Safari update automatically disables old versions of Flash
Apple on Wednesday released Safari 5.1.7, an update to its Web browser. One of the new security features is that Safari will automatically disable old versions of Adobe's Flash Player. — “Out-of-date versions of Adobe Flash Player …
Context & Ripple Effects
The update lands mid-way through a bruising spring for Apple on client-side security. In April the company shipped a Java update built to strip out the Flashback malware, and in March an address bar flaw surfaced in iOS 5.1's Safari — so 5.1.7's Flash feature reads as the next step in Apple tightening what runs inside its browser.
For Adobe, the move outsources an old problem. Its own coverage goes back years on this: a 2007 Flash Player security update and a 2009 effort to nudge users onto newer versions both grappled with the same failure mode — huge install bases that never upgrade. Now the enforcement mechanism sits in Safari rather than in Adobe's installer.
First-order effects
- Mac users running out-of-date versions of Flash Player find those versions silently switched off in Safari until they update, shrinking the window legacy exploits can target.
- Adobe's upgrade funnel changes shape: instead of persuading users directly, it now has to keep pace with a browser that deactivates anything stale.
Second-order effects
- Other browser vendors face the obvious precedent — if Safari disables old plug-ins by default, shipping an equally permissive policy becomes harder to defend.
- Sites still dependent on Flash feel the squeeze from the client side, since visitors on current Safari effectively lose access unless they maintain their plug-in.
Third-order effects
- If platform vendors keep asserting control over plug-in lifecycles, responsibility for web-runtime security migrates from plug-in makers like Adobe toward browser owners — a structural shift in who decides what code executes on the web.
- Apple is building a pattern across its stack, from removing malware-laden Java runtimes to gating Flash inside Safari, of treating third-party runtimes as liabilities to be constrained by default.
The trend: Browser and platform owners are progressively taking over the security lifecycle of third-party plug-ins like Flash, shifting enforcement away from the plug-in vendors themselves.