Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this functionality, I have to enable javascript for the site resulting in a different kind of possible security vulnerability. This forces you to choose one or the other. Which would you be more concerned about in this situation?

  • 6
    I think there is probably a very useful question underneath this, but as it stands this is quite subjective; some individuals may worry more about one or the other (or both) but that might not be useful for you at the end of the day. Can you reword the question more towards specifics? – Rory Alsop May 7 '11 at 15:41
  • Edited to meet your request – Dan May 8 '11 at 10:09
  • 2
    Still looking a bit subjective to me. If you're really worried about scripts and plugins, I suggest using Firefox with NoScript. NoScript not only does not require JavaScript (AFAIK) - it blocks it, along with any other plugin-based content, for domains not already whitelisted by you. The whitelist is also pretty easy to manage on-the-fly. – Iszi May 9 '11 at 5:07
  • I would like to flesh this out and post as an answer: In security.stackexchange.com/questions/14934/… there is a link that shows where Trend Micro tallies up Adobe Flash problems that can lead to total takeover of your computer. Javascript is essential on websites to run the menus, etc. Adobe Flash and Reader should be uninstalled - let Chrome handle them. Maybe install Nuance for PDF files also. – SDsolar Feb 2 '17 at 22:21

The answer is: yes. You should always worry about software.

"Complexity is the worst enemy of secuirty"

--Bruce Schnieir

That being said, even if your machine is fully patched, one of the many Flash 0-days could still compromise the machine. XSS is exploitable regardless of if your machine is patched. This flaw is usually exploited with JavaScript but it can be exploited with Flash as well, so having either of them would be a problem. It's also important to note that about 90% of websites won't work without JavaScript, so disabling it is very problematic. GET based CSRF vulnerabilities can be exploited with pure HTML, so even if Flash and JS are disabled you can still be hacked.

What I would do: Use Firefox with NoScript. Even if JavaScript is globally enabled NoScript will block most CSRF and XSS attacks. Install an anti-virus and keep the machine up to date.


i think, to block both are not better solution than, keep your system, flash engine, and antivirus updated. Flash and Javascript are not more dangerous than any other application in your computer. They had bugs? Yes, they were fixed? Yes. As your browser, as your operational system and as every single piece of software. With flash blocked. you should know that, for example, youtube won't work as expected. If you block javascript, some other sites that depends on, won't work, and maybe your wife's experience with internet won't be as she expects.


Actually neither one of these is the "bigger" security concern. DOM XSS is the largest concern as there is no real practical prevention against it. Also, trying to protect yourself by setting up a large white list of sites is going to cause more headaches than not. The recommendation is have one box for fun and one box for personal matters such as banking. Or to expound further setup a virtualized environment and have one system that does all the dangerous things involving flash or javascript and the other is where you can do you banking that has no flash or javascript enabled.

  • +1 for the virtualised box: this way you can always start with a known clean box adn wipe it at the end of each session. – Rory Alsop May 7 '11 at 15:37

The question here is who creates more secure software? The people creating the browser or Adobe?

They are pretty much equal, especially with all the HTML 5 stuff. Usually you need to enable JavaScript for Flash, so you could so you add Flash as a potential bringing additional attack vectors.

  • Chrome is reviewed and updated constantly by the entire community of users. Adobe Flash is not the same in that regard. – SDsolar Feb 2 '17 at 22:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.