41 ms·

Reducing Adobe Flash Usage in Firefox

235 points by _jomo 10y ago

supergreg 10y ago
The only use for Flash I have these days is for streaming sites like Twitch. Once that's tackled, I'll be more than happy to remove the plugin. That said, it used to be easy to block annoying stuff by having Flash enabled on demand.
- sp332 10y ago
  Does Twitch just not work on Safari?
  - deleted 10y ago
    [deleted]
  - duskwuff 10y ago
    Twitch uses native HLS playback in Safari. This isn't available in other browsers (yet).
    - cpeterso 10y ago
      Edge has also native support for HLS and MPEG DASH: https://blogs.windows.com/msedgedev/2015/01/29/simplified-adaptive-video-streaming-announcing-support-for-hls-and-dash-in-windows-10/ https://blogs.windows.com/msedgedev/2015/01/29/simplified-ad...
    - sp332 10y ago
      Looks like there are patent issues. Android supports it, so HLS works in Chrome for Android but not desktop Chrome. And Firefox might support it on mobile at some point but not on desktop. Sites can use e.g. Dailymotion's HLS.js https://github.com/dailymotion/hls.js https://github.com/dailymotion/hls.js and Firefox users could install this wrapper extension https://addons.mozilla.org/en-US/firefox/addon/native-hls/ https://addons.mozilla.org/en-US/firefox/addon/native-hls/
    - spikengineer 10y ago
      Chrome and Firefox never plan to support HLS. They only want customers to use HTML5-DASH.
      - cpeterso 10y ago
        And for websites that have existing HLS content or workflows they would like to use with desktop browsers, they should check out solutions like Dailymotion's HLS.js polyfill. It tunnels HLS streams into the MSE API (used by DASH) available in Chrome, Firefox, IE/Edge, and Safari. Mozilla works closely with the HLS.js developers to help debug compatibility issues and regressions in Firefox or HLS.js. http://engineering.dailymotion.com/introducing-hls-js/ http://engineering.dailymotion.com/introducing-hls-js/
  - SG- 10y ago
    Kind of the opposite, Safari was the only browser that supported Twitch's HLS/HTML5 streaming until Edge came along.
- kyrra 10y ago
  Twitch has their HTML5 player in beta right now: https://blog.twitch.tv/html5-player-turbo-beta-starts-today-135d1b7baa65#.tjecrw2rn https://blog.twitch.tv/html5-player-turbo-beta-starts-today-...
- stronglikedan 10y ago
  A lot of enterprisey applications have tools developed in Flash/Flex. Mostly internal and B2B tools, but tools nonetheless. It's not likely that they will be replaced anytime soon, because no one is going to authorize the budget for replacing something that still works, so Flash will be around in one form or another for a long while.
bobajeff 10y ago
I think Chrome's propsal to whitelist the top ten domains and block all the other sites by default would be more effective at curving the web's dependency on flash. Edit: Turns out Firefox is planning on blocking all sites by default. So Firefox's approach looks more promising.
- ocdtrekkie 10y ago
  I disagree heavily. Because Chrome's proposal is essentially an elitist focus on assuming the top ten sites are the only sites worthy of using terrible code. It's unsurprising Google favors this strategy: Google will always end up in that top ten list. (And surprisingly, a lot of Google websites fallback on Adobe Flash still. Play Music doesn't work on Firefox without it.) YouTube is no more worthy of using Adobe Flash than my personal website. They should be treated the same. If we are to disincentivize Flash, it should be disincentivized equally across the board.
  - deleted 10y ago
    [deleted]
  - bobajeff 10y ago
    It sounds like you just don't like that approach. You didn't mention anything about how it's ineffective - or how Firefox's approach is more effective - at curbing the use of Flash.
    - ocdtrekkie 10y ago
      My comment didn't specify effectiveness, I suppose, but I can handle that too: Google's approach isn't effective at curbing the use of Flash in the top ten websites. For instance, curbing Google's use of Flash.
  - sqeaky 10y ago
    If any browser were to act against and "disincentivized equally across the board" by doing something like blocking it entirely that would simply be a browser people who wanted flash content would use less. Some people want flash, probably because they are oblivious to security concerns or simply don't care about standards and progress. These are the people we must convince. Letting them have what they "must" have while chipping away at the problem is something that might work here and now. Likely these people wouldn't even realized the browser was doing it in this case and would blame the sites for having broken flash. Despite seeming morally grey or deceptive, it could work and might not punish the browser doing it.
verisimilitude 10y ago
It is interesting to contrast this discussion today with the discussion Jobs' "Thoughts on Flash" spurred 6 years ago: https://news.ycombinator.com/item?id=1304310 https://news.ycombinator.com/item?id=1304310
- SG- 10y ago
  Flash has also dramatically increased it's performances since those times because of how pathetic things were.
jhatax 10y ago
I was hoping that Shumway, Mozilla's effort to render swf files using JS (like what PDF.js is to Adobe Reader), would be released at some point. It looks like the project has been added to the Firefox Graveyard [1]. I don't have Adobe Reader installed on my Mac any more, and don't really miss it. While Chrome's proposal to white-list the top-10 domains is a good start at curbing the loading of Flash on my laptop, I prefer the approach being considered by Safari to report that Flash (and other legacy plugins) is not available on the platform even if it is installed. [2] Safari's approach will ensure that most users see HTML5 content and won't really miss Flash. Folks who use sites like Twitch that insist on Flash will know how to force Safari to load the content they want to view. Unfortunately, Safari's user share outside of Mobile is very low. We need Chrome, Firefox and IE to adopt a similar approach (or agree on an approach for all vendors) if we are to really rid ourselves of Flash. 1. https://bugzilla.mozilla.org/describecomponents.cgi?product=Firefox%20Graveyard https://bugzilla.mozilla.org/describecomponents.cgi?product=... 2. https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ Edit: Moved links to the end of the post.
- cpeterso 10y ago
  Chrome and Firefox also plan to hide Flash until the user chooses to activate it for the current site: https://docs.google.com/presentation/d/106_KLNJfwb9L-1hVVa4i29aw1YXUy9qFX-Ye4kvJj-4/edit#slide=id.g1270f83468_0_30 https://docs.google.com/presentation/d/106_KLNJfwb9L-1hVVa4i... https://bugzilla.mozilla.org/show_bug.cgi?id=1186948 https://bugzilla.mozilla.org/show_bug.cgi?id=1186948
  - bobajeff 10y ago
    I believe Firefox's plan is to only hide Flash if it's set to click-to-play. I don't think click-to-play is default behavior for Flash unless it's not the latest version.
    - cpeterso 10y ago
      That is correct, though the planned "plugin cloaking" features for Firefox and Chrome will be a form of click-to-play.
codazoda 10y ago
Good. They're going slow, starting with fingerprinting and supercookies, which is nice for users. I welcome the end of Flash. I personally killed flash from Chrome about a year ago. I've seen a few sites that use it, which I just leave, but I haven't seen anything I can't live without.
- ComodoHacker 10y ago
  >starting with fingerprinting and supercookies It's strange they weren't mentioned in the blog post. Only the third class of blocked content, viewability test, is mentioned.
_jomo 10y ago
I don't have Flash installed at all anymore and it works quite well. For the few sites that don't work without Flash these days, I either don't care or use youtube-dl -g [0] or livestreamer [1] and open the direct video link in Browser or VLC. Twitch is one of the popular sites that don't have a working HTML5 player for the masses (it does work without Flash using the methods above). There's Beam.pro which has some interesting approaches to live streaming with HTML5 [2]. The only thing I haven't found a great solution for are the big Music streaming sites, which all rely on Flash (the others shut down). Some people told me Google Play Music may or may not work with HTML5 but I haven't tried that yet. Also, a great number of websites will ask you to turn on Flash when installed but deactivated and only use the HTML5 player when it's not actually installed. I guess it's a design flaw that Browsers report disabled or click-to-play plugins to websites. 0: http://rg3.github.io/youtube-dl/ http://rg3.github.io/youtube-dl/ 1: http://docs.livestreamer.io/ http://docs.livestreamer.io/ 2: https://forums.beam.pro/topic/168/where-we-re-at-with-html5-video https://forums.beam.pro/topic/168/where-we-re-at-with-html5-...
- simcop2387 10y ago
  At least with pandora, there's a few clients out there that can work outside of a browser. I usually use Pithos[1] or Hermes[2], no idea about the others. [1] http://pithos.github.io/ http://pithos.github.io/ [2] http://hermesapp.org/ http://hermesapp.org/
  - Miner49er 10y ago
    My personal favorite is pianobar: https://6xq.net/pianobar/ https://6xq.net/pianobar/. It's a CLI client.
  - daxelrod 10y ago
    Elpis is a fantastic Pandora Windows desktop client. https://github.com/adammhaile/Elpis https://github.com/adammhaile/Elpis
- Kenji 10y ago
  Oh, wow, I need livestreamer in my life. I like watching twitch but the CPU usage of this simple video stream is absolutely insane, such that my CPU fan has to spin faster for no reason other than inefficient flash plugins.
ars 10y ago
Any plan to reduce/remove flash needs to address the HUGE amount of small flash based web games. Just look for online playable games for kids and you'll see how many there. "Websites that currently use Flash or Silverlight for video or games should plan on adopting HTML technologies as soon as possible." This is utterly unrealistic, these games are 10 or more years old sometimes, and still played in large numbers, with no money available for the developer to rewrite them. Only an automatic transpiler of some kind has any chance here.
- Sylos 10y ago
  The problem is that this is not easy at all. Mozilla had a project which tried to do pretty much exactly that, called Shumway [0], and development has been going on for a few years, but they didn't really get anywhere useful in all that time. [0]:https://mozilla.github.io/shumway/ https://mozilla.github.io/shumway/
  - spriggan3 10y ago
    Unfortunately without the help of Adobe itself, this project is DOA. It won't run most flash content out there. Flash content HAS to be specifically designed to run on shumway. Adobe should have open sourced flash years ago, it didn't. Well at least that's a lesson for developers, don't use proprietary techs on the web.
- cooper12 10y ago
  That's what Shumway [0] was supposed to be, but according to another comment, it's been added to the Firefox graveyard unfortunately. [1] [0]: http://mozilla.github.io/shumway/ http://mozilla.github.io/shumway/ [1]: https://bugzilla.mozilla.org/describecomponents.cgi?product=Firefox%20Graveyard https://bugzilla.mozilla.org/describecomponents.cgi?product=...
- larsiusprime 10y ago
  I think someone with enough ingenuity could extend [OpenFL](http://www.openfl.org/ http://www.openfl.org/) to create such a transpiler. An OpenFL HTML5 app is already capable of rendering SWF animations, but it doesn't currently support the internal actionscript. With access to the games' original source they could be ported to OpenFL pretty easily (it uses Haxe, a language similar to actionscript that can transpile to many other language targets), but that's a bit short of automatic runtime transpilation of SWF content.
rcthompson 10y ago
> We categorized SWFs as fingerprinting SWFs if they were smaller than 5x5 pixels Coming soon: 6x6 fingerprinting/tracking SWFs?
ivanhoe 10y ago
I had it disabled in Chrome for the last 6 months or so, and very rarely needed to temporarily re-enable it, like maybe twice in all that time. And even that is not a big deal, you just go to chrome://plugins and switch it on and back off later, it takes 2-3 clicks to do it.
fulafel 10y ago
It's crazy that the perpetual security disaster hasn't been enough to disable Flash so far. (Goes for Chrome too, but at least they have reasonable sandboxing for it)
- dredmorbius 10y ago
  Keep this in mind should you ever be inclined to consider a security-based start-up. People simply don't care.
nix0n 10y ago
Now that HTML5 is gradually replacing Flash, has anyone seen a good Flashblock replacement for blocking HTML5?
- Nadya 10y ago
  Block all Canvas, Audio and Video elements?
  - nix0n 10y ago
    Yes, I'm looking for a browser plugin to do that (with whitelisting to turn some back on, preferably).
    - Nadya 10y ago
      uBlock or any other ad blocking add-on should be able to. Add "##video", "##audio", and "##canvas" to your blacklist rules to remove them from the DOM. Then you can whitelist on a per-site basis to turn them back on if desired.
      - unexistance 10y ago
        Can I ask for an example entry / site that you actually do this?
  - Grue3 10y ago
    Don't forget shit like WebRTC that's impossible to turn off and known to leak certain private information (such as internal IPs).
    - cpeterso 10y ago
      Here is a Firefox add-on to disable WebRTC: https://addons.mozilla.org/firefox/addon/happy-bonobo-disable-webrtc/ https://addons.mozilla.org/firefox/addon/happy-bonobo-disabl... The source code is on GitHub: https://github.com/ChrisAntaki/disable-webrtc-firefox https://github.com/ChrisAntaki/disable-webrtc-firefox
niftich 10y ago
I'm very torn on this subject. I'm always wary when browser vendors force the hand of users, programmers, and everyone else. I fully understand that Flash has had an outsized share of vulnerabilities 'affecting browsing' over the years; I fully understand that Adobe has deprecated Flash for new content production; I fully appreciate that the 'web platform' has acquired new APIs and capabilities over the last four years, making it a more potent platform than the days when people opted for Flash or Silverlight because an external runtime was the only way to reliably deliver the experiences those developers wanted. But in a world where a HTML webpage from 1991 [1] still loads and renders fine, I'm worried about the sheer amount of content that exists in Flash from the 2000s that will be made inaccessible. Sure, those developers should have known that developing on a proprietary platform is a risky bet, but this was back when Javascript was awful, browsers were racing to implement not-yet-final enhancements to CSS3 with vendor prefixes, and powerful vendors were bickering about which formats to support in a proposed <video> tag. These developers of course should've known better, but they had no other choice. What Mozilla is doing here is actually quite reasonable, but they're under pressure from Google Chrome who can unilaterally decide to ban flash from all but the top 10 sites, and get away with it due to their control of multiple platforms and their unwillingless to compromise. If Mozilla's tactics stray too far from Google's, they risk being seen as followers, rather than policy drivers; furthemore they answer to a divided fanbase that on one hand wants an open, independent web (in which Flash has no place), and on the other hand, wants a refuge from the incumbent browser maker's unilateral policies (currently Google, previously Microsoft). [1] http://info.cern.ch/hypertext/WWW/TheProject.html http://info.cern.ch/hypertext/WWW/TheProject.html
- Chris_Newton 10y ago
  Similar arguments were made for locking out Java applets, and other plugins. The trouble is, every time the big browser developers throw their weight around like this, a lot more content becomes inaccessible, and content is what the Web is all about. Much of the valuable material that isn’t in the top x% of sites wasn’t written recently and isn’t necessarily actively maintained, and this trend for writing off entire sections of the Web because they’re inconvenient is a very dangerous one, IMHO. I’d have marginally more sympathy if the modern alternatives we’re supposed to use instead now actually worked as well as the technologies they allegedly replace, but often they do not, and the biggest advocates for the newer technologies are often among the worst offenders. I’d also have marginally more sympathy if there was evidence that closing out the plugins would significantly improve security, but given that many of these changes just move the attack surface to the browser itself and that the popular plugins have mostly been subject to some sort of click-to-play safeguard for a while, I’m not sure the security argument holds much water either. But in any case, actively cutting users off from large amounts of existing content with no workaround seems like a huge backward step to me.
rcconf 10y ago
If you Google 'top facebook games', and you browse to each one, you will find a majority of them use Flash. Here are a few of them: - Candy Crush (50,000,000+ monthly users) - Dragon City (10,000,000+ monthly users) - Criminal Case (10,000,000+ monthly users) - Angry Bird Friends (1,000,000+ monthly users) I'm currently working on a Flash game with a large player base. Firefox's suggestion of adopting HTML technologies is not simple when the game is 9 years old! I think many Facebook games are going to run into a similar issue. It's getting scary now tho, it seems like Firefox and Chrome are aggressively trying to get rid of the usage of Flash. We've essentially decided that we're going to convert this 9 year old game to C++ (via Emscripten) in the next year. Good luck to everyone else who is going through the same thing as we are.
- spankalee 10y ago
  Have you heard of StageXL? http://www.stagexl.org/ http://www.stagexl.org/
- cpeterso 10y ago
  Have you looked at Unity's game dev tools for HTML5/Emscripten/asm.js? It seems like there are viable alternatives to the Flash authoring tool. It's not just Firefox and Chrome that are focusing on Flash. Safari 10 (in macOS Sierra to be released this year) and Edge are also restricting Flash usage: https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ https://blogs.windows.com/msedgedev/2016/04/07/putting-users-in-control-of-flash/ https://blogs.windows.com/msedgedev/2016/04/07/putting-users...
- bobajeff 10y ago
  I think it should be up to Adobe to come up with a solution here. Something like an Adobe AIR for the web.
  - pc2g4d 10y ago
    I really don't understand why they haven't stepped up with a Flash-to-HTML5 converter as part of the Flash/Animate application. It would ensure the continued relevance of those tools.
white-flame 10y ago
> Over the past few years, Firefox has implemented Web APIs to replace functionality that was formerly provided only by plugins. This includes ... fast 2D and 3D graphics Just a friendly reminder that the 2D graphics functionality of Flash is still not replaced for a massive chunk of graphics and games built with a vector-based visual style. Canvas 2D vector graphics still do not properly antialias adjacent edges (shows garish seams and unexpected transparencies), whereas Flash would render them properly and with high quality.
nfriedly 10y ago
I don't install flash these days. I usually browse in Firefox and don't really miss it. On the occasions when I do need flash for something, I'll fire up Chrome because it has flash built in.
amelius 10y ago
I really wonder if one day (perhaps in a distant future) HTML will end up on a graveyard, just like Flash, and what we can do now to make this event less painful.
Animats 10y ago
Mozilla needs to do outreach to the porno industry to get them to convert.
- SG- 10y ago
  The mobile browsers (iPhone) have already caused them all to move to it long ago. They're further ahead of the BBC that still insists on Flash video.
ComodoHacker 10y ago
>The criteria for adding content to the blocklist are: >* Blocking the content will not be noticeable to the Firefox user. >* It is possible to reimplement the basic functionality of the content in HTML without Flash. There are three classes of content in the block list: Fingerprinting, Supercookie and Viewability. While I'm heard of various fingerprinting techniques besides Flash, I'm curious how "to reimplement without Flash the basic functionality" of supercookies, given its main feature is persistence despite of user's effort.
jlebar 10y ago
I know this is unimportant, but I have to say, I strongly dislike this green trendline that they have fitted to the graph. It clearly does not fit. The graph flattened out at Jul 2015.
deleted 10y ago
[deleted]
Endy 10y ago
That's funny. I guess there's a reason why I'm being forced into using old browsers rather than supporting any of the rabid anti-Flash nonsense. Then again, I'm anti HTML5 & WebDRM (now under the more innocuous title of EME)

235 points by _jomo 10y ago

The only use for Flash I have these days is for streaming sites like Twitch. Once that's tackled, I'll be more than happy to remove the plugin. That said, it used to be easy to block annoying stuff by having Flash enabled on demand.

sp332 10y ago
Does Twitch just not work on Safari?
- deleted 10y ago
  [deleted]
- duskwuff 10y ago
  Twitch uses native HLS playback in Safari. This isn't available in other browsers (yet).
  - cpeterso 10y ago
    Edge has also native support for HLS and MPEG DASH: https://blogs.windows.com/msedgedev/2015/01/29/simplified-adaptive-video-streaming-announcing-support-for-hls-and-dash-in-windows-10/ https://blogs.windows.com/msedgedev/2015/01/29/simplified-ad...
  - sp332 10y ago
    Looks like there are patent issues. Android supports it, so HLS works in Chrome for Android but not desktop Chrome. And Firefox might support it on mobile at some point but not on desktop. Sites can use e.g. Dailymotion's HLS.js https://github.com/dailymotion/hls.js https://github.com/dailymotion/hls.js and Firefox users could install this wrapper extension https://addons.mozilla.org/en-US/firefox/addon/native-hls/ https://addons.mozilla.org/en-US/firefox/addon/native-hls/
  - spikengineer 10y ago
    Chrome and Firefox never plan to support HLS. They only want customers to use HTML5-DASH.
    - cpeterso 10y ago
      And for websites that have existing HLS content or workflows they would like to use with desktop browsers, they should check out solutions like Dailymotion's HLS.js polyfill. It tunnels HLS streams into the MSE API (used by DASH) available in Chrome, Firefox, IE/Edge, and Safari. Mozilla works closely with the HLS.js developers to help debug compatibility issues and regressions in Firefox or HLS.js. http://engineering.dailymotion.com/introducing-hls-js/ http://engineering.dailymotion.com/introducing-hls-js/
- SG- 10y ago
  Kind of the opposite, Safari was the only browser that supported Twitch's HLS/HTML5 streaming until Edge came along.
kyrra 10y ago
Twitch has their HTML5 player in beta right now: https://blog.twitch.tv/html5-player-turbo-beta-starts-today-135d1b7baa65#.tjecrw2rn https://blog.twitch.tv/html5-player-turbo-beta-starts-today-...
stronglikedan 10y ago
A lot of enterprisey applications have tools developed in Flash/Flex. Mostly internal and B2B tools, but tools nonetheless. It's not likely that they will be replaced anytime soon, because no one is going to authorize the budget for replacing something that still works, so Flash will be around in one form or another for a long while.

bobajeff 10y ago

I think Chrome's propsal to whitelist the top ten domains and block all the other sites by default would be more effective at curving the web's dependency on flash. Edit: Turns out Firefox is planning on blocking all sites by default. So Firefox's approach looks more promising.

ocdtrekkie 10y ago
I disagree heavily. Because Chrome's proposal is essentially an elitist focus on assuming the top ten sites are the only sites worthy of using terrible code. It's unsurprising Google favors this strategy: Google will always end up in that top ten list. (And surprisingly, a lot of Google websites fallback on Adobe Flash still. Play Music doesn't work on Firefox without it.) YouTube is no more worthy of using Adobe Flash than my personal website. They should be treated the same. If we are to disincentivize Flash, it should be disincentivized equally across the board.
- deleted 10y ago
  [deleted]
- bobajeff 10y ago
  It sounds like you just don't like that approach. You didn't mention anything about how it's ineffective - or how Firefox's approach is more effective - at curbing the use of Flash.
  - ocdtrekkie 10y ago
    My comment didn't specify effectiveness, I suppose, but I can handle that too: Google's approach isn't effective at curbing the use of Flash in the top ten websites. For instance, curbing Google's use of Flash.
- sqeaky 10y ago
  If any browser were to act against and "disincentivized equally across the board" by doing something like blocking it entirely that would simply be a browser people who wanted flash content would use less. Some people want flash, probably because they are oblivious to security concerns or simply don't care about standards and progress. These are the people we must convince. Letting them have what they "must" have while chipping away at the problem is something that might work here and now. Likely these people wouldn't even realized the browser was doing it in this case and would blame the sites for having broken flash. Despite seeming morally grey or deceptive, it could work and might not punish the browser doing it.

verisimilitude 10y ago

It is interesting to contrast this discussion today with the discussion Jobs' "Thoughts on Flash" spurred 6 years ago: https://news.ycombinator.com/item?id=1304310 https://news.ycombinator.com/item?id=1304310

SG- 10y ago
Flash has also dramatically increased it's performances since those times because of how pathetic things were.

jhatax 10y ago

I was hoping that Shumway, Mozilla's effort to render swf files using JS (like what PDF.js is to Adobe Reader), would be released at some point. It looks like the project has been added to the Firefox Graveyard [1]. I don't have Adobe Reader installed on my Mac any more, and don't really miss it. While Chrome's proposal to white-list the top-10 domains is a good start at curbing the loading of Flash on my laptop, I prefer the approach being considered by Safari to report that Flash (and other legacy plugins) is not available on the platform even if it is installed. [2] Safari's approach will ensure that most users see HTML5 content and won't really miss Flash. Folks who use sites like Twitch that insist on Flash will know how to force Safari to load the content they want to view. Unfortunately, Safari's user share outside of Mobile is very low. We need Chrome, Firefox and IE to adopt a similar approach (or agree on an approach for all vendors) if we are to really rid ourselves of Flash. 1. https://bugzilla.mozilla.org/describecomponents.cgi?product=Firefox%20Graveyard https://bugzilla.mozilla.org/describecomponents.cgi?product=... 2. https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ Edit: Moved links to the end of the post.

cpeterso 10y ago
Chrome and Firefox also plan to hide Flash until the user chooses to activate it for the current site: https://docs.google.com/presentation/d/106_KLNJfwb9L-1hVVa4i29aw1YXUy9qFX-Ye4kvJj-4/edit#slide=id.g1270f83468_0_30 https://docs.google.com/presentation/d/106_KLNJfwb9L-1hVVa4i... https://bugzilla.mozilla.org/show_bug.cgi?id=1186948 https://bugzilla.mozilla.org/show_bug.cgi?id=1186948
- bobajeff 10y ago
  I believe Firefox's plan is to only hide Flash if it's set to click-to-play. I don't think click-to-play is default behavior for Flash unless it's not the latest version.
  - cpeterso 10y ago
    That is correct, though the planned "plugin cloaking" features for Firefox and Chrome will be a form of click-to-play.

codazoda 10y ago

Good. They're going slow, starting with fingerprinting and supercookies, which is nice for users. I welcome the end of Flash. I personally killed flash from Chrome about a year ago. I've seen a few sites that use it, which I just leave, but I haven't seen anything I can't live without.

ComodoHacker 10y ago
>starting with fingerprinting and supercookies It's strange they weren't mentioned in the blog post. Only the third class of blocked content, viewability test, is mentioned.

_jomo 10y ago

I don't have Flash installed at all anymore and it works quite well. For the few sites that don't work without Flash these days, I either don't care or use youtube-dl -g [0] or livestreamer [1] and open the direct video link in Browser or VLC. Twitch is one of the popular sites that don't have a working HTML5 player for the masses (it does work without Flash using the methods above). There's Beam.pro which has some interesting approaches to live streaming with HTML5 [2]. The only thing I haven't found a great solution for are the big Music streaming sites, which all rely on Flash (the others shut down). Some people told me Google Play Music may or may not work with HTML5 but I haven't tried that yet. Also, a great number of websites will ask you to turn on Flash when installed but deactivated and only use the HTML5 player when it's not actually installed. I guess it's a design flaw that Browsers report disabled or click-to-play plugins to websites. 0: http://rg3.github.io/youtube-dl/ http://rg3.github.io/youtube-dl/ 1: http://docs.livestreamer.io/ http://docs.livestreamer.io/ 2: https://forums.beam.pro/topic/168/where-we-re-at-with-html5-video https://forums.beam.pro/topic/168/where-we-re-at-with-html5-...

simcop2387 10y ago
At least with pandora, there's a few clients out there that can work outside of a browser. I usually use Pithos[1] or Hermes[2], no idea about the others. [1] http://pithos.github.io/ http://pithos.github.io/ [2] http://hermesapp.org/ http://hermesapp.org/
- Miner49er 10y ago
  My personal favorite is pianobar: https://6xq.net/pianobar/ https://6xq.net/pianobar/. It's a CLI client.
- daxelrod 10y ago
  Elpis is a fantastic Pandora Windows desktop client. https://github.com/adammhaile/Elpis https://github.com/adammhaile/Elpis
Kenji 10y ago
Oh, wow, I need livestreamer in my life. I like watching twitch but the CPU usage of this simple video stream is absolutely insane, such that my CPU fan has to spin faster for no reason other than inefficient flash plugins.

ars 10y ago

Any plan to reduce/remove flash needs to address the HUGE amount of small flash based web games. Just look for online playable games for kids and you'll see how many there. "Websites that currently use Flash or Silverlight for video or games should plan on adopting HTML technologies as soon as possible." This is utterly unrealistic, these games are 10 or more years old sometimes, and still played in large numbers, with no money available for the developer to rewrite them. Only an automatic transpiler of some kind has any chance here.

Sylos 10y ago
The problem is that this is not easy at all. Mozilla had a project which tried to do pretty much exactly that, called Shumway [0], and development has been going on for a few years, but they didn't really get anywhere useful in all that time. [0]:https://mozilla.github.io/shumway/ https://mozilla.github.io/shumway/
- spriggan3 10y ago
  Unfortunately without the help of Adobe itself, this project is DOA. It won't run most flash content out there. Flash content HAS to be specifically designed to run on shumway. Adobe should have open sourced flash years ago, it didn't. Well at least that's a lesson for developers, don't use proprietary techs on the web.
cooper12 10y ago
That's what Shumway [0] was supposed to be, but according to another comment, it's been added to the Firefox graveyard unfortunately. [1] [0]: http://mozilla.github.io/shumway/ http://mozilla.github.io/shumway/ [1]: https://bugzilla.mozilla.org/describecomponents.cgi?product=Firefox%20Graveyard https://bugzilla.mozilla.org/describecomponents.cgi?product=...
larsiusprime 10y ago
I think someone with enough ingenuity could extend [OpenFL](http://www.openfl.org/ http://www.openfl.org/) to create such a transpiler. An OpenFL HTML5 app is already capable of rendering SWF animations, but it doesn't currently support the internal actionscript. With access to the games' original source they could be ported to OpenFL pretty easily (it uses Haxe, a language similar to actionscript that can transpile to many other language targets), but that's a bit short of automatic runtime transpilation of SWF content.

rcthompson 10y ago

> We categorized SWFs as fingerprinting SWFs if they were smaller than 5x5 pixels Coming soon: 6x6 fingerprinting/tracking SWFs?

ivanhoe 10y ago

I had it disabled in Chrome for the last 6 months or so, and very rarely needed to temporarily re-enable it, like maybe twice in all that time. And even that is not a big deal, you just go to chrome://plugins and switch it on and back off later, it takes 2-3 clicks to do it.

fulafel 10y ago

It's crazy that the perpetual security disaster hasn't been enough to disable Flash so far. (Goes for Chrome too, but at least they have reasonable sandboxing for it)

dredmorbius 10y ago
Keep this in mind should you ever be inclined to consider a security-based start-up. People simply don't care.

nix0n 10y ago

Now that HTML5 is gradually replacing Flash, has anyone seen a good Flashblock replacement for blocking HTML5?

Nadya 10y ago
Block all Canvas, Audio and Video elements?
- nix0n 10y ago
  Yes, I'm looking for a browser plugin to do that (with whitelisting to turn some back on, preferably).
  - Nadya 10y ago
    uBlock or any other ad blocking add-on should be able to. Add "##video", "##audio", and "##canvas" to your blacklist rules to remove them from the DOM. Then you can whitelist on a per-site basis to turn them back on if desired.
    - unexistance 10y ago
      Can I ask for an example entry / site that you actually do this?
- Grue3 10y ago
  Don't forget shit like WebRTC that's impossible to turn off and known to leak certain private information (such as internal IPs).
  - cpeterso 10y ago
    Here is a Firefox add-on to disable WebRTC: https://addons.mozilla.org/firefox/addon/happy-bonobo-disable-webrtc/ https://addons.mozilla.org/firefox/addon/happy-bonobo-disabl... The source code is on GitHub: https://github.com/ChrisAntaki/disable-webrtc-firefox https://github.com/ChrisAntaki/disable-webrtc-firefox

niftich 10y ago

I'm very torn on this subject. I'm always wary when browser vendors force the hand of users, programmers, and everyone else. I fully understand that Flash has had an outsized share of vulnerabilities 'affecting browsing' over the years; I fully understand that Adobe has deprecated Flash for new content production; I fully appreciate that the 'web platform' has acquired new APIs and capabilities over the last four years, making it a more potent platform than the days when people opted for Flash or Silverlight because an external runtime was the only way to reliably deliver the experiences those developers wanted. But in a world where a HTML webpage from 1991 [1] still loads and renders fine, I'm worried about the sheer amount of content that exists in Flash from the 2000s that will be made inaccessible. Sure, those developers should have known that developing on a proprietary platform is a risky bet, but this was back when Javascript was awful, browsers were racing to implement not-yet-final enhancements to CSS3 with vendor prefixes, and powerful vendors were bickering about which formats to support in a proposed <video> tag. These developers of course should've known better, but they had no other choice. What Mozilla is doing here is actually quite reasonable, but they're under pressure from Google Chrome who can unilaterally decide to ban flash from all but the top 10 sites, and get away with it due to their control of multiple platforms and their unwillingless to compromise. If Mozilla's tactics stray too far from Google's, they risk being seen as followers, rather than policy drivers; furthemore they answer to a divided fanbase that on one hand wants an open, independent web (in which Flash has no place), and on the other hand, wants a refuge from the incumbent browser maker's unilateral policies (currently Google, previously Microsoft). [1] http://info.cern.ch/hypertext/WWW/TheProject.html http://info.cern.ch/hypertext/WWW/TheProject.html

Chris_Newton 10y ago
Similar arguments were made for locking out Java applets, and other plugins. The trouble is, every time the big browser developers throw their weight around like this, a lot more content becomes inaccessible, and content is what the Web is all about. Much of the valuable material that isn’t in the top x% of sites wasn’t written recently and isn’t necessarily actively maintained, and this trend for writing off entire sections of the Web because they’re inconvenient is a very dangerous one, IMHO. I’d have marginally more sympathy if the modern alternatives we’re supposed to use instead now actually worked as well as the technologies they allegedly replace, but often they do not, and the biggest advocates for the newer technologies are often among the worst offenders. I’d also have marginally more sympathy if there was evidence that closing out the plugins would significantly improve security, but given that many of these changes just move the attack surface to the browser itself and that the popular plugins have mostly been subject to some sort of click-to-play safeguard for a while, I’m not sure the security argument holds much water either. But in any case, actively cutting users off from large amounts of existing content with no workaround seems like a huge backward step to me.

rcconf 10y ago

If you Google 'top facebook games', and you browse to each one, you will find a majority of them use Flash. Here are a few of them: - Candy Crush (50,000,000+ monthly users) - Dragon City (10,000,000+ monthly users) - Criminal Case (10,000,000+ monthly users) - Angry Bird Friends (1,000,000+ monthly users) I'm currently working on a Flash game with a large player base. Firefox's suggestion of adopting HTML technologies is not simple when the game is 9 years old! I think many Facebook games are going to run into a similar issue. It's getting scary now tho, it seems like Firefox and Chrome are aggressively trying to get rid of the usage of Flash. We've essentially decided that we're going to convert this 9 year old game to C++ (via Emscripten) in the next year. Good luck to everyone else who is going through the same thing as we are.

spankalee 10y ago
Have you heard of StageXL? http://www.stagexl.org/ http://www.stagexl.org/
cpeterso 10y ago
Have you looked at Unity's game dev tools for HTML5/Emscripten/asm.js? It seems like there are viable alternatives to the Flash authoring tool. It's not just Firefox and Chrome that are focusing on Flash. Safari 10 (in macOS Sierra to be released this year) and Edge are also restricting Flash usage: https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/ https://blogs.windows.com/msedgedev/2016/04/07/putting-users-in-control-of-flash/ https://blogs.windows.com/msedgedev/2016/04/07/putting-users...
bobajeff 10y ago
I think it should be up to Adobe to come up with a solution here. Something like an Adobe AIR for the web.
- pc2g4d 10y ago
  I really don't understand why they haven't stepped up with a Flash-to-HTML5 converter as part of the Flash/Animate application. It would ensure the continued relevance of those tools.

white-flame 10y ago

> Over the past few years, Firefox has implemented Web APIs to replace functionality that was formerly provided only by plugins. This includes ... fast 2D and 3D graphics Just a friendly reminder that the 2D graphics functionality of Flash is still not replaced for a massive chunk of graphics and games built with a vector-based visual style. Canvas 2D vector graphics still do not properly antialias adjacent edges (shows garish seams and unexpected transparencies), whereas Flash would render them properly and with high quality.

nfriedly 10y ago

I don't install flash these days. I usually browse in Firefox and don't really miss it. On the occasions when I do need flash for something, I'll fire up Chrome because it has flash built in.

amelius 10y ago

I really wonder if one day (perhaps in a distant future) HTML will end up on a graveyard, just like Flash, and what we can do now to make this event less painful.

Animats 10y ago

Mozilla needs to do outreach to the porno industry to get them to convert.

SG- 10y ago
The mobile browsers (iPhone) have already caused them all to move to it long ago. They're further ahead of the BBC that still insists on Flash video.

ComodoHacker 10y ago

>The criteria for adding content to the blocklist are: >* Blocking the content will not be noticeable to the Firefox user. >* It is possible to reimplement the basic functionality of the content in HTML without Flash. There are three classes of content in the block list: Fingerprinting, Supercookie and Viewability. While I'm heard of various fingerprinting techniques besides Flash, I'm curious how "to reimplement without Flash the basic functionality" of supercookies, given its main feature is persistence despite of user's effort.

jlebar 10y ago

I know this is unimportant, but I have to say, I strongly dislike this green trendline that they have fitted to the graph. It clearly does not fit. The graph flattened out at Jul 2015.

deleted 10y ago

[deleted]

Endy 10y ago

That's funny. I guess there's a reason why I'm being forced into using old browsers rather than supporting any of the rabid anti-Flash nonsense. Then again, I'm anti HTML5 & WebDRM (now under the more innocuous title of EME)