[CoreDumpling]

I welcome this move, despite the possibility of some fallout from the change. It'll be painful, but even as someone who once made a living writing ActionScript, I have to say that Flash is sufficiently annoying and insecure that it really needs to be phased out.

In the short term, this will probably cause some breakage in certain sites that try to use Flash "transparently" and "unobtrusively" for things like LSOs, drag-and-drop, clipboard access, or cross-domain XHR. These are already problematic with Flashblock installed though -- Pandora, for instance, refuses to load and there is nothing available to click-to-play since that particular Flash object is hidden.

Hopefully this will light a fire under those sites and get them to update to the appropriate HTML5 methods of doing these things (local storage, WebSockets, etc.), just like how Java applets that were used for such things have been largely phased out. Until then, however, I wouldn't be surprised if some of them simply inform you not to use Firefox to visit.

[mistercow]

To take care of the invisible Flash object problem, Firefox could copy what Chrome does for Java applets and have a bar pop up at the top of the whole page, asking if you want to allow Flash to run on the site in question.

[fr0ggerz]

Pandora uses jPlayer to play audio which has an invisible Flash component to play mp3s on browsers that don't support it.

If Firefox requires 'click-to-play' on an on-screen piece of Flash to enable it, all sites using jPlayer to play mp3 simply will not work.

And of course this doesn't just affect jPlayer, many other players use this technique.

Much better -- as mistercow reasons -- to have a pop-up asking you if you wish to run Flash on a particular site and I would love to see an 'always allow' option here.

[tjoff]

Doesn't Firefox support mp3?

[seanp2k2]

Guys/gals,

Let's please try to explain things instead of just downvoting questions.

Try this link http://forums.mozillazine.org/viewtopic.php?f=23&t=21175...

TL;DR there is a licensing issue with the MP3 decoder. It's more complicated than that, but most of it is due to software patents. http://en.m.wikipedia.org/wiki/MP3#section_10 has more info if you're curious.

[ajuc]

I use Chromium, and have old flash installed. Every page shows me this bar asking me to update flash, with button to enable all flash on this page. It's very convenient, even more than FlashBlock on Firefox was.

[obtu]

The nightlies already have this, in the form of a plugin icon at the extreme left of the location bar.

[pdenya]

If only Chrome did this with it's current click to play implementation

[strager]

It does, though not with the same UI as the Java plugin: http://i.imgur.com/xHrRX.png

Clicking the puzzle piece shows a menu to "always allow" or to "enable all Flash applets on this page" (and a few other things).

I can see a more obtrusive/apparent UI being implemented if Firefox makes click-to-Flash default.

[mistercow]

That's not the same interface that I was referring to. I was talking about this: http://i.imgur.com/8lzif.png

[notatoad]

it's not the same appearance, but it's the same functionality.

[mistercow]

No it's not, because if the Flash object is invisible, it simply does not give you any way to enable them unless you go to the preferences and explicitly add an exception.

This was my entire point in the first place, if you look up at the beginning of the thread. For example, turn on click-to-play and then go to pandora.com. If Chrome treated Flash the same as Java, you would still be able to use pandora easily.

[albemuth]

A problem I found with Chrome's current implementation is on pages where you don't even know flash is being used, Google Translate and Soundcloud for example, after thinking the site was broken I remembered I had click-to-enable active.

[strager]

Indeed, this happens to me too. And I think this is why Mozilla will need to have a very good UI to tell the user how to fix a broken site (or just fix it for them e.g. through a crowd collective).

[tjoff]

Unfortunately the current implementation breaks some pages for no reason (such as wimp.com that becomes completely unusable).

[alanh]

Chrome has a click-to-play implementation for Flash? That is not a plugin? Do I have to go to chrome://flags or something?

[strager]

Yes.

Preferences > Under the Hood > Privacy > Content Settings > Plug-ins > Click to play

Or you can search for "Flash" or "Click to play" to find the setting.

[joejohnson]

Wow, thank you for sharing this. I love when Chrome obviates the need an extension to do something simple like this!

[aeurielesn]

Nice. I didn't know about this until now. Nifty! Although, a bit of a elusive setting.

[bad_user]

     ... cross-domain XHR

That's not a problem because Firefox has support for CORS, which is better than doing Flash because it's faster.

Of course, the server must cooperate with the browser by passing back allowance headers, but that's also true for Flash, as you need the server to have a crossdomain policy file for that.

Last year I wrote an article about it on my blog about how to configure it, check it out: http://bionicspirit.com/blog/2011/03/24/cross-domain-request...

[masklinn]

> That's not a problem because Firefox has support for CORS, which is better than doing Flash because it's faster.

That's nice for a new site being developed right now, it's problematic for a site which has been stable in production for months or years and for which everybody involved in the development has moved on already.

[lysol]

If that site is the case, then lack of maintenance will have reared its ugly head long before a lack of Flash (or, the inclusion of it) broke their site.

[glanch]

Don't you just love progress? Time to redo stuff that already works!

[jballanc]

Isn't that the very definition of progress? I'm pretty sure the horse-and-cart worked just fine when the automobile came around.

[masklinn]

horse-and-cart didn't stop working when the automobile came around. The proposal here is that we shoot all horses and burn all carts because somebody somewhere has started driving an automobile.

[jrockway]

No, the proposal here is that we ban horses and carts from the interstate highway system because they get in the way of the new faster automobiles.

[derefr]

As an alternative, rather than requiring that all Flash shims have some sort of screen real-estate of their own to overlay a click-to-play control onto, perhaps hidden embedded Flash (or Java, or ActiveX, or whatever) objects could request the browser to prompt for their activation with an information bar.

[cheald]

Chrome does it somewhat unobtrusively by sticking an icon in the URL bar: http://cl.ly/3I1q3k0X0R1I2G2X1p1S

Works great.

[robryan]

Cross domain XHR shouldn't be an issue as you only really need flash for it in IE 6 and 7.

[simonbrown]

I assume you are suggesting CORS as an alternative. Unfortunately, some APIs (e.g. StackExchange) implement crossdomain.xml but not CORS.

[robryan]

I was thinking of postMessage, I haven't used CORS before but it looks like it ends up giving the same kind of outcome. In my case though I control the server have have the JS on 3rd parties so it is the reverse to what you are saying.

[bad_user]

postMessage is more heavyweight than CORS.

Minus a couple of restrictions (i.e. with CORS you cannot rely on cookies being set, so you need to handle that from your Javascript somehow), CORS works well and it works on all major browsers, starting with IExplorer 8, which makes it awesome.

[hollerith]

>already problematic with Flashblock installed though -- Pandora, for instance, refuses to load

Not if you whitelist it at Tools > Add-ons > Extensions > Flashblock > Preferences.

[felipc]

For this feature, there will also be an option to enable plugins for websites that have them hidden such as Pandora. And in addition it will be possible to whitelist/blacklist websites.