[Assist] lightspark+gnash

Denis 'GNUtoo' Carikli GNUtoo at no-log.org
Wed Jun 25 21:24:45 GMT 2014

Hash: SHA1

On Tue, 24 Jun 2014 10:36:06 +0900
"taro-k at movasense.com" <taro-k at movasense.com> wrote:

> Hi,
> I didn't try lightspark because gnash is much more active.
> http://git.savannah.gnu.org/cgit/gnash.git/log/
> https://github.com/lightspark/lightspark/commits/master
Both could work together, and I guess it didn't change: lightspak
handled the newer version of flash which is totally different, and was
falling back on gnash for the older versions.
So the question is rather if gnash now handles the new versions of the
flash vm, like AVM2.

> the gnash website says we can play youtube with gnash
Well, it's rather youtube that was friendly enough to adapt itself to
gnash. They downgraded their flash version when they were detecting

> Some other websites can work and the others cannot with gnash.
> FSF is saying gnash is one of the most important projects.
> So if you are developer, you will find a lot of things to do there :-)
Yes, in one hand not beeing able to run flash animations and videos is
a pain for free software (many people install flash instead).

In another hand there are a lot of workarrounds which permit not to
need a flash virtual machine. As a result the non-free action script
which is inside the flash file isn't run.
The problems are similar than javascript, and indeed action script is
very similar to javascript.

> And if you must run some websites with flash right now,
> I recommend an isolated OS with adobe-flash at this moment.
Some issues here:
1) adobe flash is non-free and has known privacy issues (for instance
the flash cookies, but there might be some others too).
2) depending on non-free software should be avoided at all costs, now
it'f your web browsing, then tomorrow it's your email, and so on, at
the end your main computer becomes that isolated OS. Then the isolation
became pointless.
3) Isolation is hard to do right:
   - if you run it on a vm, then vm escape is easy to do.
   - if you run it trough selinux it will be a pain to ajust the
     policies: the automatic tools don't do everything.
   - if you run it on separate hardware, then it's still an issue if
     the separate hardware has microphones, cameras and so on. gpg key
     extraction can be done by using a microphone under certain
     conditions, and keylogger is probably way more easy.

Version: GnuPG v2


More information about the Assist mailing list