Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox makes click-to-activate Flash the default

support.mozilla.org

Post reply on HN
Print view View original

311–320 of 398 posts

Re: Firefox makes click-to-activate Flash the default

#311

Post by Manishearth »

[deleted] wrote: post #300
brighteyes wrote: post #291

Earlier quoted context omitted.

They have already said that after the feedback they will make pocket into an addon (installed by default but easily removable like any addon).

[deleted]

Data doesn't go to pocket until you start using it, and even then, you have to click through a few pages to get there. Pages which make it abundantly obvious that its a third party service.

Mozilla did user testing before integration and found that people do want it. Remember that techies complaining on HN doesn't mean that the majority doesn't like it.

It's not different from the privacy implications of having Google/Yahoo as a default search provider. It's a nice feature that (very visibly) uses a third party service instead of being part of Firefox Accounts.

Re: Firefox makes click-to-activate Flash the default

#312

Post by Manishearth »

mhurron wrote: post #232
ultramancool wrote: post #229

Earlier quoted context omitted.

Removing registration on Hello servers and WebRTC altogether is not stupid if you give a shit about your privacy, look at the leaks WebRTC provides, local IPs which are great for fingerprinting, real IPs from behind VPN, etc. It's one big gaping privacy nightmare so far, so it's pretty reasonable to have it disabled, until this gets sorted out at least. Fortunately it can be toggled off in about:config easily. Set lo…

It is getting annoying to have to go into about:config with every release to turn things I don't want off. Off should be default. Let those that want to use these features turn them on if they want. Or better yet, ship a damn extension.

You don't have to. Drag it off using the customize button.

These things are lazy loaded and wont run until you turn them on. No footprint when they're off the UI (minimal footprint when they are on)

Re: Firefox makes click-to-activate Flash the default

#313

Post by gmurphy »

nkurz wrote: post #276

I find "Click to Play" makes for a better browsing experience, and think this is a fine move for Firefox. Interestingly, Google Chrome recently moved in the opposite direction, and removed support for having Flash off by default and activating with a single click. Instead, they consider Flash to be "important plug-in content". While they allow you to have it off by default, rather than "click to play", they now requi…

Chrome moved to context click + menu because left click is clickjackable, so doesn't help very much with the security issues.

Re: Firefox makes click-to-activate Flash the default

#314

Post by Manishearth »

pjc50 wrote: post #238
ultramancool wrote: post #229

Earlier quoted context omitted.

Removing registration on Hello servers and WebRTC altogether is not stupid if you give a shit about your privacy, look at the leaks WebRTC provides, local IPs which are great for fingerprinting, real IPs from behind VPN, etc. It's one big gaping privacy nightmare so far, so it's pretty reasonable to have it disabled, until this gets sorted out at least. Fortunately it can be toggled off in about:config easily. Set lo…

Does Firefox Hello do registration if you never click the Hello button in a particular session?

Hello does nothing until clicked

Re: Firefox makes click-to-activate Flash the default

#315

Post by ultramancool »

technofiend wrote: post #303
ultramancool wrote: post #261

Earlier quoted context omitted.

> But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. Extremely few people have active IPv6, it seems unlikely to catch on now. In addition to that, IPv6 privacy extensions may allow a solution to this problem for many users, but if their link local IPs are also published that may lead to further trouble, depending on configu…

Are you aware IOS 9 will prefer IPV6 by default? And that many browsers already have a "Happy Eyeballs" Implementation? https://en.wikipedia.org/wiki/Happy_Eyeballs IPV6 isn't going anywhere: IPV4 exhaustion is a real concern and with the internet / internet of things growing, the only place to grow is really the IPV6 space. NAT only delayed the inevitable. See here - https://ipv6.he.net/statistics/ - for current sta…

Yeah, I know, many OSes do already prefer it by default. I see more pushes for CGN than I do for IPv6 as a solution to IPv4 depletion though, it just seems dead in the water, in my country at least. Maybe your ISPs are better, but no locally available ISP will offer me native v6, it's either real v4 or CGN v4.

Re: Firefox makes click-to-activate Flash the default

#316

Post by Manishearth »

nkurz wrote: post #276

I find "Click to Play" makes for a better browsing experience, and think this is a fine move for Firefox. Interestingly, Google Chrome recently moved in the opposite direction, and removed support for having Flash off by default and activating with a single click. Instead, they consider Flash to be "important plug-in content". While they allow you to have it off by default, rather than "click to play", they now requi…

I've been click to play on Firefox for a long time now. Faster, less annoying ads (I am okay with nonannoying ads; they help pay for the site), and sites rarely need flash anyway. I think only Gmail and github (for click to copy) need it

Re: Firefox makes click-to-activate Flash the default

#317

Post by ultramancool »

TD-Linux wrote: post #272
ultramancool wrote: post #261

Earlier quoted context omitted.

> But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. Extremely few people have active IPv6, it seems unlikely to catch on now. In addition to that, IPv6 privacy extensions may allow a solution to this problem for many users, but if their link local IPs are also published that may lead to further trouble, depending on configu…

>Extremely few people have active IPv6, it seems unlikely to catch on now. Except that over 20% of the United States has IPv6 connectivity. In fact, you might be using it without knowing (most mobile providers have it now, in fact some use IPv6->IPv4 translation methods) [1]. >Remember though, this leaks all interface IPs Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. T…

> Except that over 20% of the United States has IPv6 connectivity.

The entire rest of the world has near-zero, just look at your own link. I'm in Canada and we have 0.55% here. No local ISP will offer it to me, and the one that did withdrew it completely last year. So perhaps I'm just slighted. There are a few other countries with 5%+ but it still makes up only a very small percentage of internet users. To top it off, while there has been some IPv6 adoption in the US, CGN has also caught on pretty heavily all over the world and seems to be, sadly, the solution most ISPs will actually go with for the near term at least.

> Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem.

https://diafygi.github.io/webrtc-ips/ is able to immediately reveal all the VM interfaces on my system even with no VMs using them. I suspect this is done so that faster routes may be established, but it is indeed a major problem for anyone who doesn't like fingerprinting.

Re: Firefox makes click-to-activate Flash the default

#318

Post by cpeterso »

digi_owl wrote: post #271
marksc wrote: post #198

Mark from Mozilla here. To be clear, by "blocked" Flash we really mean enforced click-to-activate. User choice is always a #1 priority at Mozilla. We regularly block vulnerable plugins. What made this block different was that we did it before Adobe made an update available. Now that Adobe has released an update, it is no longer true that every version of Flash Player is blocked in Firefox. However, we're glad to see…

One slightly annoying thing i found right now is that if i have a plugin set as disabled in about:addons, it will not show up on the update checker found in the top link.

The (unprivileged) Plugin Check website can't detect disabled plugins because they don't show up in navigator.plugins. Ideally, Plugin Check should be an automatic check built into Firefox. The advantage of the Plugin Check website is that it works in any browser.

Re: Firefox makes click-to-activate Flash the default

#319

Post by msujaws »

Manishearth wrote: post #316
nkurz wrote: post #276

I find "Click to Play" makes for a better browsing experience, and think this is a fine move for Firefox. Interestingly, Google Chrome recently moved in the opposite direction, and removed support for having Flash off by default and activating with a single click. Instead, they consider Flash to be "important plug-in content". While they allow you to have it off by default, rather than "click to play", they now requi…

I've been click to play on Firefox for a long time now. Faster, less annoying ads (I am okay with nonannoying ads; they help pay for the site), and sites rarely need flash anyway. I think only Gmail and github (for click to copy) need it

Note, click-to-copy will eventually not need Flash :)

See https://groups.google.com/forum/#!topic/mozilla.dev.platform...

Re: Firefox makes click-to-activate Flash the default

#320

Post by cpeterso »

ceejayoz wrote: post #186
giancarlostoro wrote: post #101

Earlier quoted context omitted.

Every video on Facebook still relies on Flash though. So I'm not sure why they haven't put their money where their mouth is about it yet? Would make Facebook a lot more accessible in most cases for me not having to rely on Flash whatsoever just to view a video. I usually end up not watching a number of videos after I realize it wont let me watch them without Flash.

I wonder if they're trying to wait out Firefox on the MP4 vs. WebM/Ogg issue. They've already gone HTML5 on the mobile versions.

Facebook is migrating from Flash to HTML5 video. As of last week, they are serving HTML5 video to users running Windows 7+, including Firefox users. Firefox supports H.264 video on Windows Vista+ and OS X because those platforms ship H.264 decoders.
Post reply on HN