To everybody who wants Flash on IPad

[FloatingBones]

@darn: did you see about the new threats to Adobe Flash:

[Here is the homepage for the podcast, which includes transcripts in a variety of formats.]

Steve: So a Russian firm that does vulnerability research and sells their protection to customers is taking the position of, we're not telling Adobe because they don't pay us. So...

Leo: Oh. Oh, that sucks.

Steve: Well, you know, but they're selling their proprietary information to their customers. And it would make it less valuable if they provided it to Adobe because then Adobe would fix it, and then they wouldn't be offering exclusive protection to their customers. So it's a little, I agree, it's a little strange. But that's what they're doing.
They bypass both of these new, undisclosed, but proven and demonstrated in a video that they have, zero-day vulnerabilities; bypass both of Windows' anti-exploit features that we've talked about: DEP, which is the Data Execution Prevention, where regions of memory are marked as nonexecutable, like for example the stack, which normally only contains data, you don't typically execute the stack, and so that prevents stack overflow exploits, but not in this case; and ASLR, which is the Address Space Layout Randomization, which takes sort of the inherent modular nature of today's operating systems where different pieces are contained in separate modules, and Address Space Layout Randomization scrambles them all up so that different instances of the operating system are not always in predictable places. And that prevents the bad guys from being able to jump to known code and get their work done by sort of repurposing code in the operating system. If you don't know where it is, you can't jump to it reliably. But these vulnerabilities bypass all of that and work anyway. Oh, and they both escape from IE's sandbox. So the sandbox...

Leo: Whoa. Gee.

Steve: Yeah. So the sandboxing in IE is also ineffective.

Leo: Amazing.

Steve: Now, at the moment, this is Windows only. But they have promised soon to have a Mac OS X version.

Leo: Good. Because we want parity.

Steve: Because, exactly.

Leo: It's only fair.

Steve: Oh, goodness. So nobody knows what these are. The problem is that, as we know, you can often reverse-engineer patches in order to figure out what it was that was patched. And so the expectation is that the malware guys are going to jump on this and are probably in the
process of doing so. But there's nothing we can do about it. I mean, we users can only not use Flash in order to avoid the problem. So again, you want to be extra careful today about where you go and what links, especially what links you click in email, because anything that can invoke Flash which is malicious, if bad guys have figured out what these problems are that only this one company is selling their customers the fixes for, then that's a vector of exploitation. So Adobe has got lots of...

Leo: You got 'splaining to do.

Steve: Oh, yes, exactly. They're in the dog house.

This Russian firm sells its "protection" to virus creators; they create exploits to fund their subscriptions. What a fabulous little ecosystem.

These developers understand that Flash malware running only on PCs isn't WORA. They're actively working to have their Flash exploit also run on OS X. Will they achieve true WORA? Only time will tell if they work to port their exploits to Android, WebOS, and the other Flash platforms. If you read the full transcript of that episode, you'll see there are new exploit holes in Adobe Reader and Acrobat.

These Adobe products are the gift that just keeps on giving. Gibson also notes that Java deployed in the web has exactly the same risks.

The App Store model makes growing sense for distributing Flash code. Users can "opt in" to the apps they actually want to run and ignore the rest. @darn: given the risks of Flash-engineered malware, do you agree that the App Store model should be the way for Flash code to be distributed?

Flash runs well on my tablet so this is not true. No stuttering or slideshows--just smooth playback.

Plenty of users have indeed reported performance problems in Flash on their handhelds. Adobe itself has announced that they have dropped development for Flash on mobile devices: no new browsers, no support for new OS versions, and no new device configurations. The only support you will see is for critical bug fixes and security fixes on already-existing Android and Playbook configurations. You can read the details (and chase the links) in this Macrumors article.

That's a strong vote of no confidence from Adobe. They're clearly telling users to drop their use of Flash on the web for mobile computers. New devices -- and new versions of the OS for devices -- may have no Flash support at all. And those that do run may have security problems that will never ever be addressed. I'm guessing companies are already starting to ban the use of Flash in browsers in mobile devices.

What Adobe does support is the distribution of Flash/Flex apps via the various app stores. I support that, too: it's a way for users to "opt in" to the apps that they want to run. But I do think the time has come for legitimate businesses to stop distributing Flash content via the web.

@barkomatic: do you understand why running Flash through webpages is becoming a worse idea every day? If you disagree with that assessment, please state your reasons why.

 

[lovish]

There was one browser app on my ipod touch which had flash... it was maybe fire 360 or something like that...

Love is eternal - Albus dumbledore

 

[darngooddesign]

Your "solution" fails the John Nack test. Good luck finding clients willing to spend for two separate websites.

I'm in the pipeline to do mobile versions of existing sites. Those will be Flash free to support the main sites. I have friends doing similar things at large corporations, the argument of will a client pay for it is irrelevant as they are full time employees. It will cost no more for them to do secondary HTML sites as it would to have their employees do nothing.

Even if clients were to do this, there are huge technical problems. For instance, how can a website developer know programmatically if a Click to Flash blocker is installed and enabled on a client's machine?

You don't have to know the same way you don't have to know which browser is being used. You simply plan for all variances, and you install everything on your test machines to make sure it all works. I don't have to know if viewers of my site are on an iOS device or on a regular computer with a full browser with Flash. I just programmed both versions, added a JS redirect and then it doesn't matter. And if it doesn't register a particular Flash blocker, the user has two choices; either load the Flash content or click on the provided link to my HTML5 site. It doesn't matter to me which one they do as I deliver the same content.

If Flash supports accessibility, why doesn't it run on our Macs? @darn: this is a fact-based discussion. Stating things that you know are factually wrong is a violation of the rules for discussion. Cut it out, please.

What exactly should I cut out? Posting links to information that says Flash works with accessibility aids on Windows computers that you can't prove doesn't?

OK. Your claim that "Flash works with accessibility aids" is wrong. If I fire up Flash on my MacBook, it does NOT support accessibility. If I fire up Flash on an Android computer, it does NOT support accessibility. You are making claims in the discussion that you know are factually wrong.

It works on Windows.

WORA means that the code behaves the same way on all platforms. If I'm running on a PC, those accessibility adapters are [reportedly] available. If I'm running on any other platform, those accessibility adapters are NOT available. Adobe has placed an artificial constraint on Flash users: even though many platforms (PC, Mac OS, Android, etc.) have accessibility adapters, users must be running on a PC to [reportedly] get Flash with accessibility.

The code does act the same way if you own the hardware that can read the information it works.

Here's another way to understand: if a developer wishes to create a website accessible on all platforms, then they cannot use Flash.

They write two sites. That way they can make use of the full animation capability of Flash, which HTML5 hasn't been able to match, and the can have a simpler less animated site without Flash.

By adding the feature on a single platform, Adobe has succeeded in breaking WORA in Flash. It's one of the most boneheaded things that Adobe could have done with Flash. They made a promise of WORA, then they broke the promise.

The file is still WORA. It still runs anywhere that has a Flash plugin. This is not the fault of Adobe, its the fault of the Screen Reader companies that have not made Mac compatible versions. It would be akin to blaming Adobe for not supporting color Flash files if no one makes a color monitor for Macs. The SWF would still work the same and be able to send the same information. Have you been petitioning screen reader companies to make Mac compatible hardware? It seams that would be as helpful to handicapped people. Perhaps you could post links to other forums when you are championing to have Mac versions of the Screen Readers...

...but the vast majority of sites don't create parallel Flash and a Flash-free site for their webpage. You know that.

I can't help it if they're not smart enough to take advantage of the strenghts of all internet tools. In the end its up to each company to decide what it does and doesn't want to support and whcih technologies it values and which it doesn't. While I like Flash and want it to stick around because its the best at internet animation if it doesn't stay on the desktop another less capable protocol will take over.

Are you really agreeing with me? Do you agree that the App Store model is the appropriate way to deploy Flash content?

It is one avenue of delivering content, but it is also very limiting because if you don't have an iOS device then you can't make use of content in the app store. If a company doesn't have money to develop two sites, they certainly won't have money to develop apps for all the app stores in addition to their websites. So if you are an Android user, I'm using an example you mentioned earlier, you won't be able to take advantage of content released in the iOS App Store. Instagram, for example, is iOS only which is great for iOS devices but very limiting for everyone else.

The forking I meant was the forking of functionality: making accessibility work in only a single platform. While it may all be SWF, the accessibility code only runs on one platform. Adobe has broken WORA.

Nope, it still runs anywhere. If you are handicapped and want all functionality you will need to buy the appropriate equipment. For example, if you are a parapalegic you will need to buy specific equipment. If you need a screen reader you may need to buy specific equipment.

For anyone who was rolling their own content, it would be a terrible decision to roll out a Flash-only solution today.

Not necessarily. My friend who works for a large soda manufacturer (I'm being vague because I'm not allowed to disclose the particulars) says they are going to still use Flash video because it works better in their infrastructure, has much better playlist support, and they have plenty of non-Flash methods of delivering that content, both HTML and Apps. So choosing Flash video is not an issue and it won't impact them negatively.

While data can be presented badly with any encoding, the fundamental error of many of those websites was presenting their data exclusively in Flash.

Exactly, dont use Flash exclusively.

I don't know if your second point is valid. I have yet to see a clear communication what capabilities an Intel-based tablet will have vs. what capabilities an ARM-based tablet will have. AFAIK, we have yet to see any confirmation of Thurrott's announcement that ARM-based tablets will not have a desktop mode.

Currently everything points to Intel computers will have desktop and ARM ones won't. That's one clear example of the difference between the two.

When Microsoft is [reportedly] using the same name of "Windows 8" for telephones, tablet computers, laptops, and desktop machines, odds approach 100% that everybody will be confused over what it means. Microsoft's apparent change of direction since the Build conference don't help any, either. Microsoft's claim that there are "no compromises" in their effort is rather silly: there will always be compromises.

I feel that they will at least call one OS Windows Phone 8 because its an easy distinction that a phone OS won't have the same capabilities as a computer OS. There will be, as you said, a lot of confusion over the other W8 OSes.

If the ARM Tablets fail, we'll never quite know why. Part of the failure could be assigned to Microsoft's failure to respond rapidly to the iPad.

If ARM Tablets fail, part of the failure could be assigned to Microsoft's failure to provide leadership in clearly defining and communicating the capabilities of the device to developers and interested customers.

It could also be that given the choice between a limited Metro only ARM tablet and a robust Intel tablet with Metro and Desktop more poeple want the latter. But it will be hard to know for sure why they failed, [roviding they do fail.

So you say. I believe you also claimed that the Javascript dispatching code "works perfectly" on all browsers -- something that strains credulity.

Why does it strain credulity? There is an enormous amount of JS code that works on all browsers, why would my admitedly simple redirect code not work? My redirect works on every browser I have tested it on, and I've tested a lot of browsers, but the touch scroll mechanism doesn't work on Dolphin Browser due to the same gesture being used as part of the browser's interface, but that's why I also added left right buttons.

You have repeatedly talked about the code, but you've never given a URL for anyone to verify that your claims are true. Why not?

You're being obtuse. You know my URL, you have mentioned my URL when discussing my project, you have ene posted a link to it. All you have to do is go to my site on a Flash-enabled computer and go to my site on an iPhone/iPad and you will see this mysterious code working.

We Mac users cannot run that code to verify if the PC-only Flash accessibility code actually works. Is there some reason that you have never tried to run it on your PCs?

It wouldn't matter if I provided proof of it working because you would not believe it and would look for anything to say to the contrary. Use my JS redirect code as an example. You know my URL, I posted general information describing what the code does, then I posted the code, I told you it was up, and I'm assuming you have an iOS device. While it would be a simple matter to look at my site on your iPhone to see if it works, but you would rather make vague claims that my mysterious JS code might not work. Heck, I'm sure there are other web devs reading this thread, albeit bored with our bickering , who would have weighed in if it didn't look like it worked.

-----

@darn: did you see about the new threats to Adobe Flash:

There will ALWAYS be a security issue regardless of how secure the manufacturer tries to be. Perhaps you remember Jailbreakme.com. This was a problem with Mobile Safari that allowed a PDF to execute any code it wanted; in this case it installed Cydia and closed the exploit, but it could have been used to install all kinds of malware and if the pdf were embedded on a page the user would never know anything happened. This was a Flash free exploit which could have been extrememly serious. Most of the user-land jailbreaks, and there has been at least one in each OS version, have involved serious security holes which have luckily been found by nice people.

 

[FloatingBones]

I'm in the pipeline to do mobile versions of existing sites. Those will be Flash free to support the main sites. I have friends doing similar things at large corporations, the argument of will a client pay for it is irrelevant as they are full time employees.

You have completely misconstrued what Adobe employee John Nack said in the Adobe blog over a year ago. He is saying that HTML should be sole website for a site. He is not recommending that mobile be secondary to some "main" Flash website.

What does the spin-word "main" even mean in this context? When customers realize that some Windows 8 computers -- ARM-based tablets -- are completely Flash-free, do you think they'll relate to a Flash website as their "main" website? What about users and companies that are tired of the barrage of zero-day Flash security problems and have prohibited the execution of Flash on websites?

Why do you presume that HTML designed for mobile devices can't also be used for desktop browsers?

It will cost no more for them to do secondary HTML sites as it would to have their employees do nothing.

Again, you completely misconstrue what we were discussing here in the thread. I'm not asking what one company [reportedly] does; I'm asking what all companies should do who have Flash-only websites. What exactly should the mom-and-pop restaurant do that got sold a Flash-only website three years ago do today? Your hypothetical employer may be able to afford employees sitting around doing nothing, but mom-and-pop shops cannot afford to have parallel websites. They need a working website, and they need it to be Flash-free. This is exactly what John Nack was talking about in his blog post.

Would you really recommend that some tiny mom-and-pop restaurant keep their Flash-based website running?

I believe you are wearing rose-colored glasses. Can you give us a single example of an exemplary website that maintains all its content in parallel content in both Flash and HTML? Can you give us the URL for that website? If not, why not?

You don't have to know the same way you don't have to know which browser is being used. You simply plan for all variances, and you install everything on your test machines to make sure it all works. I don't have to know if viewers of my site are on an iOS device or on a regular computer with a full browser with Flash. I just programmed both versions, added a JS redirect and then it doesn't matter. And if it doesn't register a particular Flash blocker, the user has two choices; either load the Flash content or click on the provided link to my HTML5 site. It doesn't matter to me which one they do as I deliver the same content.

I have no idea what it means to "register a particular Flash blocker". Please answer these yes-or-no questions:

If a desktop user doesn't have Flash installed on his machine, can a website seamlessly send HTML to that user?

If a desktop user has click-to-flash installed and enabled in a browser, can a website seamlessly send HTML to that user?

If the answer to either question is "yes", please provide a live URL that demonstrates a website that can do that.

What exactly should I cut out? Posting links to information that says Flash works with accessibility aids on Windows computers that you can't prove doesn't?

Please stop making deceptive claims about Flash and accessibility.

In this message, you claimed, "I provided some evidence to the contrary [that Flash does work with accessibility aids.]".

In this message, you claimed, "I presented plenty of evidence that Flash works with acessibility aids."

Now your word choice has changed a bit. Flash does not support accessibility; only a port of Flash to a single platform [reportedly] supports accessibility. By making accessibility a proprietary extension, Adobe has broken WORA in Flash. If one actually implemented accessibility code in Flash, it would only run on one platform.

It works on Windows.

But it doesn't work in Flash. Do you now understand the difference?

The code does act the same way if you own the hardware that can read the information it works.

Not exactly. If you have a current Mac, you must boot that hardware with a Windows OS to [reportedly] access the accessible version of Flash.

Claiming that Flash supports accessibility is deceptive. It does not. Given that Adobe has now abandoned any new development of Flash on a major chunk of platforms, odds are approaching zero that Flash will ever support accessibility.

They write two sites. That way they can make use of the full animation capability of Flash, which HTML5 hasn't been able to match, and the can have a simpler less animated site without Flash.

Anyone could write two sites. As a practical matter, the huge majority of sites do not do this. There is a vast wasteland of Flash-only sites: sites that only use Flash animation in a gratuitous fashion that serves no benefit to the end user. @darn: even Adobe itself does not advocate two parallel sites.

The file is still WORA.

No. The test of WORA is that the code has the same behavior on all platforms.

It still runs anywhere that has a Flash plugin. This is not the fault of Adobe, its the fault of the Screen Reader companies that have not made Mac compatible versions.

Not exactly. Flash is an opaque technology. If Adobe were to actually implement accessibility in Flash, then Adobe would have to provide ports to the accessibility APIs for each platform: Windows, Mac, Android, etc.

With HTML, the data is transparent; each vendor directly implements the code to user their accessibility adapters.

I can't help it if they're not smart enough to take advantage of the strenghts of all internet tools.

For small websites -- like a restaurant website -- Flash never ever made sense. Serving up parallel website never has -- and never will -- make sense.

"Smart enough" is completely silly. Even Adobe isn't recommending what you are recommending.

It is one avenue of delivering content, but it is also very limiting because if you don't have an iOS device then you can't make use of content in the app store.

That's incorrect. There's an iOS App Store, a Mac App Store, a Blackberry app store, an HP WebOS App Catalog, the Google Android Marketplace, the Amazon Appstore, and Amazon's separate app store for the Kindle Fire.

If a company doesn't have money to develop two sites, they certainly won't have money to develop apps for all the app stores in addition to their websites.

Again incorrect. Adobe's Flash-packaging tools make it easy to package apps for all the app stores. This is Adobe's recommended mechanism for distributing Flash/Flex apps to mobile devices.

So if you are an Android user, I'm using an example you mentioned earlier, you won't be able to take advantage of content released in the iOS App Store. Instagram, for example, is iOS only which is great for iOS devices but very limiting for everyone else.

Go look up the Flash app Politifact. It's available for Android, iOS, and Playbook. AFAICT, developers have just been lazy about packaging their apps for all of the App Stores.

Nope, it still runs anywhere.

The accessibility code would only run on Windows machines. Not on Macs. Not on iOS. Not on Android. And not on Playbook.

If you are handicapped and want all functionality you will need to buy the appropriate equipment.

In other words, run Windows. No Mac. No WebOS. No Android. And no Windows 8 on ARM Tablets. That answer is a FAIL.

HTML has open data -- data that can be successfully interpreted with the adapters on any platform supporting accessibility. It will work on all of those platforms. The way to an accessible web -- all users on all platforms -- is to flush Flash.

For example, if you are a parapalegic you will need to buy specific equipment. If you need a screen reader you may need to buy specific equipment.

No thanks. Users on MacOS, iOS, WebOS, and Android would rather use their regular computers. They would rather not have to buy a special computer -- just to run Flash. Do you now realize the absurdity of your argument? Flash is not the solution to implement accessibility; it's actually a big part of the problem.

Not necessarily. My friend who works for a large soda manufacturer (I'm being vague because I'm not allowed to disclose the particulars) says they are going to still use Flash video because it works better in their infrastructure, has much better playlist support, and they have plenty of non-Flash methods of delivering that content, both HTML and Apps. So choosing Flash video is not an issue and it won't impact them negatively.

OK. Don't tell us which soft drink manufacturer in Atlanta you're talking about.

If Coke actually looked, I bet they would find it far easier to just stream all their video in HTML/h.264.

Exactly, dont use Flash exclusively.

John Nack is recommending that websites don't use Flash at all.

Currently everything points to Intel computers will have desktop and ARM ones won't.

Everything? Really. Where is the clear communication from Microsoft that is saying that?

Why does it strain credulity? There is an enormous amount of JS code that works on all browsers, why would my admitedly simple redirect code not work?

Then publish the code! Allow people other than you to test it.

BTW: you also need to release the spec for what you think the code is/should be doing. You have written that, right?

You're being obtuse. You know my URL, you have mentioned my URL when discussing my project, you have ene posted a link to it. All you have to do is go to my site on a Flash-enabled computer and go to my site on an iPhone/iPad and you will see this mysterious code working.

No. If you want people to run your code, then you should publicly announce it.

You also need to specify what you think your code is doing so people could try it out in their own environments. The best way to do this would be to put comments in your JS code about what it's doing.

If you never had any intention of publishing the code, there was no point in discussing it here. There was also no point in your spending any time developing it. If you want to have a fact-based proof-of-concept then provide the code. Simple. If you have no interest in anyone ever using the code for anything, then please don't waste our time talking about it.

It wouldn't matter if I provided proof of it working because you would not believe it and would look for anything to say to the contrary.

You really have no idea what a fact-based discussion is. If you want a public discussion of your code, then please announce it. Specify what the code is supposed to do, annotate the code, say where you've tested it, and announce it.

If you don't want to do that, then don't.

There will ALWAYS be a security issue regardless of how secure the manufacturer tries to be.

How conscientious has Adobe been in trying to be secure? Check out the editor's comment on the summary of the article "Reader and Acrobat Updates Address Memory Corruption Flaws" on this SANS.org page:

Isn't it about time that we drove a stake through the heart of PDF and started over? This time, let's not include stupid cruft like JavaScript, Flash, and Universal 3D in a *DOCUMENT* format.

Why did PDF ever have the capability to embed -- and execute -- JavaScript and Flash code in the document?

Why didn't Adobe turn off that capability after the first zero-day bug that exploited this hole? At the very least, why didn't they make the default behavior to NOT execute the scripting or SWF code?

Do you now understand why knowledgable Mac users have completely de-installed all versions of Acrobat and Adobe Reader from their computes?

Do you ever listen to the Security Now! podcast? Are you familiar with Steve Gibson's assessment of Adobe's security efforts? Do you really know nothing about Adobe's security reputation?

Perhaps you remember Jailbreakme.com.

Of course. That was reported on the Security Now! podcast last year. See the SANS quote above: Adobe has a long-standing record as a vendor of some of the most promiscuous software in the world.

I see Adobe software having at least 25x the number of zero-day malware attacks as Apple. Is that what you see?

While security was not the primary reason that Jobs cited for keeping iOS Flash-free, it was an important factor in the decision. Adobe had a terrible record for security back in 2006/2007. While it has improved a bit, there's still a long way to go. Can you imagine Apple deferring the security of their iOS browser to another company -- especially a company with such a terrible security record?

Dropping stupid cruft (Liston's phrase) like JavaScript and Flash from Adobe reader and Acrobat would be a good idea, right?

 

[barkomatic]

@darn: did you see about the new threats to Adobe Flash:


This Russian firm sells its "protection" to virus creators; they create exploits to fund their subscriptions. What a fabulous little ecosystem.

These developers understand that Flash malware running only on PCs isn't WORA. They're actively working to have their Flash exploit also run on OS X. Will they achieve true WORA? Only time will tell if they work to port their exploits to Android, WebOS, and the other Flash platforms. If you read the full transcript of that episode, you'll see there are new exploit holes in Adobe Reader and Acrobat.

These Adobe products are the gift that just keeps on giving. Gibson also notes that Java deployed in the web has exactly the same risks.

The App Store model makes growing sense for distributing Flash code. Users can "opt in" to the apps they actually want to run and ignore the rest. @darn: given the risks of Flash-engineered malware, do you agree that the App Store model should be the way for Flash code to be distributed?



Plenty of users have indeed reported performance problems in Flash on their handhelds. Adobe itself has announced that they have dropped development for Flash on mobile devices: no new browsers, no support for new OS versions, and no new device configurations. The only support you will see is for critical bug fixes and security fixes on already-existing Android and Playbook configurations. You can read the details (and chase the links) in this Macrumors article.

That's a strong vote of no confidence from Adobe. They're clearly telling users to drop their use of Flash on the web for mobile computers. New devices -- and new versions of the OS for devices -- may have no Flash support at all. And those that do run may have security problems that will never ever be addressed. I'm guessing companies are already starting to ban the use of Flash in browsers in mobile devices.

What Adobe does support is the distribution of Flash/Flex apps via the various app stores. I support that, too: it's a way for users to "opt in" to the apps that they want to run. But I do think the time has come for legitimate businesses to stop distributing Flash content via the web.

@barkomatic: do you understand why running Flash through webpages is becoming a worse idea every day? If you disagree with that assessment, please state your reasons why.

I didn't say everyone who is running flash on their mobile device aren't having problems. I just said that I wasn't having any issues. On a high end device I think flash generally runs fine but thats probably not the case on many of the cheaply made mobile devices.

I agree that flash is on its way out--but its far from gone yet. I still routinely access webpages that use it-- and its useful to be able to view them. Restaurant websites, hotel websites, and plenty of videos are still flash only. Again, I've got no particular love for flash, but until HTML 5 fully takes over its nice to have it.

As to the flash exploits, there is an entire world of hackers looking for any exploit they can use at all. Once flash is gone, they will move on to something else. One can dig up a multitude of articles that reveal problems everywhere.

 

[FloatingBones]

I didn't say everyone who is running flash on their mobile device aren't having problems. I just said that I wasn't having any issues. On a high end device I think flash generally runs fine but thats probably not the case on many of the cheaply made mobile devices.

Go read the reviews of Machinarium in the app store. The developer notes that this app only runs on the iPad 2. If you read the critical reviews, you'll also see a distressingly large number of users report that this Flash app crashes on their iPad 2. I don't think that either the iPad 1 or iPad 2 are cheaply made mobile devices.

I agree that flash is on its way out--but its far from gone yet. I still routinely access webpages that use it-- and its useful to be able to view them. Restaurant websites, hotel websites, and plenty of videos are still flash only. Again, I've got no particular love for flash, but until HTML 5 fully takes over its nice to have it.

Two suggestions:

1. Many large businesses have apps in the app store. If there are particular restaurant or hotel chains you frequently deal with, it's worthwhile to see if they have apps and download them.
   
2. If you do business with restaurants and hotels that have Flash-only sites, I suggest telling them that their sites are obsolete. Tell them that Adobe has stopped doing Flash development on mobile devices, and they should update their site to HTML. Not all businesses will welcome such advice, but some will. This is the way we accelerate the removal of Flash from the web!

As to the flash exploits, there is an entire world of hackers looking for any exploit they can use at all. Once flash is gone, they will move on to something else. One can dig up a multitude of articles that reveal problems everywhere.

Did you see the sans.org quote from this message in the thread:

Isn't it about time that we drove a stake through the heart of PDF and started over? This time, let's not include stupid cruft like JavaScript, Flash, and Universal 3D in a *DOCUMENT* format.

Adobe has a long-standing history of highly promiscuous software, and that dumb tradition continues to this day. There is no good reason for the Adobe Reader to execute embedded JavaScript or Flash; that only helps the hackers. This is not 1999; Adobe has absolutely no excuse for failing to secure their software.

Apple has done a far more successful job in securing iOS from hackers. The per-app filesystem firewalling is a great innovation for preventing a badly-behaving app from affecting any other apps. The app store model makes it far more difficult to run arbitrary code on an iPad or iPhone. This is not just my opinion; you will find the same conclusion from Steve Gibson on the podcast Security Now.

As Flash fades to black, I believe the internet will become a far more secure place.