Security for Informatics

Adobe Flash continues its long, slow fade from the mainstream. The latest step is today's announcement that the next release of Microsoft Edge will disable Flash by default, giving users control over whether and when Flash-based content runs.

The feature will appear in upcoming Insider Preview builds and will be released to the general public in the Windows 10 Creators Update, which is due to arrive in early 2017.

By enabling Click-to-Run functionality for Flash content in its built-in Windows 10 browser, Microsoft is matching announced plans from other browser makers, including Apple's Safari, Mozilla's Firefox, and Google's Chrome.

With Click-to-Run enabled, Microsoft Edge will default to HTML5 content when it's available. Here's how Microsoft describes the new feature:

The new move is a continuation of a feature released in the July 2016 Anniversary Update, in which Microsoft Edge selectively pauses "certain Flash content, like ads," if that content is not central to the page.

Both Google and Microsoft have opted to whitelist a set of popular sites that rely on Flash. Microsoft says it plans to "actively monitor Flash consumption in Microsoft Edge and will gradually shorten the list of automatic exceptions."

When Flash is the only option for playing content on a page opened in Microsoft Edge, the user will see a click-to-run prompt like this one:

The decline of Flash began in earnest in 2010, when Apple chose to ignore Flash-based content in its iPad. CEO Steve Jobs outlined the reasons in a public letter that focused on reliability, performance, and especially security problems with Flash. At the time, Flash was a major vector for malware, and Adobe was not taking the problem seriously.

In recent years, Flash has improved on that record through a more aggressive update policy. In Chrome and Microsoft Edge, the Flash plug-in is included by default and updated as part of the operating system.

Microsoft's advice to web developers is to leave Flash behind and instead "migrate to standardized content delivery mechanisms, such as HTML5 Encrypted Media Extensions, Media Source Extensions, Canvas, and Web Audio.