1

I just purchased some software that requires Adobe Air to run it's (NOT EVEN REMOTELY) "native" Mac app.

Alternatively it is supposed to run from the web with Flash. Right after finding out that was when I found out I don't have Flash installed. I consider that a really good thing -- I know how bad flash is!

I can actually just call it off and get a refund. But they also have an iOS version that is probably all I'd really use anyway. So plan A right now is to install the iOS and not have it on my MacBook.

I'd like opinions on exactly how virulent this particular Adobe virus is and if it is something I'll be happier if I never install.

Are there documented security reviews or some guidelines I can take in evaluating the security of an Air app in general?

Improve this question
2
  • Considering Adobe's highfalutin marketing and holier-than-though approach to pretty much every industry they touch, I would imagine the Air up that high is pretty thin. So thin that you would need an oxygen mask to survive.
    – Allan
    Feb 25, 2019 at 22:23
  • 1
    That's pretty much what I was thinking. I am most interested on how big a vector it punches into the OS for viruses and malware... er excuse me. I of course mean market research and data collection. I expect it to be ugly and incompatible. Sort of like my own private CITRIX hell. But I am curious if someone can quantify exactly how much I'm going to regret installing this garbage.
    – Terry
    Feb 25, 2019 at 22:26

2 Answers 2

Reset to default
2

Well, it's just an app framework, so depending on what your needs are it could be a savior so you don't have to spend any energy or money working on an app to a really bad piece of software.

I personally have held the line on flash and air and insisted that most apps run on iOS to avoid having to deal with those app frameworks, but not everyone can insist on that.

It wouldn't be less draconian and less secure to insist that developers sign their apps with a developer certificate and that you deny all prompts if you don't understand the security risks.

Applications deployed on Adobe AIR have powerful capabilities and access to local data, so this dialog box provides information about who built the application and allows you to decide whether to install it. If someone you trust developed the application and you would like to install it, then selecting Yes will allow the installation to proceed. If you do not recognize the developer or it is someone you do not trust, then you should not install the application.

Since Adobe doesn't even link to their security white paper from the FAQ, you can infer how invested they might be in having people learn about the security of that product. (You could equally give them a pass and ask for that link or search for it as well - It might not be intentional and Apple also has gaps in their web pages from time to time, so I’ll not pile on Adobe too much for one missing KB article link)

If that breaks the software, I would ask for a refund. You'd be well protected if your Mac doesn't allow non-app store / non-signed apps to run. Adobe is really clear, the air apps persist on your machine and are security risks just like all native apps that are not signed and don't work in a sandbox are.

Also, if you assume an educated user, always updating apps and plug in, never giving away admin password - I could see Air or Flash being a security neutral or managed risk. If you don't, I would avoid using them since you do need to learn, understand, manage the risk of more frameworks and letting flash (air) run on your Mac.

Improve this answer
0

In general it is pretty bad as it is a framework designed for developers with a more selective view of software engineering, often causing total reliance on the runtime for things like security and performance. Sadly, we all know how well that went with things like flash, silverlight and java applets.

If it is easy to write bad code but make money anyway, bad code will be written. Things like Adobe AIR facilitate that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .