Apple Hates Flash [Archive]

Lemur

04-29-2010, 17:17

This is an interesting and important read. (http://www.apple.com/hotnews/thoughts-on-flash/)I can think of many, many counter-arguments, but I'm gonna leave it alone until you've had a chance to read it.

For those who haven't been following geek news, Apple has locked Flash out of all its mobile devices, and now does not allow apps created with Adobe middleware to even be considered as apps on iPhone or iPad. And Herr Fuhrer Jobs has declared that, "People who want porn should get an Android phone," which indicates to me that on some level he desperately wants the iPhone to fail.

Interested to hear Orgahs' reactions to the anti-Flash screed.

Beskar

04-29-2010, 17:38

Some of it doesn't sound that bad, but flash should be an optional plug-in anyway and up to the user.

Tellos Athenaios

04-29-2010, 17:41

A world with less Flash can only be a good thing. Amen. OTOH: A world with less of Apple's arrogance would be a much better place as well.
The question is thus: which do I dislike more? Rubbish websites that consist solely of a flash object to annoy everyone with fluttery effects, site sprawling with invasive in-your-face advertising on the one hand; or a totalitarian view on what people are allowed to do with their own property?

Tellos Athenaios

04-29-2010, 18:14

Some of it doesn't sound that bad, but flash should be an optional plug-in anyway and up to the user.

It's mostly a load of waffle. Point by point:

(1) That you employ `open' standards does not make your product `open'. In particular: how is the platform any more open when
writing an application in Object-C coded against specific iPhone libraries than when coding a Flash game?
(2) The “full web” is a completely irrelevant argument. It does not matter one jot whether or not the entire “web” is pro-actiely made accessible to iPhone users, or whether it in fact already is;
what matters is whether or not iPhone users are deliberately banned from doing things with their phone that Jobs does not approve of.
(3) Reliability security and performance? Really? I was not aware that the iPhone itself, or indeed any iPhone application submitted to the App store, receives a proper security audit.
We would probably not have had jailbroken iPhones had they practiced their own preaching: the root account would have been *disabled* for a start. Apart from which it should be
pointed out that security, reliability, and performance on the web is well beyond Apple's entitlements and abilities to impose on the world: XSS, CSRF and similar acronyms aplenty to prove them
wrong, time and again. Performance can be murdered by any application. Simply by the virtue of not having proper multitasking included in the OS. :oops:
(4) Battery life can be killed by any piece of software. This is hardly unique to Flash. It's the same argument as (3), just called differently. And there is still nothing that prevents a coder from
re-inventing the wheel, and whack together his own video decoder in his own video player. Yes: nobody in his right mind is going to do that; possibly excepting purely to make a mockery of Apple here.
(5) Well, yes. The same holds true for CSS you know. And you still have the most important mouse function available: the click.
(6) Completely missing the point of a cross platform language. The point is *exactly* to have a subset of what each individual platform offers; which is considered suitable for the application's requirement, and then use *that* to code an application for *all* those platforms.

Crazed Rabbit

04-29-2010, 19:35

Apple knocking someone for a lack of 'openness' is hilarious.

An Android Developer: (http://www.tbray.org/ongoing/When/201x/2010/03/15/Joining-Google)

The iPhone vision of the mobile Internet’s future omits controversy, sex, and freedom, but includes strict limits on who can know what and who can say what. It’s a sterile Disney-fied walled garden surrounded by sharp-toothed lawyers. The people who create the apps serve at the landlord’s pleasure and fear his anger.

Oh, they can kill the apps you buy whenever they like (http://www.telegraph.co.uk/technology/3358134/Apples-Jobs-confirms-iPhone-kill-switch.html). Aside from already controlling with an iron fist which apps get in and what developers can do (http://www.eff.org/deeplinks/2010/03/iphone-developer-program-license-agreement-all). And, of course, why allow open source free apps when you can only allow expensive apps that aren't from your competitors?

CR

Beskar

04-29-2010, 20:09

This is where government regulation usually saves the day, so it isn't as bad as they make out, as this will not be enforced, especially in Europe.

Xiahou

04-30-2010, 02:43

Husar

04-30-2010, 10:20

Tello Athenaios really nails it even if half his post was full of things I don't entirely understand.

Though I would like to add/correct a bit.

Firstly, it can take up to a month or more from the time a developer hands in any app to when it actually appears in the AppStore, this is because Apple does test them.

Secondly, this testing sort of reared it's ugly head when they refused the Opera browser, reason unknown to me and an Amiga emulator because, as they said, it allowed the execution of external code, which is a nono for security concerns, yes, I just read the thing about root access but doesn't mean you have to make the door wide open IMO.

Thirdly, Opera Mini has been allowed lately and I'm using it all the time now, this was surprising even to me, but may be because they just launched their own advertisement service for apps that will probably make up for the lost revenue due to people using Opera instead of Safari.

And concerning Adobe, I hate them, more than Apple(look, I got an iPhone and it's really nice but that doesn't mean I have to love Apple or think it's perfect), they got a quasi-monopole on image editing software and Flash is just...well, it doesn't work correctly in my Linux Opera(no, not going to use Firefox except for a few flash videos), there was no 64bit Linux version at all last time I checked and even in Windows it's using ressources like crazy and generally acting up now and then. Like apple, I can't wait for html5.
Oh and I use Corel Graphics Suite 12, it's perfectly fine for doing all the things I want to do with pictures, gimp works, too, although I hate the layout.

Concerning openness, it has benefits and drawbacks, the android store is open it seems but I read it got flushed with fake homebanking apps that would steal your login data and bank passwords before it was detected and they were deleted, it seems such programs would not get through Apple's testing which I consider a great plus as I can trust that at least around 99% of what the AppStore offers me is actually safe and not a package of viruses and trojans(doesn't mean it's bug-free and flawless but most apps get quite a few free patches with new features, sometimes complete redesigns, bug fixes etc.).

Tellos Athenaios

04-30-2010, 16:48

Apple certainly does test them to some extent. But one of the things it does *not* do is return the developer the results of the testing. Mostly a simple “no” or “yes”. It's more of a backlog of applications waiting to get the rubber stamp than extensive security auditing (which would see them return you an extensive documentation of vulnerabilities found, if any).

In fact one could make the case that if they were so very concerned about security they would hail the likes of Java (and to a lesser extent Flash) as a Good Thing. After all, it is much harder to write a Java application that crashes the underlying OS due to the fact that any half decent underlying VM takes away many of the common attack vectors for arbitrary code execution (buffer over/under-runs, stack smashing, and generally everything to do with unmanaged pointers and references). C++ & libraries is a much less secure `platform' than Flash is. Let's entertain the following scenario:

You write an application that handles transactions of some nature and thus has to do with sensitive data from a user account. You are not an experienced coder; in fact your natural inclination would be to write your application in Flash. You can't because Jobs doesn't like it; so instead you write an application in C++. How hard can it be? Now you don't like it when people have to sign on every time: you want your application to remember their authentication details for them. You are not stupid: you know that saving a password in plaintext is not a good idea, generally speaking. Assuming that the server where you authenticate with your credentials expects both user name and password to be encrypted with SHA-256 hashes you cook up the following text file format:

url = http://www.auth-domain.com/path/to/app?query=string&params=values
name= sha-256-of-account-name
pass = sha-256-of-account-pass

What would an attacker have to do but overwrite the URL field, conditionally, disguised in a silly game? But more subtly: is your application prepared for a malformed sha-256 that is *not* 256 bits long? If you read that as binary data and you attempt to read a byte buffer of exactly 64 bytes from name where there was only "hook-line-and-sinker" what will hapen? You will read: "hook-line-and-sinker\x0Apass = "+58 characters of pass.

This type of attack, incidentally is not as uncommon as you might hope. It can happen to *any* application that uses the scanf() family of functions to interpret a line as a formatted string and extract the formatted data from it. The typical result would be a segfault.

Lemur

04-30-2010, 20:46

CEO smackdown! Adobe bites back! (http://blogs.wsj.com/digits/2010/04/29/live-blogging-the-journals-interview-with-adobe-ceo/)

Direct video link. (http://online.wsj.com/video/adobe-and-apple-ceos-square-off/5C074A32-B7A3-47EC-9B53-E7A8A5A04E49.html)