7 ms·

I've removed Flash entirely from my computers. I was afraid that it would degrade my experience, but I'm barely missing it. Sure there are a few sites that ins

by Renaud 11y ago

I've removed Flash entirely from my computers. I was afraid that it would degrade my experience, but I'm barely missing it. Sure there are a few sites that insist on using flash for video or some old games, but I'm ok with that sacrifice. Flash has been a tool of evil for too long: either storing permanent cookies for tracking or as a tool to exploit vulnerabilities in itself or its host. There is nothing on the web today that should require flash. Using it for adverts is especially egregious considering that it remains a major vector of attack despite all attempts at fixing it.

forloop 11y ago
Though you got downvoted, you're correct! Even the people of HN are overcome with be-positive-bias, when faced with technical questions. Flash is junk! I disabled it after Brian Krebs tried living without Flash successfully—and reported on it. It's been awesome! If I need Flash, I open a different browser. Easy.
- jorgecastillo 11y ago
  >If I need Flash, I open a different browser. If I need Flash, I open a different user account!
  - forloop 11y ago
    Some things aren't fungible, though. Where possible, I do, as well!
  - kachnuv_ocasek 11y ago
    If I need Flash, I go to an Internet café or a library.
  - Retr0spectrum 11y ago
    If I need flash, I load up a VM.
- andy_ppp 11y ago
  [0] http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/ http://krebsonsecurity.com/2015/06/a-month-without-adobe-fla...
- LastZactionHero 11y ago
  I've never seen a 'be-positive-bias' in HN.
  - ams6110 11y ago
    In general I agree with you, but reliably whenever anyone complains about sites that require javascript or flash to load, people will respond that javascript (or to a lesser degree, flash) is required in the modern web and if you don't have it enabled by default you are some kind of wierd paranoid luddite.
drzaiusapelord 11y ago
I did the same thing. I have Chrome configured as my "work browser" and have flash set to click to play, due to legacy software concerns. I almost never click on flash applets. I also have Firefox setup as my "personal" browser and never bothered to install flash. I can't say I'm missing anything. It would be nice if browser vendors got together and announced a Flash EOL on their platforms. On that day Flash becomes a strict click-to-play option by default with big warnings to undo it. Then eventually a tombstoning of Flash where its disabled outright and perhaps only enabled via some registry/config hackery that's user unfriendly but sysadmin/enterprise friendly.
agumonkey 11y ago
If browsers had a native 'push url to external program' I wouldn't miss most of the web.
- justizin 11y ago
  They do, it's called a protocol handler, this is how video worked in the 90s.
  - agumonkey 11y ago
    :) Good point, I never really investigated how to leverage them under linux because of program requiring a tty... Still good reminder.
mshenfield 11y ago
One huge site that still uses Flash is HBO Go. Surprising considering most other big streaming video services (Netflix, Youtube, Vimeo) have moved or are moving to HTML5.
funkyy 11y ago
Just fyi and for others to see, you can remove flash cookies by going to this url: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html http://www.macromedia.com/support/documentation/en/flashplay... This is a good solution for people that cannot work without flash.
- ketralnis 11y ago
  It is a "solution", but not a good solution. Spying on me by default, and claiming that periodically removing the cookies you've already used to do it on an essentially secret website is sufficient, is not a good solution.
  - DatBear 11y ago
    So do you not use browsers then? Cookies are enabled by default in most browsers as well. And you can just as easily figure out how to remove flash cookies as browser cookies.
    - ketralnis 11y ago
      1. it's not nearly as hidden 2. am I not allowed to dislike both things?
rtkwe 11y ago
The biggest area it's still important for me in my daily use is live streaming video. Most players are still flash.
stephengillie 11y ago
It's frustrating that VMWare is moving toward Flash as a management platform. Their entire 5.5 web console is in Flash.
- timboslice 11y ago
  Why flash? What advantages do they get with flash that outweigh the negatives? https://www.youtube.com/watch?v=31g0YE61PLQ https://www.youtube.com/watch?v=31g0YE61PLQ
  - illicium 11y ago
    VMWare probably has a bunch of enterprise customers stuck using IE7-9, so a modern HTML5 SPA for the admin interface is prohibitively expensive to write and maintain.
ce4 11y ago
> Sure there are a few sites that insist on using flash for video or some old games, but I'm ok with that sacrifice. I use this generic downloader (despite its name) for the few flash video sites that i use. Works great for many sites. https://rg3.github.io/youtube-dl/ https://rg3.github.io/youtube-dl/
georgerobinson 11y ago
I don't know if you use Google Chrome, but Adobe Flash Player in sandboxed in Chrome as a Native Client module. All interaction between a Native Client module, the host process, and the host the operating system must be mediated via the PPAPI (Pepper API). Native Client has a set of rules which are enforced via the validator to ensure that untrusted code (that is Adobe Flash itself) cannot jump, load or store outside to addresses outside the sandbox. More information on how Native Client does this can be found in the links below. Note: you should be familiar with the x86 and x86-64 instruction set for it to make much sense. Nevertheless, here is some more information: [1] https://support.google.com/chrome/answer/108086?hl=en-GB https://support.google.com/chrome/answer/108086?hl=en-GB [2] http://www.eecs.harvard.edu/~greg/cs255sp2004/wahbe93efficient.pdf http://www.eecs.harvard.edu/~greg/cs255sp2004/wahbe93efficie... [3] http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/34913.pdf http://static.googleusercontent.com/media/research.google.co... [4] http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/35649.pdf http://static.googleusercontent.com/media/research.google.co...
- justizin 11y ago
  > I don't know if you use Google Chrome, but Adobe Flash Player in sandboxed in Chrome as a Native Client module. That is, indeed, smart, but I stopped using Chrome on the basis that I don't want to use a browser that is developed by a company whose customers are advertises and for whom I am the product. :/ I was an early Chrome adopted and I saw the tide turning a way I didn't like. I've actually been pretty happy with Safari and ClickToFlash plugin of late, I'm not as worried about sandboxing it when I only use it in a couple of places behind AdBlockPlus.
  - georgerobinson 11y ago
    I don't use Chrome either. I like Firefox - even if it is less secure (in principle) than Chrome (no process separation between domains or sandboxing of plugins). The reason Native Client exists extends well beyond Adobe Flash Player. Native Client exists to enable your browser to run native code from any website (think compiled C and C++ code) without it being able to compromise the security of your machine.
brobinson 11y ago
I uninstalled Flash and just pop open Google Chrome for the occasional site which needs Flash. I'm surprised by the number of sites which have HTML5 fallback for when Flash is not present now. It's a far cry from what it was a year ago. After flipping whatever switch in about:config that enabled HD Youtube video in the HTML5 player in Firefox last year, I haven't really had any use for Flash at all.

by Renaud 11y ago

forloop 11y ago

Though you got downvoted, you're correct! Even the people of HN are overcome with be-positive-bias, when faced with technical questions. Flash is junk! I disabled it after Brian Krebs tried living without Flash successfully—and reported on it. It's been awesome! If I need Flash, I open a different browser. Easy.

jorgecastillo 11y ago
>If I need Flash, I open a different browser. If I need Flash, I open a different user account!
- forloop 11y ago
  Some things aren't fungible, though. Where possible, I do, as well!
- kachnuv_ocasek 11y ago
  If I need Flash, I go to an Internet café or a library.
- Retr0spectrum 11y ago
  If I need flash, I load up a VM.
andy_ppp 11y ago
[0] http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/ http://krebsonsecurity.com/2015/06/a-month-without-adobe-fla...
LastZactionHero 11y ago
I've never seen a 'be-positive-bias' in HN.
- ams6110 11y ago
  In general I agree with you, but reliably whenever anyone complains about sites that require javascript or flash to load, people will respond that javascript (or to a lesser degree, flash) is required in the modern web and if you don't have it enabled by default you are some kind of wierd paranoid luddite.

drzaiusapelord 11y ago

I did the same thing. I have Chrome configured as my "work browser" and have flash set to click to play, due to legacy software concerns. I almost never click on flash applets. I also have Firefox setup as my "personal" browser and never bothered to install flash. I can't say I'm missing anything. It would be nice if browser vendors got together and announced a Flash EOL on their platforms. On that day Flash becomes a strict click-to-play option by default with big warnings to undo it. Then eventually a tombstoning of Flash where its disabled outright and perhaps only enabled via some registry/config hackery that's user unfriendly but sysadmin/enterprise friendly.

agumonkey 11y ago

If browsers had a native 'push url to external program' I wouldn't miss most of the web.

justizin 11y ago
They do, it's called a protocol handler, this is how video worked in the 90s.
- agumonkey 11y ago
  :) Good point, I never really investigated how to leverage them under linux because of program requiring a tty... Still good reminder.

mshenfield 11y ago

One huge site that still uses Flash is HBO Go. Surprising considering most other big streaming video services (Netflix, Youtube, Vimeo) have moved or are moving to HTML5.

funkyy 11y ago

Just fyi and for others to see, you can remove flash cookies by going to this url: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html http://www.macromedia.com/support/documentation/en/flashplay... This is a good solution for people that cannot work without flash.

ketralnis 11y ago
It is a "solution", but not a good solution. Spying on me by default, and claiming that periodically removing the cookies you've already used to do it on an essentially secret website is sufficient, is not a good solution.
- DatBear 11y ago
  So do you not use browsers then? Cookies are enabled by default in most browsers as well. And you can just as easily figure out how to remove flash cookies as browser cookies.
  - ketralnis 11y ago
    1. it's not nearly as hidden 2. am I not allowed to dislike both things?

rtkwe 11y ago

The biggest area it's still important for me in my daily use is live streaming video. Most players are still flash.

stephengillie 11y ago

It's frustrating that VMWare is moving toward Flash as a management platform. Their entire 5.5 web console is in Flash.

timboslice 11y ago
Why flash? What advantages do they get with flash that outweigh the negatives? https://www.youtube.com/watch?v=31g0YE61PLQ https://www.youtube.com/watch?v=31g0YE61PLQ
- illicium 11y ago
  VMWare probably has a bunch of enterprise customers stuck using IE7-9, so a modern HTML5 SPA for the admin interface is prohibitively expensive to write and maintain.

ce4 11y ago

> Sure there are a few sites that insist on using flash for video or some old games, but I'm ok with that sacrifice. I use this generic downloader (despite its name) for the few flash video sites that i use. Works great for many sites. https://rg3.github.io/youtube-dl/ https://rg3.github.io/youtube-dl/

georgerobinson 11y ago

I don't know if you use Google Chrome, but Adobe Flash Player in sandboxed in Chrome as a Native Client module. All interaction between a Native Client module, the host process, and the host the operating system must be mediated via the PPAPI (Pepper API). Native Client has a set of rules which are enforced via the validator to ensure that untrusted code (that is Adobe Flash itself) cannot jump, load or store outside to addresses outside the sandbox. More information on how Native Client does this can be found in the links below. Note: you should be familiar with the x86 and x86-64 instruction set for it to make much sense. Nevertheless, here is some more information: [1] https://support.google.com/chrome/answer/108086?hl=en-GB https://support.google.com/chrome/answer/108086?hl=en-GB [2] http://www.eecs.harvard.edu/~greg/cs255sp2004/wahbe93efficient.pdf http://www.eecs.harvard.edu/~greg/cs255sp2004/wahbe93efficie... [3] http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/34913.pdf http://static.googleusercontent.com/media/research.google.co... [4] http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/35649.pdf http://static.googleusercontent.com/media/research.google.co...

justizin 11y ago
> I don't know if you use Google Chrome, but Adobe Flash Player in sandboxed in Chrome as a Native Client module. That is, indeed, smart, but I stopped using Chrome on the basis that I don't want to use a browser that is developed by a company whose customers are advertises and for whom I am the product. :/ I was an early Chrome adopted and I saw the tide turning a way I didn't like. I've actually been pretty happy with Safari and ClickToFlash plugin of late, I'm not as worried about sandboxing it when I only use it in a couple of places behind AdBlockPlus.
- georgerobinson 11y ago
  I don't use Chrome either. I like Firefox - even if it is less secure (in principle) than Chrome (no process separation between domains or sandboxing of plugins). The reason Native Client exists extends well beyond Adobe Flash Player. Native Client exists to enable your browser to run native code from any website (think compiled C and C++ code) without it being able to compromise the security of your machine.

brobinson 11y ago

I uninstalled Flash and just pop open Google Chrome for the occasional site which needs Flash. I'm surprised by the number of sites which have HTML5 fallback for when Flash is not present now. It's a far cry from what it was a year ago. After flipping whatever switch in about:config that enabled HD Youtube video in the HTML5 player in Firefox last year, I haven't really had any use for Flash at all.