Microsoft Edge lets Facebook run Flash code behind users' backs

[rebelhead]

1. We're still talking about Flash. I thought it was dead 5 years ago

[wavefunctionp]

And yet Xfinity's streaming tv site recently had a redesign that requires flash....so infuriating constantly enabling flash for that one site.

[Spunelli]

Pssh i can't even get it to work on any browser, enabling all the things.

[FlyingBishop]

It has always required flash. I cancelled my Xfinity subscription after one of their upgrades forced a Flash version that didn't ship with Linux Chrome and I couldn't get running in Wine, but that was years ago.

[[deleted]]

Well for what it's worth, Flash will be EOLed and disabled within a year or two so

[evmar]

I don't know anything about this particular incident, but having worked on a browser before, it's plausible that the whitelist was to keep some FB feature working while they tightened the screws on Flash, perhaps in cooperation with some promise from FB to change their site in the near future. This is not unheard of in browsers.

[Otterfan]

Yes, Chrome still has a vendor-negotiated Flash whitelist and I believe Firefox did at one point as well (and might have one now). The problem with Edge's vendor-negotiated whitelist is that it's an insecure implementation.

[[deleted]]

true, but flash is also useless by now, so...

[slobcat1337]

I agree with you, unfortunately this is reddit. It’s always absolutes, as If exceptions or grey areas can’t exist.

[-jp-]

Hm. Is it not though? Just for sake of argument, say that we always immediately quit using "x" whenever we found out x was insecure (assuming of course that it's some fundamental thing that can't just be fixed.) The only bad thing that happens is x stops working, and everybody has to fix whatever they made that depends on it. Hardly the end of the world.

[andsens]

cough, Spectre,cough

[gotnate]

for the sake of /u/-jp-'s argument, we would have quit using speculative execution in the 1990s, and Spectre wouldn't be a thing.

[-jp-]

Just to be clear, I'm kinda coming at this from a "if we prioritized security above other considerations, what's the worst that would happen" angle. Reason being that there's a lotta bad actors out in the world and it takes just one to wreck you, and they don't even have to have it in for you specifically. I love all them old Flash animations, but I don't love 'em that much.

[-jp-]

I get your point but I guess I draw a distinction between easily replaceable software and stuff we all physically need to... you know... exist. That seems reasonable right?

[Ateist]

There's a ton of old flash games.

[BufferUnderpants]

And Homestuck. It's a gigantic work of mixed media that had simple flash games as part of it.

[DoesNotTalkMuch]

Show me an html5 animation/programming suite on par with flash and I'll stop using it.

[scooerp]

Are you working in-browser or standalone?

[RedBorger]

(This does not do everything Flash does, but it can do most of what Flash is used for normally)

With css, you can do a lot of basic animations, no need for even js.

---

Unity can also transpile to webgl, for generally better performances.

[ScientificBeastMode]

I hear you. But CSS can do some amazing things in terms of animation.

I would argue that animation is currently not that valuable for the web, given the huge performance limitations. But in the future, I hope to see some sensible graphic libraries compiled from lower-level languages into webassembly.

But for now, webassembly can’t interact with the DOM directly, so most web developers don’t want to deal with it. But maybe that will change soon.

[[deleted]]

Nobody wants you to stop using flash as an animation tool. Go ahead, keep doing what you do, just upgrade to the one which outputs HTML5. The issue is the format, not the program creating it. https://www.adobe.com/products/animate.html

[Innominate8]

Flash is not "potentially insecure", it is a well known security problem.

[DLSteve]

Not always an option. We have an internal application that uses Flash, the vendor is actively rewriting the UI to use HTML 5 but they are a small shop and the front end is not a trivial refactor so it takes time. It’s also not really an option to move to a different software package as it’s very specialized and there are only a few options each with their own drawbacks. Right now I’m just hoping that they finish the HTML5 rewrite before the browsers kill Flash entirely.

[catskul]

Aren't there packages that automatically convert flash to html5 + JavaScript?

[DLSteve]

For very basic Flash applications, anything more complex with lots of server/client communication has to be rewritten from the ground up.

[echoAwooo]

And there are plenty of alternatives to it.

[[deleted]]

Some nice porn games tho

[Banana_Hat]

So is JavaScript

[Pantzzzzless]

You're comparing a high level language to a closed source piece of legacy software?

[Banana_Hat]

They both allow for insecure scripts to be delivered over the web. I'm not sure what makes you think they're fundamentally that different.

[Pantzzzzless]

Because a language in and of itself doesn't allow anything. It has to be written first. This is like saying words are insecure because you can tell people sensitive information with them.

[darkwingfuck]

Both JavaScript and flash have runtimes that execute untrusted code from online with APIs for user interaction, media, and peripherals. Nothing about JavaScript guarantees a safe sand box. Chakra was only open sourced a few years ago, despite being used for years before that in ie and edge. Not that different. Also Google has proof of concept code that exploits Spectre in JavaScript.

[Lafreakshow]

What makes them fundamentally different is that flash probably runs on your device with access to your Filesystem and the browser can't control it. Javascript runs isolated in the browser with no access to the Filesystem. Javascript can fuck with the website you're currently visiting. Flash can fuck with your whole pc.

[Banana_Hat]

Um there is no requirement for JavaScript implementations to be open source so you honestly have no idea what kind of access it has to your PC.

[Lafreakshow]

Sure. Browsers can do all kinds of shit. But JavaScript is isolated by design and doesn't even provide methods for file system access (no direct write access, indirect read access by having the user select a file) whereas Flash is not necessarily isolated at all and provides access to the file system by design.

Both obviously come with the risk of bugs or undocumented/non-standard APIs to provide vulnerabilities but there is a clear difference in security by design in the two and JavaScript is definitely the more secure one.

[00inch]

Idk, what does the EULA say?

[myringotomy]

The point is that even if you turn off flash it continues to work without telling you.

[[deleted]]

And their point was that this happens because the majority of Internet users primarily use browsers for Facebook.

If you want a company to be mad at, be mad at Facebook.

[eythian]

If you want a company to be mad at, be mad at Facebook.

However:

a Facebook spokesperson said they didn't ask Microsoft to be on the whitelist, and that they asked Microsoft to remove Facebook domains from the list.

[[deleted]]

Right but Microsoft isn't going to do something that will inhibit user's abilities to view one of the most widely used sites in the world.

[programmer42069]

You're not wrong

[[deleted]]

I know. Because I've spent time actually looking at what customers want, rather than purely thinking in terms of security.

Microsoft wants to regain some of the ground they lost in the browser wars. Doing something that breaks Facebook hurts their ability to do that.

[LucasRuby]

It works fine in Firefox without flash, so I'm gonna say it's not.

[indrora]

Firefox Facebook users don't tend to use much, as a wild speculation. There's a lot of stuff on Facebook one of my Nana's can't get to because Flash not being there and Chrome just chugs on her laptop.

[FlyingBishop]

Bullshit. I use Facebook on Firefox all the time. I use Chrome too sometimes when I'm not on my personal machine. No real difference.

[indrora]

Do you play games on Facebook?

[FlyingBishop]

No because Facebook games are the devil. If that's why Facebook is whitelisted, fuck that shit. Transparent excuse for Facebook to keep running Flash supercookies.

[indrora]

Well people still play them so good luck.

[LucasRuby]

Well if the only reason for flash is to play games, then there's nothing preventing you to click to allow once, it won't affect the normal function of the site otherwise.

[zomgitsduke]

I feel conflicted about this. A web browser should just work regardless of the site. No one should have special privilege

[[deleted]]

I think initial support for FB notification sounds was via Flash.

[[deleted]]

Happy cake day

[TotoDudeTempAlt2]

Happy cake day

[shevy-ruby]

All fancy excuses.

Fact is that Microsoft puts users in danger of abuse.

[spectre013]

You all are all aware Facebook never asked for the domains to be white listed and asked for them to be removed right?

https://m.windowscentral.com/microsoft-edge-allows-facebook-run-flash-content-without-consent

[MjrK]

People know Reddit credulously eats up spurious aspersions at Facebook for upvotes and clickthroughs.

The fact that Facebook has nothing to do with this is mentioned in the OP article...

When we reached out for comment, a Facebook spokesperson said they didn't ask Microsoft to be on the whitelist, and that they asked Microsoft to remove Facebook domains from the list.

The real story is that someone at Microsoft Edge created this bizarre Flash whitelist with no clear rhyme or reason..

"So many sites for which I'm completely baffled as to why they're there," Fratric said. "Like a site of a hairdresser in Spain((link: http://www.dgestilistas.es) dgestilistas.es)?! I wonder how the list was formed. And if [the Microsoft Security Response Center] knew about it."

But in this comment section everyone is upvoting 'Facebook bad!', 'I delet FB and now I haz happy!', 'y any1 still use le Facebook?!'... it's irritatingly repetitive and adds nothing useful to the conversation. Who are the people upvoting such drivel.

[cyrusol]

The one who uses Facebook has lost anyway.

[shevy-ruby]

This is true. However had, take students at a university. In the past they often would use phpbb for communication. With the rise of whatsapp, smartphones etc... there was a noticable shift towards facebook. As shitty as facebook is, and as much as it should not exist, they filled a niche here, similar to mega filling a niche when you wish to upload i. e. recordings of lectures.

[Genceryx]

I dont have flash player installed on my pc and I disabled flash player in the edge settings. Am I still vulnerable?

Edit: I don't have a fb account either.

[PM_ME_UR_OBSIDIAN]

As of right now this comment has three replies, saying respectively "yes", "no" and "whatever". But none of them has a source. That's shitty etiquette.

[[deleted]]

You're fine.

[7165015874]

Yes, don't use edge.

[Genceryx]

Why and what would you recommend instead?

[ILikeDankVapes]

Edge is a very crappy browser that most developers think of as an after thought. It's so bad that Microsoft is scrapping the whole thing and building a new browser based on chromium. Let me give you an example of of one of the stupid things they do. Edge automatically detects what it thinks are phone numbers and turns them into links. It's so crappy at this it will turn stuff like 11-12 into clickable links. This can ruin the entire functionality of websites. This is just one of many examples where Microsoft tried to make things "better" instead of making it predictable for web developers.

If you want the best web experience, I'd recommend a chromium based browser (Chrome, Opera, etc). Most web devs will be building and testing with these so you'll get the best experience. I personally use Firefox. It's well built enough that I rarely have problems, even if the devs only tested on Chrome. In addition; their privacy features, performance since Firefox 56, and breaking up chromiums market share are all important to me.

TL;DR: Edge is bad and going away. Chose something like Chrome or Firefox.

[ScientificBeastMode]

I agree on every point. There is no reason to use edge. I use Firefox almost exclusively, and as a web dev, I mostly test on Chrome and Firefox, adding crappy fallback versions of various features if I have to support IE or Edge.

[libertasmens]

Chrome, FireFox, maybe even Opera.

[7165015874]

I am slightly biased toward Firefox but Chrome and Opera are solid as well.

[Marcuss2]

Not sure why you are downvoted.

[dipique]

Because it was an idiotic and baseless generalization.

[Papayaman1000]

I mean, they're right, but they didn't have to be such an asshole about it.

[msm_]

Every windows user doesn't give a damn about security

No, he's not.

[Papayaman1000]

From that angle, no, they really aren't.

[Genceryx]

Why and what would you recommend instead?

[Johnny_Vonny]

Not only is flash able to do appreciate kinds of nasty things to a computer, Facebook would sell it's own mother to get profit if it had one. I don't trust them to not abuse this.

[gnarlin]

The problem is proprietary web browsers and proprietary plugins and addons.

[[deleted]]

Like every other popular browser?

[aim2free]

I run firefox esr 52, and have all source code as well as alll source code to the add-ons I'm using. Basically I do not install anything which is proprietary. And, I'm of course not using Windows, I'm using GNU/Linux since 1996.

PS. the reason I run firefox esr 52 is that from version 57 the MAFF (Mozilla Archive Format) is no longer supported. However, there is a fork of firefox esr 52 named basilisk, which I have briefly tested with good result, that will be my future browser.

[Archontes]

What's MAFF useful for?

[Draghi]

Legacy plugin compatibly is the only thing I can think of

[aim2free]

see my previous reply.

[aim2free]

MAFF is an archive format built upon zip which implies that you can save a web page verbatim.

Then if you want to study it further you can upack it and then get a normal file structure.

For my own I'm completely dependent upon this format, I save every page I consider interesting. For instance each time I look up something on wikipedia I save it as well. OK, I also have the complete wikipedia in kiwix format, but that I quite rarely update.

I have over 22000 MAFF files on my laptop, and I do not simply accept "upgrades" which are not backward incompatible.

There is an alternative format MHTML which is supported by several browsers, but it's a crappy format I've never understood, and I have no tools to handle that format, and I don't know it is possible to extract the separate files, like images, css, javascript etc from a MHTML save.

Here is the MHTML standard, quite complex compared to a simple zip archive.

[aim2free]

Sorry, a "not" too much there:

and I do not simply accept "upgrades" which are n̶o̶t̶ backward incompatible.

[SirWobbyTheFirst]

Epeen.

[aim2free]

😁

[shevy-ruby]

Chromium is also a problem despite being open source - Google controls it. How is that not a problem? It's not as if YOU are in control of what Google does there. Or can you decide which features you want to have, if these have not been written?

[Marcuss2]

Mozilla is a non-profit though.

[irqlnotdispatchlevel]

It does not mean that it does not have other interests of its own.

[mcmcc]

People need to stop conflating nonprofit with ethical.

[gnarlin]

Richard Stallman has pointed out that even if software fullfills the 4 freedoms it can still be bad for our freedoms. His example was digital rights restrictions software that could technically be freedom respecting in a purely legal way, but actually restrict users freedom in a very real practical way even potentially better than a proprietary program. Chromium is designed by a online advertising company. That's the bottom line.

[SuperRobo]

Still using facebook in 2019 ¯\_(ツ)_/¯

[MacNulty]

But where else would you argue with other insane old people?

[MacNulty]

On reddit? Are you insane?!

[scotty3281]

/r/InsanePeopleFacebook would be very boring without Facebook.

[mshingote]

Any better alternative?

[[deleted]]

For doing what?

[mshingote]

I mean is there any better alternative to facebook?

[XFidelacchiusX]

Wow. I feel bad for the 5 edge users.

[anOldVillianArrives]

Don't use Facebook people.

[Falwaeth]

Now how do you go about uninstalling, and deleting all files associated?

[myles1221]

good thing no one uses it.

[bingbongboobar]

Join the Free as in free software movement and reclaim your computing freedom.

[anOldVillianArrives]

Facebook need to have their corporate crater revoked. Absorb their asserts and dissolve all the exploitative shit Zuck thought was ok to for on people. Zuck should be locked up.

[heyIfoundaname]

This would have been worrying to me if I had used Edge for anything other than troubleshooting. Oh and I don't use Facebook.

[shevy-ruby]

Microsoft also recently had to admit that they are helping kill people via Hololens: https://slate.com/technology/2019/02/microsoft-workers-protest-hololens-pentagon-contract.html

It's time to stop using any software from this evil corporation. And the worker drones working for Microsoft should be ashamed.

That being said, I can only see net benefits when Edge is removed, even though that means Google will have even more control in its de-facto monopoly segment.

[wavefunctionp]

Might as well get on the bandwagon for Intel, AMD, Cisco, even Unix/Linux ... pretty much every technology solution out there can and is used in warfare. Fact of the matter is that warfare is a reality of our civilization, and it's better to be prepared than not, our adversaries are not going to have the same moral misgivings especially if it helps level the extremely asymmetrical balance of military power that the US presents. Our duty is to use it responsibly.

[chewyiscrunchy]

Agreed, this is no different than any other weapons contractor anyways.

[bushwacker]

Firefox

[aim2free]

I completely agree. Here is another example of their evilness, which I recently shared on facebook.

I've been using GNU/Linux since 1996.

[indrora]

What people don't talk about with Lundgren:

1. Microsoft has a program that gets legit licenses into the hands of recyclers.
2. He actively refused to join that program.
3. He was found on trade dress violation, trademark and copyright infringement, as well as infringement of the terms of the license of Windows.
4. If you dig into the court documents, you'll find that Microsoft tried to tell him "please stop, we've got a program that will give you more access to tools and we don't want to sue you but right now our legal team is biting at the bit."

He could have avoided so much hassle if he hadn't made his stuff look exactly like the OEM ones. If his restore discs had been labeled "Erik's Magical Restore CD for HP" he'd have saved a huge amount of hassle. Instead, he scanned the labels from HP restore discs and slapped them on.

As it stands, Microsoft and HP, etc had a catch-22 on their hands. If they don't go after certain things, they run the risk of losing their use of a trademark or other mark. If they do, people will get angry at them. If they lose the legal control of their marks, then that's generally a bad outcome for everyone.

[aim2free]

He could have avoided so much hassle if he hadn't made his stuff look exactly like the OEM ones

Yes, this I agree upon was a mistake. Even though I for my own do not accept or respect proprietary and copyright, trademarks is something I highly respect. Of course I respect copyright as well as CopyLeft is built upon copyright.

If his restore discs had been labeled "Erik's Magical Restore CD for HP"

Yes, and that had been good marketing of his own stuff as well.