Well, at least kill the need for Flash on the iPhone? Daring Fireball says a simple “yes” to Yahoo! Tech’s question.

The idea is that a standards based technology, open and broadly used, could make redundant proprietary and sometimes bloated and buggy plugins like Adobe Flash, Microsoft Silverlight, and Sun JavaFX.

Apple’s Safari, including Mobile Safari on the iPhone, and Mozilla Firefox are already supporting HTML5 features. Microsoft’s Internet Explorer — so far — isn’t.

The article gives pros and cons for both sides of the debate. Since Apple is introduction the third generation of their iPhone software tomorrow, and still no Flash in sight, we likely have a good idea which way they’re leaning already…

This is a story by the iPhone Blog. This feed is sponsored by The iPhone Blog Store.

Could HTML 5 Kill Flash on the iPhone?

Back in August AT&T sent out a customer satisfaction survey to all iPhone owners. Well now it seems a new survey is being sent out to all of us on the AT&T network asking how the 2.1 firmware is working for us and what we want to see next on your iPhone 3G.

Now don’t get too excited yet! Just because they are asking what we want does not necessarily mean we will get it. Keep in mind Apple has stated before that certain features such as copy/paste and directional GPS take a back seat to other issues that need addressing so on and so forth. But it is better than AT&T and Apple flat out ignoring us right? So at least it is a start.

Apple Insider states:

The questionnaire asks owners to pick the top five hardware or software add-ons they’d like to see and include many of the most prominent requests made in the community, including cutting and pasting text, built-in instant messaging, Flash/Java support and MMS messaging.

So when and if you get this survey, be sure to speak your mind and let AT&T what know what you want. This is our chance… they seem to be listening. (Or at least they are pretending to be!)

[Via Appleinsider]

This is a story by the iPhone Blog. This feed is sponsored by The iPhone Blog Store.

You May Control the Future of Your iPhone! AT&T Survey Wants Your Opinion

Last week the UK ruled that Apple was misrepresenting the iPhone’s provisioning of “just the internet” due to the lack of support for two ubiquitously popular 3rd party plugins: Flash and Java. We’ve previously covered the will they/won’t they drama surrounding development and deployment of Flash and Java pretty much ad nauseum infinitum, as well as some seldom discussed yet surprisingly frightening concerns about Flash and its downright sneaky use of 3rd party advertising cookies.

More recently, however, another issue has come to light. Primarily concerned with Windows Vista security and how it can be circumvented, this issue throws a renewed focus on the danger of 3rd party plugins like Flash and Java, on how they interpret and run code on our machines, and how they provide an increasingly popular attack vector for bad guys (hackers, malware authors, identity thieves, etc.)

How does this all relate to the iPhone, and what about ZOMG! Can has my Flash vidz? Read on to find out!

Before we begin, I’ll just mention again that I’m a long time (10+ years) web developer who works quite a bit with Flash. I’ll also add that some coverage of the issues I’m about to get into has tended towards the sensationalistic. The sky is not falling. We’re not doomed. Or, at least, not because of anything to do with Flash, Java, or the iPhone.

Caveat’d enough? Good.

Back in early August at the Black Hat conference, Alexander Sotirov and Mark Dowd presented a paper amusingly titled How to Impress Girls with Browser Memory Protection Bypasses. While Vista security proper is beyond the scope of this blog, as Operating Systems like OS X on the iPhone become increasingly hardened against security exploits, the web browser becomes the path of least resistance for hackers to get at us and our stuff.

The iPhone’s browser, MobileSafari is currently the closest thing to a desktop-class rendering engine as can be found on a handset. It’s based on the same WebKit core as Safari for Mac and Windows, and so it’s not unreasonable to imagine it shares the same advantages (real HTML, CSS, and AJAX) and risks (can be exploited). This could potentially include buffer overruns, cross site scripts, and — yes — plugin vulnerabilities.

On a recent episode of the TWiT network’s popular Security Now! podcast, Steve Gibson summed up the problems with Flash and Java:

Their technologies, especially in the case of Java, Java has, deliberately has readable, writable, and executable memory because of the way it operates. o it’s a big target. And so many of these third-party things, which you could pretty much depend upon, you know, Flash player is installed in the high 90 percentile of Windows machines so you can count on it being there.

And what if we could likewise count on their being on the iPhone? What potential problem could that expose?

Certainly after this paper has come out where these guys demonstrate clearly the exploitability of Flash, which is not [Data Execution Prevention] compatible, it’s like, okay, Adobe, if you want your code in my machine, you make it safe. Because we’ve seen a bunch of Flash exploits here in the last few months. And, you know, this wouldn’t be possible if Adobe would do the work. I don’t care how hard it is, it’s certainly possible to code around this [...] Basically this is laziness. In this day and age, for Flash still not to be marked as DEP friendly when it is in a highly vulnerable environment, it’s not like it’s something down on your tray, it’s in your browser. And we know what a target browsers are just by their very nature. I mean, in fact, the whole focus of this paper was specifically browser vulnerability. [...] It is very common applications like Silverlight, like Flash, commonly used components, or even Media Player, that are invokable by the browser and still not yet safe, that is really now the main target of exploitation.

We’ve already seen MobileSafari exploits in the wild (indeed, a TIFF-based vulnerability was one of the first ways people found to jailbreak the iPhone 1.1.1 — just by entering a URL in the browser!)

Again, this is not breakworld stuff. No need to panic and lock your handset in a lead box. Future versions of Flash and Java (and similar plugins) will likely address these issues.

Just remember, for now, that the iPhone is tremendously popular, and thus will be a tremendously popular target for hackers. Apple already has to worry about securing the HTML, CSS, AJAX (Javascript), and Quicktime (which they own and can therefore rapidly address) components of Mobile Safari. Add to that the complications of 3rd party code interpreters with a very real history of not only exploits, but (in the case of Flash) for being bloated and buggy on the Mac (another thing Adobe has chosen not yet to prioritize fixing), and it begins to make more sense why we haven’t seen Flash or Java on the iPhone, a device that knows who we are (all our date) and where we are (3G aGPS).

But wait, other smartphones run versions of Flash and Java, though, don’t they? Sure, but I’d argue that the iPhone isn’t really a smartphone, it’s a mobile computer. Full darwin kernal, BSD networking — pretty much a UNIX box in your pocket. To me, that’s a far bigger target than Palm OS, the Java Micro Edition inside a Blackberry, and even Windows Mobile (which, despite the name, is a very different animal under the covers than Microsoft’s desktop OS).

And isn’t there a battle going on for the Rich Internet Application (RIA, aka WebApp) space? You betcha. Google didn’t just drop Chrome for no reason. SproutCore, Flash/Air, Silverlight/.Net, Prism, Safari, Java, etc. all want to own what’s likely the next major computing platform (the web “cloud”).

Bottom-line: Both for Apple and for consumers, the advantages for Flash and Java currently do not outweigh the drawbacks, especially as standard web technologies continue to decrease the gap between proprietary plugin capabilities and the open internet (HTML, CSS, AJAX).

That’s my opinion, at least. What’s yours?

This is a story by the iPhone Blog. This feed is sponsored by The iPhone Blog Store.

Flash and Java on the iPhone: Video Dream vs. Security Nightmare Redux

Casey already told us about how an iPhone ad was banned in the UK for “misleading consumers” about providing “just the internet”, and based on how many ZOMG! No Flash Vidz! comments we get, I’m going to go out on a limb and say most people probably share the belief that MobileSafari – ( Flash + Java) != the internet.

Fine.

But allow me to retort. As a long time web (and Flash) developer, however, I’m calling shenanigans on that, and on the UK Advertising Standards Authority. Flash and Java are factually and empirically NOT part of the open, standards based Internet (i.e. HTML, CSS, Javascript/AJAX). Flash and Java, along with things like SilverLight, Real, ActiveX, and a host of other proprietary add-ons are plugins, extensions, and otherwise additions to the Internet — with all the benefits and drawbacks that go along with that.

Like what? Read on after the break!

Okay, so Flash, Java, et. al. allow for some neat multi-media effects and interactivity (though HTML 5 and CSS are catching up), and some measure of portability (though never as much as they claim), but they bring in additional security and cross-platform problems as well.

The web is supposed to be a structured container (CSS) through which content flows (HTML), which is why MobileSafari can subtly reformat font sizes, line wraps, and other elements to suit the smaller screen and multi-touch interface. As an open standard, Apple can also integrate their own containers and attributes to, for example, define the screen size for rendering.

Flash? Kinda sorta sometimes if the developer puts the effort in. Being proprietary (even “open” proprietary), however, Apple can’t exactly make changes to the source to, you know, make a version that’s not as bloated and greedy as Adobe has long allowed the Mac OS X version of Flash to remain. To prove that point, Apple has significantly developed the plugin they do own, Quicktime, creating Quicktime X to better fit their mobile vision of the future.

All this to say that there are several very good reasons why the iPhone doesn’t support Flash, Java, and the other plugins. They may be reasons that can eventually be overcome with newer/better technology, or reasons some people may even disagree with, but for the UK to randomly pick those two plugins as being “the internet” just because they happen to be ubiquitous (compared the aforementioned Silverlight, for example) is as capricious as it is wrong headed.

Apple, as they themselves rightly point out, is delivering the full standards-based Internet to the iPhone. Any site coded to conform to those standards will work just fine on the iPhone. Any site deviating, or depending on plugin extensions won’t (as anyone whose ever tried to get a secure installation to “just add this Java widget” or “just download this ActiveX control” to enable some web conferencing or like utility will all too readily tell you).

Bottom-line, the UK is showing ignorance of the real web. Sure, I wants my vidz as much as the next Viddler, but I understand the issues behind these technologies, which is something the Advertising Standards Authority might want to do before banning commercials, right?

This is a story by the iPhone Blog. This feed is sponsored by The iPhone Blog Store.

Why the UK was Wrong to Ban the iPhone “Just the Internet” Ad!

Daring Fireball, via Digital Arts, brings word that Sun hasn’t stopped trying to bring a Java Virtual Machine (JVM) to the iPhone even though:

Apple has not been publicly receptive to having Java on its popular new device. There have been questions about whether Apple’s iPhone SDK agreement would permit this. The JVM potentially could sidestep Apple’s App Store program for dispensing iPhone applications.

And while Sun’s efforts continue, they’re also hedging their bets with Innaworks, who produces alcheMo, which may let Java programs compile as native iPhone apps, ready for App Store:

[I]nitially targeted at games publishers. Now in a beta release, alcheMo for iPhone can be used to port Java ME mobile games to iPhone and iPod touch without the need for further manual adjustments. The product features an optimizing translator to convert Java ME application source code to equivalent source code for iPhone, according to the Innaworks press statement on the product.

While Apple’s Cocao Touch development sounds like a more chocolaty, and much sweeter beverage than Java, Sun sure does seem determined. Of course, determination has a tendency to crash and explode in Matrix-like bullet time when it strikes up against the Zen-like immovability of one Steven P. Jobs.

I don’t think we’ll be seeing the steaming coffee mug on the iPhone any time soon. You?

This is a story by the iPhone Blog. This feed is sponsored by The iPhone Blog Store.

In ur SDK: Sun Still Brewing Java… Sorta…

Sun, the company that loves Java so much they made it their stock symbol, has announced that they’ve looked at the new Apple SDK and believe they can use it to bring Java VM (virtual machine) ME (micro addition) to the iPhone:

“We’re going to make sure that the JVM offers the Java applications as much access to the native functionality of the iPhone as possible,” said Java VP, Eric Klein.

Apple CEO Steve Jobs, having previously lavished Java with such praise as (paraphrased) “a ball and chain OS that nobody uses and isn’t worth supporting on the iPhone”, is no doubt in deep mediation over the news.

Java, the technology that enables everything from game-lets on other mobile phones to Blu-Ray’s interactivity layer, while not widely adored in the techsphere, is widely available and offers some cross-platform portability advantages for programers (who want to use their code on multiple OS’s).

Klein also mentioned the possibility of not only JavaFX (which supports Flash-like animation), but the full desktop Java implementation in the future.

Though Sun says they will deploy JVM via the AppStore coming with iPhone firmware 2.0, how exactly they will create what could be a competitive development environment is unclear.

Related news that may or may not provide some hints, however, comes from Apple itself:

..the iPhone SDK beta [...] includes a beta version of llvm-gcc 4.2 as part of the included Xcode 3.1 beta.

LLVM (low level virtual machine), may allow for this functionality, and will also help with (according to Ars Technica’s Siracusa), “Faster compiled code, faster code compilation, more metadata for the IDE, better portability, easier to improve all of the above.”

This is a story by the iPhone Blog. This feed is sponsored by The iPhone Blog Store.

In ur SDK: Sun Brewing Java for iPhone?