RE: flashplugin-nonfree and latest Flash security updates

From	Nick Boyce <nick@glimmer.demon.co.uk>
Newsgroups	linux.debian.security
Subject	RE: flashplugin-nonfree and latest Flash security updates
Date	2016-08-04 04:30 +0200
Message-ID	<s2gA2-2HH-7@gated-at.bofh.it> (permalink)
References	<s1nke-834-33@gated-at.bofh.it> <s2gA2-2HH-9@gated-at.bofh.it> <s29Ie-6D8-19@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, 3 Aug 2016 20:47:45 +0200
Moritz Mühlenhoff <jmm@inutil.org> wrote:

> Nick Boyce <nick@glimmer.demon.co.uk> schrieb:

> > assuming Bart is MIA for some reason, is it possible
> > for the Security Team to either fix the update, or to make an
> > announcement that all Debian users should stop using the Adobe
> > player immediately ?  
> 
> No, non-free/contrib is not supported by the security team.

Okay - thanks Moritz.

> Just don't use that crap. With the amount of zero days in Flash
> you're subject to serious vulnerabilities even with an up-to-date
> plugin.

Well you're right of course, though as I said in reply to Paul Wise
there is still a use-case with no alternative at the BBC News website,
and if a throwaway VM is used then the risk is mostly mitigated.  Also I
believe there are quite a few corporate intranet use-cases that *depend*
on Flash for corporate web-apps (at least according to traffic on the
Enterprise Firefox list).

Cheers,
Nick
-- 
In a world where Henry Kissinger wins the Nobel Peace Prize,
there is no need for satire.
                        - Tom Lehrer

Thread

flashplugin-nonfree and latest Flash security updates "Darren S." <phatbuckett@gmail.com> - 2016-08-01 17:30 +0200
  Re: flashplugin-nonfree and latest Flash security updates Francesco Negri <francesconegri@gmail.com> - 2016-08-01 18:30 +0200
  RE: flashplugin-nonfree and latest Flash security updates Nick Boyce <nick@glimmer.demon.co.uk> - 2016-08-03 02:50 +0200
    Re: flashplugin-nonfree and latest Flash security updates Paul Wise <pabs@debian.org> - 2016-08-03 12:00 +0200
      Re: flashplugin-nonfree and latest Flash security updates Rob van der Putten <rob@sput.nl> - 2016-08-03 21:00 +0200
        flash plugin from ubuntu (was: flashplugin-nonfree and latest Flash security updates) Stefan Fritsch <sf@sfritsch.de> - 2016-08-03 23:20 +0200
          Re: flash plugin from ubuntu (was: flashplugin-nonfree and latest  Flash security updates) Holger Levsen <holger@layer-acht.org> - 2016-08-04 00:10 +0200
            Re: flash plugin from ubuntu (was: flashplugin-nonfree and latest  Flash security updates) "Luedtke, Nicholas (HPE Linux Security)" <nicholas.luedtke@hpe.com> - 2016-08-04 04:40 +0200
              Re: flash plugin from ubuntu (was: flashplugin-nonfree and latest Flash security updates) Stefan Fritsch <sf@sfritsch.de> - 2016-08-04 22:20 +0200
        Re: flashplugin-nonfree and latest Flash security updates Jason Fergus <leech@thefnords.org> - 2016-08-05 17:00 +0200
      RE: flashplugin-nonfree and latest Flash security updates Nick Boyce <nick@glimmer.demon.co.uk> - 2016-08-04 04:20 +0200
    Re: flashplugin-nonfree and latest Flash security updates Moritz Mühlenhoff <jmm@inutil.org> - 2016-08-03 21:10 +0200
      RE: flashplugin-nonfree and latest Flash security updates Nick Boyce <nick@glimmer.demon.co.uk> - 2016-08-04 04:30 +0200
        Re: flashplugin-nonfree and latest Flash security updates Holger Levsen <holger@layer-acht.org> - 2016-08-04 08:20 +0200
  Re: flashplugin-nonfree and latest Flash security updates Bart Martens <bartm@debian.org> - 2016-08-04 01:00 +0200
    RE: flashplugin-nonfree and latest Flash security updates Nick Boyce <nick@glimmer.demon.co.uk> - 2016-08-04 04:50 +0200

csiph-web