Flash From The Past – Why It’s Time For Flash To Die
If you’re from a certain generation of internet users — I’m looking at you, Millenials — one of your first experiences of using the internet probably involved Flash. The program started as a simple animation tool, and it was a staple of the internet from 1996 to roughly 2010, used to display websites, games, advertising, and music.
Even YouTube, in its early incarnation, ran on the Flash platform, marking the zenith of the program’s ubiquity. In 2015, however, Flash has become so utterly inconsequential to the workings of the internet that it should be taken out behind the woodshed. And shot. Otherwise, we leave ourselves open to a myriad of vulnerabilities.
Attempts to kill Flash aren’t new. Apple, in particular, sounded the death-knell for the program as early as 2010 (which probably contributed to its decline in recent years). This latest assassination attempt comes by way of revelations from the exposure of Hacking Team, a nefarious company that is part of the global market for security exploits. Documents recovered from their database revealed three Flash-based zero day attacks.
For any other program, finding three separate security exploits in the same widely-used, decades-old piece of software would be like scoring three separate hole-in-ones during your next game of golf. It just doesn’t happen. Flash, however, is exploited regularly, and these exploits frequently make everyday people into collateral damage.
Zero-day attacks, such as the exploits stockpiled by Hacking Team, are usually hoarded for use against hard targets like banks or governments. Once these exploits get into the hands of ordinary hackers, they are set to troll the general public.
It works like this: Most software developers will release patches for zero day exploits after a breach, but these patches don’t make it to everyone. Hackers take advantage of this by embedding exploit kits into various websites. These kits look for browser configurations with outdated software that’s still vulnerable to zero day attacks. They then install all kinds of vicious malware onto the unpatched systems.
Avoiding sites that offer porn or free flash games is no sure way to avoid an exploit kit. Infected sites include legitimate destinations such as church websites or the personal site of celebrity chef Jamie Oliver. The only way to protect users is to block unpatched versions of vulnerable software from running on peoples’ browsers.
For this reason, unpatched versions of Flash are swiftly becoming unusable. Users of the Firefox browser were unable to use Flash until they downloaded a patch that Adobe released on July 14th. The Chrome browser has emplaced similar restrictions.
Alex Stamos, the Chief Security Officer at Facebook, tweeted his thoughts regarding the end of the Flash era, and expanded on his thoughts, saying that the long lifespan of Flash was delaying the move to more modern and secure protocols such as HTML5. This is an extremely legitimate complaint.
As previously mentioned, Flash dates back to the mid-90s. In 1996, the total economic cost of cyberattacks was $1.8 billion, compared to $17.1 billion just four years later (source: The Economic Impact of Cyber-Attacks). No one in 1996 was really worried about designing software to resist security breaches, because back then cyberattacks were just static on the radar.
Since then, the program has changed hands from Shockwave to Macromedia to Adobe, all the while gaining new capabilities and feature sets and design philosophies. As a rule of thumb, a program will become larger, run slower, and generate additional bugs. By this measure, it is long past time for Flash to die, as its design herpes isn’t limited to security bugs. The program has an extremely poor implementation on mobile devices, is a memory hog, and causes the battery life on phones and laptops to plummet.
So, it’s time for Flash to die, but it still keeps chugging along like a zombie made of software. What can you do about it? Here’s a tip: the fewer people who run Flash, the less developers and website designers will feel the need to support it. Here’s a guide for people to disable Flash on all major browsers. Better yet, rip it out at the roots. Here’s Adobe’s guide for uninstalling Flash on Windows and Mac.
If you’re a website developer, please be aware that coding in HTML5 will provide you with a mobile-optimized site that can do everything Flash can’t. If you’re a game developer, I’m aware that many past gaming hits, including Angry Birds, were coded in Flash. However, Flash itself is beginning to end-of-life many features that made it optimal for game development, and Unity represents a free or low-cost alternative.
In conclusion, Flash is essentially the Model T of software. Flash was the entryway to programming for millions of people in the early days of the Dot-Com revolution, and is currently almost useless.
Everything that Flash once did, another program now does better, faster, and more securely. If you’re reading this, follow the instructions in the paragraph above, and help us consign Flash to the museum where it belongs.