RE: Adobe Flash Player from 32.0.0.371 contain a time-bomb

[Brazil2]

Since I can't post a reply in the original thread (http://forum.doom9.org/showthread.php?t=181703) (you do not have permission to access this page), I'm gonna put it here:

After 12-Jan-2021 ... even local SWF-files will not playback.
What is your source about that ?

[FranceBB]

Just set your computer clock to something like February 2021 and try to use flash, it won't work.

Anyway, as much as I don't like to spam other websites on Doom9, I think in this case it's appropriate: there's the XP community of MSFN that noticed it (https://msfn.org/board/topic/174085-newest-adobe-flash-and-shockwave-and-java-too/page/36/)

[LoRd_MuldeR]

What is your source about that ?

Well, he said it can easily be checked by setting your clock to a date after 12-Jan-2021.

Anyways, I think this is the "right" decision. Flash Player has become mostly irrelevant in the WWW, and it is known for endless security flaws. When Adobe will stop releasing "emergency" fixes for Flash Player every few weeks after 12-Jan-2021, then it will be better to have no working Flash Player at all than leaving millions of web-browser in "unprotected" state, by vulnerable Flash Player versions that never are going to be patched...

BTW: I assume that this "time-bomb" thing applies to the Flash Player plug-in for web-browsers only. Standalone Flash-based applications, such as the SWF viewer that comes with IrfanView, probably will continue to work.

[wswartzendruber]

Thank the Lord. The sooner we can all forget Flash ever existed, the better.

[clsid]

Programs like Irfanview and MPC-HC that can play SWF files typically use the Flash ActiveX control (read: IE browser plugin). So that will stop working as well.

[foxyshadis]

As a programmer, the sooner Flash is buried, the better. As a librarian and archivist who likes to preserve interesting things from the past, that's hard, but at least there are re-implementations of the runtime to get things that don't rely on horrific security practices to work. And if all else fails, a VM running XP or 98 with the era's runtime will always be possible.

Most Flash support is de-facto dead simply due to the webserver no longer hosting it, anyway.

[kerry7]

I totally agree, Adobe Flash it was nice several years ago, but nowadays with HTML5, CSS3 and a much more mature JS, Adobe is completely unneeded.

Not mentioned that from always has been a huge hole of hacking attacks, and very easy to hack. So.... I think from the current Internet word this is just a natural step, and we won't miss it. And of course, flash will keep a well deserved space into the Internet History.

[clsid]

Does anyone have a copy of the installers for version 32.0.0.363?

[Brazil2]

Does anyone have a copy of the installers for version 32.0.0.363?
Here you go:
https://www118.zippyshare.com/v/Bfkr51ev/file.html

[clsid]

Thanks.

[Katie Boundary]

Here you go:
https://www118.zippyshare.com/v/Bfkr51ev/file.html

very funny. where's the real file?

[Cary Knoop]

I totally agree, Adobe Flash it was nice several years ago, but nowadays with HTML5, CSS3 and a much more mature JS, Adobe is completely unneeded.

Not mentioned that from always has been a huge hole of hacking attacks, and very easy to hack. So.... I think from the current Internet word this is just a natural step, and we won't miss it. And of course, flash will keep a well deserved space into the Internet History.
Talking about internet history, whatever caused Hot Java to stop working?

[Brazil2]

very funny. where's the real file?
What is funny ?
The files are, obviously, inside the 7z archive file which contains the standalone player (SA) also called Projector, the plugins for Firefox, the plugins for IE (AX), and the plugins for Chrome (PPAPI).
All of these are original signed files.

[StainlessS]

What is funny ?
I get a 403 Forbidden.

[Brazil2]

I get a 403 Forbidden.
Works for me.

For convenience I've also uploaded it here:
https://we.tl/t-Si985Ohgda

But it will expire in one week from now.

[StainlessS]

Thanks Brazil2, got it from temp link.

But still forbidden in original link,
https://i.postimg.cc/HJvDb0RD/forbidden-00.jpg (https://postimg.cc/HJvDb0RD)

EDIT: Maybe you have it so as to only allow yourself to download or something, and everyone else is forbidden access.

Has anyone been able to download the original zippyshare link.
[ clsid said "thanks", but did he download ok ? ]

[FranceBB]

Has anyone been able to download the original zippyshare link.
[ clsid said "thanks", but did he download ok ? ]

Nope, "403 Forbidden, nginx" over here as well.

[wonkey_monkey]

It worked for me.

What is funny ?
The files are, obviously, inside the 7z archive file which contains the standalone player (SA) also called Projector, the plugins for Firefox, the plugins for IE (AX), and the plugins for Chrome (PPAPI).
All of these are original signed files.

Ignore Katie Boundary, she assumes you're playing some kind of bizarre joke on her rather than tell you what the problem is (seems several people get an error).

[ChaosKing]

zippyshare.com is blocking some countries + use this site only with an adblocker!

[StainlessS]

HMmmm, me and the prince formerly known as David, used to be in same country, perhaps one of us has emigrated.

[FranceBB]

HMmmm, me and the prince formerly known as David, used to be in same country, perhaps one of us has emigrated.

Or perhaps it's the blocked through DNS or by the ISP... Who knows...

EDIT: Added further info

From Google:


Zippyshare lovers are getting bad news from the last couple of months. Few months before, exactly in March, the website was not accessible from the UK. When you connect to the website from UK IP address, it shows 403 Forbidden message. Later, after one more month, visitors from Germany has also received the same message. Now people from Spain are also reporting the same issue.

[StainlessS]

I presumed that the "403 Forbidden / nginx" thing came from the zippyshare site itself, not ISP or other.

EDIT: Just looked up nginx,

Nginx (pronounced "engine X",[8] /ˌɛndʒɪnˈɛks/ EN-jin-EKS), stylized as NGINX or nginx or NginX,
is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
The software was created by Igor Sysoev and publicly released in 2004.[9] Nginx is free and open-source
software, released under the terms of the 2-clause BSD license.
A large fraction of web servers use NGINX,[10] often as a load balancer.[11]
https://en.wikipedia.org/wiki/Nginx

still looks to me like zippyshare blocking.

[FranceBB]

Yep, googling around I read that it's the website itself that is blocking people from the UK, Germany and Spain, but apparently it's unclear why...

[StainlessS]

Well as Wonkey_Donkey [in same kingdom as myself] was able to access it earlier today, perhaps the site was just busy when I and others tried access,
maybe it puts up "Forbidden" rather than "busy" message.

EDIT: The ISP I used to use, at certain times of day, my [external] IP address seemed to change to that of USA [usually during the night],
and at other times in my own kingdom. Perhaps Wonkey's does something similar.

EDIT: I'm using Mobile Broadband, perhaps zippyshare has blocked the mobile network due to nefarious activity of its users.
[the mobile network that used to switch to USA during the night was Hutchison 3G UK Limited, ie Three. Damn, seems Three was founded in Hong Kong, thought is was American].

[manolito]

ZippyShare has blocked users from some countries for a while now because they are afraid of legal actions from the authorities of these countries.

This is easy to circumvent. Use a VPN (Opera has a built-in VPN), or use a Proxy Server. A free WebProxy is the easiest way for me right now. Go to ProxySite.com, specify a US server and enter the Zippyshare URL.

[StainlessS]

Maybe Wonkey uses a proxy.

[manolito]

AFAIK only some European countries are geoblocked by ZippyShare right now. No need to use a proxy if you are located in the US.

[wonkey_monkey]

I'm not actually in the UK itself.

[FranceBB]

And finally we some official statements:


"the company intends to allow corporate customers to keep the outdated tech on life support beyond that date."

"HARMAN will be the official enterprise distributor for Flash Player providing support and security updates beyond 2020."

"After 2020, Flash Player playback will be blocked by default. This can be overridden by using enterprise enablement functionality available in Adobe’s latest release of Flash Player."

"Full details can be found in our Flash Player Administration guide (see ‘Enterprise Enablement’ section)."


So it seems that companies (and those who actually know what they're doing) can defuse the time-bomb: Link (PDF File) (https://www.adobe.com/content/dam/acom/en/devnet/flashplayer/articles/flash_player_admin_guide/pdf/latest/flash_player_32_0_admin_guide.pdf)

[LoRd_MuldeR]

Programs like Irfanview and MPC-HC that can play SWF files typically use the Flash ActiveX control (read: IE browser plugin). So that will stop working as well.

You are right about that. The Flash support in IrfanView has stopped working by now :scared:

However, it appears Adobe themselves are offering a fully stand-alone program under the name "Flash Player projector" that still works:
https://www.adobe.com/support/flashplayer/debug_downloads.html

Extracting video and sound files from existing SWF files works with JPEXS Free Flash Decompiler:
https://github.com/jindrapetrik/jpexs-decompiler

[clsid]

This makes it work for me in MPC-HC:

C:\Windows\SysWOW64\Macromed\Flash\mms.cfg
AutoUpdateDisable=1
EOLUninstallDisable=1
SilentAutoUpdateEnable=0
DisableDeviceFontEnumeration=1
AllowListPreview=1
TraceOutputEcho=1
EnableAllowList=1
EnableInsecureAllowListLocalPathMatching=1
AllowListRootMovieOnly=1
AllowListUrlPattern=file:*
Note: Requires Windows 7 and Flash 32.0.0.465. It does not work on Windows 10 which uses Flash 32.0.0.445 (this version seems to be buggy as it also failed on Win7).

Alternatively you can use RunAsDate (https://www.nirsoft.net/utils/run_as_date.html) tool on MPC-HC to fool the Flash plugin with a fake date.

[Katie Boundary]

It's not just a matter of being blocked in some countries. Clicking the big download button opens a ton of new new browser windows and tabs (all spam) and asks me if I want to download 7z1900-x64.exe

However, it appears Adobe themselves are offering a fully stand-alone program under the name "Flash Player projector" that still works:
https://www.adobe.com/support/flashplayer/debug_downloads.html

Oh, goodie! Unfortunately, it doesn't seem to work with URLs.