Ready for Click-to-play Flash?

[g***@gmail.com]

Hi there,

It's been 10 months since our previous discussion on Flash [1] and the landscape has changed a lot for the better. Youtube has gone <video>[2][3] by default pretty aggressively and Google has started converting [4] Flash adwords on their own.

The overall change seems the biggest with audio streaming sites with the majority being plugin free now (see below). Flash has lost almost 1/3 of it's (homepage only) marketshare according to 1 rough estimate [5]. It's losing about 1% every 4 months, but I expect that to start slowing.

I think the Firefox 39/40 time frame makes some sense for having Flash go click-to-play*. It seems some sites just need a little more push to get them to go <audio> or <video> by default. I do believe Firefox usage is enough to push some of them (specifically to <audio>) and it doesn't appear to be nearly the "hill to die on" as it seemed 10 months ago.

Thoughts?
Bryan

Firefox 39 would let there be an almost full Aurora and full Beta test before it goes to release. It's also the same time async plugins is landing. Firefox 38, aside from seeming to aggressive is also going to be an ESR release and I'd prefer to give enterprises some extra leeway there.

Works today without Flash! - audio
grooveshark.com now works without flash, wasn't true 1 year ago
libre.fm
pandora.com
soundcloud.com
jamendo.com

Doesn't work, unknown
last.fm - still requires flash for web play
spotify - seems like they recently went back to needing flash - https://community.spotify.com/t5/Help-Web-Player/Why-require-Adobe-Flash-in-Web-Player/m-p/1020725#M8871

deezer.com - unknown, not launched in US yet
rdio unknown

Works today without Flash! - video
Youtube
Vimeo
www.dailymotion.com

Doesn't work without flash (or plugins)
Netflix - uses silverlight or EME, n/a
Amazon Instant - both flash and silverlight, so n/a
Comcast Xfinity Vidoes- both flash and silverlight, so again, n/a
Hulu - requires flash
twitch - requires flash

[1] https://groups.google.com/forum/#!topic/mozilla.dev.tech.plugins/PK237Yk1oWM
[2] Firefox 37 has MSE enabled for just youtube (and on Windows only - Vista+)
https://www.mozilla.org/en-US/firefox/37.0/releasenotes/
[3] YouTube now default to video (where MSE is available it seems)
http://youtube-eng.blogspot.com/2015/01/youtube-now-defaults-to-html5_27.html
[4] Adwords, auto Flash to HTML5
https://plus.google.com/+GoogleAds/posts/BWVyFHGUi9n
[5] 11.4% This month, 32% in 2009, 14.3% April 2014, 12.5% Nov 2014
http://w3techs.com/technologies/details/cp-flash/all/all
* Just standard click-to-play, no fancy stuff like my previous proposal.

[Chris Peterson]

hi Bryan, thanks for testing all these Flash websites. The w3techs.com
report on declining Flash usage was particularly interesting.

I'm a program manager at Mozilla and one of our 2015 programs is focused
on reducing Flash problems. This program has a number of sub-projects
working on different fronts. We want to reduce the need for Flash
content by improving web alternatives (like MSE, EME, asm.js, and
Shumway) and reduce problems related to Flash (like async plugin to
reduce jank; improving our plugin sandboxing to improve security and
reduce hangs; collaborating with Adobe to investigate Flash problems
buried in Firefox crash reports and Bugzilla; Shumway for Flash ads to
reduce jank, malware risk, and power usage).

This wiki has links to more information about the various projects:

https://wiki.mozilla.org/Flash

As you point out, some major websites still rely on Flash, but they
could still work with click-to-play. We could even make the transition
to Flash click-to-play easier for users by only defaulting click-to-play
on unvisited websites. I think the owner of this decision rests with
Benjamin Smedberg.

btw, I thought all plugins (other than Flash) defaulted to
click-to-play, but I just created a new Firefox profile and found the
following plugins were "Always Activate" instead of "Ask to Activate"
(i.e. click-to-play):

- Flash (no surprise)
- GCPlugin (GradeCam)
- Unity Player
- VidyoWeb

If we can make a common plugin like Silverlight click-to-play, we should
be able to make these less common plugins also click-to-play. I will
look into this.

thanks,
chris

Post by g***@gmail.com
Hi there,
It's been 10 months since our previous discussion on Flash [1] and the landscape has changed a lot for the better. Youtube has gone <video>[2][3] by default pretty aggressively and Google has started converting [4] Flash adwords on their own.
The overall change seems the biggest with audio streaming sites with the majority being plugin free now (see below). Flash has lost almost 1/3 of it's (homepage only) marketshare according to 1 rough estimate [5]. It's losing about 1% every 4 months, but I expect that to start slowing.
I think the Firefox 39/40 time frame makes some sense for having Flash go click-to-play*. It seems some sites just need a little more push to get them to go <audio> or <video> by default. I do believe Firefox usage is enough to push some of them (specifically to <audio>) and it doesn't appear to be nearly the "hill to die on" as it seemed 10 months ago.
Thoughts?
Bryan
Firefox 39 would let there be an almost full Aurora and full Beta test before it goes to release. It's also the same time async plugins is landing. Firefox 38, aside from seeming to aggressive is also going to be an ESR release and I'd prefer to give enterprises some extra leeway there.
Works today without Flash! - audio
grooveshark.com now works without flash, wasn't true 1 year ago
libre.fm
pandora.com
soundcloud.com
jamendo.com
Doesn't work, unknown
last.fm - still requires flash for web play
spotify - seems like they recently went back to needing flash - https://community.spotify.com/t5/Help-Web-Player/Why-require-Adobe-Flash-in-Web-Player/m-p/1020725#M8871
deezer.com - unknown, not launched in US yet
rdio unknown
Works today without Flash! - video
Youtube
Vimeo
www.dailymotion.com
Doesn't work without flash (or plugins)
Netflix - uses silverlight or EME, n/a
Amazon Instant - both flash and silverlight, so n/a
Comcast Xfinity Vidoes- both flash and silverlight, so again, n/a
Hulu - requires flash
twitch - requires flash
[1] https://groups.google.com/forum/#!topic/mozilla.dev.tech.plugins/PK237Yk1oWM
[2] Firefox 37 has MSE enabled for just youtube (and on Windows only - Vista+)
https://www.mozilla.org/en-US/firefox/37.0/releasenotes/
[3] YouTube now default to video (where MSE is available it seems)
http://youtube-eng.blogspot.com/2015/01/youtube-now-defaults-to-html5_27.html
[4] Adwords, auto Flash to HTML5
https://plus.google.com/+GoogleAds/posts/BWVyFHGUi9n
[5] 11.4% This month, 32% in 2009, 14.3% April 2014, 12.5% Nov 2014
http://w3techs.com/technologies/details/cp-flash/all/all
* Just standard click-to-play, no fancy stuff like my previous proposal.

[Chris Peterson]

Post by Chris Peterson
btw, I thought all plugins (other than Flash) defaulted to
click-to-play, but I just created a new Firefox profile and found the
following plugins were "Always Activate" instead of "Ask to Activate"
- Flash (no surprise)
- GCPlugin (GradeCam)
- Unity Player
- VidyoWeb
If we can make a common plugin like Silverlight click-to-play, we should
be able to make these less common plugins also click-to-play. I will
look into this.

Here is the Firefox 31 code change that whitelisted some non-Flash
plugins to be always-activate instead of click-to-play:

https://hg.mozilla.org/mozilla-central/rev/24fc89305763

And a Mozilla blog post about this temporary click-to-play exemption:

https://blog.mozilla.org/security/2014/02/28/update-on-plugin-activation/

And a wiki page detailing click-to-play exemption policy:

https://wiki.mozilla.org/Plugins/Firefox_Whitelist

It looks like these plugins' exemptions all expired in Firefox 34 or 36.
The plugin developers are supposed to reapply for a second 24-week
exemption. I will follow up.


chris

[g***@gmail.com]

Post by Chris Peterson

Post by Chris Peterson
btw, I thought all plugins (other than Flash) defaulted to
click-to-play,

It looks like these plugins' exemptions all expired in Firefox 34 or 36.

I had assumed that was already done as well.

Post by Chris Peterson
We could even make the transition
to Flash click-to-play easier for users by only defaulting click-to-play
on unvisited websites.

I was thinking about that as well, but like my other proposal it seems like it would be quite unpredictable for sites to debug. I now prefer the more flag day approach, Ex: Firefox 40 has everything click-to-play by default. More predictable for site operators to know when they need to have things done by, etc.

Thanks!
Bryan

[g***@gmail.com]

Post by g***@gmail.com

Post by Chris Peterson

Post by Chris Peterson
btw, I thought all plugins (other than Flash) defaulted to
click-to-play,

It looks like these plugins' exemptions all expired in Firefox 34 or 36.

I had assumed that was already done as well.

I'm happy to make a patch to do that. Really the only thing I see to test is do you leave them defined switching them to 1-click to play (as opposed to 2-run always) or just remove the definitions from the file. I believe that will correspond to change for only new installs vs default to click to play for everyone (still won't change if user has set always activate manually).

Post by g***@gmail.com

Post by Chris Peterson
We could even make the transition
to Flash click-to-play easier for users by only defaulting click-to-play
on unvisited websites.

I was thinking about that as well, but like my other proposal it seems like it would be quite unpredictable for sites to debug. I now prefer the more flag day approach, Ex: Firefox 40 has everything click-to-play by default. More predictable for site operators to know when they need to have things done by, etc.

Any other discussions on this? Maybe disable on Nightly, see how it goes, then Aurora, see how it goes, beta, etc.

I do think it makes sense to disable the white-listed plug-ins first though.

Post by g***@gmail.com
Thanks!
Bryan

[Benjamin Smedberg]

At the present time we plan on keeping the current whitelist of plugins
at least until Adobe EME is being used in production. At that point we
will consider dropping the whitelist altogether.

We still have no plans to make Flash click-to-activate (unless it is a
known-vulnerable version).

--BDS

[g***@gmail.com]

Post by Benjamin Smedberg
At the present time we plan on keeping the current whitelist of plugins
at least until Adobe EME is being used in production. At that point we
will consider dropping the whitelist altogether.

Why is EME the holdup? That seems completely irrelevant for the majority of them*. We already have Silverlight click-to-play which makes more sense to wait for EME for...

Post by Benjamin Smedberg
We still have no plans to make Flash click-to-activate (unless it is a
known-vulnerable version).

So previously we discussed that it might be considered when Youtube goes HTML5. What would be the trigger for a future discussion? Flash usage under 5%?

Would you consider making Flash click-to-play on just Linux? It's no longer getting non-security updates (been almost 3 years now) and will no longer be maintained by Adobe in February 2017[1]. I'd like to get ahead of just not having it available anymore.

Thanks again,
Bryan

*Really shouldn't use EME: Unity Player, Jabber SDK, McAfee Security Scanner, Jabber Guest, Estonian ID Card, Nexus Personal BankID, GradeCam, Smart Card Plugin, WebEx, Skype, Facebook Video Calling, MS Office Lync, VidyoWeb, McAfee Virtual Technician, SiteAdvisor Enterprise, F5 Networks SSLVPN/Firepass, Nexus Personal, Box Edit, and Roblox Launcher.

Might want to (or need to) use EME: VGConnect for DirecTV, coupons.com Plugin Printer, ViewRightWeb

[1] Search for Linux - https://www.adobe.com/devnet/flashplatform/whitepapers/roadmap.html

[WaltS48]

Post by g***@gmail.com
Would you consider making Flash click-to-play on just Linux? It's no longer getting non-security updates (been almost 3 years now) and will no longer be maintained by Adobe in February 2017[1]. I'd like to get ahead of just not having it available anymore.

[Adobe Flash Player | Tech
specs](http://www.adobe.com/products/flashplayer/tech-specs.html)

Post by g***@gmail.com
Note: Flash Player 11.2 is the last supported Flash Player version for Linux. Adobe will continue to provide security updates.

Linux users could also use the "Pepper" implementation of Flash by
installing the Fresh Player Plugin aka Pepper Flash wrapper for Firefox.

[Install Fresh Player Plugin In Ubuntu Via PPA (Pepper Flash Wrapper For
Firefox) ~ Web Upd8: Ubuntu / Linux
blog](http://www.webupd8.org/2014/05/install-fresh-player-plugin-in-ubuntu.html)

I already made Adobe Flash click to play by setting the plugin to "Ask
to Activate".

[g***@gmail.com]

Post by WaltS48
Linux users could also use the "Pepper" implementation of Flash by
installing the Fresh Player Plugin aka Pepper Flash wrapper for Firefox.

Agreed, users can do that if they want. However I don't think we'd ever be able to ship that as part of say the Ubuntu Archive.

Post by WaltS48
I already made Adobe Flash click to play by setting the plugin to "Ask
to Activate".

Yup, I'm hoping we can default all users to that..

[Kim Keeling]

Play

[Benjamin Smedberg]

No.

--BDS

Play
_______________________________________________
dev-tech-plugins mailing list
https://lists.mozilla.org/listinfo/dev-tech-plugins

[Kim Keeling]

No.
--BDS

Play
_______________________________________________
dev-tech-plugins mailing list
https://lists.mozilla.org/listinfo/dev-tech-plugins

No.
--BDS

Play
_______________________________________________
dev-tech-plugins mailing list
https://lists.mozilla.org/listinfo/dev-tech-plugins