Flash Objects - What can they access? 1

[1DMF]

Hi,

If you embed an SWF file into your html page, what if anything can the flash object glean from the site / page it is hosted on or the user that may click on the object?

Thanks,

1DMF

"In complete darkness we are all the same, it is only our knowledge and wisdom that separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!"
Free Electronic Dance Music

 

[ChrisHirst]

About as much (or as little) as javascript can, the same client side restrictions apply

You could of course run Helix or Adobe's Media Server to provide server side access for ActionScript in Flash 'movies'.

Chris.

Indifference will be the downfall of mankind, but who cares?
Time flies like an arrow, however, fruit flies like a banana.
Webmaster Forum

 

[1DMF]

No, we don't want flash!

A lender has provided this months banner advert as a flash SWF, and I am concerned regarding what they might be able to leach from our site and our members via the flash object.

So you are saying allowing 3rd party flash objects on your site is like allowing them to have their own JavaScript library embedded and all the functionality that goes with it.

Basically a massive and unacceptable security risk?


"In complete darkness we are all the same, it is only our knowledge and wisdom that separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!"
Free Electronic Dance Music

 

[ChrisHirst]

Basically a massive and unacceptable security risk?

That would depend on the visitor's browser setting and what "flash objects" are allowed to do, from a server point of view it has little on no implications, as Flash is 100% a client side and other than the URL it was loaded from has no information at all.

Chris.

Indifference will be the downfall of mankind, but who cares?
Time flies like an arrow, however, fruit flies like a banana.
Webmaster Forum

 

[1DMF]

I assume it can still interrogate the page HTML it is embedded in and client browser stuff just like JS can?

"In complete darkness we are all the same, it is only our knowledge and wisdom that separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!"
Free Electronic Dance Music

 

[ChrisHirst]

Actually it can't, not natively anyway you have to create 'hooks' between "your" document and the flash object.

Chris.

Indifference will be the downfall of mankind, but who cares?
Time flies like an arrow, however, fruit flies like a banana.
Webmaster Forum

 

[1DMF]

So I have nothing to worry about with 3rd party flash adverts other than a click count they may have programmed to be sent back to their server?

"In complete darkness we are all the same, it is only our knowledge and wisdom that separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!"
Free Electronic Dance Music

 

[ChrisHirst]

That's pretty much it, and of course any self-respecting advertiser will have some form of impression/click tracking in their advertising campaigns.

Chris.

Indifference will be the downfall of mankind, but who cares?
Time flies like an arrow, however, fruit flies like a banana.
Webmaster Forum

 

[1DMF]

That's pretty much it

Thanks Chris, that's at least alleviated my immediate concerns. It's still horrible having flash with all the z-index issues and parent div / onmousedown event work-a-rounds you have to implement, so we won't be allowing them on the new shinny members area '3.0' HTML5 site when launched.

and of course any self-respecting advertiser will have some form of impression/click tracking in their advertising campaigns.

Well that's to be discussed in depth, it's a bit of a bone of contention, last thing you want to do is provide someone who spends a lot of money on advertising with you, a report that shows only 2 clicks that week, they might stop spending money with you, better to not have stats from our perspective than bad ones ;-)



"In complete darkness we are all the same, it is only our knowledge and wisdom that separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!"
Free Electronic Dance Music

 

[ChrisHirst]

Maybe but an intelligent advertiser would be looking at conversions from campaigns rather than pure volume.



Chris.

Indifference will be the downfall of mankind, but who cares?
Time flies like an arrow, however, fruit flies like a banana.
Webmaster Forum

 

[1DMF]

True and to be fair it's not really that type of advertising most of the time, it's simply 'brand awareness', nothing to convert, just a subliminal constant reminder, on strategic pages throughout the system.

"In complete darkness we are all the same, it is only our knowledge and wisdom that separates us, don't let your eyes deceive you."

"If a shortcut was meant to be easy, it wouldn't be a shortcut, it would be the way!"
Free Electronic Dance Music