Ready for Click-to-play Flash?

classic Classic list List threaded Threaded
12 messages Options
Reply | Threaded
Open this post in threaded view
|

Ready for Click-to-play Flash?

gquigs
Hi there,

It's been 10 months since our previous discussion on Flash [1] and the landscape has changed a lot for the better.  Youtube has gone <video>[2][3] by default pretty aggressively and Google has started converting [4] Flash adwords on their own.

The overall change seems the biggest with audio streaming sites with the majority being plugin free now (see below).   Flash has lost almost 1/3 of it's (homepage only) marketshare according to 1 rough estimate [5].  It's losing about 1% every 4 months, but I expect that to start slowing.

I think the Firefox 39/40 time frame makes some sense for having Flash go click-to-play*.  It seems some sites just need a little more push to get them to go <audio> or <video> by default.  I do believe Firefox usage is enough to push some of them (specifically to <audio>) and it doesn't appear to be nearly the "hill to die on" as it seemed 10 months ago.

Thoughts?
Bryan

Firefox 39 would let there be an almost full Aurora and full Beta test before it goes to release.  It's also the same time async plugins is landing.  Firefox 38, aside from seeming to aggressive is also going to be an ESR release and I'd prefer to give enterprises some extra leeway there.

Works today without Flash!  - audio
grooveshark.com now works without flash, wasn't true 1 year ago
libre.fm
pandora.com
soundcloud.com
jamendo.com

Doesn't work, unknown
last.fm - still requires flash for web play
spotify - seems like they recently went back to needing flash - https://community.spotify.com/t5/Help-Web-Player/Why-require-Adobe-Flash-in-Web-Player/m-p/1020725#M8871

deezer.com - unknown, not launched in US yet
rdio unknown

Works today without Flash!  - video
Youtube
Vimeo
www.dailymotion.com

Doesn't work without flash (or plugins)
Netflix - uses silverlight or EME, n/a
Amazon Instant - both flash and silverlight, so n/a
Comcast Xfinity Vidoes- both flash and silverlight, so again, n/a
Hulu - requires flash
twitch - requires flash

[1] https://groups.google.com/forum/#!topic/mozilla.dev.tech.plugins/PK237Yk1oWM
[2] Firefox 37 has MSE enabled for just youtube (and on Windows only - Vista+)
https://www.mozilla.org/en-US/firefox/37.0/releasenotes/
[3] YouTube now default to video (where MSE is available it seems)
http://youtube-eng.blogspot.com/2015/01/youtube-now-defaults-to-html5_27.html
[4] Adwords, auto Flash to HTML5
https://plus.google.com/+GoogleAds/posts/BWVyFHGUi9n
[5] 11.4% This month, 32% in 2009, 14.3% April 2014, 12.5% Nov 2014
http://w3techs.com/technologies/details/cp-flash/all/all
* Just standard click-to-play, no fancy stuff like my previous proposal.
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

Chris Peterson-12
hi Bryan, thanks for testing all these Flash websites. The w3techs.com
report on declining Flash usage was particularly interesting.

I'm a program manager at Mozilla and one of our 2015 programs is focused
on reducing Flash problems. This program has a number of sub-projects
working on different fronts. We want to reduce the need for Flash
content by improving web alternatives (like MSE, EME, asm.js, and
Shumway) and reduce problems related to Flash (like async plugin to
reduce jank; improving our plugin sandboxing to improve security and
reduce hangs; collaborating with Adobe to investigate Flash problems
buried in Firefox crash reports and Bugzilla; Shumway for Flash ads to
reduce jank, malware risk, and power usage).

This wiki has links to more information about the various projects:

https://wiki.mozilla.org/Flash

As you point out, some major websites still rely on Flash, but they
could still work with click-to-play. We could even make the transition
to Flash click-to-play easier for users by only defaulting click-to-play
on unvisited websites. I think the owner of this decision rests with
Benjamin Smedberg.

btw, I thought all plugins (other than Flash) defaulted to
click-to-play, but I just created a new Firefox profile and found the
following plugins were "Always Activate" instead of "Ask to Activate"
(i.e. click-to-play):

- Flash (no surprise)
- GCPlugin (GradeCam)
- Unity Player
- VidyoWeb

If we can make a common plugin like Silverlight click-to-play, we should
be able to make these less common plugins also click-to-play. I will
look into this.

thanks,
chris


On 4/6/15 8:54 PM, [hidden email] wrote:

> Hi there,
>
> It's been 10 months since our previous discussion on Flash [1] and the landscape has changed a lot for the better.  Youtube has gone <video>[2][3] by default pretty aggressively and Google has started converting [4] Flash adwords on their own.
>
> The overall change seems the biggest with audio streaming sites with the majority being plugin free now (see below).   Flash has lost almost 1/3 of it's (homepage only) marketshare according to 1 rough estimate [5].  It's losing about 1% every 4 months, but I expect that to start slowing.
>
> I think the Firefox 39/40 time frame makes some sense for having Flash go click-to-play*.  It seems some sites just need a little more push to get them to go <audio> or <video> by default.  I do believe Firefox usage is enough to push some of them (specifically to <audio>) and it doesn't appear to be nearly the "hill to die on" as it seemed 10 months ago.
>
> Thoughts?
> Bryan
>
> Firefox 39 would let there be an almost full Aurora and full Beta test before it goes to release.  It's also the same time async plugins is landing.  Firefox 38, aside from seeming to aggressive is also going to be an ESR release and I'd prefer to give enterprises some extra leeway there.
>
> Works today without Flash!  - audio
> grooveshark.com now works without flash, wasn't true 1 year ago
> libre.fm
> pandora.com
> soundcloud.com
> jamendo.com
>
> Doesn't work, unknown
> last.fm - still requires flash for web play
> spotify - seems like they recently went back to needing flash - https://community.spotify.com/t5/Help-Web-Player/Why-require-Adobe-Flash-in-Web-Player/m-p/1020725#M8871
>
> deezer.com - unknown, not launched in US yet
> rdio unknown
>
> Works today without Flash!  - video
> Youtube
> Vimeo
> www.dailymotion.com
>
> Doesn't work without flash (or plugins)
> Netflix - uses silverlight or EME, n/a
> Amazon Instant - both flash and silverlight, so n/a
> Comcast Xfinity Vidoes- both flash and silverlight, so again, n/a
> Hulu - requires flash
> twitch - requires flash
>
> [1] https://groups.google.com/forum/#!topic/mozilla.dev.tech.plugins/PK237Yk1oWM
> [2] Firefox 37 has MSE enabled for just youtube (and on Windows only - Vista+)
> https://www.mozilla.org/en-US/firefox/37.0/releasenotes/
> [3] YouTube now default to video (where MSE is available it seems)
> http://youtube-eng.blogspot.com/2015/01/youtube-now-defaults-to-html5_27.html
> [4] Adwords, auto Flash to HTML5
> https://plus.google.com/+GoogleAds/posts/BWVyFHGUi9n
> [5] 11.4% This month, 32% in 2009, 14.3% April 2014, 12.5% Nov 2014
> http://w3techs.com/technologies/details/cp-flash/all/all
> * Just standard click-to-play, no fancy stuff like my previous proposal.
>

_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

Chris Peterson-12
On 4/7/15 12:02 AM, Chris Peterson wrote:

> btw, I thought all plugins (other than Flash) defaulted to
> click-to-play, but I just created a new Firefox profile and found the
> following plugins were "Always Activate" instead of "Ask to Activate"
> (i.e. click-to-play):
>
> - Flash (no surprise)
> - GCPlugin (GradeCam)
> - Unity Player
> - VidyoWeb
>
> If we can make a common plugin like Silverlight click-to-play, we should
> be able to make these less common plugins also click-to-play. I will
> look into this.

Here is the Firefox 31 code change that whitelisted some non-Flash
plugins to be always-activate instead of click-to-play:

https://hg.mozilla.org/mozilla-central/rev/24fc89305763

And a Mozilla blog post about this temporary click-to-play exemption:

https://blog.mozilla.org/security/2014/02/28/update-on-plugin-activation/

And a wiki page detailing click-to-play exemption policy:

https://wiki.mozilla.org/Plugins/Firefox_Whitelist

It looks like these plugins' exemptions all expired in Firefox 34 or 36.
The plugin developers are supposed to reapply for a second 24-week
exemption. I will follow up.


chris
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

gquigs
> > btw, I thought all plugins (other than Flash) defaulted to
> > click-to-play,
> It looks like these plugins' exemptions all expired in Firefox 34 or 36.
I had assumed that was already done as well.  

>We could even make the transition
>to Flash click-to-play easier for users by only defaulting click-to-play
>on unvisited websites.
I was thinking about that as well, but like my other proposal it seems like it would be quite unpredictable for sites to debug.  I now prefer the more flag day approach, Ex: Firefox 40 has everything click-to-play by default.  More predictable for site operators to know when they need to have things done by, etc.

Thanks!
Bryan



_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

gquigs
On Tuesday, April 7, 2015 at 12:35:56 PM UTC-4, [hidden email] wrote:
> > > btw, I thought all plugins (other than Flash) defaulted to
> > > click-to-play,
> > It looks like these plugins' exemptions all expired in Firefox 34 or 36.
> I had assumed that was already done as well.

I'm happy to make a patch to do that.  Really the only thing I see to test is do you leave them defined switching them to 1-click to play (as opposed to 2-run always) or just remove the definitions from the file.  I believe that will correspond to change for only new installs vs default to click to play for everyone (still won't change if user has set always activate manually).
 
>
> >We could even make the transition
> >to Flash click-to-play easier for users by only defaulting click-to-play
> >on unvisited websites.
> I was thinking about that as well, but like my other proposal it seems like it would be quite unpredictable for sites to debug.  I now prefer the more flag day approach, Ex: Firefox 40 has everything click-to-play by default.  More predictable for site operators to know when they need to have things done by, etc.

Any other discussions on this?  Maybe disable on Nightly, see how it goes, then Aurora, see how it goes, beta, etc.

I do think it makes sense to disable the white-listed plug-ins first though.

> Thanks!
> Bryan
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

Benjamin Smedberg
At the present time we plan on keeping the current whitelist of plugins
at least until Adobe EME is being used in production. At that point we
will consider dropping the whitelist altogether.

We still have no plans to make Flash click-to-activate (unless it is a
known-vulnerable version).

--BDS
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

gquigs
In reply to this post by gquigs
On Wednesday, May 27, 2015 at 12:07:25 PM UTC-4, Benjamin Smedberg wrote:
> At the present time we plan on keeping the current whitelist of plugins
> at least until Adobe EME is being used in production. At that point we
> will consider dropping the whitelist altogether.

Why is EME the holdup?  That seems completely irrelevant for the majority of them*.  We already have Silverlight click-to-play which makes more sense to wait for EME for...

> We still have no plans to make Flash click-to-activate (unless it is a
> known-vulnerable version).
So previously we discussed that it might be considered when Youtube goes HTML5.  What would be the trigger for a future discussion?  Flash usage under 5%?

Would you consider making Flash click-to-play on just Linux?  It's no longer getting non-security updates (been almost 3 years now) and will no longer be maintained by Adobe in February 2017[1].   I'd like to get ahead of just not having it available anymore.

Thanks again,
Bryan

*Really shouldn't use EME: Unity Player, Jabber SDK, McAfee Security Scanner, Jabber Guest, Estonian ID Card, Nexus Personal BankID, GradeCam, Smart Card Plugin, WebEx, Skype, Facebook Video Calling, MS Office Lync, VidyoWeb, McAfee Virtual Technician, SiteAdvisor Enterprise, F5 Networks SSLVPN/Firepass, Nexus Personal, Box Edit, and Roblox Launcher.

Might want to (or need to) use EME: VGConnect for DirecTV, coupons.com Plugin Printer, ViewRightWeb

[1] Search for Linux - https://www.adobe.com/devnet/flashplatform/whitepapers/roadmap.html
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

WaltS48
On 06/25/2015 12:14 PM, [hidden email] wrote:
> Would you consider making Flash click-to-play on just Linux?  It's no longer getting non-security updates (been almost 3 years now) and will no longer be maintained by Adobe in February 2017[1].   I'd like to get ahead of just not having it available anymore.

[Adobe Flash Player | Tech
specs](http://www.adobe.com/products/flashplayer/tech-specs.html)

> Note: Flash Player 11.2 is the last supported Flash Player version for Linux. Adobe will continue to provide security updates.

Linux users could also use the "Pepper" implementation of Flash by
installing the Fresh Player Plugin aka Pepper Flash wrapper for Firefox.

[Install Fresh Player Plugin In Ubuntu Via PPA (Pepper Flash Wrapper For
Firefox) ~ Web Upd8: Ubuntu / Linux
blog](http://www.webupd8.org/2014/05/install-fresh-player-plugin-in-ubuntu.html)

I already made Adobe Flash click to play by setting the plugin to "Ask
to Activate".

--
Kubuntu 15.04 | KDE 4.14.8 | Thunderbird 41.0a1(Daily) Go Bucs!
[Coexist ยท Understanding Across Divides](https://www.coexist.org/)
[Visit Pittsburgh](http://www.visitpittsburgh.com)
[2015 EQT Pittsburgh Three Rivers Regatta](http://www.yougottaregatta.com/)
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

gquigs
> Linux users could also use the "Pepper" implementation of Flash by
> installing the Fresh Player Plugin aka Pepper Flash wrapper for Firefox.
Agreed, users can do that if they want.  However I don't think we'd ever be able to ship that as part of say the Ubuntu Archive.

> I already made Adobe Flash click to play by setting the plugin to "Ask
> to Activate".
Yup, I'm hoping we can default all users to that..
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Ready for Click-to-play Flash?

rockstarkimk
In reply to this post by gquigs
Play
_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

Benjamin Smedberg
No.

--BDS

On 10/4/2015 12:49 PM, Kim Keeling wrote:
> Play
> _______________________________________________
> dev-tech-plugins mailing list
> [hidden email]
> https://lists.mozilla.org/listinfo/dev-tech-plugins

_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins
Reply | Threaded
Open this post in threaded view
|

Re: Ready for Click-to-play Flash?

rockstarkimk
In reply to this post by rockstarkimk
On Monday, October 5, 2015 at 5:46:30 AM UTC-7, Benjamin Smedberg wrote:

> No.
>
> --BDS
>
> On 10/4/2015 12:49 PM, Kim Keeling wrote:
> > Play
> > _______________________________________________
> > dev-tech-plugins mailing list
> > [hidden email]
> > https://lists.mozilla.org/listinfo/dev-tech-plugins



On Monday, October 5, 2015 at 5:46:30 AM UTC-7, Benjamin Smedberg wrote:

> No.
>
> --BDS
>
> On 10/4/2015 12:49 PM, Kim Keeling wrote:
> > Play
> > _______________________________________________
> > dev-tech-plugins mailing list
> > [hidden email]
> > https://lists.mozilla.org/listinfo/dev-tech-plugins

_______________________________________________
dev-tech-plugins mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-tech-plugins