Adobe Flash: The New Vista?

[David Baxter PhD]

Sorry, Adobe: Flash is the new Vista
By Ed Bott, ZDNet
May 13, 2010

Here’s some advice, Adobe. The first step on the road to recovery is admitting that you have a problem.

Yes, I know you’d rather frame your fight with Apple as a high-minded crusade for freedom, but your customers think differently. When I hear fellow PC users talk about Flash these days, I hear the exact same frustration and exasperation I heard during Vista’s first year on the market. That is not the kind of word of mouth you want.

And make no mistake about it, those concerns are real. Was Steve Jobs exaggerating when he called Flash the biggest source of crashes on the Mac? Maybe a little, but I bet he has some pretty grim statistics to back that statement up. And Microsoft is reinforcing that same message, albeit more politely and with masterful understatement. Here’s what IE boss Dean Hachamovitch had to say two weeks ago:

Flash does have some issues, particularly around reliability, security, and performance. We work closely with engineers at Adobe, sharing information about the issues we know of in ongoing technical discussions.
​

“Some issues”? Yeah, that’s one way of putting it. My own experience fits right in. I discovered yesterday that Internet Explorer crashes on my wife’s PC once or twice a day. The Windows 7 Reliability Monitor says Adobe’s Flash Player is to blame (yes, it’s up-to-date), and it offers a step-by-step solution: Uninstall the Flash Player, reboot, and reinstall Flash. (The Microsoft prescription is, in fact, the exact same set of steps I recommended right here back in January.)




I did exactly that, and guess what? Today, at 7:42AM, another Flash crash. At the same time on the same PC, TweetDeck, an app that runs on the Adobe Air platform, had stopped responding. The crash report fingered that same Flash ActiveX control version as the cause.

Update: Via Twitter, Adobe’s John Dowdell questions my report on the TweetDeck crash. I got one small detail wrong. It was FlashUtil10e.exe, not the Active X control, Flash10e.ocx. Both versions were the same, 10.0.45.2. Here’s the crash report from Windows:



Oh, and just a little while ago the latest Adobe Reader update failed on another PC, with this not-so-helpful message: “Update failed. Cannot install this update. Please run Adobe Reader Repair. Error:1500.”

So pardon me if I feel cranky about your software right now, Adobe.

Look, Apple and Microsoft say you have reliability and security problems with Flash Player. A whole lot of my readers say the same thing. And so do I. We’re all sort of waiting for you to acknowledge that the number of times people have a negative experience with Flash is too high. Until you address that elephant in the room, no one is really interested in hearing much more about openness and freedom. (Well, except for the FTC and the DOJ, but that’s a different issue completely.)

And then there’s security. According to Microsoft’s most recent Security Intelligence Report, published earlier this week, a Flash Player exploit was the most commonly exploited browser vulnerability in the first half of last year. The list of security updates for Flash Player is depressingly long. So, how are you planning to convince us that you’ve gotten serious about security?

I talked to an Adobe spokesperson earlier this week and heard all about the big improvements coming in Flash Player 10.1. Product Manager Tom Nguyen told me, “We’re looking after the interests of our end users and customers,” and ticked off a list of improvements that are on the way: support for more mobile devices and more operating systems, better performance, improvements in power usage (and thus improved battery life), support for hardware-accelerated H.264 video. Those are all big, important features.

What I didn’t hear was a promise and a plan to deliver a more reliable, more secure product. Should we expect Flash 10.1 to crash less and be more resistant to attacks than Flash 10 or Flash 9? Why? What have you learned about how to stop customers from having a crappy experience and how are you applying those lessons? “Well,” I was told, “there’s an improved installer.”

Not the answer I was hoping for.

Microsoft responded to the mess that was Vista by bringing in a new boss, Steven Sinofsky, who changed the internal culture on the Windows team quickly and decisively. He also brought in a lot of engineering discipline and an unprecedented level of communication about the Windows 7 development process via detailed, sometimes epic posts on the E7 Blog.

Adobe has profound issues of quality and negative perception to deal with, just as Microsoft did with Vista. But in Flash they also have a product that is going to be severely challenged by HTML5 and Silverlight and probably some other products and technologies we don’t even know about right now. I’m certain Flash will still be around in five years and probably in 10 years. But it will be much less important than it is today.

The big question for Adobe is whether they can shut down the complaints about Flash by delivering a product that “just works.” Oh, and at the same time stake out a future for a Web running on HTML5. Good luck with that.

 

[Retired]

This post along causes concern about the internal workings of Adobe.

I don't know if their problems extend to other parts of their business, but my recent experience with Adobe Photoshop Elements 8 suggests they do. Having been a long time user of Adobe Photoshop and earlier versions of Elements, I bought and installed the latest version of Elements on my Wondows 7 system. Although the overall performance of Elements is acceptable, there are a number of obvious and well known bugs that have plagued at least the last two versions of Elements, as I have learned from the Adobe support Forums.

These are not minor glitches, but major functionalities that either don't work as expected or fail to work at all. Elements 8 in some respects hardly appears to be ready for beta, let alone retail release.

What's going on at Adobe?

 

[David Baxter PhD]

My take?

Adobe rose to "power" by porting apps originally created for Apple operating systems to Windows. The way their products were designed has never worked very well in the Windows environment and is increasingly falling behind even for the Apple environment. They are clumsy creations involving interlinked modules that take forever to load and often don't play well together. To add to the problem, their focus seems to be on adding new features, rather than fixing the problems with existing features, despite the fact that most people don't need the new features. What we get instead is endless superficial patches of bugs, ever increasing price tags for products that are already insanely overpriced, and flashy ads for "new improved" versions that still haven't addressed the issues in the "old unimproved" versions.

It was a sad day for site owners and web designers when Adobe bought DreamWeaver. Their old web site design and maintenance program, Adobe Go Live, was a nightmare in terms of the code it produced. So far they haven't managed to totally ruin DreamWeaver, once the cream of web design programs, but it's only a matter of time.

Whenever I can find a comparable competitor product, I buy and use that instead.

What Apple needs to do is what Microsoft did after Vista: Do a complete overhaul of their coding and design departments, and hire new people who have integrated a new vision for the company of what consumers actually want. The result for Microsoft was Windows 7.

 

[David Baxter PhD]

How secure is Flash? Here's what Adobe won't tell you

How secure is Flash? Here's what Adobe won't tell you
By Ed Bott, ZDNet
May 14, 2010

Yesterday, I called Adobe?s Flash ?the new Vista? and asked the company to start talking seriously about how they?re addressing problems with their products instead of pretending those problems don?t exist. In talking to Adobe representatives, reading interviews with Adobe executives, and reading Adobe?s public statements, I?ve found a steady stream of denial where there should be transparency.

One of the key issues in this discussion is security. Yesterday, I rattled off some disturbing statistics about vulnerabilities in Flash Player and asked Adobe, ?So, how are you planning to convince us that you?ve gotten serious about security? No one from Adobe has gotten back to me on that one. But John Paczkowski of Digital Daily interviewed Adobe co-founder Chuck Geschke yesterday and published a transcription of the conversation this morning. Here?s an excerpt that perfectly illustrates my concerns with Adobe?s record.

JP: Both Apple and Microsoft have said publicly now that Flash has issues with reliability, security, and performance. Do you think those complaints are legitimate?

CG: I think they?re old news. Go to our Web site and read the actual facts about Flash. We enumerate the facts about Flash there as we see them. [Microsoft and Apple] may have a different set of facts that they believe are accurate. It?s up to you to decide.
​

?Old news?? Obi-Wan Kenobi can get away with that kind of hand-waving. The CEO of a public company with a market cap of $18 billion can?t. I intend no criticism of Paczkowski, who did an excellent job under the circumstances, but Geschke?s statement demands some serious fact-checking.

I followed the link to Adobe?s new ?Setting the record straight? page, emphatically titled The truth about Flash. Here is the first of two paragraphs that appears under the Security heading:

Security is one of the highest priorities for the Flash Player team. The Symantec Global Internet Threat Report for 2009 found that Flash had the second fewest number of vulnerabilities of all Internet technologies listed (which included both web plug-ins and browsers). This is significant when you consider that Flash Player is among the most widely distributed and used pieces of software in the world. [emphasis added]
​

That is, charitably speaking, a gross distortion of the facts. And I find it interesting that Adobe?s rebuttal does not include a link to the Symantec report they cite. That makes it more difficult for readers (and reporters) to fact-check their claim. So here, allow me to help. Symantec?s Internet Security Threat Report page includes links to the full report , which was published in April 2010 and covers the year 2009. There?s also an executive summary and a link to archived reports from previous years. You?re welcome to read along with me. Tell me if you think that assertion from Adobe is accurate.

First, a quote from page 40 of the full 2009 report:

In 2009, Symantec documented 321 vulnerabilities affecting plug-ins for Web browsers (figure 9). ActiveX technologies were affected by 134 vulnerabilities, which was the highest among the plug-in technologies examined. Of the remaining technologies, Java SE had 84 vulnerabilities, Adobe Reader had 49 vulnerabilities, QuickTime had 27 vulnerabilities, and Adobe Flash Player was subject to 23 vulnerabilities. The remaining four vulnerabilities affected extensions for Firefox.
​

I suppose there?s some schadenfreude for Adobe in seeing four more vulnerabilities for QuickTime than for Flash Player. But really, is the discovery of 23 vulnerabilities in a single year really something to brag about? Is it somehow an endorsement of Flash Player?s security? Well, to answer those questions you would need to assess the seriousness of those vulnerabilities and determine which ones were attacked. For some reason, Adobe made no mention of this paragraph, which appears in the Symantec report a mere two pages later:

Among the vulnerabilities discovered in 2009, a vulnerability affecting both Adobe Reader and Flash Player was the second most attacked vulnerability. This was also one of four zero-day vulnerabilities affecting Adobe plug-ins during 2009. Two of the vulnerabilities were in the top five attacked vulnerabilities for 2009. Additionally, Adobe vulnerabilities have been associated with malicious code attacks such as the Pidief.E Trojan.
​

Perhaps Adobe?s performance in 2009 was an improvement over previous years? Uh, no. The 2008 edition of Symantec?s annual report found only 16 vulnerabilities in the Flash Player, and the 2007 edition (published in two parts) found no Flash-related vulnerabilities in the first half of the year and 11 in the second half. From 11 to 16 to 23? That is not a trend line that Adobe should be proud of.

In fact, there is nothing in the Symantec report that is flattering toward Adobe and its security record. On page 37, Symantec offers this advice for organizations:

In order to reduce the threat of successful exploitation of Web browsers, administrators should maintain a restrictive policy regarding which applications are allowed within the organization. [?] Browser security features and add-ons should be employed wherever possible to disable JavaScript?, Adobe Flash Player, and other content that may present a risk to the user when visiting untrusted sites. [emphasis added]
​

What the CEO should be saying right now goes something like this: ?Yes, we know there are security issues with Flash Player, as there are with all Internet-based programs. We think our adversaries are exaggerating their impact, but we take them very seriously.? At that point, he should turn the floor over to whoever is in charge of security development for Adobe, who can explain, in detail, what sort of processes are in place today to turn that trend line back downward.

Instead, the co-founder and co-chairman waves his hand and dismisses serious security issues as ?old news.?

It?s clear that Adobe?s sheer stubbornness in refusing to address these issues starts at the top.

 

[Cat Dancer]

I have an older computer that I tried to update Flash Player on and it has turned into a nightmare. It just will not install and it gives an error message and says to uninstall and reinstall and so I do, but it just goes around and around. I don't know if it's me or them or the computer or what, but it's frustrating.