Apple Enforces Adobe Flash Player Security Upgrade with Updated Malware Definitions

Discussion in 'Mac Blog Discussion' started by MacRumors, Feb 5, 2014.

  1. macrumors bot


    Apr 12, 2001

    Following Adobe's release of a "critical" update for Flash Player yesterday to address a security issue that is currently being exploited in the wild, Apple has updated its "Xprotect" anti-malware system to disable older versions of the plug-in. The move forces users to upgrade to the latest version of Flash if they wish to continue using the still-common media plug-in.

    Updated Xprotect definitions requiring new version of Flash Player
    Apple's Xprotect for OS X was introduced as part of OS X Snow Leopard in 2009 as a rudimentary anti-malware system that allowed Apple to block installation and running of the relatively rare cases of known malware targeting Mac systems. By 2011, Apple had upgraded the system to allow users' Macs to automatically check for updated definitions every 24 hours, ensuring up-to-date protection.

    While primarily targeted specifically at malware protection, the Xprotect system also allows Apple to enforce minimum versions of plug-ins such as Flash and Java, and the company has on occasion blocked older versions of both of these plug-ins to ensure that users upgrade their systems.

    Apple's use of the Xprotect system has, however, declined in recent months, perhaps signaling a slowdown in malware and other security issues affecting Mac systems. The most recent significant update to Xprotect definitions prior to yesterday came in mid-September to address the OSX/Leverage.A malware.

    Article Link: Apple Enforces Adobe Flash Player Security Upgrade with Updated Malware Definitions
  2. macrumors 65816


    Sep 2, 2010
    New York
    I haven't had Flash installed on a Mac since 2011. I'm better off without it.
  3. macrumors 6502a

    Nov 18, 2012
    Before anyone starts going on about how Orwellian Xprotect is and that they have a God-given right to run flawed Adobe plug-ins, this ONLY AFFECTS SAFARI. So you are 'free' to download any other browser and run vulnerable software if keeping your pants down is your thing.
  4. macrumors 68020


    Nov 22, 2011
    East Coast USA
    I don't use it much anymore so yesterday instead of updating I uninstalled.
  5. macrumors 65816


    Jul 11, 2008
    How do you watch YouTube? If I don't install Flash, I can't watch YouTube using HTML5. So I simply use Click2Flash and then watch HTML5, then load flash as I need it.

    As I recall, when I removed Flash, even with AdBlock on, I got more clutter on websites, where flash ads were.

    So if you can tell me how to solve my issues above, I'll remove Flash too.
  6. macrumors 68000


    Mar 7, 2012
    I always use chrome when flash is needed, otherwise I just use safari.
    and I never install flash plugin since chrome launched.
  7. macrumors 68020


    Aug 31, 2003
    Wherever my feet take me…
    I work in a school and a number of teachers watch YouTube, Discovery Education, and other sites that use Flash. It's a real pain to make lesson plans and then see the Flash error thing. While the IT department does have ways to push out the updates, it usually takes a while.

    The problem with Chrome is it's still 32-bit which means no Java. Plus, the grade book software the district uses uses Java so we need to run Safari or Firefox. Plus, for some reason, XProtect prevents Firefox from using outdated versions of Flash & Java for us.
  8. macrumors newbie

    Jan 22, 2009
    My xprotect file hasn't been updated since October ... how exactly does the update process work?

    ➜ Resources pwd
    ➜ Resources ll XProtect.meta.plist
    -rw-r--r-- 1 root wheel 1148 Oct 23 20:00 XProtect.meta.plist
  9. macrumors 6502

    Feb 9, 2012
    I wrote a script that disables the minimum version requirements in Xprotect on student laptops when a users logs out and back in. Security is not a real worry on shared student laptops for us. Our staff laptops do not have this script, and we simply ask staff to update Flash (and Java) when Apple updates Xprotect. This seems to work very well for us.
  10. macrumors 68030

    Amazing Iceman

    Nov 8, 2008
    Florida, U.S.A.
    Remove the second in command after Flash: JAVA :D
  11. macrumors 68000

    Mar 6, 2008
    Yeah, unfortunately Adobe Flash is still widely used on major websites like YouTube, and while they have an HTML5 version it's terrible, because the vast majority of the videos don't work & I find any videos that have ads running will not run.
  12. macrumors regular

    Jun 6, 2013
    Flash needs to go. It's holding us back: HTML 5 is the future.
  13. macrumors 68020


    Aug 31, 2003
    Wherever my feet take me…
    I think the IT department has the same kind of script, but for all computers. The teachers are given admin rights on their computers, but so many of them don't have the technical know-how to install the updates, and even more of them just don't have the time. Fortunately, we have some software update software by Casper or something so updates can get pushed out, regardless of teacher know-how/time. It just takes a while.
  14. macrumors 6502


    Nov 8, 2007
    I am running the extensions YouTube5 and AdBlock and couldn't be happier. If a website needs flash, I pull out a super old laptop with Win2K to see it. I haven't had to pull out that laptop in years.
  15. macrumors 68020


    Feb 28, 2009
    I have yet to find a single video on YouTube that was missing an HTML5 version.


    Quality is just as good.

    Not sure what to tell you, check your extensions, reset Safari, but I've not watched a Flash-based video on YouTube for a very long time now.
  16. macrumors 68030


    Mar 24, 2010
    Location: a Sun Chung wu xia
    Same here...

    I did this too. I can live without Adobe software.
  17. macrumors 6502


    Apr 12, 2012
    New England, USA
    Agreed... For me since early 2012
  18. macrumors 68020


    Feb 28, 2009
    Let me touch that up a bit:

    Flash is the past, HTML5 is now.

    Note, there are parts of HTML5 video that I can do without - YouTube's DASH implementation comes to mind. Frequently, painfully enough.

    H.265 is likely the future, same quality for half the bandwidth.
  19. macrumors regular


    Jan 4, 2014
    Penn., USA
    Can you tell me what else (player) to use in Safari? Most of sites uses Flash, example - the NY Times videos. :confused:
  20. Moderator


    Staff Member

    Dec 7, 2002
    Whakatane, New Zealand
    Interesting; I just did a fresh install of 10.9.1 yesterday and haven't yet installed Flash... and couldn't find a single video that would play (whether or not I toggled this).

    Edit: Wait, this "featured" one works, but as an example this one tells me that I need Flash. Do both work for you?
  21. macrumors 68020


    Feb 28, 2009
    I'd hardly say most sites use Flash.

    I do find that when sites *only* use Flash (like the NYTimes mentioned above), they're far more interested in serving you video ads which you have to suffer through before you actually get to content.

    TV stations and TV networks are the worst for this.

    Basically, if they try to ram an ad down my throat, I'm simply not going to watch anything from them.

    I've yet to feel that I've missed something actually important.

    The NYT wants to force a 30 second ad on me before a 60 second recap of what they put in print and on-line in words.

    Yeah, no.
  22. macrumors member

    Apr 16, 2001
    I ran into 1 last night: . Today, it works without flash. I guess the age of the video may have something to do with it. It was only like 2 hours old when I watched it.
  23. macrumors 68020


    Feb 28, 2009
    Both work for me in HTML5/mp4.

    I've found that Flash needs be *installed* before the plugins that allow HTML5 will work.

    Give that a try. Yeah it's a PITB...
  24. macrumors 601


    Jul 20, 2006
    Mannheim, Germany
    I have Flash installed on my iMac and while I don't really like it, it is a necessary evil. Many websites do use it, and I don't want to use Chrome just for these sites. I use Safari all the time, and I utilize Safari's new plug in energy saver function to control which sites are allowed to run Flash. It works very well and there is no need for click2flash.
    Of course, if using a laptop Flash has a much bigger impact on energy requirements than on an iMac. This is one of the advantages of not having to worry about power saving features I guess.:)

    I agree that Flash needs to go, but there is still a lot of content out there that needs to be converted to something better. HTML 5 is a good alternative for most things, but it seems this is not necessarily the future. I guess we will see a newer HTML version coming at some point...
    Read here for more information:
  25. macrumors 68020


    Feb 28, 2009
    It will depend on what format the video was originally submitted in as well.

    YouTube makes several versions of each video, at varying resolutions. It's not an instantaneous process, so while I've never run into an issue with a format being unavailable, I'm sure it happens once in a blue moon to folks.

Share This Page