Chromodo 42 and Ice Dragon screenshots

Thanks JoWa.

Which means many users will switch to Java supported browsers such as Safari and Firefox.

I guess I will switch to Ice Dragon when there is no longer any NPAPI support. I understand the reasoning behind the move however the reality is far different. Developers are not going to jump into HTML 5 because chromium wants them to. Java is not going to either. Market share will now increase for browsers that still support NPAPI.

Looking at the statistics, and extrapolating it, I don’t think “many users” will switch from Chromium, or even use chrome://flags/#enable-npapi in M42–44. Java on the web is really tiny these days.

The other plugins? Google Talk is no longer needed. Silverlight was until recently required for Netflix, but that is no longer the case. Netflix has an HTML-player. The browser must have an EME-implementation, though (Chrome has).

Java is not insignificant so I have no idea where you are getting that from. For one such discussion see here:

Um no, for an example on what I mean regarding JAVA see here: http://www.quora.com/How-will-Java-be-supported-in-Chrome-after-Chrome-drops-the-NPAPI-support

Yeah, Jowa, I was about say what you were on, thinking that Java is phased-out. It’s still all around.

As with Chrome/Chromium in regards to phasing out NPAPI-based plugins, Mozilla won’t be to far behind.

The world is revolving and evolving, redundancy makes room for new innovation. :wink:

Primarily from the statistics I linked to. In September 2013 8,9 % used Java, in May 2014 7,2 % and in October 2014 3,7 %. How many used Java with Chrome 41? Until that data is published we can only guess, based upon what we do know, and my guess is 2–3 %. Even fewer will probably enable NPAPI in Chrome 42–44.

See also Usage of client-side programming languages for websites (W3Techs)

What data are you referring to when you say that “Java is not insignificant”?

I set my Palemoon to “Ask to activate” a long time ago, I’ve been using it before it was cool.
Mozilla is just being a poser.

You got me there, I keep confusing Javascript with Java. I know they are different.

According to Plugins article of Mozilla Developer Network:
“Plugins are written using NPAPI, the cross-browser API for plugins. The main source of documentation for NPAPI is the Gecko Plugin API Reference. To make your plugin scriptable from web pages, use npruntime.”
If the main source for NPAPI is the Gecko Plugin API your supposition makes no sense.

I edited the broken url for you. I hope it is to your liking. Eric

To divert attention. Java can be started by the browser without using the plug in. That’s what Opera used to do.

That is a good point for Java Eric, that is also what I do for PDF.
Safer without the plugin, when it is not required.

Kind regards.

Pepperflash is no better regardless.

No better, really? At least the security of PPAPI (“Pepper”) is superior even to the sandboxed NPAPI-Flash Player that used to be included in Chrome, and Flash Player sandboxed by Firefox on Windows, not to mention NPAPI-Flash Player used with other browsers, without sandboxing.

In 2012, IBM compared

  1. Flash Player Protected Mode For Firefox
  2. Flash Player Protected Mode For Chrome
  3. Flash Player Protected Mode For Chrome Pepper

Conclusion: “We have concluded that out of the three implementations, the one that offers the most security is Pepper Flash.”

PDF: https://media.blackhat.com/bh-us-12/Briefings/Sabanal/BH_US_12_Sabanal_Digging_Deep_WP.pdf

Edit: There is more:

Beyond the security benefits, PPAPI has allowed us to move plug-ins forward in numerous other ways. By eliminating the complexity and legacy code associated with NPAPI, we’ve reduced Flash crashes by about 20%. We can also composite Flash content on the GPU, allowing faster rendering and smooth scrolling (with more improvements to come). And because PPAPI doesn’t let the OS bleed through, it’s the only way to use all Flash features on any site in Windows 8 Metro mode.

I have many flash crashes with Pepperflash. Why not dispense with Flash altogether and use HTML 5 solely?

And I haven’t had many crashes at all since I began using PepperFlash in May 2012 (Chrome 20 beta). :wink: Two users isn’t enough for any conclusions.

Flash is slowly being phased out, and mobile systems are pushing for that to happen. But it’s not a switch without problems. Switching from a plugin to HTML means that the browser has to handle the content, including proprietary video and audio formats, such as AVC/H.264 and AAC, mp3). For every installation of a decoder for a proprietary format a licensing fee must be paid to MPEG LA. So, either Comodo would have to pay a licensing fee for every installation of Dragon, Chromodo and IceDragon, or these browsers would have to rely on the system’s decoders, if available. Or they will not be able to play video and audio encoded with proprietary formats. And, as I mentioned earlier, an EME-implementation is also needed for “protected” content (Netflix etc), but at least that doesn’t have to cost.

As far as Pepperflash goes there is no difference between crashes of Pepperflash and Adobe Shockwave. Furthermore I highly doubt that it’s more secure than Adobe since hackers tend to gravitate to something that is used popularly. Chromium is making a big mistake with solely using Pepperflash. I was just speaking with someone else who had to disable Pepperflash to use certain sites. I am not the only one who knows this is a bad move for developers of various game platforms. Java is not defunct. Mozilla WILL gain a higher amount of user share and again I will probably have to switch to Ice Dragon once Chromodo is not able to play content due to the lack of NPAPI. I am not going to argue this point with you. I have been experimenting with many different browsers for more than 10 years now. You will see that I am right about this. If I was a betting person I would stake bets on yet.

NPAPI plugins are not alone, even Microsoft Spartan browser is ceasing use of ActiveX and Internet Explorer will not be around for ever.
So it is time development moved on to coincide with these changes.
Just my opinion.

I guess you have at least as much data as the Chromium-developers who in August 2012 reported that they had “reduced Flash crashes by about 20%”? Please show us your data. :slight_smile:

You’re entitled to your doubts, of course. :a0
To clarify: it is Adobe Flash Player we are talking about. “PepperFlash” is Adobe Flash Player using a modern API (Pepper Plugin API, PPAPI) instead of the obsolete Netscape Plugin API, NPAPI, from 1995. The API is the layer between the plugin and the browser.
Flash Player, both using NPAPI and ActiveX (IE) has always been a popular and easy target for attackers. Traditionally, the issue was that Flash Player ran with the same privileges as the user. IE7 on Vista introduced “Protected Mode”, which ran not only the renderer (HTML, JavaScript etc) but also plugins at low integrity level.¹ A simple and pretty weak sandbox, but better than nothing. The same can be said about Chrome’s Flash-sandbox when NPAPI was still used. Like IE, Chrome on Vista and later ran Flash Player at low integrity level, but also as a job object, like Chrome’s renderers, albeit with only one restriction (Kill on job close). This NPAPI-based sandbox did not provide any security on XP (no integrity levels there). Firefox’ Flash-sandbox added some job-restrictions but, developers focused on making it as secure as possible for Vista and later.² They did an impressive job, considering the limitations of NPAPI, which was not designed for sandboxing. Every form of sandboxing makes it harder to exploit vulnerabilities in Flash Player, but a weak sandbox isn’t good enough. PPAPI allows for a much stronger sandbox, as IBM’s report shows in detail, and is the only Flash-sandbox for XP, and also for Linux-based systems.³

¹ http://blogs.msdn.com/b/ie/archive/2006/02/09/528963.aspx
² https://blogs.adobe.com/security/2012/06/inside-flash-player-protected-mode-for-firefox.html
³ Security: Chrome 20 on Linux and Flash sandboxing

Flash is still going to be open to exploits no matter how many layers of sandboxing it’s subjected to. Sandboxing is not without concern. I use Flash dependent games and when I use PEPPERFLASH solely it has the same exact issues the “outdated” Netscape plug-in has. When I speak to other people they have to disable PPAPI in order to access games. As the internet is rife with Flash game players which cannot use PPAPI securely it remains an issue. You can debate this until the cows come home but it does remain an issue. It will in fact be an issue once Chromodo/CD switches to the current chromium branch. Sigh.