>>But is an AIR application secure, given that ... applications have the same access to the hard drive as the user? Lynch talks about ways in which users are protected. "The application installer is signed, and then the end user is informed about the rights this application is going to have,” he says. Beyond that, Adobe is relying on brand trust and internet reputation to help users make safe choices. He adds that AIR is not making the internet's security problems any worse.<<

Isn't this just what Microsoft used to say about ActiveX?

If these AIR things are easy to write, and people happen to like the stuff they do, then people will install them as merrily as they add Facebook applications today, or even as gaily as they head to cool websites. The fun stuff doesn't come from sources with "brand trust". Facebook apps and websites can't easily damage your computer, of course, so this works well - average users don't need to be security experts.

Before AIR dies, there'll be certificate impersonations (Victim: “Hey, it said it was signed by Аdobe!”. Adobe: “No, that wasn't us. Shame you didn't notice that A was cyrillic - Unicode 0410, not 0041. Goodbye.”) Then will come such smug declarations as: “When PCs started out, people were putting floppy disks on their refrigerators with a magnet, stapling disks together, and not backing up files. Gradually, people caught on. They adopted [other] practices, and the same thing will happen on the Internet.” (That was John Browne, Microsoft's product manager for Internet security, talking about ActiveX in 1996.)

Oh good, a new king of bloat arrives... all this from a company that somebody managed to make a *document viewer* (nothing more) go from a small install to a bloated behemoth that now weighs in in excess of 22MB and takes about 3 minutes to bother to load up (you can either have this pain at login time or document opening time, your "choice"). On top of the bloat, they added all manner of security holes (features) and as a direct result it's just as likely that PDFs will take over your system as using ActiveX / Internet Explorer / Word Documents, etc.

"The technology that we're using for graphics is based

on SWF, the Flash file format. That format is published

and open to anyone to build around."

So can someone POINT me to this format specificiation... or

maybe tell the gnash and swfdec people where to find it...

But I'm guessing there is no such thing anywhere...

VapourWare 3.0 FTW!!!

The difference between AIR and ActiveX, is that ActiveX silently installs and runs from a web page.

AIR applications have a bit fat 'I'm about to install something' window.

Yeah, users will click 'OK' on anything, but that gets back to the point that for security, AIR is just like your common-or-garden .exe download.

and Thermo sound like they do the same thing. Blend lets designers create the interface, then the coders do their thing. This prevents logic impaired coders from creating crappy interfaces and ultimately results in a much nicer application. We've been using Expression Blend since beta and we all love it.

"Beyond that, Adobe is relying on brand trust and internet reputation to help users make safe choices."

Did no one there ever hear of social engineering? This is doomed to be yet another infection vector that will make lots of busy work for people who actually have to administer networks.

"The difference between AIR and ActiveX, is that ActiveX silently installs and runs from a web page."

With all of them out there, it seems like it would be hard, but apparently you've never visit a page with ActiveX! Certainly makes you an expert.

(Or you stupidly crank down your browser to run everything, that would be even funnier!)

Do most computer users know whether they are installing an application or an ActiveX control?

Since AIR apps will be easy to write – far more people can write Flash and HTML than can write old-style native apps – lots of new cool, "free" (ad-funded) apps will appear every day. Each of these will suggest it alerts all your friends about itself, in order to add community lurve to the experience. The coolest and most popular of these won't have "brand trust".