Security Archive

Flash Player 9 April 2008 Security Update affects me too


So here I was, thinking that the Flash Player 9 security update (version 9.0.124) wasn’t going to affect me. A silly assumption, of course—I should have tested with the beta, regardless—but since I didn’t do anything fancy with sockets or web services, I thought I would be fine.
Ha!
I missed this section: “You have SWFs that [...]

Flash Player security misunderstanding


Up until now, I had been making some incorrect assumptions about Adobe Flash Player’s security model.
I had assumed that a SWF could not access anything outside of the domain from which it had been served, in general, without special allowances made by things like crossdomain.xml or System.security.allowDomain().
What I didn’t realize is that these domain restrictions [...]