Biz & IT —

The big problem with Microsoft’s Flash whitelist

Desktop browsers and whitelists are a bad mix.

Who wouldn't want to click on that advertisement?
Enlarge / Who wouldn't want to click on that advertisement?

I was taking a look through Windows 8's Video app and I noticed an advertisement for the new Adam Sandler movie, That's My Boy, which takes a look at the lighter side of, uh, statutory rape (he fathers a son in his early teens with a schoolteacher). Curious as to just how they could make a comedy from such an unlikely premise, I clicked the ad.

I am on the edge of my seat. I literally cannot wait to find out about this excellent movie.
Enlarge / I am on the edge of my seat. I literally cannot wait to find out about this excellent movie.

The ad opened up the film's website in the Metro-style Internet Explorer browser; this will be the default on any Windows 8 machine. The site's homepage is just a splash screen; you have to click through to see the meat of the site. Which I did.

Curses!
Enlarge / Curses!

I was greeted with an essentially blank page saying that I need to have Flash installed.

Although Internet Explorer 10 includes an embedded version of Flash, it's subject to some limitations. The desktop browser can use the embedded Flash to view any Flash content, but the Metro-style browser cannot. Microsoft has a special whitelist of sites that are allowed to use Flash. Any site not on the list has to offer plain HTML content.

Unfortunately, the site advertising Sandler's latest magnum opus is not included on this whitelist. While the site does have HTML5 content, it only offers it to mobile browsers.

Metro-style Internet Explorer isn't a mobile browser. It doesn't even have the option to pretend to be a mobile browser. So the fallback content is off-limits. It's Flash or nothing.

(Now, you can tell the Metro-style browser to load the same page in the desktop browser, but that's not a very good option. The desktop browser isn't very pleasant to use on a mouseless tablet, and switching from the Metro-style browser to the desktop browser means saying goodbye to your current session and history.)

There are two problems here. First is the lack of joined-up thinking evident in Microsoft's advertising department. It's probably just a beta problem, but there needs to be better communication between the ad agencies and Microsoft. Ads that link to Flash-based websites just won't work in Metro, because Metro-style Internet Explorer won't be able to view the sites.

Still, a little more care and attention should sort that problem out. Harder to solve is the problem of sites needing Flash in the first place. Whenever a browser requests a webpage, it sends a piece of text identifying the exact browser version, called the "user-agent" string, to the server. Sites like the That's My Boy page examine the user-agent, and if it's one that belongs to a tablet or smartphone platform, they redirect to appropriate HTML5 content.

That's going to be difficult to do for the Metro-style browser in Windows 8, however. Not only are sites simply not built to detect a beta browser on a beta operating system yet, they're also unable to use the user-agent to distinguish between the Metro-style browser, with its whitelisted Flash, and the desktop browser, with its universal Flash. Internet Explorer sends the same user-agent from both versions.

Microsoft's desire to move away from plugins and switch to standard HTML5 is all well and good, but it depends on sites giving the browser HTML5 content when they can. If they're going to detect it as a desktop browser and treat it accordingly—which means giving it Flash—then Microsoft's whitelisting approach is going to result in unsatisfactory user experiences.

Using the same user-agent between both browsers does make sense. Microsoft wants the browser to be sent the full desktop sites, not cut-down mobile sites. That's a reasonable thing to do for the kinds of machines that Windows 8 will run on. The problem is that full desktop sites expect full desktop browsers, and full desktop browsers support Flash.

Microsoft is trying to have it both ways: the same rich content that sites deliver to desktop users, with the same restrictive environment that mobile browsers offer. If Metro-style Internet Explorer 10 had a different user-agent, it would be easy for sites to give the no-Flash variant the HTML5 versions they have for tablets. If Flash was enabled across the board, Internet Explorer 10 could be safely treated as the desktop browser it really is, even in Metro. But as things stand, it's neither a full desktop browser nor a detectable mobile browser, and it leaves users stuck in the middle: they're given Flash sites, without any good way of actually using them.

Channel Ars Technica