# What happened with Flash? **URL:** \ **Category:** Factual Questions\ **Created:** [October 2, 2019, 3:40pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155 "2019-10-02T15:40:50Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![aldiboronti](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@aldiboronti](https://boards.straightdope.com/u/aldiboronti)\ **Post date:** [October 2, 2019, 3:40pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/1 "2019-10-02T15:40:50Z")
I mean here we have a program universally used across most browsers, with regular updates, and owned by a big company. Then suddenly it’s a security risk vulnerable to all sorts of exploits and all the browsers now shun it or warn you to use it at your own risk. But isn’t that what patches are for? Why didn’t Adobe plug all the holes and keep Flash secure? It must have been a huge earner for them. What does HTML5 have that Flash hasn’t? ---
**Author:** ![Omar\_Little](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/omar_little/32/269_2.png) [@Omar\_Little](https://boards.straightdope.com/u/Omar_Little)\ **Post date:** [October 2, 2019, 3:44pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/2 "2019-10-02T15:44:42Z")
When the company owns it says that they are discontinuing it, that pretty much says it. I’m sure there are consumers that wish that Zima was still being produced as well. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [October 2, 2019, 4:25pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/3 "2019-10-02T16:25:15Z")
The general impression of people in the industry was that Adobe would need to rewrite Flash from the ground up to fix it’s problems. At the same time HTML+javascript were increasing capabilities (or at least the roadmap was somewhat clear). My guess is that Adobe saw the writing on the wall and figured that even if a rewrite was successful, the need for Flash was diminishing in favor of capabilities via HTML+javascript. ---
**Author:** ![friedo](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@friedo](https://boards.straightdope.com/u/friedo)\ **Post date:** [October 2, 2019, 4:32pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/4 "2019-10-02T16:32:46Z")
> [@aldiboronti](#): > > What does HTML5 have that Flash hasn’t? An open standard, for one thing. That plus the near-impossibility of actually fixing the 20-year-old ball of crap that Flash was without a line-one rewrite made it clear that it simply wouldn’t be worth it to continue supporting Flash. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [October 2, 2019, 4:47pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/5 "2019-10-02T16:47:36Z")
> [@aldiboronti](#): > > I mean here we have a program universally used across most browsers, with regular updates, and owned by a big company. “Mr. Watson seems to have answered his own question.” Seymour Cray ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [October 2, 2019, 5:36pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/6 "2019-10-02T17:36:09Z")
The decision may also have been influenced by the fact that Steve Jobs was adamant that [Apple would never support Flash](https://www.apple.com/hotnews/thoughts-on-flash/), on Macs, iPhones or any other product. That drove a lot of web sites to use alternatives to Flash. (I don’t think Apple’s stance changed after Jobs died but I’m not positive about that.) ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [October 2, 2019, 5:53pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/7 "2019-10-02T17:53:11Z")
> [@aldiboronti](#): > > I mean here we have a program universally used across most browsers, with regular updates, and owned by a big company. > > [snip] > > What does HTML5 have that Flash hasn’t? HTML5 has most of the things you said Flash has. It isn’t owned by a single big company, which is an advantage, but otherwise it’s a completely equivalent replacement at this point. Contrariwise, Flash hasn’t been widely supported for years now, hasn’t been universally used for longer, and nobody cares about the updates because of the previous two facts. So what happened to Flash? Browsers can do everything Flash did without needing an external plugin. It’s a much cleaner solution. ---
**Author:** ![jjakucyk](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@jjakucyk](https://boards.straightdope.com/u/jjakucyk)\ **Post date:** [October 2, 2019, 6:34pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/8 "2019-10-02T18:34:04Z")
> [@markn\_1](#): > > The decision may also have been influenced by the fact that Steve Jobs was adamant that [Apple would never support Flash](https://www.apple.com/hotnews/thoughts-on-flash/), on Macs, iPhones or any other product. That drove a lot of web sites to use alternatives to Flash. (I don’t think Apple’s stance changed after Jobs died but I’m not positive about that.) Flash has always been available on Macs, but iPhones were a non-starter because Flash is such a resource hog and would’ve burned through the batteries in no time. I suspect it may also require too many permissions to be properly sandboxed for iOS. That would be why it’s such a security risk to begin with. If it can’t function without getting its hooks deep into the system, then it’s also an easy vector for other things to sneak in too. ---
**Author:** ![Mangosteen](https://avatars.discourse-cdn.com/v4/letter/m/6a8cbe/32.png) [@Mangosteen](https://boards.straightdope.com/u/Mangosteen)\ **Post date:** [October 2, 2019, 7:25pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/9 "2019-10-02T19:25:08Z")
So what happens when Flash is gone? ---
**Author:** ![friedo](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@friedo](https://boards.straightdope.com/u/friedo)\ **Post date:** [October 2, 2019, 7:27pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/10 "2019-10-02T19:27:30Z")
> [@Mangosteen](#): > > So what happens when Flash is gone? Mass hysteria. Human sacrifice. Dogs and cats living together. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [October 2, 2019, 8:18pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/11 "2019-10-02T20:18:04Z")
> [@Mangosteen](#): > > So what happens when Flash is gone? Some bits of the internet disappear or stop working - not many important bits, but some of the flash animations and games that haven’t been redone in another format, stop being available. I know of a major UK retailer that uses Flash not only for their public facing website, but also for the ecommerce portal that they make all of their suppliers use. I hope they’re busy developing the replacement for that. (I have no idea why they would choose to try to develop an ecommerce portal in flash - I’m guessing they just asked the wrong people to do it - maybe the people who developed the public website. When all you have is a hammer, everything looks like a nail. ---
**Author:** ![kenobi\_65](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kenobi_65/32/13178_2.png) [@kenobi\_65](https://boards.straightdope.com/u/kenobi_65)\ **Post date:** [October 2, 2019, 8:33pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/12 "2019-10-02T20:33:56Z")
> [@Mangosteen](#): > > So what happens when Flash is gone? Ming the Merciless finally conquers Earth! ---
**Author:** ![KneadToKnow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kneadtoknow/32/3999_2.png) [@KneadToKnow](https://boards.straightdope.com/u/KneadToKnow)\ **Post date:** [October 2, 2019, 9:42pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/13 "2019-10-02T21:42:43Z")
> [@Mangosteen](#): > > So what happens when Flash is gone? > [@kenobi\_65](#): > > Ming the Merciless finally conquers Earth! Alternately, [Wally West finally gets to wear the red suit](https://en.wikipedia.org/wiki/Wally_West#The_Flash). ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 3, 2019, 12:08am UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/14 "2019-10-03T00:08:08Z")
The problem was not really one that was patchable. Flash is a complete programming environment, and it is a fundamental theorem of computer science that in any complete programming environment, it’s possible to write programs for which it can’t be predicted what they will do. So any website creator could embed a Flash program that would do whatever they wanted, and it’s not, in principle, possible to filter out all of the bad programs. There are only two ways to fix this. The first is to make Flash a less-than-complete programming environment. But this would make it useless for the vast majority of what it’s used for (indeed, HTML5 and the other replacements are also complete programming environments). The second is to very strictly sandbox Flash: That is, put it into a virtual environment where it can do whatever it wants in that environment (like a kid playing in a sandbox), but where it can’t do anything at all outside of that box. And the only real way to make such a secure sandbox is to design it to be a secure sandbox right from the ground up. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [October 3, 2019, 12:50am UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/15 "2019-10-03T00:50:14Z")
> [@Chronos](#): > > So any website creator could embed a Flash program that would do whatever they wanted, and it’s not, in principle, possible to filter out all of the bad programs. I don’t know that it’s not _theoretically_ possible. Example: refuse to run arbitrary code; only run proof-carrying code with a valid certificate conforming to a specified security policy. That has nothing to do with ActionScript specifically, and may be beyond the scope of Flash. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [October 3, 2019, 2:37am UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/16 "2019-10-03T02:37:01Z")
> [@Chronos](#): > > The problem was not really one that was patchable. Flash is a complete programming environment, and it is a fundamental theorem of computer science that in any complete programming environment, it’s possible to write programs for which it can’t be predicted what they will do. So any website creator could embed a Flash program that would do whatever they wanted, and it’s not, in principle, possible to filter out all of the bad programs. > > There are only two ways to fix this. The first is to make Flash a less-than-complete programming environment. But this would make it useless for the vast majority of what it’s used for (indeed, HTML5 and the other replacements are also complete programming environments). The second is to very strictly sandbox Flash: That is, put it into a virtual environment where it can do whatever it wants in that environment (like a kid playing in a sandbox), but where it can’t do anything at all outside of that box. And the only real way to make such a secure sandbox is to design it to be a secure sandbox right from the ground up. The fact ActionScript was a Turing-equivalent programming language wasn’t the problem (as you say, HTML5 includes JavaScript which is almost exactly the same), the problem was that Adobe’s implementation of Flash was crap and they were not competent to fix it for a long time: [ZDNet article on the subject from 2010.](https://www.zdnet.com/article/sorry-adobe-flash-is-the-new-vista/) But that was only one aspect: Even as Flash slowly improved, browsers did, too. And putting this stuff in the browser just makes sense. The integration is smoother, because it isn’t two programs trying to talk to each other but one program doing it all, and it consumes fewer resources. The security story gets better when you don’t have a third party involved, and the number of spaces bugs can hide out goes down. Browser makers had every reason to do what they did, and Flash was squeezed out entirely. Is it _possible_ to have perfect plug-ins which don’t cause problems? Yes. You need to throw enough resources at it to make it happen, which basically amounts to time and good team organization, but it’s possible. Flash was a long way from perfect. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [October 3, 2019, 12:10pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/17 "2019-10-03T12:10:59Z")
Note: a _lot_ of things are Turing complete but that doesn’t make them security risks if certain things are not accessible, like the HD on the browsing end. Javascript is Turning complete. No one thinks that’s intrinsically insecure and has to go away. You could strip out a ton of stuff out of Javascript and still have it be Turing complete. It takes surprisingly little to be Turing complete: integer variables (actually only need 3, at most), assignments, loops, a test. So Flash being Turing complete is irrelevant here. It was a crap program with an unforgivable number of errors in it. (There’s just one site I use regularly that still uses Flash. A crossword program. But I only use it to print out the puzzles and none of the “real” Flash features. I hope it doesn’t go away rather than upgrade to HTML5.) ---
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [October 3, 2019, 3:08pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/18 "2019-10-03T15:08:30Z")
> [@ftg](#): > > Note: a _lot_ of things are Turing complete but that doesn’t make them security risks if certain things are not accessible, like the HD on the browsing end. Pedantic Nit: Nothing is Turing complete if it is running on a machine with only finite memory. 😛 As for Flash, it just wasn’t made with security in mind, and it is very hard to bolt security on as an afterthought. Still it wouldn’t have been impossible to do, but the great improvements in HTML/CSS and JavaScript engines making it possible to do most of the same things without Flash, (and with better integration with the browser) made putting in the effort to make Flash secure not worth it. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 3, 2019, 4:04pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/19 "2019-10-03T16:04:26Z")
Right, Javascript isn’t dangerous, because it was built from the ground up to be properly sandboxed. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [October 3, 2019, 7:30pm UTC](https://boards.straightdope.com/t/what-happened-with-flash/841155/20 "2019-10-03T19:30:24Z")
> [@Chronos](#): > > Right, Javascript isn’t dangerous, because it was built from the ground up to be properly sandboxed. Javascript programs are not sandboxed. This is a misuse of the [term](https://en.wikipedia.org/wiki/Sandbox_(computer_security)). It is limited in certain ways. But it can do all sorts of things that a sandboxed app would not be able to do. This does lead to security issues with improperly written scripts. E.g., cross-site scripting (XSS) is a big danger. A programmer for a sandboxed environment could never screw something up and have to worry about something like XSS. [Next page](https://boards.straightdope.com/t/what-happened-with-flash/841155.md?page=2)