Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Nightly now plays Amazon.com Flash videos using Shumway

mail.mozilla.org

Post reply on HN
Print view View original

91–100 of 109 posts

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#91

Post by tschneidereit »

userbinator wrote: post #65
acdha wrote: post #54

Earlier quoted context omitted.

Search bugzilla & you should find open tickets. They shipped first for platforms with native support, understandably, but last time I checked the intention was to support everyone. EDIT: It looks like Linux support shipped in FF26 as long as GStreamer supports it: https://bugzilla.mozilla.org/show_bug.cgi?id=794282#c101 Windows XP is still left out – they use DirectShow for MP3 ( https://bugzilla.mozilla.org/show_bug…

It's irritating that they're not just pushing all media through DirectShow, since that's the Windows native framework for doing it and it automatically supports whatever codecs are installed. Their excuse is that they don't have enough control over what codecs users install, which is a bit disappointing. ffdshow has been able to play H.264 and a bunch of other codecs for a long time, and a not-insignificant number of…

Media codecs are a very common source of security holes, which is one of the main reasons for not indiscriminately using just any codec that might be installed on the system. I think most users value the decision to not unnecessarily expose them to these security holes.

Also, that wouldn't change anything about the current situation: we still can't rely on users having the right codecs installed. We're not saying that Linux and Windows XP won't be supported going forward. They most definitely will. As part of this first small step towards deployment, we opted for a conservative approach where we only enable Shumway in situations we have the maximum amount of control over. This will be broadened over time.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#92

Post by tschneidereit »

ripdog wrote: post #43
cpeterso wrote: post #7

I'm a program manager on Mozilla's Shumway team. If you have any questions, please ask! :) The name "Shumway" is derived from "Gordon Shumway", the actual name of the TV character ALF: Flash -> Flash Gordon -> Gordon Shumway -> Shumway. :) Shumway is written in TypeScript. It has an ActionScript interpreter and a JIT that generates JavaScript, compiled using eval(). The code is on GitHub: https://github.com/mozilla/s…

Thanks for your hard work! What's the easiest way to test shumway on arbitrary files? I'm running the latest nightly, but the amazon videos still use flash (tested by checking the right click menu). I've tried the extension in the past, but it never seemed to do anything. Also, it would be nice if there was, say, a table of common flash APIs coloured by implementation status, for easy tracking of shumway completeness…

Our pleasure! :)

There are two easy ways to test Shumway on all SWF files: if you don't want to use Firefox Nightly, you can just install the extension from http://areweflashyet.com/ and should be all set. If you're using Firefox Nightly, you can simply visit about:config and change the shumway.swf.whitelist setting to "*". Note that you still need to have the Flash plugin installed for most sites to work, as I explained in another comment a few minutes ago.

Regarding the table of supported APIs: the problem with that is that we actually have most APIs implemented, but have compatibility bugs in some of them which break content. If we could easily list the broken APIs, then in most cases we could just as easily fix them. That said, there are some major API areas we don't yet support. Those are mostly related to newer and thus less-used capabilities, such as Flash's version of WebGL, called Stage3D, and a new text layout system called Text Layout Engine.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#93

Post by tschneidereit »

acd wrote: post #56
cpeterso wrote: post #7

I'm a program manager on Mozilla's Shumway team. If you have any questions, please ask! :) The name "Shumway" is derived from "Gordon Shumway", the actual name of the TV character ALF: Flash -> Flash Gordon -> Gordon Shumway -> Shumway. :) Shumway is written in TypeScript. It has an ActionScript interpreter and a JIT that generates JavaScript, compiled using eval(). The code is on GitHub: https://github.com/mozilla/s…

Hi thanks for creating Shumway, will it replace flash for all video content or what is the goal of the Shumway project?

Eventually we hope to get to the point where we can play all SWF files and hence have Shumway be a complete drop-in replacement for the Flash plugin. Since implementing full support for all capabilities (and matching all quirks) of a two decades-old platform is a huge undertaking, we're not trying to get there in one big leap. Instead, we're gradually widening the set of supported content so we can get to something useful to end users sooner.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#94

Post by tschneidereit »

stuaxo wrote: post #24
cpeterso wrote: post #7

I'm a program manager on Mozilla's Shumway team. If you have any questions, please ask! :) The name "Shumway" is derived from "Gordon Shumway", the actual name of the TV character ALF: Flash -> Flash Gordon -> Gordon Shumway -> Shumway. :) Shumway is written in TypeScript. It has an ActionScript interpreter and a JIT that generates JavaScript, compiled using eval(). The code is on GitHub: https://github.com/mozilla/s…

Have you thought of working with some of the other open source flash implementations on compatibility tests ? I'm guessing that lightspark must already have some tests, and from your side there are probably some they could use too ?

We're looking at tests and sometimes implementation details from the other open source projects, yes. E.g., we've used the SWFDec tests extensively in our work on the older AVM1 language runtime.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#95

Post by lewisl9029 »

skrowl wrote: post #60
lewisl9029 wrote: post #58

Only somewhat related, but is there still no way to access the clipboard in a web app without flash?

Imagine a web where you could just write to the users clipboard without a plugin + requiring a click. It would NEVER be safe to Ctrl+V again!

The requiring a click part is the only relevant implementation detail for this functionality, in my opinion. Whether or not it requires a plugin shouldn't matter.

In fact, requiring a plugin for this functionality only serves to increase the attack surface for the browser as a platform.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#96

Post by lewisl9029 »

cpeterso wrote: post #70
lewisl9029 wrote: post #58

Only somewhat related, but is there still no way to access the clipboard in a web app without flash?

There is a W3C spec for a web clipboard API but I don't know if any browsers have implemented it: http://www.w3.org/TR/clipboard-apis/

Thanks for pointing me to this! Glad to know it's at least something being actively considered.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#97

Post by tschneidereit »

brohee wrote: post #59
sp332 wrote: post #57

Earlier quoted context omitted.

Will this be more secure than Adobe's Flash, since that already runs in a separate process?

Since it won't be native code, they'll only be able to abuse a FF bug exposed by the JS plugin API, but should be in a very bad position to exploit a kernel bug... Same process isolation, but the JS plugin got a vastly reduced surface to attack.

Exactly. We did a survey of Flash exploits from the last few years and almost all of them would simply have been impossible in Shumway. That doesn't mean that Shumway will automatically free of all security bugs, but the whole class of bugs that in some way is caused by memory corruption is only possible through bugs in Firefox's JS engine SpiderMonkey. Of course it's much easier to just exploit them in JS directly then, so Shumway doesn't increase the surface attackable through bugs like that.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#98

Post by tschneidereit »

yellowapple wrote: post #85
cpeterso wrote: post #7

I'm a program manager on Mozilla's Shumway team. If you have any questions, please ask! :) The name "Shumway" is derived from "Gordon Shumway", the actual name of the TV character ALF: Flash -> Flash Gordon -> Gordon Shumway -> Shumway. :) Shumway is written in TypeScript. It has an ActionScript interpreter and a JIT that generates JavaScript, compiled using eval(). The code is on GitHub: https://github.com/mozilla/s…

I understand that Prime Instant Video isn't supported (according to the announcement) because Amazon uses Silverlight for that. However, it is possible to switch to Flash as a sort of fallback (this is a required step for, say, streaming PIV to a Chromecast). What would be required in order to get Shumway to actually play video from PIV (instead of Amazon simply demanding that the user installs Flash or Silverlight)?

The problem with PIV, as with a few other video services, is that it uses DRM. AS you're probably aware, there are some quite unfortunate laws around that which prevent anyone from just offering an alternative implementation of a DRM system. Hence, we can't even try. That's not to say that we won't ever be able to offer at least some support for services like this, there might well be ways to work out something clever.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#99

Post by tschneidereit »

yellowapple wrote: post #84
endgame wrote: post #42

Cool tech, but I'm a bit sad that I can't watch Shumway[1] using Shumway. [1]: http://www.albinoblacksheep.com/flash/shumway

You actually can; I'm doing so right now. However, you need to install the full Shumway extension from http://www.areweflashyet.com/shumway/ (the stripped-down version shipping in Nightly is limited to Amazon only). If you use Shumway, though, don't forget to disable Adobe's Flash (I've found that having it enabled and Shumway installed results in rather brutal crashes).

Can you give steps to reproduce this crash? It should definitely not happen. In fact, until https://bugzilla.mozilla.org/show_bug.cgi?id=558184 is implemented we rely on an installed Flash plugin to make the Flash detection used by most sites work.

Re: Firefox Nightly now plays Amazon.com Flash videos using Shumway

#100

Post by yellowapple »

tschneidereit wrote: post #99
yellowapple wrote: post #84

Earlier quoted context omitted.

You actually can; I'm doing so right now. However, you need to install the full Shumway extension from http://www.areweflashyet.com/shumway/ (the stripped-down version shipping in Nightly is limited to Amazon only). If you use Shumway, though, don't forget to disable Adobe's Flash (I've found that having it enabled and Shumway installed results in rather brutal crashes).

Can you give steps to reproduce this crash? It should definitely not happen. In fact, until https://bugzilla.mozilla.org/show_bug.cgi?id=558184 is implemented we rely on an installed Flash plugin to make the Flash detection used by most sites work.

Steps:

0) Have a Macbook Air running OS X Yosemite

1) Install Firefox

2) Install Adobe Flash

3) Install Nightly

4) Install Shumway

5) Attempt to open http://www.albinoblacksheep.com/flash/shumway

6) Watch Firefox complain that the tab crashed

7) Try to reload the tab

8) GOTO 6

Disabling Flash (via the Addons screen in Firefox/Nightly) seems to fix the issue.

Post reply on HN