Bug 1317856 (flash-click-to-play)

[meta] Make Flash plugin click-to-play (aka "Ask to Activate")

RESOLVED FIXED in Firefox 55

Status

()

defect
P3
normal
RESOLVED FIXED
3 years ago
8 months ago

People

(Reporter: cpeterson, Assigned: Felipe)

Tracking

(Depends on 3 bugs, 4 keywords)

unspecified
mozilla55
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(relnote-firefox 55+, firefox55 fixed)

Details

Attachments

(3 attachments)

Reporter

Description

3 years ago
In 2017, Firefox will require click-to-activate approval from users before a website activates the Flash plugin for any content:

https://blog.mozilla.org/futurereleases/2016/07/20/reducing-adobe-flash-usage-in-firefox/
Reporter

Updated

3 years ago
Depends on: win64-migration
Reporter

Comment 1

3 years ago
mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.
Depends on: webgl2, wasm, 1225406
Reporter

Updated

3 years ago
Depends on: 1277066

Updated

3 years ago
No longer depends on: 1312091

Updated

3 years ago
No longer depends on: 1295984
Depends on: flashstudy
Depends on: 1348089

Comment 3

2 years ago
(In reply to Chris Peterson [:cpeterson] from comment #1)
> mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly
> (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.

Why so? Making Flash click-to-play and shipping a bunch of features doesn't seem related.
Reporter

Comment 4

2 years ago
(In reply to David Bruant from comment #3)
> (In reply to Chris Peterson [:cpeterson] from comment #1)
> > mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly
> > (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.
> 
> Why so? Making Flash click-to-play and shipping a bunch of features doesn't
> seem related.

Shipping those other features first means that Flash game developers can launch their WebAssembly/WebGL2 game ports before we make Flash click-to-play. Game developers don't want their users to be interrupted by click-to-play problems. Shipping them first is a nice-to-have, not a strict release blocker.
Depends on: 1352224
According to the plan, we want to land this now so that users can start downloading these lists in advance for switching Flash as CTA, to give them a better experience.

I'll note that even with Activate-By-Default, this setting will start applying the 3rd-party blocklist for flash.

I'm wrapping this around NIGHTLY_BUILD in order to make it a separate decision/bug to roll this out, and then it will be just a matter of removing the ifdef.
Assignee: nobody → felipc
Status: NEW → ASSIGNED
Attachment #8863032 - Flags: review?(benjamin)

Updated

2 years ago
Attachment #8863032 - Flags: review?(benjamin) → review+

Comment 6

2 years ago
Pushed by felipc@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ddf532ded6f2
Configure Nightly to download and use the flash 3rd party blocklist, in preparation for switching Flash as Click-to-Activate. r=bsmedberg
Depends on: 1361433
The test failures were due to the testing running in a system principal, where plugins will be blocked with this change. I had filed bug 1361433 to change it, but that is intentional, so I cherry-picked the test fixes from bug 1335475 and sent that to tryserver to see if everything will work:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b001dee46c942ccde9efd5a9ca0db5f18fbf561e
Flags: needinfo?(felipc)
I spun off the pre-req of toggling plugins.flashBlock.enabled to a separate bug
Depends on: 1361798
Depends on: 1362149
(This has been through tryserver already and everything passed)
Attachment #8866060 - Flags: review?(benjamin)

Updated

2 years ago
Depends on: 1363713
Comment on attachment 8866060 [details] [diff] [review]
Make Flash CTP for Nightly, and favor html5 video content

Please also reset plugins.navigator.hidden_ctp_plugin to "" on all channels. https://dxr.mozilla.org/mozilla-central/rev/d8762cb967423618ff0a488f14745f60964e5c49/modules/libpref/init/all.js#3012

r=me with that addition

Please wait to land this until the week 2 flash list items are in production: so maybe land Monday for Tuesday's nightly?
Attachment #8866060 - Flags: review?(benjamin) → review+
(In reply to Benjamin Smedberg [:bsmedberg] from comment #11)
> Comment on attachment 8866060 [details] [diff] [review]
> Make Flash CTP for Nightly, and favor html5 video content
> 
> Please also reset plugins.navigator.hidden_ctp_plugin to "" on all channels.
> https://dxr.mozilla.org/mozilla-central/rev/
> d8762cb967423618ff0a488f14745f60964e5c49/modules/libpref/init/all.js#3012

ah, good catch. FWIW the study/experiment did this, I just forgot about it in this patch.

> 
> r=me with that addition
> 
> Please wait to land this until the week 2 flash list items are in
> production: so maybe land Monday for Tuesday's nightly?


Sounds good. I'll try to get a patch to prefer fallback in the SWFObject case too, and hopefully land that before or together with this.
Depends on: 1364505
Comment hidden (mozreview-request)

Comment 14

2 years ago
mozreview-review
Comment on attachment 8868255 [details]
Bug 1317856 - Ensure that flashblock tests are not affected by nosrc fallback rule.

https://reviewboard.mozilla.org/r/139838/#review143190

::: toolkit/components/url-classifier/tests/browser/flash_block_frame.html:10
(Diff revision 1)
>  </head>
>  <body>
>    <h1>Test page</h1>
> -  <object id="testObject" width="100" height="100" type="application/x-shockwave-flash-test"></object>
> +  <object id="testObject" width="100" height="100"
> +  		  type="application/x-shockwave-flash-test"
> +  		  data="simple_blank.swf"></object>

nit: tabs should be spaces
Attachment #8868255 - Flags: review?(ksteuber) → review+

Comment 15

2 years ago
Pushed by felipc@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ddc27dd93ec0
Ensure that flashblock tests are not affected by nosrc fallback rule. r=bytesized
https://hg.mozilla.org/integration/mozilla-inbound/rev/12a7b0378709
Make the Flash plugin Click-to-Activate by default on Nightly. r=bsmedberg

Comment 16

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/ddc27dd93ec0
https://hg.mozilla.org/mozilla-central/rev/12a7b0378709
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Blocks: 1365714
See Also: → 1365714
I've documented this, piggy backing it on the Flash http/https-only update as it seemed to fit well:

https://developer.mozilla.org/en-US/docs/Plugins
https://developer.mozilla.org/en-US/Firefox/Releases/55
Release Note Request (optional, but appreciated)
[Why is this notable]: Affects all Firefox users directly
[Affects Firefox for Android]: I guess so, maybe someone could verify that.
[Suggested wording]: Made Flash generally click-to-play and only allowed it on http:// and https:// URL schemes.
[Links (documentation, blog post, etc)]: see comment 17
relnote-firefox: --- → ?
Added to 55beta release notes.

Updated

2 years ago
Depends on: 1377036
This significantly changed behavior from "hidden" to "fallback" mode in nightly. I kind of prefer hide behavior, I've already restored `plugins.navigator.hidden_ctp_plugin;Shockwave Flash` in my config.

Do you plan to support case like speedtest.net? Where they detect if flash is supported with JS and redirect to beta page. Before changes in this commit flash was hidden so such code redirected to no-flash page. And overall it was better in preferring fallback content, now it is sort of preferring non-flash.

if (swfobject.hasFlashPlayerVersion("10.0.0")) {
  // User has flash
  swfobject.embedSWF("http://c.speedtest.net/flash/speedtest.swf?v=352081", "flashcontent", "728", "450", "10.0.0", "flash/expressInstall.swf", flashvars, params, attributes);
  //swfmacmousewheel.registerObject(attributes.id);
} else {
  if ('true' === 'true' && 'false' === 'false') {
    window.location="//beta.speedtest.net" + window.location.search;
  }
  // don't redirect again
  else if ( window.location.search.indexOf("noflash=1") == -1) {
    // User does not have flash
    window.location="/?noflash=1";
  }
}
Also, please remove `plugins.navigator_hide_disabled_flash` from modules/libpref/init/all.js it is not used anymore. And it fooled me for a second that it is not working.
Reporter

Comment 22

2 years ago
(In reply to Kacper Michajłow [:kasper93] from comment #21)
> Also, please remove `plugins.navigator_hide_disabled_flash` from
> modules/libpref/init/all.js it is not used anymore. And it fooled me for a
> second that it is not working.

Good catch. No code reads the plugins.navigator_hide_disabled_flash pref so we should remove it:

https://searchfox.org/mozilla-central/search?q=navigator_hide_disabled_flash
Comment 21-22 are bug 1367226. Patches gladly accepted.

Regarding comment 20: yes this has been a tough tradeoff to make. At this point in time, we've decided to ship the "safer" version where Flash is still present in navigator.mimeTypes/navigator.plugins. This is provably better for the long tail of sites that may still require Flash, even though it's not great for sites that have a non-Flash fallback. That is a decision we will continue to revisit over the next year.

Comment 24

2 years ago
Hello,
I have a question. I am from Zynga & we develop flash based games. I have one question - are we doing any domain blocking i.e. are we whitelisting any specific websites like facebook.com or google.com etc. for users not to go through "Click to activate" flow?

Comment 25

2 years ago
I have another question -
from Firefox 55 onwards, how to detect flash is enabled or not? What is the JS code for that?
There is domain-based blacklisting and whitelisting. For information on how this works, refer to:
    http://gecko.readthedocs.io/en/latest/toolkit/components/url-classifier/url-classifier/flash-block-lists.html

You can also see what domains are currently on the lists here:
    https://github.com/mozilla-services/shavar-plugin-blocklist

Flash capabilities continue to be detectable via JS as usual:
    https://developer.mozilla.org/en-US/docs/Web/API/NavigatorPlugins/plugins

Documents from blacklisted domains, however, will find that "Shockwave Flash" is not present in |navigator.plugins|. If the document receives a Click to Activate classification, "Shockwave Flash" will be present in |navigator.plugins| but of course the user will have to choose to activate Flash before the objects will actually be loaded.

Comment 27

2 years ago
Hello, I have another question - 
There is a verbatim mentioned in this documentation - https://developer.mozilla.org/en-US/Firefox/Releases/55

"
Flash content is now "click-to-activate" (bug 1317856). This was immediately put into effect for all users of Nightly, and 50% of beta users. For Firefox 55 release version, the plan is to activate this for 5% of users 2 weeks after release, 25% of users 4 weeks after release, and 100% of users 6 weeks after release (bug 1365714).
"

Can someone please provide the dates for each ramp milestone?

For our business, we are not seeing any upside on people who are affected? Did mozilla already up-ramp to 25% as of today?


Regards,
Srinath Mohan
Hello Srinath,

The plan is written slightly wrong on that page. It was:
- 5% out of door
- ramp up to 25% after two weeks
- ramp up to 100% after four weeks


We're now past two weeks but we've delayed the plan a bit. The rollout of 55 has been slower than usual (due to a few dot releases, 55.0.1 0.2 0.3), so we're waiting for more data to come up until we do the ramping.

We don't have exact dates, it's a decision to be taken on a weekly basis, but you can follow along any news on these bugs: bug 1390703 and bug 1390705.  I should mention there was some suggestion about bumping directly to 100%, but that is not certain yet (and I think it is unlikely).

Comment 29

2 years ago
Hello Felipe,
Thanks for your confirmation. I will follow up on the bug #s provided for further information. In case if you have made any decision changes, please feel free to update this ticket so that we can have a close watch.

-Srinath

Comment 30

2 years ago
Hello felipe,
As per the ticket https://bugzilla.mozilla.org/show_bug.cgi?id=1390703 it mentions v55 is 100% ramped and v56 is ramped to 25%. Please let me know whether the understanding is right and if so, when are you going with 100% for v56.


regards,
Srinath Mohan
Engineering Manager, Zynga Inc.
Summary: Make Flash plugin click-to-play (aka "Ask to Activate") → [meta] Make Flash plugin click-to-play (aka "Ask to Activate")
You need to log in before you can comment on or make changes to this bug.