Intent to implement: HTML5 by Default

[Anthony LaForge]

Contacts

Eng: gr...@chromium.org, tomm...@chromium.org

PM: laf...@chromium.org

Target

Q4 2016

Summary

Navigator.Plugins() and Navigator.MimeTypes() will only report the presence of Flash Player if the user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.

Motivation

While Flash historically has been critical for rich media on the web, today in many cases HTML5 provides a more integrated media experience with faster load times and lower power consumption.  This change reflects the maturity of HTML5 and its ability to deliver an excellent user experience.  We will continue to work closely with Adobe and other browser vendors to keep moving the web platform forward, in particular paying close attention to web gaming.

Details

Later this year we plan to change how Chromium hints to websites about the presence of Flash Player, by changing the default response of Navigator.plugins and Navigator.mimeTypes.  If a site offers an HTML5 experience, this change will make that the primary experience.  We will continue to ship Flash Player with Chrome, and if a site truly requires Flash, a prompt will appear at the top of the page when the user first visits that site, giving them the option of allowing it to run for that site (see the proposal for the mock-ups).

To reduce the initial user impact, and avoid over-prompting, Chrome will introduce this feature with a temporary whitelist of the current top Flash sites(1).  This whitelist will expire after one year, and will be periodically revisited throughout the year, to remove sites whose usage no longer warrants an exception.

Chrome will also be adding policy controls so that enterprises will be able to select the appropriate experience for their users, which will include the ability to completely disable the feature.

(1) Where aggregate usage of a specific domain puts it in the top 10 domains using Flash, based on Chrome’s internal metrics.  Those sites currently are:

1. YouTube.com

2. Facebook.com

3. Yahoo.com

4. VK.com

5. Live.com

6. Yandex.ru

7. OK.ru

8. Twitch.tv

9. Amazon.com

10. Mail.ru

Presentation

HTML5 by Default Proposal

[PhistucK]

(Adding blink-dev)

Why would YouTube need Flash? Oh, the video manager? Can you work with them in order to replace that with an HTML5 alternative?

> if a site truly requires Flash

How are you going to detect that? Flash checking scripts usually query navigator.plugins first, I think?

☆PhistucK

--
--
Chromium Developers mailing list: chromi...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-dev
---
You received this message because you are subscribed to the Google Groups "Chromium-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-dev...@chromium.org.

[Matt Giuca]

On Tue, 10 May 2016 at 17:00 PhistucK <phis...@gmail.com> wrote:

(Adding blink-dev)

Why would YouTube need Flash? Oh, the video manager? Can you work with them in order to replace that with an HTML5 alternative?

> if a site truly requires Flash

How are you going to detect that? Flash checking scripts usually query navigator.plugins first, I think?

From the slides, it looks like they are going to consider a site to "truly require Flash" if it either a) just goes ahead and tries to use Flash without checking, or b) links the user to Adobe's Flash download page. In either of these events, it prompts the user.

I agree there is something a bit strange about this policy; it means that if a site just goes ahead and uses Flash without checking, it will get the degraded-but-functional behaviour of prompting the user (once) then running Flash. But if a site does the arguably more responsible thing of

if ('flash' in navigator.plugins) {

  runFlash();

} else {

  error('You need Flash');

}

(without having either a non-Flash fallback or a link to the Flash download page), then these sites will just stop working even though they could be using Chrome's Flash. I guess they will quickly learn to change the logic, though.

[PhistucK]

Sorry for not watching the slides - I am simply firewalled here, so I cannot access Google Drive before the evening. :(

And I agree with Matt.

☆PhistucK

[B Galliart]

On Monday, May 9, 2016 at 5:35:28 PM UTC-5, Anthony LaForge wrote:

Presentation

HTML5 by Default Proposal

This is a good step forward but I do not think goes far enough.  Just last year, Yahoo was involved in one of the largest malvertising campains.  While they eventually got around to blocking the account, they did nothing to take responsibly for the victims already infected by them.  Just being in the top ten domains to publish flash files does not mean they are trustworthy across the entire domain.

It would be nice to have something much more granular.  Adobe Flush Builder for a while has supported code signing.  It would be nice if Chrome had the concept of developer in addition to publisher when choosing what should be allowed to be run.  As such, I would want Chrome to be able to understand, verify and present to the user information on the status of a code signed SWF file before passing it to the plugin.  A user should be able to make a distinction between an yahoo.com published flash signed by yahoo.com, an yahoo.com published flash signed by adobe.com, an yahoo.com published flash signed by malware.xxx and an yahoo.com published flash that is unsigned.  If I want to trust only flash code signed by adobe.com which is served by yahoo.com and reject code signed by yahoo.com, malware.xxx and unsigned flash then I should be able to do so.  The currently purposed system doesn't seem to allow for this and seems to favor a much more all or none permission model based strictly on the publisher.

There should also be an option to only trust flash published via TLS such that https://yahoo.com/ is permitted to provide flash but http://yahoo.com is not.  It would also be nice if this option was on by default.

[Ruben Gerlach]

May I kindly ask what is the long term goal for the Chromium team? Will you be satisfied with this step or is the long term stragety to completely eradicate Flash from Chrome? We have a successful gaming company built on Adobe Flash and both our users and us are very happy with the technology. Do you have plans to further decrease support for Flash in Chrome beyond this specific feature?

Thanks

[PhistucK]

While you may not get an official answer, it is obvious (to me, anyway) that the plan is to eliminate Flash (whether that means replacing it with a web based runtime like Shumway until it fades away, I have not idea). Remember that it is already completely unsupported on mobile and most of the users use mobile anyway nowadays.

(The writing has been on the wall for years, so I am personally somewhat surprised you got that far with Flash)

☆PhistucK

--

[Ruben Gerlach]

Thanks for your reply. I would like to avoid a Flash vs HTML5 discussion, but let me say this: Our company would not be where it is right now if it would not have been for Flash. We use the Flash runtime in Air to deploy to iOS, Android and Desktop and the Flashplayer on the web. Until a short while ago, there was no competing technology that would allow high quality content to be run in the web and on mobile with one codebase. (We forward mobile users in the browser to our Air (read Flash) apps in the appstore, which is the desired solution for games anyway. I am not talking about generic web services.) Unity *might* be a viable option today with export to WebGL, but it was not six months ago. Our codebase is huge, so moving to another technology would impact us (and other Flash based game companies alike) heavily. And what I would really appreciate is if our own descrete internal decisions would not be forced by Google or other companies that think they know best for everyone.

[PhistucK]

Note that only the browser option will be impacted. You could still redirect your users to install your game and just use Air, like you do on mobile anyway.

☆PhistucK

On Mon, May 16, 2016 at 12:10 PM, 'Ruben Gerlach' via Chromium-dev <chromi...@chromium.org> wrote:

Thanks for your reply. I would like to avoid a Flash vs HTML5 discussion, but let me say this: Our company would not be where it is right now if it would not have been for Flash. We use the Flash runtime in Air to deploy to iOS, Android and Desktop and the Flashplayer on the web. Until a short while ago, there was no competing technology that would allow high quality content to be run in the web and on mobile with one codebase. (We forward mobile users in the browser to our Air (read Flash) apps in the appstore, which is the desired solution for games anyway. I am not talking about generic web services.) Unity *might* be a viable option today with export to WebGL, but it was not six months ago. Our codebase is huge, so moving to another technology would impact us (and other Flash based game companies alike) heavily. And what I would really appreciate is if our own descrete internal decisions would not be forced by Google or other companies that think they know best for everyone.

--

[Richard Davey]

While I agree that the writing has been on the wall for a long time now, and this kind of move should absolutely not be a surprise to anyone, I do wish that they wouldn't be so half-way house about it. Because it clearly just confuses everyone.

Either let Flash live on, for as long as Adobe care to patch it, or kill it off properly and be done with it. Then at least you don't get stuck with the problem of companies like Ruben's (and I suspect many others) not really having a clear idea of what the intention actually is. White lists do nothing but muddy the waters.

[Ruben Gerlach]

I would like to add two thoughts:

1) HTML5 is a great tool for building websites, but it is a not so great tool for building games. Even if the Chromium team makes these decisions in good faith, they are completely overlooking a niche of developers that make a living on products that are not ideally built in HTML5. Why do you dictate an oppinion and force everyone to change the toolkit instead of having every developer making their own informed decision on the tool that is best suited for the intended job?

2) This one is a quote from the AS3 Facebook group: "This list of exceptions containing the most accessed websites on the web attest that Flash is not dying but being buried alive."

[radu birsan]

I don't like this.

[Thaek]

If you read any IT news in the last few years it has been pretty obvious that Flash is phasing out, even Adobe themselves called it dead. The future will be a world without flash - may it be in 2 years or even 10 years. If your hole business model is based on Flash you better adopt quickly or die slowly.

Thaek

[Arianit Uka]

If you Google 'top facebook games', and you browse to each one, you will find a majority of them use Flash. Here are a few of them:

- Candy Crush (50,000,000+ monthly users)

- Dragon City (10,000,000+ monthly users)

- Criminal Case (10,000,000+ monthly users)

- Angry Bird Friends (1,000,000+ monthly users)

I understand the need to remove Flash, but I think there needs to be a more serious discussion when it comes to how many games still use it and what to do with the companies that still depend on it. Development on Shumway seems to have halted and so for a lot of companies a re-write is the only option. If game companies need to re-write their game, it would be a good idea to give them a notice ahead of time. 

By the way, facebook.com appears to be on the whitelist, but is apps.facebook.com on that whitelist as well? 

[Richard Davey]

If you read the proposal it doesn't advocate the removal of Flash Player at all. In fact it clearly says "We will continue to ship Flash Player with Chrome". All it's saying is that users will now get this at the top of Chrome when visiting a page with Flash on:

https://www.dropbox.com/s/goblq7fis8shr1f/enableflashplayer.png?dl=0

The "white listed" sites however won't show the above bar, they'll bypass it automatically (and users can elect to turn the notification off entirely in the settings too)

Photon Storm Ltd.

http://www.photonstorm.com

Skype: richard.davey

Twitter: @photonstorm

Registered in England and Wales.

Company ID: 8036404

VAT Number: 136 4333 27

--

[Vakhtangi Beridze]

step by step google moving to completely remove flash player from Chrome. IMHO 

[Ruben Gerlach]

Richard: Apart from the fact that adding another layer or approval will decrease user retention and that the suggested function will be unintuitive for users (clicking install Flash to activate it on every webpage), my initial question was if the Chromium team has actual long term goals to further lower Flash support for Chome beyond this specific feature. Right now it is very unclear if they just want to add another layer over Flash or if they plan to remove Flash once and for all in the long run. If they plan to remove it, it would be nice to know in advance so we can plan ahead for a rewrite of our games from scratch.

[Richard Davey]

I agree 100%. But that isn't what _this_ proposal is about.

Photon Storm Ltd.

http://www.photonstorm.com

Skype: richard.davey

Twitter: @photonstorm

Registered in England and Wales.

Company ID: 8036404

VAT Number: 136 4333 27

[James Welbes]

I don't believe the Facebook feed uses Flash, I'm pretty sure it's just their games. 

If that's true, then logic would dictate that when they say they will allow Facebook to run Flash, that they're referring to apps.facebook.com.

They'll likely just whitelist the entire facebook.com domain, including all subdomains/subdirectories.

Flash is dead. Adapt. Or don't. Whatever.

[zwetan kjukov]

I'm not sure how much thoughts have been put in this "rough draft" proposal

but here few points

1. whitelisting does not work

   ask Microsoft who tried to do that with IE

   users were so not happy they had to revert it

2. only including the top 10 web sites is optimistic at best

   I think the web is a bit bigger than the top 10 web sites

   what about all those games portal that have a lot of Flash content

   and are ranked in the top 100 or so ?

   what about the one page web sites (very small web site) who want to demo their Flash game ?

   what about other medias site like the BBC, or even Google Music ?

   Even including the top 1000 web sites would still leave a lot of producers and users not happy at all

3. 1 year temporary whitelist ?

     you must be kidding right ?

     is that some kind of ultimatum to any web sites still showing Flash content

     that they basically have a 1 year deadline till their content would not display at all ?

4. I find particularly evil to highjack the user experience

   If you don't want users to use Flash simply because you think HTML5 is better or whatever reason

   fine, then just don't bundle the Flash Player plugin into Chrome

   and let the users decide if they want to install or not the plugin for themselves

   I'm pretty sure Google have statistics about usages and user preferences when it come to Flash content

   which would probably explain why the Flash Player plugin is bundled by default in the first place

   You can not have your cake and eat it

   eg. you can not be liked by all those users who still want to consume Flash content

   and at the same time blocking every single web sites using Flash content

   Highjacking a URL redirect is particularly evil imho, what's next ?

   hey let's highjack facebook.com and redirect to google plus URL instead ?

5. It is about user experience and content

    nobody cares which technology is used unless you are a developer

    this proposal is the perfect way to pisses off a lot of users who just want to consume some Flash content

    advertising is not content, you can go all the way and block ads, and flash ads in particular

    users will be very happy, and if you don't they will use an ad blocker anyway (wether the ads is Flash or HTML5)

    but make it really difficult to play games, to watch some animations, or any other kind of content

    and users will react

    

I'm a nobody and I don't care that much about Flash but I'm pretty sure you should brace for some backslash.

[PhistucK]

On Mon, May 16, 2016 at 6:02 PM, zwetan kjukov <zwe...@gmail.com> wrote:

 Highjacking a URL redirect is particularly evil

​It is definitely not evil (the intention is not to block your way to the Adobe Flash website, you know), it is just a questionable design decision.​

☆PhistucK

[Dan Rumney]

Will this post be the primary channel for updates to the propsal?

If not, will this forum be the primary channel?

If not, what will be the primary channel? Our products currently rely on Flash and we'll need to know how to update them in order to make our sites respond correctly to Chrome's new behaviour.

[Jeremy Martin]

I think the intent here is both obvious and good, but it stings a little bit for sites that still legitimately rely on Flash. When it comes to real-time content delivery, HTML5 video is an ongoing train wreck; the browser support matrix looks like splatter art as performed by a chimpanzee, and exempting YouTube from the new rules comes across as a bit of a concession of this.  With few exceptions, I don't think that anyone still really "likes" Flash, but from a UX perspective it's still a necessary evil for some use-cases, and throwing the confirmation step in there torpedoes whatever redeeming qualities that UX still had.

Until all evergreen browsers share a common streaming protocol and overlapping codecs for live, low-latency video (and so help me if anyone suggests HLS), developers are going to feel embittered at watching a video company organizationally tied to Chrome getting a free pass. Just my 2¢, as someone who relies on delivering live, low-latency video for a living.

On Monday, May 9, 2016 at 6:35:28 PM UTC-4, Anthony LaForge wrote:

[PhistucK]

Keep in mind that (as far as I know) most (if not all) of the Chrome users do not use Flash for playing YouTube video. I am pretty sure the editor is the one to blame here. YouTube defaults to HTML5 for Chrome, as far as I know.

So while it is indeed a free pass of some sort, it is probably not for playing videos.

☆PhistucK

--

[axlmanu]

Hey Chrome devs,

What is the process for release process?

Once you announce the intent to implement, do you get feedback and base your decision on that? Or has the decision been already made and this is to test the waters for timing?

In any case, as i see,  Unity--> webGl is not ready for prime time. I have run some tests with basic games(beginning of the year) and depending on the machine specs of end user, it may or may not work. HTML5 game community is just beginning to ramp up and there are very few comparable games.

I would suggest that  waiting for WebAssembly will be a good idea before making a drastic decision like this one, as it really impacts businesses big and small alike.

I would love to participate in this discussion if you have another forum. 

Thanks,

Manu

[Kevin Feinberg]

The writing is obviously on the wall, but we've yet to see a plan from Google (and other vendors) for filling in the major functional gaps remaining. Many use cases can accomplished natively now. Some big ones still can't. Networking is a big one that is still quite limiting that impacts both media playback and gaming.

I get the motivation behind the opt-in user interaction (proposal looks reasonable), but don't skip ahead to plotting its demise until we've done the job of implementing open and native alternatives. If you're so anxious to pull the plug, you could have pushed the effort along a while back to ensure that there truly isn't an excuse left.

[AdamAce UKCC]

So im not seeing the point of this. You say Flash has all these vulnerabilities yet your still going to allow users to opt in to using Flash anyway? Why not wait for a true successor to Flash and take these steps then? Your just wasting your time in my opinion........

[Matthew Dempsky]

On Mon, May 9, 2016 at 3:34 PM, Anthony LaForge <laf...@chromium.org> wrote:

Navigator.Plugins() and Navigator.MimeTypes() will only report the presence of Flash Player if the user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.

What's the rationale for "top 10 domains"?  Why 10 domains, and not some other number?  Why not some other selection like top N% of traffic or how many/often users will be prompted to enable flash?

[Jeffrey Gilbert]

Does this mean that ads which measure viewability will be able to take advantage of IntersectionObserver before the roll out of this ambitious Flash killing feature? If not, the web is not ready for the Chrome team to turn off Flash support for instances smaller than 5x5. 

https://github.com/WICG/IntersectionObserver

On Monday, May 9, 2016 at 5:35:28 PM UTC-5, Anthony LaForge wrote:

Contacts

Eng: gr...@chromium.org, tomm...@chromium.org

PM: laf...@chromium.org

Target

Q4 2016

Summary

Navigator.Plugins() and Navigator.MimeTypes() will only report the presence of Flash Player if the user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.

[PhistucK]

Looks like IntersectionObserver will be supported in the next major stable release, Chrome 51 -

http://blog.chromium.org/2016/04/chrome-51-beta-credential-management.html

☆PhistucK

--

[Richard Davey]

From http://www.cnet.com/news/google-to-block-flash-on-chrome-only-10-websites-exempt/

A spokesperson for Adobe said it was working with Google in its goal of "an industry-wide transition to Open Web standards," including the adoption of HTML5.

"At the same time, given that Flash continues to be used in areas such as education, web gaming and premium video, the responsible thing for Adobe to do is to continue to support Flash with updates and fixes, as we help the industry transition," Adobe said in an emailed statement. "Looking ahead, we encourage content creators to build with new web standards."

If that isn't a clear enough sign, nothing is.

[Kevin Feinberg]

The blog coverage of Flash stuff is horrendous. Most of the authors are lazy, sensationalist, and/or don't know what they're talking about. Often the following article from last year, but the actual context of it is more so around their IDE / tooling product offerings.

https://blogs.adobe.com/conversations/2015/11/flash-html5-and-open-web-standards.html

Adobe has seen the writing on the wall for years and has been quite clear about encouraging a browser-native path. They'd love to get out of the business of supporting Flash (and who can blame them?). There's been great strides in recent years for eliminating the need for it under many use cases, but some big features are still missing.

There are still some products that Adobe is stuck running in Flash for the lack of an alternative. Google and others are in the same boat for some cases. The community is more than anxious to ditch Flash. Help us help you by filling in the gaps. People will jump ship amusingly fast in favor of a native implementation. However, in the meantime it may not be the best "solution" to degrade the user experience by default for legitimate use cases.
<