Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   Computer Support (http://www.velocityreviews.com/forums/f33-computer-support.html)
-   -   Use Flash or Not? (http://www.velocityreviews.com/forums/t584711-use-flash-or-not.html)

DemoDisk 01-15-2008 08:42 AM

Use Flash or Not?
 

I'm trying to keep a secure machine, but I've lost track of which
Windows add-ons are dangerous and which are OK. (DivX, RealPlayer, etc.)

I just visited Bloomberg.com and got a message; "The new Bloomberg Chart
Builder requires Flash 8.0 or newer. Click here to download Flash." I
didn't.

Would you recommend Flash, and is there a site that catalogs the
baddies?

Thanks,
JPM



Rgr 01-15-2008 09:27 AM

Re: Use Flash or Not?
 
DemoDisk wrote:
> I'm trying to keep a secure machine, but I've lost track of which
> Windows add-ons are dangerous and which are OK. (DivX, RealPlayer, etc.)
>
> I just visited Bloomberg.com and got a message; "The new Bloomberg Chart
> Builder requires Flash 8.0 or newer. Click here to download Flash." I
> didn't.
>
> Would you recommend Flash, and is there a site that catalogs the
> baddies?


I use Flashblock and Adblock. Turn them on when required.

why? 01-15-2008 01:30 PM

Re: Use Flash or Not?
 

On Tue, 15 Jan 2008 02:42:51 -0600, DemoDisk wrote:

>
>I'm trying to keep a secure machine, but I've lost track of which
>Windows add-ons are dangerous and which are OK. (DivX, RealPlayer, etc.)


Why worry about add-ons, start at Windows.

>I just visited Bloomberg.com and got a message; "The new Bloomberg Chart
>Builder requires Flash 8.0 or newer. Click here to download Flash." I
>didn't.
>
>Would you recommend Flash, and is there a site that catalogs the


Don't know of a single site, usually a few news amd vendor product
sites.

Yes, if you want to see the chart, that's why you went to bloomberg
wasn't it?

>baddies?


Any of the AV sites with current alerts, SANS http://www.sans.org/ it's
the Global Incident link you want http://isc.sans.org/

http://www.microsoft.com/security/default.mspx


I have these sites open in my browser by default, for news as well
http://www.theregister.co.uk/
http://www.theinquirer.net/

I use Outpost Firewall with block active content by default and add
sites as needed not even allowing all active content.

Often the exe is blocked for internet access as not trusted anyway.

Oddly enough
http://www.adobe.com/downloads/updat...y_supp_updates


Me

VanguardLH 01-15-2008 02:30 PM

Re: Use Flash or Not?
 
"DemoDisk" wrote in message news:13oos8q5vto8975@corp.supernews.com...
>
> I'm trying to keep a secure machine, but I've lost track of which
> Windows add-ons are dangerous and which are OK. (DivX, RealPlayer,
> etc.)
>
> I just visited Bloomberg.com and got a message; "The new Bloomberg
> Chart
> Builder requires Flash 8.0 or newer. Click here to download Flash."
> I
> didn't.
>
> Would you recommend Flash, and is there a site that catalogs the
> baddies?



Flash is another ActiveX control. How do you know what the site
offers as Adobe's Flash Player is actually from Adobe? When you get
the prompt for them to install a well-known AX control, that should
prompt you to head off to the actual vendor of that AX control and get
it from there. The same applies for any hardware update presented at
Microsoft's Windows Update site: if it says there is a newer driver,
you go get it from the hardware maker's site, not from Microsoft -
presuming that you even have to bother with the newer version.

Go to www.adobe.com and get THEIR Flash player AX control. It is at
version 9 so the site was going to give you an older version. If you
visit sites that you have some means of knowing to whom they belong,
that doesn't mean you really want to see 3rd party Flash content. Get
a popup or Flash blocker that lets you, at least, block 3rd party
Flash content and shows only 1st party Flash content. If the site
wants you to see their advertiser's content or from some other domain,
it should be routed through their own domain; i.e., if they want to
show it on their web page, they should be responsible for its content.
Imagine going to some religious or children's site and some 3rd party
content is porn. If they want the content on their site, they should
be in control of it and it should originate from their site. Sure,
they can disclaim any responsibility for 3rd party content that they
present in THEIR web page. Sure, I can decide not to see any of that
3rd party content.

You could block all Flash content, including 1st party content, but
many sites use Flash to prevent theft of their content. They don't
want web crawlers stealing their web page. So blocking all Flash
could mean that you visit sites that won't work although YOU chose to
visit that site. Also, Flash blockers do not always initialize a page
correctly if you block the Flash content and then try to allow (run)
it. You could end up blocking the Flash content, decide you want to
see it, have the Flash blocker try to play it, but it doesn't work
because of interdependencies were broke when blocked. Sometimes
unblocking and refreshing works. Sometimes you'll have to whitelist
the site so you can revisit it so the blocking is never performed in
the first place.


Whiskers 01-15-2008 06:28 PM

Re: Use Flash or Not?
 
On 2008-01-15, VanguardLH <VanguardLH@mail.invalid> wrote:
> "DemoDisk" wrote in message news:13oos8q5vto8975@corp.supernews.com...


[...]

> Flash is another ActiveX control.


Is it? Odd that Flash should work so well with Linux then, as ActiveX
exists only on Windows systems (and is a security nightmare if permitted
to function).

> How do you know what the site
> offers as Adobe's Flash Player is actually from Adobe? When you get
> the prompt for them to install a well-known AX control, that should
> prompt you to head off to the actual vendor of that AX control and get
> it from there. The same applies for any hardware update presented at
> Microsoft's Windows Update site: if it says there is a newer driver,
> you go get it from the hardware maker's site, not from Microsoft -
> presuming that you even have to bother with the newer version.


[...]

That's generally good advice - although in my experience the 'link' for a
plugin a web site wants you to install is usually straight to the
'downloads' pages of the plugin's maker anyway.

--
-- ^^^^^^^^^^
-- Whiskers
-- ~~~~~~~~~~

DemoDisk 01-16-2008 07:01 AM

Re: Use Flash or Not?
 

"DemoDisk" <packrat@nospam.com> wrote in message
news:13oos8q5vto8975@corp.supernews.com...
>
> I'm trying to keep a secure machine, but I've lost track of which
> Windows add-ons are dangerous and which are OK. (DivX, RealPlayer,

etc.)


Whiskers, Roger, why?, & Vanguard -- Thanks for the help.



why? 01-16-2008 11:10 AM

Re: Use Flash or Not?
 

On Tue, 15 Jan 2008 18:28:41 +0000, Whiskers wrote:

>On 2008-01-15, VanguardLH <VanguardLH@mail.invalid> wrote:
>> "DemoDisk" wrote in message news:13oos8q5vto8975@corp.supernews.com...

>
>[...]
>
>> Flash is another ActiveX control.

>
>Is it? Odd that Flash should work so well with Linux then, as ActiveX
>exists only on Windows systems (and is a security nightmare if permitted
>to function).


That's the problem on a Win box, the flash is wrapped up in a ActiveX
control, often for no good reason..

<snip>

Me

VanguardLH 01-16-2008 08:38 PM

Re: Use Flash or Not?
 
"Whiskers" wrote in message
news:20080115182841.4195.1.NOFFLE@ID-107770.user.individual.net...
>
> VanguardLH wrote:
>>
>> "DemoDisk" wrote ...

>
>> Flash is another ActiveX control.

>
> Is it? Odd that Flash should work so well with Linux then, as
> ActiveX
> exists only on Windows systems (and is a security nightmare if
> permitted
> to function).


Why do you believe that similar functionality on completely different
OS platforms must use the same software technology?

"More recent versions include ActionScript, an implementation of the
ECMAScript ..."
http://en.wikipedia.org/wiki/Adobe_F...mming_language

That does not stipulated the interface used by an application or
add-on. So, are you saying that you do not have a Flash9*.ocx
(ActiveX container) under the following path (after installing version
9)?

C:\WINDOWS\system32\Macromed\Flash

..ocx is the file extension for OLE Control eXtension (OCX) used for
ActiveX. In IE7, go into Internet Options -> Programs -> Manage
Add-ons. Scroll to find "Shockwave Flash Object". And what type of
object does IE say is that linked control? Mine says ActiveX. I
don't have a Linux around at home to go check so I don't know what
software technology is used by Flash when installed on Linux. Why
would they even bother to query your OS or prompt you for it if the
same exact software technology were used across all operating systems?
Hmmmm?

Before trying to claim profiency in Windows software technologies when
you are obviously oriented to Linux, you could just Google to find
out.

http://www.google.com/search?q=%2bfl...b%22activeX%22

The OP said they wanted to know about Windows add-ons. Linux wasn't
mentioned. I can guess that they use ActiveX in Windows because that
interface is defined within Internet Explorer and that's why Adobe
used it. OLE is still heavily used within Windows and applications
that run on that platform, and OCX is just an extension of OLE.

I don't know what software technology is used on Linux for linking and
integrating data structures between applications. According to
http://www.adobe.com/shockwave/download/alternates/, Flash installs as
an add-on to Firefox to provide the player. I don't know if Flash is
then available via a similar linking technology to OLE to other
applications under Linux. Maybe Linux doesn't have an equivalent of
the wide encompassing tentacles of OLE. Apparently Flash has not been
available from Adobe until 15 months ago
(http://weblogs.macromedia.com/emmy/a...refresh_on.cfm)
and Linux users were stuck with trying to use open-source solutions
that emulated the player's functionality - which makes me suspect that
you don't know Linux at all and might not even use it except as an
intermittent neophyte. A Linux newsgroup could probably answer how
Flash works (or doesn't) on Linux. I'm not claiming any expertise
regarding Flash on Linux (all my work in UNIX platforms is at the
command line and rarely ever with the GUI).

OCX is an extension to OLE which falls under [D]COM. OLE and COM
introduced a programming model based on reusable design. As of OLE
2.0, Microsoft renamed it to ActiveX. Have a read at:

http://en.wikipedia.org/wiki/OCX
http://en.wikipedia.org/wiki/ActiveX_Control

This also answers why?'s post claiming that ActiveX is unnecessarily
used to "wrap" the script. No, there is no wrapping. It is an OLE
(now called ActiveX) object. Even the Windows Clipboard is OLE
enabled. If OLE wasn't available in Windows, copy-n-paste and
drag-n-drop would require some interface defined separately within
every application that wanted to support this function. There would
be no consistency between how applications implemented their own
copy-n-paste and drag-n-drop functions (if they even bothered to
implement them). That's why Microsoft made it part of the OS.
Copy-n-paste can be implement using either the Clipboard API or OLE.
Drag-n-drop is implemented via OLE. OLE showed up in Windows 3.10
(see http://support.microsoft.com/kb/q32905/) so you're probably not
old enough to remember using the prior versions of Windows. It was
Microsoft copying Apple's publish & subscribe feature. OCX was
Microsoft *partially* copying Apple's OpenDOC standard by delineating
components (see http://www.mackido.com/History/History_OLE.html).

Yeah, Microsoft could eliminate OLE (and OCX or AX) but it would make
Windows a real bitch to use when trying to integrate applications or
to message between them. If you don't want OLE in your system, go
back to DOS or Windows pre-3.10. Or you could go to Linux. Maybe
they use OpenDOC (a Linux/UNIX newsgroup would probably know).

>> How do you know what the site
>> offers as Adobe's Flash Player is actually from Adobe? When you
>> get
>> the prompt for them to install a well-known AX control, that should
>> prompt you to head off to the actual vendor of that AX control and
>> get
>> it from there.

>
> That's generally good advice - although in my experience the 'link'
> for a
> plugin a web site wants you to install is usually straight to the
> 'downloads' pages of the plugin's maker anyway.


That is one enhancement that I wished were added to IE. It says that
the add-on is requested and that supposedly it comes from Microsoft -
but I don't know if that it is the site telling me where are the
add-on comes from or if IE is reading the authenticode within the
program file to determine the certification path. Only after you
install it can you find out the CRL path; for example and for Flash,
right-click on the "Shockwave Flash Object" item listed in Windows
Explorer (which shows the description rather than filenames because
this is a "special" folder) and look at Properties where you can see
the CodeBase path of where the object supposedly came from. At the
time when you are prompted to install it, that path is not shown. I
see nothing that would preclude the add-on coming from the site that
wants you to install it rather than from the add-on author's site.


Whiskers 01-16-2008 11:23 PM

Re: Use Flash or Not?
 
On 2008-01-16, VanguardLH <VanguardLH@mail.invalid> wrote:
> "Whiskers" wrote in message
> news:20080115182841.4195.1.NOFFLE@ID-107770.user.individual.net...
>> VanguardLH wrote:
>>> "DemoDisk" wrote ...

>>
>>> Flash is another ActiveX control.

>>
>> Is it? Odd that Flash should work so well with Linux then, as
>> ActiveX
>> exists only on Windows systems (and is a security nightmare if
>> permitted
>> to function).

>
> Why do you believe that similar functionality on completely different
> OS platforms must use the same software technology?


What makes you think that I would believe any such thing?

Flash works on Linux; Linux has nothing like Windows ActiveX; therefore,
Flash does not require ActiveX. If the Windows version of Flash /does/
require ActiveX then Windows users should be putting pressure on Adobe to
provide them with a version of Flash for Windows that is no less secure
than the versions of Flash available for other OSs.

> "More recent versions include ActionScript, an implementation of the
> ECMAScript ..."
> http://en.wikipedia.org/wiki/Adobe_F...mming_language


ECMAscript is just another name for 'javascript'; nothing to do with
ActiveX (or Java).

> That does not stipulated the interface used by an application or
> add-on. So, are you saying that you do not have a Flash9*.ocx
> (ActiveX container) under the following path (after installing version
> 9)?
>
> C:\WINDOWS\system32\Macromed\Flash


I haven't got a copy of Windows in use. None of the Flash files on my
system have a name ending in .ocx (and ActiveX does not exist here at
all).

[...]

> Before trying to claim profiency in Windows software technologies when
> you are obviously oriented to Linux, you could just Google to find
> out.


I was making no such claim. Just saying that Flash works on Linux without
needing ActiveX and /asking/ if it was true that it did need ActiveX on
Windows. You seem to be replying along the lines that indeed it does,
repeating at huge length your own statement which prompted my perfectly
reasonable queston, but you've got your knickers in such a twist about the
merest mention of some other operating system that you can't seem to
restrain your fury.

[...]

> Maybe Linux doesn't have an equivalent of
> the wide encompassing tentacles of OLE. Apparently Flash has not been
> available from Adobe until 15 months ago
> (http://weblogs.macromedia.com/emmy/a...refresh_on.cfm)
> and Linux users were stuck with trying to use open-source solutions
> that emulated the player's functionality - which makes me suspect that
> you don't know Linux at all and might not even use it except as an
> intermittent neophyte.


The fact that no official 'Flash player' or plugin was provided for Linux
until fairly recently, has no connection at all with my experience or
expertise in using Linux. But I'll mention for the record that I haven't
used any OS but Linux for a few years now - nor needed to. The only gripe
I have with Flsh is that there's far too much of it around, serving no
useful purpose but making some web sites very difficult to use for some
visitors. But that's the fault of idiot web-site designers, not a defect
of Flash itself.

> A Linux newsgroup could probably answer how
> Flash works (or doesn't) on Linux. I'm not claiming any expertise
> regarding Flash on Linux (all my work in UNIX platforms is at the
> command line and rarely ever with the GUI).


As Flash is closed-source proprietary software, only the owners of the
company can tell anyone how it works. It does work on Linux, quite well
enough for the very few sites I've 'enabled' it for.

[...]

I don't know why you felt it necessary to attempt an explanation of some
aspect of Windows 'technology' allowing it to emulate what other OSs had
been doing for years before Microsoft got around to it.

>>> How do you know what the site
>>> offers as Adobe's Flash Player is actually from Adobe? When you
>>> get
>>> the prompt for them to install a well-known AX control, that should
>>> prompt you to head off to the actual vendor of that AX control and
>>> get
>>> it from there.

>>
>> That's generally good advice - although in my experience the 'link'
>> for a
>> plugin a web site wants you to install is usually straight to the
>> 'downloads' pages of the plugin's maker anyway.

>
> That is one enhancement that I wished were added to IE. It says that
> the add-on is requested and that supposedly it comes from Microsoft -
> but I don't know if that it is the site telling me where are the
> add-on comes from or if IE is reading the authenticode within the
> program file to determine the certification path. Only after you
> install it can you find out the CRL path; for example and for Flash,
> right-click on the "Shockwave Flash Object" item listed in Windows
> Explorer (which shows the description rather than filenames because
> this is a "special" folder) and look at Properties where you can see
> the CodeBase path of where the object supposedly came from. At the
> time when you are prompted to install it, that path is not shown. I
> see nothing that would preclude the add-on coming from the site that
> wants you to install it rather than from the add-on author's site.


Can't you see the actual URL a 'link' is for? Last time I used Internet
Explorer (version 5, I think, which was the latest version at the time), IE
could do that just fine.

If you would prefer an OS that puts the user in control rather than tries
to control the user, you know what you need to do ...

--
-- ^^^^^^^^^^
-- Whiskers
-- ~~~~~~~~~~

VanguardLH 01-17-2008 06:24 AM

Re: Use Flash or Not?
 
"Whiskers" wrote in message
news:20080116232350.4E69.6.NOFFLE@ID-107770.user.individual.net...

OP's question: "... which Windows add-ons are dangerous ... Flash ..."

My statement: "Flash is another ActiveX control.".

Your statement: "Odd that Flash should work so well with Linux then,
as ActiveX exists only on Windows systems."

This despite the context of the OP's question which placed the
question of the use of Flash solely under Windows. Your statement
implies that Flash couldn't possibly use ActiveX on Windows because
ActiveX is not available in Linux. My response was pretty much "So
what?" (and then a lot of explanation in case you really had no clue
what was ActiveX and where it came from and also to disprove your
claim).

> Flash works on Linux; Linux has nothing like Windows ActiveX;
> therefore,
> Flash does not require ActiveX. If the Windows version of Flash
> /does/
> require ActiveX then Windows users should be putting pressure on
> Adobe to
> provide them with a version of Flash for Windows that is no less
> secure
> than the versions of Flash available for other OSs.


So why would you imply that Flash doesn't use ActiveX on Windows
simply because ActiveX isn't available on Linux?

> ECMAscript is just another name for 'javascript'; nothing to do with
> ActiveX (or Java).


The point was that Flash is just another scripting language, not that
ActiveX is some wrapper around the script as was indicated by "why?".
With Linux, you should be used to lots of different scripting
languages, some having better applicability for some tasks than
others.

> I haven't got a copy of Windows in use. None of the Flash files on
> my
> system have a name ending in .ocx (and ActiveX does not exist here
> at
> all).


Yep, some proof that Flash on Linux doesn't use ActiveX which is a
purely Microsoft thing and Microsoft doesn't do UNIX (well, they're
not much into UNIX). So you proved your point that ActiveX isn't used
on Linux (for anything) but you also disqualified your statement of:

"Odd that Flash should work so well with Linux then, as ActiveX exists
only on Windows systems"

as though how Flash is implemented on Windows would have anything to
do with how it is implemented on UNIX, or visa versa.

> The fact that no official 'Flash player' or plugin was provided for
> Linux
> until fairly recently, has no connection at all with my experience
> or
> expertise in using Linux. But I'll mention for the record that I
> haven't
> used any OS but Linux for a few years now - nor needed to. The only
> gripe
> I have with Flsh is that there's far too much of it around, serving
> no
> useful purpose but making some web sites very difficult to use for
> some
> visitors.


Wrong again. As I mentioned, Flash is often used to hide the source
to create the the content of a web page. Capturing the Flash display
won't get you the code that compiled the content delivered to your
browser. You just get the end result. This makes it difficult for
someone to merely web crawl across your site to steal it and possibly
make a mirror copy for phishing or other negative use.

Of course, let's totally dismiss that Flash can control how your media
content gets handled or to enhance its use at the client end. It's
just another scripting language. With Perl, Python, Ruby, Korn/C/bash
scripting, and so on, I wouldn't think a pro-Linux user would resist
yet another scripting language designed for a more specialized
purpose.

> As Flash is closed-source proprietary software, only the owners of
> the
> company can tell anyone how it works. It does work on Linux, quite
> well
> enough for the very few sites I've 'enabled' it for.


Hmm, I thought there were open-source emulators for Flash. So those
authors must had a clue as to how to get Flash working on Linux before
Adobe eventually came up with their closed proprietary solution. MING
(http://freshmeat.net/projects/ming/) wasn't written by Adobe. The
Free Software Foundation's GNU Gnash player wasn't written by Adobe,
nor was SWFDEC, another open-source Flash decoder/renderer. As long
as the multimedia types were understood and since the scripts used to
code SWF files is published, the code needed to implement their
support doesn't have to be duplicated from however Macromedia happened
to code them.

> I don't know why you felt it necessary to attempt an explanation of
> some
> aspect of Windows 'technology' allowing it to emulate what other OSs
> had
> been doing for years before Microsoft got around to it.


Because, for some odd reason, you seemed to think Flash had to use
ActiveX technology on Linux for it to use ActiveX on Windows. "Odd
that Flash should work so well with Linux then, as ActiveX exists only
on Windows systems". Yeah, so what? When I first encountered REXX,
another scripting language, it was only available on IBM systems, and
quite handy for paralleling the execution of processes much like
threading, so if a program that used REXX on S-360 had a version of
that program that ran on HP then something *other* than REXX would've
been needed for the HPUX version. (There are now open source
interpreters for REXX so that situation has changed but in the
beginning we would've needed to use C or some other language to
provide a different platform version the same scripted program.) Same
results, different routes to get there.

The OP asked about Flash on Windows. I never said ActiveX (OCX) is
used on Linux and actually inferred that Flash could not use ActiveX
on Linux. I said how FLash uses ActiveX *ON WINDOWS* which was the
platform on which the OP was interested. How Flash is implemented on
Linux is irrelevant to the OP. I didn't bring up Linux. You did, as
though Flash could not be implemented using ActiveX on Windows simply
because ActiveX isn't available on Linux. My first reaction to your
reply was "Yeah, so what? What's Linux got to do with the Windows
implementation?"



All times are GMT. The time now is 07:16 AM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.