6 ms·

Still Have a Use for Adobe Flash? Ruffle Is Working to Safely Emulate It in Rust

109 points by mikece 4y ago

justinclift 4y ago
Came across this a few weeks ago, as a friend who likes to play old flash games was trying to get it working. While it has a long way to go, it does seem to have better traction than the prior efforts + it seems to be funded by several of the larger online (flash) game hosting places that have a need for it. So, kind of expecting this will actually work to support most flash stuff over time. Securely this time around. Guess then we'll be able to brush the dust off the old Flash creation tools? :)
UnpossibleJim 4y ago
It's almost sad to admit these days but Flash started me down my path with Actionscript. It was the first language I thought I could really use and threw myself into, creating small games for the web (at the time). It was a blast!
- tacker2000 4y ago
  Same here. I remember the first time actually grasping objects and class members: circle.x = 50;
adrian17 4y ago
Some extra notes: > project issued their first progress report with getting dozens of ActionScript 2 based games working Dozens of _previously-broken_ games working. We had a majority of (single-player) AS2 games working for years now, with only several major missing features plaguing the remaining games. The biggest one of them (a very unintuitive way variables magically bind to "DOM" objects) was implemented very recently, hence the announcement. As for AS3, you could say the interpreter support has finally reached the turning point. It took 2 years from the first AS3-related commit to the first simplest game to "kinda-sorta work", and within the next couple of months up to now, so many games started to work that we stopped being able to count them. So yeah, we're very optimistic here :) EDIT: oh, also major shoutout to https://github.com/jindrapetrik/jpexs-decompiler https://github.com/jindrapetrik/jpexs-decompiler which is effectively a full-blown low-level IDE for decompiling, debugging, analysing and manipulating (or even hand-crafting from scratch) SWFs. Without actually seeing all the ways the games abused Flash interpreter, it'd be borderline impossible to figure out Flash Player's various quirks. Further, it lets contributors create test SWFs without having to own old versions of Flash IDE.
- orra 4y ago
  > As for AS3, you could say the interpreter support has finally reached the turning point That's very exciting! Ruffle obviously isn't the first open source project to attempt a Flash player: there's Gnash, swfdec, Lightspark, and Shumway. All of these other projects were useful, but reached a local maxima, or stagnated, due to the sheer size of the task.
- musicale 4y ago
  I hope this moves us closer to a highly compatible memory-safe and freely available Flash implementation. It seems that so much creative output was lost in the Flash apocalypse. Flash/.swf (like HyperCard and some other cool-but-dead tech) seemed to hit a sweet spot that enabled many people to do cool things and share them, and I don't think anything (such as Roblox, Godot, etc. mentioned below) has adequately replaced it.
FpUser 4y ago
>"Due to the memory safety guarantees of Rust, they believe this is a secure implementation of Flash." Since the intended deployment is browser / wasm the security is already taken care of.
- teach 4y ago
  > "Ruffle runs natively on all modern operating systems as a standalone application" Ruffle isn't limited to running inside a browser, so the security is warranted.
  - jmull 4y ago
    That's true, of course, but hardly the purpose of ruffle.
- illiarian 4y ago
  Until a memory overflow in the monstrous machine that is the web browser will be exploited in 5 seconds at the next Black Hat Conference.
  - jmull 4y ago
    In that case attackers can simply not use rust or ruffle to craft their malicious wasm.
    - illiarian 4y ago
      Who said anything about attackers using Rust? The original statement is that the browser is already secure not to care about secure implementation of Flash in Rust. Meanwhile WebGL in browsers (Flash is likely to implemented in WebGL): https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=webgl https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=webgl
  - FpUser 4y ago
    >"in the monstrous machine that is the web browser" Or in one of Rust's unsafe calls / but in the compiler / etc
moolcool 4y ago
I will defend Flash all day long, and I think it's death is a regression in technology that to this day has not been rectified. Of course it had it's problems (particularly around accessibility and security), but in 1998, it was possible for a teenager to write a decent quality Mario clone that could run on a Pentium II, from a web browser, at 60fps.
- stolenmerch 4y ago
  Not to mention with swf-to-exe tools like Zinc, I could create portable and lightweight desktop applications without fighting with compilers and build steps. 20 years ago I built a fairly sophisticated program to allow users to load, view, and manipulate 3D objects. Took me a week and I can still run it today. I supposed I could do the same now with JS libraries and Electron, but it's just not the same. We indeed lost something valuable.
  - bombcar 4y ago
    Hypercard died twice, once at Apple's hands, and again at Adobe's.
- ehutch79 4y ago
  It was also very possible to write a restaurants website that ran at 5fps on the fastest cpu at the time. and honestly that's why a lot of people wanted flash dead.
  - bombcar 4y ago
    People think of Flash and fondly remember HomestarRunner but that shit was EVERYWHERE for awhile, and not just in banner ads. Entire websites would be built in flash, and not well, either.
    - deleted 4y ago
      [deleted]
  - Marazan 4y ago
geenat 4y ago
Nothing has replaced Flash for low friction creative outlet for animations and games. Even artists could use Flash very effectively by themselves. The iteration time was mindblowing- Using Flash, I remember putting together Ludum Dare games in 6 hours, while everyone else was struggling at hour 48. The new generation of devs never knew the levels of productivity that could be had with Flash.
- mysterydip 4y ago
  I've heard this before, and I'm curious, not having developed in flash myself. What was it about the UI or flow that hasn't been replicated? Is there something about it that makes cloning it difficult or undesirable in the myriad of open source "make stuff fast" languages/front ends?
  - CharlesW 4y ago
    > I've heard this before, and I'm curious, not having developed in flash myself. FWIW, Flash (the authoring tool) became Adobe Animate¹ when Adobe started targeting the web. Because the authoring experience hasn't changed much in 20 years, you can watch Adobe Animate videos² to see how its timeline-based authoring worked. ¹ https://www.adobe.com/products/animate.html https://www.adobe.com/products/animate.html ² https://www.youtube.com/c/AdobeAnimate https://www.youtube.com/c/AdobeAnimate
    - hutzlibu 4y ago
      It is not at all the same. Animating and painting works pretty much like it used to, but everything else, especially the scripting, changed quite drastically. And the result is barely usable or not at all (when we are talking about interactive aka games and such). Up to the point, where it is not worth it for me. I gave it a try again a couple of weeks ago and I struggled to get basic functionality running. And I know flash by heart and even have outside experience with easelJS, the new framework in use.
    - geenat 4y ago
      Ugh they removed Actionscript 2. Really disappointing. AS3 is a velocity killer.
oliveshell 4y ago
My main exposure to Ruffle has been through its use on Homestarrunner.com, where it’s been deployed to maintain a working archive of their old cartoons (complete with interactive Easter eggs, which obviously isn’t possible on YouTube). It was buggy initially but now seems to work very well. I’m a big fan, and echo the sentiments of others here who remember Flash fondly as a powerful and singularly accessible creative tool. To anyone working on Ruffle: I value the work y’all are doing immensely!
liketochill 4y ago
Some industrial equipment requires flash or Java for the web based configuration UI. Even Ethernet switches It’s a huge pain to find the right version of browser, Java, flash, to be able to change a setting
jstarfish 4y ago
What ended up replacing Flash [for non-interactive animation]? I could never find a straight answer to this. ControlNet is presumably the future but if I wanted to get into computer animation in 2013, what tools existed?
- dpedu 4y ago
  These days, I'd say it's probably best to use video for non-interactive animations. Flash is from a time where network speeds were too slow and video compression was too poor, both in ratio and picture quality, to be feasible. But now, it's a better option also because you don't need a runtime nor need worry about browser compatibility of some javascript animation library.
- robertoandred 4y ago
  Adobe didn't dump Flash animation, they just renamed it to Animate.
- kangalioo 4y ago
  There's also https://lottiefiles.com/ https://lottiefiles.com/ > A Lottie is a JSON-based animation file format that allows you to ship animations on any platform as easily as shipping static assets. They are small files that work on any device and can scale up or down without pixelation. LottieFiles lets you create, edit, test, collaborate on and ship a Lottie in the easiest way possible.
agumonkey 4y ago
I have a feeling that recent SSR/hydration/signals in web dev are slowly rediscovering flash streamable everything in a new form.
- mock-possum 4y ago
  Flash dev work was my first exposure to signals
mastax 4y ago
I just got security camera that has a low quality stream (720p15) and a high quality stream (4k25 H.265). On its web portal it can show the low quality stream as HTML video, but for the high quality it requires Flash, for some reason. Did H.265 even exist before flash was deprecated? I'm pretty sure this camera company didn't exist when flash was deprecated. Maybe for the web portal it uses an MJPEG stream or something.
- mastax 4y ago
  I just tried it out and apparently the video player uses ActionScript 3. Oh well, I just use VLC anyway.
- zamadatix 4y ago
  Flash was announced for deprecation in 2017 and UHD Blu Rays were in consumer hands in 2016 (H.265 having first been published in 2013) so it checks out. Of course most everyone stayed away from HEVC because of the licensing, including both browsers and Flash. Even in 2023 support in browsers is iffy and convoluted. My wild guess is the original makers of the camera/encoding system assembled some sort of software decoding solution in Flash (since this was prior to WASM rollout/mass support) and the camera company might have just repackaged that solution in a later year.
lakomen 4y ago
Noo, let the dead rest.

109 points by mikece 4y ago

Came across this a few weeks ago, as a friend who likes to play old flash games was trying to get it working. While it has a long way to go, it does seem to have better traction than the prior efforts + it seems to be funded by several of the larger online (flash) game hosting places that have a need for it. So, kind of expecting this will actually work to support most flash stuff over time. Securely this time around. Guess then we'll be able to brush the dust off the old Flash creation tools? :)

UnpossibleJim 4y ago

It's almost sad to admit these days but Flash started me down my path with Actionscript. It was the first language I thought I could really use and threw myself into, creating small games for the web (at the time). It was a blast!

tacker2000 4y ago
Same here. I remember the first time actually grasping objects and class members: circle.x = 50;

adrian17 4y ago

Some extra notes: > project issued their first progress report with getting dozens of ActionScript 2 based games working Dozens of _previously-broken_ games working. We had a majority of (single-player) AS2 games working for years now, with only several major missing features plaguing the remaining games. The biggest one of them (a very unintuitive way variables magically bind to "DOM" objects) was implemented very recently, hence the announcement. As for AS3, you could say the interpreter support has finally reached the turning point. It took 2 years from the first AS3-related commit to the first simplest game to "kinda-sorta work", and within the next couple of months up to now, so many games started to work that we stopped being able to count them. So yeah, we're very optimistic here :) EDIT: oh, also major shoutout to https://github.com/jindrapetrik/jpexs-decompiler https://github.com/jindrapetrik/jpexs-decompiler which is effectively a full-blown low-level IDE for decompiling, debugging, analysing and manipulating (or even hand-crafting from scratch) SWFs. Without actually seeing all the ways the games abused Flash interpreter, it'd be borderline impossible to figure out Flash Player's various quirks. Further, it lets contributors create test SWFs without having to own old versions of Flash IDE.

orra 4y ago
> As for AS3, you could say the interpreter support has finally reached the turning point That's very exciting! Ruffle obviously isn't the first open source project to attempt a Flash player: there's Gnash, swfdec, Lightspark, and Shumway. All of these other projects were useful, but reached a local maxima, or stagnated, due to the sheer size of the task.
musicale 4y ago
I hope this moves us closer to a highly compatible memory-safe and freely available Flash implementation. It seems that so much creative output was lost in the Flash apocalypse. Flash/.swf (like HyperCard and some other cool-but-dead tech) seemed to hit a sweet spot that enabled many people to do cool things and share them, and I don't think anything (such as Roblox, Godot, etc. mentioned below) has adequately replaced it.

FpUser 4y ago

>"Due to the memory safety guarantees of Rust, they believe this is a secure implementation of Flash." Since the intended deployment is browser / wasm the security is already taken care of.

teach 4y ago
> "Ruffle runs natively on all modern operating systems as a standalone application" Ruffle isn't limited to running inside a browser, so the security is warranted.
- jmull 4y ago
  That's true, of course, but hardly the purpose of ruffle.
illiarian 4y ago
Until a memory overflow in the monstrous machine that is the web browser will be exploited in 5 seconds at the next Black Hat Conference.
- jmull 4y ago
  In that case attackers can simply not use rust or ruffle to craft their malicious wasm.
  - illiarian 4y ago
    Who said anything about attackers using Rust? The original statement is that the browser is already secure not to care about secure implementation of Flash in Rust. Meanwhile WebGL in browsers (Flash is likely to implemented in WebGL): https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=webgl https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=webgl
- FpUser 4y ago
  >"in the monstrous machine that is the web browser" Or in one of Rust's unsafe calls / but in the compiler / etc

moolcool 4y ago

I will defend Flash all day long, and I think it's death is a regression in technology that to this day has not been rectified. Of course it had it's problems (particularly around accessibility and security), but in 1998, it was possible for a teenager to write a decent quality Mario clone that could run on a Pentium II, from a web browser, at 60fps.

stolenmerch 4y ago
Not to mention with swf-to-exe tools like Zinc, I could create portable and lightweight desktop applications without fighting with compilers and build steps. 20 years ago I built a fairly sophisticated program to allow users to load, view, and manipulate 3D objects. Took me a week and I can still run it today. I supposed I could do the same now with JS libraries and Electron, but it's just not the same. We indeed lost something valuable.
- bombcar 4y ago
  Hypercard died twice, once at Apple's hands, and again at Adobe's.
ehutch79 4y ago
It was also very possible to write a restaurants website that ran at 5fps on the fastest cpu at the time. and honestly that's why a lot of people wanted flash dead.
- bombcar 4y ago
  People think of Flash and fondly remember HomestarRunner but that shit was EVERYWHERE for awhile, and not just in banner ads. Entire websites would be built in flash, and not well, either.
  - deleted 4y ago
    [deleted]
- Marazan 4y ago

geenat 4y ago

Nothing has replaced Flash for low friction creative outlet for animations and games. Even artists could use Flash very effectively by themselves. The iteration time was mindblowing- Using Flash, I remember putting together Ludum Dare games in 6 hours, while everyone else was struggling at hour 48. The new generation of devs never knew the levels of productivity that could be had with Flash.

mysterydip 4y ago
I've heard this before, and I'm curious, not having developed in flash myself. What was it about the UI or flow that hasn't been replicated? Is there something about it that makes cloning it difficult or undesirable in the myriad of open source "make stuff fast" languages/front ends?
- CharlesW 4y ago
  > I've heard this before, and I'm curious, not having developed in flash myself. FWIW, Flash (the authoring tool) became Adobe Animate¹ when Adobe started targeting the web. Because the authoring experience hasn't changed much in 20 years, you can watch Adobe Animate videos² to see how its timeline-based authoring worked. ¹ https://www.adobe.com/products/animate.html https://www.adobe.com/products/animate.html ² https://www.youtube.com/c/AdobeAnimate https://www.youtube.com/c/AdobeAnimate
  - hutzlibu 4y ago
    It is not at all the same. Animating and painting works pretty much like it used to, but everything else, especially the scripting, changed quite drastically. And the result is barely usable or not at all (when we are talking about interactive aka games and such). Up to the point, where it is not worth it for me. I gave it a try again a couple of weeks ago and I struggled to get basic functionality running. And I know flash by heart and even have outside experience with easelJS, the new framework in use.
  - geenat 4y ago
    Ugh they removed Actionscript 2. Really disappointing. AS3 is a velocity killer.

oliveshell 4y ago

My main exposure to Ruffle has been through its use on Homestarrunner.com, where it’s been deployed to maintain a working archive of their old cartoons (complete with interactive Easter eggs, which obviously isn’t possible on YouTube). It was buggy initially but now seems to work very well. I’m a big fan, and echo the sentiments of others here who remember Flash fondly as a powerful and singularly accessible creative tool. To anyone working on Ruffle: I value the work y’all are doing immensely!

liketochill 4y ago

Some industrial equipment requires flash or Java for the web based configuration UI. Even Ethernet switches It’s a huge pain to find the right version of browser, Java, flash, to be able to change a setting

jstarfish 4y ago

What ended up replacing Flash [for non-interactive animation]? I could never find a straight answer to this. ControlNet is presumably the future but if I wanted to get into computer animation in 2013, what tools existed?

dpedu 4y ago
These days, I'd say it's probably best to use video for non-interactive animations. Flash is from a time where network speeds were too slow and video compression was too poor, both in ratio and picture quality, to be feasible. But now, it's a better option also because you don't need a runtime nor need worry about browser compatibility of some javascript animation library.
robertoandred 4y ago
Adobe didn't dump Flash animation, they just renamed it to Animate.
kangalioo 4y ago
There's also https://lottiefiles.com/ https://lottiefiles.com/ > A Lottie is a JSON-based animation file format that allows you to ship animations on any platform as easily as shipping static assets. They are small files that work on any device and can scale up or down without pixelation. LottieFiles lets you create, edit, test, collaborate on and ship a Lottie in the easiest way possible.

agumonkey 4y ago

I have a feeling that recent SSR/hydration/signals in web dev are slowly rediscovering flash streamable everything in a new form.

mock-possum 4y ago
Flash dev work was my first exposure to signals

mastax 4y ago

I just got security camera that has a low quality stream (720p15) and a high quality stream (4k25 H.265). On its web portal it can show the low quality stream as HTML video, but for the high quality it requires Flash, for some reason. Did H.265 even exist before flash was deprecated? I'm pretty sure this camera company didn't exist when flash was deprecated. Maybe for the web portal it uses an MJPEG stream or something.

mastax 4y ago
I just tried it out and apparently the video player uses ActionScript 3. Oh well, I just use VLC anyway.
zamadatix 4y ago
Flash was announced for deprecation in 2017 and UHD Blu Rays were in consumer hands in 2016 (H.265 having first been published in 2013) so it checks out. Of course most everyone stayed away from HEVC because of the licensing, including both browsers and Flash. Even in 2023 support in browsers is iffy and convoluted. My wild guess is the original makers of the camera/encoding system assembled some sort of software decoding solution in Flash (since this was prior to WASM rollout/mass support) and the camera company might have just repackaged that solution in a later year.

lakomen 4y ago

Noo, let the dead rest.