8 ms·
Senator Asks US Agencies to Remove Flash from Government Websites
- bdhess 8y agoHow did I know before clicking that the Senator would be Ron Wyden?
- brink 8y agoBecause technologically savvy senators are a rarity.
- ISL 8y agoBecause it's always Ron Wyden.
- 1121redblackgo 8y ago50/50 Wyden or Warner
- BentFranklin 8y agoI did too
- _salmon 8y agoI wish I could adopt Ron as my state's senator.
- sandermvanvliet 8y agoWhile the end-of-life, security issues angle is a perfectly valid one I’m surprised this isn’t about accessibility. I would imagine government websites should provide information in an accessible way which Flash definitely isn’t. The recent HN post about the UK government moving from PDF to HTML[0] springs to mind as an example of a move in the right direction but given that it took a lawsuit to make laws publicly and freely accessible I think that isn’t a goal in US government somehow. [0] https://news.ycombinator.com/item?id=17541045 https://news.ycombinator.com/item?id=17541045
- walrus01 8y agoSeconding this, since Flash is incompatible with most screen reading software used by the visually impaired, I think the legal requirements should be obvious.
- TeMPOraL 8y agoTwo notes, though I doubt anyone working on government pages will actually read them: 1) PDF -> HTML improves accessibility. HTML -> content rendered by JS via an SPA framework is worse than PDF, and approaches Flash. Please don't do that. 2) Think of the robots :). One of the problem of government data is that while you can usually find the scanned PDF or an XLS file with the data you're looking for, it's completely useless for automated processing. Making public data easier for machines to read enables citizens to build interesting tools on top of them.
- walrus01 8y agoNon-technical / ignorant people are also highly likely to put blobs of text content into PDFs as raster images, which pretty much makes them impossible to search/index or deal with for visually impaired persons' software assistance tools. I have seen too many government PDFs that would be impossible to understand if I were visually impaired.
- KyeRussell 8y agoI'd usually be right beside anyone wanting to begin JavaScript bashing but it feels like you are conflating two issues. Whilst the (for lack of a better term) JavaScript / SPA ecosystem encourages (especially to novices) people to do things in the Wrong Way, I wouldn't say that an SPA is inherently less accessible, and I definitely wouldn't say that it's less accessible than a PDF. I—like I'm sure the rest of HN—have experienced many a terrible SPA, but from my JavaScript dabbling it's becoming more and more apparent that it's due to bad developers more than anything else.
- j16sdiz 8y agoI will attribute this to the ignorant of management. The local government here mandated all website to have w3c AA grade accessibility. But all the management fellow it by the letter of standard. None of them provide us the time or resource to do accessibility testing. They explain away the accessibility issues raised by the concerned groups. So, yes plain html is better. They have a higher chance works without any prior testing
- modzu 8y agocan we remove captcha while we're at it? its the same sort of lazy bs flash is -- yes, it does serve a purpose, but at the expense of your users
- phyzome 8y agoThat's a very different issue. When malicious users were abusing our trial accounts at work, I tried to find alternative solutions that would slow them down, but the implementing team had already exhausted all the usual tricks and in the end I didn't really have anything to offer. And they went with ReCAPTCHA, since unfortunately that seems to be one of the better options at the moment. I think the best option might be something as CPU-hungry as a coin miner, maybe just burn through a bunch of hashes as a proof of work, but smartphones have such limited CPU that it's not clear to me you could reach a threshold that would be acceptable to phone users but not to the bots.
- pietroglyph 8y agoProof of work is an interesting angle… I think users might like it if it was an opt-in to avoid captchas. You could have a relatively viable product where users can either do tasks hard for computers a la ReCAPTCHA (and 3rd parties can put in tasks, like MTurk), or users can opt in to a mining script for a couple of minutes. Both can be monetized.
- phyzome 8y agoMy original thought was that the account creation page (or whatever needed to be gated) would do the mining and send the server a small amount of e.g. Monero. And alternatively, if you didn't want your device to actually mine the Monero, perhaps because you don't allow scripts, you could instead have your browser send that small amount directly from your own wallet. :-P ...but people have browser extensions to sniff out miners now, so a more generic proof of work is probably safer.
- thephyber 8y ago> yes, it does serve a purpose, but at the expense of your users That has always been the tradeoff of captcha. The other side of the equation is how relevant/useful is the data submitted? So long as the captcha isn't unreasonably difficult for a human, I would rather my government not spend resources to follow through with every single spammy form submission.
- classichasclass 8y agoThe adblocker suggestion is particularly interesting and I don't think is getting enough press. I would bet that a lot of smaller federal agencies wouldn't be as timely with IT updates as they should be. As it happens one of those malicious payloads could indeed be a Flash applet, so the overall push away from Flash should help, but there are many other ways in. Unfortunately I think it's local agencies that would need this extra layer of defense most, having seen how neighbouring municipalities maintain their systems (or don't).
- tomschlick 8y agoAnd really the blocker could be (and probably already is) implemented at the DNS level with something similar to PiHole's blacklist. I'm sure big switch/network gear manufacturers have something similar to block ad/tracking traffic.
- rbanffy 8y agoI'm a bit shocked someone needs to ask for this in 2018. All those Flash things must have been empty rectangles for the last decade or so.
- thephyber 8y agoIt's the difference between building a product to spec and building a product so it's usable by the actual demographic that needs to use it. US Digital Service talked about finding these Flash barriers and building quick webform replacements making a HUGE improvement in usability (like from ~5% completion to 90%+ completion IIRC). I wouldn't be surprised if those same government departments are stuck on WinXP SP2 with IE6-8 with Flash enabled. IT at huge orgs moves extremely slowly.
- rbanffy 8y ago> those same government departments are stuck on WinXP SP2 with IE6-8 with Flash enabled I'm not sure how their sysadmins can sleep at night with this ;-)
- peeters 8y agoLast decade or so? Chrome still supports Flash, you just need to enable it on a per-site basis. And it's been less than two years since they enabled it by default.
- jdietrich 8y agoBy the looks of it, many US government websites haven't had a significant technical update for at least a decade. Searching for '"best viewed * internet explorer" site:*.gov' turns up a depressingly large number of results, many of them for important-looking services rather than old static pages.
- Theodores 8y agoHow do you make Flash files in 2018? I don't see export as Flash in any of the programs I use, I am sure other programs have them though. Maybe the option needs to be purged from the toolchain as well as the browser.
- cwkoss 8y agoI knew this must be Wyden. I'm a fan, he seems like one of the only members of Congress with a strong understanding of technology.
- chris_wot 8y agoI was amazed that there is actually a Senator who actually understands technology...
- mceoin 8y agoRon Wyden again. He's making a habit of this. Anyone know who Wyden's tech-focused staffer is?
- perl4ever 8y agoThe article conspicuously doesn't mention his party.
- some_random 8y agoDoes his party matter? For reasons other than knowing if he's on my team or not?
- mcguire 8y agoThey always mention the party.
- perl4ever 8y agoWho does?
- dekhn 8y agoNearly all journalism in the US states the party affiliation in the headline or close to the first mention of the name of the politician: Title: "Jason Spencer, Georgia Lawmaker Duped by Sacha Baron Cohen, to Resign" Article lede graf: "Jason Spencer, the Georgia Republican lawmaker who was fooled into repeatedly yelling a racial epithet on the comedian Sacha Baron Cohen’s television series, intends to resign effective July 31." Title: "Lessons From a Failed Nomination, for Both Brett Kavanaugh and the Senate" "WASHINGTON — The doors to the Republican cloakroom off the Senate floor swung open and out walked Senator Ron Wyden, an Oregon Democrat who is not usually found in the inner sanctum of the majority party." It's a big part of the narrative.
- perl4ever 8y agoOk, but how is that a response to noting this article doesn't mention the party? The fact that party is commonly mentioned tends to amplify the significance of withholding it in selected cases like this. Right?
- newman8r 8y agoWhile they're at it, they should request that all government websites with news feeds provide it in RSS format. A lot of agencies do this, I have a list of almost 100 US government feeds - but it's unfortunately absent from some agencies. They really shouldn't make people to go to twitter or facebook to follow their press releases...
- paulie_a 8y agoFlash and ie6 need to be completely left unsupported. I'd go so far as Adobe and Microsoft should put a Killswitch that removes them or simply makes them unusable.
- ionised 8y agoAs an outside observer of the US, Ron Wyden seems to be one of the few that tries to stay informed and isn't totally self-interested. He seems like someone I would vote for.