Sandboxed Flash Player Coming To Firefox 86
Trailrunner7 writes "Adobe, which has spent the last few years trying to dig out of a deep hole of vulnerabilities and buggy code, is making a major change to Flash, adding a sandbox to the version of the player that runs in Firefox. The sandbox is designed to prevent many common exploit techniques against Flash. The move by Adobe comes roughly a year after the company added a sandbox to Flash for Google Chrome. Flash, which is perhaps the most widely deployed piece of software on the Internet, has been a common attack vector for several years now, and the attacks in some cases have been used to get around exploit mitigations added by the browser vendors. The sandbox is designed to prevent many of these attacks by not allowing exploits against Flash to break out into the browser itself."
'bout time! (Score:2, Insightful)
Its about damn time they did this for Firefox. I don't know how many times Flash has caused my browser to crash and I couldn't do anything about it. I love how in Chrome only the Flash player dies and not the browser.
Re:'bout time! (Score:5, Informative)
Re: (Score:2, Informative)
Open about:config
Search for "dom.ipc.plugins.timeoutSecs"
Change it (from 45!) to 10 or 5.
This should (hopefully) force Flash to crash faster, be careful if the PC is really slow though as clicking buttons that cause some sort of slow calculation to happen may crash the applet on you.
Nope (Score:2)
Re:'bout time! (Score:5, Informative)
Switching from on-board to usb audio on windows 7 reliably hangs flash for me.
However, you CAN do something about it! Find the right plugin-container.exe process (usually easy because it's the one taking hundreds of megabytes) and kill it. Firefox will now resume and give you the "your plugin has crashed" screen wherever flash was embedded previously.
Re:'bout time! (Score:4, Interesting)
Chrome Already sandboxes Flash, but only if you turn it on, and only in the DEV branch (Version 17 is current dev version as of this writing).
You can turn it on as explained here: https://plus.google.com/u/0/116560594978217291380/posts/CJvbAMkBiNf [google.com]
Comment removed (Score:5, Informative)
Re: (Score:2)
Also, that isn't going to work for Chromium because it requires the custom version of Flash that comes with Google Chrome, and there's no way to obtain and install that custom Flash plugin if you're a Chromium user - you have to download the none-Chrome version of Flash from Adobe, though chances are if you use Windows and aren't paying close attention that'll try and install Google Chrome too!
In fact, I'm not sure that Chromium can sandbox the Flash plugin at all.
Here's my hope. (Score:5, Insightful)
Maybe sandboxing the damn flash player will stop it from periodically causing Firefox to hang for 30 seconds or so thanks to some damn ugly "full motion video" ad that's trying to load up?
I'd love to see a ban on FMV ads. Double for FMV ads that start themselves automatically, and quadruple for those fucking ads that blast audio after doing so.
Re:Here's my hope. (Score:5, Informative)
I'd love to see a ban on FMV ads...
Install FlashBlock
Re: (Score:3)
Re: (Score:2)
Everyone can install flashblock. Or better yet, noscript, which also flashblocks.
Re:Here's my hope. (Score:5, Informative)
Why are you not using NoScript?
Re: (Score:1)
Seconded.
Re: (Score:2)
Even with NoScript, you're always at risk of Flash hanging Firefox if you permit it to load. I'm not one to be patient with Flash so in such cases I kill the plugin-container and Firefox comes right back (seriously, Flash is the SOLE source of Firefox hangs for me.)
What I'd like to see is Mozilla set up interactions with the plugin-container to be asynchronous so that the main Firefox thread doesn't hang when Flash kills the container. Until then, you can set dom.ipc.plugins.enabled.timeoutSecs to some supe
Re: (Score:1)
You permit "full motion video" ads to run? Damn, that's stupid. Here's how ya do it, ace. Use noscript + adblock and you'll hardly ever see anything you weren't expecting to see.
Re: (Score:2)
...and flashblock.
Re: (Score:2)
NoScript blocks Flash, there's no point in having the two installed.
Re: (Score:1)
FlashBlock keeps the web usable unlike NoScript. If you have to install just one it's a far better option.
Re: (Score:2)
Cover from XSS and clickjacking are as important if not more so than the damn audible and visual annoyance that is Flash.
I wouldn't say the Internet was worth using without NoScript, AdBlock Plus, FlashBlock, HTTPS Everywhere and Password Hasher.
This is why I stick with Firefox, even though I know it has problems. Running it in SandBoxie is a must for me on Windows.br
Re: (Score:2)
Re: (Score:2)
But NoScript already blocks Flash (and all other plugins), why install both?
Re: (Score:2)
Some dickheads use Flash for their menus, which can be enabled separately from the ads and videos if the site is important enough to stay on.
Re: (Score:3, Informative)
Re:Here's my hope. (Score:4, Insightful)
Re: (Score:3)
I tried NoScript for a week and had to give up. When a site is loading 20 JS includes, how do you know which ones to allow for functionallity, and which ones are trackers and ad-servers?
Block them all!
Only you can't block them all as that often blocks content. That was probably the final straw for me - the blocked content - Google showed me a page I needed, and yet after loading the page, only the H1 headers were displayed, as the rest was generated by JS. That fails the "Dad test" ever
Re: (Score:1)
Anyone who thinks "browsing experience" is a legitimate phrase should not be listened to.
Re:Here's my hope. (Score:5, Interesting)
Funny how my mac using artist girlfriend has no problems whatsoever with that "usability nightmare". Since she discovered it (on her own, no software evangelism in this household), she regularly comments on how awful the internet is when she has to use it without NoScript. THAT is the real usability nightmare.
Re: (Score:2)
If "the browsing experience" is a euphemism for "full-screen ad overlays you have to click through" and "crap popping up when you incidentally mouse over a random word" then I'm happy to break it...
Re: (Score:2)
No, it's a euphemism for things like CAPTCHA boxes, UBB shortcut windows, and lots of login scripts on sites that have comment systems, possibly even the one you're using now. I just stick with AdBlock and Flashblock, and I'm perfectly happy with my experience.
Re: (Score:2)
Re: (Score:3)
Why are you not using NoScript?
Can't answer on his behalf, but I don't use NoScript because it breaks virtually every site on the Web by default.
Re: (Score:3)
Here's an easy solution: remove Flash from your system.
Ad Block? (Score:2)
Come on, ad block!!
Re: (Score:2)
The ones that piss me off the most are the ones on NFL.com pages for live games that play in the same window the game updates will be displayed in. You can't block them, because if you do you won't get what you're on the page for. You can't mute the audio, and nevermind skipping the fucking ad. I've almost quit using the site entirely because of it.
Whitelist (Score:5, Insightful)
The whitelist for flash is in the single digits. Most sites don't need that privilege. ... that's about it really.
Youtube, a couple of porn sites
Re: (Score:2)
We should all... (Score:1)
Look forward to the requisite performance drop and novel new glitches. Yay.
Half Way There (Score:4, Insightful)
Considering Flash's extensive use as an attack vector this is great news. I would sleep better at night though if Firefox itself was also sandboxed; in fact I'm a bit surprised you can even sandbox Flash when the browser doesn't support it.
Re: (Score:2)
Considering Flash's extensive use as an attack vector this is great news. I would sleep better at night though if Firefox itself was also sandboxed; in fact I'm a bit surprised you can even sandbox Flash when the browser doesn't support it.
What happens when a user wants to download a file (on purpose) to their home directory when the entire browser is sandboxed?
Re: (Score:3)
A sandbox can permit saving files to a single specific directory while still denying access to any other directory.
Re: (Score:3)
When a file is downloaded you can recover to the directory the browser specifies or choose another location. Leaving it inside the sandbox and running it there (keygen, trial install) gives you the opportunity to remove the whole install if it contains malware, foistware or other crap you don't want.
Re: (Score:3)
Personnally, I run firefox using a separate user account which has read permission only where it needs. (for instance, no /etc and no /home except /etc/iceweasel and /home/firefox obvisouly)
Re: (Score:2)
Yeap. Using sudo it's very easy to set that up.
Comment removed (Score:5, Funny)
Re: (Score:1)
Wrong, wrong, wrong.
OpenSSH, the OpenBSD kernel, and other extremely secure pieces of software are written in C, and are extremely safe. All the securest pieces of software I can think about, are in C or C++.
Flash is unstable and insecure because Adobe is lazy and doesn't care about fixing it (it is too incompetet to do so), and doesn't die just because people and websites keep using it.
A third layer of sandboxing? (Score:1)
First there's the NPAPI, then there's plugin-container, and now there's another layer?
Re:A third layer of sandboxing? (Score:4, Informative)
NPAPI is just an API, not a sandbox. plugin-container just prevents flash from taking the browser with it when it crashes randomly, it doesn't protect anything from malicious code.
Project Codename: Sieve (Score:5, Funny)
Re: (Score:1)
They bought Flash when they acquired Macromedia. They just made it much worse.
Re: (Score:3)
At best they are trivial convenience stuff to assist the marketdroids to present the sheeple with their "vision".
I DONT want marketing dweebs running poorly concieved and even more poorly implemented code on my machine, no matter how well sandboxed.
NoScript and Adblock FTW.
Re: (Score:2)
name the features.
Re: (Score:1)
I still leave it on by default here, but thats the first thing to check when anyone complains their pdf file wont open.
Re: (Score:1)
Why is this downvoted? There's a very valid point being made here: flash needs to be dropped once and for all.
Wow this is awesome! (Score:1)
Firefox Dev Tools (Score:1)
Its about time (Score:3)
My cat has been trying to bury Flash for years.
what about ie? (Score:2)
subject says it all, really. it's nice to have it for chrome and firefox, but where it's really needed is in ie.
cave paintings (Score:2)
Does it run on linux? (Score:2)
Seems like the most obvious question but does this run on Linux? Also, does Gnash, or any other free implementation of the flash plugin offer this too?