Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox makes click-to-activate Flash the default

support.mozilla.org

Post reply on HN
Print view View original

51–60 of 398 posts

Re: Firefox makes click-to-activate Flash the default

#51

Post by JupiterMoon »

magicalist wrote: post #43
hendry wrote: post #30

One option was to go down the Click-to-Play route which offers a HORRIBLE UX. Especially on Youtube which still uses Flash by default. Disabling Flash however, Youtube actually seamlessly falls back to HTML video. Well done. But I can't help but think, outside the Youtube world (BBC for e.g.). LOTS is going to break. I wouldn't take this tact with my parents or clients.

> Especially on Youtube which still uses Flash by default No since January[1]. Maybe you have an old cookie set or something? [1] http://youtube-eng.blogspot.com/2015/01/youtube-now-defaults...

If you disable Flash completely then Youtube works fine with HTML5 video. However, when Flash is set as click to play then Youtube still prompts to enable Flash. Annoying.

Re: Firefox makes click-to-activate Flash the default

#52

Post by [deleted] »

velcro wrote: post #42

Bugs are always bad (and security bugs even more so) - but I've always felt that Flash gets a disproportional amount of hate/hype in the media. To some degree it should be normal that the more widespread a technology is - the more it gets targeted for security exploits. If you run the popular browsers/plugins against the National Vulnerability Database, you'd get the following results (as of January 2014): - Internet…

[deleted]

Re: Firefox makes click-to-activate Flash the default

#53

Post by billpg »

AndrewDucker wrote: post #47

I have that setting already set - Flash is set to "Ask to Activate", which means it only runs on sites that I actually want it to run on. Which prevents a lot of autoplaying videos, and also pages sometimes taking a long time to load on slow connections.

They've implemented "ask to activate" badly by making it cover the whole page instead of per-element. They did it the right way in the past.

https://bugzilla.mozilla.org/show_bug.cgi?id=886792#c41

Re: Firefox makes click-to-activate Flash the default

#54

Post by vog »

TD-Linux wrote: post #41
vog wrote: post #27

Earlier quoted context omitted.

Good catch. So replacing "HTLM5" with "video codes", this may have a point. But I'm still wondering, as we have very good decoders from projects like FFmpeg and VLC. (Not sure which of all those decoders are used by Firefox.) These are platform independent and to my experience better than the platform specific libraries. For example, I often hear that people install VLC under Windows because it decodes lots of video…

Firefox can actually use ffmpeg as a decoder. It would be a great option for supporting a lot of these formats. However, Mozilla can't ship it enabled, because the patent problem is very real. See, for example, all of the Play Store apps that got C&D letters from Dolby for using ffmpeg's implementation of AC3. Firefox does ship a lot of other video and audio codecs though, such as vorbis, opus, theora, vp8, and vp9.…

> However, Mozilla can't ship it enabled

Just a minor nitpick: Under Linux, people don't download from Mozilla but have it installed by default. If not, they install via package manager and not via download from Mozilla.

So it's not Mozilla making that decision, but the respective Linux distros. But of course they have the same problem.

I believe a good compromise would be to check if ffmpeg is installed on the system, and use it only when available. So the user would have to install ffmpeg directly.

That would be a very different situation from including code from ffmpeg directly into some app.

Re: Firefox makes click-to-activate Flash the default

#55

Post by JupiterMoon »

viraptor wrote: post #7
w342 wrote: post #5

Linux still struggles with HTML5 and flash

Flash - sure, since Adobe doesn't really care that much. But HTML5? That's in browser's hands and support depends on your browser choice only. Did you mean any specific codec for video playback, or something else?

EME is not present on Linux yet I think. I don't really mind this however it does mean no Netflix without Google Chrome..

Re: Firefox makes click-to-activate Flash the default

#56

Post by rplnt »

orf wrote: post #36

I uninstalled Flash about a year ago and haven't looked back since. Funnily enough only Facebook used to give me issues.

I have Chrome with flash installed (not that it gave me any choice), but other than that I haven't had flash for maybe two years. If I need to play Flash, I just open Chrome for that. Facebook is one of the last common offenders with its flash videos on desktop version. I can't comprehend why...

Re: Firefox makes click-to-activate Flash the default

#57

Post by JonAtkinson »

HugoDaniel wrote: post #32

Unfortunately in this case avoiding the problem won't make it go away. Many old sites will stop working (my first site was done in flash) as well as many games that are still heavily played today by millions of people. Also flash IDE provides a good introduction to programming for self-taught kids these days: many of them still do their first code in flash after clicking on "that strange icon next to photoshop". Over…

> We need a real open-source alternative to flash player.

We quietly built the alternative to Flash over the last 10 years. It's called the web.

A standard document in the web browser can play audio, video, display vector graphics, utilise OpenGL, supports direct drawing via Canvas, and it is deeply scriptable with a mature, open programming language.

What else do you need?

Re: Firefox makes click-to-activate Flash the default

#58

Post by onion2k »

velcro wrote: post #42

Bugs are always bad (and security bugs even more so) - but I've always felt that Flash gets a disproportional amount of hate/hype in the media. To some degree it should be normal that the more widespread a technology is - the more it gets targeted for security exploits. If you run the popular browsers/plugins against the National Vulnerability Database, you'd get the following results (as of January 2014): - Internet…

So Flash is second in terms of number of high severity bugs and first in terms of the percentage of bugs that are high severity, only being beaten by Internet Explorer. By your evidence the hate for Flash is quite justifiable.

Re: Firefox makes click-to-activate Flash the default

#59

Post by fuzzix »

JonAtkinson wrote: post #57
HugoDaniel wrote: post #32

Unfortunately in this case avoiding the problem won't make it go away. Many old sites will stop working (my first site was done in flash) as well as many games that are still heavily played today by millions of people. Also flash IDE provides a good introduction to programming for self-taught kids these days: many of them still do their first code in flash after clicking on "that strange icon next to photoshop". Over…

> We need a real open-source alternative to flash player. We quietly built the alternative to Flash over the last 10 years. It's called the web. A standard document in the web browser can play audio, video, display vector graphics, utilise OpenGL, supports direct drawing via Canvas, and it is deeply scriptable with a mature, open programming language. What else do you need?

Copy to clipboard, apparently.

(Github project pages have a flash application to handle this)

Re: Firefox makes click-to-activate Flash the default

#60

Post by stevenh »

velcro wrote: post #42

Bugs are always bad (and security bugs even more so) - but I've always felt that Flash gets a disproportional amount of hate/hype in the media. To some degree it should be normal that the more widespread a technology is - the more it gets targeted for security exploits. If you run the popular browsers/plugins against the National Vulnerability Database, you'd get the following results (as of January 2014): - Internet…

Remote code execution exploits were found in Firefox at least once per month during the first half of 2015. The only reason we didn't hear about these cataclysmic exploits is because it wasn't Flash.

January 20, 2015: https://community.rapid7.com/community/metasploit/blog/2015/...

February 25, 2015: https://msisac.cisecurity.org/advisories/2015/2015-018.cfm

March 1, 2015: https://www.mozilla.org/en-US/security/advisories/mfsa2015-3...

April 22, 2015: https://msisac.cisecurity.org/advisories/2015/2015-046.cfm

May 12, 2015: https://www.mozilla.org/en-US/security/advisories/mfsa2015-5...

Hackers search for remote code execution exploits in Flash first and foremost because they know a successful Flash exploit will reach the highest number of targets (90% or more on the desktop) whereas only 44% of desktop machines are running Chrome and 15% are running Firefox.

Hackers seeking out and exploiting RCE bugs in Firefox is unheard of for the same reason malware targeting Macs has been virtually unheard of over the past decade: It's not that OS X is more secure; it's simply that Windows is a more lucrative target.

Post reply on HN