Originally Posted By: Hal Itosis
One wonders whether Adobe even tries to "get it right" . . . ever.
Seems like they don't learn anything, from one patch to the next.

Two zero-day vulnerabilities found in Flash Player

  crazy

I don't think this is a matter of getting it right on Adobe's part. I think it is more a matter of cutting their losses and doing the minimum effort they can get away with to keep their corporate customers happy. Adobe has already announced they are dropping development of Flash for handheld and tablet devices as well as tacitly acknowledging HTML 5 has already won the day on the desktop.

From my knowledge of Macromedia, the originator of Flash and Dreamweaver, my strong suspicion is Adobe is using a huge library of legacy code, which they did not write, developed at time when "security" was an unused word in the programmer's dictionary, and in a programming style that makes maintenance difficult and consequently very expensive. So Adobe has lots of patches to the code and each patch risks exposing and/or creating additional potential exploits. Apple was in a similar position when Steve Jobs returned to take the helm and made the decision to bet the company and invest in a completely new operating system and applications code base written in an unusual dialect of the C language. I have not seen anything from Adobe indicating they have either the vision or the resources to do anything that risky or daring.

Personally I don't think Flash will be around much longer. When Microsoft endorses any Open Source technology, and when Apple and Microsoft agree on anything, the game is over and Adobe lost.


If we knew what it was we were doing, it wouldn't be called research, would it?

— Albert Einstein