Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox makes click-to-activate Flash the default

support.mozilla.org

Post reply on HN
Print view View original

271–280 of 398 posts

Re: Firefox makes click-to-activate Flash the default

#271

Post by digi_owl »

marksc wrote: post #198

Mark from Mozilla here. To be clear, by "blocked" Flash we really mean enforced click-to-activate. User choice is always a #1 priority at Mozilla. We regularly block vulnerable plugins. What made this block different was that we did it before Adobe made an update available. Now that Adobe has released an update, it is no longer true that every version of Flash Player is blocked in Firefox. However, we're glad to see…

One slightly annoying thing i found right now is that if i have a plugin set as disabled in about:addons, it will not show up on the update checker found in the top link.

Re: Firefox makes click-to-activate Flash the default

#272

Post by TD-Linux »

ultramancool wrote: post #261
TD-Linux wrote: post #251

Earlier quoted context omitted.

I agree with a lot of this, but not turning off WebRTC in general. Certainly you should turn it off (or force TURN only) if you're trying to hide your IP behind a VPN. But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. I still think WebRTC enabling peer to peer connections is better than running all of your data through a th…

> But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. Extremely few people have active IPv6, it seems unlikely to catch on now. In addition to that, IPv6 privacy extensions may allow a solution to this problem for many users, but if their link local IPs are also published that may lead to further trouble, depending on configu…

>Extremely few people have active IPv6, it seems unlikely to catch on now.

Except that over 20% of the United States has IPv6 connectivity. In fact, you might be using it without knowing (most mobile providers have it now, in fact some use IPv6->IPv4 translation methods) [1].

>Remember though, this leaks all interface IPs

Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem.

[1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

Re: Firefox makes click-to-activate Flash the default

#273

Post by techwizrd »

farawayea wrote: post #205
marksc wrote: post #198

Mark from Mozilla here. To be clear, by "blocked" Flash we really mean enforced click-to-activate. User choice is always a #1 priority at Mozilla. We regularly block vulnerable plugins. What made this block different was that we did it before Adobe made an update available. Now that Adobe has released an update, it is no longer true that every version of Flash Player is blocked in Firefox. However, we're glad to see…

This is great. Let's continue: remove pocket, remove hello

Just out of curiosity, how will removing Pocket integration and Hello (a thin UI over WebRTC) personally? Both are lazy-loaded, so the only bloat they add is "visual bloat". This behavior is seriously disappointing from the Firefox community.

I've been using Pocket since it was Read It Later and I was pleased to see it integrated into the browser. Mozilla is working on a Reader mode[0] but it does not seem to be ready for public consumption yet (despite landing in 2012). Most people don't even know it exists, and it obviously does not save it for later (unless you bookmark it). The implementation is open-source (MPL license), although Pocket itself is proprietary. Hotword detection is not absolutely necessary for browser functionality, yet I hear no chorus of complaints from Chrome users. Should Mozilla be prohibited from partnering with proprietary third-parties whether or not it benefits their users?

Hello is even less of an argument. Firefox Hello is a simple Javascript UI for the existing WebRTC spec supported by Firefox, Chrome, and Opera[1]. It allows people to communicate without having to set up accounts, sign-in somewhere, and works against the platform lock-in of proprietary services such as Facetime, Hangouts, and Skype. If it's disabled by default, the service becomes useless. My parents shouldn't have to enable it about:config for me to talk to them, nor should they have to download another plugin to use a technology built-in to the browser. I understand the security implications[2] in IP leakage[3], but I don't see a simple fix that doesn't neuter the functionality (although this comes close[4]). W3C has stated their position on fingerprinting[5], but at least Mozilla is actively working on the issue.

0: http://www.ghacks.net/2015/02/07/mozilla-starts-to-push-read...

1: https://support.mozilla.org/en-US/kb/which-browsers-will-wor...

2: https://twitter.com/incloud/status/619624021123010560

3: https://bugzilla.mozilla.org/show_bug.cgi?id=959893

4: https://addons.mozilla.org/en-US/firefox/addon/statutory/

5: https://github.com/w3ctag/spec-reviews/blob/master/2015/05/f...

Re: Firefox makes click-to-activate Flash the default

#274

Post by throwaway2048 »

ars wrote: post #48
Aardwolf wrote: post #17

Earlier quoted context omitted.

I hope this will not make more content creators choose that annoying unity3D plugin thing that doesn't support linux for games.

> that doesn't support linux for games. There is support: http://pipelight.net/cms/installation.html For me on debian it was install and it worked without even restarting the browser.

this is not support, its basicly running the plugin inside wine, with all the attendant issues that invokes.

Re: Firefox makes click-to-activate Flash the default

#275

Post by agumonkey »

throwaway2048 wrote: post #269
agumonkey wrote: post #230

Earlier quoted context omitted.

What made Flash so fast ? was it direct unsafe access to the metal or was there some black magic in their code ?

actionscript (the flash programming language) is pretty much the same as javascript, the main reason why flash is often a lot faster than html+js things in a browser is it is not constrained to a slow, broken DOM for building uis.

I know but I would be very surprised if the DOM model was entirely responsible for the performance hit.

Re: Firefox makes click-to-activate Flash the default

#276

Post by nkurz »

I find "Click to Play" makes for a better browsing experience, and think this is a fine move for Firefox.

Interestingly, Google Chrome recently moved in the opposite direction, and removed support for having Flash off by default and activating with a single click. Instead, they consider Flash to be "important plug-in content". While they allow you to have it off by default, rather than "click to play", they now require that you right click then pull down to "run this plugin" each time you want to activate: https://productforums.google.com/forum/#!topic/chrome/xPcpRB...

I presume this is because they want to discourage people from having Flash off by default, since this would mean they would miss too many Flash ads. I took this as an opportunity to try out some different browsers, and found that Opera met my needs slightly better than Firefox. If you are looking for an alternative to Firefox or Chrome, or just want to see what's out there, you might want to check it out too: http://www.opera.com/

ps. As an example of the new Google interface strategy, to show all the responses on the Google Chrome Help Forum link above rather than being forced to click on each one, you can press the 'o' key some random number of times until they appear: https://productforums.google.com/forum/#!topic/gec-answers-f...

Re: Firefox makes click-to-activate Flash the default

#277

Post by grumblestumble »

JoshTriplett wrote: post #262
yarrel wrote: post #236

Earlier quoted context omitted.

Can you call for a formal EOL on HTML5 DRM as well, please?

As much as I'd like to see this, Mozilla doesn't have the necessary clout to do this when other browsers are adopting it.

The web has become an application delivery platform, like it or not. While there are arguments against forcing DRM on consumers, for video production workflows and project management, DRM is a necessity. I'm assuming you've worked with private Github repos with access control, right? Same idea.

Re: Firefox makes click-to-activate Flash the default

#278

Post by [deleted] »

mangeletti wrote: post #234
marksc wrote: post #198

Mark from Mozilla here. To be clear, by "blocked" Flash we really mean enforced click-to-activate. User choice is always a #1 priority at Mozilla. We regularly block vulnerable plugins. What made this block different was that we did it before Adobe made an update available. Now that Adobe has released an update, it is no longer true that every version of Flash Player is blocked in Firefox. However, we're glad to see…

Hi Mark, Do you have any interest an organizing an effort, along with Facebook's Alex Stamos and other folks, to plan a formal EOL for Flash? Of course, the steps Mozilla and others have taken help, but perhaps a more organized movement could get other thought and market leaders on board, trigger higher rates of HTML5 adoption and foster the bits of remaining innovation that are needed to fully replace Flash on the w…

[deleted]

Re: Firefox makes click-to-activate Flash the default

#279

Post by Animats »

mhurron wrote: post #232
ultramancool wrote: post #229

Earlier quoted context omitted.

Removing registration on Hello servers and WebRTC altogether is not stupid if you give a shit about your privacy, look at the leaks WebRTC provides, local IPs which are great for fingerprinting, real IPs from behind VPN, etc. It's one big gaping privacy nightmare so far, so it's pretty reasonable to have it disabled, until this gets sorted out at least. Fortunately it can be toggled off in about:config easily. Set lo…

It is getting annoying to have to go into about:config with every release to turn things I don't want off. Off should be default. Let those that want to use these features turn them on if they want. Or better yet, ship a damn extension.

Right. It's like the "just hit delete" line from spammers, and the invisible "x" boxes to reject "shared" posts in Facebook.

Firefox doesn't even predefine some of the things in "about:config" that need to be set to turn off some of these undesirable features.

There's IceCat, a GNU fork of Firefox without all the proprietary extensions.[1] It may start getting more traction as Mozilla puts more junk in the browser.

[1] http://www.gnu.org/software/gnuzilla/

Re: Firefox makes click-to-activate Flash the default

#280

Post by throwaway2048 »

agumonkey wrote: post #275
throwaway2048 wrote: post #269

Earlier quoted context omitted.

actionscript (the flash programming language) is pretty much the same as javascript, the main reason why flash is often a lot faster than html+js things in a browser is it is not constrained to a slow, broken DOM for building uis.

I know but I would be very surprised if the DOM model was entirely responsible for the performance hit.

it is by far the largest preformance drain in pretty much any dynamic website.
Post reply on HN