4 ms·
I don't understand why they removed support for Silverlight and Java, but kept Flash. Are Java applets and Silverlight apps demonstrably less secure than Flash
by k_sze 10y ago
I don't understand why they removed support for Silverlight and Java, but kept Flash.
Are Java applets and Silverlight apps demonstrably less secure than Flash?
Just as a naive metric, if you look at the CVE database, there have been a total of three CVEs for Silverlight last year; whereas for Flash... well, I stopped counting.
I don't know of any bank or government agency that uses Flash, but I certainly know that the Hong Kong government uses Java on some of its websites.
It feels like Mozilla is keeping Flash around just because it's more popular with browser gamers and video watchers. I don't think that's doing the right thing.
- untoreh 10y ago> I don't understand why they removed support for Silverlight and Java, but kept Flash. drm something something...shall I remind spotify web player still uses flash.
- nnethercote 10y ago> It feels like Mozilla is keeping Flash around just because it's more popular with browser gamers and video watchers. That's exactly right. The amount of Flash content dwarfs the amount of other plugin content. Banning other NPAPI plugins doesn't avoid the Flash security problems but it does avoid the other security problems. It's a step forward, but it's not the final step.
- comex 10y agoIt's not about security. As you said, it's because Flash is more popular, so killing it will disrupt more users' workflows. It's a pragmatic decision… Personally, I'm hoping we see a WebAssembly build of Flash eventually (once WA is featureful enough to support it), at which point the native plugin can die without breaking (as many) old sites.