News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by FeepingCreature on Thursday December 18, 2025 @03:05PM (#46317909)
If only there was a widely used vector format that had script support and also decades of work on maintaining a battle-tested security layer around it with regular updates on a faster release cycle than your browser. That'd be crazy. Sure would suck if we killed it because we didn't want to bother maintaining it anymore.

(Yes I'm still salty about Flash.)

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by JoshTriplett on Thursday December 18, 2025 @03:18PM (#46318092)
> because we didn't want to bother maintaining it anymore

That wasn't the only reason. Flash was also proprietary, and opaque, and single-vendor, among many other problems with it.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by lambdaone on Thursday December 18, 2025 @03:07PM (#46317934)
SVG without <script> would do just fine.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by naasking on Friday December 19, 2025 @03:09PM (#46330304)
SVG also supports event attributes, so you should probably strip those too.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by ajross on Thursday December 18, 2025 @03:56PM (#46318596)
Uh... Flash was a genuine firehose of security flaws. I mean, yeah, they patched them. So "battle tested security layer" isn't wrong in a technical sense. But, yikes, no.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by acheron on Thursday December 18, 2025 @06:09PM (#46320107)
The Flash revisionism I see around here occasionally is bizarre.

No, Flash was terrible and killing it was good.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by FeepingCreature on Thursday December 18, 2025 @07:13PM (#46320692)
I think it depends on whether you see Flash as competing with webvideo or with downloadable executables.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by RulerOf on Thursday December 18, 2025 @08:35PM (#46321299)
It was terrible from a security POV, but the tooling was superb.

I remember my teenage friends creating things with flash in a way that doesn't happen on the modern web.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by ajross on Thursday December 18, 2025 @08:52PM (#46321410)
Sure, but that's because the media and forums change, not so much a point about tool capability. The equivalent of teenaged geeks hacking on flash games today is influencer wannabes editting trends in CapCut. If anything content production is far more accessible now than in the 90's.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by Blackthorn on Thursday December 18, 2025 @09:51PM (#46321793)
There is artistically no equivalent to Flash ever since it died. Nothing else has allowed someone with artistic skills but no programming skills to create animations and games to the same degree and with the same ease.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by ajross on Thursday December 18, 2025 @11:25PM (#46322255)
I'd say Roblox is absolutely filling that market need. And as mentioned elsewhere, the "animations and games" demographic has moved on in the intervening decades to social media, and tools like CapCut make creating online content easier than it ever has been.

Honestly I think a lot of the Flash mania is just middle aged nerds fondly remembering their youth. The actual tool was a flash in the pan, and part of a much more complicated history of online content production. And the world is doing just fine without it.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by johnny22 on Thursday December 18, 2025 @10:18PM (#46321944)
what is missing was a replacement for the flash editor itself, not the format.
[ Parent | on HN ]