Hacker News Reader

Comment by MaulingMonkey | Hacker News Reader

Note that "kill" is just a less ugly way of saying "stop providing security updates for." It's not a SAAS, they can't just snap their fingers, shut down the servers, and have flash actually go away. Even if Adobe actively tried to murder Flash Player, people would still end up pirating copies of the installer from shady sites for their legacy needs.

View on HN

If no browsers had support out of the box and even plugins were hard to come by (browsers could actively prevent running anything it thinks is a flash plugin..) the problem might go away.

Browsers already do this.

What are we supposed to do about the millions of legacy sites and applications that use Flash, that nobody is going to update?

Am I crazy for thinking that Flash being in maintenance mode in perpetuity is a good thing? I want webpages from a decade or two ago to work fine.

I think Chrome is taking a good approach [0]. Disabled by default, but you can optionally enable it on a per-visit / per-site basis.

[0] https://blog.chromium.org/2016/12/roll-out-plan-for-html5-by...

Firefox does this too; I had assumed all modern browsers did these days

I don't know, write a JavaScript interpreter of Flash?

Or let it die already. Remember VBscript? Neither does anybody else.

> If no browsers had support out of the box

This was the original state of Flash and Java. This is when they grew. Trust me when I say: This would not be a problem.

> and even plugins were hard to come by (browsers could actively prevent running anything it thinks is a flash plugin..)

This is no longer Adobe 'kill'ing Flash Player, and also how you get a bunch of pissed users switching browsers or sticking to legacy versions. This shit right here is how you get IT departments sticking to IE 6.

Although, this is perhaps a golden age of open source. Maybe we'd see hostile forks instead!

And, of course, iOS Safari has already 'kill'ed Flash in this sense. On the one hand, it's added some pressure to transition to new tech stacks. On the other, since we're still asking questions about how to kill Flash Player, it clearly didn't do the job ;)

I think the current pace of the death of flash is good enough. It also seems entirely fine if corporations or some individuals have to bend over backwards to keep their legacy apps running - that's how XP mode on windows still ran 16bit apps for years after ms stopped shipping a Windows version with native support for 16bit apps.

The problem with flash is that the people who get in trouble through exploits had no intention to run flash at all.

Browsers could start by disabling it by default and only enabling after modifying well hidden settings that would be no problem for a legacy intranet or kiosk scenario, but would serve my mother in law well.

No. Kill is to _only_ add bugfixes for X years and then commit to shutting it down, while creating a migration path (shumway, whatever) for existing code.

Windows XP is dead.

Windows 7 is dead.

Win 7 is going to be an even bigger die hard than Win XP.

Yes. Windows 7, at 45%, is the most common operating system among Firefox users. Only 26% run Windows 10.

https://metrics.mozilla.com/firefox-hardware-report/#goto-os...

I'm running Windows 10. If I could pay to go back to Windows 7, I would in a heartbeat.

> No. Kill is to _only_ add bugfixes for X years and then commit to shutting it down, while creating a migration path (shumway, whatever) for existing code.

Shumway is dead. There is no migration path for existing code. The closest thing that exists is Haxe and OpenFL but it doesn't directly support ActionScript or SWF files. What they need to do is opensource the player.

I doubt they will open-source the player, for one primary reason: We already know that Flash is hilariously broken wrt security (see for example [1]), and exposing the source code will lead to dozens and dozens of horrible exploits within a few days, thus prompting browser vendors to forcefully lock out Flash in a cloak-and-dagger operation to protect their customers. (Either this, or Adobe will face a shitstorm of unprecedented proportions.)

[1] http://www.zdnet.com/article/offensive-security-research-com...

You'd be surprised to know how many millions of people use these dead operating systems on a daily basis.

Yes. Dead doesn't mean doesn't work.

Dead means EOL.

No way. My employer finished upgrading 250k devices to Windows 7 early last year.

Thanks to the epic fuckup with Windows 8, there's no way that transition to 10 will complete in 2020. My guess is that most large commercial customers will have 20% of users running Windows 7 through at least 2023. VDI or other similar mechanisms will be used to isolate it.

Reply on news.ycombinator.com