Published on by

For years I have been advocating against Adobe Flash Player. My arguments have been:

Unfortunately, with the advent of web services such as YouTube and Hulu, Flash Player became "necessary" part of our browsing experience. Web browsers would persistently nag you to "install additional plugins to be able to view the content" and soon foot was in the door, there was no computer left that didn't have Adobe Flash Player installed.

This "popularity" made Flash Player a target for hackers and cyber-criminals alike — soon various exploits started to show up, and neverending patch the hole / find new exploit race between Adobe developers and people with malicious intent has begun. To stay ahead in this game Adobe developers implemented auto-update technology for Flash Player.

That auto-update feature is exactly what prompted me to write this rant. Today when I powered up my PC I was greeted with the following dialog:

FlashUtil10g_Plugin.exe

What is wrong with that?

  1. I was not presented with an option to use auto-update when I installed Flash Player.
  2. FlashUtil10g_Plugin.exe file which presents this dialog resides in WINDOWS folder hierarchy, not in Program Files, which is bad security practice.
  3. Mechanism by which FlashUtil10g_Plugin.exe gets executed on a schedule is concealed — I could not find it registered in common autorun locations. This behavior is typical for spyware and malware because they do not want you to be able to "accidentally" remove it.
  4. Adobe Flash Player settings are not easily discoverable — you need to launch your browser and estabilish connection with Adobe's website to be presented with settings manager embedded into a webpage.
  5. Being integral part of Adobe's webpage theoretically allows Adobe to have full insight into your Flash Player settings — which sites you have visited, allowed or denied access, etc.

All this prompted me to revisit my Flash Player settings and to witness feature creep first hand — enter Peeer-Assisted Networking:

Peer-Assisted Networking

In my opinion, introducing such a feature without explicit user consent during installation, and leaving it enabled by default for all websites is pure evil.

Not only it is yet another security risk, a nightmare for corporate network administrators, but it can also set you back for a significant amount of money if your Internet access plan involves paying for the amount of data transferred which is the most common method of payment for Internet access on mobile devices such as cell phones.

For me it is now totally obvious why Apple's CEO Steve Jobs has refused to allow Flash Player on iPhone and iPad. I sincerely hope that HTML5 will take off, and put an end to the tyranical reign of Adobe Flash technology.