6 ms·

Let's say that we can get every major site to stop using Flash going forward, and that we can paper over it with HTML5 and polyfills. Great. What do we do abou

by cwyers 11y ago

Let's say that we can get every major site to stop using Flash going forward, and that we can paper over it with HTML5 and polyfills. Great. What do we do about the historic content that will never, ever be ported to anything other than Flash? Every thing on Kongregate? Newgrounds? Homestarrunner.com? Desktop Tower Defense? We're talking about taking a decade's worth of interactive web content and declaring it no longer relevant. Without a plan for preserving that material and continuing to make it accessible, I think that killing off Flash rather than deprecating it is a terrible idea.

ende 11y ago
We don't go to those sites anymore.
Silhouette 11y ago
As an aside, we shouldn't even accept your first assumption there, because it's demonstrably not true. There are all kinds of thing that tools like Flash (and Java, and Silverlight, and even ActiveX controls) have previously been useful for that HTML5 and JS can't yet replace. But your main point is a very good one. There are way too many people in the industry right now complaining about those older technologies who think that the world somehow magically owes them updates to 10-20 years of past work, just because their bleeding edge browser-native tools have finally reached the point in the very recent past when they can do some of the same work to a useful degree. There are also way too many people moaning about how these plug-ins are such horrendous security problems while ignoring the facts that (a) every major browser also has a less than stellar track record on security issues, with Firefox and Chrome patching numerous vulnerabilities in updates every few weeks, and (b) moving the more advanced, and often hardware-accelerated, functionality from plug-ins to native browser capabilities isn't really reducing the area of the attack surface, it's just reshaping it. Given these facts, there is little reason to assume that browsers will inherently be more secure just because plug-ins were forced out in favour of native technologies. As others have been pointing out today, the reverse might actually be true, because at least the plug-ins have a degree of isolation and click-to-play safeguards are now widespread, while the trend with browsers (again, particularly Firefox and Chrome) is to remove obvious settings that would allow users to turn off certain functions.
- pyre 11y ago
  Don't most of the Chrome vulnerabilities used in pwn2own end up being Java or Flash vulnerabilities?
  - dangerlibrary 11y ago
    Things that do more have a larger attack surface.
    - pyre 11y ago
      Exactly. This is why the argument of "well, you can't complain about Flash/Java exploits because the browser itself also has exploits too" is not valid. By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole.
      - Silhouette 11y ago
        By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole. By adding HTML5 video and now its DRM-related infrastructure, WebGL, and other features that developers used to use Flash/Java for, you are also increasing the attack surface of the browser "package" as a whole. The comparison is a perfectly reasonable one.
        pyre 11y ago
        On the other hand, those will be separate implementations on different browsers, so it reduces the applicability of any one exploit. An exploit in Flash or Java becomes cross-browser.
        Silhouette 11y ago
        On the other hand, those will be separate implementations on different browsers Unless more than one browser uses, say, the same video codecs, or the same third-party DRM-related module, or the same system services for doing hardware-accelerated 3D rendering. There may be some marginal advantage to having different implementations in different browsers, but marginal is probably all it is. Realistically, as things we used to do in the likes of Flash or Java move into browser-native implementations, there is still no reason to assume that the people writing those implementations will magically produce completely secure implementations where no-one ever has before.
ehPReth 11y ago
From what I understand Shumway (https://github.com/mozilla/shumway https://github.com/mozilla/shumway) is being developed for exactly that reason
- jamescostian 11y ago
  And Google is also doing the same with Swiffy (https://developers.google.com/swiffy/ https://developers.google.com/swiffy/)
andrewmcwatters 11y ago
I get really tired of the industry's widespread bandwagoning on this issue in particular. This bandwagoning dismisses more collective works and industries than any technology in the past just for the sake of promoting bleeding edge, evergreen tech. What about the game industry? What about the animation industry? HTML5 doesn't replace Flash for those arenas. It's blatant ignorance for individuals to even come out and claim Adobe should set and end of life date for the product. Sure Flash has had some issues, and they came at the expense of FutureWave Software, Macromedia, and Adobe moving faster than anyone in the web industry at the time, with different goals, that just happen to now be of interest to web developers at large. The reality is that web tech has just eaten into and provided standardized variants of features that Flash/Shockwave has had for over TWO decades. Yeah, real progressive of the web community. _Slow clap._
- jamescostian 11y ago
  > What about the game industry? What about the animation industry? HTML5 doesn't replace Flash for those arenas In the gaming arena, you can look at http://html5games.com/ http://html5games.com/ or http://www.kongregate.com/html5-games http://www.kongregate.com/html5-games or http://www.html5games.net/ http://www.html5games.net/ or even just Google "HTML5 Games". Based on all of those HTML5 games it's clear that HTML5 can replace Flash in the gaming arena. There's only 1 place where HTML5 games and Flash games are really that different - on mobile devices (Flash doesn't work well if at all, HTML5 works like a charm). As for animations, doing some simple Googling will bring up results that also show HTML5 can replace Flash: https://www.freshdesignweb.com/examples-html5-animation/ https://www.freshdesignweb.com/examples-html5-animation/
  - hellofunk 11y ago
    I definitely wouldn't say that HTML5 "works like a charm" on mobile devices. I did a simple frame rate counter for a basic Canvas scene; the Chrome iOS browser was only 25% the frame rate of Chrome on a 4-year-old laptop. But I see your point and expect HTML5 to improve, but it is along way from being what a lot people think it is.
potatolicious 11y ago
> "Without a plan for preserving that material and continuing to make it accessible, I think that killing off Flash rather than deprecating it is a terrible idea." I'll miss some of the content to be sure, but ultimately the security of hundreds of millions of users trumps nostalgia and old Flash games from the 90s. If there's a good way to preserve the content in some way, I'm all for it, but justifying the continued use of Flash purely on the grounds of historical content is IMO pretty weak. Side note: a lot of the old Flash animations have been "ported" to YouTube, the non-interactive stuff at least. Heck, the YouTube versions show up before the real Flash versions sometimes...
- deleted 11y ago
  [deleted]
- tothepixel 11y ago
  Flash was the major source of online rich-media games up until a couple of years ago, not "the 90's". It's still used in that arena because HTML/CSS/JS is not as good of a platform for interactive gaming.
  - potatolicious 11y ago
    I'd argue that Flash as a gaming platform has been fairly marginal for quite some time, and that most of what people would want to preserve existed somewhere between the late 90s to the mid-00s - but that's purely a subjective argument and we can argue about that till the cows come home and never agree. Ultimately it comes down to this: keeping a notoriously insecure runtime around in active use, by hundreds of millions of people, is a non-starter. Unlike, say, Java applets, the frequency and severity of security holes found in Flash is just ridiculous. After years of allegedly focusing on cleaning up Flash, serious exploits are still being discovered regularly. The strongest argument in favor of keeping Flash around is IMO the fact that there is important functionality provided by Flash that has not been effectively (or at all) replicated by HTML. The weakest argument is IMO any centered around historical preservation. Personally, even considering the strongest argument, keeping an insecure runtime running on hundreds of millions of machines vs. better in-browser games... The choice seems pretty clear.
melling 11y ago
Much of the content will disappear. Wasn't that one of the arguments against using Flash in the first place? People used it anyway. Now it's time for the emotional blackmail? If Apple kills iOS in a decade what happens to all those apps? They're not sentimental.
- cwyers 11y ago
  Well, no, they're not sentimental. But I am. And that's a hell of an incentive to not use iOS if you ask me. At least with Android I know that I'll be able to still run those versions in an emulator if I want to. This isn't about emotional blackmail. And heck, I'm not the person who made any of those things. I'm just the person who remembers them fondly and still wants to have them around. The difficulty of preserving digital works is bad enough without callous disregard for the task.
  - melling 11y ago
    In hundreds of years, let alone thousands of years, the Flash content isn't going to matter. Neither will those iOS and Android apps. Flash has been dying for 5 years. A quicker death will be better for everyone. If we wait another 5 years, the problem will just grow. Also, consider that the next couple billion people to come online will be mobile only. Why create content that they can't use?
    - cwyers 11y ago
      We still watch hundred-year-old movies and read thousand-year-old books. Because people have put in the effort to preserve those things for us. Meanwhile, you're arguing that we shouldn't expend any effort so that people can watch five-year-old Flash cartoons. In multiple posts, I've said deprecate it. No new Flash content. No reason to create more content that is encumbered by Flash's legacy status. (Although others here have pointed out that HTML5 is not quite as capable of replacing Flash as some think.) But why the huge rush to completely abolish the Flash content that already exists?
      - 11y ago
Shish2k 11y ago
> What do we do about the historic content that will never, ever be ported to anything other than Flash? Stick it in our history books as an example of what happens when you tie yourself to a proprietary platform?
- hellofunk 11y ago
  True. And in fact even Steve Jobs said a decade or two ago that the digital videos people were making at the time would never run on any computer in the future. And I do have a bundle of digital media from the mid-90s that I can't open in anything.
Zikes 11y ago
You're right, it's no longer relevant. Just like Commodore 64, Apple IIe, the original PlayStation, NES, XBox, and a slew of other platforms made obsolete by something called "progress".
denom 11y ago
Look at the various computer museums and organizations that deal in archiving old technology. They have been dealing with this problem for years. It could be as simple as mirroring the website or service and firing up a virtual machine with windows 2000 and Adobe Flash installed. Thats easy compared to dealing with old magnetic media like floppies and reels. It's time for flash to die.
macspoofing 11y ago
https://github.com/mozilla/shumway https://github.com/mozilla/shumway
moistgorilla 11y ago
With webassembly maybe a compile target for flash could be created?
wcummings 11y ago
>Newgrounds? Homestarrunner.com? Desktop Tower Defense? I'm pretty comfortable calling these things irrelevant.
leni536 11y ago
Run them in a VM, just like old C64 or DOS games.
jcranmer 11y ago
And what about all the games from 15-20 years ago, or all the "explanatory" pages (e.g., visualizing different types of balanced binary search trees) that used Java applets? This has been done before, and not that long ago. And just like with DOS or NES games, people will build emulators that work well enough and that will suffice for enjoying historical content. Actually, the really annoying stuff isn't Flash, it's Shockwave. The format's not been reverse-engineered, and it's hard-to-impossible to find a working plugin for it that seems to play some of those old Shockwave games.
ytdht 11y ago
that is a very important issue that is very common with everything software related.... hopefully someone will keep porting them to newer technologies.. but more then likely lots of stuff will be lost forever... even backups can suffer from this in the long run, but maybe the physical media would become defective first..
asadotzler 11y ago
Shumway, a Flash player in JavaScript, will be a safer and smarter option.

by cwyers 11y ago

ende 11y ago

We don't go to those sites anymore.

Silhouette 11y ago

As an aside, we shouldn't even accept your first assumption there, because it's demonstrably not true. There are all kinds of thing that tools like Flash (and Java, and Silverlight, and even ActiveX controls) have previously been useful for that HTML5 and JS can't yet replace. But your main point is a very good one. There are way too many people in the industry right now complaining about those older technologies who think that the world somehow magically owes them updates to 10-20 years of past work, just because their bleeding edge browser-native tools have finally reached the point in the very recent past when they can do some of the same work to a useful degree. There are also way too many people moaning about how these plug-ins are such horrendous security problems while ignoring the facts that (a) every major browser also has a less than stellar track record on security issues, with Firefox and Chrome patching numerous vulnerabilities in updates every few weeks, and (b) moving the more advanced, and often hardware-accelerated, functionality from plug-ins to native browser capabilities isn't really reducing the area of the attack surface, it's just reshaping it. Given these facts, there is little reason to assume that browsers will inherently be more secure just because plug-ins were forced out in favour of native technologies. As others have been pointing out today, the reverse might actually be true, because at least the plug-ins have a degree of isolation and click-to-play safeguards are now widespread, while the trend with browsers (again, particularly Firefox and Chrome) is to remove obvious settings that would allow users to turn off certain functions.

pyre 11y ago
Don't most of the Chrome vulnerabilities used in pwn2own end up being Java or Flash vulnerabilities?
- dangerlibrary 11y ago
  Things that do more have a larger attack surface.
  - pyre 11y ago
    Exactly. This is why the argument of "well, you can't complain about Flash/Java exploits because the browser itself also has exploits too" is not valid. By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole.
    - Silhouette 11y ago
      By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole. By adding HTML5 video and now its DRM-related infrastructure, WebGL, and other features that developers used to use Flash/Java for, you are also increasing the attack surface of the browser "package" as a whole. The comparison is a perfectly reasonable one.
      - pyre 11y ago
        On the other hand, those will be separate implementations on different browsers, so it reduces the applicability of any one exploit. An exploit in Flash or Java becomes cross-browser.
        Silhouette 11y ago
        On the other hand, those will be separate implementations on different browsers Unless more than one browser uses, say, the same video codecs, or the same third-party DRM-related module, or the same system services for doing hardware-accelerated 3D rendering. There may be some marginal advantage to having different implementations in different browsers, but marginal is probably all it is. Realistically, as things we used to do in the likes of Flash or Java move into browser-native implementations, there is still no reason to assume that the people writing those implementations will magically produce completely secure implementations where no-one ever has before.

ehPReth 11y ago

From what I understand Shumway (https://github.com/mozilla/shumway https://github.com/mozilla/shumway) is being developed for exactly that reason

jamescostian 11y ago
And Google is also doing the same with Swiffy (https://developers.google.com/swiffy/ https://developers.google.com/swiffy/)

andrewmcwatters 11y ago

I get really tired of the industry's widespread bandwagoning on this issue in particular. This bandwagoning dismisses more collective works and industries than any technology in the past just for the sake of promoting bleeding edge, evergreen tech. What about the game industry? What about the animation industry? HTML5 doesn't replace Flash for those arenas. It's blatant ignorance for individuals to even come out and claim Adobe should set and end of life date for the product. Sure Flash has had some issues, and they came at the expense of FutureWave Software, Macromedia, and Adobe moving faster than anyone in the web industry at the time, with different goals, that just happen to now be of interest to web developers at large. The reality is that web tech has just eaten into and provided standardized variants of features that Flash/Shockwave has had for over TWO decades. Yeah, real progressive of the web community. _Slow clap._

jamescostian 11y ago
> What about the game industry? What about the animation industry? HTML5 doesn't replace Flash for those arenas In the gaming arena, you can look at http://html5games.com/ http://html5games.com/ or http://www.kongregate.com/html5-games http://www.kongregate.com/html5-games or http://www.html5games.net/ http://www.html5games.net/ or even just Google "HTML5 Games". Based on all of those HTML5 games it's clear that HTML5 can replace Flash in the gaming arena. There's only 1 place where HTML5 games and Flash games are really that different - on mobile devices (Flash doesn't work well if at all, HTML5 works like a charm). As for animations, doing some simple Googling will bring up results that also show HTML5 can replace Flash: https://www.freshdesignweb.com/examples-html5-animation/ https://www.freshdesignweb.com/examples-html5-animation/
- hellofunk 11y ago
  I definitely wouldn't say that HTML5 "works like a charm" on mobile devices. I did a simple frame rate counter for a basic Canvas scene; the Chrome iOS browser was only 25% the frame rate of Chrome on a 4-year-old laptop. But I see your point and expect HTML5 to improve, but it is along way from being what a lot people think it is.

potatolicious 11y ago

> "Without a plan for preserving that material and continuing to make it accessible, I think that killing off Flash rather than deprecating it is a terrible idea." I'll miss some of the content to be sure, but ultimately the security of hundreds of millions of users trumps nostalgia and old Flash games from the 90s. If there's a good way to preserve the content in some way, I'm all for it, but justifying the continued use of Flash purely on the grounds of historical content is IMO pretty weak. Side note: a lot of the old Flash animations have been "ported" to YouTube, the non-interactive stuff at least. Heck, the YouTube versions show up before the real Flash versions sometimes...

deleted 11y ago
[deleted]
tothepixel 11y ago
Flash was the major source of online rich-media games up until a couple of years ago, not "the 90's". It's still used in that arena because HTML/CSS/JS is not as good of a platform for interactive gaming.
- potatolicious 11y ago
  I'd argue that Flash as a gaming platform has been fairly marginal for quite some time, and that most of what people would want to preserve existed somewhere between the late 90s to the mid-00s - but that's purely a subjective argument and we can argue about that till the cows come home and never agree. Ultimately it comes down to this: keeping a notoriously insecure runtime around in active use, by hundreds of millions of people, is a non-starter. Unlike, say, Java applets, the frequency and severity of security holes found in Flash is just ridiculous. After years of allegedly focusing on cleaning up Flash, serious exploits are still being discovered regularly. The strongest argument in favor of keeping Flash around is IMO the fact that there is important functionality provided by Flash that has not been effectively (or at all) replicated by HTML. The weakest argument is IMO any centered around historical preservation. Personally, even considering the strongest argument, keeping an insecure runtime running on hundreds of millions of machines vs. better in-browser games... The choice seems pretty clear.

melling 11y ago

Much of the content will disappear. Wasn't that one of the arguments against using Flash in the first place? People used it anyway. Now it's time for the emotional blackmail? If Apple kills iOS in a decade what happens to all those apps? They're not sentimental.

cwyers 11y ago
Well, no, they're not sentimental. But I am. And that's a hell of an incentive to not use iOS if you ask me. At least with Android I know that I'll be able to still run those versions in an emulator if I want to. This isn't about emotional blackmail. And heck, I'm not the person who made any of those things. I'm just the person who remembers them fondly and still wants to have them around. The difficulty of preserving digital works is bad enough without callous disregard for the task.
- melling 11y ago
  In hundreds of years, let alone thousands of years, the Flash content isn't going to matter. Neither will those iOS and Android apps. Flash has been dying for 5 years. A quicker death will be better for everyone. If we wait another 5 years, the problem will just grow. Also, consider that the next couple billion people to come online will be mobile only. Why create content that they can't use?
  - cwyers 11y ago
    We still watch hundred-year-old movies and read thousand-year-old books. Because people have put in the effort to preserve those things for us. Meanwhile, you're arguing that we shouldn't expend any effort so that people can watch five-year-old Flash cartoons. In multiple posts, I've said deprecate it. No new Flash content. No reason to create more content that is encumbered by Flash's legacy status. (Although others here have pointed out that HTML5 is not quite as capable of replacing Flash as some think.) But why the huge rush to completely abolish the Flash content that already exists?
    - 11y ago

Shish2k 11y ago

> What do we do about the historic content that will never, ever be ported to anything other than Flash? Stick it in our history books as an example of what happens when you tie yourself to a proprietary platform?

hellofunk 11y ago
True. And in fact even Steve Jobs said a decade or two ago that the digital videos people were making at the time would never run on any computer in the future. And I do have a bundle of digital media from the mid-90s that I can't open in anything.

Zikes 11y ago

You're right, it's no longer relevant. Just like Commodore 64, Apple IIe, the original PlayStation, NES, XBox, and a slew of other platforms made obsolete by something called "progress".

denom 11y ago

Look at the various computer museums and organizations that deal in archiving old technology. They have been dealing with this problem for years. It could be as simple as mirroring the website or service and firing up a virtual machine with windows 2000 and Adobe Flash installed. Thats easy compared to dealing with old magnetic media like floppies and reels. It's time for flash to die.

macspoofing 11y ago

https://github.com/mozilla/shumway https://github.com/mozilla/shumway

moistgorilla 11y ago

With webassembly maybe a compile target for flash could be created?

wcummings 11y ago

>Newgrounds? Homestarrunner.com? Desktop Tower Defense? I'm pretty comfortable calling these things irrelevant.

leni536 11y ago

Run them in a VM, just like old C64 or DOS games.

jcranmer 11y ago

And what about all the games from 15-20 years ago, or all the "explanatory" pages (e.g., visualizing different types of balanced binary search trees) that used Java applets? This has been done before, and not that long ago. And just like with DOS or NES games, people will build emulators that work well enough and that will suffice for enjoying historical content. Actually, the really annoying stuff isn't Flash, it's Shockwave. The format's not been reverse-engineered, and it's hard-to-impossible to find a working plugin for it that seems to play some of those old Shockwave games.

ytdht 11y ago

that is a very important issue that is very common with everything software related.... hopefully someone will keep porting them to newer technologies.. but more then likely lots of stuff will be lost forever... even backups can suffer from this in the long run, but maybe the physical media would become defective first..

asadotzler 11y ago

Shumway, a Flash player in JavaScript, will be a safer and smarter option.