Hacker News Reader

Comment by wodenokoto | Hacker News Reader

On one hand, I kinda stand by being against flash, but on the other hand, we aren't really at a better place today than when Flash was all over the place.

View on HN

I just wish someone had made a good Flash/ActionScript3 -> JS+HTML-Canvas compiler. There's no reason we couldn't have kept the authoring tools just because we got rid of runtime and all its security issues.

We now have Ruffle which does more or less what Adobe should have done 10 years ago.

https://github.com/ruffle-rs/ruffle

If Adobe had seen their ban from the iPhone as a challenge to make Flash player capable of running without a plug-in they would dominate so many areas today. Flex would have become a viable platform to develop web apps/PWAs with - effectively sitting in the same position as what Flutter is doing today (Although I don’t believe Flutter is a one size fits all universal toolkit). I suppose they tried with PhoneGap but without Flash/Flex, which was their super power, they just didn’t have enough value proposition.

I suspect they saw the desktop install base of Flash Player as too important to risk loosing by marking it redundant - innovator's dilemma.

For some reason they just excepted defeat with Flash.

What about authoring tools? Part of what made flash popular was the photoshop effect.

Ruffle is pretty bad what what I've seen so far. It's not there yet.

Mozilla actually had a really impressive one about 5 years ago... but it was shutdown by Adobe lawyers.

The runtime has too much baggage, and Adobe is it’s own worst enemy to keep AnimateCc alive. Instead I would prefer someone rebuild a subset of the authoring tool that sufficiently captures the essence of Flash, with multi-platform targets (including WebGL). I say rebuild Macromedia Flash 5, but with a JavaScript coding environment, and you would have a successful product.

>multi-platform targets

I think WebAssembly is the most natural fit here.

WebAssembly is not a platform.

Yeah thanks.

Perhaps I’m remembering things incorrectly, but wasn’t Flash the source of a large number of drive-by malware installs, which are much rarer today with modern browsers?

The runtime was definitely a consistent security problem. But the games, animations, etc. people made with Flash did really enrich the internet, I’d say. And Adobe Flash was a powerful tool with a relatively easy entry point for beginners and non-programmers.

Nowadays they will install a WebAssembly module or use your GPU instead.

WebAssembly’s sandbox is quite a bit stronger than Flash’s was though.

No need to escape the sandbox to abuse the users computer, or reach out to possible secrets, if they happen to go through exported functions.

For sure. But one of the bigger issues with flash was it’s runtime being a constant source of RCEs

Now you get to enjoy them as JIT CVEs.

Though from my understanding, there is far less of them, they're harder to do, and easier to solve.

And even if it's the same amount, having a sandbox that's harder to escape, holding everything else equal, seems like a win for end-users.

Flash's demise, while it caused me no end of grief back in the day as it was the bulk of my income, was a good thing in the end.

Flash did not went away, thanks to the wonders of WebAssembly.

https://leaningtech.com/cheerpx-for-flash/

May I ask how have you been monetizing Flash up to that point?

I remember reading examples from an e-book on how to build 3D scenes with Flex 3 when I was 17-18 years old. It was a short lived dream of mine to create online video games. Instead, I ended-up making add-ons for PHP-based forums.

During that era Unity had its own web browser plugin and there was at least one Tennis-like game on the miniclip site itself.

I owned and ran a web design agency, but because of my skills in Flash a lot of our "value add" was doing impressive experiences/interactive showcases for our various clients. A lot of it was doing kiosk deployment work, which I think is still done today with Flash sometimes.

Crypto miners don't need to escape a sandbox

Easy solution, don't leave random webgames running when you're done with them, and if it doesn't noticeably impact performance...?

You don't need a game for that, any website will do, specially with background workers.

Exactly!

Who's checking for this stuff on every blog page open, actually? I wish I was, but, usually am not.

Modern browsers will flag and slow down tabs that abuse the cpu. You could probably still mine but it’s a slow drip.

What is the reason why Java and Flash runtimes were somehow more prone to malware but JS seems fine? Is it some specific sandboxing technology or something else entirely?

All three runtimes are/were regularly compromised, so there’s no fundamental difference between them.

Flash suffered from not having a spec other than its implementation. Made it hard to fix bugs while being backwards compatible

We definitely are. Flash websites were super common at all levels; Now you rarely get the over-the-top website with zero accessibility, they’re more expensive.

I’m not counting ad tech and the various user-hostile websites because they’d have happened in Flash too (rather, Flash ads were already a thing too)

I think the over-the-top interactive sites died off partially because of that but also because it really is a terrible experience in mobile. And mobile web became so important.

Reply on news.ycombinator.com