I've actually posted a thread on the forums about this. For youtube you can just use HTML5. If you require flash there are alternatives: gnash, lightspark, freshplayerplugin-git, shumway, etc...

On Wed, Jul 15, 2015 at 7:09 PM, Francis Gerund ranrund@gmail.com wrote:

Hello!

Run:

• Arch linux 64-bit
• 4.0.7-2-ARCH #1 SMP PREEMPT Tue Jun 30 07:50:21 UTC 2015 x86_64

GNU/Linux

• Firefox 39.0-1
• flashplugin 11.2.202.481-1 (Install Date : Wed 08 Jul 2015)

What is best practice about the current flash vulnerabilites? Just uninstall flashplugin? Can live without, but many websites still require it.

freshplayerplugin

Just to nitpick: even if it's more current (feature-wise) than standard Adobe Linux 11.2 flashplugin, it's still Adobe Flash and thus just as problematic regarding its security.

--byte

Okay.

Just uninstalled flashplugin (really should never have installed anyway). can always try gnash later, but I'll try without to see how it goes.

Thanks.

On Wed, Jul 15, 2015 at 6:38 PM, Jens Adam jra@byte.cx wrote:

...

freshplayerplugin

Just to nitpick: even if it's more current (feature-wise) than standard Adobe Linux 11.2 flashplugin, it's still Adobe Flash and thus just as problematic regarding its security.

--byte

On 16 July 2015 at 13:04, Ralf Mardorf ralf.mardorf@rocketmail.com wrote:

On Wed, 15 Jul 2015 19:45:35 -0500, Francis Gerund wrote:

...

Just uninstalled flashplugin (really should never have installed anyway). can always try gnash later, but I'll try without to see how it goes.

Gnash can't replace the proprietary crap. I neither have the proprietary, nor gnash installed. For "emergency" I've got Chrome installed, but my usual approach is, that as soon as Chrome is needed, I'm not interested in the content anymore. JFTR assumed you're using Firefox with safe browsing and auto-updates e.g. for Cisco H264, with prefetch and keyword enabled and geo information and reports enabled, then you don't need to care about how evil a Google browser or Adobe crap are, since your Firefox is bad too ;).

I have to agree with Ralf, you will be fine.

I have been flash-free for 18 months now and it's going absolutely fine. Unless you have a penchant for flash games, there's very little reason to have it installed any more.

On 07/16/2015 01:37 AM, Sebastian Pipping wrote:

On 16.07.2015 01:22, D C wrote:

...

I've actually posted a thread on the forums about this. For youtube you can just use HTML5.

To my best knowledge, it depends on the video / the compression algorithm used. For some videos on YouTube HTML5 works just fine, for some Videos you still need Flash.

FWIW, I don't think I've ever encountered a non-HTML5-friendly video on YouTube in at least 2 years. (Granted, this is just anecdata, but...)

On Thu, 16 Jul 2015 12:20:48 -0400, Daniel Micay wrote:

On 16/07/15 12:06 PM, Ralf Mardorf wrote:

...

http://www.theguardian.com/technology/2015/jul/14/facebook-end-adobe-flash-f...

Mozilla blocked the vulnerable version, as they've done in the past. The current release isn't blocked because there aren't yet disclosed security vulnerabilities.

Google bundles the PPAPI Flash player with Chrome so they don't need a comparable blacklist as it gets updated with the browser.

That's not why I posted this link. I posted it regarding the quote of Facebook’s head of security Alex Stamos:

"It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day."

On Thu, 16 Jul 2015 12:01:09 -0500, Francis Gerund wrote:

Just noticed in Firefox 39.0-1 preferences an entry "Flash video".

Where exactly is this entry?

I heard that H.264 from Cisco phones home, resp. auto-updates, so you might want to edit about:config to use gstreamer H.264. Perhaps this automatically is done by installing the optional dependencies?

JFTR I didn't change something regarding H.264 and I kept several other phone home crap of a default Firefox. I guess I only disabled "Block reported..." by the preferences.

However, if I right click on a YouTube video there is "About the HTML5 player": https://www.youtube.com/html5

On 07/16/2015 05:10 AM, Ben Oliver wrote:

I have to agree with Ralf, you will be fine.

I have been flash-free for 18 months now and it's going absolutely fine. Unless you have a penchant for flash games, there's very little reason to have it installed any more.

I totally support phasing out flash, however, I run firefox inside a docker container and then I don't have to worry about these security issues since I disgard the running container and reload from the saved image daily.

Natu

On 07/16/2015 01:06 PM, Daniel Micay wrote:

On 16/07/15 03:48 PM, Natu wrote:

...

On 07/16/2015 05:10 AM, Ben Oliver wrote:

...

I have to agree with Ralf, you will be fine.

I have been flash-free for 18 months now and it's going absolutely fine. Unless you have a penchant for flash games, there's very little

reason to

...

...

have it installed any more.

I totally support phasing out flash, however, I run firefox inside a docker container and then I don't have to worry about these security issues since I disgard the running container and reload from the saved image daily.

Natu

You do have to worry unless you don't care about it someone grabbing all of your active login sessions (cookies), all of the entered form data, etc. There's a reason for browser sandboxes being per-site-instance instead of trying to wrap the browser as a whole. Most of the information the attackers want is in the web browser, or can be obtained there by grabbing passwords and other information like credit card numbers as they're entered.

Anyway, local privilege exploits in the Linux kernel are as common as remote Flash exploits. Docker exposes nearly the entire Linux kernel attack surface to code in the container. It's not much of a sandbox.

Thanks for pointing this out.. What you say is true. I actually run two different firefox browsers, one for secure uses and the other for random browsing. One inside of a VM on my desktop (and I revert back to the base image daily). The other web browser I run in a docker container running on a tiny arm box. The one running on the arm box, obviously doesn't support flash. I generally use the one running on the arm box for online banking/credit cards etc.

I don't know that I even trust openssl anymore. I used to run chromium, but got tired of it passing so much information back to google, so I went back to firefox. What I run is not an ideal solution. I'm open to other suggestions. I used to love chrome, but got tired of google spying. And yes, you have to turn off features in firefox to avoid similar spying behavior, but it can be done without maintaining your own version of the source code.

Natu

On Thu, 16 Jul 2015 13:43:25 -0700, Natu wrote:

And yes, you have to turn off features in firefox to avoid similar spying behavior, but it can be done without maintaining your own version of the source code.

But we need to monitor Firefox. A minute ago I deleted 7 Yahoo entries in about:config. Using Wireshark I noticed connections to a Yahoo thingy. If you clean about:config from all unwanted entries, you might automagically get new unwanted entries after a while. I consider my machine as a digital audio workstation with less security and less privacy. Pale Moon seems not to be (much) better. Maybe QupZilla is a little bit better, at least the history is better usable :D.

I don't know that I even trust openssl anymore. I used to run chromium, but got tired of it passing so much information back to google, so I went back to firefox. What I run is not an ideal solution. I'm open to other suggestions. I used to love chrome, but got tired of google spying. And yes, you have to turn off features in firefox to avoid similar spying behavior, but it can be done without maintaining your own version of the source code.

Chromium doesn't have 'spying' code that's not optional. It supports more Google services than Firefox and uses more of them out-of-the-box since it's the basis of the browser Google uses to promote themselves. Firefox is picking up support for non-Google proprietary services over time anyway so it'll probably end up with more in the end.

User security is certainly much, much lower on Firefox's priority list. They don't even enable ASLR yet, let alone robust sandboxing and advanced exploit mitigations throughout the browser. Mozilla ends up taking the same anti-user positions on issues like DRM after pretending that they're different. I can't think of one issue where they've taken the high road compared to Chromium. At least you know what you're getting with Google: profit-oriented corporation. Mozilla may not be accountable to shareholders, but they're even less concerned about the users. Google will reverse course during a PR disaster... Mozilla will just dig in and stonewall.

For just one of many examples, look at the difference in the handling of the WebRTC IP leak:

https://code.google.com/p/chromium/issues/detail?id=333752 https://bugzilla.mozilla.org/show_bug.cgi?id=959893

Oh, and the developer making the calls at Mozilla on this WebRTC privacy disaster developed the backdoored random number generation standard with the NSA. Mozilla isn't interested in commenting on this at all, as is usually the case (all discussion about it has been shut down).[1]

[1] http://www.reuters.com/article/2014/03/31/us-usa-security-nsa-rsa-idUSBREA2U...

Google would have fired this guy ASAP because it's not in their self-interest to make themselves look bad. Mozilla just coasts by on a naive, trusting community as they always do... and yet of their prominent developers think you should be groveling at their feet for all the good they've done for FOSS.

On 07/16/2015 05:50 PM, Daniel Micay wrote:

...

I don't know that I even trust openssl anymore. I used to run chromium, but got tired of it passing so much information back to google, so I went back to firefox. What I run is not an ideal solution. I'm open to other suggestions. I used to love chrome, but got tired of google spying. And yes, you have to turn off features in firefox to avoid similar spying behavior, but it can be done without maintaining your own version of the source code.

Chromium doesn't have 'spying' code that's not optional. It supports more Google services than Firefox and uses more of them out-of-the-box since it's the basis of the browser Google uses to promote themselves. Firefox is picking up support for non-Google proprietary services over time anyway so it'll probably end up with more in the end.

Have you used something like tcpdump and verified that you can configure chromium such that it doesn't connect to any google servers or any other servers other than the ones that you've specified in the url or that are referenced on web pages that you've opened? Maybe I'll have to try it again. That wasn't my experience the last time I tried it.

Mozilla gets a large amount of their funding from google, so there's alot of politics behind this. Google for "firefox funded by google".

User security is certainly much, much lower on Firefox's priority list. They don't even enable ASLR yet, let alone robust sandboxing and advanced exploit mitigations throughout the browser. Mozilla ends up taking the same anti-user positions on issues like DRM after pretending that they're different. I can't think of one issue where they've taken the high road compared to Chromium. At least you know what you're getting with Google: profit-oriented corporation. Mozilla may not be accountable to shareholders, but they're even less concerned about the users. Google will reverse course during a PR disaster... Mozilla will just dig in and stonewall.

For just one of many examples, look at the difference in the handling of the WebRTC IP leak:

https://code.google.com/p/chromium/issues/detail?id=333752 https://bugzilla.mozilla.org/show_bug.cgi?id=959893

Oh, and the developer making the calls at Mozilla on this WebRTC privacy disaster developed the backdoored random number generation standard with the NSA. Mozilla isn't interested in commenting on this at all, as is usually the case (all discussion about it has been shut down).[1]

I do agree that chromium is technically more advanced, but I don't exactly trust google either. I'm not really sure where to find a web browser that can be trusted. I do note that both tor and jondo have chosen firefox, and I suspect there is a good reason for this, though they do apply their own modifications. The security of TOR has been touted as being very solid, though I haven't seen as many reviews of jondo. By default flash is disabled in both of them, but easier to turn on in jondofox.

[1] http://www.reuters.com/article/2014/03/31/us-usa-security-nsa-rsa-idUSBREA2U...

Google would have fired this guy ASAP because it's not in their self-interest to make themselves look bad. Mozilla just coasts by on a naive, trusting community as they always do... and yet of their prominent developers think you should be groveling at their feet for all the good they've done for FOSS.

On Thu, 16 Jul 2015 16:01:42 -0700, Natu wrote:

Tor browser

Tor browser not necessarily is slow, but it is missing comfort such as a history.

I need around 1½ hours to compile a kernel with a default Arch configuration and around 3½ hours to compile Firefox.

In Western civilisations we seldom need TOR, what we need are less bloated browsers, that still provide some comfort.

On 16/07/15 11:30 PM, Natu wrote:

On 07/16/2015 05:50 PM, Daniel Micay wrote:

...

...

I don't know that I even trust openssl anymore. I used to run chromium, but got tired of it passing so much information back to google, so I went back to firefox. What I run is not an ideal solution. I'm open to other suggestions. I used to love chrome, but got tired of google spying. And yes, you have to turn off features in firefox to avoid similar spying behavior, but it can be done without maintaining your own version of the source code.

Chromium doesn't have 'spying' code that's not optional. It supports more Google services than Firefox and uses more of them out-of-the-box since it's the basis of the browser Google uses to promote themselves. Firefox is picking up support for non-Google proprietary services over time anyway so it'll probably end up with more in the end.

Have you used something like tcpdump and verified that you can configure chromium such that it doesn't connect to any google servers or any other servers other than the ones that you've specified in the url or that are referenced on web pages that you've opened? Maybe I'll have to try it again. That wasn't my experience the last time I tried it.

It will check for updates to extensions... so will other browsers. You are claiming that spying code is there yet it's an open-source project and no one has ever found any. Prove it instead of spreading FUD.

Mozilla gets a large amount of their funding from google, so there's alot of politics behind this. Google for "firefox funded by google".

Mozilla gets their money from other sources like Yahoo and the in-browser advertising and proprietary services now.

...

User security is certainly much, much lower on Firefox's priority list. They don't even enable ASLR yet, let alone robust sandboxing and advanced exploit mitigations throughout the browser. Mozilla ends up taking the same anti-user positions on issues like DRM after pretending that they're different. I can't think of one issue where they've taken the high road compared to Chromium. At least you know what you're getting with Google: profit-oriented corporation. Mozilla may not be accountable to shareholders, but they're even less concerned about the users. Google will reverse course during a PR disaster... Mozilla will just dig in and stonewall.

For just one of many examples, look at the difference in the handling of the WebRTC IP leak:

https://code.google.com/p/chromium/issues/detail?id=333752 https://bugzilla.mozilla.org/show_bug.cgi?id=959893

Oh, and the developer making the calls at Mozilla on this WebRTC privacy disaster developed the backdoored random number generation standard with the NSA. Mozilla isn't interested in commenting on this at all, as is usually the case (all discussion about it has been shut down).[1]

I do agree that chromium is technically more advanced, but I don't exactly trust google either.

Yet you trust another American corporation (Mozilla) that has repeatedly shown itself to place users and especially contributors in even lower regard.

I'm not really sure where to find a web browser that can be trusted. I do note that both tor and jondo have chosen firefox, and I suspect there is a good reason for this, though they do apply their own modifications. The security of TOR has been touted as being very solid, though I haven't seen as many reviews of jondo. By default flash is disabled in both of them, but easier to turn on in jondofox.

The Tor browser is quite insecure. It's nearly the same thing as Firefox, so it falls near the bottom of the list when it comes to browser security, i.e. below even Internet Explorer, which has a basic sandbox (but not nearly on par with Chromium, especially on Linux) and other JIT / allocator hardening features not present at all in Firefox. What the Tor browser *does* have that's unique are tweaks to significantly reduce the browser's unique fingerprint.

https://blog.torproject.org/blog/isec-partners-conducts-tor-browser-hardenin...

Tor would be a fork of Chromium if they were starting again today with a large team. They don't have the resources to switch browsers. That would only change if they can get Google to implement most of the features they need.

On 17/07/15 12:35 PM, Ralf Mardorf wrote:

On Fri, 17 Jul 2015 11:30:05 -0400, Daniel Micay wrote:

...

The Tor browser is quite insecure. It's nearly the same thing as Firefox, so it falls near the bottom of the list when it comes to browser security, i.e. below even Internet Explorer, which has a basic sandbox (but not nearly on par with Chromium, especially on Linux) and other JIT / allocator hardening features not present at all in Firefox. What the Tor browser *does* have that's unique are tweaks to significantly reduce the browser's unique fingerprint.

https://blog.torproject.org/blog/isec-partners-conducts-tor-browser-hardenin...

Tor would be a fork of Chromium if they were starting again today with a large team. They don't have the resources to switch browsers. That would only change if they can get Google to implement most of the features they need.

Vivaldi is based on Chromium. How does Vivaldi compare regarding security and privacy to IceCat, Pale Moon, Firefox, QupZilla, Opera?

https://aur4.archlinux.org/packages/?O=0&K=vivaldi https://aur.archlinux.org/packages/?O=0&K=vivaldi

It's a proprietary browser built on Chromium. It's not interesting from a security / privacy perspective.

If you want Chromium without Google integration then you can use Iridium. It doesn't remove any tracking / spying code though. There wasn't any to remove. Their redefinition of tracking just means support for any service hosted by Google (like adding a warning message when a dictionary would be downloaded from them). Most of what it does is changing the the default settings to be more privacy conscious.

https://git.iridiumbrowser.de/cgit.cgi/iridium-browser/log/

On 17/07/15 01:14 PM, Jagannathan Tiruvallur Eachambadi wrote:

We don't have it in the AUR though.

Well, I don't really think it's useful. It was just a suggestion for people who can't tolerate Chromium downloading things like dictionaries from Google.