Flash Player refuses to run, if outdated. Can I change this setting?

[forrie]

I work in a video production environment -- tonight we ran into a problem where a couple of live monitoring systems were not working because Flash refused to run; presumably, because it's out of date.   In this case, the systems are "Deep Frozen" (locked down, essentially).

While I think I understand the underlying reasoning for this, it's highly disruptive.    Is there a way we can change Flash Player so it doesn't refuse to run if it's outdated?

These systems are on OSX Yosemite.  It's possible it's not just a Flash Player setting, but a browser setting -- still trying to track this down.  

Tips, pointers would be appreciated!

Thank you.

[jeromiec83223024]

It's a browser setting. 

Safari: About Internet plug-in management - Apple Support‌

It's probably fine if you're not using these machines to browse the web, but if you're doing anything else that requires access to the Internet, we'd recommend that you just opt-in to automatic updates.  Running an old version of Flash puts you at a significantly increased risk for malware infection.

[forrie]

Our systems are "deep frozen" (see faronics.com).  So, even if someone downloaded malware, a reboot would clean  it.    But in this case, where we have stations being used in production, it's not always feasible to quickly update -- so we need to have a flash player that "just works" while we schedule updates.

We use Chrome, Safari and Firefox -- Chrome packages its own.  But I'm sure each browser has caveats with this.

[jeromiec83223024]

Yeah, that makes sense.  Faronics is really into buzzwords.  It was hard to cut through the marketing-speak to figure out what they were actually doing.

The plug-in blocking technology on Mac is called xprotect.  You can disable it, which might make sense in your use-case, but it's typically a really bad idea for the average end-user.

sudo mkdir /System/Library/Launchdaemons/Disabled

sudo mv /System/Library/LaunchDaemons/com.apple.xprotectupdater.plist /System/Library/LaunchDaemons/Disabled/com.apple.xprotectupdater.plist

sudo /usr/libexec/PlistBuddy -c "Delete:JavaWebComponentVersionMinimum" /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

I'm guessing that these files are mutable on the system and not part of the persistent snapshot, or I imagine that the blocking would have went away after a reboot.  I'm thinking that you can probably disable these and update the relevant snapshots to ensure that you're not picking up new xprotect blacklists in the field.

If you're just hitting the same set of consistent local IPs for your monitoring backend, it might make more sense to preconfigure them in Safari as always allowed vs. wholesale disabling xprotect.

Hopefully that's helpful.

[forrie]

Thank you, that's very helpful!