Flash and Chrome | Hacker News Reader

Flash and Chrome

chrome.googleblog.com

284 pointsrayshan174 comments

Although Flash's heyday is long gone, let's not forget how much Flash brought to the table back in the late 90's and early 2000's: animation, sound, games, and scaleable vector graphics and more. Macromedia's purchase of FutureSplash and subsequent release of the ubiquitous Flash player was a game changer for the web. Being able to download and play real games and experience interactive websites over slow dial-up connections was amazing and changed people's perspectives of the web.

The FLV format also finally made streaming video a seamless experience for the end user; leading to the creation of Youtube and other streaming video services.

Like all technologies, Flash was overused in places (pre-loaders, rotating 3d logos, banner ads) and Adobe's push towards Flex and RIA's took Flash away from of it's roots in animation for quite a few years. However, it will be interesting to see if the equivalent HTML5 stack follows a similar timeline-- minus the website pre-loaders...of course.

I'm happy to see Flash on its way out – I haven't even tried to install it the last few years. Native browser support tends to work and integrate much better on Linux than having to depend on a third party to deliver up-to-date software. The only site I visit that still seems to require Flash is the BBC, for video fragments.

There's some irony with Google blaming Flash for being spammy; I recently inspected what's probably the biggest shopping website in the EU because it slowed my computer to a crawl and noticed at least 30 to 40 outgoing connections, a lot of them to Google and its diverse ad, tracker and analytics properties.

Also if you want to stream BBC radio in browser it still insists on using Flash to do it. My concern is with the way Google tend to do things in Chrome (Aunty Google knows best, please do as I say) I might not even be able to continue to use flash for the very few sites I'd like to, or have to.

e.g. I tried to download an mp3 of a radio show from bbc.co.uk earlier today and "download blocked" with no option to override. I have all the protect me from myself settings firmly off. chrome help says it's Internet Settings. Internet settings says it's fine to download, and I've downloaded dozens of other mp3s flawlessly. mp3 actually downloads if you paste the button url in a new tab rather than click the button. I've had similar issues with other, innocent and harmless, files in the past. Well, since they brought in their cleverness and download "protections".

I forsee similar issues with flash as it goes through its deprecation.

If Chrome blocks a download, you can always go to chrome://downloads (or click the 'see all downloads' link) and unblock it manually there.

There's some irony with Google blaming Flash for being spammy

You're being a little kind; this is not so much irony as outright hypocrisy.

Apple did something similar with iOS, refusing to support the plugins arguing that they were insecure and so on, and then promptly using one of their own for HTML5 media elements that broke all kinds of functionality, as well as ignoring the related Web standards whenever it suited them, and then locking up their ecosystem so no-one else could offer an alternative browser that handled these issues better.

The problem with modern browser developers is that they seem to have decided their job isn't just to present the content of the Web but to try to influence and curate it on behalf of their user bases. Google gets extra demerits because it is also trying to do the same through its control of the dominant search engine. I don't think this amount of concentrated power is even remotely a healthy trend for the future of the Web.

Even FF is doing this with bad SSL Certs. I am 100% behind the idea of saying "We don't think you should go to this page because of $x", but at the end of the day, give me a way way to override it.

What does FF do that can't be overridden? We have a WAP management page that uses an insecure DH cipher; Chrome and Firefox both blocked us, but only about:config in FF had an override.

I can't find a site to test on, but I believe it's sslv3 sites that FF won't let me override. I could be mis-remembering, but it's something similar to that.

EMC just switched their terrible java front end for one of their products to a terrible flash front end. I laughed in the sales guy's face when he tried to tell me that switching to flash was this great advancement. They weren't doing anything you couldn't do in html 5.

> Today, more than 90% of Flash on the web loads behind the scenes to support things like page analytics. This kind of Flash slows you down, and starting this September, Chrome 53 will begin to block it.

Slightly off topic: I always found the term "block" to be a bit odd in the web browser context. The browser is the ultimate authority on what gets rendered and shown to the user; there's no need to block anything, because it can just not attempt to show it in the first place.

The term goes back at least as far as popup blockers. I wonder if it's because early popup blockers were browser plugins, rather than built in features, so they did have to actively intervene in the user experience.

I think it is very easy. Your browser BLOCKS the server from delivering something. I think the term "blocking" is perfect here. :)

The server is not going to deliver something unless the client requests it (or the client and server are using a protocol like HTTP/2 that can push content from the server).

I think your parent is pointing out that the browser is the one that initiates the fetching of all of this content in the first place. So, there's no need to "block the server from delivering something" as it can decide never to ask the server to deliver that something.

That's not what happens though. The server totally delivers the initial thing, the browser decides the thing is not important and doesn't do anything with the data it received and inspected. This may result in other things never being requested.

The term "ignoring" is more accurate.

"boycotts"? "strikes"? "No animation, no service!"?

Ignores? Filters?

You are absolutely correct. 'Block' is an easier term, or at least a more familiar term, for the layperson.

> This kind of Flash slows you down, and starting this September, Chrome 53 will begin to block it.

Ah, so it's for the user, not because other ad networks cannot rely on implicit whitelisting for their analytics callback channels because, aww shucks, the browser vendor just happens to run the ad network.

The UA might be the ultimate authority on what gets presented to the user and what doesn't, but, for better or for worse, the policy has been "draw everything" since forever. Given a change in policy that explicitly avoids drawing some specific things, it's fair to call it "blocking" those things.

The end of an era, to which all I can say is good riddance. Flash Player has been responsible for 892 published CVEs [1]. The world is safer without it.

[1] https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...

That's like saving good riddance to the internal combustion engine because we would be healthier without it, as if we've had better alternatives all along. If it weren't for Flash, we might all be complaining about Java applets right now.

> we've had better alternatives all along

We've had better alternatives on the desktop for over six years now, since Apple said "No Flash for iOS" in April 2010, when content creators panicked to capture that market and started conversion to HTML5 video. That already was a long time coming.

Chrome finally saying farewell to Flash in this manner forces the market to recognize that Flash is no longer an option even on the desktop.

As for my security argument: using the link above, if we start with vulnerabilities found in Flash Player after April 2010, that's still 830 of them.

Video alone isn't all of it though... there were a lot of games, and flash animation was also MUCH lighter than video streaming on bandwidth and cpu overhead.

Beyond that, one of the most significant areas of flash as a player is eLearning, training and simulations. Say what you will about a lot of the garbage in player, the authoring tools were some of the best available... though I haven't seen what Adobe has on deck today, it was a very nice experience with nothing comparable for at least until 2012 (last time I worked with flash/flex).

What my real hopes were when adobe bought Macromedia, was that they'd open up the format, and convert it to a packaged zip file with a manifest, svg and javascript proper as the language. Allowing for browsers to co-opt and internalize the players. Then adobe could continue to make great tooling and the browser vendors could correct the ship on the players. My dream is pretty close to what Silverlight offered, but that was something nobody was willing to look at for good enough reasons.

Have a look at FlexJS.

I've seen it, and it may work for quite a bit of that legacy content... there are also stand alone players/clones that I've seen a few of... I haven't had to work with or generate that kind of content for a while though, so no idea what the modern tooling equivalent is.

> Say what you will about a lot of the garbage in player, the authoring tools were some of the best available...

I emphatically agree. Back in 2004-2006 I was doing Macromedia Flash MX 2004 development (with the new-and-shiny ActionScript 2.0! Based on the forthcoming ECMAScript 4 standard that should be finalized any day now...). It was hands-down one of the best development environments I've used w.r.t. creating games and "rich Web applications". It really was the best thing available at the time: you could draw and animate your sprites, tiles, backgrounds, whatever within the same IDE in which you wrote your code. You could attach scripts to any object on- or off-stage, and they ran in an event loop. The documentation it shipped with was also excellent, and I picked up a hardcopy of the "ActionScript 2.0 Bible", a massive tome of beginner's tutorials, intermediate tips and tricks, and complete language and library reference -- for a measly $20.

Nowadays, Unity gives a similar yet more featureful environment for writing games, and Silverlight briefly presented an alternative for "rich content". As far as rich content goes: sure, we can do that stuff with HTML5 and JavaScript nowadays, but it was just so much more pleasurable to work with the Flash IDE than anything else I've seen, excepting maybe Silverlight. Where making a Web 2.0 application feels like an enormous pain in the ass, making the same in Flash was a joy. It was fun rather than frustrating!

I think if Adobe (or even Macromedia) had opened up the Flash format (SWF), and maybe even the plugins, things would've gone a lot differently. Flash could've been a law-abiding citizen of the "Open Web", and we could've seen some healthy competition amongst development and runtime environments. The community at large could've found ways to iterate and improve on the technology. But, I suppose that ship has sailed and we're stuck trying to jackhammer the round peg that is application delivery into the trapezoidal hole that is document delivery (i.e., the Web).

No, we didn't have better alternatives.

For video, HTML5 video was simplistic before DASH, which became a standard in 2012. Further, with Flash your choice of codecs was easy (Sorensen Spark, and later H.264); with HTML5, you have to stream in whichever combination of audio and video codec and container the browser supports.

For rich interactivity other than video, we're just now, in 2016, at a point where we can claim the Web Platform [1] finally is on par with Flash, but sites like CanIUse still exist [2], because not every browser supports every new API. Flash gets a (rightfully) bad rep for its security vulnerabilities, but it was a single platform to target, and it's been replaced with alternatives that are no less subject to vendor pressures, despite being 'open' and 'neutral'.

[1] https://docs.webplatform.org/

[2] http://caniuse.com/

Or we could have native applications, for many flash use cases they were a better alternative.

In a (classic, non-appified) native application, the application can do whatever it wants with your computer and your personal files, and only the OS' privilege escalation mechanism is stopping it from modifying system files (but will happily let you proceed if you sudo or click the windows UAC prompt).

Vulnerabilities aside, at least Flash runtime didn't give unfettered access, and was even nice enough to ask for permissions to the webcam and microphone. Furthermore the runtime was frequently updated and patched by the vendor, and Flash being embeddable in web pages made keeping up-to-date individual Flash applications easy, as they were hosted on the server.

So maybe I've we'd had native applications instead of this flash crud, OS developers would have been forced to sandbox applications properly earlier!

And if we lived in that world we'd all be saying "no one ever sandboxed their apps, maybe if Flash had taken off they'd have plugged their security holes and we would have had a great platform!"

We could have had those same apps sand boxed in the same flash. Only the delivery method would need to change.

And then we'd have Windows or iOS or Android only applications.

I'm not sure I'd call that "better". Running, albeit a bit worse, is better than not running at all.

Cross platform apps are a thing, there were frameworks to build them before flash existed, flash could have become one of them.

could?

it did, see Adobe AIR, publishing to Windows / mac OS X / iOS / Android is imho cross-platform enough.

True, but from memory this only came out as flash was on the decline.

AIR goes back at least as far as 2007, when I saw it presented at Adobe Max. I have a mobile app developed with AIR that runs on both IOS and Android.

...as if we've had better alternatives all along...

In the case of about 95% of the Flash that's been written, we have had a better alternative all along: Not writing Flash. Not animating the self-help menus at your ISP, not auto-playing music at every restaurant website, not cramming a megabyte of crap into the ads coming down your 56kbps modem connection, etc.

I don't think that number is really meaningful. Chrome is at 1315. https://www.cvedetails.com/vulnerability-list/vendor_id-1224...

A better comparison could be for CVSS scores over 9: Flash 742, Chrome 209.

I agree that your number is better, and I was admittedly being lazy when filtering this data.

On top of all the CVEs there is also the rampant proliferation of fake Flash installers. They are just tricky enough to get less savvy users and slam them with adware or malware. Not having to install third party software to browse the internet has it's own security benefits.

Why do you think Flash was so bad? Surely Adobe isn't a company filled with incompetent developers (not being sarcastic).

Even the best developers aren't miracle workers. Its clear that a lot of these older web projects like Flash and Java runtimes were poorly engineered from the start, especially in terms of security, and now all the guys who maintain them just inherited thousands of man years of technical debt. They can't fix it, short or rewriting from scratch, and that has a time/money cost management isn't interested in.

Worse, to fix a lot of these issues you'd have to fix the APIs as well, and that means a new version that doesn't work with the old codebase. People only use Java and Flash because they're on every computer and work with legacy apps. If you introduce a new breaking version, then you're asking for trouble.

Oracle tried that. At my previous employer, the week after a Java client update was always fraught with peril as the new plugin didn't work with Peoplesoft(!) and prevented us from being able to take orders. The fix was usually some combination of a hot-patch for clients plus extended patching for Peoplesoft.

As a former Flash animator and ActionScript programmer I appreciate the tone of the post. Flash sucks by today's standards but it played its crucial role in the history of the internet. Farewell.

Agreed... nothing compared to Flash's tooling at the time, and when Apple started the fist volley that started sinking flash, there really wasn't anything comparable, or having the reach of the tooling for authors.

I haven't had to deal with that kind of content for quite a while now, but I would think some of the authoring has gotten better. It's a bit of a shame though as flash animation projects were so much lighter than video streaming.

I hope as the web moves on we find an easy way of preserving a lot of the creative work that's been done in Flash.

Some sort of WebGL/asm.js/WebAssembly player for SWFs on the internet archive would be the pipe dream, I think. That way we could watch Strong Bad long after Flash is available in the future.

That's Mozilla's Shumway, a SWF player in Javascript.

Shumway's potential is lost now. I would love for Firefox to take on the same model as Chrome and bundle Flash in the browser and Shumway was a half-baked way to do this.

Shumway is DOA without the direct help from Adobe. That's not the first time someones tries to develop an open source flash player. They all failed.

There just wasn't enough work and money put into these open source players.

For instance there is proprietary Flash implementation called Scaleform used for games UI. Even long ago before Autodesk acquired them it's had both decent compatibility with normal SWF as well as full GPU acceleration for every platform possible include Linux.

I've used Scaleform a good amount. It's not 100% compatible with stock Flash but it's pretty darn close in the use cases I've been exposed to.

Scaleform has a complex code base but clearly it is possible to reverse engineer the Flash runtime and make a compatible player.

Funny that https://mozilla.github.io/shumway/ makes Chrome crash immediately.

Works for me on Chrome 52 / Linux.

Same here, also on Linux

There is https://github.com/ienaga/swf2js that works really well.

Hm, to view old content, you can also use the old flashplayer - so nothing is lost. I doubt, that creating a new flash-player on webgl/wasm base is worth the effort, as it would be very complex. (because contrary to popular opinion adobes flash engineers were pretty good)

But you may give it a try ...

There's also GNU Gnash[0] which specifically features Homestar Runner on their homepage.

[0]https://www.gnu.org/software/gnash/

I was a Flash developer. It blows my mind how far and wide this plugin went. We're still dealing with a transition out years after it fell out of favour. It's kind of neat and a good reminder that if people start using a technology it's not so easy to simply move away from it. Very similar to the days of IE 5,6,7,8 (and yes I know that's not "over" either... but a lot less of a concern than it was).

Still, faults aside, Flash was awesome. It was an advanced "Hypercard" (which I learned to build things in as a kid). I hope we don't completely lose some of the good aspects of these technologies.

Flash community was great. It was a real pleasure to work with visual artists and musicians. There will never be anything like it in web development.

They need a more technical description of "default experience". How is Chrome supposed to know if a site only supports Flash? I've tried several sites that require Flash, but only until I change the user agent to a mobile browser. Will Chrome try messing with the user agent in this case?

If the site is so poorly done that you have to fiddle with the user agent to get it to work, I'd say good riddance to that site. Sites like that need a market pressure to become good, and you quitting said site is a vote in the right direction.

You're assuming that the site is still actively maintained.

Chrome (and Firefox [1]) will hide Flash from navigator.plugins so that sites will think Flash is not installed. Sites that have an HTML5 alternative will fall back to that. Sites that don't will display show a "Please install Flash" error message. Chrome and Firefox can show an in-browser prompt to allow Flash, which will allow the page to continue.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1186948

Flash has also been used to circumvent some of the browser protections, especially for older browsers. For example it has been the way to achieve cross-origin http requests (CORS) for browsers that don't support it, like IExplorer < 9 (or 8?) and even IExplorer 9 because the CORS support is shit for that one. On one hand it's been cool for developers to be able to do such things, but on the other hand it makes your browser less secure.

Anyway, I'm a Firefox user and I don't have Flash installed. The web works just fine without it. One less plugin to worry about.

There seems to be a lot of people saying "ohh people thing flash is bad now, but once upon a time it was really a useful thing."

That time was the 90s and early 2000s. And in that time, I avoided pages with Flash because they were painful. They are still a little painful now.

If Flash was transformative, I think it was that it introduced the kind of bloat and intrusiveness that we now take for granted on the web.

As happy as I am overall about the death of Flash I will say that at least Flash being a plugin meant it was trivial to control.

The amount of auto-play videos (both ads and non-ads) is extremely obnoxious and I haven't found a good way to prevent that them yet.

Just use firefox with noscript!

I never have any issue with any auto-play videos at all.

The performance on the good old FF 30 is N*10 times better than latest chrome browser.

Firefox 30? isn't that extremely outdated however?

Does archive.org archive flash stuff? Decades into the future, playing back archived flash games and animations will be very difficult.

Yes, archive.org archives Flash and other content, as long as something links to it so the archiver can find it.

Standalone flash players exist, and flash-to-HTML translation will continue to improve.

This is what the Shumway project is for.

https://mozilla.github.io/shumway/

One problem with archive.org is that it retroactively obeys the robots.txt file, even if the files have been spidered and archived [0].

For example, consider the case when a new domain owner attempts to block all bots from spidering their site, by adding something like this to their robots.txt file

    User-agent: *
    Disallow: /

This is actually a fairly common case when domain resellers purchase expired domains.

Now when you try to visit the archived link, because the live robots.txt file disallows bots, you won't be able to access the archived site (which may have been owned by someone completely different).

[0] https://archive.org/post/406632/why-does-the-wayback-machine...

This is true, however they don't purge any of the old archives. If the robots.txt is updated to allow bots again then all of the previous archives will become available again.

it seems weird to me to retroactively obey robots.txt for a _different_ version of the site.

It makes much more sense to archive the robots.txt along with the content, and use the robots.txt linked with that version of the site. Updating the current robots.txt shouldn't affect a past archive.

I believe the reasoning is that if I accidentally published a public page and didn't realize it but later fixed the problem, I'd like to make sure no one else could see it later. It's probably easier than dealing with all kinds of takedown requests.

> In December, Chrome 55 will make HTML5 the default experience, except for sites which only support Flash. For those, you’ll be prompted to enable Flash when you first visit the site.

Are they still planning to grant a one-year exemption to the top ten flash-only sites? The article doesn't mention it, but I haven't heard anything about it being cancelled.

As far as I understood, the rumours were blown up. Chrome will show a prompt asking you whether you would like to allow Flash (similar to the one asking you to give permission to access your location) if it's used on the website you just opened.

The only exemption those top 10 Flash sites will get is they will have this permission by default, but you should still be able to both permanently add other websites to the whitelist and remove those default ones ones from it. Which, in my book, isn't nearly as bad as Apple's hardcoded support for FairPlay + DASH in Safari only on netflix.com.

I could be wrong though, there could be more stages where it gets harsher and what I described is only the first step.

Looks like https://google.com/finance didn't get the memo.

"Adobe Flash Player is required for interactive charts."

http://www.apple.com/hotnews/thoughts-on-flash/ Steve Jobs, April 2010

When I clicked on the link, I expected to see something like "Flash is an abomination and shouldn't exist, that's why we are killing it". I was wrong and happy to be. Today "Flash" means "problems", but I remember the time where it meant "modernity" and "Improved user experience": I'm glad to witness that Google discards Flash while honoring its legacy!

I find it a bit funny and ironic that the only app I regularly use which prompts me to install Flash [0] is Google Music. On both Safari and Safari Technology Preview!

I'm all for killing Flash, but if even Google is unable to completely do away with it, doesn't that mean that it might be a premature move?

I don't have any interest in seeing Flash kept around. In fact, I'm quite happy to see it die. But do we actually have working alternatives for the problems it currently solves? I don't ask this rhetorically, I'm very curious if there's still problems which HTML5 is unable to reasonably solve.

[0] https://www.dropbox.com/s/f52ew4wpwcmt1dr/Screenshot%202016-...

That is ... strange. I run chromium on FreeBSD without flash, and Google Play Music works well for me (as opposed to Amazon Music, which wants flash). Perhaps it is something about safari vs chrome?

Google Play Music supports HTML5, however I think it works better (i.e. more tested) with Flash or something. So Flash is still the default, while HTML5 is the fallback.

And btw, GPM seems to use a similar DRM method as the one supported in Netflix, so if your browser does not support DRM, you're out of luck [1].

[1]: http://googlesystem.blogspot.com.br/2016/04/google-play-musi...

I only use GPM for DRM-free music that I've uploaded, so that must be why I'm not noticing any issues.

It's a bit frustrating, because it's the only remaining reason I have for installing Flash.

There's some superb wrapper apps [0], but they apparently use WebKit.framework, so it still prompts you to install Flash.

Although I just discovered that the Radiant Player people are working on an Electron version [1], which is very exciting!

[0] https://github.com/radiant-player/radiant-player-mac

[1] https://github.com/radiant-player/radiant-player-electron

The only site I visit that still uses Flash is https://twitch.tv/

And Twitch is actively working on an HTML5 player: https://blog.twitch.tv/html5-beta-access-expands-99554ea982e...

That was the case for me as well until I started utilizing Livestreamer [0].

[0]- http://docs.livestreamer.io/

Flash is definitively the perfect scapegoat

whatever your problem: slow machine, battery, security, etc. it's all its fault

seriously, if everyone have already moved to HTML5, how come we are still blaming Flash for those daily petty problems ?

It's not used so let's block it but it is still responsible for the majority of problems ...

nobody notice the ambiguity of the argument ?

It's quite painful to see such arguments from Google, I thought they would be smart enough to understand that any popular technology get hacked, the problem is not really Flash, its the browser itself (and the advertising networks that are perfect to distribute dodgy payloads to tons of users).

The other sad point is the amalgam of everything, for some ppl Flash equals advertising, and that's bad so Flash is bad, and they don't want to think further than that.

The choice of the users ? The tons of SWF content (that will probably not be ported to HTML5) ? nobody care apparently

And about throwing everything in the same bag, so apparently if Flash is dead then ActionScript is dead too right ?

nope

Flash is just 1 runtime running in the browser, there are other runtimes: Adobe AIR for desktop and mobile, and also Redtamarin [1] for the command-line / server-side.

[1]: https://github.com/Corsaair/redtamarin

I used to make and release flash games and still have them on my website. Is there a good low-to-moderate effort way to convert them to HTML5?

A couple of the games used a ton of frame by frame animation with large sprites, so they probably wouldn't convert to spritesheets very well and should stay vector graphics.

Example: https://youtu.be/Qk9HlXbqRTQ?t=43s

No, there is not a simple way to convert flash to html5. I say from experience, we look for it for years.

Moreover, you can rewrite a game in html5 from scratch, if it is simple enough, but it will be slower, less smooth, and require some latest browser versions to run at all.

You could see if it will run in Shumway?

It's definitely not a "converter" for Flash but I really like the javascript framework Phaser for small games.

So what specifically is going to happen? Instead of a click-to-play box, you'll get an HTML5 version of the content if the site is serving one, and if the site isn't serving one, you get a button to click to enable Flash content on that domain? Seems a little unclear to me and not much different from click-to-play. It sounds like Flash will continue to work with a clickthrough, which is the status quo.

I can't be happier that Flash is bein removed except that I a heavily use Google's own MotionChart[1] which is built using Flash and there seems to be no HTML5 alternative yet available [2] (although google internally seems to be uing a HTML5 version of it [3]):-(

[1] https://developers.google.com/chart/interactive/docs/gallery...

[2] https://github.com/google/google-visualization-issues/issues...

[3] https://www.google.com/publicdata/explore?ds=ltjib1m1uf3pf_#...

MotionChart is being rebuilt in HTML5. See demo here: https://www.gapminder.org/tools/bubbles

I believe this is the library: http://vizabi.org/examples/bubble-chart.html

This seems to me to be an obvious power play by google. Does no one else see how this is not against flash, but in favor of code which google can analyse and extract data from. When the analytics are in flash, google has no insight, but when forced into js they have full visibility into everything a developer does.

Why would Google themselves care about what developers are reporting back? It's not as if they don't have insight into the types of analytics people care about: Google Analytics is very large.

> Does no one else see how this is not against flash, but in favor of code which google can analyse and extract data from.

I doubt that very much - Google has been extracting data from and indexing Flash content for close to a decade[1]. If they wanted to reverse-engineer the behaviour of flash code, they could run it as blackbox code in a Flash sandbox

1. http://searchengineland.com/google-now-crawling-and-indexing...

> Does no one else see how this is not against flash, but in favor of code which google can analyse and extract data from. When the analytics are in flash, google has no insight, but when forced into js they have full visibility into everything a developer does.

The bytecode format and semantics of both AVM1 and AVM2 (the VMs used in Flash) are common knowledge.

Not only that. I believe the main purpose of the whole war agains flash is to kill the online games ecosystem, from which neither Apple nor Google make profit, and move gamers to appstores.

That seems unlikely. It's true that Flash is overwhelmingly popular among browser game devs, but there's been efforts to encourage them to move to HTML5 for years, because Flash is terrible for users.

google analytics is supported inside Flash

since 2008 gaforflash [1]

since 2014 as3-universal-analytics [2] (measurement protocol)

[1]: https://code.google.com/archive/p/gaforflash/

[2]: https://github.com/zwetan/as3-universal-analytics

Can we have then a decent alternative to "Copy to clipboard button" that does not use flash? :(

document.execCommand('copy') seems to be decently supported (Chrome, FF, IE9+, Safari 10) by now: https://developer.mozilla.org/en-US/docs/Web/API/Document/ex...

Note that Safari 10 hasn't actually been released yet - it's only in a Developer Preview

Hm, that's not really the same.

Wonder how does Firefox compare with it and what steps it is taking in this direction?

Firefox plans to make Flash "click-to-play" by default sometime in 2017. This is similar to Chrome's plan.

https://blog.mozilla.org/futurereleases/2016/07/20/reducing-...

Meanwhile, it's pretty easy to force Firefox to apply this policy right now. Just go to the Plugins screen and select "Ask to activate" for Flash. I've been using Firefox like this for over two years, and have never been happier with my web experience.

Firefox will start blocking the "Flash pixels" too, as noted in the Mozilla blog post.

To all those saying Flash is dead or dying, this is simply not so. Mainstream use of Flash may be on it's way out, but browsers will continue to support it in one way or another for the foreseeable future.

Why? As I've said before, and will say again: A lot of enterprisey applications have tools developed in Flash/Flex. Mostly internal and B2B tools, but tools nonetheless. It's not likely that they will be replaced anytime soon, because no one is going to authorize the budget for replacing something that still works, so Flash will be around in one form or another for a long while.

The same is true for java applets. There are still lots of LOB applications that depend on it. Nonetheless, chrome removed support, firefox said they will by the end of this year, and Edge has no support.

Companies still using them are now in the same position as those using active-X, they need IT to deploy special measures for users that need to access them.

I think it's fair to sum up this situation by saying that java applets are dead or dying. Flash may well be in the same position in 3-4 years.

I was going to counter by saying that our MIS displays some reports using a java applet, and I can still access them in Chrome. However, I just attempted to run one of those reports, and it turns out that the latest version of our MIS no longer offers the java applet as a display option. Therefore, I must concede. TIL.

Thank god. The nightmare is ending.

Am I the only one who feels like this has been talked about for a long, long time? I actually already thought that Flash had been just about eradicated from the major browsers.

I still use Flash for youtube (with an add-on that enforces it) because Firefox doesn't seem to be able to handle my 4-monitor Xmonad setup properly with HTML5 fullscreen video. And the process also locks up my soundcard until I kill the process. Flash behaves much better. After youtube ditches its Flash player altogether, I guess it's chromium for YT then. No biggie.

Same with me as well, Firefox or Chrome both are slower with HTML5 media versus flash. Flash video runs faster than HTML5 and also has hardware acceleration which HTML5 fails at on my hardware, a couple of laptops and a desktop rig.

I'm all against Flash. But this argument sounds silly. Why not handle this like any decent OS, and "nice" the Flash portion of the page, so that it takes only cycles (or bandwidth) which are otherwise left unused?

Because that's not really the reason behind the change, it's just a convenient argument to use.

> This kind of Flash slows you down

I wonder if Flash is still slower than the current JS bloat of the "modern web". My intuition says, probably not.

And funnily enough, Google itself is behind a lot of that JS bloat and background tracking. They are probably not the ones that should be pointing fingers at Flash.

I wonder, does anybody here plays online games? I wonder, further, is there anyone who thinks HTML5 is even close to Flash for games creation?

Good. Maybe that'd force Facebook to update their OpenGraph video embedding. Right now it essentially requires an URL that's either application/x-shockwave-flash or video/mp4 (with undocumented <iframe> embedding for chosen parties), which doesn't really cover all the cases for online videos (e.g. live streaming with DASH or HLS).

Some of the comments on that page are just sad. I didn't realise Flash still had so many fans.

The article mentions Flash content slows web page loading and is power inefficient. Flash also has an abysmal security record. Chrome 53 will start blocking certain kinds of Flash usage, and Chrome 55, in December 2016, will go further.

Great news!

Even then Chrome's battery usage is pathetic. I sincerely hope you guys get it right in battery consumption from within chrome rather than blaming on flash! Please! It hurts.

For years!!! we been waiting for Flash to be kicked to the curb.

Remember when this was a selling point for android devices? I think everyone that owned one pretty much touted it as the killer feature.

"Everyone that owned one" feels like kind of an exaggeration, but it was a big feature at the time. I found it very useful for video players and was glad my phone could plug the gap while the web caught up to HTML5.

At the time, it was a killer feature.

I thought it was a killer feature right up until I actually tried to play a five-year-old Flash game on my brand-new, cutting-edge Galaxy Nexus and got like 3FPS.

All that left was Flash video (very easy to replace server-side, just switch to an HTML5 player and all the videos on your site are good to go) and sites with Flash-only interfaces (good riddance, for the most part).

I guess it would be nice to watch Homestar videos on my phone browser instead of having to find them on YouTube, but that's literally the only other use case I had.

It's great that Google is highlighting the importance of power efficiency as a major part of their justification for killing flash. Now they need to fix Chrome itself: http://www.theverge.com/2016/6/20/11975514/microsoft-chrome-...

Don't want to troll around but it seems to me only two things are inevitable: taxes and Flash Obituaries. ;)

I use Linux, what's flash? Joking, but seriously I would like HBO now to finally work on my Linux boxes.

"This kind of Flash slows you down" .. Shame they apply the "block" only to "this kind of flash".

great decision, it is time to move forward. i believe flash will cease to exist in 5 years

will they address the elephant in the room and also say that Google analytics slow down 90% of the web just for tracking?

I updated my Chrome today (Mac OSX) and the graphics took a huuuuge step backward. Almost like someone accidentally published the Linux build to the Mac link. A couple of my friends have reported the same experience, but I don't see anything official about this. Am I going to have to attempt to downgrade to get the better UI back?

Can you please file a bug at crbug.com/new ?

Why would he file a bug for a UI change?

https://chrome.googleblog.com/2016/08/flash-and-chrome.html?... also echoes what you say:

  I don't know what you guys changed under the hood, but I'm
  experiencing the exact opposite of your first paragraph claims:
  most videos don't work, and it's draining my macbook's battery
  at an unprecedented rate. I can live with my flash videos not
  working, but the reduced battery life is making chrome
  unusable.

I'm getting frequent graphics glitches on my MbP

It's the new "material design". You can disable it in chrome://flags to get the non Windows 95 style back. I too hate it. Not sure what the recent design trend of sucking all colour from UIs is hoping to achieve.

Thanks, those 5 minutes were really uncomfortable. Apparently some people are really into sad UIs.

Just know that that flag will not stick around. It will be removed at some point, the rule of thumb is 2 major updates, so 12 weeks.

If you have actual issues with the new design, file bugreports or issues.

Where they will sit ignored and unaddressed like literally every complaint about crappy browser UI.

(Me, bitter?)

Not sure what Linux has to do with anything; a Linux build would simply not run on OSX.

What do you mean the graphics took a huge step backward? You don't like the new UI, or stuff like WebGL/HTML5 Canvas is performing poorly?

Personally I prefer the new UI, better suits El Capitan's return to a more clean, flat look.

When they eventually remove the Material UI toggle from chrome://flags, I'd recommend installing a Chrome theme that you like rather than rolling back actual security patches and bug fixes.

Since recently flash in chrome makes my computer reset after 3s of video playback...

What kind of system are you working on?? That is ridiculous. Flash has never made any computer that I have ever owned reset.

And anecdotal evidence of what never happened to you, still works best, to ridiculise other peoples experience, right?

This is new to me too. My laptop is dying of old age it seems.

Surprised they didn't just ban it from the browser outright, like they did with Unity.

They didn't ban Unity. The legacy NPAPI extension format (which the Unity web player plugin was built on) was deprecated in favour of PPAPI.

NPAPI was outdated, unperformant and insecure, the goal of PPAPI was to address those issues. All that would be needed for Unity web player to work out-of-the-box in Chrome again is for it to be ported to PPAPI

And they were given a 4 year heads up that chrome was going to remove it.

Instead Java used that time to build several help pages that showed you how to install other browsers then made a shitty anti-chrome campaign when it was finally removed, and unity just sat there and did nothing the whole time.

Here's what a Unity dev said:

"I don't expect Chrome to keep supporting PPAPI native plugins for any longer then they have to (in order to support Flash), because it has the same security issues as NPAPI.

And, porting the plugin to PPAPI would be far from trivial, and not be compatible with existing content anyways"

Is any of that fundamentally wrong? They decided it was a better use of their time to go right to WebGL.

Honestly I'm not that sure, and that was a shitty way for me to word it about Unity. The big thing with PPAPI is that it can be much more sandboxed than NPAPI ever could, which means it already has a big step up in security, but obviously anything whose purpose is to circumvent the restrictions put in place for the browser is going to be inherently less secure than just running a website. In the end PPAPI could let you run code from a webpage as "root" on your computer, and there is nothing Chrome or anyone else can do to stop that.

That being said, I think Unity is going in the right direction trying to get away from plugins altogether. They are trying (successfully IMO) to compile to "true" web technologies and let the game be exported as HTML5 and javascript which is the right choice.

> They didn't ban Unity. The legacy NPAPI extension format (which the Unity web player plugin was built on) was deprecated in favour of PPAPI.

Which had the effect of banning Unity.

I understand that this was a good move from a general security standpoint. I'm annoyed that Google has done their best to make it impossible for a power user to override it, just as they made it unreasonably complicated to install non-Google-approved plugins.

By all means, set your softwares' defaults for general security. Don't tell me what I'm not allowed to do with my own computer "for my own good." We don't accept that when Microsoft or Apple does it.

> All that would be needed for Unity web player to work out-of-the-box in Chrome again is for it to be ported to PPAPI

No. All existing Unity apps would have to be recompiled. Making legacy games harder to run leaves a bad taste in my mouth, even if it's for good reasons.

They wouldn't have to be recompiled. Unity apps running via UWP don't execute directly in the browser document context, UWP is it's own stand-alone plugin which is then embedded where needed in the page (similar to Flash and Java), this is why you have to download the UWP executable in addition to the browser plugin. The browser plugin is merely a wrapper for the UWP binary.

Unity apps compiled against the UWP runtime should run all the same regardless of whether UWP is wrapped in an NPAPI or PPAPI plugin, unless the wrapper plugins themselves and/or how they call the UWP runtime are implemented differently.

Flash has one key advantage over HTML5 video.

Flash can be blocked, through browser extensions, CSS, or simply by removing the !@#$%^&*() Flash plugin, disabling all autoplay video.

HTML5 has no such similar functionality.

This feature of Flash is very sorely missed.

(/etc/hosts or similar blocklists of all known video service providers is an effective and reasonably concise, if not entirely perfect, alternative. I recommend it.)

It wouldn't be that hard to make a chrome extension for that....

Try for Android.

That's not really correct. It can be blocked both by extensions (ABP and uBlock), and by CSS (just hide <video> or other containing element).

My experience on hiding video was that the video was hidden, yes, but the audio continued to play and video content, I believe, was being downloaded.

I've yet to find an extension which blocks all video effectively. Or prevents autoplay.

Chome/Android doesn't support extensions at all. So there's that.

Flash, by its very blobbiness, had an effective defeat mechanism: remove the blob.

Again, for video, especially autoplay sources, I've found blackholing the video platform provider's hosts or domain quite effective. It's still only a handful for most offenders. And if the practice spreads we may see pressure from the providers themselves to defeat autoplay.

Though those of us blocking will be beyond caring.

Which is probably why Google don't mind seeing it go — they use JavaScript for all their privacy violations.

> Flash can be blocked, through browser extensions, CSS, or simply by removing the !@#$%^&*() Flash plugin, disabling all autoplay video.

> HTML5 has no such similar functionality.

Just as you can block Flash by not having a client that handles Flash content ("removing the...Flash plugin"), you can do that for HTML5 too.

But there's a whole lot of baby that gets thrown out with the bathwater in that case.

Reply on news.ycombinator.com