1475890 - Check for updates for ADD-ONS does not find newest Flash update

Status: RESOLVED INVALID

(Toolkit :: Add-ons Manager, defect)

Description

[Dan Pernokis]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180704003137

Steps to reproduce:

Adobe pop-up said that new FLASH update was available.  In FF, I went to ADD-ONS manager (Tools, Add-ons;  Plugins) to check current version and to check for available updates for anything else.


Actual results:

Update scan reported "no available updates".  It did not report currently pending Adobe FLASH update, nor has it done so several times since the new-style update checking was implemented.


Expected results:

Scans for updates to add-ons and extensions should show the latest updates available.  Because it didn't find the FLASH update, what else might I be missing???

Perhaps because this FLASH update is too new -- released just today.  But there have been times when the update is for security concerns and should be applied ASAP, but has been missed by the FF scan.  (I happened to catch these by polling Adobe FLASH update site directly.)

Comment 1

[Gingerbread Man]

Unless something's changed since bug 602795 and I can't find any trace of it, the Add-ons Manager has never checked for plug-in updates. Also, the Mozilla Plug-in Check site was retired. Firefox does have a blocklist that updates periodically, but only grossly outdated Flash Player versions end up on it: looks like the latest block is from October 19, 2017.

Comment 2

[Dan Pernokis]

On the Add-ons Manager page, there is a tools gear button at the top toward the right.  The first item in this drop-down is "check for updates".  What does this do -- and why is it even there -- if it doesn't check for plugin updates??  Similar functionality exists on the Extensions Manager page.

I contributed to resolving several issues with the old Mozilla Plug-in Checker and was dismayed to see it replaced by a mechanism that (i) would not warn users when things were out-of-date, and (ii) would not allow users to see if (and how far) out-of-date things were.  When I commented on this, I was assured that we don't have to worry, Firefox would update all its plugins automatically.  I would have little or no reservations if this was truly the case.

Subsequent comments that "plugins are dead" are fine if FF has a viable replacement built into its native code.  But AFAIK, there are not yet any valid replacements for FLASH, and since FF still continues to use it, FF must make the effort to keep it up-to-date.  At the very least, FF updaters should warn if something is out-of-date, especially when something is known to be vulnerable or compromised.

Generally, if an update function is provided in FF, it should work correctly and not mislead users by saying "no updates available" when in fact there are.  And specifically, if FLASH is being used by FF, it must continue to be updated until such time as a true inboard FF functional replacement is developed.

Comment 3

[Gingerbread Man]

(In reply to Dan Pernokis from comment #2)
> On the Add-ons Manager page, there is a tools gear button at the top toward
> the right.  The first item in this drop-down is "check for updates".  What
> does this do -- and why is it even there -- if it doesn't check for plugin
> updates??  Similar functionality exists on the Extensions Manager page.

I'm not sure what you mean by "the Extensions Manager page", in that you're implying it's somehow separate from the Add-ons Manager. There's only one Add-ons Manager. Whatever category you select on the left, the cog wheel menu remains the same. It checks for updates to extensions and themes, and I believe, dictionaries and language packs as well. I'm not sure if the bundled WebRTC and content decryption plug-ins are also checked, or if they only perform automatic background checks.

> FF must make the effort to keep it up-to-date.

I'd be extremely surprised if anyone decided to put time and effort into a Flash Player update check mechanism now that it's essentially obsolete and has about 2 years left until its end of life.

> a true inboard FF functional replacement is developed.

If you're referring to a built-in way to render Flash content, there won't be one. Efforts to include such a player (dubbed Shumway) were abandoned in early 2016. The plan was for it to be a separate extension instead. However, development stalled on March 29, 2016 leaving the latest version as compatible up to Firefox 46.

Comment 4

[Dan Pernokis]

Thanks for your reply and explanation.

In the ADD-ONs Manager (the pull-down menu under TOOLS), I presumed the various tabs were individual managers.  It's a logical presumption since the items functionally do different things.  So it's also logical to think that the respective cog wheel applies to each -- and that the cog on the Plug-Ins Tab applies to Plug-Ins specifically.  One more step -- "check for updates" thus would mean check for out-of-date plug-ins.  You say this is wrong, and I'll accept that.  But please fix the optics that "check for updates" //appears// to be checking for new plugs-ins and falsely reassuring us there are none.

I apologize for not being privy to other peoples plans.  I only know what I've been told in this regard, the latest of which was that FLASH was being replaced.  So that's wrong too, and obviously out-of-date.  But I do understand and now fully agree not to pursue further FLASH-type new development, given its end-of-life status.

So, except for the perception of plugins being OK when they're not actually being checked, we're agreed that *THIS* bug as reported is dead.  I'll accept your ruling as "Invalid" and resolve it that way.

Comment 5

[Gingerbread Man]

(In reply to Dan Pernokis from comment #4)
> But please fix the optics that "check for updates" //appears//
> to be checking for new plugs-ins and falsely reassuring us there
> are none.

I couldn't find any reports about this, so feel free to file one.

> I apologize for not being privy to other peoples plans.

You can read more about Flash Player EOL in the announcements from Adobe and Mozilla. The gist of it is that in 2019, Flash Player will be disabled by default. Then in 2020, it will only be supported in the ESR version intended for organizations.
https://theblog.adobe.com/adobe-flash-update/
https://blog.mozilla.org/futurereleases/2017/07/25/firefox-roadmap-flash-end-life/

As far as I can find, an announcement about Shumway being abandoned was never made.
https://www.ghacks.net/2016/02/23/flash-replacement-shumway-is-as-good-as-dead/
https://en.wikipedia.org/wiki/Shumway_(software)

> we're agreed that *THIS* bug as reported is dead.  I'll
> accept your ruling as "Invalid" and resolve it that way.

That's my opinion, but I had intentionally left this open rather than duping to bug 602795 so a developer would make a decision instead.

Comment 6

[Dan Pernokis]

(In reply to Gingerbread Man from comment #5)

>> I couldn't find any reports about this, so feel free to file one.
Actually, that's what *THIS* bug originally did.  My bug report states that I went to ADD-ONs Manager under plugins to check the current version of FLASH, knowing that an Adobe Flash update was released and pending.  I selected "Check for Updates" (which I expected to do exactly that) but it reported no updates were available (as it has said in the past too).  Then your comment #1 says it never has checked, which is directly opposed to what is offered.

Also, Bug 573699 comment 3 sums it up nicely - AOM offers to check but doesn't.  (And 573699 is actually reporting something much more serious -- that an outdated and possibly dangerous plugin was being used without warning by the current web page.)

I know at one time the process did check for plugins -- probably the old Mozilla Plug-in Check -- and we as users have been given no reason to suspect it no longer checks because "Checking for Updates" is still an option on the gear cog menu.  Since ADD-ON Manager can't or won't check its one-and-only remaining non-mandated  plug-in (FLASH), then the fix is to remove checking from the cog menu specifically on the Plugins tab.  (Or even simpler: just display a general message on the plugins page to say plugins are not being checked -- at least we will know.)


Meanwhile, thanks for the links -- interesting.  I knew FLASH was dying or being pushed out because of security concerns and repeated vulnerabilities, but that's the first time (other than above) I'm seeing that its FF replacement is defunct too.


>> I couldn't find any reports about this, so feel free to file one.
You can re-activate *THIS* bug if you like -- probably easier than re-filing the same report and going around the circle again.  (I think my report is more specifically targeted than Bug 602795 in any case.)  Thanks again.

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to Dan Pernokis from comment #6)
> ...
> You can re-activate *THIS* bug if you like -- probably easier than re-filing
> the same report and going around the circle again.  (I think my report is
> more specifically targeted than Bug 602795 in any case.)  Thanks again.

Perhaps your bug summary should be something more like, remove gear from plugins page, since nothing in the gear is relevant to plugins.