Windows 8. Photo: Microsoft

Starting today Microsoft is ditching the whitelist, allowing Flash in IE10 to run by default on almost any site that needs it.

Previously Microsoft had announced that Windows 8′s Metro mode would not support Flash. By the time Windows 8 actually launched that had changed to allow Flash to run on websites that Microsoft had formally whitelisted. Flash always ran unfettered in IE10 when using Windows 8′s desktop mode.

Now Microsoft is reversing the whitelist, blacklisting “the small number of sites that are still incompatible with the Windows experience for touch or that depend on other plug-ins.” According to the IEBlog that’s fewer than 4 percent of sites using Flash.

According to web survey company W3Techs, around 20 percent of all websites still use Flash in some fashion. The HTTPArchive puts that number somewhat higher at 35 percent in general, but 42 percent for the top 1,000 sites on the web. Unfortunately neither of those sources track whether or not Flash is an integral part of the sites that use it, or just used in advertisements on the site.

Whatever the case, despite the fact that the number of sites using Flash is declining, it’s clearly still a big part of the web.

Whitelisting every site on a site-by-site basis was cumbersome at best and often frustrating since sites that might have worked just fine could not simply because they had not made the list. Today’s change of heart for IE10 eliminates that problem and makes Windows 8 a bit more consistent, offering nearly the same Flash experience whether you’re in desktop or Metro mode.

Windows 8. Photo: Microsoft

If you’ve been testing the built-in version of Internet Explorer in Microsoft’s coming Windows 8, you may be vulnerable to security flaws in Adobe’s Flash plugin.

Like Google Chrome, IE 10 on Windows 8 bundles the Flash Player directly into the browser. Unlike Google Chrome, IE 10 isn’t yet getting Flash updates on time. Because the plugin is bundled Adobe’s auto-update tools don’t work, nor can users manually download and install updates.

The only way to update Flash in Windows 8 is through Windows Update. That means the job of making sure those updates get to users falls to Microsoft, which so far has not delivered.

A Microsoft spokesperson tells Webmonkey that the company is “working closely with Adobe to release an update for Adobe Flash in IE 10 to protect our mutual customers.” However, Adobe’s latest round of patches was released August 21 and there’s still been no update for IE 10 users. Microsoft says that the update will be available “shortly.”

The company also assures Webmonkey that this issue will be worked out before Windows 8 actually ships.

Part of the problem appears to simply be scheduling. Microsoft’s updates are generally released on the second Tuesday of each month, while Adobe typically patches Flash a week or two later. That window between updates is what currently leaves those testing Windows 8 vulnerable.

Microsoft tells Webmonkey that a plan is in the works to address the scheduling conflict and ensure that Windows 8 users don’t have a vulnerable version of Flash for two weeks every patch cycle. Microsoft didn’t offered any details beyond saying the company plans to “align our release schedule as closely to Adobe’s as possible.”

Jelly Bean kicks the Flash habit. Image: Google

Today’s the day Adobe will pull its Flash Player plugin from Google’s Android marketplace, marking the end of what was once touted as a key advantage of Android over Apple’s iOS.

As we reported earlier, Google’s new Android 4.1 “Jelly Bean” marks the end of the line for Adobe’s certified version of mobile Flash Player. While the move shouldn’t have been a huge surprise since Adobe already announced last year that it would cease development of its mobile Flash Player, it’s still bad news for those that wanted an official version of the Flash Player on a Jelly Bean phone.

And now Adobe has limited access to Flash in the Google Play Store to any phone on this list of certified devices. For everyone else Flash on Android is a thing of the past.

The reasoning behind Adobe’s decision to pull Flash from the Google Play store is that any devices that don’t have Flash Player installed out of the box are, in Adobe’s words, “increasingly likely to be incompatible with Flash Player.”

There is a way around the new limitations if you’re a developer who needs access to Flash (or, presumably, a user who doesn’t mind hacking your phone): Flash Player for Android will remain available in Adobe’s archive of released Flash Player versions. It’s also worth noting that when we first wrote about the end of Flash on Google Play a number of readers let us know that the Flash plugin actually does seem to work with Android 4.1, so if you’ve just got to have it, head to the archives and give it a shot.

Adobe has released Flash Player 11.3, which offers several new features aimed to make the widely used browser plugin more secure — including a new security “sandbox” for Firefox on Windows.

To grab the latest version of Flash, head to Adobe’s Flash Player download page.

The big news in this release is the new sandbox security settings for Firefox on Windows, which first showed up in the beta release earlier this year. Flash’s near ubiquity make it a popular target for web-based attacks, but the new sandboxing means that even when such attacks succeed the damage is limited and won’t spill over into the rest of the browser or even the operating system.

Adobe and Google have previously worked together to add the same sandboxing feature to the Chrome browsers.

Mac users finally get an (optional) background updater with Flash 11.3. It works just like the updater that’s been available in Windows for some time — provided you allow automatic updates, the new updater will check with Adobe’s servers every 24 hours. If an update is available, the background updater can download and install it without interrupting your browsing session.

This release of Flash for OS X is also the first to support Apple’s Gatekeeper feature coming later this year in OS X 10.8. Gatekeeper checks a developer’s unique Apple Developer ID to verify that an application is not known malware. Flash 11.3 for OS X is the first release signed with an Apple Developer ID certificate, ensuring there will be no problems installing it on OS X 10.8.

Firefox's proposed click-to-play model for plugins like Adobe Flash Player

A very early version of the “click-to-play” option for plugins is now available in the Firefox nightly channel. Once that’s installed you’ll need to type about:config in your URL bar and then search for and enable the plugins.click_to_play flag. Once that’s done visit a page with Flash content and it won’t load until you click on it.

While HTML5 lessens the need for Flash and other plugins, they’re still a big part of the web today. Even where HTML5 has had great success — like the video tag — it hasn’t yet solved every publisher’s problems and remains incapable of some of the things Flash can do. That means Flash will likely remain a necessary part of the web for at least a few more years. At the same time Flash and other plugins are often responsible for poor performance and security vulnerabilities. So if something is necessary, but can slow down your browser and can be the source of attacks, what do you do?

At Webmonkey we’ve long advocated NoScript or even disabling plugins system-wide.

Another popular solution is the click-to-play approach that Mozilla developers are considering. It’s not a new solution, Chrome offers the option, but so far no web browser has yet made it the default behavior. Savvy users will already know that you don’t need to wait for Firefox to implement this feature to block Flash. If you’d like to prevent Flash from loading until you say so you can do that today with Flashblock (Safari users can try the Click to Flash add-on, Chrome will block plugins out of the box, see the Plugins section in Chrome’s settings).

Visit a webpage with embedded Flash content when Flashblock or similar is installed and you’ll see a static image where the Flash movie would normally be playing. Click the image and then the plugin loads. Because Flashblock blocks even things you don’t realize are Flash, for example banner ads, it can greatly reduce memory use and speed up your browser by preventing those elements from running in the background. Indeed Flashblock and its ilk are like ad-blockers, hard to live without once you’ve become accustomed to them.

Whether or not the click-to-play approach that Mozilla is considering will ever become the default behavior for Firefox remains to be seen. This very early release is rough around the edges and nowhere near ready for prime time, but the goal is to have it be part of — disabled, but part of — Firefox 14.

Google issued a beta release of Chrome for Android earlier today. The browser provides support for modern web standards and includes a number of compelling features that aren’t available in the Android’s default browser. One noteworthy Chrome desktop feature that isn’t included in the mobile port, however, is the integrated Flash runtime.

Adobe has issued a statement confirming that Chrome for Android does not support Flash content. The company also indicated that it does not plan to work with Google to add Flash support to the new mobile browser. Adobe will, however, continue supporting Flash in the current default Android browser.

“Today Google introduced Chrome for Android Beta. As we announced last November, Adobe is no longer developing Flash Player for mobile browsers, and thus Chrome for Android Beta does not support Flash content,” wrote Adobe’s Flash Platform product manager Bill Howard.

Adobe struggled for years to make the Flash player plugin viable on mobile devices. Though it was able to make Flash work reasonably well on Android phones, results were mixed on other systems. Due to Apple’s unwillingness to allow the Flash plugin on iOS and the difficulty that Adobe faced bringing the Flash player to new devices, the plugin never achieved the same ubiquity on phones that it has historically enjoyed on the desktop.

These setbacks caused Adobe to abandon its mobile Flash player strategy last year. The company announced that it would phase out development of its mobile Flash player plugin and not support it on new platforms. Adobe instead focused its mobile Flash efforts on developing tools for deploying Flash content as native mobile applications. It also strengthened its commitment to native web standards and acknowledged HTML5 as the way forward for building rich mobile web experiences.

When Google eventually moves to replace the default Android browser with Chrome in future versions of the Android platform, devices that run the operating system will likely no longer be able to play Flash content in the browser.

This article originally appeared on Ars Technica, Wired’s sister site for in-depth technology news.

Adobe wants to save Firefox users from falling victim to Flash-based security flaws. Working with Mozilla, Adobe has created a beta version of Flash with a new sandbox technology designed to limit the damage Flash-based attacks can do. Adobe previously added similar sandbox protection to Google’s Chrome browser.

If you’d like to test the new Flash Player Protected Mode for Firefox on Windows 7 or Vista, head over to the Adobe Labs download page. Bear in mind that this is a beta release and may contain some bugs.

The new sandbox feature for Flash in Firefox will provide extra protection against malicious browser exploits launched through the Flash Player. Sandboxing means that even when such attacks succeed, the damage is limited and won’t spill over into the rest of the browser or even the operating system.

The design of the Flash sandbox is similar to what Adobe uses in its Adobe Reader X Protected Mode. “Since its launch in November 2010, we have not seen a single successful exploit in the wild against Adobe Reader X,” writes Peleus Uhley, senior security researcher for Adobe. Uhley goes on to say that Adobe is hoping to “see similar results with the Flash Player sandbox for Firefox once the final version is released later this year.”

While Adobe has ceased development of mobile Flash, the company continues to develop and improve Flash for the desktop. HTML5′s canvas and video elements — among others — are designed to remove the need for plugins like Flash on the web. However, HTML5 support remains incomplete even in the newest browsers, and Flash will likely remain a necessary part of the web video and animation world for the foreseeable future.

If you needed further proof that even Adobe is done with Flash, look no further than the company’s recent announcement that it will open source the Flash-based Flex SDK. Adobe plans to turn over its Flex SDK to the Apache Software Foundation.

Flex is the company’s development framework for building cross-platform applications using Adobe Flash and ActionScript. The SDK’s focus on data-driven apps made Flex a popular choice with Adobe’s enterprise customers, many of whom are no doubt feeling a bit let down to see Adobe walking away from Flex.

Much of the Flex codebase is already open source; what’s changing with the move to the Apache Software Foundation is the governance of Flex. Adobe is no longer the sole guiding force behind Flex.

Ordinarily, when a company opens up a project like Flex it’s good news for developers, but in this case it feels more like Adobe’s exit strategy. The community of Flex developers may have gained some more control over Flex’s future, but that future looks pretty bleak.

Adobe has already made it clear that the company plans to refocus its efforts on HTML5, and, while it says it intends to continue supporting Flex, it also says, “in the long-term, we believe HTML5 will be the best technology for enterprise application development.”

In fact the initial message about the future of Flex was dire enough that Adobe felt the need to update its FAQ to specifically address concerns that it is abandoning Flex. “Absolutely not,” says Adobe in the updated statement, adding that the company is “incredibly proud of what we’ve achieved with Flex.”

While the updated statement is intended to reassure Flex developers, it’s hard to miss the use of the past participle in reference to Flex, which doesn’t bode well for developers looking to the future. It’s also hard to miss the reiterated commitment to HTML5. “In time,” says Adobe, “we believe HTML5 could support the majority of use cases where Flex is used today.” The company puts the timeframe for most applications in the three- to five-year range. In other words, Adobe believes Flex is only a good bet for the immediate future, developers interested in building something with more long term viability would do well to consider the web and HTML5.

For more details on the future of Flex and Flash, be sure to read through Adobe’s updated FAQ on the subject.

See Also:

• What the Death of Mobile Flash Means for the Web
• Metro-style Internet Explorer 10 Ditches Flash, Plugins
• Adobe Proposes New Standard for 3D Effects on the Web