The Call to Kill Adobe’s Flash in Favor of HTML5 Is Rising

Re:The Call to Kill Adobe’s Flash in Favor of HTML5 Is Rising by pyre on Tuesday July 14, 2015 @11:16AM (#9885541)

Don't most of the Chrome vulnerabilities used in pwn2own end up being Java or Flash vulnerabilities?

[ Parent | on HN ]

Re:The Call to Kill Adobe’s Flash in Favor of HTML5 Is Rising by dangerlibrary on Tuesday July 14, 2015 @11:36AM (#9885713)

Things that do more have a larger attack surface.

[ Parent | on HN ]

Re:The Call to Kill Adobe’s Flash in Favor of HTML5 Is Rising by pyre on Tuesday July 14, 2015 @02:19PM (#9886962)

Exactly. This is why the argument of "well, you can't complain about Flash/Java exploits because the browser itself also has exploits too" is not valid. By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole.

[ Parent | on HN ]

Re:The Call to Kill Adobe’s Flash in Favor of HTML5 Is Rising by Silhouette on Tuesday July 14, 2015 @02:27PM (#9887020)

By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole.

By adding HTML5 video and now its DRM-related infrastructure, WebGL, and other features that developers used to use Flash/Java for, you are also increasing the attack surface of the browser "package" as a whole. The comparison is a perfectly reasonable one.

[ Parent | on HN ]

Re:The Call to Kill Adobe’s Flash in Favor of HTML5 Is Rising by pyre on Tuesday July 14, 2015 @04:23PM (#9887771)

On the other hand, those will be separate implementations on different browsers, so it reduces the applicability of any one exploit. An exploit in Flash or Java becomes cross-browser.

[ Parent | on HN ]

Re:The Call to Kill Adobe’s Flash in Favor of HTML5 Is Rising by Silhouette on Tuesday July 14, 2015 @08:11PM (#9888958)

On the other hand, those will be separate implementations on different browsers

Unless more than one browser uses, say, the same video codecs, or the same third-party DRM-related module, or the same system services for doing hardware-accelerated 3D rendering.

There may be some marginal advantage to having different implementations in different browsers, but marginal is probably all it is. Realistically, as things we used to do in the likes of Flash or Java move into browser-native implementations, there is still no reason to assume that the people writing those implementations will magically produce completely secure implementations where no-one ever has before.

[ Parent | on HN ]