Homeless in Vancouver: Thoughts on browsing without Flash

Adobe is facing renewed calls to retire its 19-year-old Flash Player plug-in after June and July’s security holes proved to be especially nasty. And many pundits have gone so far as to recommend that people delete the plug-in off of their computers altogether—they might not even miss it, they’re told.

But who’s to say whether you will miss Flash Player based on the way that you use the web?

It would be nice if a software agent could be rigged to crawl a selected portion of browser history and report back on how many of the sites a person visited (in the last month, say) required Flash Player for some reason.

A Firefox add-on that I use called Wappalyzer parses the software used by the websites that I visit but it doesn’t show Flash. The closest it comes is SWFObject, an open source JavaScript that can be used to detect if a browser is running Flash Player as well as embed Flash video. But the presence of SWFObject is no guarantee that a website is using Flash.

To make a long story short, I decided to test a bunch of websites, local and global, to see how many still used Flash for some purpose. First the tables, then some of the conclusions that I drew from the exercise.

• Flash, HTML5 = has some videos/audio encoded for Flash and some for HYML5.
• Flash/HTML5 = all videos/audio is available in both encodings.
• mp3 stream = downloadable m3u link to an audio stream that can be opened with most media players.

Taking in the sites of Vancouver

Conventional wisdom says that small single-market media websites are more likely to be hanging on to embedded Flash content and that certainly seems to be the case with Vancouver radio stations. However, the majority of other media sites that I tested have moved over to HTML5, often by just uploading all of their video to YouTube.

Taking a site-seeing trip around the world

Money talks and what it says determines if Flash walks

It appears to me that the use of Flash to embed and stream multimedia is being ditched from the pointy end of the Internet pyramid down. The more a website depends on traffic for its income, the more likely it is to be moving to HTML5.

It’s fitting that YouTube, which adopted—and thus legitimized—Flash video in 2005, is leading the move away from it. Not only does YouTube’s move to HTML5 encourage other websites to follow suit but many small websites are making the jump by simply using YouTube to host all their videos.

But there remain tens of thousands of small and medium-size company websites at the bottom of the pile that are sticking with Flash video and audio for many of the same reasons that people have stuck with Windows XP: they can’t see why they should go to the trouble and expense of changing something that they don’t think is broken and that generates, at best, good will but no revenue.

A lot of radio and television stations around the world fall into this category.

Until someone creates the next FarmVille in HTML5 and the next Candy Crush Saga and so on—until then, Flash will remain the de facto choice for creating such social games, because it’s proven its worth—billions and billions of dollars-worth.

The financial sector of the web continues to use Flash-based tools to create interactive, real-time data visualizations of stock market activity and they likewise won’t be rushed to abandon what works and helps earn them money.

On the technical side, I found that when testing a site’s ability to deliver content in pure HTML5, it wasn’t always enough just to disable Flash Player in the browser; I had to remove it.

It’s default of the servers

A case in point was the Canadian Broadcasting Corporation (CBC), which said that Flash Player was required for video playback; this appeared to be true but only when I had the Flash Player installed.

• With Flash Player installed and activated, the CBC played the video with Flash
• With Flash Player set for click to play, the CBC showed the “Activate Flash” block screen
• With Flash Player disabled, the CBC said that I was missing the necessary Flash plug-in

But after I completely uninstalled Flash Player from my laptop, all the CBC’s videos played—meaning they are all being provided in both Flash format and an open standard HTML5 format but the CBC will default to offering the Flash version unless there is no hint of Flash Player in your browser!

The NBA website was the same way.

HTML5—an open source of some confusion

HTML, or HyperText Markup Language, is a system of text “tags” that tell web browsers how to make web pages look and act. Adobe Flash originally gained its foothold delivering so-called rich media on the web because HTML could define text and colour and static images but had no tags to control multimedia.

The latest revisions to the HTML markup language—the fifth, hence “HTML5”—finally adds the tags (like <video> and <audio>) that can allow web browsers to handle multimedia, without the need for third party plug-ins like Adobe’s Flash Player and Microsoft’s Silverlight.

Ideally, the World Wide Web Consortium (WC3) that oversaw the HTML5 revisions, would have settled on two open source encoders (or codecs)—one for video and one for audio—as the only two codecs that web browsers needed to build-in support for.

This made a world of sense and many expected and hoped that the two high-quality open source codecs chosen would be Ogg Vorbis (for audio) and Ogg Theora (for video).

Instead, for whatever reason, the W3C settled on nothing whatsoever, forcing browsers to choose between three competing “open standard” video codecs:

• H.264, created by the MPEG and ITU-T, is an open standard subject to royalties
• Ogg Theora, created by On2 Technologies and made open source by 2002
• WebM, an open source version of another On2 codec, released by Google after it bought On2 in 2010

Apple stands behind H.264 and this is seemingly the only video coding format of the three that is natively supported by Apple’s Safari web browser. Neither Mozilla Firefox nor Opera can afford the licensing fees for H.264 and instead both support Ogg Theora and WebM. Google’s Chrome still supports all three codecs and more. Microsoft supported H.264 and WebM in Internet Explorer 9 but it’s not clear yet what the Edge browser in Windows 10 supports.

A confusion of competing video codecs was one of the things that made the one-stop solution of Flash so attractive in the early 2000s and it was exactly what the revised HTML5 standards were supposed to avoid but didn’t.

If Flash dies, it will be from old age, not HTML5

The new HTML5 standard is powerful but adoption has clearly been handicapped by both an unwillingness to settle on explicit audio and video encoding formats and by a lack of multimedia authoring tools.

The former means that web browser makers are left to decide which of the three video encoding schemes they will build support for and web developers wanting to deliver streaming video using pure HTML5 must make up to three versions of the same video available if they want to be compatible with all the major web browsers—as opposed to doing it once for Flash.

This can only make converting an existing multimedia library over to HTML5 that much more expensive.

And HTML5 seems to be nowhere near having the development capabilities to match Adobe Flash in the creation of animated content, but I’m honestly not qualified to talk about that (the last time that I built with Flash was with version five in 2000!).

And I cannot competently speak to the security questions either.

But I will say that the charge leveled against the Flash Player, that it has become a popular attack vector because it allows malicious coders the same weak doorway into all operating systems, seems to equally apply to HTML5.

And HTML5’s answer to Flash’s animation capabilities, resting as it does on SVG files and JavaScript, appears to have its own genuine security implications to address.

Scalable vector graphics (SVG) image files can contain unseen interactive code structures, such as HTML, JavaScript, and Flash, allowing something called code injection. Security experts say that any SVG image should be treated as a potential application program, with all the security issues that entails. And JavaScript can also store hidden data payloads and allows HTML code injection.

Many social media web platforms, including WordPress.com, which hosts my blog, will not support the upload of SVG images due to their inherent security risk and will only accept JavaScript from trusted content providers, such as Google.

A short history of Adobe Flash