Our friends at Source Elements have issued what they describe as a "Public Service Announcement" because Apple have stopped patching QuickTime for Windows. Source Elements say...

We recommend all Windows users uninstall the non-secure QuickTime player. Uninstalling this software will not affect Source-Connect or related software since version 3.1. If you are still running 'Source Elements Desktop' please consider upgrading to a standalone version of Source-Connect for security purposes.

The story seems to be coming from a post by Trend Micro in which they say...

We’re putting the word out that everyone should follow Apple’s guidance and uninstall QuickTime for Windows as soon as possible. This is for two reasons.

1. Apple is deprecating QuickTime for Microsoft Windows. They will no longer be issuing security updates for the product on the Windows Platform and recommend users uninstall it. Note that this does not apply to QuickTime on Mac OSX.

2. Our Zero Day Initiative has just released two advisories ZDI-16-241 and ZDI-16-242 detailing two new, critical vulnerabilities affecting QuickTime for Windows. These advisories are being released in accordance with the Zero Day Initiative’s Disclosure Policy for when a vendor does not issue a security patch for a disclosed vulnerability. And because Apple is no longer providing security updates for QuickTime on Windows, these vulnerabilities are never going to be patched.

Windows Users, What Do You Plan To Do? 

The advice so far seems to be that Pro Tools and Media Composer users should disconnect their systems from the internet, or at the very least be very careful about opening QuickTime movies from questionable sources. Apparently Avid have been made aware of the issue but it does appear to be a quick fix because QuickTime is so integral to the Avid workflow. As our Pro Tools Windows specialist we asked Alan Sallabank for his thoughts...

For the moment I plan to carry on regardless. My Pro Tools systems don't directly access the internet, and the chances of a "dodgy source" QuickTime making it on to my system are really quite slim.

I am also deeply suspicious of this - something to me just doesn't add up. If it's so bad to have this software on your Windows system, why is it still available for download from Apple? The "uninstall advice" that Trend Micro are linking to is a generic advice page, and does not reference this supposed issue. None of the articles I've read link to a specific statement by Apple.

My gut instinct is this is anti-Windows hysteria, fuelled by people not prepared to look into it in any depth, and happy to just re-publish a scare story that's landed in the lap on a quiet news day.

What Do Non Lethal Applications Have To Say?

We asked Non Lethal Applications, makers of Video Slave and Video Slave Pro, which Alan reviewed and we have a deal running until April 30th 2016, to comment about this and also the wider story of QuickTime and so this is from Flo Loferer the developer and owner of Non Lethal Applications....

The original QuickTime framework is 24 years old now which are a couple of centuries in computer time.  While it was and still is a great engine, they never made the move to 64 bit.
Probably because the only people knowing all the innards of QuickTime are either dead or are no longer working for Apple. QuickTime really was MASSIVE! You could literally do EVERYTHING with it but as many parts were really old, it was a real pain!

Apple introduced a new platform called AVFoundation as a successor in OS X 10.6 (5 years ago). Since OS X 10.9, QuickTime has been officially deprecated and might disappear in a new OS X release. Although Apple is still extending AVFoundation, it’s still not as powerful as QuickTime. Especially regarding new codecs. AVFoundation can only handle a few codecs and there are no codec packs you can install to change that.

As far as I am aware, AVFoundation never made the jump to Windows. Probably because Windows now has powerful frameworks itself and there’s just no need to port the platform.

That’s probably also the reason why AVID moved to their own engine in Pro Tools (they used QuickTime before). Apple moved Logic’s video engine to AVFoundation with Logic 9 (I think) and they had to drop features like external video output which many users really hate.

A common confusion among many OS X users is QuickTime 7 versus QuickTime X on OS X. QuickTime 7 (Pro) uses the original QuickTime engine while QuickTime X uses the new AVFoundation framework. In my experience most users don’t know this and are always confused when they hear that.  Who would think that an app called “QuickTime X” doesn’t use the original QuickTime engine.

All this deprecation does not include the QuickTime MOV file format by the way. This still is supported and is also used by AVFoundation. 

So all in all this maybe a storm in a teacup, but we wanted to give you the best advice at our disposal.  Windows users do share with us what you plan to do in the comments below.

I Am A Windows User, What Should I Do?

One of the features of the Avid Video Engine introduced in Pro Tools 11 is that is bypasses QuickTime completely, even if the video is in a .mov container. However it does still depend what codecs are used within the movie wrapper. Unfortunately, there are some codecs which remain dependent on QuickTime being installed on Windows, most notably Apple ProRes. 

Other commonly used QuickTime formats which would be affected by the uninstallation of QuickTime include Animation (import and export), DNxHD/HR (export only) as would workflows where growing QuickTime files are being used although advice these days is to use MXF for this wherever possible.

You can choose to un-install QuickTime 7 completely and if you don't need ProRes or mp3 audio support. That may be OK, but for Windows users that do need mp3 support like voiceover artists then there is a solution by only installing QuickTime Essentials. We do advise that you fully uninstall QuckTime 7 and then re-install the latest version of QuickTime - 7.7.9.

You can get the installer for QuickTime 7.7.9 from the Apple site here. 

QuickTime 7.7.9 contains security updates and Apple recommends it for all QuickTime 7 users on Windows. More information on the security content of this update.

We also noticed that The QuickTime web browser plug-in is no longer installed by default when installing QuickTime 7.7.9 and Apple say it is removed if you have a previous version of QuickTime on your PC.

You should then have access to codecs like Apple ProRes, be able to import and export mp3 audio without having the vulnerability of the web browser plug-in.

Update - Avid Release Detailed Guidelines

Avid have released a detailed set of guidelines QuickTime Support and Security on Windows for Media Composer and Pro Tools users.