• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

Uninstall QuickTime for Windows: Apple drops support, won't patch security issues

Status
Not open for further replies.
Alternative 1) might not work as Premiere needs QuickTime's encoding abilities as well as decoding, and 2) might still be affected by the vulnerability since it's just the same codec repackaged.

I use Premiere Pro and AE daily and never installed QuickTime, only QT Lite. Works fine.

Can't really say much about your second point though, might be true.
 

Coreda

Member
You need the codec for programs like Spotify.

I'll just convert my .m4a-files to VBR .mp3.

Spotify can't play M4A files without Quicktime installed on the system? Is this 2005?

Pity it's tied to a service since any decent audio player, eg: foobar2000, handles the format fine, though it lacks visual chapter support IIRC.
 

davepoobond

you can't put a price on sparks
I use Premiere Pro and AE daily and never installed QuickTime, only QT Lite. Works fine.

Can't really say much about your second point though, might be true.

Is qt lite supposed to be anymore secure? If it isn't it doesn't exactly address the issue
 

M3d10n

Member
For those that want more technical details here are the important points: both of these are heap corruption remote code execution vulnerabilities. One vulnerability occurs an attacker can write data outside of an allocated heap buffer. The other vulnerability occurs in the stco atom where by providing an invalid index, an attacker can write data outside of an allocated heap buffer. Both vulnerabilities would require a user to visit a malicious web page or open a malicious file to exploit them. And both vulnerabilities would execute code in the security context the QuickTime player, which in most cases would be that of the logged on user.

So, it's not the end of the world if you really need the codecs for some reason.

AFAIK the plugin hasn't been installed by default for quite some time (and plugins in overall are being phased out in most browsers), so that leaves the malicious file problem, which can be dealt with by not using/uninstalling the QT player or any media player that relies on it for decoding, using something like VLC or MPC-HC instead. Not ideal, but it can be managed.
 

Falcs

Banned
Apple is so damn shady. They haven't actually said publicly that they are not supporting Quicktime for Windows yet. They've only provided uninstall instructions for Quicktime.
If you look at the logs in the zero day initiative:

11/11/2015 - ZDI reported 2 vulnerabilities to the vendor
11/11/2015 - The vendor acknowledged receipt of both reports
02/29/2016 - ZDI wrote to the vendor requesting a status update
03/08/2016 - The vendor replied, inviting ZDI to a call
03/09/2016 - ZDI joined a call with the vendor:
ZDI was advised that the product would be deprecated on Windows and the vendor would publish removal instructions for users.
ZDI advised the vendor that the cases would be 0-day.
03/24/2016 - ZDI notified the vendor of the intent to 0-day on or after 4/13
04/01/2016 - The vendor acknowledged and provided a link to their removal instructions

Basically, ZDI reported the vulnerabilities to Apple.
Apple ignores it.
ZDI follows up, Apple says verbally that they aren't supporting the software anymore.
Apple never does anything about it.
ZDI publishes vulnerabilities after a deadline.
Apple responds by giving uninstall instructions, doesn't publicly acknowledge vulnerabilities, doesn't make any formal statement on their support for Quicktime for Windows. Doesn't even take down the download.
 

jmdajr

Member
So Adobe has done...pretty much nothing.

In a brief message to Adobe product users from Madison Murphy on behalf of its Customer Care Team, the company suggested limited workarounds for processes that “unfortunately” rely on the abandoned format. In the meantime, they have worked “extensively” to remove those dependencies altogether. According to the post, this is all part of the plan.

Adobe’s desire has always been to support everything natively without the need for QuickTime. As a result of the above we intend to increase our efforts to remove these incompatibilities, and provide our customers with a complete native pipeline. We will provide more information on this as we progress.

Graphics.com’s Chris Dickman isn’t buying any of it. The founding editor has provided his own translation of Adobe’s message, and it’s a bit less flattering:

Unfortunately? Let me paraphrase that for you: “We didn’t see this coming, your systems are compromised if you keep using our software and we will make no committment to fixing this.”
 
Last I checked it was practically impossible to install on Win10 anyway. The installer erroneously gives a "OS too olde" error, even if you try compatibility modes.

Meh.
 
To the surprise of absolutely nobody. Adobe is so monumentally useless as a company.

I mean, what were they supposed to do? Tell Apple to update anyway? Release a new version that would magically drop dependency on QT overnight? That's not Adobe's fault.
 

Weckum

Member
I mean, what were they supposed to do? Tell Apple to update anyway? Release a new version that would magically drop dependency on QT overnight? That's not Adobe's fault.

Exactly, this is Apple screwing over Adobe basically (not on purpose probably, but still)
 

neshcom

Banned
It's hard to imagine a world where Adobe ever supposedly wanted to cut out its QuickTime dependencies with any real gusto. Maaaaaybe this will get them to really do it, but I don't see it coming anytime soon.
 

jstripes

Banned
I mean, what were they supposed to do? Tell Apple to update anyway? Release a new version that would magically drop dependency on QT overnight? That's not Adobe's fault.

How long ago did Apple say they were abandoning QuickTime for Windows?

Adobe has a long history of dragging their feet when Apple deprecates stuff.
 
How long ago did Apple say they were abandoning QuickTime for Windows?

Adobe has a long history of dragging their feet when Apple deprecates stuff.

Read the thread. Apple didn't tell anyone until they were nagged about it multiple times. And even that was half-assed.
 

Neo_Geo

Banned
Guess I begin the process of converting all of my .MOV files. Is there no way to have an alternative safe codec so my current .MOV files can be used in Google Picasa?
 

The Real Abed

Perma-Junior
Guess I begin the process of converting all of my .MOV files. Is there no way to have an alternative safe codec so my current .MOV files can be used in Google Picasa?
Does Picasa require QuickTime to be installed? Surely they'll just update it so it doesn't right?
 
To the surprise of absolutely nobody. Adobe is so monumentally useless as a company.

You clearly don't know what Adobe does.

I mean, what were they supposed to do? Tell Apple to update anyway? Release a new version that would magically drop dependency on QT overnight? That's not Adobe's fault.

Exactly. Adobe will have to do something, but it will take time to untangle that dependency.
 

-griffy-

Banned
Update from Adobe for those who need Quicktime for their video workflows:
Today we’re pleased to announce that Adobe has been able to accelerate work that was already in progress to support native reading of ProRes. This new capability is fully licensed and certified by Apple, and barring any unforeseen issues during pre-release, these fixes will be included into an update to the relevant products in Creative Cloud shortly.

When these fixes are released most Windows users will have a seamless workflow for virtually all popular codecs even with QuickTime removed from the computer; however, we do anticipate that some older, less used legacy formats may not be directly supported and therefore no longer be accessible. Users may need to find a method of transcoding their legacy media.
Good news.
 
Status
Not open for further replies.
Top Bottom