You are not logged in.

#1 2016-07-22 06:18:06

johnraff
nullglob
From: Nagoya, Japan
Registered: 2015-09-09
Posts: 8,335
Website

[DONE] Flash in bl-welcome

We're all agreed that Adobe's Flash Player is the spawn of the devil and has the potential to open all kinds of security vulnerabilities.

A bug report and discussion: https://forums.bunsenlabs.org/viewtopic.php?id=1873

However, while HTML5 is often usable, sometimes there is no alternative to Flash, eg BBC videos.

Head_on_a_Stick wrote:

Unpleasant as it may be, Flash is essential for many users and should be left as an option IMO.

Adobe have announced that they're dropping flash support for Linux, and are only maintaining the ver. 11 series (installed by flashplayer-nonfree) with security updates, no improvements. However, the "pepperflash" version, now at ver. 22.*, is in fact used by Google Chrome, even on Linux. The flash player (libpepflashplayer.so) is extracted from GoogleChrome by the pepperflashplugin-nonfree package and made available for Chromium. If browser-plugin-freshplayer-pepperflash is installed then Firefox can also use that library.

neutral Google have recently dropped support for the 32bit i386 architecture, so 32bit users can no longer install google-chrome or pepperflashplugin-nonfree. Chromium still has a 32bit version, but needs pepperflash, so the only option for 32bit users would have been to use Firefox with the old ver. 11.* flash.

smile BUT, the Adobe direct download site also offers a 32bit Linux version of the pepperflash player. Users can install this and use it in Chromium or Firefox (with browser-plugin-freshplayer-pepperflash) The security difference is that pepperflash in GoogleChrome/Chromium is run inside a sandbox, while the freshplayer plugin for Firefox is not. I have posted a script to automate the download/install here, but bear in mind that no checksum testing is done on the downloaded file. Adobe do not seem to post checksums anywhere.

SO... what should bl-welcome be (A) recommending, and (B) offering to users? There has been much, much discussion, on the thread above and elsewhere, and I'm going to suggest what might be a usable compromise. It is still open to modification though.

EDIT Now we have bunsen-pepperflash in the repos, which works for both i386 and amd64 systems, this suggestion is out of date. See the post below for something simpler.

bl-welcome can detect the system architecture:

64 bit systems

Boost up the Flash Warning anyway, and, in declining order, recommend/offer to install:

1) Google-chrome-stable (or Chromium + pepperflashplugin-nonfree)  to be used for Flash only, other browsing on Firefox.
or, less, 2) Firefox w + browser-plugin-freshplayer-pepperflash with even more warning.
3) Do not offer flashplugin-nonfree at all.

32 bit systems

Even more Stern Warning, then offer a method of getting the 32bit Linux pepperflash library.
Possibly:
A bunsenlabs debian package including a script like that above.
or
A link to a HOWTO on the forum.

NOTE most 32bit machines are old. I have found that the old 11.* series Flash plugin is lighter on processor usage, and some users might actually prefer it just to have videos that play smoothly.

Anyway, comments?

Last edited by johnraff (2017-01-06 07:21:00)


...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), idle Twitterings and GitStuff )

Introduction to the Bunsenlabs Lithium Desktop

Offline

#2 2016-07-22 07:19:56

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 8,759
Website

Re: [DONE] Flash in bl-welcome

I totally agree with the plan as laid out above and would prefer:

(B) offering to users


“Et ignotas animum dimittit in artes.” — Ovid, Metamorphoses, VIII., 18.

Forum Rules   •   How to report a problem   •   Software that rocks

Offline

#3 2016-07-23 21:30:16

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

If you've seen my post on my troubles with flash I'm in no way in favor of spreading it to other people.  It seriously kills my dual core processor on my netbook. That's even with transitioning to pepperflash.  (Granted the netbook isn't working with processors that are able to handle a heavy load under any circumstance)

Truth be told...I would probably vote to say don't even offer flash or pepperflash. When they open their browser and in the now increasing small amount of occasions where they'll actually need flash, they can download it or then apply pepper.. If this were years ago, I think my answer would be different, but with youtube (a huge percentage of video for people)  going to nearly all HTML5, flash is (thankfully) in the minority of use cases. Shouldn't the bl-welcome be catering more towards more popular usages?


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#4 2016-10-24 06:22:45

johnraff
nullglob
From: Nagoya, Japan
Registered: 2015-09-09
Posts: 8,335
Website

Re: [DONE] Flash in bl-welcome

New suggestion

Now we can offer PPAPI ("pepperflash") for both i386 and amd64 with the bunsen-pepperflash package, how about this flow:

Stern Warning pretty much as before.

Ask "would you like to install the flash plugin?", if "yes", then:

If the old NAAPI flashplugin-nonfree is detected, then insist on removing it before continuing.

Same for pepperflashplugin-nonfree which is superseded by bunsen-pepperflash.

Then offer these two options:

    1) Install chromium + bunsen-pepperflash, use chromium exclusively for flash, firefox for everything else. (Recommended.)

or

    2) Install bunsen-pepperflash + browser-plugin-freshplayer-pepperflash (needs backports) and carry on using firefox for everything.

How does that sound?


...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), idle Twitterings and GitStuff )

Introduction to the Bunsenlabs Lithium Desktop

Offline

#5 2016-10-24 07:10:58

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 8,759
Website

Re: [DONE] Flash in bl-welcome

Yes, that sounds like a good idea smile


“Et ignotas animum dimittit in artes.” — Ovid, Metamorphoses, VIII., 18.

Forum Rules   •   How to report a problem   •   Software that rocks

Offline

#6 2016-10-24 07:25:13

dolly
Miss Mixunderstand
From: /lab701
Registered: 2015-10-03
Posts: 434

Re: [DONE] Flash in bl-welcome

As I understand it (or mixunderstand it) Flash is still a necessary evil. This proposed solution seems simple enough for me. Yuotube works fine without Flash, but there are quite a lot of other sites that needs it.


A bit nerdy, trying to grow up.

Offline

#7 2016-10-24 15:14:34

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

dolly wrote:

As I understand it (or mixunderstand it) Flash is still a necessary evil. This proposed solution seems simple enough for me. Yuotube works fine without Flash, but there are quite a lot of other sites that needs it.

Yep, hence all of this discussion..

That's a good idea JRaff... shame it has to be such a muddled mess like this.  Either way, for the user's best interests, NPAPI should be removed regardless, yes?  Hopefully once this transition period ends from using NPAPI to most having moved to  ...well...not flash at all ideally.

Though JRaff I gotta disagree with the idea that Option 1 would be preferable to option 2. i think focusing on cross browser support would be ideal. I'd be a bit miffed if I was encouraged or had to keep and use two different browsers for my daily tasks. In fact I sort of already have to do that for work. A lot of our internal sites don't work on Firefox, so I have to use I.E. (It's wildly annoying) So, recommending a way to be able to let users use their preferred browser,  with the bunsen-pepperflash + freshplayer-pepperflash, despite backports... would still  be ideal at least for me.


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#8 2016-10-24 15:40:45

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

Also @JohnRaff I think there may be a mistype in the README file on github, you say:

This package will download and unpack the PPAPI flash plugin directly from Adobe.
Configuration files for chromium and browser-plugin-freshplayer-pepperflash
will be installed so that those applications can use the plugin.

Chromium will be able to use the downloaded plugin immediately,
but for Mozilla browsers the package
browser-plugin-freshplayer-pepperflash must also be installed.

Notice that you say the browser-plugin-freshplayer-pepperflash is needed for Chromium...but this is only needed for Firefox correct? Doesn't Chromium only need the pepperflashplugin-nonfree package?  While to use flash in firefox, it needs both PLUS the browser-plugin-freshplayer-pepperflash?


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#9 2016-10-24 15:52:49

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 8,759
Website

Re: [DONE] Flash in bl-welcome

johnraff wrote:

offer these two options:

    1) Install chromium + bunsen-pepperflash, use chromium exclusively for flash, firefox for everything else. (Recommended.)

or

    2) Install bunsen-pepperflash + browser-plugin-freshplayer-pepperflash (needs backports) and carry on using firefox for everything.

How does that sound?

I've been thinking about this...

Adobe now offer a fully updated version of the NPAPI plugin as well as the PPAPI version, the only features missing are the DRM-related stuff and 3D GPU acceleration.

This is available from their beta channel at the moment and hence is not installable via the flashplugin-nonfree package.

It can be downloaded from here:

http://labs.adobe.com/downloads/flashplayer.html

Is it possible to offer Firefox users the chance to install this version of NPAPI rather than having to enable jessie-backports to get the freshplayer wrapper?


“Et ignotas animum dimittit in artes.” — Ovid, Metamorphoses, VIII., 18.

Forum Rules   •   How to report a problem   •   Software that rocks

Offline

#10 2016-10-25 06:51:17

johnraff
nullglob
From: Nagoya, Japan
Registered: 2015-09-09
Posts: 8,335
Website

Re: [DONE] Flash in bl-welcome

Horizon_Brave wrote:

... shame it has to be such a muddled mess like this...

You said it! I'm getting quite eager to move onto something that has nothing to do with Flash, to be honest. bored.gif

I gotta disagree with the idea that Option 1 would be preferable to option 2...I'd be a bit miffed if I was encouraged or had to keep and use two different browsers for my daily tasks.

I'm in two minds over this too. The advantage of using Chromium for flash is that it's safer - the plugin goes in a sandbox, which doesn't happen when using the freshplayer plugin with Firefox. Also, keeping one separate browser for flash alone keeps your logins etc on the other browser a bit further away from any intruders.

All that said, I use Firefox for everything. Maybe if we word it to sound like Chromium is a bit safer, but Firefox is also an OK option for most people? Head_on_a_Stick?


...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), idle Twitterings and GitStuff )

Introduction to the Bunsenlabs Lithium Desktop

Offline

#11 2016-10-25 06:53:06

johnraff
nullglob
From: Nagoya, Japan
Registered: 2015-09-09
Posts: 8,335
Website

Re: [DONE] Flash in bl-welcome

Horizon_Brave wrote:

Also @JohnRaff I think there may be a mistype in the README file on github

I don't think so. Read it again...


...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), idle Twitterings and GitStuff )

Introduction to the Bunsenlabs Lithium Desktop

Offline

#12 2016-10-25 06:59:55

johnraff
nullglob
From: Nagoya, Japan
Registered: 2015-09-09
Posts: 8,335
Website

Re: [DONE] Flash in bl-welcome

Head_on_a_Stick wrote:

Adobe now offer a fully updated version of the NPAPI plugin as well as the PPAPI version, the only features missing are the DRM-related stuff and 3D GPU acceleration...
Is it possible to offer Firefox users the chance to install this version of NPAPI rather than having to enable jessie-backports to get the freshplayer wrapper?

It's possible, yes, but to be honest I'm not sure if I feel like complicating this any more. Enabling Debian backports (pinned at 100 btw) isn't such a big issue is it? Compared with installing a beta version from Adobe Labs? Maybe when it makes it to the regular install page...

Meanwhile, in Debian Stretch, browser-plugin-freshplayer-pepperflash is in contrib, no backports needed.

Last edited by johnraff (2016-10-25 07:00:48)


...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), idle Twitterings and GitStuff )

Introduction to the Bunsenlabs Lithium Desktop

Offline

#13 2016-10-25 10:00:48

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 8,759
Website

Re: [DONE] Flash in bl-welcome

johnraff wrote:

Enabling Debian backports (pinned at 100 btw) isn't such a big issue is it? Compared with installing a beta version from Adobe Labs?

Yes, that is a very good point.


“Et ignotas animum dimittit in artes.” — Ovid, Metamorphoses, VIII., 18.

Forum Rules   •   How to report a problem   •   Software that rocks

Offline

#14 2016-10-25 15:57:45

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

johnraff wrote:

Meanwhile, in Debian Stretch, browser-plugin-freshplayer-pepperflash is in contrib, no backports needed.

Let's just bury our head in the sand then and wait it out until Stretch turns Stable! tongue  The browser-plugin-freshplayer-pepperflash going main, would solve atleast some of the apprehension behind all of this, though it as HoaS said and from the Adobe Labs site, that may be a moot point... Below:

From the release notes :

"In the past, we communicated that NPAPI Linux releases would stop in 2017.  However, this is no longer the case, and once we have performed sufficient testing and received community feedback, we will release both NPAPI and PPAPI Linux with their major version numbers in sync and on a regular basis. "

You know I'm actually not sure how I feel about this... I want flash to die finally... this new found revived support for Linux 32/64 bit AND now Firefox/Opera continued support for NPAPI and PPAPI makes it seem like Flash isn't going anywhere... sad


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#15 2016-10-25 16:11:25

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 8,759
Website

Re: [DONE] Flash in bl-welcome

Horizon_Brave wrote:

The browser-plugin-freshplayer-pepperflash going main

You seem to be confused about the nature of the repository components, see https://wiki.debian.org/SourcesList#Component for more on this.

The freshplayer package will never be included in the main component of the repositories (ie, it will not be part of the official Debian release) but when stretch is released it will be installable without recourse to any backport repositories.


“Et ignotas animum dimittit in artes.” — Ovid, Metamorphoses, VIII., 18.

Forum Rules   •   How to report a problem   •   Software that rocks

Offline

#16 2016-10-25 17:05:57

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

Le Sigh.  I honestly don't know why I even try sometimes. Like I knew the difference between debian main repo, and it's components, but yet I still mistyped that... A year here and I still make these mistakes...  cry  cry


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#17 2016-10-25 18:00:12

geekosupremo
Member
Registered: 2016-04-27
Posts: 168

Re: [DONE] Flash in bl-welcome

johnraff wrote:

The advantage of using Chromium for flash is that it's safer - the plugin goes in a sandbox, which doesn't happen when using the freshplayer plugin with Firefox. Also, keeping one separate browser for flash alone keeps your logins etc on the other browser a bit further away from any intruders.

This would work for me. It is actually not far from how I use my Mac. Chrome has flash, everything else is HTML5/JS. It's only slightly annoying to launch chrome for the one site, but it's 'cleaner' and I don't have to worry over much about if Flash is going to crash or infect my machine.

Offline

#18 2016-10-25 21:55:37

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

So... because Adobe Labs now supports NPAPI for firefox/opera :

http://labs.adobe.com/downloads/flashplayer.html
and since they're still updating PPAPI for all linux from the official Adobe site..(32 and 64 bit )


Wouldn't this mean that the "shim" idea of browser-plugin-freshplayer-peppperflash not be needed anymore?
As I understand it (god please let me atleast get this correct)  the browser-plugin-freshplayer-pepperflash package just creates a path for firefox to see and use the chromium pepperflash plugin... So.. because Adobe-Labs is not patching, and updating NPAPI, there's no real need for it?

That said, we believe that the new NPAPI build
represents a significant step forward in functionality, stability, and security and look forward to hearing your feedback

To me, doesn't this sound like both NPAPI and PPAPI will not be on par with each other, security and function wise? (except some 3D acceleration functions)

If I have this wrong, I'm giving up on linux forever and becoming a hobo.


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#19 2016-10-25 22:30:33

damo
....moderator....
Registered: 2015-08-20
Posts: 6,722

Re: [DONE] Flash in bl-welcome

Horizon_Brave wrote:

....
If I have this wrong, I'm giving up on linux forever and becoming a hobo.

Noooo!  Don't leave us for a pointless life on the road!

Seriously though, personally I appreciate your working-through-problems and heart-on-the-sleeve  approach. You aren't afraid to ask the questions, which is always valuable.


Be Excellent to Each Other...
The Bunsenlabs Lithium Desktop » Here
FORUM RULES and posting guidelines «» Help page for forum post formatting
Artwork on DeviantArt  «» BunsenLabs on DeviantArt

Offline

#20 2016-10-26 01:15:25

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

damo wrote:
Horizon_Brave wrote:

....
If I have this wrong, I'm giving up on linux forever and becoming a hobo.

Noooo!  Don't leave us for a pointless life on the road!

Seriously though, personally I appreciate your working-through-problems and heart-on-the-sleeve  approach. You aren't afraid to ask the questions, which is always valuable.

Haha....Wait...you didn't agree with my assessment of the flash issue... :::Packs bags::   tongue

Anyway to not have this go way way off topic and stay focused here.  I think for the short term, there's no need to make this anymore complicated (for J.Raff ...) than it has to be. The desire to be perfect is often a downfall. I think we should present the two options...

Let the user know that Flash in general is probably a bad idea. If needed they'll probably need bunsen-pepperflash for chromium PPAPI support. Tell them Chromium will be set as the default browser for flash. Ask them if they prefer a different browser...if they choose yes, then download the Adobe-Labs NPAPI updated + security package.

Is that illogical? 
Not sure if that can all be bundled into the bunsen-pepperflash script


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#21 2016-10-26 03:41:37

johnraff
nullglob
From: Nagoya, Japan
Registered: 2015-09-09
Posts: 8,335
Website

Re: [DONE] Flash in bl-welcome

Horizon_Brave wrote:

I think for the short term, there's no need to make this anymore complicated (for J.Raff ...) than it has to be.

...sigh... How I agree with that!

Tell them Chromium will be set as the default browser for flash.

There's no such setting unfortunately. It's just down to how people choose to use their software. We can tell them that flash will be usable on Chromium though.

Ask them if they prefer a different browser...if they choose yes, then download the Adobe-Labs NPAPI updated + security package.

I think it's too early to start offering the Adobe beta NPAPI plugin. At this point I'd prefer to stay with PPAPI for both Chromium (directly) and Firefox (via the freshplayer wrapper), for bl-welcome that is. (Of course there's no reason someone couldn't write a how-to for using the new NPAPI plugin.)

Can we all live with that, at least for the time being?


...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), idle Twitterings and GitStuff )

Introduction to the Bunsenlabs Lithium Desktop

Offline

#22 2016-10-26 09:53:08

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 8,759
Website

Re: [DONE] Flash in bl-welcome

^ Yes, I would agree with that proposal.


“Et ignotas animum dimittit in artes.” — Ovid, Metamorphoses, VIII., 18.

Forum Rules   •   How to report a problem   •   Software that rocks

Offline

#23 2016-10-26 15:10:29

Horizon_Brave
Operating System: Linux-Nettrix
Registered: 2015-10-18
Posts: 1,473

Re: [DONE] Flash in bl-welcome

^^  +2 to that. Yea that is a very good point in that it's still a Beta version..and mixing it into a Stable debian (especially something volatile like flash)  would probably make for a bad cocktail.


"I have not failed, I have found 10,000 ways that will not work" -Edison

Offline

#24 2016-10-26 16:30:45

dolly
Miss Mixunderstand
From: /lab701
Registered: 2015-10-03
Posts: 434

Re: [DONE] Flash in bl-welcome

^^^Yes.


A bit nerdy, trying to grow up.

Offline

#25 2016-10-27 01:46:58

johnraff
nullglob
From: Nagoya, Japan
Registered: 2015-09-09
Posts: 8,335
Website

Re: [DONE] Flash in bl-welcome

@all thanks!
With any luck I'll have the bl-welcome flash page written today or tomorrow, and finally be able to think about something else. smile

The task itself is pretty simple - what complicates it is trying to output sensible-sounding messages for all the corner-cases when people have this or that package installed already. Like, people who've tried to set flash up themselves and come back to bl-welcome hoping to sort it out, or people who installed BL some time ago and have just upgraded to the new bl-welcome...

Still, can't complain: I was forced to learn a bit about systemd services (thanks to Head_on_a_Stick) and finally start dabbling with Python (thanks to Twoion) so it wasn't time wasted at all.


...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), idle Twitterings and GitStuff )

Introduction to the Bunsenlabs Lithium Desktop

Offline

Board footer

Powered by FluxBB