The end arrives as Adobe starts blocking Flash content | Hacker News Reader

The end arrives as Adobe starts blocking Flash content

zdnet.com

73 pointscft46 comments

I have an old Windows offline desktop application (from circa 2003) that has an embedded Flash component which is necessary for it to run properly. It simply stopped working this morning on my Windows 10.

Resetting the date to yesterday works, but I'd like to avoid it if possible.

Standalone flash players (such as Newgrounds') do not work, since the desktop application is the one who actually runs the Flash component, and I cannot control it directly.

I tried uninstalling Flash and reinstalling an older version, without success: it seems to be using an ActiveX component which I cannot overwrite, since the old installer says "You already have a newer version". Windows does not allow me uninstalling it manually (it's "part of the system", and apparently the only Windows Update KB which allows it to be uninstalled, prevents you from installing any other Flash version), and I tried manually searching for registry keys, but there are several and I need to change permissions, etc.

So, I'm afraid I'll have to run an emulator such as PCem, with an older Windows inside, whose date is set to a distant past, so that my app will simply keep working as usual. I'd appreciate if there are simpler solutions.

I am in a similar situation and was able to disabled Flash's EOL "kill switch" just for this old flash site with a mms.cfg:

  EOLUninstallDisable=1
  EnableAllowList=1
  AllowListUrlPattern=https://old-flash-site.com

Took inspiration from https://blogs.sap.com/2020/12/10/how-to-keep-enterprise-flas...

That will only work until June.

Any details on that? Because I currently use it as workaround, and I can't remember reading about June in the docs I had a look at.

You can use the projector [0] to run a SWF file outside of the browser.

Edit: Apologies, I misread the bit about the Flash requirement only being a part of the application. The above may still provide some use though?

[0] https://www.adobe.com/support/flashplayer/debug_downloads.ht...

Is the projector going to stop working soon too, or is it being treated differently from the browser plugin?

There has been no announcement on that yet but I would guess (hope) that there is no kill switch as the time has now password and it still runs. The projects are still available to download too. I believe Adobe are keeping them up for enterprise users for debugging.

Can you sandbox the app/block access to Adobe's servers, so that it doesn't get their deprecation command?

The limitation doesnt seem to involve communication with Adobe servers; its appears to be based solely on the machine time. I suspect that the Flash player on OPs machine has been connected to the internet and updated Flash Player at least once in the last 3 years.

Indeed, the laptop has been disconnected for days. I (or, more precisely, Windows) inadvertently updated to a more recent Flash version containing the "time bomb", so now the application simply checks the system date and decides whether to block it or not.

If I could "sandbox the clock" for this specific application, that might work, but I don't think that it is possible.

As a disclaimer I have to say I haven't used this (yet), but it does sound a lot like what you need.

https://www.nirsoft.net/utils/run_as_date.html

Genius! Good to know it exists, if I need it one day.

For now, I tried patching the timestamp in the binary as suggested by jtvjan, since I saw it before your post. It works, so I'll stick with it for now. But I'll be sure to try this RunAsDate when I need something similar in the future.

What are you running on it?

If you need a fix, you can patch the .so like this:

  bbe -e 's/\x00\x00\x40\x46\x3e\x6f\x77\x42/\x00\x00\x00\x00\x00\x00\xf8\x7f/' libflashplayer.so | sponge libflashplayer.so

Source: https://cache.tehsausage.com/flash/defuse.txt

On Windows, this seems to work for the browser plugin, but the .ocx (used e.g. by the JPEXS Flash decompiler – they also have a built-in player, but that unfortunately seems somewhat buggy) didn't like the expiration time stamp being set to infinity. Setting some other time stamp far in the future does work though, even if philosophically it's not quite the same as literal infinity.

Thanks a lot! The page you linked did work; I had to copy the Flash folder elsewhere, used a hex editor to find the timestamp in my Flash.ocx file, then I renamed the original folder to Flash.bak and copied the modified one in its place, and my application works again!

And for Linux:

https://gist.github.com/szymonszl/982359cf6cb6618c124054dc34...

Not really gone, Ruffle[1] is being actively developed and as of now is able to play most of the early Flash content, including some AS2 games.

[1] https://ruffle.rs/

Any reason that ruffle progress seems to have been much faster than Gnash, which was a much older attempt at doing this? Is it just the impending EOL lit a fire under users?

And yet http://get.adobe.com/flashplayer/about/ :

> Adobe Flash Player is the standard for delivering high-impact, rich Web content. Designs, animation, and application user interfaces are deployed immediately across all browsers and platforms, attracting and engaging users with a rich Web experience.

Bathwater finally eliminated. Location of baby unknown.

I went to the gym this morning and some of the TVs usually show info in the corner about the song and artist currently being played over the sound system. Apparently it was using Flash because today it just showed the Flash logo with a question mark overlay.

That's why I don't go to the gym. :)

"Finally gone"

Why the word "finally" when it's about tons of games, animations and culture being gone?

Lots of techy types are glad to see Flash blown out the airlock because of Adobe's abysmal stewardship of the product ever since picking it up from Macromedia. It's been responsible for a number of security breaches and even found use as a web bug/tracking tool.

Flash has been declared dead many times. This time it really is the end, it's final. Maybe.

There have been widespread frustration and critique of flash for 20 years. So "finally gone" makes a lot of sense from that point of view.

If you have any saved swf files that are too obscure/degenerate to be on Flashpoint or any of the other archive sites, I can report that the flashplayer projector debuggers still seems to work.

https://www.adobe.com/support/flashplayer/debug_downloads.ht...

Until about 2 years ago the AARP website had some flash content!

I'd wince when my then 85-year-old mother would call me after searching around the web and following the help on sketchy websites on how to "install Flash."

I contacted them (I'm 58--old enough to join AARP, too!) and told them how dangerous it was; all Flash content disappeared about a year after.

> I'm 58--old enough to join AARP, too!

Fun fact: AARP doesn't have age limits, anyone can join. I'm in my mid-40s and I've been a member for a few years. Depending on what you like to do, they have some useful discounts that are based on membership, not age.

"Adobe Flash is dead after nearly 30 years of dominating media content on the web"

Nah, it dominated for maybe 10 years but it's been irrelevant for a long time already.

Even then "dominated" is pretty strong, besides video streaming, games and poorly designed marketing sites most of the web was still HTML+JS.

> besides video streaming, games and poorly designed marketing sites

Ads too, right?

Imagine some day in the 1600s something started stopping people from reading parchment scrolls.

Huge swaths of art is going to be lost, forever.

Glad to hear what Newgrounds and Ruffle are doing.

I've heard that is essentially the case. The number of people who speak Latin has dramatically declined, even among scholars and historians, and huge amounts of historical literature is now left ignored or unread. It seems a little fantastical that there may be new history waiting to be discovered.

Latin is one of the best-documented languages. Even Google Translate can translate it with tolerable accuracy. Even picking through ye olde handwriting is a bigger challenge.

What good is a challenge if noone takes it?

Ruffle looks really promising.

I see the Homestar Runner site has switched over to Ruffle, so its Flash-based content (even the stuff from 2001) works just fine.

https://homestarrunner.com/post-flash-update

People are discussing using an older version of Flash, and never upgrading their browser in order to keep it running.

At least for them, getting rid of flash is not doing anything good for security.

I'm considering doing it myself, there are just too many old flash games I still play.

We still manage an old vmware install where Flash or a Windows client is required. I guess we're down to using the Windows client now.

Yes, it should absolutely have been upgraded, but some client are a little slow to make a decision.

I was kind of surprised to see a notice to uninstall Flash when I turned on my laptop yesterday. I wasn't even aware that Flash was installed on that machine.

Are there any Flash websites where i can see the effect of this? Apparently Chrome is going to remove its PPAPI Flash on the 19th, so it should still work there?

https://z0r.de hosts a bunch of swfs and has a Ruffle/Flash switch.

The memories. Still 2/3rds broken on Ruffle. :-(

But what can you expect when the internet is run by a witch burning mob.

That said I better get my pitchfork out and join in before I get burned myself.

Ahem, burn flash, burn flash, it turned my PC into a newt. Burn ITTTTTTTTT!!!!!111!!!!

All hail the true lord and savior JavaScript that never had any security issues and has a frozen API so has no reason to introduce new ones at any point.

Adobe could have released Flash Player under a free license and it might have made its way into a standard.

Reply on news.ycombinator.com