Re: [Gnash-dev] Flash cookies and GNU Gnash

[Rob Savoye]

John Gilmore wrote:

> It's not the default, unfortunately.  Perhaps when we tried making
> those cookies non-writeable, too many web sites stop working.  Since

  Flash cookies (.sol files) are heavily used by many swf files for
storing configuration settings, like game scores. I've looked at
hundreds, and at least never saw anything privacy invading yet... But
the ability to store executable code should scare people... I'm not so
worried about SharedObjects as I am LocalConnection when it comes to
security.

> option to "Delete all Shared Object files (flash cookies) on exit", or
> "Only keep Shared Object files in temporary RAM" would protect users,
> while not breaking the web sites that attempt to sneak up on them.

  We do print out what is written to the .sol file, which is better than
nothing. We could do a lot more like integrating support in the GUI to
display, edit, etc... .sol files as used by the playing swf file.
Patches gladly excepted. :-)

> We mention "flash cookies" once in our documentation, but we should
> use that term throughout the doc and the program, now that it's become
> the publicly accepted term.

  It's cause our documentation hasn't barely been updated in over a year...

> Gnash also provides a "soldumper" command-line program that can decode
> what's inside those .SOL files.  It works on .SOL files created by
> Adobe Flash as well as those created by Gnash.  Example:

  One of these days I intend to add support to soldumper to do much more
than it does now. Most of the other Gnash developers ignore the little
utilities Gnash has. I'd like to add an option to recursively find all
the .sol file in ones $HOME/.macromedia directory, and to dump all the
data. It'd also be nice to add the ability to modify the .sol file
without using flash. With the release coming up, I know I don't have
time to add this support before 0.8.6, but would love a patch. :-)

> I'm shocked that I have this many.  I'd thought gnash was protecting me
> from them.

  You unfortunately need them for proper functionality for many things,
like media players.

> "soldumper -l" is supposed to list all the cookies (like the above), but it
> doesn't actually work in the current release.

  In 0.8.5 ? It should, but is working in trunk, so will make the next
release. which should be out in Sept.

        - rob -