One of the issues surrounding Adobe's Flash technology -- and one that Apple in particular has criticized -- is its vulnerability to malware. On Wednesday, Adobe announced that Flash will be sandboxed in the Safari browser under Apple's new Mavericks 10.9 operating system, as it is on other browsers.
Sandboxing contains a process or , making it harder for malware to do any harm outside of the infected application. The Flash Player plug-in has specific security permissions when it runs within the sandbox, which limit the Player's capabilities to reading and writing files only within needed locations and sets limits on connections to local computer resources or connections. The sandbox profile for the Flash plug-in is now included in the Webkit project, which is the browser engine employed by Safari.
Adobe has also released sandboxed versions of its Reader and Acrobat for OS X Mavericks. Both of those applications, like Flash, have been malware targets and, in January, Adobe issued security updates for both.
'Thoughts on Flash'
In a posting on the Adobe Secure Software Engineering Team blog on Wednesday, platform security strategist Peleus Uhley noted that Adobe has worked with Google's Chrome, 's Internet Explorer and Mozilla's Firefox to similarly deploy sandboxes for Flash on their respective browsers.
"Safari users on OS X Mavericks," he wrote, now "can view Flash Player content while benefiting from those added security protections," and he acknowledged the assistance Adobe received from Apple's security team.
Apple iOS devices do not directly support Flash, and the company has been promoting the use of HTML5 technologies in its stead. Adobe has also been emphasizing its development of HTML5-based tools.
'Thoughts on Flash'
In a well-known open letter published on Apple's Web site in the spring of 2010 and entitled "Thoughts on Flash," Apple co-founder and CEO Steve Jobs cited six reasons that Apple was not supporting Flash on its then-recently released iPad. He pointed to Flash's proprietary nature, the existence of other Web technologies, life, performance, reliability and security. In particular, he noted that Apple didn't want to "reduce reliability and security of our iPhones, iPods, and iPads by adding Flash."
He added that security firm Symantec had highlighted Flash as "having one of the worst security records in 2009," said that Flash "is the number one reason Macs crash," and said that, in spite of Apple's "working with Adobe to fix these problems," they had persisted. In addition, he said, Adobe needed to adapt Flash for touchscreen interaction.
About five months after that open letter, Apple did allow Flash to become available for developers in its App Store using Adobe's iOS packager, which compiles the runtime with the app into a single app that iOS can run.