Patch your Flash! Version 19.0.0.226 (October 16, 2015)

[lanux128]

Adobe has released an update to patch a critical vulnerability, details in the link.

You can check your current version here and update if necessary.

• Online Update: https://get.adobe.com/flashplayer/
• Offline Update: https://www.adobe.com/products/flashplayer/distribution3.html

[tomos]

Thanks lanux

[Tuxman]

Maybe people should generally abandon Flash.

[tomos]

Maybe people should generally abandon Flash.

I look forward to the day!
Flash + Firefox has been a disaster for years now. I ran without it for a while on my desktop lately, but found I did need it for a couple of sites (at least one of them work related), so, back with it now.

[Tuxman]

What do you do at work? Review old-fashioned non-HTML5 porn sites? 

[Jibz]

I enabled click-to-play for plugins in Chrome a while back, and there aren't that many sites that require me to run flash anymore. The only slightly annoying thing is that you have to right-click and run the built-in PDF viewer as well.

[tomos]

What do you do at work? Review old-fashioned non-HTML5 porn sites? 

eh, no :p :-)
This year I had to do a share of work using an interactive flash-based mapping site (has various layers that can be interchanged e.g. mapping from various times, etc. and shows location of archaeological sites). I mainly do archaeological illustration -- including some maps, with site locations, etc. (here's an older example).

[mouser]

Thanks for the heads up. 

[mwb1100]

I mainly do archaeological illustration -- including some maps, with site locations, etc. (here's an older example).

A bit off topic, but it looks like it must be an interesting job!  The example you posted reads a bit like a map from a Tolkein book (probably because I don't know a lick of Gaelic):

  - Bóthar Mór
  - Lin Mór
  - Lough Atalia
  - The Green
  - Suckeen Bogs
  - Struthán Muire

[tomos]

A bit off topic, but it looks like it must be an interesting job!  The example you posted reads a bit like a map from a Tolkein book (probably because I don't know a lick of Gaelic):

:-)
I'm no expert, but can say that the Irish language has less in common with middle English (Tolkien's speciality) than, for example, Icelandic, or even modern English for that matter. Irish (Gaeilge/Gaelic) and Scottish Gaelic are very closely related. They are in turn related to other Celtic languages -- Welsh, Breton, etc., but you have to go back much further for their relationship to other European languages.

partial translations

  - Bóthar Mór = (the) Big Road
  - Lin Mór = (the) Big Pool
  - Lough Atalia = anglicisation of Lough an tSáile = Lake of the Willows
  - Suckeen Bogs = Suckeen is an anglicisation of something, but I dont know what. The '-een' suffix was originally a diminutive: '-ín' as in 'Coleen' (wee girl), 'Bóthairín' / 'Boreen' (little road), or 'Tomáisín' [Tomawsheen] (little Tom), etc.
  - Struthán Muire = Mary's Stream

[f0dder]

I'd recommend using Firefox as your primary browser, without any of Java, Flash or AdobePDF plugins, but with stuff like Adblock Origin, Ghostery, Certificate Patrol and (if you can suffer it) RequestPolicy + RefControl + NoScript.

Whenever you need Flash or Java, open that particular site in Chrome.

[Tuxman]

with stuff like Adblock Origin, Ghostery, Certificate Patrol and (if you can suffer it) RequestPolicy + RefControl + NoScript.

... or just µBlock + uMatrix.

[f0dder]

... or just µBlock + uMatrix.

I didn't get to looking at uMatrix yet - does it fully cover what RefControl + RequestPolicy can do?

Ghostery is almost superfluous if you have tight 3rd-party domain blocking, but there might be a few sites that do statistics reporting to their own domain... and I like the overview of trackers it gives

Wouldn't do without NoScript.

[IainB]

I'd recommend using Firefox as your primary browser, without any of Java, Flash or AdobePDF plugins, but with stuff like Adblock Origin, Ghostery, Certificate Patrol and (if you can suffer it) RequestPolicy + RefControl + NoScript.
Whenever you need Flash or Java, open that particular site in Chrome.
_______________________

I'd pretty much arrived at the same conclusion by experimentation. I use FF as the main browser and information-gathering tool (because I collect stuff using the Scrapbook extension and the Zotero utility), and, though I used to use Google Chrome Canary for Flash/Java web pages it had become just fat bloated software, so, when I switched to Win10 I started using MS Edge and that seems to work much more efficiently, so I tend to stick with that.

My kids use a lot of Flash-based games that I have downloaded over time, so I use IrfanView to play those.

So, the thing I miss in FF - my main browser at the moment (but probably not for that much longer) - is easy Flash and YouTube viewing - e.g., pages in the DCF with Flash and YouTube content do not display properly and many discussion threads that used to paginate quite quickly became sluggish (this seems to have been seriously aggravated in the recently-implemented DCF platform).

[Tuxman]

I didn't get to looking at uMatrix yet - does it fully cover what RefControl + RequestPolicy can do?

It does different things with the same result.

Wouldn't do without NoScript.

What does NoScript do for you that uMatrix doesn't, except eat more RAM?

About Ghostery: I, personally, prefer my trackers blocked. I don't want to see them, I want them to just be away.

[f0dder]

As I said, I haven't looked at uMatrix yet - but here goes:

The combination of RefControl + Request Policy lets me control which 3rd-party domains get contacted at all, and lets me control whether the HTTP Referer [sic] header is set for the domains I allow to be contacted.

Ghostery both shows trackers as well as blocks them. Does uMatrix block trackes on the 1st-party domain, including both POST and GET based ones? And does it come with a big library of known trackers, or do you have to write your own rules for everything?

NoScript allows me to block scripts (and other active elements) on the 1st-party domain, as well, as it allows me to allow requests (images, stylesheets, ...) on 3rd-party domains without allowing scripts to be executed there. Does uMatrix handle the same usecases (and without a lot of manual rule entries)?

[f0dder]

So, the thing I miss in FF - my main browser at the moment (but probably not for that much longer)

I wouldn't move to Edge for my main browser experience - while MS definitely have been working hard on improving security, and have done a lot of interesting and nice things both for Edge and Win10, IE + Edge are still going to be the most heavily targeted browsers for a while yet, simply because of market share. That, combined with the lack of security-focused extensions, still makes Firefox the #1 choice.

But interesting the MS is building Flash into Edge, might make it a viable alternative to Chrome for the secondary browser - though I'll obviously still be on Chrome on the work macbook

[Tuxman]

The combination of RefControl + Request Policy lets me control which 3rd-party domains get contacted at all

That's the whole point of uMatrix.

Does uMatrix block trackes on the 1st-party domain, including both POST and GET based ones?

Blocking trackers is what (good) ad blockers are for. µBlock has lists for that.

And does it come with a big library of known trackers, or do you have to write your own rules for everything?

^ The lists ...

NoScript allows me to block scripts (and other active elements) on the 1st-party domain, as well, as it allows me to allow requests (images, stylesheets, ...) on 3rd-party domains without allowing scripts to be executed there. Does uMatrix handle the same usecases (and without a lot of manual rule entries)?

All of those: Yep.

[IainB]

with stuff like Adblock Origin, Ghostery, Certificate Patrol and (if you can suffer it) RequestPolicy + RefControl + NoScript.

... or just µBlock + uMatrix.
______________________

Many thanks for mentioning that. I have discovered that there is some potentially useful experiential truth there. I knew nothing about either µBlock + uMatrix until you mentioned them, whereupon I did a bit of reading up on them and similar/associated tools. There was definitely something useful in what you wrote, and a trial on a suck-it-and-see basis seemed appropriate to find out more about the potential. That is, the potential to achieve the same (or more) in blocking etc. than existing tools do, by replacing existing security/privacy tools with something that uses significantly less resources (RAM and CPU).
Currently, my existing FF configuration is grossly inefficient when operational and is fast becoming too bloated.

So, now I can blame you for my having installed µBlock Origin + uMatrix.

I don't know why (?) you settled on µBlock instead of  µBlock Origin, but I thought I'd try them both out, starting with  µBlock Origin first.
I'd be interested in any advice/thoughts you might have on this.
(This subject seems a bit off-topic. Maybe I need to put it in a new/separate topic/thread.)

[Tuxman]

So, now I can blame you for my having installed µBlock Origin + uMatrix.

Nooooooo!

I don't know why (?) you settled on µBlock instead of  µBlock Origin

Both are developed in parallel, both copy from each other. I guess it depends on the mood.

As they use the same ad-blocking filter lists, it should not matter much anyway.

[f0dder]

The combination of RefControl + Request Policy lets me control which 3rd-party domains get contacted at all

That's the whole point of uMatrix.

That much I had already gathered, and I've considered looking into uMatrix as a replacement for RequestPolicy. Anyway, you skipped the second part of that line of text - "and lets me control whether the HTTP Referer [sic] header is set for the domains I allow to be contacted.".

I guess I'll have to check out uMatrix, although I'm doubtful it really does handle all the above-mentioned stuff - you probably misunderstood my questions.

[f0dder]

I don't know why (?) you settled on µBlock instead of  µBlock Origin, but I thought I'd try them both out, starting with  µBlock Origin first.
I'd be interested in any advice/thoughts you might have on this.
(This subject seems a bit off-topic. Maybe I need to put it in a new/separate topic/thread.)

I'm sticking with uBlock Origin - here's why.

[Tuxman]

IIRC the reason is not entirely true, but YMMV.

[f0dder]

Right, I've dropped RequestPolicy - uMatrix beats it in every possible way, from performance to advanced features to ease-of-use. All of those were expected, perahsp except ease-of-use... it's really great. I modified the defaults from always allowing css/image references to only allowing them first-party, which means a little more work, but also more safe blocking. The matrix view that quickly lets you identify & check off the stuff you need works extremely well.

It doesn't replace RefPolicy, though, since it only lets you spoof the HTTP REFERER, it doesn't offer the block/allow that RefPolicy does. And I'm still keeping Ghostery and uBlock since uBlock can pretty up visual elements and is more fine-grained than uMatrix (DOM regexes rather than non-regex host-based).

Some day I'll have to take a more indepth look at Ghostery to evaluate whether it adds a lot when I have extensive host blocking - but it works differently than uBlock/uMatrix since it can fiddle with JavaScript to neutralize trackers even on first-party sites where you want to run the non-tracking scripts.

[IainB]

^^ That's rather interesting. Thanks for mentioning it @f0dder.