Flash Security Issues in an HTML5 World

This week, several critical security issues in Adobe’s Flash Player plugin triggered a number of responses from around the web, including Firefox briefly disabling support for Flash, Facebook’s head of security calling for an end-of-life timeline, and Wired publishing an article simply titled “Flash. Must. Die.”

Now is a good time to make sure either:

• Flash is disabled / not installed or
• you have the most recent update.

Five years ago, Steve Jobs famously refused to allow Flash on the iPhone, beginning the plugin’s slow march towards deprecation. In that time, a renaissance of browser features and open standards, under the banner of HTML5, has enabled web developers and innovative designers to create experiences that were only previously possible with Flash, leaving behind security issues, delayed updates, short battery life, and proprietary development.

Video is one of the main reasons Flash is still around. Many of the first-generation video platforms still expect Flash for playback, falling back to a limited HTML5 experience at best (or asking you to install Flash at the worst -- the image below is taken from a competitor’s HTML5 example). Legacy infrastructure (and service departments) are slow to adopt new capabilities. Even YouTube was Flash-first until earlier this year, and many video ads still require Flash.

Two years ago, we built our HTML5 player framework. We designed it to support modern standards, allowing developers and designers to create interactive experiences as innovative and powerful as the modern web. Our players only fallback to a Flash “playback frame” in very old browsers, and even then, the interactive experience stays the same. In the years since we launched, we have expanded our framework capabilities and continued to drive features to support emerging HTML5 standards while allowing deeper customization than any other player provider, all with simple HTML, CSS, and Javascript.

The web still has a bit of catching up to do. As most of you know, adaptive playback and content protection isn’t supported across all browsers yet. Even Firefox, one of the biggest proponents of the open web, has restricted access of crucial streaming and content protection standards from everyone except YouTube for months. (And yes, this preferential treatment of one vendor is the same sort of competitive disadvantage that worries network neutrality advocates.)

However, these are speed bumps towards an inevitable destination: a web where open standards combine to enable powerful, interactive, responsive, and secure video experiences.

Today, make sure your company is safe from security issues by upgrading or removing Flash. Tomorrow, when evaluating your options for a video platform, make sure you are choosing a partner that embraces the direction the web is heading, not the way it used to be.