Firefox is blocking Flash by default

[Brink]

After a number of issues and exploits have been discovered recently, Mozilla has taken a big step and is now blocking Flash in all of its Firefox browsers.

Flash, the much maligned and hated software on which a surprisingly big part of the web still relies, has often been criticized for its faulty security. More recently, unpatched vulnerabilities, which are being exploited in the wild, have transformed Adobe’s platform into an even bigger liability.

But you’re a bit safer if you rely on Firefox, as Mozilla has put Flash on its blacklist of software and addons. The program is disabled by default and can only be enabled if the user clicks on a prompt that pops up. The reasoning here is that Flash needn’t be blocked completely, but it shouldn't be running without the user’s knowledge either.

Read more: After Facebook called for its death, now Firefox is blocking Flash by default

 

[lehnerus2000]

Sounds like Mozilla are doing something sensible for a change.

 

[Callender]

Blocking it by default is okay but how many users are going to active flash content anyway? The problem is that once activated flash will be allowed to run for any content on the whole webpage or even the whole domain (website)

Personally I've always used this Firefox addon:

https://addons.mozilla.org/en-US/firefox/addon/click-to-play-per-element/

Installation instruction regarding about:config and about:addons preferences configuration are detailed in the above link.

What it does:

Blocks flash content unless a user specifically activates it and then it's only activated for the chosen element.

Opera: The version I use has the same functionality built in.

Internet Explorer: I don't have the flash plugin installed.

 

[andrew129260]

Or just set the option to click to play. Easier than installing an addon and less bloat.

 

[Callender]

Click to play - Firefox

Or just set the option to click to play. Easier than installing an addon and less bloat.

@ andrew129260

Hi Andrew,

I've just tried your suggestion using FF v39 and set pluins.click_to_play to true in about config preferences and also set Flash to "Ask to activate"

Now when I visit a page with multiple flash element including malicious flash advertising banners clicking on just one element activates flash for the entire web page. Would you please explain how to configure Firefox so that only the chosen flash element is activated?

Let me know if you need more info.

Many thanks.

Page with muli]tiple flash elements:



Click one just one element and they all activate. That's a security risk and I want to only activate the element that's clicked on.

 

[andrew129260]

Hmmm.....wonder if they changed that in firefox.....Last time I used firefox was about 5 versions ago. That worked then I believe. Perhaps they changed it now. Or maybe my memory is faulty...

I know with chrome when I set flash to click to play I right click on the one I want to run and click run and its only that area.

Perhaps because of my addons I get that behavior? I can't talk about some of them here...

 

[Callender]

Okay I understand the need not to mention some add ons. Actually I prefer to use Cyberfox or Opera 12 but do have Firefox Portable installed (latest version) just for testing. Thanks anyway!

 

[JerometheGiraff]

I suppose it's the best method.

 

[OvenMaster]

Flash update 18.0.0.209 seems to have fixed the issues for me. Now all Flash content plays flawlessly in Firefox without requiring any additional steps.

 

[Brds7t7]

I look forward to the day when flash has been completely killed. I'm very anti-facebook but even I have to agree with their security expert that Adobe really should set a date to kill it.
I've always had mine set to "Click to play" in Chrome but still await the day I can remove it. Flash is unnecessary now.
Java is another one I wish I could completely remove from my pc, but still have programs that use it.

 

[BlueGuy]

Flash update 18.0.0.209 seems to have fixed the issues for me. Now all Flash content plays flawlessly in Firefox without requiring any additional steps.

...... 2 days ago I was wondering why there was more than one flash update in a week, all the portable browsers I use were blocking the older copies as they 'aged'.

 

[RoasterMen]

Flash Player's been bugging me off. Can't Mozzila create their own instead? Flash Player is considered dead.

 

[lehnerus2000]

Easy To Use

It would be nice if it would just go away.

The trouble is, it is really easy to create animated content in Flash.
Unfortunately Flash projects are often a menace once they are deployed.

I've just finished an Adobe Edge module in my Web Design course.
It was a lot more difficult to create an entire website using Edge than using Flash.
Of course once I was almost finished the site, I realised I should have used a completely different approach.

Edge Tip
Build your basic website the normal way (I use Notepad++).
Build any fancy items (e.g. media players, slideshows, etc.) as individual components and then add them to the appropriate web pages.

 

[Diosoth]

Flash Player's been bugging me off. Can't Mozzila create their own instead? Flash Player is considered dead.

How so? Lots of sites still use it. I think disabling Flash is going to be annoying for a lot of people since places like eBay's checkout system require it. And while I'm aware Unity has sort of overtaken it for browser game creation, it's mostly being wasted on simple junk like idle games that do not warrant having such a resource hog of an engine. I also think it'll take a lo tof work to replace it, since the only effective way would be for the new thing to support the old stuff. You won't get the entire internet to just switch to something new overnight, and how many companies are going to want to spend the money needed to overhaul their sites?

Not to mention that a lot of less-savvy types will probably just see Firefox being annoying by doing this and switch browsers to something that isn't shutting off their plugins.

As for Java... one word for why that's still around... Minecraft. The game prints money and keeps selling, you can blame that on Java being so widespread, and probably not updated too often on user's PCs so logn as their game runs fine. Not that I can much recall seeing it used in browsers much anymore since Flash came along.

 

[ThrashZone]

Pretty odd eBay would require flash just for checkout :/
Just another good reason not to use eBay as far as I can tell

It is ironic now browsers are blocking flash
It took years for M$ to support flash starting with ie11

 

[HerrKaLeun]

As for Java... one word for why that's still around... Minecraft. The game prints money and keeps selling, you can blame that on Java being so widespread, and probably not updated too often on

Maybe you are referring to private use only. but Java is used all over the place where you get a browser interface (or for device firmware). for example at my work the(server based - browser accessed) time keeping is JAVA based, all modern building automation systems (and their access via browser) are JAVA based. If JAVA disappeared, you probably would not have many powerplants or any other things running.

JAVA usually are good in updating, most problem is see are with the specific software and lack of quality control on vendor side. Can't blame JAVA for that.

I'm not an IT person, so i may just be talking out of my ass. But i know in the corporate word not having JAVA on your PC would prevent you from doing many things you take for granted.

Privately, you could chose to be without JAVA and just don't go to websites that use it. But at work you see how "eveywhere" JAVA is.

for Flash: I just de-installed all flash and just don't use websites that have it. Haven't come across one that required it. If i come across an important site, i may reconsider. Most feates that flashprovided are annoying an silly anyway. I think Apple didn't use Flash because they found their own way to make 100 fart noise apps, which are equally as useful as what i see was provided with Flash.

 

[ThrashZone]

I believe we're say Oracle is the problem not java script in general
Oracle has been on a quarterly update schedule for sometime and that's one of the main problems
Too many unfixed exploits for the stand alone Oracle platform Toolkit/............ which most people don't need.

 

[margrave]

Flash Player's been bugging me off. Can't Mozzila create their own instead? Flash Player is considered dead.

No, Mozilla cannot create their own.

Flash is more than just a program or a plugin. It's a widely use tool that took years to get to where it is. A Mozilla replacement, no matter how good, would initially have no market penetration. The uptake would take years. That's not something that Mozilla is positioned to do.

If Mozilla wants to do something (and who know whether), they could quarantine Flash in a sandbox to halt the security issue. Deny Flash access to everything except for its own rendering.

 

[RoasterMen]

Flash Player's been bugging me off. Can't Mozzila create their own instead? Flash Player is considered dead.

No, Mozilla cannot create their own.

Flash is more than just a program or a plugin. It's a widely use tool that took years to get to where it is. A Mozilla replacement, no matter how good, would initially have no market penetration. The uptake would take years. That's not something that Mozilla is positioned to do.

If Mozilla wants to do something (and who know whether), they could quarantine Flash in a sandbox to halt the security issue. Deny Flash access to everything except for its own rendering.

It can be gone as easy as pie of Oracle doesn't give a f*** about the bugs.

 

[jamis]

Flash update 18.0.0.209 seems to have fixed the issues for me. Now all Flash content plays flawlessly in Firefox without requiring any additional steps.

Not for me. Flash v18.0.0.209 installed on 07/14/2015 just crashes when an attempt to use it in FF v39.

Update: Uninstalled Flash and re-installed v18.00.209 and it works fine in FF v39. Must have been a bad update.