<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<link href="chrome://translator/skin/floatingPanel.css"
type="text/css" rel="stylesheet">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I had this warning the yesterday saying that flash is unsafe and
that I should upgrade it. I upgraded it and was surprised to see
that after the upgrade I received the same notification.<br>
<br>
In the end I had to use Chrome to watch the video that I was trying
to watch... this will obviously drive people away from Firefox and
over to Chrome.<br>
<br>
/Mike Ratcliffe<br>
<br>
<div class="moz-cite-prefix">On 14/07/2015 09:13, Mark S wrote:<br>
</div>
<blockquote
cite="mid:CAL2S=5p56se2q4qtNAR70v-Q56+iotRo6Mxn26wsxKMjHtV8Eg@mail.gmail.com"
type="cite">
<div dir="ltr">Right now we are (rightly) blocking all versions of
Flash because of unpatched vulnerabilities. I've seen signs
that this is causing much confusion and frustration for users -
and many users are going to blame Firefox. <br>
Chrome's Flash currently has the same vulnerabilities but Chrome
is doing nothing to block or mitigate the problem. So users
will see that Chrome "just works."<br>
<br>
We present an alarming notification bar telling people that the
plugin is unsafe.<br>
<a moz-do-not-send="true" href="http://i.imgur.com/vocQhtk.png">http://i.imgur.com/vocQhtk.png</a><br>
This is great, but does not lead users towards being informed or
finding a solution. This is confusing and frustrating for users
who are wondering "What's going on?? How do I fix this?"<br>
<br>
As of this writing there *is* no solution, but we should at
least make it easy for users to know this and help them
understand why or else they are likely to think that Firefox is
the problem.<br>
<br>
I suggest a "Why?" button or link be added to the bar that
allows users to see more information. <br>
<br>
It has been pointed out that the Plugin Check page ( <a
moz-do-not-send="true"
href="https://www.mozilla.org/en-US/plugincheck/">https://www.mozilla.org/en-US/plugincheck/</a>
) clearly states that all versions of Flash are vulnerable, but
getting to this page is non-obvious and doesn't appear
associated to the problem when users encounter a
Flash-containing page.<br>
<br>
Following the "More Info" link from Flash in <a class="moz-txt-link-freetext" href="about:addons">about:addons</a> can
get <a moz-do-not-send="true"
href="https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p946">https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p946</a>
which is not nearly as clear. It sounds like it's just an old
version and needs updated. Most users however will not get to
this page as they will not organically browse to the
<a class="moz-txt-link-freetext" href="about:addons">about:addons</a> > Plugins section.<br>
<br>
Perhaps we did not originally run under the assumption that a
plugin could be so thoroughly exploited and unpatched with no
update available.<br>
<br>
We need to connect the problem more directly to the "solution"
for our users and the current notification fails to do this.<br>
<br>
P.S. It has been pointed out that clicking on the alarming lego
brick in the location bar (which we can assume most users will
not do) contains a link titled "What's the risk?" This link
takes users to... <a moz-do-not-send="true"
href="https://get.adobe.com/flashplayer/">https://get.adobe.com/flashplayer/</a>
which has been described as "less than stellar" aka kinda
ridiculous.<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
firefox-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:firefox-dev@mozilla.org">firefox-dev@mozilla.org</a>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/firefox-dev">https://mail.mozilla.org/listinfo/firefox-dev</a>
</pre>
</blockquote>
<br>
<div style="bottom: auto; left: 656px; right: auto; top: 56px;
display: none;" class="translator-theme-default"
id="translator-floating-panel">
<div title="Click to translate"
id="translator-floating-panel-button"></div>
</div>
</body>
</html>