Slashdot Mirror
Facebook's New Chief Security Officer Wants To Set a Date To Kill Flash
An anonymous reader writes: Facebook's new chief security officer, Alex Stamos, has stated publicly that he wants to see Adobe end Flash. This weekend Stamos tweeted: "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day. Even if 18 months from now, one set date is the only way to disentangle the dependencies and upgrade the whole ecosystem at once."
Why on earth would Adobe want to kill flash?
Can you set an EOL date in the past? Maybe by a decade, give or take a bit? If causality doesn't currently permit that, we should look into patching this functionality into reality as a special case.
I worked for http://www.boardvantage.com/ this company for a spell. It was a shit company, and a really shit product. Somehow the CTO has convinced Board rooms around the world that the flex client is the most secure thing ever, and every time some flash vulnerability was announced, he could always dance his way around it.
Point being that as long as those in positions of power can be convinced it's a needed evil, it will be a used evil.
Use the same date to turn off Facebook too?
So Facebook wants to decide what will work on the Internet now? I thought that was Googles job.
Seems as good a time as any.
It is not going to happen. Way too many companies rely on Flash and Flex applications, written by programmers that are long gone. If the browser vendors try to force this, people will just stick with the old browsers that still work, and it will be just like IE6 all over again.
HTML5 doesn't even work half the time because the browser implementation is off by one.
How about facebook just stop using flash and switch to html5 like youtube has.
Or do i need to put my tinfoil hat on and speculate why certain influential groups might want a large proportion of the internet dependent on a binary only browser plugin.
(yes yes in theory there is open source flash plugins, but nobody uses it because its mostly broken).
If you're not using HTML5 by now, you're a fucking dinosaur.
Just as people go to museums to see fossils of dinosaurs, people go to Newgrounds, Albino Blacksheep, Dagobah, Homestar Runner, Weebl's Stuff, and the like to view vector animations in SWF format. What would you suggest to convert existing SWF vector animations to HTML5 format or to create new vector animations in HTML5 format?
Hell, VMware just released vsphere 6 a few months ago and it requires flash, it will be under support until 2020/2022 .
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Windows 7 and 8 include "compatibility mode" for running applications designed for Windows XP. Heck, Windows 7 Pro even included a coupon for a copy of XP in a virtual machine at no additional charge. What would be the counterpart to compatibility mode for running SWF objects?
> If you're not using HTML5 by now, you're a fucking dinosaur.
Using HTML5 is not the same as killing flash. The entire multi-billion dollar programmatic advertising industry uses (predominantly) flash for waterfalling/timeouts/buffering and RTB interactions. See the IAB (which still mentions silverlight alongside javascript) which sets standards, about killing flash, then you might see change.
Often wrong but never in doubt.
I am Jack9.
Everyone knows me.
So many processes have dependancies that are so ingrained in corporate apps it will be impossible to get rid of. We still use IE 6 at work and even xp eol couldn't kill it due to 2 must have apps which are impossible to ever replace. Our training only works with ancient insecure flash 11 at work due to a 10 year old version of premier which created our slides. Lock the browser out of flash and we will stick with obsolete version
http://saveie6.com/
Adobe did not kill Flash Player for Linux. It killed Flash Player for Linux NPAPI due to limits of NPAPI. Flash Player for PPAPI was alive and well in Google Chrome for Linux last time I checked.
See the IAB (which still mentions silverlight alongside javascript) which sets standards, about killing flash, then you might see change.
"I just browse the site on my tablet; it's almost like using Adblock." Would that get the IAB's attention?
Uninstall Flash. Just stop using it. Encourage your friends to do the same.
I uninstalled it a couple months ago. I no longer have to worry about updating it or being exposed to the vast amount of vulnerabilities - it should be clear to everyone by now that it is a /major/ vector for infection.
Only a few times have I hit content that still requires Flash - usually sites that have an old Flash video player. Most big sites or sites using modern players happily support HTML5 video. Those that don't I can live without. (Bonus: far less irritating animated ads. For now.)
But make sure you provide feedback to sites that still have Flash - let them know you can't use the site properly. Fortunately - largely thanks to Apple's refusal to allow Flash in iOS - there are fewer and fewer of these today.
Google and Facebook have the right to dictate what ad formats they will deliver. Google further has the right to dictate what file formats Googlebot will index. Historically, it has indexed SWF, but if Google wants to bury SWF, it'll index sites as if Flash Player is not installed.
Too many internet pages rely on Flash for video and advertisements... and,as much as we hate them, advertisements means money...
I'm not saying that progress isn't being made. Youtube dropped Flash this year and is now using HTML5 as the default for video, but that doesn't fix legacy videos.
http://www.theverge.com/2015/1...
My thought is that Flash will be around for another 3 to 5 years. The quoted "18 months" is just wishful thinking....
I've never seen a Flash update that protects end users from Adobe, not one!! I may get get rich off off blocking companies looking to profit from me. Or I might not. But in the end what is mine is mine, and fuck you for trying to suck it out of me.
Time is what keeps everything from happening all at once.
Is Professor Zoom the Facebook CSO now? I can't keep up with all the retcons.
In this analogy, Shumway (an independent reimplementation of SWF named after the creature from ALF) would be like switching from Windows to X11/Linux and using Wine (an independent reimplementation of Win32 named after an age-restricted beverage). This isn't the same thing as compatibility mode in Windows, which I'm told uses actual copies of the previous version's DLLs. Is there a counterpart to Wine AppDB for Shumway, to give someone a good impression of how well it will handle the majority of things on Newgrounds and Albino Blacksheep? What can be done when bug reports filed against Shumway for particular URLs remain unfixed for months or years?
Despite flash being a scourge, it would be better for the internet to pick a day to kill off facebook.
One of the (in my opinion) major aspects should not be forgotten: As long as porn sites like youporn rely on flash, flash will not die.
Tells you a lot about VMWare though.
A lot of the content (like Homestar Runner and Weebl's Stuff) is also available via their official YouTube channels. You lose all the interactivity, though.
Rendering the video to pixels and compressing it with H.264 or VP8 bloats files by a factor of ten in my tests. The era of dial-up is mostly over, but the era of monthly quotas and pay-per-bit last miles is still very much with us.
That is a pretty sad indictment on the state of vsphere.
https://addons.mozilla.org/en-us/firefox/addon/watch-with-mpv/
I need bbc news video clip support though as bbc news web developer basically suck at there jobs. They push HTML5 video for iPads which don't support Adobe Flash, but output a message telling everybody else who doesn't have Adobe Flash installed to install it. I DON'T want to f'ing install it you idiots. I like the Gardian better, but they've got fewer articles. The Gardian does appear to do HTML5 by default too.
A software crash is NEVER the fault of the user. Ever. Any developer that blames the user is an idiot. Period.
There are still enterprise applications out there that depends on the Microsoft Java plugin.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Didn't see "Alex Stamos - Facebook CSO" on en.wikipedia.org/wiki/List_of_Flash_enemies Perhaps the article needs updating?
Is it possible for major browser vendors to implement a sandbox for obsolete technology? When a tech becomes too outdated, put them in and restrict their functionality, hence reducing the different ways of attack and slowly let them fade away gracefully, giving other people time to update their stuff.
,,,is there an equivalent development program for HTML5? Like, would I really have to code absolutely everything including the x,y positions of literally every shape to grace the screen, or is there something with a drag/drop transform interface to modify shapes directly on the canvas?
I think the program you're looking for is called "Adobe Flash Pro CC": http://blogs.adobe.com/jnack/2...
Replace the word "Flash" with any other plugin or technology that geeks don't like. Will it still be okay if we go out of our way to kill it and make sure nobody can use it? Replace "Adobe" with "Free Software Foundation". Is that better? How about we talk about the Unity3D plugin? That's a plugin, too, just like Adobe PDF and Java, so that means it's bad. It's easy to pick on Flash and I can't say I really like the plugin, but when organizations with a large amount of industry influence start talking about killbits, that makes me really nervous.
I'd have no problem with Facebook urging other web sites to stop using Flash, especially if they're willing to support development of an alternative. When they talk about actively killing things for the good of the community, that's going too far. This starts leaning to the direction that it's okay to execute prisoners because nobody likes them.
Sometimes I'm really disturbed by the will of the community. I'm already pissed enough that I can't run certain Java applets anymore because the great Oracle says I'd hurt myself if I tried. Heaven forbid they give me a warning and I make up my own mind. As for grandma's computer, I could just configure the web browser to not use Java or install any other plugin.
The TFA page cited in the post has an embedded video. It is the "SoundCloud" video player, which my Ghostery plugin blocked.
Like a good neighbor, fsck is there
That's better than VMWare 5.5, which required it's own NPAPI plugin, which barely worked with an old version of Chrome on Linux, and doesn't work with any distro you can just spin up. As a cross-platform management solution, it was dead before it was born.
Worse is Chinese no-name security DVRs that are still being deployed, that require an activex plugin.
Dinosaurs are one of the more successful types of animals on Earth, even now I can here one hooting out in the forest and probably hunting my cat, so what's the problem of being a dinosaur?
https://en.wikipedia.org/wiki/Inverted_totalitarianism
If you're not using HTML5 by now, you're a fucking dinosaur.
Fair enough, but where are the authoring tools then? Coding everything by hand might be fun for a "look ma, no Flash!" demo, but a full blown application? Not so much. And don't get me started about Google, Apple, etc. pushing their slightly different flavour of HTML5...
RT.
Is ActiveX still required for any online banking in South Korea?
Il n'y a pas de Planet B.
Interactive Advertising Bureau. Who'd've thought there could be such a thing?
Il n'y a pas de Planet B.
considering the fact that if I log in to Facebook from my PC it loads Flash.
Java Applets at the same time. Or maybe mandate a domain whitelisting for applets.
Formerly known as Jasc Trajectory Pro--a product I once held high hopes for, until Adobe assimilated it.
Il n'y a pas de Planet B.
for its videos. Please start by fixing that first.
For those who seek perfection there can be no rest on this side of the grave.
The best time to kill flash was 20 years ago. The second best time is now.
urd
There's plenty of legacy stuff in intranets that require flash that is *not* easily upgradeable, or at least up to the user.
Case example on where I run every now and then in work, Cisco IMC controllers (server management cards).
http://www.cisco.com/c/en/us/t...
Their UI is based on Flash (and Java), for remote console, status data, and so on. If I point a browser to a CIMC server, the first thing I see is "Install flash player" if it's not already installed. Even if Cisco would release an upgrade *today*, how often are people interested in rebooting their servers for firmware upgrades as long as it's running ok?
Seems as good a time as any.
If you're not using HTML5 by now, you're a fucking dinosaur.
Did you test flash vs html5?
flash still a lot better choice for making games...
I will never understand why they wrote the web vSphere client to use Flash. I do believe HTML5 was coming into the limelight a year or two before it came out. Now we're stuck with a turd since they won't put new features into the fat client. The new GUI is shit anyway. It took me quite a while to figure out which disks attached to a guest were RDMs.
I suggest all of you bitching about it uninstall it and then try a porn site. HTML5 has a *LONG* way to go yet.
What did the blue background f say to the red background f? F you.
I kind of get why they want to make vSphere management less Windows dependent, but the Flash dependency is crazy. And IMHO, they are kind of shooting themselves in the foot by not adding new features to the fat client, even if it goes against their desire to be less Windows dependent as it makes most places less aware of engaged with new feature that require the web client because they all want to use the fat client (not to mention the clusterfuckery catch-22 of new features on standalone hosts without a vCenter instance).
Getting rid of flash won't improve Facebook. You can't fix stupid.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
I just deinstalled Flash and tried Spiegel.de again. It still works.One more problem solved :-)
C - the footgun of programming languages
Maybe it'll force all browsers and devices to properly support webm so we don't get crying idiots anymore anytime it's used. GIF belongs in 1995. I can't believe that in 2015, everyone is totally ok wasting shittons of bandwidth on making animations that are color reduced to hell and run at about 5 fps yet weigh in at incredible filesizes, because they're trying to cram shit into it that the format was never designed for. It's like people on horses trying to travel the fucking freeway.
It may not have the security issues Flash does, but it's a problem nonetheless.
I'm so glad there's a move afoot to kill Flash, in which a few well-connected standards goonies who are not satisfied with the rollout for HTML5 think that no campaign to capture hearts and minds is complete without some form of digital strip mining, in which major portions of the Internet heritage are blocked by "newer, better" software and rendered dark, obsolete and broken overnight. It's just like a seat belt law,right? It's all about protecting Joe Sixpack from driving drunk on the web. And the big important players like Facebook have naught but our precious safety as a motive. /SARC
I hated Flash for its abuses and excesses at first, but I have grown fond of the things it has become useful for, and does well. Here is a low level instruction set of instruction and vector graphic primitives that has been used to accomplish amazing feats. Even self-contained and offline feats. Things that will never make it to HTML5 without a serious ride in the newer is better and bigger and much slower (though our processors are faster and memory is bigger so we pretend that it's faster and smaller) bloat-mobile. /NOTSARC
Remember when the Whole Damned World was ready for a GIF-killer? And PNG was one little tiny step away from doing so? The png image format was so ready to dominate the world, and we were maybe a few open source developer weekends away from having a GIFlike format with comparable non-encumbered LZW compression, and (as promised) simple animation too. To be able to animate in full RGB without shoving palettes down our collective throats. Well, some people on the Standards Committee, some <BLINK>anti-blink tag hipsters</BLINK> who were Running With Scissors cut out that promise and proceeded to punt the animate part of the bargain into the Next MNG generation, which would be a video-killer too and would happen Real Soon Now. The upshot was that the PNG rocket sled hit a big pile of jello, While MNG was languishing, a whole generation of web-folk faced difficult times with GIF in which open source tools generated bloaty files unless you compiled them yourself (because they did not to fork money or paperwork to license the LZW) and the world was treated to... more of GIF! It is today's GIF! And do we have those <BLINK>anti-blink tag hipsters</BLINK> to thank? No, that is not really fair, they just wanted to build a better world. But bad decisions in retrospect do happen. /NOTSARC
But Flash is different! Never mind how useful it has become, it must be killed. Because in this silly Collectivist world of planned obsolescence it is not enough to succeed. Something old must be declared evil, be systematically dismantled and ultimately fail not on its own lack of merit, but because some all seeing Standards Committee wishes to keep Joe Sixpack safe while driving drunk on the web. The insurance companies have already factored in the liability for HTML5 vulnerability coverage so we're good there. /SARC
From this day forward, any zero day vulnerabilities in HTML5 code will be tolerated in the civilized manner, and any emerging Flash exploits will be blamed on the Iranians and North Koreans, and those who continue to use and support Flash will have their hip-credentials revoked. /NOTSARC And we're ready to destroy all those vinyl LP phonograph records too, all the music that matters has been reissued, yeah, fuck that old music. /SARC
Because, God Forbid, the whole human race could never just gather to re-write a popular primitive procedural language without creating a shitload of new exploitable errors. It just cannot be done. /SARC
<blink>down the rabbit hole</blink>
it seems like the stupid ads on slashdot from flash ads cause firefox to crash atleast 2 times a day. So yeah, screw flash.
even now I can here one hooting out in the forest and probably hunting my cat
More likely it's the other way around.
that needs to go HTML5 soon and make it a free upgrade as well.
This is exactly how Oracle operates. 'We know what is best for you and shall disable XYZ'. Really FB, just go fuck yourself. Whether Flash is good/bad or something else, FB has no right to collude to deny computer users the right to use any program/plugin/interface outside of their own site.
Why? Because with Flash video I just get a big blank box I can click to play it, and shit never autoplays.
Autoplaying video needs to die.
They are so full of themselves, they think they control the world.
Also, are there tools on par with Flash (the editor!) for animating HTML (CSS or Canvas)?
I'm not aware of any tools you can buy, but I've heard of one you can rent: Edge Animate.
Converting an existing Flash project is pretty easy.
Provided its author is still contactable and still has the .fla files. Good luck contacting authors of the majority of works on Newgrounds to follow through with this conversion.
Adobe's flash can export most any fla to html 5
Do sites that allow users to upload Flash files require the user to also upload the .fla, or only the .swf?
Nuff said.
Lisias@Earth.SolarSystem.OrionArm.MilkyWay.Local.Virgo.Universe.org
Comment removed based on user account deletion
It's a Barred Owl, now and again it comes around and sits in a tree eyeballing the cat. Luckily the cat is very furry and looks large enough that the owl decides the cat is too big to tackle. Still the wife tries to keep the cat inside at dusk but the cat likes being outside, especially in the heat.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
Large corporations are still using browsers that do not support HTML5, due to long cycles between updates. For that very reason, a client recently asked that our project be coded in Flash as opposed to HTML5.
Also, as a concept, I'd much rather all the code be captured in a couple of components that can fail without bringing down the whole page to a site that literally cannot render anything unless I allow it to run arbitrary (hopefully sandboxed) code on my computer.
Your ad here. Ask me how!
I had honestly forgot ActiveX existed. I don't know where it went, but I'm glad it's not here anymore.
See the IAB (which still mentions silverlight alongside javascript) which sets standards, about killing flash, then you might see change.
I think you've got that backwards. Some advertising board doesn't get to dictate what technologies we use. We figure that part out, and the advertisers can either adapt or stop advertising. If Flash adoption goes down to 10%, do you think the advertisers are still going to be pumping out Flash ads?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
But until you actually, and openly, do something about these problems, you are equally guilty. Because you are lazy.
Through the /SARC when it comes down to it you are right of course. Please +mod Parent as an amazingly and thought provoking response, a fine rant response. I must admit that over the years I have been part of the problem. Despite time put in to learn the mechanics of computer language, network, protocol and presentation, applying many an operations-oriented shim or patch or fix.. I have NOT delved deep into any single open-source project, taken the reins, become part of a team, or even one of those prolific lone wolf coders. I have no curriculum vitae in open source. Now that I look back on it that's kind of shameful, especially as I present myself as a critic of the times. I'll try to do better with the next half of my life.
Who are those bad actors and what is bad acting? Leaving aside the potential for cross site scripting, malformed instructions, rooting and malware for a moment. There was a time when smooth continuous motion on the borders of a web page, however clever the item, was considered distracting by static purists, who even objected to looping animation. I was never one of those, though I did see they clearly disliked the intrusive and unexpected. Then came the sounds, loud and lots. In a platform where a mute button or volume control must be explicitly coded few did and if your volume control was up you'd be blasted out of your seat muttering "What were they thinking?" But all that is past and gone. There are no aesthetic elements made possible by Flash that are not not do-able from HTML or JS.
And because migration is now possible some feel migration is necessary. The Register is cheekier than I, spicing urgent reminders with lambasting criticism. Clearly from Adobe's position proactive measures are necessary and a ground-up audit/rewrite is necessary using a compiler framework that (with performance penalty of course) mitigates the silly things like use-after-free. And in Open Source there have been reverse engineering projects and attempts to replicate Flash, lately even shims...
But what has been missing is an publicly audited open source Flash initiative that had begun years ago, begun right as Flash was introduced. Some would call such a thing intellectual property theft. I'd bring up OpenSSL as a shining example except for... certain things that have happened. Are they worse than the things that might have happened if some corporate actor, RSA for example, imposed bin-only blobs on everyone, Windows Linux and Apple? Who can say.
But you won't, and there is one telling phrase why not:
"Because in this silly Collectivist world of planned obsolescence..."
You have a mindset that can't be reasoned with.
What you really mean is, You reach down and you flip Flash over on its back. Flash lays on its back, its belly baking in the hot sun, beating its legs trying to turn itself over, but it can't. Not without your help. But you're not helping.
Point taken.
<blink>down the rabbit hole</blink>
Sure. Go ahead and set a date to kill Flash and Java.
I'd mention how much of a fail idea it is and try to convince you to stop. However, like Napoleon Bonaparte once said: If your enemy is making a mistake, don't stop them.