So Firefox just straight up blocked Flash yesterday. Not "click to allow," not a nagging popup. Mozilla flipped the switch and now if a site tries to load a Flash object it just doesn't run, full stop, until Adobe patches whatever hole is currently on fire. Mark Schmidt from the Firefox support team put it out there pretty bluntly: too many unpatched exploits floating around, so the plugin gets blocklisted until Adobe catches up. I actually laughed out loud when I saw it because I've been complaining about Flash on this blog since, what, 2012? And now a browser vendor is just done with it too.
The reason this is happening right now and not some random Tuesday is the Hacking Team breach from last week. If you missed it: Hacking Team is (was?) an Italian company that builds surveillance software and sells it to governments, not exactly a secret, they've been written up for years for selling to regimes with, let's say, spotty human rights records. Someone broke into their network on July 5th and dumped something like 400 gigs of internal emails, contracts, and source code onto the internet, including their own hijacked Twitter account renamed "Hacked Team," which is the kind of petty detail I love in these stories.
Buried in that dump were multiple zero-day exploits for Flash Player. Not theoretical bugs, working exploit code, the kind that gets weaponized within days because now every script kiddie with a Github account has the recipe. Adobe's been pushing out emergency patches basically back to back since, I lost count somewhere around the third one this month. And that's the part that pushed Firefox over the edge, plus Facebook's security guy Alex Stamos has been publicly saying for days now that Adobe just needs to announce an actual end-of-life date for Flash and let browsers kill it off on a schedule instead of this whack-a-mole every few weeks.
Honestly, yes. Please. I would like that very much.
I know I sound like every other person with a tech blog in 2015 ranting about Flash, and fine, guilty, but I have a specific complaint that isn't just "it crashes a lot" (though it does, my Chrome tab crasher is like 90% Flash-related at this point). My actual complaint is that Flash is the reason I still can't reliably watch video on my Nexus 7 without either the page hanging for ten seconds or the fan on my old work laptop spinning up like it's trying to take off. There is no reason in 2015 that watching a 90 second video clip should make a laptop sound like a hair dryer. HTML5 video has been a real, working, good option for years now and there are still sites (looking at you, a certain ad network I won't name because I don't need the legal letter) that insist on Flash banners because the analytics are apparently better or something. I don't buy it.
There's also just something satisfying about watching an old piece of internet infrastructure get pushed out the door by its own security failures rather than by some big redesign announcement. Nobody planned this rollout. Nobody had a keynote. It's just: too many holes, block it, deal with the fallout. Chrome already does click-to-play for a lot of Flash content by default since a while back, and I'd bet good money Safari and everyone else follows the same road within a year or two once the embarrassment compounds enough.
If you're running an old site with Flash navigation menus (you know who you are, and there were a lot of you circa 2008), now is genuinely the moment to deal with it, not because it's trendy but because your visitors on Firefox literally cannot see it anymore starting yesterday. I spent about forty minutes this afternoon going through my own old project folders checking for embedded SWF files I'd forgotten about, found exactly one, on a page from early 2012 that I'm honestly a little embarrassed still exists. It's getting an HTML5 replacement this weekend, no more excuses.
Anyway. Adobe's response so far has mostly been more patches and no announced death date, which feels like the wrong call given the last two weeks, but I don't run the company so what do I know.