Arch Linux

Banton

Member

Registered: 2010-05-28

Posts: 67

Re: Adobe Flash security hole

I'm using Epiphany with HTML5 YouTube extension - and man I don't miss flash at all... I can't even notice that it is gone. Sometimes youtube complains about flash player but i reload the page several times and html5 player pops up. No flash at all - finally

How is it that Epiphany accomplishes this?  Is it using a chrome plugin like IE does?

It really sucks the way Google is using HTML5 (or at least H.264) as a way to restrict and dominate rather than open, which was the original intention of HTML5.  Do no evil - yeah right.  I certainly don't trust any browser or plugin concocted by the likes of Google, the biggest info thieves around, regardless of how well it works.  Might as well still be stuck with Adobe or Microsoft - they've just replaced one evil with another as far as I'm concerned.

Is there any open browser that can use H.264 youtube video that is non-Google/non-Chrome?

When you use Firefox nightly there is webM included, you can watch youtube videos with this.

IgnorantGuru

Member

Registered: 2009-11-09

Posts: 640

Website

Re: Adobe Flash security hole

When you use Firefox nightly there is webM included, you can watch youtube videos with this.

Looks promising - thanks!

thepizzaking

Member

From: Melbourne, Victoria, Australia

Registered: 2006-03-13

Posts: 46

Re: Adobe Flash security hole

How is it that Epiphany accomplishes this?  Is it using a chrome plugin like IE does?

No, it uses the gstreamer plugins installed on the system which in this case would include a H.264 decoder.

It really sucks the way Google is using HTML5 (or at least H.264) as a way to restrict and dominate rather than open...

I don't know if I'd go that far.  As far as I know, google chrome also supports the open theora format, and development versions support WebM.  The main reason they included H.264 in my opinion was because IE and Mac weren't going to support anything else, so they included it for interoperability.  The other main reason for H.264 is that I hear that google's internal storage format for youtube videos is H.264, so using that for youtube would be easy.

They are currently in the process of transcoding their videos to their new WebM format, which is currently supported by gstreamer, mplayer, vlc, the development version of Firefox etc.  Once gstreamer has support for WebM, any youtube video that's been transcoded will play using it in epiphany (once you subscribe to the HTML5 beta that is)

Is there any open browser that can use H.264 youtube video that is non-Google/non-Chrome?

Any browser that uses libwebkit should be fine, eg Epiphany, Midori.  So long as you have the correct gstreamer plugins installed.

Edit: I just updated my system and turns out you don't need to compile gstreamer yourself for webm/vp8 support anymore.

Last edited by thepizzaking (2010-06-25 01:05:04)

IgnorantGuru

Member

Registered: 2009-11-09

Posts: 640

Website

Re: Adobe Flash security hole

@thepizzaking
I haven't kept up with this but from what I read in this thread, google has more monopolistic purposes in mind, and webkit doesn't seem to be popular either.  I guess I have some research to do.

Thanks for all the info!

TURBO

Member

Registered: 2010-06-26

Posts: 2

Re: Adobe Flash security hole

Hi. I am a newbie, but I love arch.. . I do have the  libflashplayer.so (64 bit) V10.0 R45. I just put this baby into /usr/lib/mozilla/plugins and boom!. It works. If you can find it, fine. If you need it, just shoot an email. Hope it helps somebody.

Last edited by TURBO (2010-06-26 00:39:07)

graysky

Wiki Maintainer

From: :wq

Registered: 2008-12-01

Posts: 10,600

Website

Re: Adobe Flash security hole

@TURBO - one can download the official arch package from several archival repos such as http://www.schlunix.org/archlinux

I highly doubt you'll get any experienced arch user to take you up on your offer for two reasons:

1) Using precompiled binaries from an untrusted source is just haphazard (no offense to you).
2) If it doesn't get installed by pacman, no one will use it.

---

CPU-optimized Linux-ck packages @ Repo-ck  • AUR packages • Zsh and other configs

ngoonee

Forum Fellow

From: Between Thailand and Singapore

Registered: 2009-03-17

Posts: 7,356

Re: Adobe Flash security hole

Hi. I am a newbie, but I love arch.. . I do have the  libflashplayer.so (64 bit) V10.0 R45. I just put this baby into /usr/lib/mozilla/plugins and boom!. It works. If you can find it, fine. If you need it, just shoot an email. Hope it helps somebody.

It is, however, the old version WITH the mentioned security hole.

---

Allan-Volunteer on the (topic being discussed) mailn lists. You never get the people who matters attention on the forums.
jasonwryan-Installing Arch is a measure of your literacy. Maintaining Arch is a measure of your diligence. Contributing to Arch is a measure of your competence.
Griemak-Bleeding edge, not bleeding flat. Edge denotes falls will occur from time to time. Bring your own parachute.

hokasch

Member

Registered: 2007-09-23

Posts: 1,461

Re: Adobe Flash security hole

3) 10.0,45 has serious security issues, which are fixed in 10.1.53, which does not exist for x64, which started all this mess

edit: 3 min late. I might want to refresh the page before I post something. next time.

Last edited by hokasch (2010-06-26 01:16:21)

TURBO

Member

Registered: 2010-06-26

Posts: 2

Re: Adobe Flash security hole

@TURBO - one can download the official arch package from several archival repos such as http://www.schlunix.org/archlinux

I highly doubt you'll get any experienced arch user to take you up on your offer for two reasons:

1) Using precompiled binaries from an untrusted source is just haphazard (no offense to you).
2) If it doesn't get installed by pacman, no one will use it.

Oh, ok. No offense taken. While all this mess gets work out, at least this file works. I downloaded from adobe labs. Any ways, right now I can see all flash movies without adding any work arounds or 32bit crap. Of couse, with my security hole!!. Je, je...

killajoe

Member

From: Berlin Planet Earth

Registered: 2007-07-04

Posts: 168

Website

Re: Adobe Flash security hole

---

Cancel me not -- for what then shall remain?
Abscissas, some mantissas, modules, modes, A root or two, a torus and a node:
The inverse of my verse, a null domain.
-- Stanislaw Lem, The Cyberiad

bond

Member

From: Melbourne, Australia

Registered: 2009-05-05

Posts: 62

Re: Adobe Flash security hole

so are we able to drop some sort of flash plugin into /usr/lib/chromium/ or other dir?

greenfish

Member

From: eating fish in /dev/null

Registered: 2008-08-30

Posts: 229

Re: Adobe Flash security hole

Hey guys!

If 10.0,45 is the culprit, why can't we use older builds then?

I'm not gonna use the nswrapper until I know what's stopping us from using older builds.

Thank You

---

ARCH64 archSKYNET server AMD  Phenom(tm) II X2 550 HDD 6TB Ram 8GB
Hobbies: Running, Pistol Marksmanship, Classic Music

ngoonee

Forum Fellow

From: Between Thailand and Singapore

Registered: 2009-03-17

Posts: 7,356

Re: Adobe Flash security hole

Well, for 64-bit the older builds basically suck stability-wise. Besides the fact that they probably have the same security hole.

Just use the latest build and flashblock, problem solved.

---

Allan-Volunteer on the (topic being discussed) mailn lists. You never get the people who matters attention on the forums.
jasonwryan-Installing Arch is a measure of your literacy. Maintaining Arch is a measure of your diligence. Contributing to Arch is a measure of your competence.
Griemak-Bleeding edge, not bleeding flat. Edge denotes falls will occur from time to time. Bring your own parachute.

tomk

Forum Fellow

From: Ireland

Registered: 2004-07-21

Posts: 9,839

Re: Adobe Flash security hole

correct - adobe's security bulletin specifically says "version 10.0.45.2 and earlier".

cb474

Member

Registered: 2009-04-04

Posts: 469

Re: Adobe Flash security hole

I absent mindedly ran "nspluginwrapper -v -a -i" while logged in as root. But flash seems to be working fine. Should I be worried this? Have I given flash root privileges or something? I got this output:

Auto-install plugins from /usr/lib/mozilla/plugins
Looking for plugins in /usr/lib/mozilla/plugins
Install plugin /usr/lib/mozilla/plugins/libflashplayer.so
  into /usr/lib/mozilla/plugins/npwrapper.libflashplayer.so
Auto-install plugins from /root/.mozilla/plugins
Looking for plugins in /root/.mozilla/plugins

If there's a problem how do I undo what "nspluginwrapper -v -a -i" did?

I also subsequently created ~/.mozilla/plugins/ and ran "nspluginwrapper -v -a -i" again in my user account, but it didn't install anything in that directory.

ataraxia

Member

From: Pittsburgh

Registered: 2007-05-06

Posts: 1,553

Re: Adobe Flash security hole

I absent mindedly ran "nspluginwrapper -v -a -i" while logged in as root. But flash seems to be working fine. Should I be worried this? Have I given flash root privileges or something? I got this output:

Auto-install plugins from /usr/lib/mozilla/plugins
Looking for plugins in /usr/lib/mozilla/plugins
Install plugin /usr/lib/mozilla/plugins/libflashplayer.so
  into /usr/lib/mozilla/plugins/npwrapper.libflashplayer.so
Auto-install plugins from /root/.mozilla/plugins
Looking for plugins in /root/.mozilla/plugins

If there's a problem how do I undo what "nspluginwrapper -v -a -i" did?

I also subsequently created ~/.mozilla/plugins/ and ran "nspluginwrapper -v -a -i" again in my user account, but it didn't install anything in that directory.

You installed it system-wide. Not so bad, if that's ok with you.

Toke

Member

From: Stockholm/Sweden

Registered: 2009-02-14

Posts: 12

Re: Adobe Flash security hole

How would you notice if your system is compromised?

jt512

Member

Registered: 2009-02-19

Posts: 262

Re: Adobe Flash security hole

How would you notice if your system is compromised?

No balance in your checking account; big balance on your credit cards.

Jay

greenfish

Member

From: eating fish in /dev/null

Registered: 2008-08-30

Posts: 229

Re: Adobe Flash security hole

ngoonee
tomk

thanks for the information!

---

ARCH64 archSKYNET server AMD  Phenom(tm) II X2 550 HDD 6TB Ram 8GB
Hobbies: Running, Pistol Marksmanship, Classic Music

cb474

Member

Registered: 2009-04-04

Posts: 469

Re: Adobe Flash security hole

You installed it system-wide. Not so bad, if that's ok with you.

Okay, thanks. Sounds fine to me, I just didn't want any unnecessary security risks.

jMo3f

Member

Registered: 2010-07-15

Posts: 1

Re: Adobe Flash security hole

I just installed the old x86_64 flashplugin from here and also started using flashblock addon on firefox to prevent possible security threats. It seems to be working fine, but as the post recommending this is almost a month old I'd like to ask an update from someone who is familiar with the subject, on wheter this is still the best choice of action? (is that even senseful sentence )

---

"I have noticed even people who claim everything is predestined, and that we can do nothing to change it, look before they cross the road" -Stephen Hawking

Milena

Member

Registered: 2010-04-02

Posts: 67

Re: Adobe Flash security hole

I keep using the 10.0.45.2 flash plugin on my x64, enabling it on demand, together with no-script, adblock plus, etc. in firefox and only use it on websites i trust. The only thing i've done that may or may not help with security is linking ~/.adobe/Flash_Player and ~/.macromedia/Flash_Player to /tmp which is a tmpfs here so the cache is always cleared.

Last edited by Milena (2010-07-15 16:29:13)

valium97582

Member

Registered: 2010-06-19

Posts: 126

Re: Adobe Flash security hole

But gnash is just fine, if you install the gstreamer codecs.

And it is lighter in both my computers.:rolleyes:

Last edited by valium97582 (2010-07-26 15:55:26)

---

I'm also known as zmv on IRC.

graysky

Wiki Maintainer

From: :wq

Registered: 2008-12-01

Posts: 10,600

Website

Re: Adobe Flash security hole

@valium - which gstreamer codecs are you talking about?

Last edited by graysky (2010-08-05 07:27:02)

---

CPU-optimized Linux-ck packages @ Repo-ck  • AUR packages • Zsh and other configs

Pawlerson

Member

Registered: 2010-09-01

Posts: 44

Re: Adobe Flash security hole

My understanding of this stuff is pretty weak, so I'll err on the side of your knowledge. Articles like this though seem to me to point to it being real today even with fairly modern Linux kernels:

http://lwn.net/Articles/347006/

It's not related. Some bug is not equivalent to design mistakes present in Windows. Btw. does someone know where I can download a vulnerable 64bit flash player? I don't want to mess with 32bit libraries. Thanks.