Hacker News Reader

Comment by M4v3R | Hacker News Reader

I strongly disagree that the only reason Flash died was Steve Jobs/Apple's personal vendetta against it. Sure, it might've played a part, but as other commenters already pointed out Flash was riddled with problems - it was a resource hog, the macOS implementation was buggy and slow and Adobe seemed to not care about fixing these problems, and it had a very bad record of security holes. Plus it was closed source and the format itself was undocumented.

I can see how all the aforementioned problems made it so Apple didn't want to include it on its mobile devices. And even if politics played some part in it, these problems made it easy for Apple to convince everyone else that retiring Flash is the right thing to do.

View on HN

> the macOS implementation was buggy and slow

This is actually another lie that has somehow been retconned into the collective narrative. Baffling.

I was a professional Flash developer at the time, working for brands like Nike and Johnson & Johnson. We as an industry used Apple almost exclusively. This was not a common observation until after "Thoughts on Flash"

(Most?) Flash apps didn't adjust for responsive web. It was also full of security issues. Most flash applications were running at a certain FPS, instead of reacting to UI changes/redrawing. Flash was nice for games, but for the rest is was a pain in the butt.

Also, look at how slow Adobe is in keeping things updated for newer platforms. I'm happy flash is dead, and I hope creative suite will follow.. Probably not though.

> Flash apps didn't adjust for responsive web

This was 2009. "Responsive layout" was barely a concept. Most HTML/CSS websites didn't have responsive layout. We were still figuring out all out.

Maybe it was not called "Responsive layout", but it was a thing since 2004: https://www.themaninblue.com/writing/perspective/2004/09/21/

Flash was as bad as Java Applets. They both tried to solve problems that couldn't be done with standard web technologies at the time. They both needed extra plugins so they could work... while everything else just works in the browsers. They have no place in web development.

Maybe not responsive, but definitely fluid design.

If by "responsive layout" one means adapting to the size of the browser window, and not specifically adapting to mobile screens, then it was fairly common in 2009. And even earlier - we just did it with tables in late 90s and early 00s.

It is also true that the vast majority of web pages done in Flash did not do it.

At the time, (most?) websites didn't adjust for responsive web either. There's nothing inherent about Flash that made it impossible to support responsive layouts with it. In fact, if anything, developing with Flash gave you more control over positioning than html/css did at the time.

Sure, there were downsides to Flash. It's true that many Flash-based apps/websites used more battery power than html/css stuff. But I'd argue that this is an indicator that there is a demand for rich content on the web. Since Flash was killed, we've seen a resurgence of all kinds of heavy JavaScript libraries, and forums like hackernews are full of people complaining about websites being sluggish and slow to load because of the amount of js that's being injected. Well guess what - now we've just replaced Flash with a fragmented open landscape.

Is it better? Maybe - to a degree the openness of html/css/js is good for obvious reasons. But to be honest, I think the web still hasn't recovered from the blow Apple gave to the creative ecosystem that had been built up around Flash, because there still isn't a similar tool that allows you to easily build web-based rich, interactive experiences, full of animation and rich graphics, the way Flash did about 15-20 (!) years ago

Maybe you have a bias since you worked with flash.

As a flash consumer from 2001-2011 I must tell you that honestly; flash was fucking painful.

Run a very weird binary blob riddled with security holes and questionable browser integrations or suffer.

Yes, some things became possible (habbo hotel, flash games, video/audio before browsers supported it) but it wasn’t worth it. I very much wanted flash to die by 2006 and ran a lot of extensions to bypass flash on Linux such as the “HTML5 everywhere” browser add on that tried to force YouTube to use HTML5 video (with mixed results).

I think anyone looking at flash now is romanticising the past. It was the least enjoyable thing about web browsing in the 00-s

> "riddled with security holes"

There it is again! That specific phrasing. Curious. [1]

> "flash on Linux"

Yes, Flash on Linux sucked. We're talking about macOS, and it did not suck on macOS.

> Maybe you have a bias since you worked with flash.

Oh, absolutely. I chose to work with Flash because it was great! But that's not really germane. I would not have wanted to work with Flash if it sucked on Apple, since that was the platform I used at the time.

[1] https://news.ycombinator.com/item?id=30585649

Riddled is pretty common verbiage for native English speakers when something is heavily afflicted with something which is probably why you’re seeing it everywhere.

“Riddled with holes” is the original phrase, usually when referring to worn out clothing or something which has been damaged with many punctures.

It’s not a conspiracy or a retcon. I think I have tweets from this period where I was extolling my frustration with YouTube specifically for requiring flash.

To be fair I didn’t use Apple computers in that era so you could be right; but I did use Windows and Linux and Linux was by far the least favoured by adobe, but it still wasn’t pleasant on Windows.

I bought my first MacBook in 2011 and flash was already dead by then.

I disagree that it's a common phrase. It's used primarily when talking about cancer or infestations. It is almost never used in any engineering context. Except when people speak about Flash. You don't find that odd at all?

That you don't use the word doesn't mean no one does. There's no grand conspiracy here.

It's not about my using that phrase. It's about how often it's used and in what context.

It's inevitable when talking about Flash, but not, say, Windows, or other contexts with security vulnerabilities. Always "Flash" specifically "riddled".

I have used “riddled with problems” and “riddled with security holes” to talk about other software than flash.

I just googled the phrase:

https://www.computerweekly.com/news/252512175/Investigators-...

https://blog.avast.com/aws-freertos-riddled-with-security-vu...

https://www.zdnet.com/article/hola-vpn-still-riddled-with-se...

https://securityinfive.com/episode-659-tiktok-riddled-with-s...

https://www.computerworld.com/article/2490527/many-antivirus...

It’s a common phrase, not a conspiracy.

It's incredibly common.

I find your interpretation odd. I use the term "riddled with bugs" in software engineering regularly.

It might not be common vernacular in your neck of the woods, but it is where I'm from.

I’ve refused the phrase “riddled with security bugs” to describe XML parsers.

>I think anyone looking at flash now is romanticising the past. It was the least enjoyable thing about web browsing in the 00-s

The least enjoyable thing about web browsing in the 00-s was javascript. Pop-up windows, window resizing, stealing focus. Now javascript is still the reason web sucks. And security has not improved much.

> And security has not improved much.

What?!

Modern browser security has gotten orders of magnitude better since Shockwave Flash was removed from web browsers. The sheer unending volume of security vulnerabilities flash introduced into browsers was staggering. Flash (until very near the end of its life) had no sandboxing, and had its own update mechanism. It was the norm for people to be running old versions of flash with unpatched security holes. And flash had so many vulnerabilities - if memory serves, flash generally fielded more CVEs in any given year than the entire rest of the browser!

Remember how revolutionary pwn2own was? "Wow, find a vulnerability and win $1000!". These days vulnerabilities of that magnitude are worth way more money, because of how secure the browser environment has become. ($100k-$1M on the black market as I understand it.)

The only reason it feels like security hasn't improved much is because crypto ransomware has made hacking so much more profitable. But even then, most randomware doesn't usually take advantage of security vulnerabilities in web browsers. Its really quite remarkable how secure the modern web has become; and that wouldn't have been possible if flash were still around.

> Remember how revolutionary pwn2own was? "Wow, find a vulnerability and win $1000!". These days vulnerabilities of that magnitude are worth way more money, because of how secure the browser environment has become.

Theses amounts were low because there was no interest in rewarding white hat hackers sadly. Bug bounties at the time were extremely rare. It wasn't lower because it was easier (though it may have been easier, not arguing it wasn't, just that the amounts are not evidence of it).

> ($100k-$1M on the black market as I understand it.)

On the "white" market you means. Zerodium is paying theses amounts. I don't feel like it would be higher in the black market than what they are offering, but could be.

Speaking of which, in 2020 Zerodium stopped accepting "Apple iOS LPE, Safari RCE, or sandbox escapes" for a few months because there was too many of them... still no "Thought on iOS" yet... It's not like it's even a new thing, I remember a long time ago when you could jailbreak your iPhone using a website directly.

Didn't even need to go far either... check CVE-2022-22620, only a month ago.

Who are you to decide if it was worth it or not ? Tons of humans had a really good time and memories on e.g. Habbo. That alone makes it entirely worth it.

Sorry. I should have clarified maybe.

When I say “was not worth it” I am implying that it was not worth it for me.

That I often didn’t enable flash even if I did enjoy some of the things flash provided.

I still firmly believe that we have much less energy consumptive software since flash died, I recently brought back some old /f/ content from 4chan and ran a flash emulator written in rust and it crippled my laptop, so it hasn’t improved a whole lot.

I hated it so much and it was so forced upon me that I am finding it extremely hard to have sympathy for you.

> Flash was riddled with problems - it was a resource hog, the macOS implementation was buggy and slow and Adobe seemed to not care about fixing these problems, and it had a very bad record of security holes

Yeah, see this? This "riddled" word? That's how I know you're just repeating what you read. It's a tell.

Jobs + Wired + Gawker + Apple made an incredibly strong conceptual gravity well that makes conversation about this difficult. They all use this "riddled with security holes" phrasing. It's like you just repeated "No, you don't understand. Brawndo is what plants crave."

What security holes? Specifically? Were they more serious than any browser?

https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...

https://www.cvedetails.com/vulnerability-list/vendor_id-49/p...

During this conversation, someone inevitably posts this without comment, as if it is a rhetorical slam-dunk.

Could you expand on this? Your point is the Flash had vulnerabilities?

What software doesn't? https://www.cvedetails.com/product-list/vendor_id-1224/Googl...

Remember, Jobs' contention was that Flash's problems were inherent. Can you support that?

Compare Flash to Safari then: Flash is a comparatively small VM runtime and vector graphics engine while Safari is a whole browser, which has a much larger attack surface. And Safari, despite its increased complexity, had about the same amount of reported vulnerabilities around 2010:

https://www.cvedetails.com/product/2935/Apple-Safari.html?ve...

So, objectively, Flash did have very persistent security issues.

"Comparatively small" is doing a lot of lifting, there. What about Flash was "comparatively small" compared with Safari, and why does that let Safari of the hook for its vulnerabilities compared with Flash?

I spelunked through the Firefox source code about 10 years ago.

A modern browser is an amazingly complex piece of software. A gazillion parsers with the ability to handle malformed content that should give anyone nightmares. Multiple JITs and interpreters. Layout handling with incremental grid calculation algorithms that gave me vertigo - before I understood that it was done asynchronously.

There is no way in hell flash is anywhere near as complex.

Your "no way in hell" is not really an answer, and any response will just devolve into "Uh huh!" "Nuh uh!"

Browsers now are very complex. At the time, we were still dealing with IE6 and JavaScript 3.

Flash could do literally everything that browsers at the time did, and more. Load and display multimedia files, animate them, interpret ActionScript, and do it cross platform, cross browser, in a performant, relatively secure manner.

You compiled to flash. Content served that were run by the flash runtime were valid or didn't work at all. The amount of code dealing with malformed content in browsers is staggering. A browser deals with everything that flash did, but in more complex ways, while also doing a LOT more.

"No well in hell" is a very good answer. Just the HTML DOM and layouting code in KHTML before it was forked into WebKit was an enormously complex piece of code. Then there is the JS implementation (including compiler - JS gets transferred as source code), the SVG DOM and renderer and other goodies that were integral parts of browsers already back then that I'm probably not thinking about.

Just adding to this: the attack surface of a web browser is humongous compared to that of a relatively small runtime, even in 2008. In 2011 when I had a look through the FF codebase, there were already 2 JITs for JavaScript, one which had been in for years (but I don't remember if it was in use).

On the other hand, flash was being used by everyone, windows, mac, linux, mobile... Safari was just being used by mac users. Les users, less bugs found.

Compare apples with oranges. Flash is a program, safari is an operating system.

So, you will ask for citations and then rip them apart because “every piece of software is vulnerable”?? If you don’t like what you get, why did you ask for it?

At first, you were merely overly aggressive. But this is turning into bullying.

Security issues? Yes, there were 0days after 0days. Adobe kept pushing updates, but users were often lagging behind. Researchers continually found new vulnerabilities.

Browsers weren't as sandboxed and hardened as they are today, and flash plugged directly into them.

Flash was one of the most used vectors for adware, all you had to do was visit some shady website.

> 0days after 0days

[Citation needed]

Here you go

https://www.zero-day.cz/database/?set_filter=Y&arrFilter_pf%...

Good citation. :)

100% of all zero-day vulnerabilities from 2008-2022 are due to Adobe?

Let's look at the entire context.

https://www.zero-day.cz/database/?set_filter=Y&arrFilter_pf%...

No, I was filtering on Adobe so you could easily see all Flash zero days.

One in twelve of all security issues—in a period that begins when Flash was already on the decline and extends far beyond when Flash was at all relevant—were caused by a single web browser plugin and you're trying to handwave that off as not a big deal? Adobe has the highest percentage of exploits listed there for any company that is not an OS vendor, and Flash has the most of any single product that is not Windows (in an era when XP was still supported!) or IE (which it ties with).

And, yeah, Flash did suck as an end-user experience. For a few years it seemed like every restaurant in existence had an all-Flash web presence, and, no, waiting for endless animations while wading through some entirely non-standard "rich media" experience, while listening to my laptop fans kick into overdrive, did not "surprise and delight" when I was just trying to find their hours and a menu. It was absolutely infuriating.

This is ignoring that one of the major malware vectors that wasn't a zero-day at the time was to just put up a webpage claiming that Flash was out of date, and then linking a fake updater. Sure, that wasn't entirely Adobe's fault, but if they'd done a better job of keeping it up to date on their own it would have been an awful lot less believable to end users.

Riddled is a common word that native English speakers tend to use. It’s not a tell.

Your aggression, on the other hand, is uncommon. It is a tell.

Sorry. Not intending to be aggressive. That's me being weirded out, not intentionally aggressive.

As a native English speaker, I can assure you it's not a common technical term at all. It's a poetic phrase, designed to elicit thoughts of illness and damage. A house can be riddled with termites, a body can be riddled with cancer, a bridge can be riddled with rust. But Flash, uniquely, is "riddled" with security holes. No one says that about Windows.

As an engineer, I hear it used all the time in contexts outside of Flash. It's extremely common.

Getting “riddled” specifically means to get holes put in you, as in with bullets. It’s a very fitting term for having lots of security holes.

Strange, I googled “windows riddled” (without quotes - try it). This was the first result:

https://answers.microsoft.com/en-us/windows/forum/all/why-is...

“Why is Windows 10 riddled with so many bugs and the updates make matters worse?”

It’s likely time to admit that you’re wrong. Riddled is a word, the meaning fits and people use it to describe software.

> Jobs + Wired + Gawker + Apple made an incredibly strong conceptual gravity well that makes conversation about this difficult.

I never, ever, read the Jobs manifesto against flash. Never cared to read any article about flash back in the day and I absolutely dreaded opening a website that used flash.

It was a guaranteed loading times on my bad internet, followed and/or preceded by a notice saying that I needed to install this crapware or update it. Not to mention my numerous crashes directly related to an unresponsive flash application.

But as you clearly wrote somewhere on this thread, this was probably due to me using windows and most flash devs using macOS.

As someone who just learned about jobs hate to flash and never touched on a MacBook in his life. I’m extremely happy this technology belongs to the past.

>it was a resource hog

Well, it had the ability to be one if a shade tree programmer didn't garbage collect their assets. Something that could easily be tested in an app platform. You could make amazing games that used only a few megs of RAM, or you could make a crappy app that hogs hundreds.

Reply on news.ycombinator.com