Helping People Upgrade Flash
As mentioned by Johnathan, with last week's 3.5.3 and 3.0.14 releases, Mozilla started warning users if their version of Flash is out of date. Coupling the following two facts tells us that such an effort has a chance at making a significant impact with overall internet safety.
Context & Ripple Effects
Mozilla spent 2009 shipping rapid-fire Firefox security releases — 3.0.9 followed by 3.0.10 within days back in April — and its own security team had just disclosed research showing users refuse upgrades over privacy fears. The lesson drawn from both was that waiting for users to self-update is a losing strategy.
With last week's 3.5.3 and 3.0.14 releases, Mozilla stopped treating plug-in staleness as Adobe's problem alone: Firefox now checks the user's Flash version and warns when it's behind. That matters because Adobe's December 2007 Flash Player update addressed real vulnerabilities, yet stale installs persisted for years afterward — the browser is the one piece of software that already talks to every user.
First-order effects
- Firefox 3.5.3 and 3.0.14 users running an outdated Flash build now see an in-browser prompt directing them to Adobe's current version, converting a silent risk into a visible call to action.
- Adobe gains a distribution channel it doesn't control: Mozilla's update-checking surfaces Flash upgrades to Firefox's install base without Adobe having to reach those users itself.
Second-order effects
- Adobe faces pressure to keep older supported Flash branches patched and compatible with the browser-driven upgrade flow, since a warning pointing at a broken or slow update path would reflect on both vendors.
- Other browser makers confront a new baseline expectation — that the browser audits third-party plug-ins — raising the bar for Safari, Opera, and Internet Explorer to match or explain why they don't.
Third-order effects
- Responsibility for keeping web-platform components secure shifts from end-user vigilance toward the browser vendor as enforcement layer, a structural move away from the 'users should patch' model that Mozilla's own upgrade-refusal research showed doesn't work.
- If the warning pattern holds, the logical endpoint is browsers gating or disabling unsafe plug-in versions outright rather than merely nagging — making the browser, not the plug-in vendor, the arbiter of what runs.
The trend: Browser vendors are absorbing responsibility for third-party plug-in security, moving the web from user-initiated patching toward browser-enforced component freshness.