1317856 - (flash-click-to-play) [meta] Make Flash plugin click-to-play (aka "Ask to Activate")

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect, P3)

Description

[Chris Peterson [:cpeterson]]

In 2017, Firefox will require click-to-activate approval from users before a website activates the Flash plugin for any content:

https://blog.mozilla.org/futurereleases/2016/07/20/reducing-adobe-flash-usage-in-firefox/

Comment 1

[Chris Peterson [:cpeterson]]

mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.

Comment 2

[Kohei Yoshino]

Posted the site compatibility doc: https://www.fxsitecompat.com/en-CA/docs/2016/flash-content-will-be-click-to-activate-in-2017/

Comment 3

[David Bruant]

(In reply to Chris Peterson [:cpeterson] from comment #1)
> mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly
> (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.

Why so? Making Flash click-to-play and shipping a bunch of features doesn't seem related.

Comment 4

[Chris Peterson [:cpeterson]]

(In reply to David Bruant from comment #3)
> (In reply to Chris Peterson [:cpeterson] from comment #1)
> > mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly
> > (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.
> 
> Why so? Making Flash click-to-play and shipping a bunch of features doesn't
> seem related.

Shipping those other features first means that Flash game developers can launch their WebAssembly/WebGL2 game ports before we make Flash click-to-play. Game developers don't want their users to be interrupted by click-to-play problems. Shipping them first is a nice-to-have, not a strict release blocker.

Comment 5

[:Felipe Gomes (needinfo for replies!)]

Attachment: Part 1 - Download and use 3rd-party blocklists

According to the plan, we want to land this now so that users can start downloading these lists in advance for switching Flash as CTA, to give them a better experience.

I'll note that even with Activate-By-Default, this setting will start applying the 3rd-party blocklist for flash.

I'm wrapping this around NIGHTLY_BUILD in order to make it a separate decision/bug to roll this out, and then it will be just a matter of removing the ifdef.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ddf532ded6f2
Configure Nightly to download and use the flash 3rd party blocklist, in preparation for switching Flash as Click-to-Activate. r=bsmedberg

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for various plugin related test failures, e.g. test_refresh_navigator_plugins.html:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9be2eb8c9061cdfc16d7d53e8f384afa5e1dcb8e

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=ddf532ded6f21595fe1b88b02cb964994d2d30e2&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=retry&filter-resultStatus=usercancel&filter-resultStatus=runnable

Comment 8

[:Felipe Gomes (needinfo for replies!)]

The test failures were due to the testing running in a system principal, where plugins will be blocked with this change. I had filed bug 1361433 to change it, but that is intentional, so I cherry-picked the test fixes from bug 1335475 and sent that to tryserver to see if everything will work:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b001dee46c942ccde9efd5a9ca0db5f18fbf561e

Comment 9

[:Felipe Gomes (needinfo for replies!)]

I spun off the pre-req of toggling plugins.flashBlock.enabled to a separate bug

Comment 10

[:Felipe Gomes (needinfo for replies!)]

Attachment: Make Flash CTP for Nightly, and favor html5 video content

(This has been through tryserver already and everything passed)

Comment 11

[Benjamin Smedberg]

Comment on attachment 8866060 [details] [diff] [review]
Make Flash CTP for Nightly, and favor html5 video content

Please also reset plugins.navigator.hidden_ctp_plugin to "" on all channels. https://dxr.mozilla.org/mozilla-central/rev/d8762cb967423618ff0a488f14745f60964e5c49/modules/libpref/init/all.js#3012

r=me with that addition

Please wait to land this until the week 2 flash list items are in production: so maybe land Monday for Tuesday's nightly?

Comment 12

[:Felipe Gomes (needinfo for replies!)]

(In reply to Benjamin Smedberg [:bsmedberg] from comment #11)
> Comment on attachment 8866060 [details] [diff] [review]
> Make Flash CTP for Nightly, and favor html5 video content
> 
> Please also reset plugins.navigator.hidden_ctp_plugin to "" on all channels.
> https://dxr.mozilla.org/mozilla-central/rev/
> d8762cb967423618ff0a488f14745f60964e5c49/modules/libpref/init/all.js#3012

ah, good catch. FWIW the study/experiment did this, I just forgot about it in this patch.

> 
> r=me with that addition
> 
> Please wait to land this until the week 2 flash list items are in
> production: so maybe land Monday for Tuesday's nightly?


Sounds good. I'll try to get a patch to prefer fallback in the SWFObject case too, and hopefully land that before or together with this.

Comment 13

[:Felipe Gomes (needinfo for replies!)]

Attachment: Bug 1317856 - Ensure that flashblock tests are not affected by nosrc fallback rule.

With the activation of Ask-to-Activate mode by default, we'll also activate the fallback rule that favors fallback content when the object has not provided a src, so we need to prepare this test for that

Review commit: https://reviewboard.mozilla.org/r/139838/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/139838/

Comment 14

[Robin Steuber (they/them) [:bytesized]]

Comment on attachment 8868255 [details]
Bug 1317856 - Ensure that flashblock tests are not affected by nosrc fallback rule.

https://reviewboard.mozilla.org/r/139838/#review143190

::: toolkit/components/url-classifier/tests/browser/flash_block_frame.html:10
(Diff revision 1)
>  </head>
>  <body>
>    <h1>Test page</h1>
> -  <object id="testObject" width="100" height="100" type="application/x-shockwave-flash-test"></object>
> +  <object id="testObject" width="100" height="100"
> +  		  type="application/x-shockwave-flash-test"
> +  		  data="simple_blank.swf"></object>

nit: tabs should be spaces

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ddc27dd93ec0
Ensure that flashblock tests are not affected by nosrc fallback rule. r=bytesized
https://hg.mozilla.org/integration/mozilla-inbound/rev/12a7b0378709
Make the Flash plugin Click-to-Activate by default on Nightly. r=bsmedberg

Comment 16

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ddc27dd93ec0
https://hg.mozilla.org/mozilla-central/rev/12a7b0378709

Comment 17

[Chris Mills [:cmills]]

I've documented this, piggy backing it on the Flash http/https-only update as it seemed to fit well:

https://developer.mozilla.org/en-US/docs/Plugins
https://developer.mozilla.org/en-US/Firefox/Releases/55

Comment 18

[Sebastian Zartner [:sebo]]

Release Note Request (optional, but appreciated)
[Why is this notable]: Affects all Firefox users directly
[Affects Firefox for Android]: I guess so, maybe someone could verify that.
[Suggested wording]: Made Flash generally click-to-play and only allowed it on http:// and https:// URL schemes.
[Links (documentation, blog post, etc)]: see comment 17

Comment 19

[Julien Cristau [:jcristau]]

Added to 55beta release notes.

Comment 20

[Kacper Michajłow [:kasper93]]

This significantly changed behavior from "hidden" to "fallback" mode in nightly. I kind of prefer hide behavior, I've already restored `plugins.navigator.hidden_ctp_plugin;Shockwave Flash` in my config.

Do you plan to support case like speedtest.net? Where they detect if flash is supported with JS and redirect to beta page. Before changes in this commit flash was hidden so such code redirected to no-flash page. And overall it was better in preferring fallback content, now it is sort of preferring non-flash.

if (swfobject.hasFlashPlayerVersion("10.0.0")) {
  // User has flash
  swfobject.embedSWF("http://c.speedtest.net/flash/speedtest.swf?v=352081", "flashcontent", "728", "450", "10.0.0", "flash/expressInstall.swf", flashvars, params, attributes);
  //swfmacmousewheel.registerObject(attributes.id);
} else {
  if ('true' === 'true' && 'false' === 'false') {
    window.location="//beta.speedtest.net" + window.location.search;
  }
  // don't redirect again
  else if ( window.location.search.indexOf("noflash=1") == -1) {
    // User does not have flash
    window.location="/?noflash=1";
  }
}

Comment 21

[Kacper Michajłow [:kasper93]]

Also, please remove `plugins.navigator_hide_disabled_flash` from modules/libpref/init/all.js it is not used anymore. And it fooled me for a second that it is not working.

Comment 22

[Chris Peterson [:cpeterson]]

(In reply to Kacper Michajłow [:kasper93] from comment #21)
> Also, please remove `plugins.navigator_hide_disabled_flash` from
> modules/libpref/init/all.js it is not used anymore. And it fooled me for a
> second that it is not working.

Good catch. No code reads the plugins.navigator_hide_disabled_flash pref so we should remove it:

https://searchfox.org/mozilla-central/search?q=navigator_hide_disabled_flash

Comment 23

[Benjamin Smedberg]

Comment 21-22 are bug 1367226. Patches gladly accepted.

Regarding comment 20: yes this has been a tough tradeoff to make. At this point in time, we've decided to ship the "safer" version where Flash is still present in navigator.mimeTypes/navigator.plugins. This is provably better for the long tail of sites that may still require Flash, even though it's not great for sites that have a non-Flash fallback. That is a decision we will continue to revisit over the next year.

Comment 24

[Srinath Mohan]

Hello,
I have a question. I am from Zynga & we develop flash based games. I have one question - are we doing any domain blocking i.e. are we whitelisting any specific websites like facebook.com or google.com etc. for users not to go through "Click to activate" flow?

Comment 25

[Srinath Mohan]

I have another question -
from Firefox 55 onwards, how to detect flash is enabled or not? What is the JS code for that?

Comment 26

[Robin Steuber (they/them) [:bytesized]]

There is domain-based blacklisting and whitelisting. For information on how this works, refer to:
    http://gecko.readthedocs.io/en/latest/toolkit/components/url-classifier/url-classifier/flash-block-lists.html

You can also see what domains are currently on the lists here:
    https://github.com/mozilla-services/shavar-plugin-blocklist

Flash capabilities continue to be detectable via JS as usual:
    https://developer.mozilla.org/en-US/docs/Web/API/NavigatorPlugins/plugins

Documents from blacklisted domains, however, will find that "Shockwave Flash" is not present in |navigator.plugins|. If the document receives a Click to Activate classification, "Shockwave Flash" will be present in |navigator.plugins| but of course the user will have to choose to activate Flash before the objects will actually be loaded.

Comment 27

[Srinath Mohan]

Hello, I have another question - 
There is a verbatim mentioned in this documentation - https://developer.mozilla.org/en-US/Firefox/Releases/55

"
Flash content is now "click-to-activate" (bug 1317856). This was immediately put into effect for all users of Nightly, and 50% of beta users. For Firefox 55 release version, the plan is to activate this for 5% of users 2 weeks after release, 25% of users 4 weeks after release, and 100% of users 6 weeks after release (bug 1365714).
"

Can someone please provide the dates for each ramp milestone?

For our business, we are not seeing any upside on people who are affected? Did mozilla already up-ramp to 25% as of today?


Regards,
Srinath Mohan

Comment 28

[:Felipe Gomes (needinfo for replies!)]

Hello Srinath,

The plan is written slightly wrong on that page. It was:
- 5% out of door
- ramp up to 25% after two weeks
- ramp up to 100% after four weeks


We're now past two weeks but we've delayed the plan a bit. The rollout of 55 has been slower than usual (due to a few dot releases, 55.0.1 0.2 0.3), so we're waiting for more data to come up until we do the ramping.

We don't have exact dates, it's a decision to be taken on a weekly basis, but you can follow along any news on these bugs: bug 1390703 and bug 1390705.  I should mention there was some suggestion about bumping directly to 100%, but that is not certain yet (and I think it is unlikely).

Comment 29

[Srinath Mohan]

Hello Felipe,
Thanks for your confirmation. I will follow up on the bug #s provided for further information. In case if you have made any decision changes, please feel free to update this ticket so that we can have a close watch.

-Srinath

Comment 30

[Srinath Mohan]

Hello felipe,
As per the ticket https://bugzilla.mozilla.org/show_bug.cgi?id=1390703 it mentions v55 is 100% ramped and v56 is ramped to 25%. Please let me know whether the understanding is right and if so, when are you going with 100% for v56.


regards,
Srinath Mohan
Engineering Manager, Zynga Inc.