News for hackers. Stuff that matters.
Re:Two more Flash 0-days emerge in Hacking Team leak by dhimes on Sunday July 12, 2015 @12:38PM (#9873970)
Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.
Re:Two more Flash 0-days emerge in Hacking Team leak by sethd on Sunday July 12, 2015 @02:17PM (#9874338)
I can think of one use case where Flash still makes sense: Live video

A lot of people seemed to be surprised this is the case but tell me what single live streaming protocol is supported across all browsers without a plugin?

With Flash you can stream HLS (HTTP Live Streaming) to a Flash player in full browsers while just directly loading the same HLS playlist in mobile browsers via native players (iOS / Android).

This means you can deliver live streaming over the same audio/video codec (H.264/AAC) and over the same protocol (HLS). This vastly simplifies your streaming infrastructure and removes the need for transcoding on the server, unless you just want to create different qualities for adaptive bitrate streaming.

It would be nice if "desktop" browsers all supported HLS and H.264/AAC natively, that would be a real Flash killer.

Re:Two more Flash 0-days emerge in Hacking Team leak by TD-Linux on Sunday July 12, 2015 @04:35PM (#9874864)
You're right, live video without Flash is not nearly as advanced. However, there are several options that work right now:

- Plain old HTTP WebM stream. Only one resolution, but it works. - MPEG-DASH - very similar to HLS, but implementable in Javascript via MSE APIs in browsers today. - WebRTC - low latency streaming, in some cases it might make sense to use this over MPEG-DASH even for one-to-many streaming cases, like interactive lectures and the like.

Unfortunately several browsers lag behind in implementing the required APIs, so this does not solve all problems yet. But the problem isn't creating any new protocols, it's just getting adoption.

As for H.264, it's mostly a solved problem with hardware decoders and OpenH264 (currently not used for <video> playback, but could be). AAC, however, costs more to license and is much more problematic, so there will always be some browser vendors that don't ship it.

Re:Two more Flash 0-days emerge in Hacking Team leak by endianswap on Sunday July 12, 2015 @02:45PM (#9874432)
Yes except if you want 1080p60 you just won't be able to use Flash because even on fast computers the CPU overhead is killer.
Re:Two more Flash 0-days emerge in Hacking Team leak by sethd on Sunday July 12, 2015 @04:21PM (#9874812)
I don't have those issues with 1440p Flash video on OS X running decent hardware.

That said, I truly wish these remaining use cases for Flash were unnecessary, I would not miss it at all.

Re:Two more Flash 0-days emerge in Hacking Team leak by archgoon on Sunday July 12, 2015 @12:42PM (#9873986)
A lot of advertising networks use it to deliver advertisements. Whether it is simple inertia at this point, or because the networks can get a better fingerprint using flash, I don't know.

Also, it used to be the case that Flash had better DRM controls on it, but I'm pretty sure that reason is no longer the case since Encrypted Media Extensions got rolled out.

However, that doesn't explain why Facebook's on-site video player uses Flash.

Re:Two more Flash 0-days emerge in Hacking Team leak by ninkendo on Sunday July 12, 2015 @06:45PM (#9875321)
The advertising networks being the last to use it is something that will make Flash's implosion very quick and sudden, IMO.

If uninstalling flash only causes you to miss out on ads, it makes uninstalling flash that much more attractive. Which makes the advertisers want to get off flash that much sooner.

It needs probably just one or two more use cases to disappear (Facebook video is one of them), and its final death will be quite quick.

Re:Two more Flash 0-days emerge in Hacking Team leak by bydo on Sunday July 12, 2015 @01:36PM (#9874205)
Which is what makes these exploits so insidious: sneak an infected advertisement onto one network, even briefly, and you're now targeting who knows how many Internet users visiting legitimate, trusted websites.

Honestly, one of the biggest reasons to run an ad blocker is the significantly reduced attack surface.

Re:Two more Flash 0-days emerge in Hacking Team leak by shimfish on Sunday July 12, 2015 @01:24PM (#9874156)
Facebook appears to have moved to an html player in the last few days.
Re:Two more Flash 0-days emerge in Hacking Team leak by hobarrera on Sunday July 12, 2015 @07:39PM (#9875480)
Not for everyone, apparently. I'm still being prompted to install a plugin.

Not only that, but images flagged as "gif" also prompt me to install flash (amazing how oddly these new features get implemented!).

Re:Two more Flash 0-days emerge in Hacking Team leak by cpeterso on Sunday July 12, 2015 @05:28PM (#9875045)
Facebook currently only supports HTML5 video for Windows 7+.
Re:Two more Flash 0-days emerge in Hacking Team leak by jimmaswell on Sunday July 12, 2015 @01:20PM (#9874142)
YouTube's Flash player still works a lot better than the HTML5 one. Their HTML5 one desynchs the audio occasionally, cuts off the audio before the video ends, doesn't support a real right click -> copy video URL (all it can do is give a popup with the URL), and still has other small bugs. The Flash one has none of these problems.

It seems to be the case in general for most sites that offer HTML5 alternatives that the Flash version is much more solid. Maybe using HTML5 video in these domains is inherently error-prone, maybe it isn't, but in practice it almost always gets screwed up.

Plus people still use flash games and sites like Newgrounds.

Re:Two more Flash 0-days emerge in Hacking Team leak by eridius on Sunday July 12, 2015 @03:35PM (#9874614)
YouTube's HTML5 video player has always been a shit-show, and I don't understand why. Vimeo has had an excellent HTML5 video player for many years, and there's at least a few third-party HTML5 video players that are pretty good as well.
Re:Two more Flash 0-days emerge in Hacking Team leak by bitmapbrother on Sunday July 12, 2015 @04:23PM (#9874821)
Speak for yourself. YouTube's HTML5 video player has always been stellar for me.
Re:Two more Flash 0-days emerge in Hacking Team leak by eridius on Sunday July 12, 2015 @07:31PM (#9875445)
Are you sure you're actually using the HTML5 player? I am being 100% serious when I say I've never met someone before who thinks YouTube's HTML5 player is good.

Among the various issues I've seen:

* Sometimes refuses to play anything, without showing any errors, requiring a reload of the page.

* Occasional poor performance.

* Audio/video desynchronization

* Scrubbing the video often causes it to get stuck, refusing to play, until I scrub it again

* Videos often take longer to start playing than with the flash player.

* Fullscreen is sometimes broken

* Switching from regular mode to "theater" mode sometimes leaves the video playing in its original size, anchored to the corner of the now-larger black area that it should be playing in.

I think it's gotten a little better recently (i.e. I see issues less often), but it's still far from great.

And before you ask, I've seen these issues in both Safari and Chrome.

Re:Two more Flash 0-days emerge in Hacking Team leak by bitmapbrother on Sunday July 12, 2015 @09:31PM (#9875878)
Yes, I'm using the HTML5 player. This is easily verified by clicking the right mouse button on the video and seeing the HTML5 context menu. I have no problems with it at all and it's easily superior to the Flash player in performance and resource usage. It also seamlessly plays 1080p 60FPS video without any issues.

As for the issues you're experiencing - are you sure you have GPU acceleration turned on?

I'm using Chrome and CPU usage is only 45-50% for perfect 1080p 60FPS playback.

Re:Two more Flash 0-days emerge in Hacking Team leak by ild on Monday July 13, 2015 @01:34AM (#9876593)
> and it's easily superior to the Flash player in performance and resource usage.

Not on older (3y+) machines.

Re:Two more Flash 0-days emerge in Hacking Team leak by morphles on Monday July 13, 2015 @05:13AM (#9877077)
All such comments about not working flash player on youtube make me think of some kind of adobe shills maybe? Or PEBCK. Unless you have some super lame vidoe card I do not see how one can not make HTML5 player work. My experience: HTML5 player works really well on youtube, been using it for at least a year (well possibly +- couple months) exclusively. No problems after configuration, machine is quite old q6600 cpu that is 5-6 years old and GF220, which is also quite old now. Full hd video ON Linux (!), Firefox no problems (though possibly just 30fps, not sure if I ever try 60fps). And people complain all over the place about HTML5 youtube on Linux.
Re:Two more Flash 0-days emerge in Hacking Team leak by ild on Monday July 13, 2015 @09:59AM (#9878078)
Fine. I cannot argue about _your_ experience. _My_ experience is different. One of my computers is really old Pentium M laptop (9y old) and HTML5 barely works at 240p. Not only that, it has limited set of resolutions at the first place. Flash works just fine 480p resolution. It looks also much better at lower bitrates (to _my_ taste) than HTML5 in Firefox

> make me think of some kind of adobe shills maybe

Delusions or paranoia may be?

Re:Two more Flash 0-days emerge in Hacking Team leak by morphles on Tuesday July 14, 2015 @01:47AM (#9883092)
It was far less personal than that, I generaly only lurk on HN, but your post one that struck a nerve finaly, after many similar posts here and in /..

Also 9 year old is quite a frac cry from your initial post of "(3y+) machines", 9 year old machine almost guaranteed has absolutely no support in hardware for modern codecs. So no wonder has strong limitations on resolution. Still flash working better than HTML5 players is still suspicious to me, I still believe with correct configuration reverse should be true, as flash is basically just another layer in between screen and bits on the net. Though possibly not applicable in all cases.

Re:Two more Flash 0-days emerge in Hacking Team leak by ild on Tuesday July 14, 2015 @04:42AM (#9883551)
9y old machines is what many people (not gamers, enthusiasts etc.) have; 3+ y old include underpowered Celeron 847, AMDs (way weaker than your monstrous Q6600) and even on these machines Flash works better. _My_ _actual_ observations.

> Still flash working better than HTML5 players is still suspicious to me,

Do you write programs for life or what? It is not a problem with HTML5 players, it a problem the way they are written. Flash is an older product, with better support of legacy or underpowered products.

> I still believe with correct configuration reverse should be true

Yes, the correct configuration is "more powerful CPU".

Re:Two more Flash 0-days emerge in Hacking Team leak by pavanky on Sunday July 12, 2015 @09:23PM (#9875851)
I am not the person you are replying to but I do not have flash installed on my system. I have to do an occasional reload but I've never had to do anything else you have mentioned.

For reference, I use chromium (not chrome) on Linux (which does not come with flash bundled).

Re:Two more Flash 0-days emerge in Hacking Team leak by frik on Sunday July 12, 2015 @01:33PM (#9874191)
The HTML5 video in iOS is rock solid (Safari/Chrome on iOS). The Chrome/Firefox/IE HTML5 video implementations could be a bit better (in comparison).
Re:Two more Flash 0-days emerge in Hacking Team leak by tammer on Sunday July 12, 2015 @01:35PM (#9874200)
This is like asking why people still use cash when there are so many other easier to use & manage payment options. The simple answer is there are far too many edge cases where it's still required - any single one doesn't sound like a good answer.
Re:Two more Flash 0-days emerge in Hacking Team leak by ams6110 on Sunday July 12, 2015 @01:52PM (#9874266)
Cash is still the most anonymous way to pay for something also, at least for most people.
Re:Two more Flash 0-days emerge in Hacking Team leak by phn on Sunday July 12, 2015 @01:52PM (#9874264)
I think the truth is, technology that supplants it is still not there yet. Sockets, sound, video...

And there's still a truckload of fun games available only in flash form, which makes flash relevant even if the number of new stuff coming out in it dwindles.

Re:Two more Flash 0-days emerge in Hacking Team leak by darklajid on Sunday July 12, 2015 @01:20PM (#9874143)
Twitch. Which happens to amuse me, which I like to waste time. But .. they seem unwilling to move away from Flash (the only thing I found was a ~3 year old support thread that wants to .. support HLS. Yay. Not that's not helpful)
Re:Two more Flash 0-days emerge in Hacking Team leak by tl on Sunday July 12, 2015 @01:28PM (#9874174)
Twitch without Flash has been available for a while now, if you were willing to use VLC + an IRC client. Twitch HTML5 chat went live on June 30th, HLS was prior to that.

I'd say they're open to ditching Flash.

Re:Two more Flash 0-days emerge in Hacking Team leak by darklajid on Sunday July 12, 2015 @02:13PM (#9874323)
VLC for HLS I assume (and I only stumbled upon the '/hls' suffix for any url to support that by accident/in that ticket, which still doesn't seem to be officially closed).

IRC for chat is absolutely new to me and would actually be quite nice..

Re:Two more Flash 0-days emerge in Hacking Team leak by aw3c2 on Sunday July 12, 2015 @02:45PM (#9874436)
Re:Two more Flash 0-days emerge in Hacking Team leak by hengheng on Sunday July 12, 2015 @04:18PM (#9874798)
Is there a nice way to get the stream to open in VLC?
Re:Two more Flash 0-days emerge in Hacking Team leak by scottjad on Sunday July 12, 2015 @10:15PM (#9876000)
idk about VLC, but with mpv you can just type "mpv http://www.twitch.tv/streamername" and it plays.
Re:Two more Flash 0-days emerge in Hacking Team leak by DrJokepu on Sunday July 12, 2015 @01:32PM (#9874190)
Twitch works just fine with HTML5 these days, including chat.
Re:Two more Flash 0-days emerge in Hacking Team leak by chippy on Sunday July 12, 2015 @02:06PM (#9874305)
How do you get the video to play with HTML5?
Re:Two more Flash 0-days emerge in Hacking Team leak by DrJokepu on Sunday July 12, 2015 @05:25PM (#9875033)
Works out of the box on Safari 8 with no Flash installed.

Edit: proof: http://i.imgur.com/myfsoNv.png

Re:Two more Flash 0-days emerge in Hacking Team leak by rockdoe on Monday July 13, 2015 @08:25AM (#9877672)
It's using HLS, so not really HTML5 but an Apple specific proprietary extension.

The HTML5 solution is usually to run DASH via a JS demuxer utilizing MSE.

Re:Two more Flash 0-days emerge in Hacking Team leak by decisiveness on Monday July 13, 2015 @08:37AM (#9877724)
Wonder if they'll ever ad support for Firefox.
Re:Two more Flash 0-days emerge in Hacking Team leak by feld on Sunday July 12, 2015 @01:33PM (#9874193)
Ubiquiti products require it for some functionality, and they're wildly popular for Wifi and wireless ISPs right now.

I actually just filed a complaint on their forums.

http://community.ubnt.com/t5/UniFi-Wireless/BUG-Adobe-Flash-...

Re:Two more Flash 0-days emerge in Hacking Team leak by ran290 on Sunday July 12, 2015 @02:20PM (#9874353)
Their latest controller (v4?) removed the Flash requirement for both video (playback) and main (maps) IIRC. Do they still have leftover areas that require Flash?
Re:Two more Flash 0-days emerge in Hacking Team leak by feld on Sunday July 12, 2015 @02:37PM (#9874411)
v4 is a long way from being a stable release
Re:Two more Flash 0-days emerge in Hacking Team leak by ran290 on Sunday July 12, 2015 @07:05PM (#9875379)
Ah, I was under the impression that they've officially moved it out of the 'beta' naming
Re:Two more Flash 0-days emerge in Hacking Team leak by hueving on Sunday July 12, 2015 @06:50PM (#9875334)
wtf are you complaining for? You don't like flash and they are removing it.
Re:Two more Flash 0-days emerge in Hacking Team leak by feld on Sunday July 12, 2015 @09:36PM (#9875890)
ubnt has a habit of not finishing what they start. AirControl 2 is not finished and they're talking about Aircontrol 3. Airvision has been rewritten 3 times in 3 years.

For all I know they're doing Unifi 5 in pure flash. I wouldn't be surprised.

Re:Two more Flash 0-days emerge in Hacking Team leak by Scarbutt on Sunday July 12, 2015 @02:22PM (#9874358)
What ubnt products require flash? airOS works fine for me without flash.
Re:Two more Flash 0-days emerge in Hacking Team leak by feld on Sunday July 12, 2015 @02:35PM (#9874397)
Unifi 3.x requires flash to manage devices on a map. It's the main screen you see when you log in.

Unifi 4.x is still beta and I'm not sure if it still requires flash (Though for Ubnt stable means beta, beta means alpha, alpha is unlikely to even run.)

Last I checked AirControl did too (managing many AirOS devices)

Re:Two more Flash 0-days emerge in Hacking Team leak by steckerbrett on Sunday July 12, 2015 @12:42PM (#9873990)
What websites use it? I've not encountered a single incompatible website recently, and haven't had flash installed for a long time now.
Re:Two more Flash 0-days emerge in Hacking Team leak by archgoon on Sunday July 12, 2015 @12:47PM (#9874015)
Facebook's inline video player uses it. On linux, I get a popup saying that I must install Flash.
Re:Two more Flash 0-days emerge in Hacking Team leak by toja92 on Sunday July 12, 2015 @12:52PM (#9874031)
In Safari on OS X, Facebook does use the native <video> player.

I'm guessing that Facebook encodes video h264 which isn't natively supported in Firefox; rather it relies on support in the operating system. I'm not sure if Chrome on Linux supports h264, however since Chrome also includes its own Flash player I guess that Facebook may be using their own flash player anyway.

Re:Two more Flash 0-days emerge in Hacking Team leak by hkmix on Sunday July 12, 2015 @01:01PM (#9874063)
Pretty sure there are some settings you need to enable in about:config to get H264 working in Firefox (assuming you have the right gstreamer stuff installed).
Re:Two more Flash 0-days emerge in Hacking Team leak by nitrogen on Sunday July 12, 2015 @01:09PM (#9874100)
Firefox can also install the free Cisco h.264 codec.
Re:Two more Flash 0-days emerge in Hacking Team leak by therealmarv on Sunday July 12, 2015 @12:47PM (#9874011)
FB is using it a lot. For videos, for uploading pictures.
Re:Two more Flash 0-days emerge in Hacking Team leak by Kliment on Sunday July 12, 2015 @01:10PM (#9874105)
BBC iPlayer is flash-only
Re:Two more Flash 0-days emerge in Hacking Team leak by cormullion on Sunday July 12, 2015 @02:29PM (#9874380)
Not just iPlayer - the main BBC website - including news/weather/sport - requires Flash to display all video content on desktops.
Re:Two more Flash 0-days emerge in Hacking Team leak by skrebbel on Sunday July 12, 2015 @12:44PM (#9874002)
Porn sites.
Re:Two more Flash 0-days emerge in Hacking Team leak by ran290 on Sunday July 12, 2015 @12:57PM (#9874048)
All my frequent porn sites support HTML5 video now
Re:Two more Flash 0-days emerge in Hacking Team leak by dhimes on Sunday July 12, 2015 @12:54PM (#9874041)
Good question. There were some I had to use Chrome to view (espn, cnn, facebook-- somebody) and I was quite surprised.
Re:Two more Flash 0-days emerge in Hacking Team leak by MatthiasP on Sunday July 12, 2015 @01:05PM (#9874083)
twitch.tv
Re:Two more Flash 0-days emerge in Hacking Team leak by sobkas on Sunday July 12, 2015 @01:13PM (#9874119)
You can play streams with: livestreamer

http://docs.livestreamer.io/

And chat trough their irc server.

Re:Two more Flash 0-days emerge in Hacking Team leak by DavideNL on Sunday July 12, 2015 @01:59PM (#9874287)
I don't think that's needed, i'm looking at Twitch right now (via the normal way) - and i don't have Flash installed.
Re:Two more Flash 0-days emerge in Hacking Team leak by darklajid on Sunday July 12, 2015 @02:13PM (#9874324)
On an iOS or Apple device?
Re:Two more Flash 0-days emerge in Hacking Team leak by DavideNL on Tuesday July 14, 2015 @11:46AM (#9885788)
OS X, Yosemite, Safari
Re:Two more Flash 0-days emerge in Hacking Team leak by Redoubts on Sunday July 12, 2015 @01:13PM (#9874118)
HBO Go
Re:Two more Flash 0-days emerge in Hacking Team leak by x0x0 on Sunday July 12, 2015 @01:36PM (#9874208)
My 401k provider -- that btw I can't choose -- fucking uses flash for their entire website.
Re:Two more Flash 0-days emerge in Hacking Team leak by stinky613 on Sunday July 12, 2015 @03:31PM (#9874599)
It seems like some B2B software vendors use it to keep people from seeing/manipulating their frontend code in web-based applications.
Re:Two more Flash 0-days emerge in Hacking Team leak by marvel_boy on Sunday July 12, 2015 @01:55PM (#9874273)
Unfortunately advertising managers love Flash. Technicaly there is no reason to use (see iOS Safari HTML dealing with video).