If Flash was implemented in JavaScript, which sounds slightly crazy but not entirely impractical, it probably wouldn't have nearly as many vulnerabilities.
When's the last time a JavaScript exploit was found? I know the Pwn2Own contests manage to bust out of the sandbox now and then, but this seems exceedingly rare compared to the near monthly super critical Flash updates.
I wouldn't say Shumway has failed, it's still an active and new project. I can pretty much use any "traditional" vector animated flashes on them. Video is still a problem due to codec patent issues, which is a bit sad because it's a legal obstacle, not a technical one.
The primary uses that I see, day to day, for Flash are:
1. Video players (which should be done natively)
2. Ads (which is an awful use case)
3. Fancy, but broken, font replacement (less so lately)
4. Weird, unnecessary utility, like copying text to the clipboard.
I don't see any reason to reimplement Flash in Javascript when all of these use cases can be better done in native HTML/Javascript already (1-3), or just not done at all (4). It seems like a huge amount of engineering effort to maintain an old technology that even its creator is migrating away from.
The reason is similar to why people build emulators for old game systems: To be able preserve history.
There's a lot of Flash games and applications out there that would be completely inaccessible to people were it not for the Flash player.
For example, the Homestar Runner site is built entirely on Flash, and while movie rips of this exist, there's small, subtle interactive elements only possible in the Flash version. http://www.homestarrunner.com/
When Flash is dead a large part of the web goes dark, and that's a tragedy.
> But then it would be even worse on battery life.
I'd claim the opposite: There's (at least) one less runtime needed when executing Flash within JS. Also, no extra graphic, audio, video, … stack that is executed alongside the browser stack.
There's a lot of legacy stuff that will never be reimplemented. For this content, you can use e.g. Mozilla's Shumway[1].
> 4. Weird, unnecessary utility, like copying text to the clipboard.
The JavaScript document.execCommand() clipboard APIs are available in Firefox 41+, Chrome, Safari, and IE. More discussion (in the issue tracker for ZeroClipbboard, a popular Flash clipboard utility):
When's the last time a JavaScript exploit was found? I know the Pwn2Own contests manage to bust out of the sandbox now and then, but this seems exceedingly rare compared to the near monthly super critical Flash updates.