No no no no NO. It's time to get rid of Flash. Open-sourcing will make it live forever.
Flash has very little to offer that is not at this point duplicated (or improved upon) by others. It's also woefully insecure. "Many eyes make all bugs shallow" will only work for the most trivial bugs in the most common code paths. Plenty of vulnerabilities will remain. In open source, they'll be even easier for attackers to find and exploit. If you want something open-source and (mostly) Flash compatible, follow nkkollaw's suggestion: support one of the already-open-source alternatives.
Do you think Flash is insecure in principle, or in implementation? I think it is very much a problem of the implementation. I don't know if Adobe/Macromedia could have done better, or if the backwards compatibility requirements make it impossible to maintain, but I'd like to see for myself.
Anyway, you have no reason to be afraid. All mayor browsers are dropping support for plugins anyway. An open source flash player will most likely be used standalone, and not in a browser.
(I can't help but wonder if we are making a huge historical mistake here by the way. Because the Flash implementation was so bad, we were led to believe that plugins are bad per se. But at least in theory, it seems to me that the best architecture would be a minimal browser (just a layout engine), and everything as a plugin. Current browser are horrible monolithic giants, that only mega-corporations (and Mozilla ;-)) can maintain. That they are relatively secure is only due to the massive amounts of human-years that went into polishing and bug fixing in the recent decade.)
I don't have strong feelings on browser plugins vs no browser plugins, but I can say that I can now watch streaming video from the major services and play browser games on Linux now, and that wasn't possible a couple of years (or maybe a little more) ago. I welcome the end of Silverlight, Flash, Java applets, because it means I can use any modern browser to do anything I want on any platform I want (kinda, but it keeps getting more true over time).
Plugins aren't inherently Linux-incompatible it's just that for most of them Linux support was an afterthought or actively avoided for competitive reasons (in the case of Silverlight, I would guess). I don't miss fighting to make Flash work in a 64-bit browser, or having to set my user agent to claim I'm on Windows, to make something work (and have it break periodically for whatever reason).
The issue with a plugin architecture is that it makes it difficult to compete. There essentially will come a pool of plugins which are expected to be installed on every user's machine, & without standardization or open source implementations you'll end up with 1 plugin being used on any base browser as opposed to different versions on each browser
In theory we could create a basic browser with various HTML/JS/CSS spec features created as a plugin
Speaking as a clueless user; closed source plugins, sooner or later, go away. Which is pretty painful. In the interim, the big grief-causers are usually closed source plugins that crash the host.
Open source plugins cause a lot less grief. Typically they don't have a feature I want. Often for legal reasons and not technical, or because a proprietary vendor is fighting back (eg; video patents the first case, Skype protocol the second).
The linux kernel is an example how an open-source-only plugin system works technical wonders. A very interesting case study was graphics drivers circa 2005. The closed source drivers (essentially plugins) tethered the linux community to the technically obsolete X server; and would have crippled the kernel in a similar way if the kernel devs had accepted closed source plugins.
Apple did wonders driving open standards on the web with the explicit acknowledgement that popular closed source plugins were too dangerous for their platform to implement [1].
The issue here is the one Stallman has been harping on since the dawn of time - closed source is unmaintainable in an extremely profound way.
You could also argue in the opposite direction: Without a plugin architecture, you are at the mercy of the browser developers to implement a certain functionality.
If you need some native feature, browser vendors can force you to use a native app and thus go through their app store (think Safari on iOS). There is a large category of apps that you cannot make in HTML, for example anything truly P2P (not WebRTC, but based on real sockets). You can't make an IMAP client. You can't make a friend-to-friend file sharing tool, without a central server, that uses your Facebook and Google contacts to find peers (I've tried). You can't make the browser window partially-transparent or use native looking widgets. You can't burn a DVD. And if someone invents free-floating holograms, you can't add them to your page.
Granted, these examples are silly. The web is now a very capable platform. But vendors have always been steering what you can and cannot do based on business and other interests. It would be great to be able to break out of that, by having a kind of "C foreign function" interface for the web.
In addition to this. Many of the new Web features came from people going "Flash does it". Plugins allow capability that can be used by people now. Those instances can then be shown to people who say one of my most hated phrases, "What's the use case?"
Plugin has advantages though, consider I don't need the built in pdf in browser, if the pdf reader was a third party plugin I could decide to not install or remove it, less code that I do not use is better. Also we could have a few prf reader plugins choices instead of having the one Google/Mozilla chose.
Anyway the people wanting Flash to be preserved do not intend to built Flash apps but conserve the existing ones, most of them could be run in the standalone player(I think a few try to hook into the browser to get the url or similar ,so those would fail as standalone)
> An open source flash player will most likely be used standalone, and not in a browser.
It'll most likely be modified to run in browsers, too, e.g., via compilation to WebAssembly and suitable web-platform replacements for the low-level IO, etc., implementations.
There are some noteworthy security problems with Flash in principle.
If website.com embeds a flash file from flash.example, it will run in the context of flash.example, the embedee.
If website.com embeds JavaScript from js.example, the code will run in the context of website.com, the embedder.
This will and has caused problems with interoperability in so far, as I'd call it an ugly and dangerous wart.
The only way to solve that implementation problem is to create competition, just like you have with HTML.
So the W3C would have to define "standard Flash specification" and then everyone would have to implement their own "Flash player". But ain't nobody got time for that.
If the "Flash player" had been a specification rather than a piece of standalone software from day one, I believe the overall security of the Flash players would have been way better.
Very narrow minded. Tens of thousands of games rely on flash, along with many movies and general history of the internet. Open souring it will preserve countless hours of lost work.
They are preserved, no ones making Commodores or GameBoys but I can play all those games just fine. Spin up a XP VM if you want the vintage Flash game experience.
(Hello downvotes? It's true, we preserve all of those things through virtual machines of one variety or another. The Flash plugin doesn't magically stop working because Adobe stops developing it.)
You would have then to create a Flash VM, probably based on Linux not XP, but you may have issues with 3d acceleration, and it will consume a lot of extra resources. For now you can use the standalone player for some flash content but that could change in a few years and the player may not work in new Windows or Linux releases.
I have no idea, but I know the standalone Windows version was working fine under Wine for some games I was playing), this only means that the features those games were using worked fine.
Reimplementing Windows is hard, I was playing some old RPG games, Fallout3 and Skyrim works fine in Wine(with mods and such), Fallout New Vegas and Oblivion had issues for me(works for others) I got stutters under wine, Oblivion under Windows10 I get a black screen that I could not find a soluton that worked. So old games don't always work latest Windows, I am not sure if a VM would help since 3d and VMS is slow.
It does not need to be open source. Just save the plug-in along with your legacy browser and legacy OS and run it all on an emulator. Making it open source is an excuse to allow people to continue flash development in some way.
What if, rather than just play the Flash content, I want to write a tool to convert it to a different format? Or what if I want to port the player to a new platform, or compile it to WASM so I can run it in a browser? There are a lot of things open sourcing Flash would enable that just running it in a VM would not.
And also, why do you care if some people _do_ want to continue developing Flash? It's going to get removed from browsers either way. The mere existence of a Flash player on somebody's desktop somewhere is not a security liability for you.
>> And also, why do you care if some people _do_ want to continue developing Flash?
The argument presented was that open sourcing would allow that little bit of internet history to be preserved. My point is that you don't need source code for that. IMHO we don't want anyone to continue developing flash. Even it's creator has declared EOL for it. I understand there are people who want to mess around with it and do things that are potentially interesting, I object to disguising those desires as a preservation activity.
So instead of being able to make something that just runs flash content when you so choose to you want someone to compile and tend to VM image(s) that runs specific OS and specific browser. All major browsers will stop showing Flash content after it's end of life (that has been confirmed), so I see no harm with having some external software that could run flash games/animations/whatever from a local file.
Just like with Java it's the Flash in browser that sucks, not Flash in and of itself.
How about all the kids who made animations and games with Flash just because it was the only thing accessible enough?
Your reasoning about proprietary stuff is just plain stupid and made completely retrospectively. There is literally no reason why we shouldn't preserve this work just because some people don't see value in them.
Tens of thousands of books are written each year. Tens of thousands of songs are recorded each year. Etc. This is an absurd line of reasoning.
People get permission to build Commodore 64 clones, for retro computing preservation, and Hacker News says that's great. Someone requests similar permission for Flash, and now we're upset about the notion of a proprietary codebase being open sourced? Why? Because Steve Jobs said it wasn't cool? Because you're seriously afraid that it would make a comeback, and dethrone HTML5 on the mainstream web?
Guys, someone started a petition to ask a company to donate a propriety codebase after EOL. That's all. This is just idle chat, because nothing in Adobe's history suggests that they would actually consider this.
Regardless, if you would rather NOT see a historically signficant codebase open sourced, then simply don't sign the petition. And take all the low-quality jokes and guffaws back to Reddit, please.
I hate Flash. And yet, I fully support an effort to open source it. Just like I hate MS Word and would support an effort to open source it.
Open sourcing code does not carry any of the risks you mention because those risks relate to browsers, not to Flash, besides that the whole point is to 'make it live forever' so that the millions upon millions of hours spent building Flash stuff will not have been wasted.
Open sourcing abandonware is exactly the right thing to do.
Well, its pretty simple. Why should people be against open-sourcing it?
I think 90% of those who are against it, are against it, because they want to forget flash and never see it again.
So somehow, they must have made so bad experiences with flash, that they do not want to get it for free or even someone else to get it.
So you next question is probably: What could have been such a bad experience? Probably not a just one. From my own memory:
Good experiences with flash:
- youtube, etc.: Flash was overcoming the codec problem we had in the past. By providing a minimal set of supported codecs it was setting a defacto standard for video streaming. But that problem is solved today.
Bad experinces with flash:
- Flash menus (please install that macromedia plugin before you can actually use this website)
- Flash menus (please wait until this uber cool animation finishes to render before you can click on that link)
- Complete 'websites' in flash (Please install that plugin before you can see if this website is of any use at all)
- Header logos with large file sizes, as they are animated like hell
- a laggy computer just because some website embeded a flash animation which uses all of your CPU power
- Contact forms which disallowed copy and paste.
- Websites which you could not find again because the search engine could not find them.
- decisions about being vulnerable vs. actually seeing flash content at all
- tracking cookies beyond normal cookies
- extra applets which are there just to make sure you are a real browser.
So I think nobody has a real problem with those gift cards or the games. But given the history of flash we would better not receive a gift, just to make sure we will never have to experience those moments again.
You won't have to use Flash. Browsers are dropping support for Flash. Its for the sake of archiving and learning about its code base. Just because its open sourced doesnt mean the web is going to return to 2001.
Think about it this way: as a linux user, wouldnt it be a great thing for humanity if Windows XP was open sourced? You wouldnt have to use it. No one would have to use it. But that knowledge and history would be unlocked instead of hidden away. Someone in the future would be able to learn from it or modify it to get a really old obscure program to run. The possibilities are endless.
Preservation and reduction of bit rot is a great reason to open source Flash or ensure there is always a definitive version available, even if all the browsers should ban it because it is a messy, unperformant security liability.
Dop not worry. The SWF files will be preserved and long playable after 2020, using Flash Projector, Swiff Player or iSwiff. Just no longer in web browsers.
> Preservation and reduction of bit rot is a great reason to open source Flash
It's a reason, and a good point, but it's not a good reason. Improving the already-open-source players would be a better alternative. Adobe could even help facilitate that, by documenting the interfaces and enough of the internals so that other developers can achieve better compatibility. A canonical sandboxed version would also achieve the goal of preservation, without the security woes. Open-sourcing Flash is would just ensure its continued use as it is today, crowding out either of those efforts.
Yes, that would also work in the sense of improving compatibility, but it would still leave the other players competing with Adobe's own. Eventually they might prevail, due to being less security-bug-ridden, but in the interim we'd still be worse off.
Also, this whole discussion is moot because open-sourcing Flash ain't gonna happen. I can practically guarantee that it's too entangled with other companies' IP for that to happen. Maybe the people who are arguing that we should treat open source as an alternative to the trash can (which is pretty damn insulting to those of us who actually produce open-source software) could spend just a little bit of their obviously-copious free time lobbying to change that IP regime.
> but it would still leave the other players competing with Adobe's own.
You have that backwards.
The effort going into open source projects emulating a closed source product are wasted if that closed source project can be open sourced. That's a win for everybody, after that the effort can be directed to something more important because perfection is now attainable.
The only reason these open source projects exist in the first place is because the reference implementation isn't open sourced. I'm pretty sure the maintainers of those projects will welcome such a move by Adobe, there is no innate right to some kind of 'protected space' for open source projects that purposefully aim to provide an open implementation of a closed source product. Obviously one of the risks of embarking on such a project is that the original may one day be open sourced.
> The effort going into open source projects emulating a closed source product are wasted if that closed source project can be open sourced.
Yeah, that Linux thing just died when Solaris was open-sourced. Even more relevantly, IE and Chrome.
> perfection is now attainable.
That's cute. As somebody who has actually produced software for thirty years (but without ever hitching my wagon to Flash like some here) I'm a bit more skeptical about the likelihood of taking a gigantic long-lived ball of mud and making it perfect. In particular, security is hard to bolt on after the fact. I certainly wouldn't assume that the maintainers of other implementations would be overjoyed by the prospect. Just look at how many reimplementations there are of things that were already open source. I'd say it's unlikely that a significant number of people will work on Flash without being paid to do so.
> Yeah, that Linux thing just died when Solaris was open-sourced.
I fail to see the relevance. Linux never tried to be an 'open source Solaris clone' and of course it didn't die off, in fact, it flourished, which sort of undermines your argument.
> Even more relevantly, IE and Chrome.
What of them? I could see Mozilla vs IE.
> As somebody who has actually produced software for thirty years
Appeal to authority ;)
> but without ever hitching my wagon to Flash like some here
Join the club. I absolutely hated Flash and for many years resisted using it to deliver video.
> I'm a bit more skeptical about the likelihood of taking a gigantic long-lived ball of mud and making it perfect.
Perfect as in 'perfect emulation', not perfect as in perfect all across the board. Having the Flash source would allow the open source implementations to look at how things were done so they can emulate all behavior up to and including the bugs. If Adobe would open source it then they would not have to avoid looking at even disassemblies of the Flash code.
> In particular, security is hard to bolt on after the fact.
This is not about future developments in Flash, it is about digital archeology. If you start seeing it through that lens then maybe you will be a bit more relaxed about it.
Nobody is suggesting that Flash be given eternal life or that we will have another round of Flash content if Flash is open sourced. The sooner it is gone from the web the better. But that old stuff still remains and maybe one day someone wants to review it. That is what this is about. CF people using C64 Roms or Nintendo stuff 3 decades old.
> I certainly wouldn't assume that the maintainers of other implementations would be overjoyed by the prospect.
Did you ask them?
> Just look at how many reimplementations there are of things that were already open source.
So what? Fragmentation is the very power of open source at work.
> I'd say it's unlikely that a significant number of people will work on Flash without being paid to do so.
Exactly. So that is - again - why open sourcing the old Flash player is a good thing.
> Improving the already-open-source players would be a better alternative.
Between the options of open-sourcing an already-complete and canonically "correct" implementation, and having Adobe document their code and interfaces and improving the partial (but open) implementations that we have, it seems like the latter involves a lot more work. I guess I don't see the benefit.
Open sourcing it won't help preserve content - that's far more effectively achieved via VMs and using the archived players which Adobe provide (and will hopefully continue to provide or allow preservation of on abandoware or other sites).
Maintaining the build systems, compatibility layers and so forth won't be easy (Adobe often couldn't manage it), and bug fixing in the code is a risky prospect for preservation as it could render older content unplayable or differently playable.
The swf file format is almost open - it would be nice if Adobe updated the published specification to the latest format. Again that would go some way towards ensuring the content remained available in some way.
Edit: genuinely interested in the downvotes here - am I missing something fundamental about content preservation? It seems logical to me that the file spec being available + original players is far more valuable than the source, as the source will then bitrot without continuous maintenance. In comparison the players will always run in the VMs.
Not sure if you know but Adobe open source the Flex framework, is now part of Apache and it continued to be used in projects. If Flash and AIR could be open sourced, we could ahve an alternative for GUI application development(nothing wrong with choice) and AIR could compete with Electron
I've had the misfortune to work with Flex - I really didn't enjoy it. It was also incredibly difficult to make Flex apps accessible in a meaningful way.
AIR did hold promise, but ultimately suffered from being terribly cumbersome to extend when you wanted to access native features or platform standard libraries (I've created several AIR native extensions over the years).
However, one of the big problems with using Flex or AIR after Adobe have end-of-lifed Flash is that you're going to lose access to the content creation tools. There are some alternatives (FlashDevelop and FDT for coding, I forget the name of the attempt at an open source Flash timeline editor), but nothing is close to being as good as Adobes own tools when you want to.
If you want to leverage knowledge of ActionScript, people may be better off looking at something like Haxe for cross platform gui app dev.
I would not start a new project in Flex/AIR but I am stil bug fixing existing projects. I use Intelli IDEA, I do not need the drag and drop GUI editor I learned how to make good layouts editing the XML and it is much more simpler to layout components using Flex(or other GUI toolkits , I used Qt and WPF ) then using divs and css(thought he new flexbox in css improved the situation),
So in Flex(Qt,and others) you have components like listboxes, dropdowns, DataGrids that are very flexible , you want an item to look different you create an item renderer and reimplement the paint method in AS3 or if is simple enough in plain XML(or using the GUI Designer)
In HTML5 land you do not have such flexible components as standard so you need to find an open source or buy this compoenents or implement one.
You can say it is easy to implement a dropdown(built in one can't show icons and can't be customized), you hack some divs,lis and some css and it is done. But later you find that you did not consider corner cases, your implementation opens outside of the screen if dropdown is on the bottom of the page, the dropdown has no property where you can ask "show max 6 element, probably you did not add all the standard hover effects, and not implemented all the events,
My point is that in Flex and other toolkits you can do a good GUI with good layout using the built in stuff and no hacks(I am thinking at css where some obvious thing did not worked for me until I found on SO that I need to set min-width to 0 so the css engine finding this useless rule would take a different path and display the expected thing).
Can you share what GUI toolkits you used and what features you loved from each one? Thanks
I tend to use the native UI for each platform I work on. My general opinion of cross platform UI frameworks these days is that they for developer convenience - they don't help the users. However I'm also aware that persuading the budget holder that users are worth spending money on is hard :)
For the drop downs - when I used Flex I had the same issues over window bounds, in that nothing could extend beyond the limits of the flash rendered window. Did they fix that in later versions?
You can extend over window bounds, what I meant is the dropdown should open up or give you a property to allow you this option, also Flex dropdowns had the property you can set how many items are visible at a time.
I learned Adobe AIR because my employer liked it better then Qt at that time and he also trusted Adobe products, moving from c++/Qt (and previous C# Winforms and WPF) to AIR was a downgrade in some aspects but after you learn it you can do your job and implement most of the things fast.
What do you use for creating native apps for Windows, I do not know what is the prefered thing this days?
It's not about making it available for continued production use. It's about archiving the content people created with it.
That's getting harder and harder to do as platforms get more and more complicated. "Mostly" compatible is less than helpful. Having access to the actual primary Flash implementation would be invaluable for preservation efforts.
Is there still a standalone Flash player? (or at least, will the debug version work?) Haven't messed with Flash stuff in over a decade but I remember having a standalone player to play downloaded SWF files back in the day. No idea if there's anything roughly equivalent out there in its current incarnation.
A sandboxed player application would go a long way toward the uses mentioned in this thread, no? I wonder when we'll start seeing Flash emulators being developed to play back all that old content.
A dead project due to the shear complexity and obfuscation and proprietary bug/feature weirdness (e.g. undocumented relied upon in some edge case feature/bugs tend to exist in proprietary single-implementation systems) of flash.
Things like Mono took a decade to finish as an exact clone of a portion of Microsoft's implementation, and that was only possible because the people using it (the target audience begin linux programmers) could fix the code as needed. Flash's target audience is artists.
Flash will not be further developed by 2020, but it does not mean the Flash Player suddenly will stop running the SWF files. You will still be able to play them using Flash Projector.
I thought we're talking about Flash here? You know, the thing that only works on a subset of browsers on the three major desktop OSes and has absolutely zero modern mobile support.
Almost everything that has been done with Flash falls in to one of two categories:
1. Things that should be done in standard and truly universal HTML5, generally with assistance of Javascript, CSS, and SVGs. This includes every single media player and most non-interactive or lightly interactive animations, as well as all navigation elements for a web site. Your valentine's card example is definitely in this category.
2. Things that should be done with a proper game engine.
There's a very small margin in between those two mostly full of games too complicated to be practical in HTML+JS but too simple to really be worth the effort of a full game engine. Even that range is getting a lot smaller these days with the number of high quality game engines available for free to anyone who wants them.
Wasn't this basically what people said about Netscape pre-Firefox? That worked out, and ushered in a new age of Internet.
Flash has an immense amount of value built in which cannot be replaced by any of the alternatives. Maintaining and fixing old code isn't as sexy as jumping on the latest competing standard, but it's far more valuable.
Even if we don't continue to develop new features for Flash, it's important to keep it alive so we don't lose the ability to run the wide variety of flash programs which at this point make up a significant portion of Internet culture and history.
Open source projects with no large company support or full-time employees == no browser will want to continue to support this.
Open sourcing flash just means that devs who have spent years building games in flash can still play those games. It is still a death sentence for the future of flash.
False. The standalone Flash Player will not suddenly stop running. In fact, you will be able to open your SWF files for a long time, just not in web browsers, but using Projector.exe or Swiff Player.
The security issues with Flash are due to it being closed-source. Make it open-source and a lot of the problems that lead it to being EOLed will be solved.
Sure, but they're also being defended constantly by armies of programmers. When a vulnerability is discovered, the four projects you mentioned are all awfully quick to issue and distribute patches.
Think about how Google pressured Microsoft to fix a vulnerability when MS was too slow to respond[1]. That's the kind of crap you see with proprietary development.
Open source is just a flat-out better method of developing software, but especially so when it comes to patching vulnerabilities.
Flash has very little to offer as a tool, but as a platform with thousands of hours of beautiful, creative content made for it (Homestar Runner, games, interactive art, etc), it will be tragic to lose all that art and history.
If we open-source Flash, at least museums will have an option to preserve that content for future generations to learn from and enjoy.
"Time to get rid of Flash" sounds more like irrational attitude than anything approaching positive evolution of technology. We are meant to push technology forwards, fix it, make it better, find the positive aspects, not get on high-horses with brand-loyalty agendas about what should die and what sucks.
The true purpose to open sourcing Flash is archiving / making it impossible to never be able to revisit Flash sites which are a huge part of internet history, e.g. NewGrounds and other sites.
I want to say "Java Applets", but that feels like trolling.
Really flash had its place for animations, games, and sound/video stuff. There isn't any single alternative, although a lot of things it was used for can be supported directly nowadays. (Things like using the clipboard, etc.)
It won't be what it is today, it'll mean that it will live on as a niche. There are large business applications written in Flex that actually work well. The existing open-source Flash alternatives will not serve these applications. It will cost hundreds of thousands of dollars to port these applications and bring little to no benefit to the organisations that use them.
I went to the Github page specifically to vote against this petition ... Using the star is more of a bookmark to me but it certainly doesn't provide a way to down vote the idea.
Quite the opposite. Flash allowed creativity on the web to grow whilst the web was being held back by IE6.
Aside from experiments in user interfaces, creative hubs like Newgrounds, YouTube and Vimeo relied on Flash to promote user-generated content on the web. I'd even go as far as saying without Flash those sites may have never existed.
Flash has very little to offer that is not at this point duplicated (or improved upon) by others. It's also woefully insecure. "Many eyes make all bugs shallow" will only work for the most trivial bugs in the most common code paths. Plenty of vulnerabilities will remain. In open source, they'll be even easier for attackers to find and exploit. If you want something open-source and (mostly) Flash compatible, follow nkkollaw's suggestion: support one of the already-open-source alternatives.