

IE10 won't run Flash unless website is whitelisted by Microsoft - nitochi
http://blog.rabidgremlin.com/2012/10/11/did-microsoft-just-kill-flash-ie10-wont-run-flash-unless-your-site-is-on-a-microsoft-whitelist

======
belorn
The keyword is lockdown.

I am all for giving hate to flash. It is commonly found vulnerable. It produce
slow websites which eats memory and cpu. It has poor history in non-windows
systems.

But in all, I have serious doubt this call was made for any reason beyond
pushing users to their app-store. games? online experience? chat? By
forbidding flash, companies are bit more forced to turn to apps with their
products. Sure, things can still use javascript, html5 and web-sockets, but I
would not trust web-sockets to be left alone if they seriously would start to
threaten the app world.

Maybe I am just cynical, but follow the money argument looks to support it.

~~~
brudgers
"Lockdown" is not the correct term.

1\. Flash isn't prohibited on Windows RT devices. This is distinctly different
from Apple's approach with iOS, and Google has removed Flash from Android. [1]

2\. Existing Flash websites will run on Windows RT devices. Windows RT will
ship with the desktop version of IE10. [2]

Microsoft has made explicit what we all know. There are some websites that use
Flash appropriately and in a way which benefits the person browsing, and there
are websites whose use of Flash makes the web suck.

Having browsed the web for two years with Flash disabled by default, I'd add
that here are a lot of sites which just use Flash for the sake of using Flash.
When I don't see it, I still get the content I was seeking.

[1] [http://www.readwriteweb.com/mobile/2012/08/adobe-flash-on-
an...](http://www.readwriteweb.com/mobile/2012/08/adobe-flash-on-android-
rip.php)

[2] <http://en.wikipedia.org/wiki/Windows_on_ARM#Limitations>

~~~
Karunamon
What bugs me is the fact that we are forced (not a default list, not an opt
out list, _forced with no alternative_ if you want to use IE) to defer to
Microsoft's judgement on what is a "flash appropriate" site and what is not.
Did Newgrounds make their list? Shockwave? Pogo?

Quite frankly, I don't trust them with that power. This is the company that
just got off of "monopoly probation".

I'm starting to really tire of this trend where developers lock away even
power user settings (like the ability to decide what fucking plugins run in
your browser) in the name of "security".

~~~
marshray
Read the guidelines [http://msdn.microsoft.com/en-
us/library/ie/jj193557%28v=vs.8...](http://msdn.microsoft.com/en-
us/library/ie/jj193557%28v=vs.85%29.aspx)

> We place sites with Flash content on the CV list if doing so delivers the
> best user experience in Internet Explorer 10 with those sites. For example,
> how responsive is the content to touch? Does it work well with the onscreen
> keyboard, or affect battery life? Do visual prompts comply with the Windows
> Store app user experience guidelines? Sites that rely on capabilities (for
> example, rollover events and peer-to-peer (P2P) functionality) that are not
> supported within Windows UX guidelines for Windows Store apps, and don't
> degrade gracefully in their absence, are better off running in Internet
> Explorer 10 for the desktop with Flash.

It sounds to me like they're just saying they don't want plugins screwing up
their shiny new UI. If you want to run your arbitrary plugins, just do it with
the classic desktop version of the browser.

~~~
Karunamon
>It sounds to me like they're just saying they don't want plugins screwing up
their shiny new UI.

The _end user's_ shiny new UI. That's why this leaves a bad taste in my mouth.
Why not just make Flash click to enable? That'll stop ads and most other
shenanigans while still making things that users want to access (and haven't
been blessed by MS for whatever reason) still able to access them.

~~~
marshray
> Why not just make Flash click to enable?

"Developers with sites that need plug-ins can use an HTTP header or META tag
to signal Internet Explorer 10 to prompt the user to switch to Internet
Explorer for the desktop."

------
rangibaby
I remember reading this and thinking "nice", back when there were a lot of
sites where video couldn't be viewed on an iPhone:

<https://www.apple.com/hotnews/thoughts-on-flash/>

Two years later, and I can even comfortably disable the Flash plugin in my
desktop browser.

It seems (thankfully) that Flash is fast turning into a relic of last decade.
Not a bad move by MS.

~~~
sageikosa
I uninstalled Flash from my machine, got tired of it constantly
patching/updating/hardening itself. If I want to view Flash-content I use
Chrome.

------
easternmonk
Well, we have come to a point where no one actually cares about IE. Everyone
wishes this browser wouldn't exist and most of the people use it as a tool to
download Chrome and Firefox.

Having said that Microsoft's new policy is either aimed at discouraging Flash
altogether OR this is just a test. They want to test users are willing accept
this kind of feature where MS white-listed websites are given more power than
the normal websites. Expect more to happen on this front.

~~~
fakeer
> _most of the people use it as a tool to download Chrome and Firefox._

Not true. A lot of people still use it as in _use_. I was alarmingly surprised
to find the number of users using IE as their main browser in my office, other
than mandatory use to access company portal. And oh, my company's entire
mail/issue-tracking suite works on this _piece of art_.

~~~
Hovertruck
Chartbeat can speak to this a bit: <http://chartbeat.com/labs/totaltotal/>

You'll need a big monitor, as this was a quick hack and doesn't function very
well on small screens, but you can see the number of people using IE across
all of the sites our JS is loaded on in real-time.

~~~
fakeer
Good source. Yes I can see and it shows IE at number 2 spot consistently.

>> _doesn't function very well on small screens_

Works just fine with "CTRL -"

------
Zenst
My initial reaction was oh noo how dare they take something away from me, I
then realised I have chrome.

I then got thinking, as a default for a browser that will end up in corporate
desktops and home users that this is actualy a realy nice move. I'm sure there
will be some registry hack to negate this, but for the common user who lacks
the ability to do that are perhaps best left with there internet L plates
attached.

In summary, big fat +1 from me on this as anybody who is able to bypass this
hurdle will be alot less likely to fall foul of this safty net. Less infected
PC's, less spam, less crap in general.

Lets not also forget the big benefit this betowes upon us, less calls from
friends who's PC's/Internet seems to be running a little slower and after 15
minutes on the phone you realise it will be easier to see them.

~~~
aristidb
Except the desktop version of the browser still has Flash. It's only the
Metro, pardon me, Windows 8-style UI version that has no Flash.

------
micheljansen
Big question is: will Silverlight run on websites not whitelisted by
Microsoft? Otherwise it's a dirty trick.

~~~
manojlds
Silverlight is more dead than Flash and MS killed itby alienating Silverlight
developers.

~~~
zapdrive
The only thing keeping silverlight alive is Netflix. I wonder why they use it
in first place.

~~~
ttrashh
DRM, better streaming, C# and the .Net framework

~~~
46Bit
I have to admit though: Netflix's (Silverlight) player is remarkably stable
compared to anything I've ever tried in Flash.

------
PaulHoule
Microsoft is being like Apple; like Apple, they know Flash isn't a good answer
for tablets and mobile and they're guiding people towards something that is.
In fact, Microsoft is pushing developers towards HTML 5.

Note that desktop IE 10 supports Flash and other plug-ins just fine. I run
Windows 8 preview on the computer in my ham shack and I find that do almost
all my browsing with the desktop IE anyway. I just use the Metro IE to visit
QRZ, which is a web application for looking up call signs and logging
contacts.

------
isani
Earlier, the plan was to have no plugin support at all in IE10 Metro.
Microsoft is positioning the whitelist approach as a backwards compatibility
shim for high-profile sites that won't or can't give up Flash.

~~~
buro9
And if this is controlled by group policy, then this allows them to increase
security for end consumers whilst allowing business customers the ability to
carry on supporting the internal use of Flash that they may (feel that they)
require.

------
acedeathkill
The whitelisting is on the IE10 thats embedded in the Windows 8 ui (those
fancy tiles). The normal IE10 browser that you use to browse the web with has
no such limitations. Nothing to see here...

------
justindocanto
As questionable of a move that is, this kind of excites the 'omg, is flash
finally going to die' moment i've been waiting for, for years.

~~~
Father
Why is that? Flash seems pretty logical to me. If you were giving the choice
to either design with a single language that compiles to bytecode and runs in
a vm(jit), or an array of interpretive scripts that's heavily submitted to
fragmentation, which would you choose? You'd probably go for the first, as
would I.

Flash may be a bad implementation of good idea, but alternatives have not
exactly wooed me either. To be quite honest; they all seem equally flawed to
me. The fact that jQuery, Bootstrap, and others originated out of overcoming
fragmentation pretty much proofs that point. Also different JavaScript engines
give you different performances and have different bottlenecks. At least with
flash you had the guarantee it would crash the same on all platforms.

~~~
wladimir
I agree that the _idea_ of a cross-browser, cross-OS bytecode platform is
really nice. Every time I hear of "X-to-javascript" compilers I cringe a bit.

But with flash the fatal problem is, and always was, that the only viable
implementation of the interpreter is a proprietary and buggy blob, not even
available for all platforms. Apart from that being a plugin also made it
clunky, too much like a "java applet" (it never integrated into a page as well
as javascript does).

If it had been based on an open specification (like HTML5 is now) then it
could have been successful. Different browsers could have competed for the
fastest and most secure JIT, like they do with javascript now. The end result
would probably have been great. Alas...

Even non-technical people I hear complaining almost daily about what a piece
of crapware the Adobe Flash plugin is, after it crashed for the zillionth
time. Everyone wants flash to die, as the last sites that still require it
either move to HTML5 or are replaced.

------
DanielRibeiro
Previous discussion: <http://news.ycombinator.com/item?id=4637845>

~~~
justindocanto
The previous discussion was about Mobile IE10. This blog post is about IE10 on
Windows 8, in general.. meaning desktop too.

~~~
manojlds
Both the discussions are about the same article and same topic.

~~~
justindocanto
Didn't think to check the link after i saw the title of 'Mobile Version...',
but you're right. Sorry about that DanielRibeiro =)

------
marshray
When we data security advocates discuss things like promiscuous trust among
SSL certificate authorities and one-click scary page bypass features with
browser vendors, inevitably the old adage comes up "no vendor is willing to
lose market share by making its security policies more restrictive than the
others".

Perhaps this is a test case trying to break out of the old status quo?

Disclaimer: I recently accepted a position at the big M itself.

~~~
michaelt
The iphone/ipad web browsers already don't support flash, so dropping flash
support isn't entirely a new thing. I for one am looking forward to its death
on more platforms.

~~~
marshray
Hmm. Reading the linked MS document, it sounds more like they're desupporting
plugins more for user experience consistency reasons than security or anything
else.

------
Quarrelsome
I'm becoming confused as to who Microsoft are anymore. They continue to
disappoint by chasing other people's customers while alienating their existing
ones.

I've been here before with WindowsCE and WinMobile. :(

------
devsatish
reading the lines, It seems this is only in the Metro version of IE. But still
an hassle, where the desktop IE pops-up when non white-listed Flash content is
on the page.

Submitting your site for consideration for Internet Explorer compatibility As
stated previously, developers who have sites that require Flash Player can
mark the page with a META tag (or serve a header) indicating that the site
requires a plug-in. This causes Internet Explorer 10 to prompt the end user to
open the site in Internet Explorer 10 for the desktop. If a site is on the CV
list as compatible with Internet Explorer 10, Internet Explorer 10 will always
open it with Flash Player enabled and the user won't be prompted to open in
Internet Explorer 10 for the desktop.

------
devsatish
Interesting. Flash is not just video and ads. Flex is a powerful and rich
application stack on Flash platform. There are numerous sites out there using
Flex.

~~~
VeejayRampay
Let's get real, very few websites use Flex, it's kind of a dead technology.

------
libido
"First they took away Flash, but I didn't care because I was not a Flash
developer..."

Whatever your stance is on Flash, this is a scary development if you don't
like walled gardens.

~~~
wccrawford
There was recently a big furor over Notch's statement that he refuses to let
Microsoft certify his games for Win8. Many people felt he was being childish
and throwing a tantrum, while others think he's a visionary and working to
prevent MS from walling off Windows like the 360.

Personally, I think it's a fight worth fighting, since they really could go
that route if they got enough buy-in on it. And I don't doubt they would, if
they thought it was in their best interests. That's what corporations do.

Luckily, Linux has recently gotten a _lot_ of support from indie developers
via Kickstarter (and the players' demands for a Linux version) and it's
starting to look more viable as a platform for commercial games. We can hope.

~~~
cooldeal
The problem with Notch was that it was impossible to find out exactly what he
was ranting about when he is fine with accelerating the demise of the PC by
having his game run on the locked down iOS but not releasing it in the Windows
8 desktop store which is open.

Read this three part article about the confusion.
[http://www.withinwindows.com/2012/09/28/notch-doesnt-hate-
wi...](http://www.withinwindows.com/2012/09/28/notch-doesnt-hate-
windows-8-hes-just-confused/)

------
BonoboBoner
So I cant use e.g. Flowplayer on my site to show IE people a video?

~~~
Veus
Yes you can. The new version of Flowplayer is HTML5 and then falls back to
Flash if HTML5 isn't supported.

------
zapdrive
Is M$ trying the Apple approach? To be in control of everything? Is this the
beginning of another walled garden? Will M$ succeed at it?

------
kayoone
thats bad news for 3D games in the browser where HTML5 isnt an option yet.

~~~
Skrekkpus
True, but Unity is even better. The same regime might still apply though.

~~~
adrr
Reading the MSDN page posted on a previous comment, it looks like they are
deprecating activex interface for IE. Flash, Silverlight and any other plugin
using activex to interface more directly with hardware will be affected.

------
mcpoulet
How is this news ? We know this since last May (
[http://www.withinwindows.com/2012/05/23/windows-8-secrets-
in...](http://www.withinwindows.com/2012/05/23/windows-8-secrets-internet-
explorer-10-will-ship-with-adobe-flash/) ).

------
jzs
Personally i think this is great news. And i would very much like to see Java
ending up in the same boat.

Having a language that is not inherently designed to be run in a sandboxed
environment should not be allowed to run in a browser.

------
Revisor
Also an interesting information: there are two versions of IE. How and why
should the user choose which one is more appropriate? Will the locked down
version be default?

~~~
rst
It's coupled to the "split personality" of the Windows 8 UI. If you start IE
from desktop mode, you get "desktop IE", with desktop UI conventions, and web
sites with flash will still work. If you select IE off the browser tile in the
formerly-Metro "start screen", you get mobile-style UI conventions, and flash
breaks unless you're on the whitelist.

Either they're expecting everyone who uses flash in a significant way to get
whitelist approvals (and how many people do they have vetting those, anyway?),
or they don't mind a period where, from the user's perspective, stuff randomly
breaks for reasons that are not likely to be apparent. (Even if you tell them
"well, it's how you started the browser fifteen minutes ago", they'll ask,
"and why should that matter?" They have a point.)

------
magoon
It'll run flash, it won't run flash, it'll run flash, now it will only run
some flash. Headspin. Alienating developers.

------
AbraKdabra
I wish that Google doesn't whitelist YouTube with MS so everyone migrates to
Chrome, I want IE10 dead.

------
hayksaakian
By the time ie10 becomes the majority of ie market share, flash will have not
mattered for many years

~~~
camus
> By the time ie10 becomes the majority of ie market share it will never
> happen.

------
andrewcooke
doesn't the significance of this depend on the roles of the two browsers in
windows 8? is that explained anywhere? how can you understand or comment
usefully on this without knowing what the difference in uses for the two is?

------
guilloche
Horay for the death of flash and IE.

