Petition to open source Flash
github.com
github.com
Flash has very little to offer that is not at this point duplicated (or improved upon) by others. It's also woefully insecure. "Many eyes make all bugs shallow" will only work for the most trivial bugs in the most common code paths. Plenty of vulnerabilities will remain. In open source, they'll be even easier for attackers to find and exploit. If you want something open-source and (mostly) Flash compatible, follow nkkollaw's suggestion: support one of the already-open-source alternatives.
Anyway, you have no reason to be afraid. All mayor browsers are dropping support for plugins anyway. An open source flash player will most likely be used standalone, and not in a browser.
(I can't help but wonder if we are making a huge historical mistake here by the way. Because the Flash implementation was so bad, we were led to believe that plugins are bad per se. But at least in theory, it seems to me that the best architecture would be a minimal browser (just a layout engine), and everything as a plugin. Current browser are horrible monolithic giants, that only mega-corporations (and Mozilla ;-)) can maintain. That they are relatively secure is only due to the massive amounts of human-years that went into polishing and bug fixing in the recent decade.)
Plugins aren't inherently Linux-incompatible it's just that for most of them Linux support was an afterthought or actively avoided for competitive reasons (in the case of Silverlight, I would guess). I don't miss fighting to make Flash work in a 64-bit browser, or having to set my user agent to claim I'm on Windows, to make something work (and have it break periodically for whatever reason).
In theory we could create a basic browser with various HTML/JS/CSS spec features created as a plugin
Open source plugins cause a lot less grief. Typically they don't have a feature I want. Often for legal reasons and not technical, or because a proprietary vendor is fighting back (eg; video patents the first case, Skype protocol the second).
The linux kernel is an example how an open-source-only plugin system works technical wonders. A very interesting case study was graphics drivers circa 2005. The closed source drivers (essentially plugins) tethered the linux community to the technically obsolete X server; and would have crippled the kernel in a similar way if the kernel devs had accepted closed source plugins.
Apple did wonders driving open standards on the web with the explicit acknowledgement that popular closed source plugins were too dangerous for their platform to implement [1].
The issue here is the one Stallman has been harping on since the dawn of time - closed source is unmaintainable in an extremely profound way.
If you need some native feature, browser vendors can force you to use a native app and thus go through their app store (think Safari on iOS). There is a large category of apps that you cannot make in HTML, for example anything truly P2P (not WebRTC, but based on real sockets). You can't make an IMAP client. You can't make a friend-to-friend file sharing tool, without a central server, that uses your Facebook and Google contacts to find peers (I've tried). You can't make the browser window partially-transparent or use native looking widgets. You can't burn a DVD. And if someone invents free-floating holograms, you can't add them to your page.
Granted, these examples are silly. The web is now a very capable platform. But vendors have always been steering what you can and cannot do based on business and other interests. It would be great to be able to break out of that, by having a kind of "C foreign function" interface for the web.
It is probably why we all have flat windows 3 inspired UIs now.
It'll most likely be modified to run in browsers, too, e.g., via compilation to WebAssembly and suitable web-platform replacements for the low-level IO, etc., implementations.
If website.com embeds a flash file from flash.example, it will run in the context of flash.example, the embedee. If website.com embeds JavaScript from js.example, the code will run in the context of website.com, the embedder.
This will and has caused problems with interoperability in so far, as I'd call it an ugly and dangerous wart.
See web security literature like "The Tangled Web" (or https://code.google.com/archive/p/browsersec/wikis/Part2.wik...) for more.
So the W3C would have to define "standard Flash specification" and then everyone would have to implement their own "Flash player". But ain't nobody got time for that.
If the "Flash player" had been a specification rather than a piece of standalone software from day one, I believe the overall security of the Flash players would have been way better.
(Hello downvotes? It's true, we preserve all of those things through virtual machines of one variety or another. The Flash plugin doesn't magically stop working because Adobe stops developing it.)
Seems a weird thing to bring up for why we shouldn't opensource a runtime to preserve content....
And also, why do you care if some people _do_ want to continue developing Flash? It's going to get removed from browsers either way. The mere existence of a Flash player on somebody's desktop somewhere is not a security liability for you.
The argument presented was that open sourcing would allow that little bit of internet history to be preserved. My point is that you don't need source code for that. IMHO we don't want anyone to continue developing flash. Even it's creator has declared EOL for it. I understand there are people who want to mess around with it and do things that are potentially interesting, I object to disguising those desires as a preservation activity.
Just like with Java it's the Flash in browser that sucks, not Flash in and of itself.
People get permission to build Commodore 64 clones, for retro computing preservation, and Hacker News says that's great. Someone requests similar permission for Flash, and now we're upset about the notion of a proprietary codebase being open sourced? Why? Because Steve Jobs said it wasn't cool? Because you're seriously afraid that it would make a comeback, and dethrone HTML5 on the mainstream web?
Guys, someone started a petition to ask a company to donate a propriety codebase after EOL. That's all. This is just idle chat, because nothing in Adobe's history suggests that they would actually consider this.
Regardless, if you would rather NOT see a historically signficant codebase open sourced, then simply don't sign the petition. And take all the low-quality jokes and guffaws back to Reddit, please.
Open sourcing code does not carry any of the risks you mention because those risks relate to browsers, not to Flash, besides that the whole point is to 'make it live forever' so that the millions upon millions of hours spent building Flash stuff will not have been wasted.
Open sourcing abandonware is exactly the right thing to do.
I think 90% of those who are against it, are against it, because they want to forget flash and never see it again.
So somehow, they must have made so bad experiences with flash, that they do not want to get it for free or even someone else to get it.
So you next question is probably: What could have been such a bad experience? Probably not a just one. From my own memory:
Good experiences with flash:
- youtube, etc.: Flash was overcoming the codec problem we had in the past. By providing a minimal set of supported codecs it was setting a defacto standard for video streaming. But that problem is solved today.
Bad experinces with flash:
- Flash menus (please install that macromedia plugin before you can actually use this website)
- Flash menus (please wait until this uber cool animation finishes to render before you can click on that link)
- Complete 'websites' in flash (Please install that plugin before you can see if this website is of any use at all)
- Header logos with large file sizes, as they are animated like hell
- a laggy computer just because some website embeded a flash animation which uses all of your CPU power
- Contact forms which disallowed copy and paste.
- Websites which you could not find again because the search engine could not find them.
- decisions about being vulnerable vs. actually seeing flash content at all
- tracking cookies beyond normal cookies
- extra applets which are there just to make sure you are a real browser.
So I think nobody has a real problem with those gift cards or the games. But given the history of flash we would better not receive a gift, just to make sure we will never have to experience those moments again.
Think about it this way: as a linux user, wouldnt it be a great thing for humanity if Windows XP was open sourced? You wouldnt have to use it. No one would have to use it. But that knowledge and history would be unlocked instead of hidden away. Someone in the future would be able to learn from it or modify it to get a really old obscure program to run. The possibilities are endless.
> Good experiences with flash:
>
> [1 item]
It's a reason, and a good point, but it's not a good reason. Improving the already-open-source players would be a better alternative. Adobe could even help facilitate that, by documenting the interfaces and enough of the internals so that other developers can achieve better compatibility. A canonical sandboxed version would also achieve the goal of preservation, without the security woes. Open-sourcing Flash is would just ensure its continued use as it is today, crowding out either of those efforts.
The open source players could be improved by comparing implementation with Adobe's once it is open sourced.
Also, this whole discussion is moot because open-sourcing Flash ain't gonna happen. I can practically guarantee that it's too entangled with other companies' IP for that to happen. Maybe the people who are arguing that we should treat open source as an alternative to the trash can (which is pretty damn insulting to those of us who actually produce open-source software) could spend just a little bit of their obviously-copious free time lobbying to change that IP regime.
You have that backwards.
The effort going into open source projects emulating a closed source product are wasted if that closed source project can be open sourced. That's a win for everybody, after that the effort can be directed to something more important because perfection is now attainable.
The only reason these open source projects exist in the first place is because the reference implementation isn't open sourced. I'm pretty sure the maintainers of those projects will welcome such a move by Adobe, there is no innate right to some kind of 'protected space' for open source projects that purposefully aim to provide an open implementation of a closed source product. Obviously one of the risks of embarking on such a project is that the original may one day be open sourced.
Yeah, that Linux thing just died when Solaris was open-sourced. Even more relevantly, IE and Chrome.
> perfection is now attainable.
That's cute. As somebody who has actually produced software for thirty years (but without ever hitching my wagon to Flash like some here) I'm a bit more skeptical about the likelihood of taking a gigantic long-lived ball of mud and making it perfect. In particular, security is hard to bolt on after the fact. I certainly wouldn't assume that the maintainers of other implementations would be overjoyed by the prospect. Just look at how many reimplementations there are of things that were already open source. I'd say it's unlikely that a significant number of people will work on Flash without being paid to do so.
I fail to see the relevance. Linux never tried to be an 'open source Solaris clone' and of course it didn't die off, in fact, it flourished, which sort of undermines your argument.
> Even more relevantly, IE and Chrome.
What of them? I could see Mozilla vs IE.
> As somebody who has actually produced software for thirty years
Appeal to authority ;)
> but without ever hitching my wagon to Flash like some here
Join the club. I absolutely hated Flash and for many years resisted using it to deliver video.
> I'm a bit more skeptical about the likelihood of taking a gigantic long-lived ball of mud and making it perfect.
Perfect as in 'perfect emulation', not perfect as in perfect all across the board. Having the Flash source would allow the open source implementations to look at how things were done so they can emulate all behavior up to and including the bugs. If Adobe would open source it then they would not have to avoid looking at even disassemblies of the Flash code.
> In particular, security is hard to bolt on after the fact.
This is not about future developments in Flash, it is about digital archeology. If you start seeing it through that lens then maybe you will be a bit more relaxed about it.
Nobody is suggesting that Flash be given eternal life or that we will have another round of Flash content if Flash is open sourced. The sooner it is gone from the web the better. But that old stuff still remains and maybe one day someone wants to review it. That is what this is about. CF people using C64 Roms or Nintendo stuff 3 decades old.
> I certainly wouldn't assume that the maintainers of other implementations would be overjoyed by the prospect.
Did you ask them?
> Just look at how many reimplementations there are of things that were already open source.
So what? Fragmentation is the very power of open source at work.
> I'd say it's unlikely that a significant number of people will work on Flash without being paid to do so.
Exactly. So that is - again - why open sourcing the old Flash player is a good thing.
Between the options of open-sourcing an already-complete and canonically "correct" implementation, and having Adobe document their code and interfaces and improving the partial (but open) implementations that we have, it seems like the latter involves a lot more work. I guess I don't see the benefit.
Maintaining the build systems, compatibility layers and so forth won't be easy (Adobe often couldn't manage it), and bug fixing in the code is a risky prospect for preservation as it could render older content unplayable or differently playable.
The swf file format is almost open - it would be nice if Adobe updated the published specification to the latest format. Again that would go some way towards ensuring the content remained available in some way.
Edit: genuinely interested in the downvotes here - am I missing something fundamental about content preservation? It seems logical to me that the file spec being available + original players is far more valuable than the source, as the source will then bitrot without continuous maintenance. In comparison the players will always run in the VMs.
AIR did hold promise, but ultimately suffered from being terribly cumbersome to extend when you wanted to access native features or platform standard libraries (I've created several AIR native extensions over the years).
However, one of the big problems with using Flex or AIR after Adobe have end-of-lifed Flash is that you're going to lose access to the content creation tools. There are some alternatives (FlashDevelop and FDT for coding, I forget the name of the attempt at an open source Flash timeline editor), but nothing is close to being as good as Adobes own tools when you want to.
If you want to leverage knowledge of ActionScript, people may be better off looking at something like Haxe for cross platform gui app dev.
For the drop downs - when I used Flex I had the same issues over window bounds, in that nothing could extend beyond the limits of the flash rendered window. Did they fix that in later versions?
That's getting harder and harder to do as platforms get more and more complicated. "Mostly" compatible is less than helpful. Having access to the actual primary Flash implementation would be invaluable for preservation efforts.
There's a lot of content out there made with flash, especially games.
A sandboxed player application would go a long way toward the uses mentioned in this thread, no? I wonder when we'll start seeing Flash emulators being developed to play back all that old content.
Things like Mono took a decade to finish as an exact clone of a portion of Microsoft's implementation, and that was only possible because the people using it (the target audience begin linux programmers) could fix the code as needed. Flash's target audience is artists.
So does DOS, OS/2, CPM, AmigaOS, etc. Let individuals decide what to do with the source code.
Pray, tell me of a universally-supported compact interactive vector graphics animation format, with sound, in a single file.
Back in the year 2000 I could send a Valentine card with an animated message that could be downloaded as an email attachment and kept forever.
So, what's the improved version of that?
- (M)HTML with bundled/inlined SVG and multimedia files.
- SVG with embedded multimedia files (demo: http://xn--dahlstrm-t4a.net/svg/audio/html5-audio-in-svg.svg)
- PDF with embedded multimedia files
That a larger can of worms than flash itself.
E.g. try make a fire or particle effect with SVG
I thought we're talking about Flash here? You know, the thing that only works on a subset of browsers on the three major desktop OSes and has absolutely zero modern mobile support.
Almost everything that has been done with Flash falls in to one of two categories:
1. Things that should be done in standard and truly universal HTML5, generally with assistance of Javascript, CSS, and SVGs. This includes every single media player and most non-interactive or lightly interactive animations, as well as all navigation elements for a web site. Your valentine's card example is definitely in this category.
2. Things that should be done with a proper game engine.
There's a very small margin in between those two mostly full of games too complicated to be practical in HTML+JS but too simple to really be worth the effort of a full game engine. Even that range is getting a lot smaller these days with the number of high quality game engines available for free to anyone who wants them.
Flash has an immense amount of value built in which cannot be replaced by any of the alternatives. Maintaining and fixing old code isn't as sexy as jumping on the latest competing standard, but it's far more valuable.
Even if we don't continue to develop new features for Flash, it's important to keep it alive so we don't lose the ability to run the wide variety of flash programs which at this point make up a significant portion of Internet culture and history.
Open sourcing flash just means that devs who have spent years building games in flash can still play those games. It is still a death sentence for the future of flash.
How about streamable vector animation without hogging your CPU like HTML5 canvas or svg? (Zing!)
And also, authoring tools that guaranteed to work everywhere as you draw graphs.
Think about how Google pressured Microsoft to fix a vulnerability when MS was too slow to respond[1]. That's the kind of crap you see with proprietary development.
Open source is just a flat-out better method of developing software, but especially so when it comes to patching vulnerabilities.
[1] https://www.engadget.com/2015/01/02/google-posts-unpatched-m...
If we open-source Flash, at least museums will have an option to preserve that content for future generations to learn from and enjoy.
What tech can do what Flash does and is as easy and approachable as Flash for non-developers?
I mean sure with WebGL and mad computer graphic skills no problem, but with out?
Really flash had its place for animations, games, and sound/video stuff. There isn't any single alternative, although a lot of things it was used for can be supported directly nowadays. (Things like using the clipboard, etc.)
Developing a new toolchain might take so long that it wouldn't make sense as a project.
It seems a reasonable compromise to me.
am i being naive?
Aside from experiments in user interfaces, creative hubs like Newgrounds, YouTube and Vimeo relied on Flash to promote user-generated content on the web. I'd even go as far as saying without Flash those sites may have never existed.
- It was a response to the stagnant IE-dominated web that allowed people to experiment and create incredibly rich content that is still hard to replicate.
- It's editor was amazing for introductory programming. It was as easy and intuitive to use as any vector-graphics editor, but you could get really complex on your programming too. It was very visual, very graphical, which helped.
- It was great for animation. I really can't think of anything that compares. There's lots of animation software out there but most are targeted to video. There's lots of libraries for animating Canvas/SVG, but they don't have interfaces/editors for non-programmers. Flash was an amazing middle-ground; a great creative AND technical tool IMO.
- ActionScript was nice; it wasn't daunting, it had types to help you, but they didn't clutter the syntax. If I recall correctly, the tooling wasn't too shabby either, with good auto-complete and suggestions as you type.
It's thus no wonder it caught on like wildfire and there was so much content for it. It was a good option for technical projects and creative ones, beginners and experts. I definitely don't want to see Flash making a comeback on web, but I wouldn't mind seeing it in standalone applications (assuming security doesn't become an issue), and I could see its value on education, granted, with the right editors and tools.
But Flash was a gift from the gods back in the early days of IE and most people forget that. If you wanted to make some HTML look nice you had little more than the dreaded 'blink' tag to work with.
If it weren't for Flash I doubt we'd have anywhere near as advanced CSS, SVG, Canvas and HTML5 bells and whistles that designers can actually use now.
I doubt Adobe will open source it though. They probably know there's a whole heap of other security issues in it that'll get found and exploited as soon as they release it. Your average user won't be able to patch fast enough!
I honestly wish we'd stuck with flash.
Flash, Java Applets, and jQuery all changed the web for the better and were amazing things at one time. But we should move on.
There are still some things it will do for you that can be tedious with vanilla and arguments could still be made to use it as a dependency. But imho, it should be treated more of as an optional dependency that you use when/if you need it, rather than a cross browser compatibility crutch.
http://youmightnotneedjquery.com/ helped me out quite a bit as I transitioned away from using it for day to day. It's not exactly 1-to-1, but it helped ease the initial pain.
So wait until 2020, after all major browsers have dropped support for it. No reason to worry about vulnerabilities in software that nobody's using in production anymore. If anyone still cares, they can always fix the security problems themselves.
Open sourcing flash doesn't mean it will stay mainstream, it probably shouldn't. But there is valuable flash content. If they kill flash and don't open source it, the only way to run flash will be on old browsers possible in old operating systems. This will put a big burden on businesses requiring old flash apps.
And also consumers who may have devices like webcams that require flash to view the video feeds from a browser.
And the web is much worse because of it.
The one thing that was excellent about flash was that you could easily disable it and all the security issues and annoying crap would disappear. You can't do that today without breaking stuff.
An appropriate thing to say in a discussion about Flash :)
Then I guess the bugs can be taken into account like Firefox did with IE6?
Perhaps having a compatibility-mode on/off so that new movies could follow the standard.
Again, I don't see why if there's interest in Flash and Adobe is abandoning its player, the open source ones can't be made to work as well (or as bad) as Adobe's.
Firefox copied IE's quirks back in the day, I don't see why it can't be done again.
What make more difficult the reimplementation is the abscence of a specification or a standard.
one can dream
Security affects everyone. Even if I can keep my own machine uninfected, I can't do the same for my bank's machines. Nor can I do the same for random strangers whose machines get 0wned and then used to launch new attacks against me, my bank, and everyone else. Insecure software needs to be replaced by more secure software, not put on indefinite life support.
Only thing you can argue is that if someone is using old out of date software they would be at risk, but they are already at risk. Open sourcing Flash would not make it any less secure if it's not being used anywhere anymore.
Why even bother worrying about Chromium? People who are going to want the legacy Flash stuff are running Windows and there isn't even Windows build of Chromium. How come people on HN always come up with some ridiculous edge case that has zero baring on reality.
> We understand that there are licenced components you can not release. Simply leave them out with a note explaining what was removed. We will either bypass them, or replace them with open source alternatives.
As bdcravens and ghaff allude to elsewhere in this subthread, the question is whether Adobe can be convinced to put in the effort required to strip out licensed IP. Maybe a crowdfunded campaign with a bounty to cover Adobe's costs would be more compelling than a slacktivist petition like TFA.
It's not. Even when doing so is a priority, it can take months of work.
Such a campaign could also send a much stronger signal of how badly people actually want an open source flash player. Starring a repo is too easy; it's better to let folks put money where their mouth is. Imagine if the hypothetical campaign raises a million dollars. It'd be hard for Adobe to ignore.
As I said though, it's been years and I'm just relaying what I can recall so I may very well be getting things wrong.
If there was just a button to be pressed, Adobe would have pressed it circa 2010. But at this point, I think open-sourcing Flash Player is the kind of thing where the project to figure out what all would need to be done would cost more than Adobe would want to invest, never mind actually doing the necessary work (both engineering and legal).
It's a compatibility layer.
I am already using gnash to run flash games and a feature complete open source implementation would be very welcome.
But, honestly - Flash as a platform hasn't advanced much in quite a while. What it once offered - rich multimedia runtime engine across platforms - is either available in the browser directly or can be attained through even more rich engines such as Unity3D.
Personally I just want to ensure there's a way for me to go back and look at all the work I did in high school. It's already a pain to figure out how to run my old SWF files, and soon it's going to be nearly impossible.
Maybe I should just snapshot a VM with everything set up correctly?
Notice: The idea is not to save Flash Player, but to open source Flash!
I think a better description of the purpose of this petition might be a good idea. A lot of people conflate Flash and Flash Player.
Think of it like an emulator. It would still be stripped from browsers, but you could download the SWF and play it locally, in the "flash emulator". Except it'd be based on the real thing, and as such, would achieve perfect compat right away.
A projector is a different thing, it's a special .exe version of the .swf with the Flash Player bundled at compile time. So the concept of using the latest projector to view an old .swf doesn't make sense.
Sorry for the pedantry but that's the third time I've read it used incorrectly on this thread.
> Adobe Flash Player 26 (Win, Mac & Linux) debugger (aka debug player or content debuggers) and standalone (aka projectors) players for Flex and Flash developers.
Future history does need a copy they can use in the future to look at web sites of the past though. Content that relies on proprietary technology will be lost in the annals of history.
I believe that open sourcing Flash should be done for the sake of software preservation. But I would recommend 2025 (end of life for Windows 10 and IE11) as the earliest release date.
Seriously, why start with sentences like that if you really care about it being open-sourced?
Gnash works pretty well with non AS3 noninteractive movies and looping swfs. Most games are still broken though.
To me Google Chrome is the one responsible for killing Flash, Adobe is just playing catch up.
I never understood the hate flash got, sure it was abused by ads but to this date I have never seen the same level of animated and vibrant websites that were around in its peak.
Everything is the same old bootstrapped template now, its pretty boring.
Shut it down, the internet is massively more secure without flash
Sounds like a daunting task, especially if no big organization/leader takes up the task of cleaning it up, the way OpenBSD did with LibreSSL.
I think all the comments are missing the point. This is about preserving our digital history. A huge amount of content exists only in flash. It would be sad to see it all disappear. It's even being used in important AI research, with openAI making a ton of old flash games available for training AIs. I have fond memories of many simple flash games I used to play on the school computers. I still have a bunch of .swf files I saved that won't open anymore.
(Also even back in the day some flash games had built in DRM that required contacting an external server to run. And I have no idea how to fix that.)
If you really want to get them working you can try:
- Opening them in the debug player, maybe you'll see a trace that gives you a clue.
- Decompiling (with the right software this is often quite successful... 'Sothink' used to be pretty good) , opening in the Flash authoring environment and re-exporting.
- Trying older versions of Flash Player (Adobe still provides them for download)
Huh? Who said anything about browser vendors? This is about preserving history, not preserving features in web browsers. Browser vendors can and should continue to remove support for Flash regardless of whether it's open sourced or not.
Plenty of people in game development used Scaleform and it's have much better compatibility than any open source Flash reimplementation while it's codebase is solid.