Mozilla may make Flash click-to-play by default in future Firefox

I welcome this move, despite the possibility of some fallout from the change. It'll be painful, but even as someone who once made a living writing ActionScript, I have to say that Flash is sufficiently annoying and insecure that it really needs to be phased out.

In the short term, this will probably cause some breakage in certain sites that try to use Flash "transparently" and "unobtrusively" for things like LSOs, drag-and-drop, clipboard access, or cross-domain XHR. These are already problematic with Flashblock installed though -- Pandora, for instance, refuses to load and there is nothing available to click-to-play since that particular Flash object is hidden.

Hopefully this will light a fire under those sites and get them to update to the appropriate HTML5 methods of doing these things (local storage, WebSockets, etc.), just like how Java applets that were used for such things have been largely phased out. Until then, however, I wouldn't be surprised if some of them simply inform you not to use Firefox to visit.

I am so happy that I can barely contain myself. Hopefully this means Flash will now be used for important things, instead of shoving ads in my face that I can't dismiss, and follow my scroll bar.

The problem is some uses of flash doesn't put any flash controls on the webpage. Mainly for audio related uses, like audio players (mixcloud), or games (since html5 audio still has some work to be done). Chrome gets around this with an icon in the urlbar, and an option "Run all plug-ins this time". If firefox wants to make click-to-play the default option, I don't think this is going to cut it. The only two options they have are to only click-to-play visible plugins (but this is really hard to detect), or give a popup. The popup might work for most users, but some are just going to get confused. In fact, I don't know if most users will read the place-holder for click-to-play in general, or just go "why isn't youtube working".

Oh man, bad memories. I used to get so frustrated with Internet Explorer* for doing this about 7 years ago. I was young then, 12 or 13, and had just gotten Flash for my birthday. I know it had to be 2004 or 2005 because the version was Flash MX 2004. I was young enough and it was long enough ago that I think I was using Internet Explorer primarily, and got terrible frustrated when they started using this default click-to-play behavior on my Flash creations. How dare they! It took me long enough to figure out how to embed them (I remember I tried using the <img src="" /> tag with a .swf file. HAHA!)

It was something to do with an "ActiveX control," I don't remember anymore. But you should have seen how angry it made 13-year-old-me, because my loud, annoying Flash creations had to be allowed their obnoxiousness by every user. Anyway, the point is I approve. :)

* I'm pretty sure it was IE, could be remembering wrong.

This is great, really, but I'd like to see something more aggressive:

Non-foreground tabs should be completely suspended - plugins, JavaScript, media, you name it - unless they specifically request and are granted permission to run in the background.

Very good Idea I think. Flashblock is one of the most useful plugins to me right now. Although I think that mozilla will definitely have to implement a very easily accessible whitelist to go along. Otherwise, it will become slightly annoying for people with slow internet connections who rely on loading e.g. loading videos while surfing in another tab and the like.

Not just flash, all plugins, which is a good security idea, considering how Microsoft likes to slip in theirs via windows update.

I see the setting in FF12b5 but not sure if it works yet.

Adobe has proven time and again that they cannot produce secure software. Down with Flash, and down with Reader. These two pieces of software seem to be responsible for millions of malware infections and thus tons of spam and fraud online.

The world would be a better place without these two Adobe products. Their /content production/ software is amazing, and they should just stick to that IMO.

I am quite pleased with this idea. This is what NoScript does by default and pages load noticeably faster. In requiring flash objects to be clicked first provides a increased protection against the all too common Flash zero day exploits.

This is the original blog post that I wrote in case you are interested: http://msujaws.wordpress.com/2012/04/11/opting-in-to-plugins...

I didn't know Chrome already had the option to do click-to-play until I read this. Very cool, I'm turning it on now.

As a Flashblock user, I love the idea.

I rock click-to-play for plugins in Chrome and it's extremely helpful for browsing speed and enjoyability. No more playing "Which window is that sound coming from?". That said, there are definite usability problems with the current chrome implementation that I hope FF improves on. I'd like a "Load all requested plugins for this page" button. Or a whitelist maybe.

Great move. I am reminded of Apple's recent Java update[1], which turns Java off by default, and disables it again after a period of disuse. It moves the security threat into phishing rather than drive-by territory, a definite improvement.

[1] http://news.ycombinator.com/item?id=3834267

i would go one step further and disable all auto-play for audio and video. not just flash, but html5 as well.

if there is some audio or video designated to play onLoad, notify user and have them click ok/prevent/mute...etc. it might make for some no-so-seamless experiences, but the alternative it 90's style animated gif annoyances on spam sites etc..

I think the real benefit here would be to block java plugins automatically. The current implementation blocks both (to the best of my understanding).

Not automatically loading java would be a great benefit to the majority of users. Its not used on nearly as many websites yet it is responsible for the lion's share of current security exploits.

Didn't IE try this and developers got around it by using Javascript to embed flash?

http://www.computerworld.com/s/article/9046245/Microsoft_dro...

Turns out Microsoft did it because of patent issues.

Make this the default behavior if you want, but add a configuration option to change it.

In my opinion, there should always be a configuration option associated to a new feature/behavior like this!

Because in the end that's why I still use Firefox : I can configure it like I want!

Is this going to break (or make more annoying) all of the things which use zeroclipboard[1] to copy something to the clipboard?

1. http://code.google.com/p/zeroclipboard/

Firefox would lose a lot of users if they did this. There are a lot of people who don't understand plugins and they would probably just find this feature to be annoying and use IE or Chrome instead.

On a side note: is there an opensource browser who doesn't let a flash video/embed to steal keyboard focus? I tend to use the kb heavily for navigation and this behaviour is frustrating.

This should be done for all kinds of animation like gifs, canvas and whatever comes next in the future.

Animated ads are the second most annoying thing on the web after embedded background music.

Here's another suggestion: how about an invisible "volume bar" that shows itself in each tab that is currently playing music?

This feature, although turned off by default, has been available in Opera for some time now. I quite like it.

Great idea. Opera browser made this a long time ago. The innovator that everybody else copies.

Great! I'm just wondering why it took them so long: Opera has had this built-in for ages.

Does that mean random websites would no longer scream "Congratulations, youve won!!"?

This should be default on every browser but hey, we'd kill flash banners this way.

I already have to click to enable Flash on my Firefox whenever I use Tor. :)

How does this affect adverts?

Nice move, appreciated!

For my money, they oughta make Canvas click-to-play as well, since the rendering speed in Firefox is unbelievably slow and the javascript behind it is so frequently written to hog up 100% of the CPU it's hard to even know what you're looking at if you accidentally stumble across an HTML5 page in Firefox, before your system grinds to a complete halt. It's funny how people blame Flash for slow websites when what they should really blame is bad coding practice, which can just as easily show up in JS (and does). To take it further, it's pretty rare for Flash code to bootstrap a huge set of libraries to do some petty effect - and if it does, the plugin doesn't freeze the browser preload while waiting on them. Whereas a 150k JS file that includes jquery and a bunch of other junk which probably isn't necessary (but makes coding some effect that much easier for bad programmers) can bring a website to its knees before the first line of text is delivered in the browser.

Again, don't blame the tools; blame the tools who use them.

Awesome. I hope the old adage good product wins is really true in the browser world. It was quite a trick to grab market share against IE back in the day, but now they are up against the google cash machine paying Adobe/Avast/ Real/etc. $3/download for chrome. Hard for the little non-profit that could to compete against that. We'll see.

Did anybody notice that this feature is already available (off by default) in Firefox 11 stable?

I hope they don't turn it on, or advertisers will move away from Flash to Canvas.