Chris Peterson [:cpeterson] Reporter
	Description • 8 years ago

In 2017, Firefox will require click-to-activate approval from users before a website activates the Flash plugin for any content:

https://blog.mozilla.org/futurereleases/2016/07/20/reducing-adobe-flash-usage-in-firefox/

	Chris Peterson [:cpeterson] Reporter
	Comment 1 • 8 years ago

mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.

	Kohei Yoshino [:kohei]
	Comment 2 • 8 years ago

Posted the site compatibility doc: https://www.fxsitecompat.com/en-CA/docs/2016/flash-content-will-be-click-to-activate-in-2017/

	David Bruant
	Comment 3 • 7 years ago

(In reply to Chris Peterson [:cpeterson] from comment #1)
> mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly
> (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.

Why so? Making Flash click-to-play and shipping a bunch of features doesn't seem related.

	Chris Peterson [:cpeterson] Reporter
	Comment 4 • 7 years ago

(In reply to David Bruant from comment #3)
> (In reply to Chris Peterson [:cpeterson] from comment #1)
> > mbest recommends that we ship SharedArrayBuffer (bug 1225406), WebAssembly
> > (bug 1188259), and WebGL2 (bug 889977) before making Flash click-to-play.
> 
> Why so? Making Flash click-to-play and shipping a bunch of features doesn't
> seem related.

Shipping those other features first means that Flash game developers can launch their WebAssembly/WebGL2 game ports before we make Flash click-to-play. Game developers don't want their users to be interrupted by click-to-play problems. Shipping them first is a nice-to-have, not a strict release blocker.

	:Felipe Gomes (needinfo for replies!) Assignee
	Comment 5 • 7 years ago

According to the plan, we want to land this now so that users can start downloading these lists in advance for switching Flash as CTA, to give them a better experience.

I'll note that even with Activate-By-Default, this setting will start applying the 3rd-party blocklist for flash.

I'm wrapping this around NIGHTLY_BUILD in order to make it a separate decision/bug to roll this out, and then it will be just a matter of removing the ifdef.

	Pulsebot
	Comment 6 • 7 years ago

Pushed by felipc@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ddf532ded6f2
Configure Nightly to download and use the flash 3rd party blocklist, in preparation for switching Flash as Click-to-Activate. r=bsmedberg

	Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)
	Comment 7 • 7 years ago

Backed out for various plugin related test failures, e.g. test_refresh_navigator_plugins.html:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9be2eb8c9061cdfc16d7d53e8f384afa5e1dcb8e

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=ddf532ded6f21595fe1b88b02cb964994d2d30e2&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=retry&filter-resultStatus=usercancel&filter-resultStatus=runnable

	:Felipe Gomes (needinfo for replies!) Assignee
	Comment 8 • 7 years ago

The test failures were due to the testing running in a system principal, where plugins will be blocked with this change. I had filed bug 1361433 to change it, but that is intentional, so I cherry-picked the test fixes from bug 1335475 and sent that to tryserver to see if everything will work:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b001dee46c942ccde9efd5a9ca0db5f18fbf561e

	:Felipe Gomes (needinfo for replies!) Assignee
	Comment 9 • 7 years ago

I spun off the pre-req of toggling plugins.flashBlock.enabled to a separate bug

	:Felipe Gomes (needinfo for replies!) Assignee
	Comment 10 • 7 years ago

(This has been through tryserver already and everything passed)

	Benjamin Smedberg
	Comment 11 • 7 years ago

Comment on attachment 8866060 [details] [diff] [review]
Make Flash CTP for Nightly, and favor html5 video content

Please also reset plugins.navigator.hidden_ctp_plugin to "" on all channels. https://dxr.mozilla.org/mozilla-central/rev/d8762cb967423618ff0a488f14745f60964e5c49/modules/libpref/init/all.js#3012

r=me with that addition

Please wait to land this until the week 2 flash list items are in production: so maybe land Monday for Tuesday's nightly?

	:Felipe Gomes (needinfo for replies!) Assignee
	Comment 12 • 7 years ago

(In reply to Benjamin Smedberg [:bsmedberg] from comment #11)
> Comment on attachment 8866060 [details] [diff] [review]
> Make Flash CTP for Nightly, and favor html5 video content
> 
> Please also reset plugins.navigator.hidden_ctp_plugin to "" on all channels.
> https://dxr.mozilla.org/mozilla-central/rev/
> d8762cb967423618ff0a488f14745f60964e5c49/modules/libpref/init/all.js#3012

ah, good catch. FWIW the study/experiment did this, I just forgot about it in this patch.

> 
> r=me with that addition
> 
> Please wait to land this until the week 2 flash list items are in
> production: so maybe land Monday for Tuesday's nightly?


Sounds good. I'll try to get a patch to prefer fallback in the SWFObject case too, and hopefully land that before or together with this.

	Robin Steuber (they/them) [:bytesized]
	Comment 14 • 7 years ago
mozreview-review

Comment on attachment 8868255 [details]
Bug 1317856 - Ensure that flashblock tests are not affected by nosrc fallback rule.

https://reviewboard.mozilla.org/r/139838/#review143190

::: toolkit/components/url-classifier/tests/browser/flash_block_frame.html:10
(Diff revision 1)
>  </head>
>  <body>
>    <h1>Test page</h1>
> -  <object id="testObject" width="100" height="100" type="application/x-shockwave-flash-test"></object>
> +  <object id="testObject" width="100" height="100"
> +  		  type="application/x-shockwave-flash-test"
> +  		  data="simple_blank.swf"></object>

nit: tabs should be spaces

	Pulsebot
	Comment 15 • 7 years ago

Pushed by felipc@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ddc27dd93ec0
Ensure that flashblock tests are not affected by nosrc fallback rule. r=bytesized
https://hg.mozilla.org/integration/mozilla-inbound/rev/12a7b0378709
Make the Flash plugin Click-to-Activate by default on Nightly. r=bsmedberg

	Carsten Book [:Tomcat]
	Comment 16 • 7 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/ddc27dd93ec0
https://hg.mozilla.org/mozilla-central/rev/12a7b0378709

	Chris Mills [:cmills]
	Comment 17 • 7 years ago

I've documented this, piggy backing it on the Flash http/https-only update as it seemed to fit well:

https://developer.mozilla.org/en-US/docs/Plugins
https://developer.mozilla.org/en-US/Firefox/Releases/55

	Sebastian Zartner [:sebo]
	Comment 18 • 7 years ago

Release Note Request (optional, but appreciated)
[Why is this notable]: Affects all Firefox users directly
[Affects Firefox for Android]: I guess so, maybe someone could verify that.
[Suggested wording]: Made Flash generally click-to-play and only allowed it on http:// and https:// URL schemes.
[Links (documentation, blog post, etc)]: see comment 17

	Julien Cristau [:jcristau]
	Comment 19 • 7 years ago

Added to 55beta release notes.

	Kacper Michajłow [:kasper93]
	Comment 20 • 7 years ago

This significantly changed behavior from "hidden" to "fallback" mode in nightly. I kind of prefer hide behavior, I've already restored `plugins.navigator.hidden_ctp_plugin;Shockwave Flash` in my config.

Do you plan to support case like speedtest.net? Where they detect if flash is supported with JS and redirect to beta page. Before changes in this commit flash was hidden so such code redirected to no-flash page. And overall it was better in preferring fallback content, now it is sort of preferring non-flash.

if (swfobject.hasFlashPlayerVersion("10.0.0")) {
  // User has flash
  swfobject.embedSWF("http://c.speedtest.net/flash/speedtest.swf?v=352081", "flashcontent", "728", "450", "10.0.0", "flash/expressInstall.swf", flashvars, params, attributes);
  //swfmacmousewheel.registerObject(attributes.id);
} else {
  if ('true' === 'true' && 'false' === 'false') {
    window.location="//beta.speedtest.net" + window.location.search;
  }
  // don't redirect again
  else if ( window.location.search.indexOf("noflash=1") == -1) {
    // User does not have flash
    window.location="/?noflash=1";
  }
}

	Kacper Michajłow [:kasper93]
	Comment 21 • 7 years ago

Also, please remove `plugins.navigator_hide_disabled_flash` from modules/libpref/init/all.js it is not used anymore. And it fooled me for a second that it is not working.

	Chris Peterson [:cpeterson] Reporter
	Comment 22 • 7 years ago

(In reply to Kacper Michajłow [:kasper93] from comment #21)
> Also, please remove `plugins.navigator_hide_disabled_flash` from
> modules/libpref/init/all.js it is not used anymore. And it fooled me for a
> second that it is not working.

Good catch. No code reads the plugins.navigator_hide_disabled_flash pref so we should remove it:

https://searchfox.org/mozilla-central/search?q=navigator_hide_disabled_flash

	Benjamin Smedberg
	Comment 23 • 7 years ago

Comment 21-22 are bug 1367226. Patches gladly accepted.

Regarding comment 20: yes this has been a tough tradeoff to make. At this point in time, we've decided to ship the "safer" version where Flash is still present in navigator.mimeTypes/navigator.plugins. This is provably better for the long tail of sites that may still require Flash, even though it's not great for sites that have a non-Flash fallback. That is a decision we will continue to revisit over the next year.

	Srinath Mohan
	Comment 24 • 7 years ago

Hello,
I have a question. I am from Zynga & we develop flash based games. I have one question - are we doing any domain blocking i.e. are we whitelisting any specific websites like facebook.com or google.com etc. for users not to go through "Click to activate" flow?

	Srinath Mohan
	Comment 25 • 7 years ago

I have another question -
from Firefox 55 onwards, how to detect flash is enabled or not? What is the JS code for that?

	Robin Steuber (they/them) [:bytesized]
	Comment 26 • 7 years ago

There is domain-based blacklisting and whitelisting. For information on how this works, refer to:
    http://gecko.readthedocs.io/en/latest/toolkit/components/url-classifier/url-classifier/flash-block-lists.html

You can also see what domains are currently on the lists here:
    https://github.com/mozilla-services/shavar-plugin-blocklist

Flash capabilities continue to be detectable via JS as usual:
    https://developer.mozilla.org/en-US/docs/Web/API/NavigatorPlugins/plugins

Documents from blacklisted domains, however, will find that "Shockwave Flash" is not present in |navigator.plugins|. If the document receives a Click to Activate classification, "Shockwave Flash" will be present in |navigator.plugins| but of course the user will have to choose to activate Flash before the objects will actually be loaded.

	Srinath Mohan
	Comment 27 • 7 years ago

Hello, I have another question - 
There is a verbatim mentioned in this documentation - https://developer.mozilla.org/en-US/Firefox/Releases/55

"
Flash content is now "click-to-activate" (bug 1317856). This was immediately put into effect for all users of Nightly, and 50% of beta users. For Firefox 55 release version, the plan is to activate this for 5% of users 2 weeks after release, 25% of users 4 weeks after release, and 100% of users 6 weeks after release (bug 1365714).
"

Can someone please provide the dates for each ramp milestone?

For our business, we are not seeing any upside on people who are affected? Did mozilla already up-ramp to 25% as of today?


Regards,
Srinath Mohan

	:Felipe Gomes (needinfo for replies!) Assignee
	Comment 28 • 7 years ago

Hello Srinath,

The plan is written slightly wrong on that page. It was:
- 5% out of door
- ramp up to 25% after two weeks
- ramp up to 100% after four weeks


We're now past two weeks but we've delayed the plan a bit. The rollout of 55 has been slower than usual (due to a few dot releases, 55.0.1 0.2 0.3), so we're waiting for more data to come up until we do the ramping.

We don't have exact dates, it's a decision to be taken on a weekly basis, but you can follow along any news on these bugs: bug 1390703 and bug 1390705.  I should mention there was some suggestion about bumping directly to 100%, but that is not certain yet (and I think it is unlikely).

	Srinath Mohan
	Comment 29 • 7 years ago

Hello Felipe,
Thanks for your confirmation. I will follow up on the bug #s provided for further information. In case if you have made any decision changes, please feel free to update this ticket so that we can have a close watch.

-Srinath

	Srinath Mohan
	Comment 30 • 7 years ago

Hello felipe,
As per the ticket https://bugzilla.mozilla.org/show_bug.cgi?id=1390703 it mentions v55 is 100% ramped and v56 is ramped to 25%. Please let me know whether the understanding is right and if so, when are you going with 100% for v56.


regards,
Srinath Mohan
Engineering Manager, Zynga Inc.