Chrome will begin pausing many Flash ads by default on September 1

It may be using both.

IIRC ZeroClipboard falls back to flash if you're not using a browser with the new clipboard APIs.

Because JavaScript doesn't give you the option of programmatically messing with the user's clipboard. The best you can do is present a selected string in a textbox for the user to press Ctrl+C

No need for a fallback in Chrome, and it'd be exempted under the tiny transport plugins exemption too.

Did you read their conclusions? Javascript is most certainly a method for fingerprinting, regardless of Flash presence.

"Browser developers should also consider what they can do to reduce fngerprintability, particularly at the JavaScript API level."

"We identified only three groups of browser with comparatively good resistance to fngerprinting: those that block JavaScript, those that use TorButton, and certain types of smartphone."

Not having Flash doesn't mean you're immune to fingerprinting. That said, it would be nice if Adobe prevented system font lists via Flash.

TBH if a Flash crash or any other user space application crash causes a system crash it's an issue with the OS. Steve Jobs at the time said that every time MacOS crashes it's more often than not Flash's fault, which wasn't really true and would only speak "wonders" of how well MacOS isolates user space applications...

On the security issues it's some what true because the nature of Flash, applications like these are almost impossible to sandbox properly unless you have an operating system that sandboxes everything by default.

Flash it self these days is pretty much code execution as a service it can do pretty much everything you want some browsers sandbox it better than others but it's still intended to pull code from the ether and run it and when you have a setup like that you will never be able to limit it effectively. Flash can be phased out only because it's mostly used to play various forms of media, but any other use of it cannot be converted to HTML5.

If Javascript (as it's parsed and executed in browsers) will ever get to the point of being as flexible and powerfull as Flash is today you'll see browser based RCE vulnerabilities skyrocket also, JS is safe to use only because the browsers restrict it, Flash and AIR are intended to support everything from an animated ad to a full desktop application.

Just look at Node.JS (and many NoSQL DB's that used JS) in it's early years almost every (non-DOM based) cross-site scripting vulnerability in a Node.JS application could result in remote code execution on the server, even today you can still easily cause it if you don't handle the code properly one stupid eval in your node code which was there for lazy debugging can lead to your box getting owned in minutes.

It also chews up resources like nobody's business. Note that Android has also scrapped Flash. I'm pretty sure that Steve Jobs can't be blamed for that. :-)

The other ad networks likely won't be using Flash anymore either, which makes blocking ads more difficult - and that is a good thing to ad networks in general. Thus I won't say it's Google against others, and while it may seem so in the short term, in the long term Google and other ad networks benefit from it (while the users suffer...?)

half-hearted attempts to optimize video playback ?

the Flash Player plugin can render hardware accelerated video since v10.2 (released early 2011).

http://blogs.adobe.com/flashplayer/2011/02/flash-player-10-2...

"For example, using Flash Player 10.2 with Stage Video hardware acceleration, we’ve tested a Mac Mini released two years ago and a low-powered GPU-enabled Windows netbook playing smooth full HD 1080p video using less than 8% of the CPU; more powerful computers use even less."

As I discovered while looking for targets of opportunity, the term of art is apparently "online video provider", or OVP (not "VPN" as I'd first written, thinking "video provider network".

"Tips for Choosing an Online Video Platform (OVP)" http://www.streamingmedia.com/Articles/Editorial/Featured-Ar...

Yes, there's collateral damage. I'll take it. If needs be, I'll hop into /etc/hosts and unblock for a moment.

Rooted Android works. You can swap the /etc/hosts file.

Plugins such as uBlock Origin should allow for adding hosts to blocklists.

If you can configure the DNS servers directly or via DHCP in the network settings of the device, then you can take control of how domains get resolved at that level.

In fact I've (unintentionally) bypassed site-blocking on some public networks, just because I configure my devices to use public DNS servers instead of whatever the DHCP provides.

I really don't.

More to the point: disabling the elements in CSS isn't sufficient to keep video/audio from playing INVISIBLY.

Killing the source is the only option.

Thank you!

> act slightly wonky when it doesn't.

I would hope so. Autoplay videos are fraught with discrimination: "live in a country where bandwidth is expensive? Fuck you, have an autoplay video."

I hope browsers move toward having autoplay as default "off" in the future.

Chromium bug:

"Disable video/audio autoplay" https://code.google.com/p/chromium/issues/detail?id=514102

Among the reasons I'm posting hosts is to show how concentrated OVPs are. A small number of entries wipes out nearly all instances. Plus it puts pressure on providers.

you might also be able to get around it by using separate firefox profiles for each of you.

I use flash blocker specifically for youtube, so that it doesn't start playing when I queue up a tab. When I get to the tab I enable flash for that player. Gonna be annoying when that doesn't work. Not that I don't want flash to disappear.

For Firefox users, YouTube is supposed to prefer HTML5 video if an H.264 platform decoder is available and then fall back to Flash. YouTube should be serving HTML5 video to OS X, Windows Vista+ (except for some variants without codecs like Windows Server 2008), and Linux (if ffmpeg is available).

Chrome beta, Windows 8.1. But I tried it again now and it seems to be working without Flash. No idea what was wrong then a month ago. Ah well ¯\_(ツ)_/¯

For Chrome: https://chrome.google.com/webstore/detail/disable-html5-auto...

For Firefox, I think you can just set media.autoplay.enabled = false in about:config.

I've had WebGL crashes quite often on YouTube. Allot of the WebGL demos are also either forcing a WebGL crash from time to time or just hang browsers due to performance. You can say allot about Flash but atm it's performance and stability are better than WebGL in it's current state.

The problem with WebGL is that it pretty much inherited the mess of OpenGL every driver version on every GPU can implement different feature set of it (similar to the extension mess of OpenGL in Nvidia and ATI minidrivers at the time) which results in Browsers having to maintain blacklist/whitelists[1] for a very large array of hardware and software combinations (Chrome currently isn't maintaining a driver version based list other than a cut off date for certain drivers which also causes problems if you are running old hardware and the best drivers for it are considered out of date by Google).

WebGL it self is also not implemented in the same manner across different browsers Chrome and FF for example have quite a different blacklist/whitelist for WebGL, I don't know if this because of different in browser implementation or because of they are simply encountering different issues and adjusting accordingly.

The worse thing I've encountered so far is WebGL on switchable graphics (e.g. Nvidia Optimus) enabled laptops, some features might switch the GPU arbitrarily even mid execution which causes the whole thing to implode..

[1]https://chromium.googlesource.com/chromium/src/gpu/+/master/...

Whats worse is that WebGL can actually crash your graphics driver and if it's bad enough than Windows can't recover the kernel mode driver it's a complete kernel panic. This doesn't happen often but if you want to do it you can do it sadly too easily, Chrome/FF chase known DOS cases with WebCL quite well but they really don't catch all of them and if that feature isn't blacklisted for your setup well you can crash a machine with a single pixel draw ;)

And the introduction of WebCL would probably lead to some of the nastiest RCE vulnerabilities you can imagine soon enough you are allowing people to execute general purpose code directly on the metal and interact with Kernel mode components. There are already GPU rootkits out there soon enough they'll find an infection vector trough WebGL or WebCL and it will be a very unpleasant period.

My home computer has been fine, but my work computer has a bunch of browser-crashing problems. I've raised bug reports, but unfortunately that means coordinating a bug report between between the website, the browser, the graphics drivers, and the graphics card manufacturer.

Unfortunately the abstraction layers aren't yet good enough that something stable on nvidia will be stable on ati :)

That's just means that it works with your video card(s), but it can still crash with other/older cards. For example on the ShaderToy website ( https://www.shadertoy.com/browse ) I can always easily find examples that crashes WebGL in Chrome (and it's just slower or hangs in Firefox). Right on that first page there are shaders that makes WebGL crash on two different computers (one with an older NVIDIA card and one with just integrated so not the fastest ones). But it crashes only the WebGL part not the whole browser, so that's not so bad. Also it could be because Chrome sees WebGL code is running slow (due to slower cards and the complex shaders) and decides it's better to kill it, just like when there is an infinite loop in Flash or JavaScript the browsers shows a dialog to stop the code.

Is the conversion tool actually open source? The Swiffy Wikipedia page says "There is a server-side component (source currently not public) that converts SWF to an intermediate representation serialized as JSON.".

There are planty sites which dont work without JS. Guess what I do when I see an empty page..

Yeah, but it's just an arms race at this point. If I can decrypt the content by performing X, I can make by browser either simulate X or report to your servers that I did X.

See previous reply. You get both.

Extensions are specific to profiles. Rather than toggle a bunch of extensions on and off, just switch profiles.

> It is rather ironic half of their sites are going to break, unless they conveniently add an exception.

Those sites aren't going to break, even without adding any exceptions. There's no definition of "essential" that would exclude Flash content on Google Finance. As mentioned above, the exact heuristics they're using are:

"TLDR, essential content is either: 1) On the same domain as the page 2) Considered "Large" (at least 298 x 398, certain aspect ratio, minimum total area), with an exception for tiny content (likely transport plugins)."

Thanks for this. I'm not sure why they wouldn't use a fallback mechanism instead of making this an explicit setting?

Edit: This is strange. I went to change the setting and it is greyed out and cannot be changed. This is in both chrome AND firefox. Both are up to date with most recent version, and my macbook was bought this year. Neither have adblockers enabled.

You're supposed to use an <iframe> to embed these days, but some sites still use the flash-only <object>/<embed>.

Check out the Flashcontrol extension on Chrome. It does a good job of giving you control on this.

WHy not just use the click-to-play option in Chrome?

No, we wouldn’t scream for a plugin making that possible, but we’d scream for a web standard.

We already have a way to transmit two-way video live in browsers (WebRTC).

It should be not to hard to use the codecs existing for that to make a one-way live streaming in browsers.