Package: firefox Version: 85.0-1 Severity: normal Dear Maintainer,
I hear that following the end of life of the Adobe Flash player at the end of 2020, Firefox, starting in version 85 released in January, now refuses to even load the Adobe Flash plugin at all, while explicitly and deliberately refraining from providing any configuration mechanism to control this behavior. This is problematic both in its consequences and as a behavior from a vendor. I find that Adobe was pretty responsible and diligent in their handling of the end of life of Flash. True, they did introduce a time bomb in their software, which is very much an offensive practice; but they announced their plans years in advance, coordinated with everyone, and more importantly, they provided and publicized several mechanisms to empower end users to work around this. For one, they provided an officially documented configuration mechanism to manage the end of life of the Flash player, both before and after the date it disabled itself. See their administration guide, chapter 4, "Administration": https://www.adobe.com/content/dam/acom/en/devnet/flashplayer/articles/flash_player_admin_guide/pdf/latest/flash_player_32_0_admin_guide.pdf#page=33 They also provided an official standalone Flash player application, which I hear, unlike the Flash plugin, was not affected by the time bomb: https://www.adobe.com/support/flashplayer/debug_downloads.html I haven't tried any standalone player, but using the documented configuration settings, I was able to restore Flash plugin functionality, after January 12, 2021 when it disabled itself, in several web browsers (including Firefox 84). Now keep in mind that this is coming from Adobe, a commercial company publishing closed-source, proprietary software. To be clear about this, starting on January 12, 2021, web browsers would still load the Flash plugin into the web page or tab, but the Flash plugin would display a big inactive icon instead of running the content. After setting the right configuration, the Flash plugin would run the content again as before. However, later in January, major web browser vendors rolled out new versions that disabled the Flash plugin at their own level, especially stating they provided no mechanism to reenable it. In Firefox 85, contrary to Firefox 84, the Flash plugin is not even listed anymore in about:plugins. It appears like there is some explicit rule to refuse to even load the Flash plugin. The Flash plugin doesn't load in pages or tabs where it is required, and the Flash configuration mentioned above to allow content to run in the plugin again can't change anything to that. Providing no mechanism to manage this runs counter to the direction, decision, and standards set by Adobe for the end of life of their own product. And it disenfranchises end users. Mozilla has no standing to enforce Adobe Flash player's end of life this way, especially not as a champion of not only free and open source software, but also of end users' empowerment and online freedoms and rights, as they reaffirm in their manifesto. This is hardly acceptable offensive behavior, especially in the form it takes. Not only does this endorse Adobe's time bomb, but with automatic Firefox updates to the newest version (e.g. on Windows), this is remote tampering to lock the end user out of a feature before they can even get a say in it - this is actually what happened to me before I could understand it, when investigating the issue after noticing it in another browser first. This is artificial feature lockout from a vendor - in free software. And Adobe Flash reached its final version so it's not like already existing support would require any future work to adapt to new Flash developments. I envision Debian as better than that. Thus I request the possibility in Debian to keep running the Adobe Flash plugin in Firefox, at the user's discretion. Perhaps with a configuration setting to make Firefox load the plugin again. Or if there could be a hack to apply on the local plugin installation, I'd be willing to hear about it. Either way, this wouldn't be the first time that Debian disagrees with Mozilla or restores support for a feature dropped by them in Firefox, and these are reasons I've appreciated your maintainership of the firefox packages for all these years. This is not just a political problem, this can be very real and practical. My Internet service provider offers an IPTV service as one main component of their plans, and one way to access it from home computers is through a web page hosted on their proprietary CPE router. Unfortunately, it requires Flash to play the video streams, as my ISP never converted it to HTML 5, even despite having years to do so and my CPE still being a supported product. This IPTV feature now doesn't work anymore; see https://dev.freebox.fr/bugs/task/22560 I've tried to hack around to the direct stream, but to no avail. This is a web page that mixes HTML and JavaScript controls to browse and switch channels, with Flash to play the selected stream; so I can't work it in a standalone Flash player, I need support in a web browser. I can't either update to HTML 5 myself that web solution embedded on my ISP's CPE, even if it was my job. I had successfully restored functionality after January 12 through Flash configuration settings, before web browser updates later broke it again. I pay every month for this feature, that Firefox locked me out of, even after Adobe chose not to. I'd like to see this kind of situations getting avoided on Debian before it spreads further than the latest non-ESR versions in unstable. And I'm sorry if I need to make one last point, because some people would like to just point out something along the lines of: "Flash is dead, just get on with it, better rip that band-aid once and for all, than clinging to the past." Flash isn't just video playback replaceable by HTML 5. It's also a myriad of artworks, animations and games, that are part of our web cultural heritage. Saying to just forget about them now is glib. After TV came out, we didn't burn all books saying that if they were still relevant, someone would have made a movie version of them. That's ridiculous. Best regards and thanks for your consideration on this issue, -- Pierre Ynard -- System Information: Debian Release: bullseye/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /bin/dash Init: sysvinit (via /sbin/init)
