Re: What's the long term plan with Click-to-play and Flash?

On 6/1/14, 12:22 AM, [email protected] wrote:
> If there currently isn't one, allow me to outline a possibility (the numbers were picked without any hard data, likely tweaking is needed) :
What is the problem you are trying to solve, and why do you think this 
proposal will solve it? It seems that your proximate goal is to get 
advertisers off of Flash, and that you ultimately want to do this to 
improve user privacy by disallow Flash cookies.

 From user research, we know that some users expect advertisements in 
the page, and when we tried blocking Flash, these users were confused 
about why the page didn't look right and were unhappy that we broke the web.
> a. Advertisers are the biggest current reason for more than 1 flash plugin on a page.

This is undoubtedly true.

> b. Attack sites are the other big reason to have many plugins per page.
I very much doubt this. We do know that one of the leading vectors for 
non-targeted malware attacks is plugins on advertising networks. I doubt 
that there will be a high plugin *count* in those attack scenarios, though.

> c. There are very few websites that currently depend on showing 6 flash instances at once that are not ads.

This sounds like a reasonable guess, but we definitely need to collect 
some data.

I sympathize with the desire to get advertisers off of Flash, but I 
don't think that this plan strikes the right balance. Because developers 
often don't control whether advertisers use Flash, any problems this 
causes will be inherently intermittent and confusing for both developers 
and users.

Our current strategy is to continue development of Shumway to the point 
where it displays most web content reliably and performs acceptably, and 
then try to switch users to Shumway with a fallback to "real" Flash if 
we detect incompatible content. I believe that will be the best way to 
solve the privacy issues with Flash without causing pain to our users.

--BDS