Great to be in a community where discussions (another one here) turn into actions. Bill and Mark from Adobe gave the good news that Flash Lite 3.0 security issue will be solved soon on S60 devices, in cooperation with (Forum) Nokia.
Thanks!
Usually, when new version of a software is released, we cheer, considering things will get better and easier. As we were expecting things would be easier for developers, we cheered up for Flash Lite 3.0’s features, however that couldn’t be more than wrong and it turned out to be a big pain for us. Moreover, there doesn’t seem to be any short term solution, and no one guarantees there will be one in mid or long term. I would like to write my reasons why I think so, and warn Adobe, Nokia and developers for a potential threat, which will not be long to come.
Flash Lite 3.0 came with Flash 8 engine, and together with Security Sandbox ‘feature’. This might make sense for browser plugin, but doesn’t make any sense for standalone player. Nick has a really nice post about this issue, which is almost 1 year old, can give an idea about the past and future of the problem.
Ok, what’s wrong with ‘Security Sandbox’? Isn’t security something good? Well, security is good when it’s used in convenience. If you use security for a case where doesn’t make any sense or bring an added value, you end up making life difficult for developers and users. Problem about this new Security Sandbox is; you either can have a local connection (i.e loading local files), or can a network connection (i.e connect to internet). This ‘feature’ not only brought an unnecessary pain to us (developers), but also broke backwards compatibility. How? Simple: If you have a Flash Lite 1.x or 2.x movie using local and network connections at the same time, it simply won’t work on Flash Lite 3.0 (which means new phones like N95). Wasn’t the biggest problem on mobile world fragmentation?
Problems not only end with those on ‘Security Sandbox’ feature. It’s not possible to do localhost calls, which disables any connection from Flash Lite to outer world. Why is this something bad? Well, there are many 3rd party projects extending Flash Lite via localhost (the only way left to us, because 3rd party application launch is limited by Nokia), such as KuneriLite, Flyer and Janus. These projects help Flash Lite to expand beyond its capabilities and enable people to create richer applications, which can compete with native S60 applications in look and performance.
Luckily, there is a ‘best of worst’ trick that solves those problems. There is a magic folder in ‘C:\data\others\trusted’ (that’s another pain, I will come to that shortly), which disables ‘Security Sandbox’ and enables applications to communicate both with local and network, as well as localhost. Why is this a ‘best of worst’? Simply because whatever you put into this directory is visible under ‘Gallery’ which brings a very bad user experience and many security concenrs within.
This issue will be even more cronic, if Adobe or Nokia doesn’t make any move; because ‘trusted’ folder will not be available anymore for S60 3.2 devices. Which will kill all developer efforts and backwards compatibility forever. We are not sure if Adobe or Nokia will solve this problem, but crossing our fingers hoping someone sees our S.O.S fire.
I mentioned Security Sandbox problem and a ‘best of worst’ solution to that above. Now see another pain closely related to this subject.
S60 devices have ‘Phone Memory’ (PM) and ‘Memory Card’ (MC). Users are given the option to install their applications to PM or MC. As you know, to solve Securiy Sandbox problem, we need to install Flash Lite applications to those ‘Trusted’ folders that exist both on PM and MC. So what is the problem? With a clever(!) move, ‘Trusted’ folder is located at different paths on PM and MC. It’s at C:\Data\Others\Trusted\ on PM and E:\Others\Trusted\ on MC. Yeah, but what is the problem? Well simply, it’s not possible to install applications (SIS packages) to different folders on PM and MC, and this breaks Symbian Signed criterias. So, Flash Lite 3.0 applications either will work on PM, or MC. And in that way, you can not get your appliction Symbian Signed.
There is no solution we could find for that yet. If we can not; it will not be possible for anyone to Symbian Sign their Flash Lite applications on Flash Lite 3.0 phones (from my current understanding).
Well, Security Sandbox is not the only problem. There is a serious bug on Flash Lite 3.0 with XML sockets. Simply put, it’s not possible to receive data via XML socket shorter than 1+ seconds, which kills if you need to stream data.
Most clear example for that is using KuneriLite Accelerometer plugin with Flash Lite. Naturally, to use axis values, you need to get those values at least 4-5 times per second; so that you can reflect it to your application. But because of this bug, you can get data only 1 time or less per second, which makes it impossible to use.
See the this Forum Nokia thread for more information on that subject. And as far as we see, there is no solution offered yet.
I tried to state my reasons, why Flash Lite 3.0 is a potential show-stopper for developers, users, enablers and many more on S60 devices. Nokia keeps on spreading this problem via Firmware updates and pushing Flash Lite 3.0 player to earlier phones (i.e Nokia N95 Classic), supporting and triggering fragmentation. With the introduction of S60 3rd edition Feature Pack 2 devices, these problems will be impossible to solve and Flash Lite player will get fragmented at least for couple of years, which will delay market entrance that is already delayed for long time and still immature. What I would like to see is some action from Adobe and Nokia, leaning on this subject and listening to us to avoid a big potential problem awaiting all Flash Lite users and developers in short term.
Please leave me your comments if you have any.
cheers,
Ugur.-
Adobe announced the Adobe Open Screen Project which is dedicated to ensuring a consistent rich Internet experience across a broad range of digital screens and form factors including mobile phones, consumer electronics, televisions and personal computers. This experience will be driven by Adobe Flash Player and in the future Adobe AIR and is meant to ensure that designers and developers can focus on the consumer experience and know there efforts will scale across different platforms and screens. Simply put the mission of the Open Screen Project is meant to enable a consistent runtime environment for designers and developers across desktops and devices.
You can read details on Bill’s post or see FAQ here.
There has been a wave of news originating from Anand’s post lately about Flash Lite 3.1 made available for OEMs. *Personally* I don’t see this as a big news, due it’s for OEMs, and I don’t see any large scale OEM to go for that, due most of them already licensed Flash Lite from Adobe: No big impact for Flash Lite developers.
Today Mark Doherty (Manager of Developer Relations at Adobe Mobile and Devices - EMEA) provided official(?) details about upcoming Flash Lite 3.1 and its features. According to Mark; Flash Lite 3.1 does not offer big difference, but some improvements like;
Looking forward to see first S60 FP2 device shipped and test Flash Lite 3.1. And thanks to Mark for providing us details.
Bill posted a really great resource: Flash Lite market percentage (as of January 2008). Those numbers are from U.S and Western Europe and give quite good impression of the target market in those selected regions. Listed numbers include Nokia S60, Nokia Series 40, Sony Ericsson and BREW. It’s especially great to see the numbers of devices separately for each platform as well. I always thought UK had the most S60 devices in Europe, however it’s clear that Italy is the leader.
Tomorrow there is an interesting seminar that will be presented by Stephen Ellis (Forum Nokia) and Bill Perry (Adobe): Flash and Mobile Browsing.
There will be Question and Answer at the end of the seminar, therefore do not miss the chance to ask your questions and get the answers from first hand!
Date and time:
15th April 2008
Check Bill’s blog post for more details.
Adobe just launched a Flash Mobile Gallery containing Flash Lite screensavers, wallpapers, games and applications. You can see elite examples of Flash Lite content with a demonstration, description and reference to their developers.
Adobe announces today that Microsoft has licensed Adobe® Flash® Lite™ to enable Flash Lite content within the Internet Explorer Mobile. Microsoft also licensed Adobe Reader® LE software for viewing Adobe’s PDF Documents.
Great tutorial by Alessandro on Adobe Developer Center; How to protect Flash Lite content with OMA DRM 1.0.
Developers, content providers, and operators are all involved in protecting mobile content. Digital Right Management (DRM) is an important issue in the mobile world and it is a complex environment to work with. Open Mobile Alliance DRM (OMA DRM) can be used to protect Flash Lite content. OMA DRM has two specifications 1.0 and 2.0. Both DRM solve the same problem – protecting content. I will briefly explain the differences in OMA DRM 1.0 and OMA DRM 2.0 and how to apply OMA DRM 1.0 Forward Lock to Flash Lite content. Note that this is not an easy topic and it is important to understand all entities involved in the process of protecting content.
This year we will be in Mobile World Congress in Barcelona at the Adobe stand. We will showcase new release of KISS60, KuneriLite and some of our other Flash Lite products. Stop by if you would like to meet us or learn more about what we do. I also will be giving a theater presentation “A New Approach to S60 Application Development”. Will be happy to see you there.
Adobe booth;
17:00 - 19:00 on February 11, 12, 13 Demo Station 2 (Hall 1, Stand 1E05).
Theater presentation;
12:40 - 12:55 on February 11, 12, 13 and 14
16:20 - 16:35 on February 11, 12 and 13 (Hall 1, Stand 1E05)
