The funny thing is, this change would convince me to install the Flash plugin for Firefox. I've long used a different browser if I needed Flash because I didn't want the separate dependency to update that has a lot of security flaws. (Since IE/Edge and Chrome include and auto-update it). Now, I can safely install Flash on my Firefox, and know that it won't affect anything unless I explicitly permit it.
I am generally against browsers acting against user desires for compatibility. (And specifically, backwards compatibility, which the web should strive to be.) I would argue that blocking Flash is an antifeature, but providing a security gate, like not running it by default, is a security feature.
You can actually get that now. Firefox lets you set plugins to "Ask to Activate" and as far as I can tell it uses some logic like the article talks about foe whether it notifies you to activate or not. I've had it set to that and I only seem to get popups when there's a giant main video or I click a button on the page that tries to use flash for something.
The thing is Flash keeps browsers from being backwards compatible without either reverse engineering the Flash Runtime or working directly with Adobe under their terms on the proprietary Flash Player codebase.
This is why mobile browsers and unpopular systems can't access Flash content. In effect Flash breaks backwards compatibility across platforms.
I don't think the top 10 white list is the best idea, I just meant I can see where they are coming from and I don't think it is evil.
I uninstall flash entirely, never install it in the first place and/or do not use browsers that come with any proprietary plugins. I expect most people here on HN each have their own preference that largely defies attempts to clean categorization in statistical terms.
But most other users probably can be lumped into categories that aren't "misc" or "other". Anything that gets a larger chunk of web users safer and hopefully away from flash is good by me. I mostly care about the practical results, so bring on the "security gates", white lists, black lists and in general down with flash and the cesspool of security vulnerabilities it exposes people too.
I am generally against browsers acting against user desires for compatibility. (And specifically, backwards compatibility, which the web should strive to be.) I would argue that blocking Flash is an antifeature, but providing a security gate, like not running it by default, is a security feature.