Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,456
30,667



Following Adobe's release of a "critical" update for Flash Player yesterday to address a security issue that is currently being exploited in the wild, Apple has updated its "Xprotect" anti-malware system to disable older versions of the plug-in. The move forces users to upgrade to the latest version of Flash if they wish to continue using the still-common media plug-in.

xprotect_flash_12_0_0_44.jpg
Updated Xprotect definitions requiring new 12.0.0.44 version of Flash Player
Apple's Xprotect for OS X was introduced as part of OS X Snow Leopard in 2009 as a rudimentary anti-malware system that allowed Apple to block installation and running of the relatively rare cases of known malware targeting Mac systems. By 2011, Apple had upgraded the system to allow users' Macs to automatically check for updated definitions every 24 hours, ensuring up-to-date protection.

While primarily targeted specifically at malware protection, the Xprotect system also allows Apple to enforce minimum versions of plug-ins such as Flash and Java, and the company has on occasion blocked older versions of both of these plug-ins to ensure that users upgrade their systems.

Apple's use of the Xprotect system has, however, declined in recent months, perhaps signaling a slowdown in malware and other security issues affecting Mac systems. The most recent significant update to Xprotect definitions prior to yesterday came in mid-September to address the OSX/Leverage.A malware.

Article Link: Apple Enforces Adobe Flash Player Security Upgrade with Updated Malware Definitions
 

proline

macrumors 6502a
Nov 18, 2012
630
1
Before anyone starts going on about how Orwellian Xprotect is and that they have a God-given right to run flawed Adobe plug-ins, this ONLY AFFECTS SAFARI. So you are 'free' to download any other browser and run vulnerable software if keeping your pants down is your thing.
 

furi0usbee

macrumors 68000
Jul 11, 2008
1,790
1,382
I haven't had Flash installed on a Mac since 2011. I'm better off without it.

How do you watch YouTube? If I don't install Flash, I can't watch YouTube using HTML5. So I simply use Click2Flash and then watch HTML5, then load flash as I need it.

As I recall, when I removed Flash, even with AdBlock on, I got more clutter on websites, where flash ads were.

So if you can tell me how to solve my issues above, I'll remove Flash too.
 

Tankmaze

macrumors 68000
Mar 7, 2012
1,707
351
How do you watch YouTube? If I don't install Flash, I can't watch YouTube using HTML5. So I simply use Click2Flash and then watch HTML5, then load flash as I need it.

I always use chrome when flash is needed, otherwise I just use safari.
and I never install flash plugin since chrome launched.
 

guzhogi

macrumors 68040
Aug 31, 2003
3,733
1,824
Wherever my feet take me…
I work in a school and a number of teachers watch YouTube, Discovery Education, and other sites that use Flash. It's a real pain to make lesson plans and then see the Flash error thing. While the IT department does have ways to push out the updates, it usually takes a while.

I always use chrome when flash is needed, otherwise I just use safari.
and I never install flash plugin since chrome launched.

The problem with Chrome is it's still 32-bit which means no Java. Plus, the grade book software the district uses uses Java so we need to run Safari or Firefox. Plus, for some reason, XProtect prevents Firefox from using outdated versions of Flash & Java for us.
 

AdamN

macrumors newbie
Jan 22, 2009
28
0
My xprotect file hasn't been updated since October ... how exactly does the update process work?

➜ Resources pwd
/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources
➜ Resources ll XProtect.meta.plist
-rw-r--r-- 1 root wheel 1148 Oct 23 20:00 XProtect.meta.plist
 

sseaton1971

macrumors 6502
Feb 9, 2012
431
11
I work in a school and a number of teachers watch YouTube, Discovery Education, and other sites that use Flash. It's a real pain to make lesson plans and then see the Flash error thing. While the IT department does have ways to push out the updates, it usually takes a while.

I wrote a script that disables the minimum version requirements in Xprotect on student laptops when a users logs out and back in. Security is not a real worry on shared student laptops for us. Our staff laptops do not have this script, and we simply ask staff to update Flash (and Java) when Apple updates Xprotect. This seems to work very well for us.
 

Amazing Iceman

macrumors 603
Nov 8, 2008
5,283
4,030
Florida, U.S.A.
How do you watch YouTube? If I don't install Flash, I can't watch YouTube using HTML5. So I simply use Click2Flash and then watch HTML5, then load flash as I need it.

As I recall, when I removed Flash, even with AdBlock on, I got more clutter on websites, where flash ads were.

So if you can tell me how to solve my issues above, I'll remove Flash too.

Remove the second in command after Flash: JAVA :D
 

Yamcha

macrumors 68000
Mar 6, 2008
1,825
158
Yeah, unfortunately Adobe Flash is still widely used on major websites like YouTube, and while they have an HTML5 version it's terrible, because the vast majority of the videos don't work & I find any videos that have ads running will not run.
 

guzhogi

macrumors 68040
Aug 31, 2003
3,733
1,824
Wherever my feet take me…
I wrote a script that disables the minimum version requirements in Xprotect on student laptops when a users logs out and back in. Security is not a real worry on shared student laptops for us. Our staff laptops do not have this script, and we simply ask staff to update Flash (and Java) when Apple updates Xprotect. This seems to work very well for us.

I think the IT department has the same kind of script, but for all computers. The teachers are given admin rights on their computers, but so many of them don't have the technical know-how to install the updates, and even more of them just don't have the time. Fortunately, we have some software update software by Casper or something so updates can get pushed out, regardless of teacher know-how/time. It just takes a while.
 

FakeWozniak

macrumors 6502
Nov 8, 2007
428
26
How do you watch YouTube? If I don't install Flash, I can't watch YouTube using HTML5. So I simply use Click2Flash and then watch HTML5, then load flash as I need it.

As I recall, when I removed Flash, even with AdBlock on, I got more clutter on websites, where flash ads were.

So if you can tell me how to solve my issues above, I'll remove Flash too.

I am running the extensions YouTube5 and AdBlock and couldn't be happier. If a website needs flash, I pull out a super old laptop with Win2K to see it. I haven't had to pull out that laptop in years.
 

smithrh

macrumors 68030
Feb 28, 2009
2,722
1,730
Yeah, unfortunately Adobe Flash is still widely used on major websites like YouTube, and while they have an HTML5 version it's terrible, because the vast majority of the videos don't work & I find any videos that have ads running will not run.

I have yet to find a single video on YouTube that was missing an HTML5 version.

Period.

Quality is just as good.

Not sure what to tell you, check your extensions, reset Safari, but I've not watched a Flash-based video on YouTube for a very long time now.
 

smithrh

macrumors 68030
Feb 28, 2009
2,722
1,730
Flash needs to go. It's holding us back: HTML 5 is the future.

Let me touch that up a bit:

Flash is the past, HTML5 is now.

Note, there are parts of HTML5 video that I can do without - YouTube's DASH implementation comes to mind. Frequently, painfully enough.

H.265 is likely the future, same quality for half the bandwidth.
 

Nermal

Moderator
Staff member
Dec 7, 2002
20,622
3,983
New Zealand
I have yet to find a single video on YouTube that was missing an HTML5 version.

Interesting; I just did a fresh install of 10.9.1 yesterday and haven't yet installed Flash... and couldn't find a single video that would play (whether or not I toggled this).

Edit: Wait, this "featured" one works, but as an example this one tells me that I need Flash. Do both work for you?
 

smithrh

macrumors 68030
Feb 28, 2009
2,722
1,730
Can you tell me what else (player) to use in Safari? Most of sites uses Flash, example - the NY Times videos. :confused:

I'd hardly say most sites use Flash.

I do find that when sites *only* use Flash (like the NYTimes mentioned above), they're far more interested in serving you video ads which you have to suffer through before you actually get to content.

TV stations and TV networks are the worst for this.

Basically, if they try to ram an ad down my throat, I'm simply not going to watch anything from them.

I've yet to feel that I've missed something actually important.

The NYT wants to force a 30 second ad on me before a 60 second recap of what they put in print and on-line in words.

Yeah, no.
 

smithrh

macrumors 68030
Feb 28, 2009
2,722
1,730
Interesting; I just did a fresh install of 10.9.1 yesterday and haven't yet installed Flash... and couldn't find a single video that would play (whether or not I toggled this).

Edit: Wait, this "featured" one works, but as an example this one tells me that I need Flash. Do both work for you?

Both work for me in HTML5/mp4.

I've found that Flash needs be *installed* before the plugins that allow HTML5 will work.

Give that a try. Yeah it's a PITB...
 

petvas

macrumors 603
Jul 20, 2006
5,479
1,807
Munich, Germany
I have Flash installed on my iMac and while I don't really like it, it is a necessary evil. Many websites do use it, and I don't want to use Chrome just for these sites. I use Safari all the time, and I utilize Safari's new plug in energy saver function to control which sites are allowed to run Flash. It works very well and there is no need for click2flash.
Of course, if using a laptop Flash has a much bigger impact on energy requirements than on an iMac. This is one of the advantages of not having to worry about power saving features I guess.:)

I agree that Flash needs to go, but there is still a lot of content out there that needs to be converted to something better. HTML 5 is a good alternative for most things, but it seems this is not necessarily the future. I guess we will see a newer HTML version coming at some point...
Read here for more information: http://www.andrewgreig.com/257/
 

smithrh

macrumors 68030
Feb 28, 2009
2,722
1,730
I ran into 1 last night: http://www.youtube.com/watch?v=z6kgvhG3AkI . Today, it works without flash. I guess the age of the video may have something to do with it. It was only like 2 hours old when I watched it.

It will depend on what format the video was originally submitted in as well.

YouTube makes several versions of each video, at varying resolutions. It's not an instantaneous process, so while I've never run into an issue with a format being unavailable, I'm sure it happens once in a blue moon to folks.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.