Flash support is increasingly a minefield

Back in 2011, I mentioned that Microsoft was about to halt development of the Silverlight plugin, that Flash mobile was being discontinued, and that Adobe recommended HTML5 for enterprise RIA development instead of Flex, which was being open-sourced. My post was a little long-winded, but the short version was: whoa, the times-are-a-changin’, it’s getting dangerous to rely on browser plugins.

Over the last year, the situation has evolved in an interesting way — browser support for plugins (especially Flash Player) has been considerably restricted by browser vendors due to repeated security vulnerabilities in Flash Player and Java.

Automatically disabling Flash Player

In May 2012, Apple’s Safari browser began automatically disabling outdated versions of Flash Player: “Out-of-date versions of Adobe Flash Player do not include the latest security updates and will be disabled to help keep your Mac secure.” If a webpage contains a SWF but the installed edition of Flash Player is deemed out of date, Safari will display a “blocked plugin” message and inform the user they need to download the latest edition of Flash Player at adobe.com. This change came with Adobe’s blessing.

In January 2013, Mozilla introduced a global “click to play” mechanism that disables ALL plugins in Firefox by default, except the latest edition of Flash Player:  “Our plan is to enable Click to Play for all versions of all plugins except the current version of Flash.”

To Adobe’s credit, Flash Player updates are being released at a fast clip to address known security vulnerabilities. Unfortunately, this has a nasty side effect: you’re very likely to have an outdated edition of Flash Player when you try to view Flash content on a website. (By my unofficial count, there have been at least 13 updates over the past calendar year, averaging about once a month.)

At a recent job, I managed a small network of Macs in classrooms. The Macs were set up to use Adobe’s ‘automatic updates’ feature for Flash Player, but they never seemed to update fast enough — we received numerous complaints from classroom users who couldn’t view Flash content because Safari blocked it.

Internet Explorer’s on-again, off-again relationship with Flash Player

I previously mentioned that Microsoft’s Windows 8 ‘Metro’ mode disabled all plugins, including Flash Player; Microsoft said Internet Explorer in Windows 8 Metro mode “provides an add-on–free experience, so browser plugins don’t load and dependent content isn’t displayed“.

In May 2012 Microsoft changed their minds and enabled Flash in Metro mode. BUT… Microsoft will ship Flash Player as a component of IE 10 (much like Google Chrome does), and will restrict which sites are allowed to run Flash! “While any site can play Flash content in IE10 on the Windows desktop, only sites that are on the Compatibility View (CV) list can play Flash content within Metro style IE.”

In other words, if you don’t have Microsoft’s blessing, your Flash site will not work when viewed in Metro mode.

Update: @chris_sage pointed me to a post by Microsoft written just three days ago where they apparently changed their minds again — almost a year after saying they’d require a whitelist, they now say they support Flash Player by default in Metro mode without requiring sites to be whitelisted.

What it boils down to…

If you develop Flash-based content, it will be more and more of a challenge to provide a smooth, problem-free user experience. For e-learning developers, one of the original lures of Flash was the ubiquity of Flash Player; Flash made it easy to provide the same e-learning experience across browsers and platforms. Due to fragmentation in Flash support, this no longer appears possible.

  • Adobe says: No Flash Player for mobile devices.
  • Microsoft says: No Flash Player on Surface tablets (or other Windows 8/RT tablets) unless the user switches to desktop mode OR gets on our whitelist for Metro mode. We love us some Flash! But we’ll manage the security updates ourselves, thank-you.
  • Mozilla says: Only the latest edition of Flash Player for Firefox.
  • Apple says: No Flash Player on Apple iOS devices, and only the latest edition of Flash Player for desktop Safari.
  • Opera says: Flash Player on desktop editions of Opera? No problem. Flash Player in Opera Mobile? Don’t get mad at us, Adobe stopped providing Flash Player for mobile devices!
  • Google says: We control Flash Player for Chrome (desktop) ourselves. No worries. Flash Player in Chrome on mobile devices? Don’t get mad at us, Adobe stopped providing Flash Player for mobile devices!

The browser vendors are enforcing their will. You don’t have to be a Flash-hater to see that building Flash-dependent sites is a minefield.

For those of you in e-learning who depend almost completely on Flash-based courseware, it’s a good idea to start looking for alternatives.




FlashCamp and Flash CS4

I attended FlashCamp this weekend (except Sunday) at Adobe’s San Francisco offices. It was really cool of Adobe to create a free event filled with tons of goodies, great food (including free beer), free massages(!) and even free licenses for Flash CS4! I admit I think I ate too many cookies and rice krispie treats… I couldn’t resist. (FYI Gordon Biersch’s Marzen lager doesn’t go very well with rice krispie treats.)

Everyone seemed to have a great time. It was a nice mix of people; I thought I’d feel very out-of-my-league, but there were all kinds of people there, including regular Joes like me, many designer/developer industry-types, and lots of Adobe peeps, including key members of the Flash authoring and Flash Player product teams. Even ran into Geoff from SWFObject/YouTube. Kudos to Dom Sagolla for putting it all together; apparently they whipped the whole thing together in about 2 weeks, which is pretty amazing considering the turnout and number of goodies provided.

As for Flash CS4 (aka Flash Professional 10), it definitely has some major enhancements worth checking out. Most of the advancements are designer-oriented (as opposed to coder/developer-oriented), but they touch on AS3, too. I didn’t take notes and can’t tell you about every new feature (I doubt I heard about all of them), but here are my favorites based on what I saw in the live demos: the Bones tool (WAY cool), the changes to working with tweening in the timeline (also WAY cool and a huge improvement), and most importantly (and probably most controversial or overlooked): the CS4 interface itself. It takes a while to get used to, but I really like it, especially on a Mac. I wasn’t enjoying all those floating windows in earlier versions of Flash Professional… I prefer docked panels like those available in CS4. (I believe docking can be toggled off if you don’t like it.)

Flash Player 10 was also demoed, and it looks good, except for a few security changes that make great sense but may also break sites (again).

We were told Flash CS4 would be shipping very soon (a week maybe?); I assume they’ll have demo versions online around that time. I strongly suggest downloading it and trying it out, it’s pretty cool.

Oh, one thing that hasn’t changed: the ActionScript editor. Still bare-bones with no new features that I know of.

Most telling part of the experience? Dom was trying to partner up people for the hackathon projects. One particular guy was interested in working with Flash Lite (used for mobile devices) and was looking for people to work with. Dom asked the crowd — probably over 100 people — if anyone in the house had experience with Flash Lite. Not a single person raised their hands. Mind you, people raised their hands for all kinds of other stuff, ranging from writing AS3 classes to PixelBender to Subversion to graphic design, but no Flash Lite. Hmm…

In closing I think it’s safe to say this event raised my opinion on Flash and the direction(s) Adobe is heading with it. When you read blog entries or news articles about Flash, it really doesn’t give you a great sense of what’s going on, but when you hear from the employees themselves, things are much more exciting than I realized, and it sounds like some pretty interesting (and still undisclosed) features are in the works for Flash 11 (or CS5, whatever they choose to call it).