Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Firefox Media Mozilla Security News

Mozilla Testing Click-to-Play Option For Plugin Content 124

Trailrunner7 writes "Mozilla is developing a feature in Firefox that would require some user interaction in order for Flash ads, Java scripts and other content that uses plugins to play. In addition to easing system slowdowns, the opt-in for Web plugins is expected to reduce threats posed by exploiting security vulnerabilities in plugins, including zero-day attacks. 'Whether you hate them or love them, content accessed through plugins is still a sizable chunk of the web. So much so, that over 99% of internet users have Flash installed on their browser,' writes Mozilla's Jared Wein, the lead software engineer on the project, in a blog post."
This discussion has been archived. No new comments can be posted.

Mozilla Testing Click-to-Play Option For Plugin Content

Comments Filter:
  • by Anonymous Coward on Friday April 13, 2012 @12:43PM (#39675375)

    Seriously, this is a no-brainer, that has been implemented by tonnes of extensions. So now that we're at version 4000, why is it suddenly a good idea to implement it?

    • by b4dc0d3r ( 1268512 ) on Friday April 13, 2012 @01:26PM (#39676231)

      And, it was the subject of an EOLAS lawsuit against Microsoft, who IIRC had to disable automatically running things in IE for a while (maybe they got that overturned before actually having to implement it).

      EOLAS invents something, patent-trolls, gets $30million (down from the 500+ originally awarded) and 10 years later everyone starts to realize it's a bad idea!

      • Frankly, MS should have kept that Click to run as an security option in IE. It pretty much did the same thing noscript did back in 2003. Of course IIRC it had one of those annoying drop down bars you had to click on in order to get it to run instead of clicking the control box in question and it was easily worked around (but that could be fixed)

    • Gnash (Score:4, Insightful)

      by buchner.johannes ( 1139593 ) on Friday April 13, 2012 @01:39PM (#39676481) Homepage Journal

      I would like it if one could decide on a per-site basis to play the Flash with Gnash or with Adobe Flash.

      Gnash is much faster, plays nicer with the graphic card, and is more secure. I had success using it on several websites.

      However it doesn't support many of the newer Flash features, so everyone trying it out will turn away from it.

      If there was a "SafeFlash" extension, that would, like HTTPSEverywhere, use Gnash where the website is compatible, a smooth transition away from Adobe Flash (which will be phased out for Linux anyway apparently) would be possible.

      • Re:Gnash (Score:5, Interesting)

        by hairyfeet ( 841228 ) <bassbeast1968@gm ... minus herbivore> on Friday April 13, 2012 @02:10PM (#39676977) Journal

        While that is a pretty good idea there is an even worse bug in FF that they need to address because I'm sure other bad guys will pick up on it and that is the Yahoo porn bug. I call it a porn bug because its seen most often on porn video sites but I've been told the trick is showing up at other places so maybe its starting to spread and the sad part is it ought to be trivial to stop. This is how it works:

        Target A uses FF to surf a porn video site. While the video is playing FF is sent a hidden iFrame that loads the yahoo login, FF logs the target in and then everyone in their address book gets porn and malware spam links. This gets around many of the spam filters because its from a non blacklisted account and they don't send more than one or two emails per targeted address and having received a couple from those that were hit it looks like it may be taking random sentences from somewhere (maybe another hidden iFrame?) to get past the filters and look like a legit email.

        The fix seems pretty obvious and I honestly don't know why mozilla hasn't done so. All one would have to do is prompt the user on install or upgrade to put a master password on their password store and here is the key have it only ask ONCE per session and no means do not ask again for the session because after telling my users to put a master password they immediately started screaming that it made FF unusable so I put a master password on mine and...wow. it will bug the ever loving shit out of you with constant asking for the master password! I was getting 4 or 5 requests for the master password on just regular sites which tells me that the current password design sucks ass if so many see you are running FF and try to hit it.

        So while i'm glad they are working on the autoplay problem I'd say user passwords being threatened is just as big if not bigger and really hope they do something about this in future releases. Since I had a machine I was gonna wipe anyway I decided to cook up a couple of phony Yahoo accounts (along with a phony Gmail and Hotmail) and test this for myself and can say that at least as far as i could tell this bug ONLY affects FF and Yahoo, not Gmail or Hotmail, and not Dragon, Opera, Safari, QTWeb, or Chrome. So I'd say if you have a user or family member that uses yahoo as a primary email you might want to switch them to another browser until they get that fixed. Oh and NO I did NOT test IE because after they refused to backport to XP which is still supported i officially wrote off IE. If you have to replace a supported OS just to stay current on the fricking browser then its no longer a functional choice IMHO.

        Oh and since someone always seems to ask the version number the one I tested was i believe 8, FF has been spinning through version numbers so fast lately its hard to keep up and I don't have the time to rerun this test every time a browser has a new release. If someone wants to run the test again its pretty easy, you'll need 1 fake yahoo account along with either another fake yahoo or gmail or hotmail in the address book of the fake yahoo so the bug has an email to send spam to. Then simply start clicking on random porn vids, xHamster or youPorn, any of the major porn sites will do. If the bug is still active you'll see strangely worded spam go to your target account from the yahoo account and that's how you know its still active. Like I said i just don't have the time so after trying several browsers i switched my users and family over to Comodo Dragon since it had both ABP and low rights mode. Since the switch no more strange porn spams so I'd say it was a successful switch.

        • Are you saying that flash allows for XXS attacks?
        • F logs the target in and then everyone in their address book gets porn and malware spam links.

          FTFY: FF logs the target in and then everyone in their address book gets porn and malware sperm links.

          • FF logs the target in and then everyone in their address book gets porn and malware sperm links

            I had to ask, was that intentional?

            • What you expect from porn related intrusion?
            • I don't know exactly what he is trying to "fix for me" but I think I would have been pointing this bug out a little more loudly if I had actually gotten malware SPERM, not to mention that PC wouldn't have been wiped but killed with fire.
        • by theCoder ( 23772 )

          Why is this a Firefox bug? What do other browsers do to prevent this type of thing? I was under the impression that cross site scripting prohibitions in the browser prevented sites from doing what you're saying is happening.

          Why would a master password protect against this issue? Wouldn't the password autofilling (assuming that's the issue) be available once the user had entered the master password, just as if there were no master password? I admit I've never bothered to set a master password, so maybe t

        • I've no idea what might be causing that particular bug, but ever since this bug (360493) [mozilla.org] was active, I've enabled/disabled saving passwords as I need them. The reason being, FF seemed far to happy to automatically insert saved usernames/passwords when really I'd have much preferred have a button that *I* have to press to do activate this. I believe that is/or was the solution in Opera using a magic-wand button? (never used Opera for anything other than browser testing).

          That said... I've switched to Chrome
    • It isn't a good idea unless it is disabled by default and only available as an option.

      I WANT Firefox to spread in the enterprise, and this will likely make that less probable.

      Web based applications requiring individual permissions for aspects of their functionality in the corporate world? I have enough trouble getting these mental giants to load a web page...

    • That's the nice thing about throwing rocks from the peanut gallery: You can throw them if they don't implement a feature, and still throw them if they do implement it. Well played, sir.
  • finally (Score:2, Insightful)

    by Anonymous Coward

    This should have been the default 10 years ago.

    I'm a fan of Java, but I still cringe when I go to a web page and the Java console opens.

  • for javascript? (Score:5, Insightful)

    by sdnoob ( 917382 ) on Friday April 13, 2012 @12:46PM (#39675433)

    really? you'd get carpel tunnel if you had to click-to-run every script on most commercial sites these days.

    no script is more effective but with a learning curve.

    but either method will still have the masses turning the 'feature' off (essentially white-listing everything).

    • Re:for javascript? (Score:4, Informative)

      by phayes ( 202222 ) on Friday April 13, 2012 @12:50PM (#39675519) Homepage

      I've been using NoScript for years. You whitelist the trusted sites where you need it & the others are just an occasional click.

      • by sdnoob ( 917382 )

        exactly.. but the brain-dead masses won't "get" how to use it... thus, would just turn it off (if they could even figure *that* out) or continue their click-click-click-click ways..

        • NS (Score:5, Interesting)

          by tunapez ( 1161697 ) on Friday April 13, 2012 @01:15PM (#39676067)

          I've tried this on numerous occasions, the more advanced users eventually click 'Allow Scripts Globally", the less advanced keep calling me until I click 'Allow Scripts Globally".

          I personally love it, easy-peasy black/white-list. My other apps do not stutter and bog whenever I scroll a page or open a new one. Pages load faster or not at all(both good IMO). Google's auto-search doesn't clog up my 1MB connection or freeze FF trying to force feed me their assumptions(must remove Goog from pre-loaded whitelist). Minimal ad tracking tools/cookies/malware collecting in my system, bleachbit completes in record time. My whitelist allows mo-add-ons page, my local library and some local devices. I'm typing now with /. & FSDN blocked. With the exception of moderation, the site suits me better with them blocked!

          • Moderation comes and goes. Right now, I shift-click the comment number and get the comment by itself in a new window. Select the moderation, and the 'moderate' button is at the bottom.

            Even if it has child replies, as long as they remain 'normal', you only moderate the single comment.

            It also helps refresh to see if someone else has changed the moderation, or made a reply that I should consider in my moderation. Unless there are 5 child replies and the page gets large, overall I think this way is the best

          • I use the "allow second-level domains" (or whatever it's called) on NoScript. For example: news.slashdot.org. That eliminates a lot of headaches but still blocks dangerous sites filled with viral-scripting.

            I also use the free AVG which includes a Firefox plugin to filter-out anything it considers bad.

        • the braindead will want a way to fix it, quick, without thinking hard. if you want this as default, but don't want them turning it completely off, then you need to provide a really easy way of them to think they've fixed their immediate problem. They won't think beyond that. Maybe a "whitelist this page so your scripts work?" popup the first time you visit a site? may get annoying on every other page, though.

      • by Rolgar ( 556636 )

        I do this, but if everybody had it as the default, the websites would put all the scripts in the same domain so you would have to choose to get all or nothing.

        The companies the host the ad scripts would have to figure out a way to make money without hosting their scripts directly, but I'm sure they would figure out something.

    • Re:for javascript? (Score:4, Informative)

      by amicusNYCL ( 1538833 ) on Friday April 13, 2012 @01:19PM (#39676139)

      This doesn't have anything to do with Javascript, Javascript is not a plugin. This affects plugins like Flash, Java, and Silverlight.

    • Or, we stop loading scripts. You're assuming a whitelist wouldn't be built in. I use Ghostery, and it sometimes requires intervention, but for the most part silently nukes ad scrapers. This would create something similar, but standard in the browser. Third party script? No thanks.

      Oh, and Click-for-Flash (via an add on) has been my preferred UI for years. Works fine.

    • by Anonymous Coward

      The summary doesn't say "JavaScript" it says "Java scripts", as in applets. JavaScript isn't even a plugin. They're talking about blocking automatic execution of Java applets and Flash, not JavaScript.

    • Well maybe not "years" but since Opera 10 came out. The Javascript operates normally, but if you turn-on the Turbo mode, Opera does not load any flash content but just displays a placeholder until you click it.

      That's a nice way to avoid loading a lot of ads, or embedded youtube videos (thus speeding-up browsing). Opera also has a convenient "images off/on" toggle at the bottom, which I use on slow connections like Dialup or cellphone.

      • by Anonymous Coward

        You don't have to use turbo mode.

        Tools -> Preferences -> Advanced -> Content -> Enable plug-ins only on demand.

        • by Anonymous Coward

          In addition, this can be turned on granularly as well (per website). It'll be under F12->Edit Site Preferences.

  • NoScript? Already done, thanks.
    • Re:You mean like (Score:4, Informative)

      by ElmoGonzo ( 627753 ) on Friday April 13, 2012 @12:50PM (#39675511)
      FlashBlock, too.
      • noscript already blocks flash so flashblock would be redundant if you already have noscript
        • by allo ( 1728082 )

          i think you need to change the defaults for that. Might be a reason, why some noscript users still use flashblock.

          • People who allow scripts so the page will run/load, might not want flash running automatically. For example the entire Gawker family, including iO9 which occasionally posts interesting things. I might whitelist it to read the content, but I don't want flash loading automatically.

            So you get the combination. By default, Java, Flash Silverlight, and 'other plugins' are disabled bu default.

            • by allo ( 1728082 )

              yeah, and you can configure noscript to block plugins even when scripts are allowed.

              you need to enable "block plugins even on whitelisted sites" or something like this. Then you have exactly the flashblock behaviour.

          • "i think you need to change the defaults for that. Might be a reason, why some noscript users still use flashblock."

            Interface for Flashblock is better. You just click the element, you don't need to go through a menu.

            • by allo ( 1728082 )

              same interface in noscript. i do not speak of the script blocking part,but of the click-to-start-plugin part.

          • Addendum:

            I just tested it, and the "Block Adobe Flash" option in my NoScript settings doesn't even work.
            • by allo ( 1728082 )

              [x] block adobe flash
              [x] use on trusted websites, too
              [x] show placeholder symbol

              (not the exact text, as my system does not have an english locale)

        • IIRC, NoScript would allow every YouTube video to play automatically if I just allowed one YouTube video to play temporarily. So, I installed flashblock, which ALWAYS requires me to start each flash video manually.

          • noscript will block flash too if you configure it, you need to set "Apply these restrictions to whitelisted sites too" on the "embeddings" tab in the option
    • by phayes ( 202222 )

      Yeah those of us who care about security have been using NoScript for years but this will push the ignorant masses into better security.

      • Yeah those of us who care about security have been using NoScript for years but this will push the ignorant masses into better security.

        No, those of us who care about security, speed, and and hate ads and social crap have been using NoScript for years.
        And we set it up so that clicking the button triggers "Temporarily allow all this page". If a site doesn't work, we just click the button repeatedly until it does.

      • Yeah those of us who care about security have been using NoScript for years but this will push the ignorant masses into better security.

        A little bit... however, I doubt Mozilla is going to go as far as NoScript with the concept; likely, they'll stick to blocking media (read: Flash videos) and continue to allow the ad servers all the access they want.

        • by phayes ( 202222 )

          You're certainly right & that will mean that there will still be a good reason to use NoScript. However that doesn't mean that what Mozilla is planning still won't be a good thing for the less security consious.

  • monopolized by google's chrome browser i would rather see HTML-5 make plugins like flash obsolete, i refuse to install google chrome just to have flash, and will remove the existing flash plugin at the first sign of vulnerability problems, for javascript and plugins i use noscript extension in firefox at the moment and if mozilla.org developers build something similar to noscript right in to the browser itself would be fine with me
    • i would rather see HTML-5 make plugins like flash obsolete

      So would I. But first, someone must fix these problems:

      • Make vector animations in web browsers implementing HTML5 Canvas play as fast as they do in Flash Player. This benchmark [themaninblue.com] gives about 40 fps for Flash on my computer and 20 fps for Canvas in Firefox.
      • Make a tool to author vector animations.
      • Make a way to reliably convert existing vector animated series, such as Weebl and Bob and Homestar Runner, so that they can be played through an implementation of HTML5. Smokescreen [slashdot.org] goes part of the way toward this.
      • by allo ( 1728082 )

        > vector animation
        > canvas
        you're doing it wrong.
        you need to test scripted svg.

        • you need to test scripted svg.

          Result of same benchmark with SVG [themaninblue.com]: eight times slower than Canvas.

          • by Anonymous Coward

            They key here actually is that Firefox's SVG sucks - not that SVG in general sucks.

            On my machine I get the following results for the test with the default parameters

                  Canvas ~35 FPS
                  SVG ~3 FPS

                  Canvas 40-50 FPS (bounces around a bit more than the other tests)
                  SVG ~ 65 FPS

            • by allo ( 1728082 )

              flash html canvas svg with chromium.
              with firefox, flash is the fastest and the rest is sucking.

              good argument for using more chromium.

              i really need to evaluate, how much of my data (history, bookmarks, etc.) can be imported and which extensions i would really be missing.

              • good argument for using more chromium.

                So if analytics show a lot of Gecko (Firefox, SeaMonkey, etc.) and a lot of MSIE, what's the most polite way to encourage the user to install one of the Chromium browsers so that the frame rate will become acceptable?

      • by Gordo_1 ( 256312 )

        That's funny because for me, with Win7/Firefox 11 on a Core i5 CPU with a recent Nvidia GPU, for a 2000 particle run I get 40fps in Flash and about 45fps using canvas.

        http://themaninblue.com/experiment/AnimationBenchmark/flash/?particles=2000 [themaninblue.com]
        http://themaninblue.com/experiment/AnimationBenchmark/canvas/?particles=2000 [themaninblue.com]

        So I guess YMMV.

      • by Desler ( 1608317 )

        I get ~42fps on my 3rd gen iPad for canvas. Either you have an old computer or Firefox's implementation is crap.

      • Flash gives me about 60fps, where canvas was staying right around 90fps with an occasional drop to 75fps, though Flash also did have some slow spikes. This is on Firefox 11 with the on CPU Intel graphics on a mobile i7.

      • YMMV and all that, but I'm getting fastest results (42-43 fps) with canvas under Firefox 12 / Snow Leopard (there is an update I haven't applied yet, it just showed up). This is not a new machine by any standard -- it's a 2007 Core 2 Duo 2.4 MBP. I'm running Parallels with a Windows XP VM while testing, and I've got 2 X11 rdesktop sessions open (IOW if I wasn't at work and could close out everything, my results would probably be faster).

        I get roughly the same under Flash, but it's very jumpy, with swings f
      • HTML: 60 fps
        Canvas: 87 fps
        SVG: 85-90 fps
        Flash: 33-36 fps

        Chromium 17 & Flash 11-r1, on Debian testing.

      • 32-33 FPS HTML
        69-70 FPS Canvas
        23-28 FPS SVG
        54-60 FPS Flash

        Quad-core I5 at 3.40GHZ running Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:14.0) Gecko/20120412 Firefox/14.0a1 ID:20120412030726
        GeForce GT 440

        So, yes, I'm cheating by running the burning edge of the latest FF in 64-bit mode, alpha software running on Windows 8 64-bit, also alpha.

  • So much so, that over 99% of internet users have Flash installed on their browser,' writes Mozilla's Jared Wein, the lead software engineer on the project, in a blog post.

    Yes, I have Flash installed in my browser.

    No, I do not have Flash enabled all the time in my browser. I only enable Flash for the particular content I want to view via Flash.

    I already have the "click to play" option for Flash.

  • by Anonymous Coward
    The linked article says "Java scripts" but the actual blog post http://msujaws.wordpress.com/2012/04/11/opting-in-to-plugins-in-firefox/ [wordpress.com] she was writing about just says plugins. I'm guessing they wouldn't require permission for javascript.
    • While it could have been worded better, Java scripts clearly has a space in the middle, meaning that the language being referred to is Java, not JavaScript.

      They should have said Java Applets, though.

  • Just ban Flash outright! The whole world will be thankful.
    • Ban plugins, their time has come and gone. The web's a very different place from when they were introduced in the mid 90's.

      • by tepples ( 727027 ) <tepples@NOSpAM.gmail.com> on Friday April 13, 2012 @01:14PM (#39676039) Homepage Journal
        As I wrote in another comment [slashdot.org], both Firefox's implementation of Canvas and Firefox's implementation of SVG are substantially slower than Flash Player at playing back vector animations. Furthermore, most web browsers don't provide an API for a JavaScript program to (ask the user's permission to) turn on the camera and microphone. Once Firefox's implementation of Canvas becomes competitive in frame rate and once a device API becomes widely implemented, I will become more inclined to agree with you. Until then, SWF is the only way to push certain features out to users of IE 8 who lack permission to install other browsers (e.g. work break room, public library) because Adobe Flash Player is far more widely installed than Google Chrome Frame.
        • That's a vicious circle: things get implemented in Flash because the browser's too slow, browser features get a low priority because there's Flash to lean on, ... Third party plugins are the bane of the modern open web maybe it's worth dealing with breakages for a year if it forces the issue.

          • by Desler ( 1608317 )

            Or the users will just move to the browser that doesn't break things since they won't want breakage.

            • Or the users will just move to the browser that doesn't break things since they won't want breakage.

              Yeah, It'd require some consensus between Mozilla, Google and Microsoft although the first two would probably be able to force the issue on their own. Note that Apple's already there with iOS. The future is smartphones and tablets and they're already plugin-free, we just need the desktop to catch up.

            • Or the users will just move to the browser that doesn't break things

              In an office, public library computer lab, school computer lab, or other institutionally managed setting, it's not the user's choice; it's the IT administrator's choice. Users don't get to install browsers because they aren't administrators, and in some cases (such as AppLocker), users don't even get to download executables or bring them in on USB flash drives.

      • instead of stuffing more and more into the browser itself, put more of the stuff in plugins.

        but not the old nsplugins, limited to their square area, but plugins which can for example improve the javascript engine, define new html-tags, and such stuff.
        okay, much of this is done via javascript already nowadays, but everthing which would run faster with native code, should go to plugins. so what about and video? They could be plugins, just with a reasonable api, not the limited api which nsplugins use.


  • flashblock and noscript provide this option since a looooong time. They could just ask the users of these addons for their experience.

  • by Maury Markowitz ( 452832 ) on Friday April 13, 2012 @01:05PM (#39675849) Homepage

    I run ClickToPlugin in Safari for all the reasons above. During general browsing my fan no longer turns on and my battery lasts days.

  • Like Opera's had for about 3 major versions now?

  • "..Blocks Flash so it won't get in your way, but if you want to see it, just click..."

    https://addons.mozilla.org/en-US/firefox/addon/flashblock/ [mozilla.org]

    • Came here to say exactly that. Looks like their intention is to integrate the functionality into firefox itself.

      • by allo ( 1728082 )

        like personas. put more stuff into the core, which works better as an extension.

        • Well yeah, essential thing *should* be made part of the core. Hell, have you tried browsing the web without flashblock? Flash eating all you CPU all the time with ads, sounds comming from background tabs you can't find, etc, etc.

          In some cases, it *is* more effiecient too, imagine writing something that connects to an API, registers a callback, etc, vs doing something in-core. If done properly, a minor efficienty improvement might be seen.

          Finally, flashblock is ugly, the icon is horrible streched all the

  • yes, please (Score:4, Insightful)

    by Tom ( 822 ) on Friday April 13, 2012 @04:38PM (#39679043) Homepage Journal

    On anything that is video (animated images count) or audio, I absolutely want confirmation.

    I regularily open several tabs in the background, e.g. go through a news site, open all interesting articles in their own tabs, continue until end of summary page, then go read all of them. The next time some audio suddenly starts blasting through my speakers, drowning out my music, and I have to hunt down the fucking window that does it, I'll do berserk.

    Seriously, audio in webpages should always require an explicit user start.

  • by WillyWanker ( 1502057 ) on Friday April 13, 2012 @05:06PM (#39679453)

    OK, I don't use Firefox, I use Chrome. And I have plug-ins disabled by default, so they all show up as grey boxes. If I want to run one I right click and select Run. How is this any different?

To do two things at once is to do neither. -- Publilius Syrus