Adobe Hopes Pop-up Warnings Will Stop Office-Borne Flash Attacks 125
tsamsoniw writes "In the wake of the most recent zero-day attacks exploiting Flash Player, Adobe claims that it's worked hard to make Player secure — and that most SWF exploits stem from users opening infected Office docs attached to emails. The company has a solution, though: A forthcoming version of Flash Player will detect when it's being launched from Office and will present users with a dialog box with vague warnings of a potential threat."
Separate the code and the data (Score:5, Insightful)
This is why your data should not be executable.
Re:Separate the code and the data (Score:5, Insightful)
People want convenience. And convenience is the mortal enemy of security.
Re:Separate the code and the data (Score:5, Interesting)
WTF is so convenient about having Word being able to display Flash content?
Do a significant/noticeable number of people embed Flash content in their Word documents?
How about Flash just preventing itself from running in non-browsers [and maybe their standalone Flash app]?
Re:Separate the code and the data (Score:4, Insightful)
WTF is so convenient about having Word being able to display Flash content?
Do a significant/noticeable number of people embed Flash content in their Word documents?
The number of people actually doing this for legitimate reasons is probably very small. The problem is, companies like Microsoft and Adobe must constantly release new versions of their software in order to keep a constant revenue stream. And that means constantly adding new "features" of questionable value.
Re:Separate the code and the data (Score:5, Informative)
While that may be true for flash specifically, the number of people who embed complex programming scripts into word documents is incredibly large. I've never worked for a company which didn't have some bizarre use for it.
A small Pizza joint used a complicated array of javascript to automate their ledgers which were kept in an excel file rather than an accounting program.
A biscuit factory I worked for actually managed to turn a very large collection of excel files into a rudimentary database with an insanely complicated set of scripts embedded in each file. This surprisingly worked, though you pushed a button and it would open many files in excel at once and the computer ground to a halt while computing the necessary ingredients for the next batch.
Now I work for a large fortune 500 company and every word document is embedded with complicated scripting to automagically update footers and synchronise with a 3rd party document management system.
While I haven't seen flash specifically it is not at fault here security wise, embedding programming languages into content files is, and that is incredibly common.
Re: (Score:2)
Excel technically is an accounting program, spreadsheets were first created to do double entry book keeping.
It's better than most the other uses I've seen for it, like excel based databases.
Re:Separate the code and the data (Score:4, Insightful)
Re: (Score:3)
I could not disagree more. An off-the-shelf program is very often a perfectly adequate tool for the job and has all the features you want. Most small businesses need the same things to do their accounting and only need slight customization within the range of what standard programs can be easily configured to do.
It's easy to find somebody to explain how to use it or set up your custom installation. And your data will all be in a standard format. If later on you decide that LitteWare Accounting doesn't f
Re:Separate the code and the data (Score:5, Interesting)
Re: (Score:1)
Re: (Score:2, Insightful)
Re: (Score:3)
Word can be Pwned by an image, an embedded spreadsheet, a document template...
Exactly. Add to that the fact that any jackass who's learned to click on "Developer" can create a macro. I recall one horrible Word macro provided to our company from a customer (this is in the DoD world, where all sorts of 'mandatory forms' are passed around). The concept was stupid enough: when this document template was opened, an autorun macro created an extra Menu item (back in the heavenly days before the cursed Ribbon) full of special macro-backed commands we had to use to fill the Word doc with h
Re: (Score:2)
People want convenience. And convenience is the mortal enemy of security.
I thought being cheaper was the mortal enemy of convenience.
For example, "convenience" stores are only convenient because they are closer, not because they sell stuff at twice the price of grocery stores.
But then I can see your point, because the convenience store doesn't hire a security guard, while the grocery store usually has 1 or 2.
So yes, I guess your correct.
Re:Separate the code and the data (Score:5, Funny)
This is why your data should not be executable.
I'm trying to figure out what possible reason to have Flash embeddable inside an Office document someone might have. Maybe you could argue that it's worth being able to embed in a PowerPoint slide, but even that is reaching.
A forthcoming version of Flash Player will detect when it's being launched from Office and will present users with a dialog box with vague warnings of a potential threat.
I think a better solution is to disable Flash entirely* when run from an Office document and instead display a message that says:
"Flash has been disabled. To enable Flash content, contact your system administrator and he will come back there and hit you on the head with a tack hammer 'cause you are a retard [youtube.com]."
* of course with the obligatory registry-key-bypass for corporate users
Re:Separate the code and the data (Score:4, Funny)
Re: (Score:2)
+100. Any Office program, any browser, anything else with embeddable content: the developer should default programmed content OFF until the user manually turns it on.
Which they will (all the virus has to do is promise them Britney Bewbs or whatever...)
Re: (Score:3)
And, this is why Adobe should have removed the ability of Flash to expand randomly to trick the user into clicking on something they clearly didn't want to click on in the first place.
Well, not Adobe, that's why Macromedia should have done it and why webmasters shouldn't be doing it.
Oh god, this is marked insightful (Score:3, Informative)
Re: (Score:2)
Clever move (Score:4, Insightful)
Yeah!. Since the average user totally understands the situation, that "vague warnings of a potential threat" will, obviously, solve the problem. Pure genius.
Re: (Score:2, Informative)
The "vague" warning on Office 2008 or earlier is below. The default is do not allow content to play. It's inline with other generic warnings so let's try to keep the FUD to a minimum.
Also, Office 2010 has a Protected Mode sandbox. If it's from the Internet or Untrusted Zone the Protected View feature prevents it from running by default.
"This document contains embedded content that may be harmful to your computer.
Choose from one of the following options:
- Do not allow content to play (Recommended).
- I recogn
Re: (Score:2)
Which gets blindly clicked thru since they see that pop up dozens of times a day.
I am a fan of microsoft up until after win xp, but UAC and the effing annoyance it causes with legit apps was definitely not the way to go to improve security.
Re: (Score:1)
no. win 2000 did not have them.
And it does have nothing to do with the office package but with the system.
Re: (Score:2)
Re: (Score:1)
Of course it solves the problem...for Adobe. Just like ActiveX warnings solved the problem for MS or UAC solved the problem for MS. Instead of fundamentally fixing a broken system by removing or mitigating all the attack issues, the onus is put on the user to make the correct choice up front by giving very vague information on just precisely might happen without any possibility to mitigate or revert what actually happens. Hence not even a genius could make the correct choice because there's often too lit
Re:Just remove Flash from office machines (Score:4, Insightful)
There's absolutely no reason to have Flash installed on machines in an office. Remove it and give the users regular accounts so it can't be re-installed, and you'll be fine.
Except of course, for the web-based trainings that employees have to take that rely on Flash.
Re: (Score:2)
Except of course, for the web-based trainings that employees have to take that rely on Flash.
Web-based training is a virus. It both decreases productivity and makes users unhappy.
Re:Just remove Flash from office machines (Score:4, Insightful)
Except of course, for the web-based trainings that employees have to take that rely on Flash.
Web-based training is a virus. It both decreases productivity and makes users unhappy.
No arguments here, but tell that to the state of California that requires 2 hours of sexual harassment training for all workers that supervise other employees. The training itself decreases productivity and makes users unhappy, making it web based doesn't make it moreso. A least I can browse the web while clicking through the tedious training with "quizes" with answers that anyone with a modicum of common sense can answer.
Re: (Score:1)
There's absolutely no reason to have Flash installed on machines in an office.
Slow down there, that's not really fair. Considering that not all offices in the world perform the same work, generalizing that Flash is of no use in any office is sort of counter productive. Flash may be losing its ubiquity, but I can still think of a number of practical uses that aren't cat videos and games.
Re: (Score:1)
Slow down there, that's not really fair. Considering that not all offices in the world perform the same work, generalizing that Flash is of no use in any office is sort of counter productive. Flash may be losing its ubiquity, but I can still think of a number of practical uses that aren't cat videos and games.
Genuinely interested... what would you use Flash for in an office? Not counting people who develop Flash games for work, since they ought to be clueful enough not to get pwned.
Re:Just remove Flash from office machines (Score:5, Informative)
Genuinely interested... what would you use Flash for in an office? Not counting people who develop Flash games for work, since they ought to be clueful enough not to get pwned.
At least in the medical field, every damned 'training' company, every manufacturer, every news site uses Flash. And uses it poorly. But it's not going away any time soon.
Re: (Score:2)
Nearly every rapid e-learning authoring tool creates Flash output. It's easy for people who develop training but have no experience in developing multimedia. It can be created by a novice with PowerPoint skills then tweaked by someone skilled in javascript or actionscript.
Mind you, the entire industry is not "in bed" with Flash...they are using the tool that works for them and are mostly oblivious to the technology in the background. All they know is they can make their training in Captivate, Articulate, wh
Re: (Score:2)
Of couse the expectation quickly became that a 'modern; OS was primarily used as a toy, i.e. Mac OS was inferior to MS windows beca
Re: (Score:1)
Re: (Score:3)
Re: (Score:2)
The Davidsons did very well indeed. They used their profits from Math Blaster to buy a little videogame company called Silicon & Synapse.
Re: (Score:2)
Re: (Score:2)
But at least he wasn't Granny Smith.
slaps head (Score:2)
have you heard of 'flashback'?
Re: (Score:3)
I said that once, then got a stern talking to when one of the partners couldn't watch a video of a dog walking on it's front legs peeing on everything.
You are right, but how do you convince those in charge of it?
I had another place that made their company website so it would only work correctly on internet explorer. The web designer said it come stock on 98% of all computers so it was enough. I solved that issue by telling the CFO to try to surf it on his Iphone and then asked why they would have features f
Re: (Score:3)
It's a moot point because MS decided to hide the file extension from the user and let the file contain the icon for the file.
Re: (Score:3)
what a great idea for a virus (Score:3)
Warning: Adobe has detected this file may be infected. Click here to report this to Corporate IT security and secure your workstation.
Re: (Score:2)
Warning: Adobe has detected this file may be infected. Click here to report this to Corporate IT security and secure your workstation.
Does it uninstall Flash, then?
aaand it won't help much (Score:5, Insightful)
"So what's wrong with it?"
"You have the latest flash virus. Have you opened any Word documents lately?"
"Of course! I use Word all day."
(scans hdd, finds the one in email that started it)
"Did you open this?"
"Of course I did. It's the weekly report."
"Didn't it WARN you there may be a virus?"
"Yes it opened up a box I hadn't seen before. But I needed to see the report, so I clicked the Open Anyway button."
"Didn't you get the memo last week about not clicking Open Anyway?"
"Of course I read the memo. But I need to read that report. I had to open it."
aaaand this is why this doesn't work anywhere near as well as Adobe says it will. No matter how many times you tell them to call you and NOT open it anyway, they still will. And you'll be at her desk again. Maybe later today even. Because she opened it anyway, because she "had to". (speaking from experience here)
The only reasonably effective way to implement this is with a policy that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)
Re:aaand it won't help much (Score:4, Insightful)
People sometimes don't realize that people they know may be sending malware (not on purpose), or that someone may be pretending to be people they know. Just because the email is from the head of your church committee doesn't mean it's safe to open the "look at these kitties!" file.
Some people also just click yes to everything. I was helping my mother figure out some new problem on Firefox, which involves telling her the names of a particular menu to choose and the like. And I couldn't figure out why she wasn't find the menus or buttons I was talking about. Then I realized she had updated her Firefox whenever it popped up and said "hey, please update me!", and now she had a UI she was unfamiliar with. This also means she occasionally ends up with google bars or yahoo bars or something else stupid that I have to uninstall every time I visit.
It's not just mothers that do this, I see professionals in the office doing the same thing.
Re: (Score:2)
Sometimes you get people who only care about getting their job done. I had to deal with a couple that flat out told me they didn't care if it had a virus in it or not, they needed to open it, and come hell or high water, they were going to open it. Sort of a "reports are my job, dealing with viruses is your job" kind of attitude.
And then the virus traffic detection tags the machine and tells the switch to turn off her port and we get lots of waaaaah.
dealing with viruses is your job (Score:4, Insightful)
welcome to corporate america, you are responsible for shit you have no way to control or to fix.
just like everyone else.
those people who have to open those reports are in the same boat as you. if they dont open the report, then xyz doesnt get done, then a shit storm rolls down the hill and destroys the entire department.
Re: (Score:2)
Re: (Score:1)
Usually you get people - quite intelligent, technical, well educated and experience people - who still can't understand why you don't click on the "Stop sending this spam" link in spam,
No, those are not intelligent people (or you aren't.) Forget all the other adjectives. If someone cannot comprehend that clicking a link in an email can provide information to a spammer after your explanation then there's something wrong with one of you.
or why they can't have the "Yahoo toolbar" browser add-on installed by some app they downloaded from a some random download portal on the Internet with uncertain provenance
Again, either they're stupid or your explanation is poor.
But then you have C level executives who don't understand reply-all either also.
They just don't care enough to understand. And frankly I've run into that with a lot of people who are supposedly intelligent. They have decided that something isn't their job and therefore they should
Re: (Score:2)
Enable Remote Desktop on your mom's PC. It's not as insecure as people claim, if you do it right.
Re: (Score:2)
It's not just mothers that do this, I see professionals in the office doing the same thing.
It's sad you have to point it out before people can see it as sexist. The geek community here didn't used to be quite like that. There were trolls of course, but lately it's become prevalent even in otherwise perfectly good comments... :(
Re: (Score:1)
that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)
Sure. Activate this. 10seconds to the first call of a user "ordering" you to reactivate it, because he/she need's it, 30seconds until your boss get's a call from him/her cause you refused it, 60seconds 'til the department head get's a call from his/her boss, ordering your boss to order you to reenable it.
Re: (Score:2)
that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)
Sure. Activate this.
10 seconds to the first call of a user "ordering" you to reactivate it, because he/she need's it,
30 seconds until your boss get's a call from him/her cause you refused it,
60 seconds 'til the department head get's a call from his/her boss, ordering your boss to order you to reenable it.
You're exactly right, and that's because of the real problem: Word cannot tell if something in a document is malicious or not, so it will display the warning message for all content of that particular type, even if it is perfectly legitimate. And so you are left with an all or nothing choice --
(1) Let people open the documents and take your chances
or
(2) Don't allow users to open ANY document which contains that particular type of content (are you ABSOLUTELY SURE that NOBODY in your company is producing doc
Re: (Score:2)
Which is why these applications need administrator-level permissions that let you prevent those warning and instead show an error message (without an "ok" button).
Better yet, corporations could wake up and start demanding their software and infrastructure stop requiring the use of flash player to access their services.
Re:aaand it won't help much (Score:4, Interesting)
Here's the real version of that conversation:
"So what's wrong with it?"
"You have the latest flash virus. Have you opened any Word documents lately?"
"Of course! I use Word all day."
(scans hdd, finds the one in email that started it)
"Did you open this?"
"Of course I did. It's the weekly report."
"Didn't it WARN you there may be a virus?"
"No"
"I'm pretty sure it popped up and warned you about the security implications of opening documents containing flash applets from untrusted sources"
"What does that mean?"
"It means it warned you about a possible virus"
"Oh, well stuff pops up all the time and I just click OK so the computer will work. Sometimes it pops up again so I click Cancel"
Users are bombarded with dialog boxes, permission boxes, info bars, tray notifications, software update notifications, and so forth all day long. They don't read them, they just click YES/OK. If it pops up again, they try CANCEL (even if the text is different - remember they don't read it!)
That's why IE's ActiveX scheme was a massive failure - it relied on users to know what ActiveX was, know what digital certificates were, then make an informed security decision for each and every control that wanted to install. Even if the native code execution wasn't a huge hole all by itself the whole scheme is a massive failure because most users don't know what ActiveX is, wouldn't know how to verify a certificate if they wanted to, and can't control what the control does after it's installed.
This is also why Android is a huge security fail. It relies on the user to understand what the permissions mean and what the consequences are at the time of install. Even if you understood exactly what those 18 permissions were (including scrolling down to expand the list and finding identically named permissions but with slightly different detail text under them)... you can't enable-disable them if you decide the app shouldn't have some of them. Should App X be able to modify or delete USB storage? maybe... depends on what it wants to do! Should it be able to make phone calls or send text messages? Maybe... too bad you won't be asked about it when it signs you up for $9.99/mo SMS services. What about manage accounts? Maybe the app wants to legitimately manage accounts... or maybe it will delete your entire google account. Who knows, but you sure won't be prompted about it.
Any system that relies on the user to make potentially dangerous security decisions is an automatic failure; doubly so if the decision is irreversible and persistent for all time (which covers the vast majority of security systems in use today).
I'm almost certain that in the future we'll grant permissions to different apps and websites by answering at the time the app wants access to the resource, not forever. Further I think the system will want to keep a history (think git, but for the entire filesystem), allowing you to effectively "roll back" a bad security decision. That probably means browsers and apps all run isolated in their own OS-provided VM/sandbox and all sharing or filesystem access routes through the version control system.
Re: (Score:2)
I'm almost certain that in the future we'll grant permissions to different apps and websites by answering at the time the app wants access to the resource, not forever.
Like UAC's wonderfully helpful popups, you mean?
'Application Hello Kitty Screensaver wants to: Access Hard Disk. Allow/Deny?'
Yeah, that's going to make life much easier for Joe Know-Nothing to avoid malware. They'll click yes to everything, then disable it after ten minutes because it's popping up all the time.
The only way it can work is to sandbox every app so it can't infect any files but its own. Even then, it also needs a network sandbox so it can't connect to arbitrary network services.
Re: (Score:2)
The technical term for it is dancing pigs [wikipedia.org] (or Dancing Rabbits).
The premise is that any security that relies on getting in the user's way of a task will be promptly bypassed. The user will always choose dancing rabbits/pig
Re: (Score:2)
This is exactly what I was going to post, I searched to see if anyone had posted the dancing rabbits problem yet and there it is.
If you leave it up to the user to decide whether or or not to bypass the security protocols, then you have no security protocol. It's like getting the most secure door installed on your house but allowing your 4 year old to open the door to strangers.
Re: (Score:2)
"And now you need to be out of commission for at least an hour so we can fix your computer that you broke. I'm sure your manager will understand."
Re: (Score:2)
Re: (Score:2)
I dunno, that might be NSFW ?
Re: (Score:2)
Did it occur to you that maybe she did actually need to open the weekly reports and that the policy was not fit for purpose? The story seems intended to imply the ignorance of the user but I'm left questioning the ignorance of the IT guy.
Re: (Score:2)
Deal with psychopaths much do you? It's not healthy to have that many cope-links on hotkey.
"Just show me auntie's e-card!" (Score:3, Interesting)
"This document contains macros which may harm your computer. Do you wish to allow them to run?" (Clicks "Yes" blindly.)
Some (or maybe all...IDK) Word documents that were actually templates contained macros in the absence of an actual wizard. This meant that in versions of Office that recognized the security hazard, you got a pop-up before the document actually opened. I personally clicked "Yes" or "Open Anyway" or "Allow" or whatever it said without even bothering to read it because I usually got the document from a trusted source (as in someone I trust, not someone a company/corporation trusts using an actual whitelist/blacklist). I presume many got tired of seeing the message as I did, and they did the same thing. Similar events will probably happen with this Flash issue. Your aunt sent you an e-card for your birthday from her virus-infested computer? Sweet! Allowed!
And before people ask, yes I was speaking in the past tense. I no longer use Microsoft Office, in favor of Google Drive's Office-like features that started out as "Google Docs & Spreadsheets". It may not be as full-featured, but I don't need it to be either.
Re:"Just show me auntie's e-card!" (Score:5, Informative)
Macro viruses were annoying also. For awhile Word/Excel gave you only one check box in security prefs, to pop a dialog when a document contained macros. (you could not disable them, only turn on the dialog)
Then when the user opened a doc with a macro (or more often, a virus) it would pop and give just TWO options... (A) open and run macros, or (B) do not open.
Gotta love microsoft for that one. Took them insane ages to add the (C) Open with macros disabled. Until then we had to deal with the "but I HAD to open it" people. But then I could continue to bash on them for not having a "flush macros" button anywhere, and the ability to create a "hidden" macro, and every macro virus creator's all-time-favorites, the "run on open" and "copy macro to other closed document" options. But that's drifting somewhat OT.
Better answer... (Score:2)
Stop allowing Flash to be embedded in things like Word documents and PDF files.
I have yet to see a single valid use of Flash in PDF or other document formats that couldn't be done as a web page instead.
Re: (Score:2)
Stop allowing Flash to be embedded in things like Word documents and PDF files. .
This is the correct answer. Yes, Adobe needs to get their shit together and stop producing software with new security flaws being discovered almost daily. But what about Microsoft's responsibility? Flash embedded in a Word document? What.The.Fuck
Re: (Score:3)
Well, didn't MS pretty much invent documents as an attack vector. Perhaps my memory isn't so good, but the first cases I remember of that were for Word.
Re: (Score:2)
But what about Microsoft's responsibility? Flash embedded in a Word document?
Yeah, not to mention the idiotic capability to embed entire Office documents inside other Office docs. I knew people who thought this was far better than, say, a nice zip archive. I used to get even by doing helpful things like converting a Word doc to PDF (try opening that embedded spreadsheet NOW, Dr. Doom!), or embedding a PowerPoint doc in a Word doc., embedding that Word doc in an Exel workbook, etc. in an EmbeddedTurtles Allthe Way Down sequence, and giving that back to them.
Meanwhile Gnash (Score:4, Interesting)
Meanwhile Gnash supports Youtube just fine, which remains Flash's sole legitimate use.
It even supports audio out of the box.
Re: (Score:2)
Is it demonstrably more secure? Or is it just too obscure for anybody to target?
Re: (Score:2)
I don't have an authoritative answer, but Chromium keeps telling me Adobe Flash is out of date with its bright yellow Load Anyway dialogue. I see that bar on a lot of sites which should not have any reason to use SWF, even though adblock removes the worst offenders.
Re: (Score:2)
I don't have an authoritative answer, but Chromium keeps telling me Adobe Flash is out of date with its bright yellow Load Anyway dialogue. I see that bar on a lot of sites which should not have any reason to use SWF, even though adblock removes the worst offenders.
Flash is often embedded in web pages with no UI in order to implement "super cookies" (LSO's or Local Shared Objects) in order to be able to track you even if you have cookies disabled, since people want to be able to see their videos. So they leave Flash enabled.
The workaround for the user is to install something like "ClickToFlash", but that can get annoying pretty fast, especially on sites like abc.com or cbs.com, which have very short timeouts on reading the data back out, and so claim you have flash d
Re: (Score:2)
You can deal with super cookies by using an add-on like FF's BetterPrivacy.
Even more basically, you can make Flash's hidden .adobe and .macromedia folders read-only.
Re: (Score:2)
...and that's when you use something like BetterPrivacy (in Firefox at least). http://fixtracking.com/ [fixtracking.com]
Re: (Score:2)
It's definitely the latter. It's pretty easy to find bugs in Gnash. However due to the obscurity of Gnash itself combined with the diversity of the platforms that Gnash runs on, Flash is a much more interesting target for attackers.
Re: (Score:3)
Youtube [...] remains Flash's sole legitimate use.
Is there a reason that you feel that showing web animations (such as Homestar Runner or animutations) without converting to MP4 and thereby bloating the download size by a factor of 10 is not "legitimate"
Re: (Score:2)
Are you saying that you'll play those legitimate animations written in ActionScript (a flavor of ECMAScript) in a Flash format outside of a web browser that already supports JavaScript (a flavor of ECMAScript) and Vector Graphics? Adobe hates Flash. They make money making tools that create flash content, and they would MUCH rather simply sell the same tools and generate HTML5 content with them instead. Same revenue, no cost to maintain the "player" becuase it's in the damn browser. You can even embed J
Re: (Score:2)
Are you saying that you'll play those legitimate animations written in ActionScript (a flavor of ECMAScript) in a Flash format outside of a web browser that already supports JavaScript (a flavor of ECMAScript) and Vector Graphics?
Solve these three issues and I'll consider joining you in bashing Flash:
Re: (Score:2)
Even better, join the youtube html5 trial, no flash needed (I don't think though it works for all the videos yet): http://www.youtube.com/html5 [youtube.com]
Re: (Score:3)
Says "...currently our video library can only be watched from within the United States." Can't be bothered to find a local TOR exit...
A solution... (Score:2)
to the problem of liability.
Minitube does not use the Flash Player (Score:2, Informative)
http://flavio.tordini.org/minitube [tordini.org]
Linux, Mac OS X, Windows
"Light on your computer. By consuming less CPU, Minitube preserves battery life and keeps your laptop cool. That's because Minitube does not use the Flash Player.
High Definition. Minitube plays HD videos up to 1080p. Go full-screen and watch them play smoothly.
1-Click Downloads. Download your favorite clips to your computer and put them on your portable device. Downloaded files are in MPEG4 format which is compatible with most devices, including Appl
Re: (Score:2)
Where are the 64 bit binaries? But more importantly, where is the source code?
Re: (Score:2, Informative)
for Linux - it should be posted on their site.
Even more importantly, where is the source code for Adobe Flash?
Yes another popup message is the fix! (Score:3, Insightful)
Re: (Score:1)
"Warning: Smoking Adobe/Microsoft/Apple/etc products has been shown that it may increase the chances of cancer and hallucinations about said software being good."
Sounds about right.
Office 2008? (Score:2)
Refer to Office 2008 then post a Windows screenshot? Par for the course I suppose.
And fluffy bunnies (Score:3)
* Hopes popup warnings will stop * attacks (Score:5, Insightful)
Sorry.
It doesn't happen that way.
It just doesn't.
They tried this with browsers. It was egregiously cumbersome and conditioned people to auto-click YES to everything.
They tried this with Windows. It's still egregiously cumbersome and is still just conditioning people to blindly auto-click YES to everything.
So...NOW...they're adding MORE crap to click YES automatically to?
Third time's the charm?
FUCK NO!
Three strikes and you're out fuckers!
Warning popups prevent a small amount of infestations up front.
HOWEVER, down the road, as people get conditioned to the popups, they just click past without looking. Because the popups ARE IN THEIR WAY.
Adding a stupid popup is basically an admission that they're too goddamn stupid or lazy (or both) to secure their software properly. Or that their software is, inherently not secure or not able to BE secured.
At which point, it's crap that needs to be replaced with a better solution. Even if it means giving up the convenience of "Well this works right now".
Noscript (Score:3)
I use noscript.
A site has to be really important to me for me to activate plugins on it. If newspapers cant put in a static image but reduce all news reports to 5 lines of non-descriptive generic text and a link to a video they bought from somwhere, i dont need that.
Re: (Score:2)
I use noscript.
Where do you get Noscript for Microsoft Office?
How About Killing E-Mail Attachments Altogether? (Score:2)
This is an idea I had just now, could be completely useless, impossible to get users to adapt to, and would just shift the problem from one domain to another, but here goes anyway: How about we do away with e-mail attachments? Adapt a policy that forbids any e-mail attachments from being downloaded, period (sorry, people who feel the need to include a fancy e-mail signature image, guess you'll just to have to use boring text). Obligate employees, etc. to retrieve files from another source outside of e-mail.
Re: (Score:1)
Re: (Score:2)
Why do we want Flash outside of browsers, anyway? (Score:2)