Hacker News Reader

Comment by abrowne | Hacker News Reader

I uninstalled Flash a few months ago and don't miss it. I mostly use Firefox, but I do keep Chrome around, so I could use Chrome's Flash if I wanted to, but I don't think I have so far.

The only site I commonly visit that doesn't work is BBC News, funnily enough. It's a little annoying because it will work if I change the user agent to iPad, but instead I just don't watch BBC News videos.

View on HN

I find that "click to play" works well enough. So it's always off by default, but you still have the option to make exceptions in the very rare cases where it's needed. I always wonder why is this not enabled by default in all majors browsers in fact.

My problem with click to play — which I used for a few years on Safari, Chrome, and Firefox, with extensions before it was built-in — is that your browser still reports to the website that you have Flash installed. At this point, most sites work without Flash, but only if the site thinks you don't have it. (Or, like Youtube, by requesting the HTML5 player in a setting.)

I miss it when I'm looking for porn to be honest, but not much else.

So Chrome has their own flash written by engineers at Google?

Sort of.

http://www.pcworld.com/article/250455/for_flash_on_linux_chr...

> Adobe and Google have now created a “Pepper” implementation of Flash Player for all x86/64 platforms supported by the Google Chrome browser, Adobe said.

To clarify, Pepper is not a rewrite of Flash. It's a browser plugin sandbox API.

And Google maintain a Pepper port of Flash.

Google has what's called Pepperflash, which is just the flash executable in a sandbox, similar to what IE8+ has been doing with sandboxing on Vista and newer OS's. Both browsers are incapable of stopping many attacks with their various sandboxing techniques. Flash is just too poorly written and can't be too deeply sandboxed probably because of all the things it needs to do (directly access video drivers, directly access microphones, etc).

It astounds me how often Flash and Acrobat keep pooping their pants with horrible security holes that require frequent updates. It's been how many decades that this been going on for, now?

Yeah, sure, Flash does a lot of crazy stuff that's hard to sandbox, and everyone who understands the code base probably left Adobe years ago, but what the hell is Adobe's own flagship Acrobat doing, that they just can't get it right no matter how many times they try?

Does pushing out so many updates increase the number of third party spyware toolbars that get installed, or something? Is McCaffe (or NSA) giving them a kickback for every virus vector they install that makes McCaffe Security Scan Plus seem useful, on top of the toolbar kickbacks? http://www.tiagoespinha.net/2010/10/adobe-starts-including-s...

Why don't they just run it through emscripten and be done with it?

Reply on news.ycombinator.com