Adobe puts a price tag on security updates for Photoshop and others

[tgell]

Users who want to protect their Photoshop, Illustrator or Flash Professional installations against critical security holes must now dig deep into their pockets. It costs £190.80 ($199) to upgrade from a previous version to Photoshop CS6 alone, and this update is recommended by Adobe because it fixes several critical security holes. The other upgrades, for Illustrator and Flash Professional, which close security holes are also exclusively available to paying customers. The only free update Adobe has released on its May patch day is one for Shockwave.

Article

[funkydude]

You can't just EOL your software when the next version comes out, what are they thinking?

[xxJackxx]

Originally Posted by funkydude

You can't just EOL your software when the next version comes out, what are they thinking?

That's pretty much what they have been doing. Not surprised.

[hashed]

Originally Posted by xxJackxx

That's pretty much what they have been doing. Not surprised.

I hate to admit it, but Jobs had it right, Adobe's software is junk; this and the endless exploits and patches after patches on their products, is proof enough for me to seek out alternatives.

~h

[prius04]

Originally Posted by xxJackxx

That's pretty much what they have been doing. Not surprised.

Yes.....no surprise. I dumped all over them via email and on their forum for the way they handle Photoshop Elements, for which Adobe releases a new version annually. A security issue was discovered back in the fall of 2011 with v8. Their official solution was, and is, to upgrade to version 9 (and now v10) since v8 is "no longer supported".

What a great solution; get your customers to pay ~$75 for the latest, "improved", version rather than fix a vulnerability in the old one.

I'm not trying to defend Adobe here, but when you buy software, you have to seek out info on how many time it will be supported/updated for free by the maker.

[prius04]

Originally Posted by guest

...when you buy software, you have to seek out info on how many time it will be supported/updated for free by the maker.

I agree. However, you'll have to tell me where to seek out this "info" because, to the best of my knowledge, Adobe doesn't publish any kind of firm dates or numbers. Further, they managed to fix this exact same vulnerability (at least, what I understand to be the same) in Photoshop but left PSE v8, and earlier, to twist in the wind. Just not a good practice from an ethical perspective and serves to create a lot of animosity toward the company.

[Rmus]

It costs £190.80 ($199) to upgrade from a previous version to Photoshop CS6 alone, and this update is recommended by Adobe because it fixes several critical security holes.

You can paraphrase:

It costs £190.80 ($199) to upgrade from a previous version to Photoshop CS6 alone, and this update is necessary if you want to use its RAW converter when a new camera is released.

There is always the free DNG tool, but not satisfactory for millions of photographers.

Adobe's business/marketing model has been criticized for years.


----
rich

[TheWindBringeth]

It seems to me that a critical security flaw is the result of a defective product. Don't some US states (and perhaps other countries?) have consumer protection laws that are applicable to defective products and over-ride manufacturer terms? Might, in some locales, such a law require Adobe to provide fixes for resolve such flaws for up to N years after purchase?

[prius04]

They typically disclaim everything so it's an uphill battle, regardless. In fact, I did manage to find Adobe's limited warranty in a license.html file:

6. Limited Warranty.

Adobe warrants to the individual or entity that first purchases a license for the Software for use pursuant to the terms of this agreement that the Software will perform substantially in accordance with the Documentation for the ninety (90) day period following receipt of the Software when used on the recommended operating system and hardware configuration.

It's actually worse than I thought since the foregoing (ridiculously puny) limited warranty is expressly inapplicable to patches and the like, which are offered strictly AS-IS.

[dw426]

Originally Posted by TheWindBringeth

It seems to me that a critical security flaw is the result of a defective product. Don't some US states (and perhaps other countries?) have consumer protection laws that are applicable to defective products and over-ride manufacturer terms? Might, in some locales, such a law require Adobe to provide fixes for resolve such flaws for up to N years after purchase?

The software world is another whole kettle of fish compared to physical goods, hence why the whole legal system is screwed up with patent wars and the like. If you could sue Adobe for having constantly screwed up products, you'd put them and many other big time companies out of business. Only the government has better lawyers than software companies, and they lock down their agreements air-tight and leave no wiggle room or chance.

[Pinga]

Adobe may be categorising exploits as "code used in anger to cause damage", because there is at least one proof of concept exploit for one of the APSB12-11 vulnerabilities. Releasing a security advisory will, however, have raised awareness with attackers – especially attackers who use spear-phishing tactics aimed at particular categories of users within an organisation – that such holes exist in Photoshop and that they are potentially exploitable. Adobe says that installation of the upgrade "is therefore at the user's/administrator's discretion".

http://www.h-online.com/security/new...s-1572717.html

[CogitoTesting]

Originally Posted by hashed

I hate to admit it, but Jobs had it right, Adobe's software is junk.
~h

I do not think that Photoshop, Dreamweaver, Illustrator and Indesign are junk.

Thanks.

[Baserk]

Adobe has apparantly noted the wave of criticism and will offer patches for free;

'We are in the process of resolving the vulnerabilities addressed in these Security Bulletins in Adobe Illustrator CS5.x, Adobe Photoshop CS5.x (12.x) and Adobe Flash Professional CS5.x, and will update the respective Security Bulletins once the patches are available.' link

[tgell]

I bet quite a few companies that use this software got on their case.

[JRViejo]

After a hue and cry from outraged users and security experts alike, Adobe has reversed direction and promised free patches for older versions of Photoshop, Illustrator, and Flash Professional to close eight critical vulnerabilities. The company didn't specify when the free updates would be available for users.

Adobe will fix vulnerabilities in Flash Professional CS5.5, Photoshop CS5, and Illustrator, according to an email from its spokesperson sent late in the evening on May 11. The announcement came after users and security experts lambasted the company for telling customers to upgrade to the latest CS6 editions in order to close serious security flaws in the software.

Adobe BackPedals, Will Patch Photoshop, Illustrator by Fahmida Y. Rashid.

[siljaline]

The announcement from Adobe.

[funkydude]

Originally Posted by JRViejo

Adobe BackPedals, Will Patch Photoshop, Illustrator by Fahmida Y. Rashid.

Laughable at best, maybe they will learn something.

[Noob]

Hmmm so a massive whining actually works!

[dw426]

Originally Posted by Noob

Hmmm so a massive whining actually works!

When the "whining" comes from industries and people that pay hundreds of thousands for your products, you bet. It's a BS policy to begin with.

[siljaline]

In this case it was decided by Adobe - bad Press and all.

Originally Posted by Noob

Hmmm so a massive whining actually works!

[Ranget]

i ditched Photoshop since CS3 and i'm using Gimp

i'm not a professional or anything but i make a wallpaper or two from time to time
Gimp is more than enough for this matter

Don't get me started on Adobe updating and high priced Product
they are doing this just because there is no real alternative