Pure Java MPEG or WMV playback

[Chris Uppal]

I don't know, but I'm glad you reminded me, cause it
made me think of something I meant to mention.
I would install the (quirky and problematic) QuickTime
on my PC, but never Flash. There are two many security
concerns with it, for too little value.

I, personally, view /all/ of Adobe's products (including the old Macromedia et
al line) with intense suspicion. They have a nasty tendency to add JavaScript
in unexpected and unpublicised places (e.g. in QuickTime if memory serves me
correctly).

For one example, review the current kafuffle around the Acrobat reader plugin
(v 7 or earlier -- v 8 is only available for Windows as far as I know), and its
extraordinarily stupid exposure to JavaScript abuse.

-- chris

 

[John W. Kennedy]

I, personally, view /all/ of Adobe's products (including the old Macromedia et
al line) with intense suspicion. They have a nasty tendency to add JavaScript
in unexpected and unpublicised places (e.g. in QuickTime if memory serves me
correctly).

QuickTime is Apple's multimedia player.

 

[Chris Uppal]

John W. Kennedy wrote:

[me:]

QuickTime is Apple's multimedia player.

Not sure what point you are making here ?

In case it helps clarify my doubts, consider the example described here:

http://www.offensivecomputing.net/?q=node/319

It's the kind of thing that often happens when the incompetent add clever
features to software that should be simple.

BTW, note that the security implications of this sort of thing don't stop at
(often don't even start at) /direct/ damage via "clever" inclusions
(JavaScript, HTML rendering, etc), but because those inclusions give another,
and unexpected (and therefore less likely to be protected) route by which other
exploits can be triggered.

-- chris

 

[Andrew Thompson]

John W. Kennedy wrote:

[me:]

QuickTime is Apple's multimedia player.

Not sure what point you are making here ?

I understood John's confusion, as I was also slightly
confused to see QT mentioned as almost a 'tag-on'
to a paragraph that seemed to focus on a company
that did not make it.

In case it helps clarify my doubts, consider the example described here:

http://www.offensivecomputing.net/?q=node/319

This leads (indirectly) to..

It's the kind of thing that often happens when the incompetent add clever
features to software that should be simple.

OK - yes. I sure see your point now.

I had never imagined QT had *any* JS support.

Since I have JMStudio to handle the MOV formats
that my Kodak cameras produce, QT will soon be
*removed* from my system.

Andrew T.

 

[Chris Uppal]

John W. Kennedy wrote:

[me:]

I, personally, view /all/ of Adobe's products (including the old
Macromedia et al line) with intense suspicion. They have a nasty
tendency to add JavaScript in unexpected and unpublicised places
(e.g. in QuickTime if memory serves me correctly).

QuickTime is Apple's multimedia player.

Not sure what point you are making here ?

I understood John's confusion, as I was also slightly
confused to see QT mentioned as almost a 'tag-on'
to a paragraph that seemed to focus on a company
that did not make it.

My mistake. I tend to confuse Apple and Adobe when thinking about
software-only stuff.

(Fortunately, some relevance to the point-at-hand remained, despite my
confusion...)

-- chris