Intent to implement: HTML5 by Default

[Anthony LaForge]

Contacts

Eng: gr...@chromium.org, tomm...@chromium.org

PM: laf...@chromium.org

Target

Q4 2016

Summary

Navigator.Plugins() and Navigator.MimeTypes() will only report the presence of Flash Player if the user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.

Motivation

While Flash historically has been critical for rich media on the web, today in many cases HTML5 provides a more integrated media experience with faster load times and lower power consumption.  This change reflects the maturity of HTML5 and its ability to deliver an excellent user experience.  We will continue to work closely with Adobe and other browser vendors to keep moving the web platform forward, in particular paying close attention to web gaming.

Details

Later this year we plan to change how Chromium hints to websites about the presence of Flash Player, by changing the default response of Navigator.plugins and Navigator.mimeTypes.  If a site offers an HTML5 experience, this change will make that the primary experience.  We will continue to ship Flash Player with Chrome, and if a site truly requires Flash, a prompt will appear at the top of the page when the user first visits that site, giving them the option of allowing it to run for that site (see the proposal for the mock-ups).

To reduce the initial user impact, and avoid over-prompting, Chrome will introduce this feature with a temporary whitelist of the current top Flash sites(1).  This whitelist will expire after one year, and will be periodically revisited throughout the year, to remove sites whose usage no longer warrants an exception.

Chrome will also be adding policy controls so that enterprises will be able to select the appropriate experience for their users, which will include the ability to completely disable the feature.

(1) Where aggregate usage of a specific domain puts it in the top 10 domains using Flash, based on Chrome’s internal metrics.  Those sites currently are:

1. YouTube.com

2. Facebook.com

3. Yahoo.com

4. VK.com

5. Live.com

6. Yandex.ru

7. OK.ru

8. Twitch.tv

9. Amazon.com

10. Mail.ru

Presentation

HTML5 by Default Proposal

[PhistucK]

(Adding blink-dev)

Why would YouTube need Flash? Oh, the video manager? Can you work with them in order to replace that with an HTML5 alternative?

> if a site truly requires Flash

How are you going to detect that? Flash checking scripts usually query navigator.plugins first, I think?

☆PhistucK

--
--
Chromium Developers mailing list: chromi...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-dev
---
You received this message because you are subscribed to the Google Groups "Chromium-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-dev...@chromium.org.

[Matt Giuca]

On Tue, 10 May 2016 at 17:00 PhistucK <phis...@gmail.com> wrote:

(Adding blink-dev)

Why would YouTube need Flash? Oh, the video manager? Can you work with them in order to replace that with an HTML5 alternative?

> if a site truly requires Flash

How are you going to detect that? Flash checking scripts usually query navigator.plugins first, I think?

From the slides, it looks like they are going to consider a site to "truly require Flash" if it either a) just goes ahead and tries to use Flash without checking, or b) links the user to Adobe's Flash download page. In either of these events, it prompts the user.

I agree there is something a bit strange about this policy; it means that if a site just goes ahead and uses Flash without checking, it will get the degraded-but-functional behaviour of prompting the user (once) then running Flash. But if a site does the arguably more responsible thing of

if ('flash' in navigator.plugins) {

  runFlash();

} else {

  error('You need Flash');

}

(without having either a non-Flash fallback or a link to the Flash download page), then these sites will just stop working even though they could be using Chrome's Flash. I guess they will quickly learn to change the logic, though.

[PhistucK]

Sorry for not watching the slides - I am simply firewalled here, so I cannot access Google Drive before the evening. :(

And I agree with Matt.

☆PhistucK

[B Galliart]

On Monday, May 9, 2016 at 5:35:28 PM UTC-5, Anthony LaForge wrote:

Presentation

HTML5 by Default Proposal

This is a good step forward but I do not think goes far enough.  Just last year, Yahoo was involved in one of the largest malvertising campains.  While they eventually got around to blocking the account, they did nothing to take responsibly for the victims already infected by them.  Just being in the top ten domains to publish flash files does not mean they are trustworthy across the entire domain.

It would be nice to have something much more granular.  Adobe Flush Builder for a while has supported code signing.  It would be nice if Chrome had the concept of developer in addition to publisher when choosing what should be allowed to be run.  As such, I would want Chrome to be able to understand, verify and present to the user information on the status of a code signed SWF file before passing it to the plugin.  A user should be able to make a distinction between an yahoo.com published flash signed by yahoo.com, an yahoo.com published flash signed by adobe.com, an yahoo.com published flash signed by malware.xxx and an yahoo.com published flash that is unsigned.  If I want to trust only flash code signed by adobe.com which is served by yahoo.com and reject code signed by yahoo.com, malware.xxx and unsigned flash then I should be able to do so.  The currently purposed system doesn't seem to allow for this and seems to favor a much more all or none permission model based strictly on the publisher.

There should also be an option to only trust flash published via TLS such that https://yahoo.com/ is permitted to provide flash but http://yahoo.com is not.  It would also be nice if this option was on by default.

[Ruben Gerlach]

May I kindly ask what is the long term goal for the Chromium team? Will you be satisfied with this step or is the long term stragety to completely eradicate Flash from Chrome? We have a successful gaming company built on Adobe Flash and both our users and us are very happy with the technology. Do you have plans to further decrease support for Flash in Chrome beyond this specific feature?

Thanks

[PhistucK]

While you may not get an official answer, it is obvious (to me, anyway) that the plan is to eliminate Flash (whether that means replacing it with a web based runtime like Shumway until it fades away, I have not idea). Remember that it is already completely unsupported on mobile and most of the users use mobile anyway nowadays.

(The writing has been on the wall for years, so I am personally somewhat surprised you got that far with Flash)

☆PhistucK

--

[Ruben Gerlach]

Thanks for your reply. I would like to avoid a Flash vs HTML5 discussion, but let me say this: Our company would not be where it is right now if it would not have been for Flash. We use the Flash runtime in Air to deploy to iOS, Android and Desktop and the Flashplayer on the web. Until a short while ago, there was no competing technology that would allow high quality content to be run in the web and on mobile with one codebase. (We forward mobile users in the browser to our Air (read Flash) apps in the appstore, which is the desired solution for games anyway. I am not talking about generic web services.) Unity *might* be a viable option today with export to WebGL, but it was not six months ago. Our codebase is huge, so moving to another technology would impact us (and other Flash based game companies alike) heavily. And what I would really appreciate is if our own descrete internal decisions would not be forced by Google or other companies that think they know best for everyone.

[PhistucK]

Note that only the browser option will be impacted. You could still redirect your users to install your game and just use Air, like you do on mobile anyway.

☆PhistucK

On Mon, May 16, 2016 at 12:10 PM, 'Ruben Gerlach' via Chromium-dev <chromi...@chromium.org> wrote:

Thanks for your reply. I would like to avoid a Flash vs HTML5 discussion, but let me say this: Our company would not be where it is right now if it would not have been for Flash. We use the Flash runtime in Air to deploy to iOS, Android and Desktop and the Flashplayer on the web. Until a short while ago, there was no competing technology that would allow high quality content to be run in the web and on mobile with one codebase. (We forward mobile users in the browser to our Air (read Flash) apps in the appstore, which is the desired solution for games anyway. I am not talking about generic web services.) Unity *might* be a viable option today with export to WebGL, but it was not six months ago. Our codebase is huge, so moving to another technology would impact us (and other Flash based game companies alike) heavily. And what I would really appreciate is if our own descrete internal decisions would not be forced by Google or other companies that think they know best for everyone.

--

[Richard Davey]

While I agree that the writing has been on the wall for a long time now, and this kind of move should absolutely not be a surprise to anyone, I do wish that they wouldn't be so half-way house about it. Because it clearly just confuses everyone.

Either let Flash live on, for as long as Adobe care to patch it, or kill it off properly and be done with it. Then at least you don't get stuck with the problem of companies like Ruben's (and I suspect many others) not really having a clear idea of what the intention actually is. White lists do nothing but muddy the waters.

[Ruben Gerlach]

I would like to add two thoughts:

1) HTML5 is a great tool for building websites, but it is a not so great tool for building games. Even if the Chromium team makes these decisions in good faith, they are completely overlooking a niche of developers that make a living on products that are not ideally built in HTML5. Why do you dictate an oppinion and force everyone to change the toolkit instead of having every developer making their own informed decision on the tool that is best suited for the intended job?

2) This one is a quote from the AS3 Facebook group: "This list of exceptions containing the most accessed websites on the web attest that Flash is not dying but being buried alive."

[radu birsan]

I don't like this.

[Thaek]

If you read any IT news in the last few years it has been pretty obvious that Flash is phasing out, even Adobe themselves called it dead. The future will be a world without flash - may it be in 2 years or even 10 years. If your hole business model is based on Flash you better adopt quickly or die slowly.

Thaek

[Arianit Uka]

If you Google 'top facebook games', and you browse to each one, you will find a majority of them use Flash. Here are a few of them:

- Candy Crush (50,000,000+ monthly users)

- Dragon City (10,000,000+ monthly users)

- Criminal Case (10,000,000+ monthly users)

- Angry Bird Friends (1,000,000+ monthly users)

I understand the need to remove Flash, but I think there needs to be a more serious discussion when it comes to how many games still use it and what to do with the companies that still depend on it. Development on Shumway seems to have halted and so for a lot of companies a re-write is the only option. If game companies need to re-write their game, it would be a good idea to give them a notice ahead of time. 

By the way, facebook.com appears to be on the whitelist, but is apps.facebook.com on that whitelist as well? 

[Richard Davey]

If you read the proposal it doesn't advocate the removal of Flash Player at all. In fact it clearly says "We will continue to ship Flash Player with Chrome". All it's saying is that users will now get this at the top of Chrome when visiting a page with Flash on:

https://www.dropbox.com/s/goblq7fis8shr1f/enableflashplayer.png?dl=0

The "white listed" sites however won't show the above bar, they'll bypass it automatically (and users can elect to turn the notification off entirely in the settings too)

Photon Storm Ltd.

http://www.photonstorm.com

Skype: richard.davey

Twitter: @photonstorm

Registered in England and Wales.

Company ID: 8036404

VAT Number: 136 4333 27

--

[Vakhtangi Beridze]

step by step google moving to completely remove flash player from Chrome. IMHO 

[Ruben Gerlach]

Richard: Apart from the fact that adding another layer or approval will decrease user retention and that the suggested function will be unintuitive for users (clicking install Flash to activate it on every webpage), my initial question was if the Chromium team has actual long term goals to further lower Flash support for Chome beyond this specific feature. Right now it is very unclear if they just want to add another layer over Flash or if they plan to remove Flash once and for all in the long run. If they plan to remove it, it would be nice to know in advance so we can plan ahead for a rewrite of our games from scratch.

[Richard Davey]

I agree 100%. But that isn't what _this_ proposal is about.

Photon Storm Ltd.

http://www.photonstorm.com

Skype: richard.davey

Twitter: @photonstorm

Registered in England and Wales.

Company ID: 8036404

VAT Number: 136 4333 27

[James Welbes]

I don't believe the Facebook feed uses Flash, I'm pretty sure it's just their games. 

If that's true, then logic would dictate that when they say they will allow Facebook to run Flash, that they're referring to apps.facebook.com.

They'll likely just whitelist the entire facebook.com domain, including all subdomains/subdirectories.

Flash is dead. Adapt. Or don't. Whatever.

[zwetan kjukov]

I'm not sure how much thoughts have been put in this "rough draft" proposal

but here few points

1. whitelisting does not work

   ask Microsoft who tried to do that with IE

   users were so not happy they had to revert it

2. only including the top 10 web sites is optimistic at best

   I think the web is a bit bigger than the top 10 web sites

   what about all those games portal that have a lot of Flash content

   and are ranked in the top 100 or so ?

   what about the one page web sites (very small web site) who want to demo their Flash game ?

   what about other medias site like the BBC, or even Google Music ?

   Even including the top 1000 web sites would still leave a lot of producers and users not happy at all

3. 1 year temporary whitelist ?

     you must be kidding right ?

     is that some kind of ultimatum to any web sites still showing Flash content

     that they basically have a 1 year deadline till their content would not display at all ?

4. I find particularly evil to highjack the user experience

   If you don't want users to use Flash simply because you think HTML5 is better or whatever reason

   fine, then just don't bundle the Flash Player plugin into Chrome

   and let the users decide if they want to install or not the plugin for themselves

   I'm pretty sure Google have statistics about usages and user preferences when it come to Flash content

   which would probably explain why the Flash Player plugin is bundled by default in the first place

   You can not have your cake and eat it

   eg. you can not be liked by all those users who still want to consume Flash content

   and at the same time blocking every single web sites using Flash content

   Highjacking a URL redirect is particularly evil imho, what's next ?

   hey let's highjack facebook.com and redirect to google plus URL instead ?

5. It is about user experience and content

    nobody cares which technology is used unless you are a developer

    this proposal is the perfect way to pisses off a lot of users who just want to consume some Flash content

    advertising is not content, you can go all the way and block ads, and flash ads in particular

    users will be very happy, and if you don't they will use an ad blocker anyway (wether the ads is Flash or HTML5)

    but make it really difficult to play games, to watch some animations, or any other kind of content

    and users will react

    

I'm a nobody and I don't care that much about Flash but I'm pretty sure you should brace for some backslash.

[PhistucK]

On Mon, May 16, 2016 at 6:02 PM, zwetan kjukov <zwe...@gmail.com> wrote:

 Highjacking a URL redirect is particularly evil

​It is definitely not evil (the intention is not to block your way to the Adobe Flash website, you know), it is just a questionable design decision.​

☆PhistucK

[Dan Rumney]

Will this post be the primary channel for updates to the propsal?

If not, will this forum be the primary channel?

If not, what will be the primary channel? Our products currently rely on Flash and we'll need to know how to update them in order to make our sites respond correctly to Chrome's new behaviour.

[Jeremy Martin]

I think the intent here is both obvious and good, but it stings a little bit for sites that still legitimately rely on Flash. When it comes to real-time content delivery, HTML5 video is an ongoing train wreck; the browser support matrix looks like splatter art as performed by a chimpanzee, and exempting YouTube from the new rules comes across as a bit of a concession of this.  With few exceptions, I don't think that anyone still really "likes" Flash, but from a UX perspective it's still a necessary evil for some use-cases, and throwing the confirmation step in there torpedoes whatever redeeming qualities that UX still had.

Until all evergreen browsers share a common streaming protocol and overlapping codecs for live, low-latency video (and so help me if anyone suggests HLS), developers are going to feel embittered at watching a video company organizationally tied to Chrome getting a free pass. Just my 2¢, as someone who relies on delivering live, low-latency video for a living.

On Monday, May 9, 2016 at 6:35:28 PM UTC-4, Anthony LaForge wrote:

[PhistucK]

Keep in mind that (as far as I know) most (if not all) of the Chrome users do not use Flash for playing YouTube video. I am pretty sure the editor is the one to blame here. YouTube defaults to HTML5 for Chrome, as far as I know.

So while it is indeed a free pass of some sort, it is probably not for playing videos.

☆PhistucK

--

[axlmanu]

Hey Chrome devs,

What is the process for release process?

Once you announce the intent to implement, do you get feedback and base your decision on that? Or has the decision been already made and this is to test the waters for timing?

In any case, as i see,  Unity--> webGl is not ready for prime time. I have run some tests with basic games(beginning of the year) and depending on the machine specs of end user, it may or may not work. HTML5 game community is just beginning to ramp up and there are very few comparable games.

I would suggest that  waiting for WebAssembly will be a good idea before making a drastic decision like this one, as it really impacts businesses big and small alike.

I would love to participate in this discussion if you have another forum. 

Thanks,

Manu

[Kevin Feinberg]

The writing is obviously on the wall, but we've yet to see a plan from Google (and other vendors) for filling in the major functional gaps remaining. Many use cases can accomplished natively now. Some big ones still can't. Networking is a big one that is still quite limiting that impacts both media playback and gaming.

I get the motivation behind the opt-in user interaction (proposal looks reasonable), but don't skip ahead to plotting its demise until we've done the job of implementing open and native alternatives. If you're so anxious to pull the plug, you could have pushed the effort along a while back to ensure that there truly isn't an excuse left.

[AdamAce UKCC]

So im not seeing the point of this. You say Flash has all these vulnerabilities yet your still going to allow users to opt in to using Flash anyway? Why not wait for a true successor to Flash and take these steps then? Your just wasting your time in my opinion........

[Matthew Dempsky]

On Mon, May 9, 2016 at 3:34 PM, Anthony LaForge <laf...@chromium.org> wrote:

Navigator.Plugins() and Navigator.MimeTypes() will only report the presence of Flash Player if the user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.

What's the rationale for "top 10 domains"?  Why 10 domains, and not some other number?  Why not some other selection like top N% of traffic or how many/often users will be prompted to enable flash?

[Jeffrey Gilbert]

Does this mean that ads which measure viewability will be able to take advantage of IntersectionObserver before the roll out of this ambitious Flash killing feature? If not, the web is not ready for the Chrome team to turn off Flash support for instances smaller than 5x5. 

https://github.com/WICG/IntersectionObserver

On Monday, May 9, 2016 at 5:35:28 PM UTC-5, Anthony LaForge wrote:

Contacts

Eng: gr...@chromium.org, tomm...@chromium.org

PM: laf...@chromium.org

Target

Q4 2016

Summary

Navigator.Plugins() and Navigator.MimeTypes() will only report the presence of Flash Player if the user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.

[PhistucK]

Looks like IntersectionObserver will be supported in the next major stable release, Chrome 51 -

http://blog.chromium.org/2016/04/chrome-51-beta-credential-management.html

☆PhistucK

--

[Richard Davey]

From http://www.cnet.com/news/google-to-block-flash-on-chrome-only-10-websites-exempt/

A spokesperson for Adobe said it was working with Google in its goal of "an industry-wide transition to Open Web standards," including the adoption of HTML5.

"At the same time, given that Flash continues to be used in areas such as education, web gaming and premium video, the responsible thing for Adobe to do is to continue to support Flash with updates and fixes, as we help the industry transition," Adobe said in an emailed statement. "Looking ahead, we encourage content creators to build with new web standards."

If that isn't a clear enough sign, nothing is.

[Kevin Feinberg]

The blog coverage of Flash stuff is horrendous. Most of the authors are lazy, sensationalist, and/or don't know what they're talking about. Often the following article from last year, but the actual context of it is more so around their IDE / tooling product offerings.

https://blogs.adobe.com/conversations/2015/11/flash-html5-and-open-web-standards.html

Adobe has seen the writing on the wall for years and has been quite clear about encouraging a browser-native path. They'd love to get out of the business of supporting Flash (and who can blame them?). There's been great strides in recent years for eliminating the need for it under many use cases, but some big features are still missing.

There are still some products that Adobe is stuck running in Flash for the lack of an alternative. Google and others are in the same boat for some cases. The community is more than anxious to ditch Flash. Help us help you by filling in the gaps. People will jump ship amusingly fast in favor of a native implementation. However, in the meantime it may not be the best "solution" to degrade the user experience by default for legitimate use cases.

[zwetan]

> The community is more than anxious to ditch Flash.

ORLY ?

which "community" are we talking about here ?

the community of HTML5 developers ?

one thing is sure, there is no shame in bullshit

[Anthony LaForge]

Howdy folks,

Thanks to everyone who took the time to provide thoughtful feedback about this feature, it really was greatly appreciated.  E-mail unfortunately doesn't afford complex thread response chains, so we took a best effort at consolidating and trying to answer the key themes below, in a single e-mail.

Q. Why Now?

A. With the shift to Mobile, many sites have built pure HTML5 experiences, which they use when Flash Player is not present.  Internally we did a lot of testing and for most common browsing patterns, the web experience (when turning off Flash Player) is largely the same… This, in turn, informed our decision to do this now (i.e. we think that the web is ready).  Try disabling Flash Player in chrome://plugins, we think that you’ll be pleasantly surprised.

Q. Flash Player, HTML(5), and Gaming

A. Ultimately we think that the Open Web is the right platform for developers, especially as mobile devices become increasingly more prominent.  We think that we currently have a compelling story for Ads and Media, and are looking to invest more in technologies that enable web gaming (e.g. WebASM, WebGL2, etc…) to further improve our story.  Speaking of gaming, Mozilla has a great site to try out that demonstrates the capability of games on the Open Web.

Q. Does this mean that Chrome is deprecating Flash Player?

A. Flash Player is still widely used by many websites, we currently don’t have any plans to announce regarding deprecation.  Any future plans that we make will be based on usage and what’s in the best interests of our users.

Q. What about the whitelist?

A. Our whitelist will be based strictly on real usage numbers, the goal being to avoid over prompting users.  The whitelist will expire one year from the Stable launch of the feature, at which time, users will need to directly approve the sites.

Q. How did we pick the top 10?

A. We looked at the number of times that Flash was loaded, for a given domain, and ranked the sites by volume. After the 10th site, relative usage dropped below 1%, which was consistent w/ the line that we had held for the NPAPI wind down. The (current) top 10 sites represent ~28% of the total load volume, which we believe will have a material impact on the number of prompts that most users see.

Q. Will the whitelist change, before Q4?

A. Perhaps, though it's likely to decrease in size (or have members replaced), rather than expand. As an example, we're working w/ the YouTube team right now to see if we can't find a way to get them off the list before we launch the feature (given the volume of Flash activity, 8.26% of all Flash Loads were from YouTube.com, we wanted to approach that with an abundance of caution).

Q. What about users (or sites) who still need Flash Player?

A. We’ll still continue to ship Flash Player with Chrome for the foreseeable future, we intend for it to be simple to enable on a per site basis and the preference will be a one-time choice for each site (i.e. we won’t prompt again).

Q. Will sub-domains also be whitelisted?

A. Yes, approvals are on per domain basis (e.g. apps.facebook.com would be under the approval for facebook.com).

Q. Anything else?

A. Yes, we're especially looking for feedback from games developers. In particular we'd like to understand the current set of challenges associated w/ targeting HTML5, whether it's platform capability, tool chain, etc... Having a better sense for the pain points will help us prioritize our development efforts.

Thanks again!

Kind Regards,

Anthony Laforge
Technical Program Manager
Mountain View, CA

[Ruben Gerlach]

Hi Anthony,

thanks for your writing. You are asking for feedback from game developers. OK here goes, you won't like it. I usually do not even bother to try to convince anyone, because mindsets rarely change. But maybe this one time it is worth it. Stay a while and listen...


Why not HTML5?

The last time we have built a minigame in HTML5 for a promo, it took way longer than we anticipated with our Flash experience. And in the end, we had a lot of nasty workarounds and bugfixes for different browsers, browser versions and OS versions. We ended up with if clauses that target specific environments (is this Android 4.2 and browser Firefox, or Windows Desktop with IE 8 then do this little workaround, ... etc). For an ad sized minigame! This is not what I have in mind when I think of a platform I want to develop games on. Games are such a higly complex thing that we can not afford wasting time fixing stuff for different browsers or browser versions. Go ahead and ask any game developers around.

Don't get me wrong, I do not doubt that games can be built in HTML5. The newschool developers coming from an HTML5 background will be used to all these nasty tricks, and they will not miss a sophisticated toolchain because they have never seen one. That does not mean there is good reason to force everyone to switch to this technology.

Besides, I have no doubt that Apple (and maybe Google, too) will do their best to sabotage HTML5 gaming on mobile. The 30% cuts in the appstore are much too sweet to have anyone cut a corner through the browser. And I hope no one has anyone illusions about what was the real reason that Flash never had a chance on iOS.

Why the timing is bad

You are trying to convince me that WebGL2 and WebASM will be worthy replacements for Flash. Really? Can we wait until they are out, industry proven and mature before we force everyone to do the switch? We started with our games in 2009. Do you know what we have done since then? We have written code. If we start over now, I will call it a success if we are done in less than a year. Without any other progress on the product itself! So forgive me that I do not jump any train that comes across as the savior of web gaming.

Let's talk about Flash

Usually when I talk to other developers, they have a complete misunderstanding of what Flash is and what it can do. So it might be worth spending some time on explanations. I hear the "but Flash does not run on mobile" way too often. It does! That what Adobe Air is for. I can easily deploy my Flash game to web, Android, iOS, Windows and Steam, MacOS and even Linux! With a single code base, and a mature, highly capable rendering engine, that will deliver identical results on any platform. Digest on that.

Flash is not a "necessary evil" for us, as some have put it. We, and our fellow AS3 developers think it is a great piece of technology, that just requires some attention and a marketing polish. It is much more powerful than anything that HTML5 is promising today. And we do not want to switch.

But Flash is bad

Oh really? This is my favorite topic. There is a certain hate against Flash that is mostly based on (horrible, as Kevin noted) press coverage on Flash and all the good stuff those people missed out on when they got their first iPhone. In any case, anyone will mention the "Thoughts on Flash" by Steve Jobs. Let's go dive into the details:

Battery Life: Of course, bad written Flash ads do drive your battery down, and it is for the better that no one is using Flash ads anymore. But wait. What are all those flashy ads that drain my CPU to the knees? Oh right, HTML5 ads. And did you know that although Flash was considered very bad for iOS, there was no objection to allow Air apps in iTunes, that are using the very same tech? There are even reports were Apple approved Air apps built in interpreter mode. That is kind of a debug mode to step through your AS3 code and it is very CPU intense to say the least. We are building games, and if any of our user complaints that they can not use their Notebook 9 hours but only 5 while they are playing our game, my recommendation to them would be to plug it in.

If you are really so worried that users will dislike Flash content, why don't you just let them make the decision which sites they will visit on their own? The times of Flash ads are over (and everyone begins to realize that HTML5 ads are not that much better) so the chance that someone consumes Flash content without having the intention to do so is quite low.

Security: Isn't Flash this thing that has an issue with security? As we are talking about Chrome here, it is very worth mentioning the PPAPI. I assume most readers are not aware of what exactly it is. Historically, browser plugins were written with the Netscape Plugin API, NPAPI. In short, it has problems with security, because it grants the plugin unregulated system access. That is why the Google team came up with the Pepper Plugin API, aka PPAPI. You see, the PPAPI was designed in a way that it does not easily allow for unauthorized system manipulation. Nowadays, Flash is built upon this PPAPI, because it is the only API that Chrome allows. By this point, all security issue allegations against Flash in Chrome are void.

Besides: It is curious how everyone celebrates the Flash security issues (that are usually fixed within 2-3 days by the Adobe team!) but ignores major security leaks in Android, Windows Font driver, Mozilla Firefox or iOS, that all had there shares of security issues. Go read what an awesome job they did: http://www.zdnet.com/article/android-you-have-serious-security-problems/

Many Android devices will still suffer from the above issue because many device manufacturers can not be bothered to update devices older than a year or two. Still, I do not hear anyone calling for the death of Android.

Adobe: Flash is bad, because it is proprietary software built by Adobe. Having a proprietary platform built by a single company is actually a good thing, because it guarantees identical results on any given platform. You see, browser vendors are not even able to agree on video codecs. Other than that I think Adobe does a really bad job of promoting Flash and Air, and it is the one thing that is shaking the AS3 developer community. Invest more, rethink the business model and give Google a share so they are happy to leave Flash in Chrome. We would be more than happy to pay more for licenses if in return we get a guarantee for support.

What will happen if Flash will be removed from Chrome

Other vendors will follow and within a couple of years Flash development will be halted. Air will follow sooner or later and in any case we will have to switch to another technology that allows cross platform deployment on web and mobile, which will cost us a full year of development stop in the best case. Our games make a considerable amount of revenue on Google Play and we usually release 1-2 games per year. That means Google will lose out on those revenue cuts because we will be occupied switching our codebase to another platform.

What would be the alternative?

I think because you do not understand Flash and Air, and especially the very passionate community of developers behind it, you are missing out on great potential. Go check the Air, ActionScript or Starling forums that are very much alive. Make one step further and imagine Flash would not be a bad thing but just a tool for developing apps and applications. The only thing it is missing is some love and support, and that is because Adobe fails to monetize the platform. Imagine Google would buy the platform, give it a marketing treatment and make every developer buy a fee per month, similar what Unity is doing. We would be more than happy to pay a subscription fee if we get the confidence back, that Flash and Air are here to stay, because they are great tools.



The last thing that I want to highlight is that I really dislike the way that Google is forcing everyone to comply to the "HTML5" world, because you say so. As pointed out, there are a lot of legitimate use cases for Flash, so why not just let everyone choose the tool that they think best for the job and let the users decide.

Thanks

[Vakhtangi Beridze]

beside gaming there is another issue, no real solutions for DRM, Camera and Microphone support in HTML5, real time chats and online conferences. 

[zwetan]

add to that E4X which is standard but not-implemented and ignored by

all major browser vendor

apparently some standards are not worth implementing

don't forget the <audio> tag which is real bad, even worst on mobile

but nobody cares as everyone goes on youtube right ?

for real-time chat

you have sockets API in Chrome but it's not standard

no worry when it's not standard but implemented by Chrome it's OK to use

I could go on for hours ...

standard:

word used by corporation only when it align with their agenda

On 18 May 2016 at 12:08, Vakhtangi Beridze <22r...@gmail.com> wrote:

beside gaming there is another issue, no real solutions for DRM, Camera and Microphone support in HTML5, real time chats and online conferences. 

--

[nguyen khuong]

Great Answer.

Vào 14:33:36 UTC+7 Thứ Tư, ngày 18 tháng 5 năm 2016, Ruben Gerlach đã viết:

[Ruben Gerlach]

You say > Any future plans that we make will be based on [...] what’s in the best interests of our users.

What I hear is: We have the strong desire to remove Flash because of reasons.

> Ultimately we think that the Open Web is the right platform for developers

I had to breed over this one a little while longer. May I ask: Who are you? What is your experience in gaming? How many people in your team have created any games? How many of those games were commercially successful? And how many among those have stood the test of time, browser version over browser version, year over year? And why on earth do you not plan to allow just both ways of creating games?

The decision that you are making here is affecting companies, careers, jobs and families. And it is not like decisions made on the table always turned out to be the best. I strongly urge you to not force anyone on your path unless you have the experience and proof that it really works out. And the HTML5 community still owes us this proof.

[benjamin BOUFFIER]

Hi,

As I understand you want to disable flash for site that have a HTML5 fallback.

Don't you think if site have HTML5 fallback but keeps the flash version don't have a good reason to do so ?

If the HTML5 experience is the same or better than the flash one why do they keep the flash version ?

I understand the necessity to do this on tablet devices but on desktop computer what is the needs to lower the power consumption ?

What about the site that don't have HTML5 fallback like flash online game ? I think your solution will just kill flash game industry. Maybe you don't have experience in web gaming, but ask a user to enable the plugin before accessing a game is like say him to go away !

Maybe is it possible to add something like a meta tag in the web page to inform chrome that the site needs flash ? Or maybe apply your solution only on mobile and tablet devices ?

[Renan Muniz]

Bad idea!
HTML5 is not ready for gaming, audio, rich media and mobile devices.

[Robby Scherer]

Being a Flash game developer for the past 7 years this is unfortunate news.  I think things like website layouts are best left to HTML5 and I do agree that Flash is probably best staying out of that scene.  However I think Flash is still an amazing platform to develop games for and I don't think HTML5 is quite up to par with it.  IMO, Flash is one of the best platforms to develop games for.  Users can play your games in the browser without having to download or install a single file, and your games can also be exported to AIR for desktop or mobile.  There is such a massive amount of games and portals that use Flash that this would really impact ALOT of developers and players.  Hardcore players would still be able to play their games, but initially blocking users out of flash and making them right click in the area to enable it will really add an unneeded extra step in their experience, probably causing a lot of lost players.  At VERY least, if this absolutely must be implemented, I think it would be much preferred that the user has to simply left click on a button to enable Flash, as inexperienced computer users will probably be confused and turned away by having to right click and enable something via a drop down menu.

All in all I don't think the web gaming scene is anywhere near ready to get rid of Flash yet.

[Savka Anna]

>> Try disabling Flash Player in chrome://plugins, we think that you’ll be pleasantly surprised

I did. I'm not surprised at all: my favorite games are NOT working anymore. Yes, my everyday web experience differs from Yours. Some people still use web to have fun. Did You know that?

If there's a technology MATURE enough to beat Flash - let it be a honest fight.

Best regards

[zwetan]

I would say don't even wait for Google to implement this proposal

do the tests yourself

if you have a Flash game or any kind of SWF app embedded in HTML

test A

HTML page with SWF, eg. regular detection or "autoplay"

test B

HTML page with SWF with "click to enable Flash"

see the bounce rates from test B ?

presenting a warning before being able to view content to users

is pretty much asking those users to go somewhere else

go ahead do the analytics, see the metrics

 

On 18 May 2016 at 16:00, Robby Scherer <robsch...@gmail.com> wrote:

Being a Flash game developer for the past 7 years this is unfortunate news.  I think things like website layouts are best left to HTML5 and I do agree that Flash is probably best staying out of that scene.  However I think Flash is still an amazing platform to develop games for and I don't think HTML5 is quite up to par with it.  IMO, Flash is one of the best platforms to develop games for.  Users can play your games in the browser without having to download or install a single file, and your games can also be exported to AIR for desktop or mobile.  There is such a massive amount of games and portals that use Flash that this would really impact ALOT of developers and players.  Hardcore players would still be able to play their games, but initially blocking users out of flash and making them right click in the area to enable it will really add an unneeded extra step in their experience, probably causing a lot of lost players.  At VERY least, if this absolutely must be implemented, I think it would be much preferred that the user has to simply left click on a button to enable Flash, as inexperienced computer users will probably be confused and turned away by having to right click and enable something via a drop down menu.

All in all I don't think the web gaming scene is anywhere near ready to get rid of Flash yet.

--

[Jeffrey Yasskin]

On Wed, May 18, 2016 at 12:33 AM, 'Ruben Gerlach' via Chromium-dev <chromi...@chromium.org> wrote:

Let's talk about Flash

Usually when I talk to other developers, they have a complete misunderstanding of what Flash is and what it can do. So it might be worth spending some time on explanations. I hear the "but Flash does not run on mobile" way too often. It does! That what Adobe Air is for. I can easily deploy my Flash game to web, Android, iOS, Windows and Steam, MacOS and even Linux! With a single code base, and a mature, highly capable rendering engine, that will deliver identical results on any platform. Digest on that.

This is probably a dumb question, but if Adobe Air can compile your Flash game to a codebase that works on the mobile web, why can't it compile it to a codebase that works on the desktop web without using the Flash plugin itself?

Thanks,

Jeffrey

[PhistucK]

Hm...

You seem to be misinformed.

DRM - Encrypted Media Extensions (supported in all of the major modern browsers), camera, microphone, real time chats and online conferences - WebRTC and ORTC (supported in one way or another in at least three major modern browsers).

Microsoft is working on WebRTC (in addition to ORTC) and I heard that Apple is working on WebRTC also, so all of the major modern browsers will support it soon.

☆PhistucK

On Wed, May 18, 2016 at 1:08 PM, Vakhtangi Beridze <22r...@gmail.com> wrote:

beside gaming there is another issue, no real solutions for DRM, Camera and Microphone support in HTML5, real time chats and online conferences. 

--

[Ruben Gerlach]

Hi Jeffrey,

sorry for the confusion. You can not export Flash games to target mobile web, instead you compile mobile apps. As we are talking about games, this is the preferred solution on a mobile device anyway.

Cheers.

[Anthony LaForge]

Just to re-cap the feature behavior, because it sounds like there is perhaps a bit of confusion.

It's correct that users will see a prompt per site, to enable Flash Player, however once they have consented to running Flash Player on that site everything will behave as it does today (i.e. we are not enabling click to play, at this time).  The image showing the context menu is meant to demonstrate an alternate user flow (aside from activation via the info bar) to enable in-line content w/ a context menu item.  Since we will remember and honor the user's choice, for a given site, the impact should be pretty minimal for most users.

My expectation is that users looking for specific types of content (e.g. games), will likely have no trouble navigating that flow.

Kind Regards,

Anthony Laforge
Technical Program Manager
Mountain View, CA

--

[PhistucK]

Please, do not rant. If you have concrete and specific complaints, file issues for them. If this is an API level complaint (the API is simply not designed to let you do something), start a discussion or file an specification issue. If this is a browser specific complaint (a bug, a performance issue, a file that should be playing but does not), use crbug.com for Chrome, or the other issue trackers for other browsers.

And yes - not all of the standards are worth implementing. The amount of (much more) bloat you would get if every browser implemented every standard would be huge (so will the amount of bugs :)).

For real time chat, you can use WebRTC. A draft standard, but it is on the standards track. Prefixed in Chrome (though they are actively working on aligning with the standard and unprefixing), but adapter.js mostly lets you code according to the (draft) standard. The Chrome extension or application sockets API is too powerful to be given to web applications at the moment and the browsers have not converged on such a standard yet.

☆PhistucK

[PhistucK]

If a meta tag is implemented, everyone will simply add it. That is not a solution...

Regarding power consumption, it comes with CPU consumption. Flash locks the CPU even though other applications need it (and sometimes it can use less, but it uses more). And electricity also costs (and the fan noise is annoying). :)

☆PhistucK

--

[zwetan]

if I publish a game with NaCi or PNaCi

which unless I'm mistaken require the Native Client plugin

would the behaviour be the same ?

e.g. "click to enable"

If not, can Google justify why they do not apply the same behaviour

to this plugin as they consider now HTML5 to be mature ?

from my point of view, the Flash Player runtime is closer to NaCi

than it is to HTML5+JS, in term of capabilities

thanks to clarify that

[Gary Yang]

1) Allowing a "top 10" to be superior than all the others is unfair, if this monopoly proposal implemented, could make the internet polarized even more, and it is no better world, it is against "no evil".

2) Technically speaking, there are so many options to make Flash Player safer, for example, restricting the cross domain loading and communications, stop automatic playing( which you already did for small animation ), you can load the 1st frame and ask people whether to continue, you don't have to scare people with some blind face picture at least!

3) Flash development is still a lot more efficient for content across web, Android and iOS, there are so many people are using Flash in the good way, especially for small startup companies, please consider them, and make more constructive move please.

Thank you.

[zwetan]

by the way HTML5 is so mature

when I try to watch Google IO live stream

https://www.youtube.com/watch?v=31G8mbaP8e0

it ask for the Flash player to be installed

--

[Peter Kasting]

Friendly reminder: while we do appreciate feedback and are intentionally asking this stuff on a public list, this is a technical development mailing list, and replies should be appropriate for that context.

Please avoid insults, threats, attacks on people's motives, snide remarks about people's lack of knowledge or experience, theories about ulterior corporate agendas, complaints about unrelated bugs, etc.  None of these help understand what are the concrete ramifications of the proposal here, and will generally make developers either ignore the posts in question or even give up on the thread entirely.  If you have serious concerns, that's not the reaction you want.

Finally, please take the time to consider the proposal here deeply rather than reacting quickly or at a surface level.  Saying something like "blocking Flash will hurt my company" isn't very meaningful because this proposal doesn't involve blocking Flash.  Worrying about the long-term effects of removing Flash from Chrome is likewise out of scope because we're not proposing removing Flash from Chrome.  All such comments do is confuse and mislead other people on this thread and make it unclear to us to what degree this proposal will actually affect the people replying.  When your reply is detailed and clearly a response to the specifics proposed here, that's far more helpful in considering whether to ship this and what changes we might need to consider.

Thanks for your help here.

PK

[Jeremy Martin]

Hey Anthony - 

I appreciate you taking the time to address the concerns being raised here.  Your team does some incredible work, and while I'm at odds with this particular announcement, I do think we're all better off for the work that you do. 👍

I think a good deal of the frustration here is that HTML5 is being posited as an unimpaired replacement for Flash, and that position was offered as the primary motivation at the onset of this thread:

today in many cases HTML5 provides a more integrated media experience with faster load times and lower power consumption.

Aside from the fact that the existence of an alternative is somewhat peculiar as the primary motivation, this more importantly seems dismissive of the many use cases where this isn't yet the case. I've already suggested low-latency, live video broadcasting as one of these, which is currently a pretty dismal scene without the presence of Flash.

It's awesome that soon we might be able to get away with Media Source Extensions using WebM and VP9 everywhere (this would be my personal dream come true), but we have an actual business today. The same goes for game developers who might soon be able to rely on WebAssembly, WebGL, and sundry technologies, but we're not there yet.

Consumers of social media and casual gaming are extremely fickle and generally demonstrate low tolerance for even the smallest of UX barriers.  These are also highly competitive spaces, and conversion and exit rates are extraordinarily important here.  I don't want to overly dramatize the impact of this, but the impact is real nonetheless.  And given the rate at which standards are finalized, adopted, and implemented across the primary browser vendors, putting this decision into effect now seems poorly justified by citing cool HTML5 stuff that W3C is still in the process of standardizing.

I find myself doing a lot of self questioning, actually, as I sit here and defend Flash.  I personally rather loathe the technology (and plugin-based approaches to web development in general), but at the same time I've already invested significant time and resources into trying to "escape" Flash.  While I didn't think I'd still be saying this in 2016, the reality is that for our needs, HTML5 still isn't ready and we actually deliver a better user experience with Flash (and as I read this thread, it's apparently true for other use cases as well).

As many have already pointed out, I'll happily concede that the writing has been on the wall for a long time now, but I'd contest that the failure here isn't developers who just went the status quo instead of investing in modern tech. Not to harp on live streaming again, but HTML5 video has been around for long enough that it's fair to criticize now, and there's literally not a single protocol+codec that supports live streaming across all major platforms and browsers. I mean, really?  There's certainly a failure here, but I'm not owning it simply because I figured out that Flash allows me to skip re-encoding and lower my infrastructure costs by (literally) an order of magnitude.  There's an easy path forward to scrapping Flash here (at least for some use cases), but it involves browser vendors sitting in the same room together, not making users click through an unnecessary dialog.

Which actually kind of takes me back to the start of this reply and why this decision was made.  Because if it's the motivation that was initially put forth, then I guess I understand it, but I'm throwing up a flag because I think someone was wrong.  HTML5 is great and it's clearly going to replace Flash eventually, but if HTML5 was actually ready to do it carte blanche today, then we'd be seeing that happen more organically already.