
HTML5 Flash Player (Shumway) lands in Mozilla - robin_reala
http://gemal.dk/blog/2013/10/02/html5_flash_player_shumway_landed
======
willvarfar
This is excellent for security. In the same way that Mozilla's PDF.js does PDF
rendering in-browser and in-sandbox, doing SWF rendering in-browser and in-
sandbox makes the security nightmare that is Flash go away.

ADDED: Mozilla blogging about security benefits of PDF.js, which apply here
too to

[http://andreasgal.com/2011/06/15/pdf-
js/](http://andreasgal.com/2011/06/15/pdf-js/)

~~~
rplnt
I'd be afraid that I lose control of the flash with this. As things are now, I
can safely disable the flash plugin and everything is fine. If someone is able
to render flash within HTML5, how can I prevent it from doing so?

~~~
DavidBradbury
Anything that this can do, JavaScript can do. If you're worried about losing
control with JavaScript, then you should already have that disabled.

~~~
robmcm
It's this sort of person who will be calling to bring back flash, so all the
annoying banners and CPU intensive code can be easily blocked.

------
spongle
Great effort but I really don't want this.

I've lived without Flash for a year now and all is good. We just need to break
the crack addiction!

~~~
Wintamute
There's no real conceptual difference between a <canvas> element, a <video>
element, a WebGL experience, a NaCl app or a Flash <object> on your webpage.
They're all somewhat non-semantic, hard to search, rich media black boxes. So
what's your particular beef with Flash, especially when rendered via HTML5? Or
do you just hate all tools that enable creativity beyond a plain text website
equally? Or did you just drink the Flash-should-die KoolAid without really
thinking about it?

~~~
spongle
Yes there is.

You misunderstand.

My beef is with NaCl, objects, Applets and ActiveX etc as well, mainly because
they run outside of the browser's engine, sandbox, security model and
conceptual model. you also have to ship them externally to the browser.

Canvas, video, webgl fine.

~~~
biot
From the fine article:

    
    
      "Shumway is an HTML5 technology experiment that explores
       building a faithful and efficient renderer for the SWF file
       format without native code assistance."
    

By your criteria, you should be fine with this.

~~~
spongle
Well if it wasn't for the numer of turtles in the pile on the way down it'd be
fine. This is a whole other layer on top...

------
chrismonsanto
Does this mean the FSF can cross off 'free flash player' from their high
priority list? What will happen to Gnash?

~~~
zeckalpha
This isn't GPL, so I'm assuming work will go on.

~~~
davexunit
It is Apache v2 licensed, which means that Shumway is free software. So, if
Shumway functions adequately then I imagine that the FSF will consider the
task complete. Believe it or not, the FSF and the GNU project don't demand
that everything be GPL licensed.

~~~
pjmlp
Which is great for the companies that take open source into their products and
never return anything back.

~~~
icebraining
GPL isn't about (nor does it require) licensees to contribute anything back.

~~~
pjmlp
Hence the need of AGPL.

I do a lot of development with closed source software as well, but when I do
open source, I take the point of only using copyleft licenses.

~~~
icebraining
The AGPL doesn't either. We have a product based on a third-party AGPL
licensed codebase and we're fully compliant even if we don't contribute
everything back.

You should really read up on the licenses and the intent behind them;
contributing back was never the point.

------
hcopr
Nothing beats the ease with which the regular flash player can be blocked, and
then occasionally loaded by mouse click as it works with flash block and the
like. The danger of it becoming an extension is that it's now more difficult
to have that block/override workflow. And there's always the dreadful prospect
of people embedding it directly into their site, potentially leading to a new
wave of blanket JavaScript blocking as a response.

~~~
Grue3
The current reliance of sites on Javascript is worse than Flash ever was.
Flash elements can be blocked, but if you block javascript, this disables the
entire site, so you have to live with CPU chugging mess of a website.

~~~
hcopr
That is sort of my point though. On the other hand, I can see myself just
stopping to use sites that abuse JavaScript, keeping the "good" ones. Maybe
that kind of feedback just have happened on the web a long time ago.

------
kapowaz
Why do we need this? The way that Flash has diminished in significance since
high-quality browsers on smartphones and tablets emerged is a good thing. The
web is better with Flash gone completely, not dragged along through
compatibility layers.

~~~
Jasper_
First of all, good old backwards compatibility. There's large codebases still
written in Flash, or perhaps things that are in Flash that will never get
updated ever again (browser games being a big one), and people would like them
to work even after Adobe's dropped out.

It also turns out that reimplementing Flash in HTML5 gives you a great idea of
what's missing if you want to tell developers to just use HTML5. There has
been quite a lot missing from the web standards that Shumway helped pushed
through.

~~~
kapowaz
> First of all, good old backwards compatibility. There's large codebases
> still written in Flash, or perhaps things that are in Flash that will never
> get updated ever again (browser games being a big one), and people would
> like them to work even after Adobe's dropped out.

It's a fair point that wanting to retain the ability to run this content after
there is no (working) Adobe plugin is desirable, but is the browser the best
place for this? We don't demand that each version of an operating system is
able to run all old application software for that OS; the preferred way of
being able to do this is through virtualisation, and I'd argue that's probably
a better way to do this, too.

> There has been quite a lot missing from the web standards that Shumway
> helped pushed through.

…such as? (I'm genuinely interested; I wasn't aware of this)

~~~
Jasper_
A big one that's being discussed right now is blend modes and filter effects
on canvas, as we can't do a GPU blur or convolution filter on canvas contents
right now. We're looking to see if it's possible to reuse some of the stuff
like CSS filter effects on canvas 2D contents.

We've also helped with a lot of the baggage around audio decoding and
synchronization, since Flash files can have MP3 files that require close sync
to the timeline, so we need to use <audio> together with WebAudio, which is a
giant bag of worms. We're still working through that on the web audio mailing
list.

And we've also helped with some minor additions to the spec that aren't really
too hard to implement, like canvas's isPointInStroke().

------
gkoberger
Very cool. Here's some more demos:
[http://mozilla.github.io/shumway/](http://mozilla.github.io/shumway/)

~~~
ekianjo
The other cool thing about this is that it could potentially bring back Flash
compatibility on Linux machines since the official Flash support/updates was
dropped in 2011.

~~~
cpeterso
And other platforms like Android and Firefox OS. The areweflashyet.com demos
apparently also work on iOS!

------
eksith
This is great news. Now if only Mozilla made it easy to _remove_ plugins just
as other addons[1], we'll be all set.

[1] At present, you'll need to go to [your install folder]\extensions or check
their path.

To do this, go to about:config and set 'plugin.expose_full_path' to 'true'.
Now go to about:plugins where you'll see the full install path. Go to these
and delete the .dll

Edit: Globally installed plugins, may affect other browsers installed on your
machine. Renaming is probably safer in case you need to roll back.

~~~
AndrewDucker
Go to Tools->Addons.

Select the "Plugins" tab.

Select "Never Activate" for the ones you don't want to activate.

~~~
eksith
My OCD wouldn't allow a plugin that is "just there" in the browser even if
it's not activated ;)

------
aktau
In something I'm building, we have to play all kinds of clips. Some of the
more "legacy" ones are unfortunately in flash. We can't get rid of them for
the next few years and nobody is going to redo them in something else. So this
might a really good thing to be able to get rid of the flash plugin but keep
supporting those files. Thanks mozilla!

------
trycatch
I tried to use it ~1 month ago, it wasn't a great experience. I tried playing
video and several games on Kongregate, and almost nothing worked, except Flash
ads (only few games showed anything similar to loading screen -- most of them
just didn't start at all). But the most problematic thing was its slowness.
Even small almost static ads brought entire Firefox to its knees. I am looking
forward for this project, but I really hope the developers will solve the
performance problems before shipping it in stable Firefox.

~~~
sabret00the
A lot changes in a month in terms of software development. Try it again and
let us know if it still sucks by your standards.

~~~
trycatch
I've compiled new version from git, but still literally nothing except ads
work. I've tried various games from Kongregate, Armor Games and Newgrounds,
including very old ones, various sites with Flash video, various sites with
Flash charts -- nothing. And there are still very serious slowdowns even if
Shumway is not on screen.

------
Doctor_Fegg
This is great. It effectively makes ActionScript 3 into YALTCTJS; Yet Another
Language That Compiles To JavaScript, just like CoffeeScript and TypeScript.

In particular, AS3 is strongly typed; you could say it puts the Java into
JavaScript. It has (had?) a large developer community, and there's a lot of
good code for it out there already. I quite enjoy programming it, though the
endless reliance on EventListeners is a PITA.

Mind you, Flex (the UI framework) genuinely does deserve to eat flaming death.
I'm convinced Adobe were trolling Apache by donating it to them.

~~~
Marazan
While it has a number of poor implementation choices under the hood Flex was
simply miles ahead of any competing tech for doing Rich Internet Applications
5 years ago.

It's still ahead even now, just not so decisively.

------
Pxtl
So when ActionScript is compiled to JS, do they mean it's actually pure JS, or
is this getting converted into ASM.JS? Historically, a big appeal of Flash vs.
JS has been performance - ActionScript is an ugly language, but it's
statically typed. And JS/canvas/whatever historically haven't been too
efficient at moving vectored objects around the screen.

Then again, a the factor in Flash's favour isn't the run-time, its' the
development workflow.

~~~
mbebenita
Shumway compiles ActionScript bytecode to JavaScript source. It cannot target
ASM.JS because not all ActionScript code is typed. The goal of Shumway is to
identify what is missing from the web platform and fix it, so we're working on
improving graphics performance.

------
captainmuon
I wonder whether this supports all the simple animation features that made
flash big back in the day (like vector animation, tweening, etc.). When people
say HTML5+js is the replacement for Flash, they usually think about video
players and ActionScript apps.

I also wonder, if you go through all the trouble of creating a new flash
implementation, why do it in HTML+js? Why not in native code on top of a
cross-platform library, such as Skia or Qt? Security is one issue, but if you
start a new project you can plan for security from the start and effectively
rule out buffer overflows etc. with the right programming practices. Also all
modern OSes have ways to sandbox applications.

I'd very much rather have my code in small, auditable, removable plugins than
put everything and the kitchen sink in the browser. Sure, you prevent buffer
overflow exploits by using a well tested JS engine, but you get a load of
other possible bugs that you wouldn't have if the plugin were in a separate
process (DoS/hanging the browser, information leakage, cross origin scripting,
etc.).

------
Kartificial
Why is this called a HTML5 Flash player? What is HTML5 about it?

~~~
robin_reala
<canvas> is an HTML5 element? :)

------
davexunit
How did Mozilla get around Adobe's oppressive EULA that forbids reverse
engineering? This is a major obstacle of the Gnash project. They developers
cannot install Flash, because to do so would make their work illegal.

~~~
Jasper_
They dropped that a long time ago with the OpenScreenProject licensing.

------
nl
Is there a reason this has to be an extension?

What is stopping it from being hosted on a webpage, which then loads flash
files from URLs?

(Background: I need a way to let thousands of flash-based educational
resources be usable on an iPad)

~~~
robin_reala
It doesn’t have to be an extension, their demo page just loads the player as a
JS file:

[http://mozilla.github.io/shumway/iframe/viewer.html?swf=../m...](http://mozilla.github.io/shumway/iframe/viewer.html?swf=../main.swf)

~~~
drewying
This demo (nor none of the others linked to on the main Shumway page) appear
to be working on my iPad, mobile Safari running iOS7.

Not sure if it's me or if it's the code. Can anyone else confirm?

------
jaredsohn
This is great step for allowing more user control / detection over sound
within Firefox.

I recently open sourced MuteTab
([http://www.github.com/jaredsohn/mutetab](http://www.github.com/jaredsohn/mutetab)).
If MuteTab were to also work on Firefox (it builds with OpenForge right now),
it should be possible to get audio indicators working within Firefox, at least
for HTML5 audio/video and for Flash that is supported by Shumway.

Although perhaps a native implementation of what I just described is in the
works.

------
exo762
I wonder if this project will suffer from same things that haunt Mono and
Moonlight - chasing a moving target that does not want to be reached.

~~~
robin_reala
Flash is far from moving fast these days.

------
Ygg2
While I love the concept, I don't think Shumway is ready for prime time. It
doesn't work on Kongregate, last time I tried, which is the largest flash
based game site there is. Youtube works nicely, but overall, unless both Flash
games and videos are supported, I doubt it should be shipped.

------
Sami_Lehtinen
Why not to convert flash stuff to html5 directly? Using runtime is just extra
overhead.

~~~
Yoric
That would be the ideal case. However, that would require the cooperation of
the owners of all this Flash stuff, and there is simply no way to get them all
to agree to get rid of Flash just because the reference implementation happens
to be annoying, crash-prone, unsafe, etc.

So, in practice, the only way to handle the issue is to do stuff at runtime.

~~~
frou_dh
Similar issue to there being a colossal amount of invalid HTML out there
that's never going to be made valid, so the browsers just have to do the best
they can. It's the way of the web.

------
ethana
What black magic is this? I wonder what the performance hits will be like
though.

~~~
Marazan
Why would you think this is black magic? The SWF format has been open for
years and there are many other flash players out there.

------
saejox
I removed Acrobat Reader from my computer after PDF.js.

This has the same potential. Although it's vm is implemented in pure js, not
even asm.js. It may never hit the 'good enough' performance levels.

------
CmonDev
This is beautiful! There will be less need to move small casual games to
HTML5, so hopefully Flash developers will be a bit happier.

------
codereflection
Flash is dead! Long live Flash!

I've been hoping this was going to get pulled into Firefox soon. Honestly the
sooner the better.

------
dgesang
When will all that hate for Flash finally come to an end? It's growing old and
boring.

------
cheeaun
So if I install the extension, do I need to disable Flash plugin on Firefox?

~~~
cpeterso
You don't need to install the Shumway extension if you are running Firefox
Nightly builds and flip the "shumway.disabled" pref in about:config. Shumway
will try to load embedded Flash content and show a little "Shumway X" button
that you use to fall back to Adobe's Flash Player instead.

------
shmerl
How about video decoding? Can it rely on gstreamer for codecs support?

------
OliC
Why didn't this come out of Adobe a year ago?

~~~
maheart
Why would Adobe do something like this? It costs them money and it doesn't
improve their position (and IMO, their goals) at all.

~~~
ZenoArrow
From where does Adobe get money from Flash? It isn't through the Flash Player
plugins (which are already free), but it does get money from tools that create
Flash content. So why wouldn't it make sense for Adobe to have made a move
like this?

~~~
clopez
Because is smarter to invest in developing a new tool to create HTML5 content
than to invest in a tool that converts the deprecated flash to HTML5.

~~~
ZenoArrow
Smarter for whom? Adobe? It's in their interest to keep the 'depreciated'
Flash going as long as possible, whilst it still makes them money.

~~~
Jasper_
It actually still makes them money. The Flash authoring environment is still
one of the more popular methods of doing production-quality animation. See
[http://coldhardflash.com](http://coldhardflash.com) for lots of examples.

The Flash authoring environment is the best vector graphics editor I've used,
even without the animation and scripting on top. They're still going to
continue that, even if the Flash Player plugin is a bit behind.

~~~
ZenoArrow
"It actually still makes them money." That was what I was saying.

------
anon1385
Thank god for noscript.

