Date: 2017-04-23
Title: Flash and LSO cookies
Author: Nathanaël Naeri <nathanael-naeri/at/users.noreply.github.com>
Valid for: Ubuntu 14.04+
Valid for: NPAPI and PPAPI Flash Player (plugins) 25.0
Valid for: Fresh Player Plugin (wrapper) 0.3.6
There are two Flash Player plugins available for Linux: one that uses the legacy Netscape Plugin API (NPAPI) to interface with the browser [1], and another that uses the more modern Pepper API (PPAPI) instead [2,3].
Chromium and Chrome only support the Pepper API to interface with plugins, and can therefore only use the PPAPI Flash plugin. Firefox only supports the Netscape Plugin API, and only for the NPAPI Flash plugin since version 52: support for all other plugins has been dropped, as the web moves away from plugins [4]. Mozilla is exploring the possibility to use the Pepper API for Flash in the future [5], but they may just drop all Flash support instead.
To complicate the matter, a PPAPI-to-NPAPI wrapper (converter) exists that makes it possible for the PPAPI plugin to present to NPAPI-compatible browsers as a NPAPI plugin [6]. This piece of software was designed because Adobe stopped developing the NPAPI plugin for Linux from 2011 to 2016, focusing instead on the PPAPI plugin. With the NPAPI plugin stuck at version 11.2, it became desirable for Linux users of NPAPI-compatible browsers to be able to use the PPAPI plugin through the PPAPI-to-NPAPI wrapper. The reverse wrapper, NPAPI-to-PPAPI, does not exist.
The NPAPI and PPAPI plugins are not exactly the same, and certain features are not fully implemented in the NPAPI version, such as GPU acceleration of 3D graphics [7]. To enjoy these features, it is necessary to use the PPAPI plugin through the PPAPI-to-NPAPI wrapper. If doing so, note that the version number reported by the wrapper in about:plugins might be wrong [8,9,10]: check with www.adobe.com/software/flash/about instead.
Both the NPAPI plugin and the PPAPI plugin are binary files, named respectively libflashplayer.so and libpepflashplayer.so, that can be downloaded from Adobe [11,12] and placed manually in a browser-specific location for the browser to find them. The PPAPI-to-NPAPI wrapper is another binary file, named libfreshwrapper-flashplayer.so, whose sources can be downloaded from the developer's page [6] and the compiled binary can be placed in the same browser-specific location. Several packages provide the plugin and the wrapper and automate their installation:
--------------------------------------------------------------------------------------------------------------------------------------
Source package -> Debian binary package -> Ubuntu binary package Download from Type
--------------------------------------------------------------------------------------------------------------------------------------
adobe-flashplugin adobe-flashplugin partner NPAPI PPAPI
flashplugin-nonfree flashplugin-nonfree flashplugin-installer multiverse NPAPI
pepperflashplugin-nonfree pepperflashplugin-nonfree pepperflashplugin-nonfree multiverse PPAPI
pepperflashplugin-nonfree pepperflashplugin-nonfree PPA Fernyhough PPAPI
--------------------------------------------------------------------------------------------------------------------------------------
freshplayerplugin browser-plugin-freshplayer-pepperflash browser-plugin-freshplayer-pepperflash multiverse WRAPPER
freshplayerplugin browser-plugin-freshplayer-pepperflash PPA Alin WRAPPER
freshplayerplugin browser-plugin-freshplayer-pepperflash PPA Fernyhough WRAPPER
freshplayerplugin browser-plugin-freshplayer-pepperflash PPA Santini WRAPPER
--------------------------------------------------------------------------------------------------------------------------------------
[1] https://en.wikipedia.org/wiki/NPAPI
[2] https://en.wikipedia.org/wiki/Google_Native_Client#Pepper
[3] https://blog.chromium.org/2012/08/the-road-to-safer-more-stable-and.html
[4] https://www.mozilla.org/en-US/firefox/52.0/releasenotes
[5] https://wiki.mozilla.org/Mortar_Project
[6] https://github.com/i-rinat/freshplayerplugin
[7] http://blogs.adobe.com/flashplayer/2016/08/beta-news-flash-player-npapi-for-linux.html
[8] https://github.com/i-rinat/freshplayerplugin/blob/master/doc/known-issues.md#flash-version-is-incorrect
[9] https://bugs.launchpad.net/ubuntu/+source/adobe-flashplugin/+bug/1446888
[10] https://bugs.launchpad.net/ubuntu/+source/adobe-flashplugin/+bug/1520782
[11] https://get.adobe.com/flashplayer/otherversions
[12] http://labs.adobe.com/downloads/flashplayer.html
----------------------------------------------------------------------------
flashplugin-installer Debian package heavily modified for Ubuntu
Provided by: multiverse
Use with: 14.04+
Plugin:
the archive downloads the NPAPI plugin from Canonical's partner repository
NPAPI installed as /usr/lib/flashplugin-installer/libflashplayer.so
Update:
through APT
package version is bumped with new versions of Flash Player
Provides:
symlink to the NPAPI plugin, for Mozilla-based browsers:
/usr/lib/mozilla/plugins/flashplugin-alternative.so
-> /etc/alternatives/mozilla-flashplugin
-> /usr/lib/flashplugin-installer/libflashplayer.so
----------------------------------------------------------------------------
adobe-flashplugin Ubuntu package
Provided by: partner
Use with: 14.04+
Plugin:
the archive contains a NPAPI plugin and a PPAPI plugin
NPAPI installed as /usr/lib/adobe-flashplugin/libflashplayer.so
PPAPI installed as /usr/lib/adobe-flashplugin/libpepflashplayer.so
Update:
through APT
package version is bumped with new versions of Flash Player
Provides:
symlink to the NPAPI plugin, for Mozilla-based browsers:
/usr/lib/mozilla/plugins/flashplugin-alternative.so
-> /etc/alternatives/mozilla-flashplugin
-> /usr/lib/adobe-flashplugin/libflashplayer.so
path to the PPAPI plugin, for Chromium-based browsers:
set in /etc/chromium-browser/customizations/10-flash
adobe-flash-properties-{gtk|kde}: installed as recommended dependency
----------------------------------------------------------------------------
When installing a new Ubuntu 14.04+ system, selecting the option about non-free software installs flashplugin-installer as a recommended dependency of ubuntu-restricted-addons [13,14,15].
The package downloads the adobe-flashplugin source package from Canonical's partner repository [19], which is a tarball archive containing the NPAPI plugin, the PPAPI plugin, and the control panel (name: adobe-flashplugin_<version>.orig.tar.gz). The package then extracts the NPAPI plugin to /usr/lib/flashplugin-installer/libflashplayer.so, and creates a symlink to it in the Mozilla plugin directory: /usr/lib/mozilla/plugins/flashplugin-alternative.so -> /etc/alternatives/mozilla-flashplugin -> /usr/lib/flashplugin-installer/libflashplayer.so.
The PPAPI plugin and the control panel are not installed.
To get the PPAPI plugin instead of (or in addition to) the NPAPI plugin provided by flashplugin-installer, remove flashplugin-installer and install adobe-flashplugin from Canonical's partner repository [16,17,18,19].
This package includes the NPAPI and the PPAPI plugins (name: adobe-flashplugin_<version>_<arch>.deb). Both plugins are installed in /usr/lib/adobe-flashplugin. Firefox can find the NPAPI plugin because the package creates a symlink to it in the Mozilla plugin directory /usr/lib/mozilla/plugins, via the alternatives system. Chromium and Chrome can find the PPAPI plugin because the package writes the path to it in a config file in /etc/chromium-browser/customizations.
Then install the PPAPI/NPAPI wrapper too (see further), so that NPAPI-compatible browsers can detect the PPAPI plugin in addition to the NPAPI one. If both versions show up in about:addons (which shouldn't be the case), don't try and disable the NPAPI one: you can't tell it from the PPAPI one by the version number, and disabling a version also disables the other.
The adobe-flash-properties-{gtk|kde} package is installed as a recommended dependency of adobe-flashplugin: I don't know if it is the control panel for the NPAPI plugin, the PPAPI plugin, or both. There is nothing interesting in it anyway.
[13] https://packages.debian.org/flashplugin-nonfree
[14] https://launchpad.net/ubuntu/+source/flashplugin-nonfree
[15] http://packages.ubuntu.com/flashplugin-installer
[16] https://help.ubuntu.com/stable/ubuntu-help/net-install-flash.html
[17] https://wiki.ubuntu.com/Chromium/Getting-Flash
[18] https://launchpad.net/ubuntu/+source/adobe-flashplugin
[19] http://archive.canonical.com/ubuntu/pool/partner/a/adobe-flashplugin
----------------------------------------------------------------------------
pepperflashplugin-nonfree Debian package slightly modified for Ubuntu
Provided by: multiverse
Use with: 14.04+
Plugin:
downloaded from Adobe
PPAPI installed as /usr/lib/pepperflashplugin-nonfree/libpepflashplayer.so
Update:
sudo update-pepperflashplugin-nonfree {--status|--install}
package version is NOT bumped with new versions of Flash Player
----------------------------------------------------------------------------
pepperflashplugin-nonfree Debian package slightly modified for Ubuntu
Provided by: ppa:jonathonf/pepperflashplugin-nonfree
Use with: 14.04 and 16.04 (the PPA doesn't package for other releases)
Plugin:
downloaded from Adobe
PPAPI installed as /usr/lib/pepperflashplugin-nonfree/libpepflashplayer.so
Update:
daily check (etc/cron.daily/update-pepperflashplugin-nonfree)
package version is NOT bumped with new versions of Flash Player
----------------------------------------------------------------------------
Debian users are not supposed to use Canonical's partner repository, but instead use pepperflashplugin-nonfree as their source for the PPAPI plugin [20,21]. This Debian package made by Bart Martens is automatically imported into Ubuntu at each development cycle [22,23], but doesn't have a specific Ubuntu maintainer, and has been requested for removal from Ubuntu 17.10+ [44].
Ubuntu users may use it as their source for the PPAPI plugin, but it is not recommended over adobe-flashplugin. Available in multiverse, the package downloads the PPAPI plugin from Adobe, installs it as /usr/lib/pepperflashplugin-nonfree/libpepflashplayer.so, and writes the path to it in a config file in /etc/chromium-browser/customizations (16.04+) or /etc/chromium/default (14.04) so that Chromium-based browsers can find it. After the PPAPI/NPAPI wrapper is installed (see further), NPAPI-compatible browsers are able to detect it too.
In the early days of the PPAPI plugin, the plugin was only available to Google, and the only way of getting it on Linux was to rip it from a download of Google Chrome (which comes as a .deb package). This is what pepperflashplugin-nonfree used to do. Now Adobe has made the Linux PPAPI plugin available to Canonical and on their own download site, and Google has unbundled it from Chrome since Chrome version 54, released in late 2016-10 [24]. Versions of pepperflashplugin-nonfree that have taken this change into account are in in <release> for 17.04+ and in <release>-updates for previous releases.
The advantage of pepperflashplugin-nonfree is that it doesn't install the NPAPI plugin and the control panel, so no bloat if you're only after the PPAPI plugin. Also, it is in multiverse which is enabled by default, if for some reason you don't want to enable partner. The drawback is that its version is not bumped when a new Flash Player plugin is released [21], so Flash Player updates cannot be done via APT and must be done manually. A standalone script is provided for that task, which redownloads the plugin [25]:
$ sudo update-pepperflashplugin-nonfree {--status|--install}
Jonathon Fernyhough's PPA features a version of this package that also downloads the PPAPI plugin from Adobe, is compiled for 14.04 and 16.04, and automates the Flash Player updates via a daily cronjob [26]. I'd recommend it over the multiverse version for these releases.
[20] https://packages.debian.org/pepperflashplugin-nonfree
[21] https://wiki.debian.org/PepperFlashPlayer
[22] https://launchpad.net/ubuntu/+source/pepperflashplugin-nonfree
[23] http://packages.ubuntu.com/pepperflashplugin-nonfree
[24] https://bugs.launchpad.net/ubuntu/+source/pepperflashplugin-nonfree/+bug/1632870
[25] http://www.webupd8.org/2014/01/pepper-flash-player-installer-for.html
[26] https://launchpad.net/~jonathonf/+archive/ubuntu/pepperflashplugin-nonfree
[44] https://bugs.launchpad.net/ubuntu/+source/pepperflashplugin-nonfree/+bug/1685609
The PPAPI/NPAPI wrapper is named Fresh Player Plugin, because even though it is not the (PPAPI) Flash plugin itself, it is a (NPAPI) plugin to the browser, installed as a binary file in the Mozilla plugin directory (libfreshwrapper-flashplayer.so). It is developped by Rinat Ibragimov [6,27] and packaged for Debian and Ubuntu as browser-plugin-freshplayer-pepperflash (src:freshplayerplugin) by several different maintainers.
Vincent Danjean is the maintainer of the Debian package [28]. This package is imported in Ubuntu's multiverse repository [29,30], starting with 16.04, as part of the regular Debian package import at the beginning of the development cycle of each Ubuntu release. The resulting Ubuntu package doesn't have a specific Ubuntu maintainer.
The Debian package recommends pepperflashplugin-nonfree, Debian's sole source for the PPAPI Flash plugin. Its Ubuntu version was modified [31] to recommend adobe-flashplugin instead, Ubuntu's recommended source for the PPAPI Flash plugin.
The package adds an alternative to the mozilla-flashplugin group, changing the symlink chain pointing to adobe-flashplugin's NPAPI plugin (/usr/lib/mozilla/plugins/flashplugin-alternative.so -> /etc/alternatives/mozilla-flashplugin -> /usr/lib/adobe-flashplugin/libflashplayer.so) to a symlink chain pointing to the PPAPI/NPAPI wrapper (/usr/lib/mozilla/plugins/flashplugin-alternative.so -> /etc/alternatives/mozilla-flashplugin -> /usr/lib/browser-plugin-freshplayer-pepperflash/libfreshwrapper-flashplayer.so). This is how Mozilla-based browsers are able to find the wrapper. As for the wrapper itself, it finds the PPAPI plugin it is supposed to wrap by looking for it in several locations where the plugin is usually installed [36].
Like all packages imported from Debian, new versions of browser-plugin-freshplayer-pepperflash only land in Ubuntu's development release (and not even automatically, since there is a Debian/Ubuntu delta). For the package to be updated in Ubuntu's published releases, a MOTU needs to take specific action, which rarely happens (the packages in the repository of a published release are updated as little as possible, for stability reasons). Hence why browser-plugin-freshplayer-pepperflash is outdated in the published releases.
Andrei Alin is the maintainer of the package available in the WebUpd8 PPA [32,33]. In contrast to the package available in multiverse, Andrei Alin's package is updated for all published releases, whenever new upstream releases are available.
The package recommends adobe-flashplugin and adds the same alternative as the package available in multiverse.
Jonathon Fernyhough's PPA provides versions of browser-plugin-freshplayer-pepperflash for 14.04 and 16.04 that are backports of the 17.04 multiverse version [26]. Mere copies, no changes.
This may be useful for users of 14.04, since browser-plugin-freshplayer-pepperflash is not present in multiverse for that release (no backport has ever been requested). Users of 16.04 will also get a small version bump from using this PPA. In both cases however, Andrei Alin's package is more recent.
Giovanni Santini's PPA provides daily builds of the Fresh Player Plugin for all published releases and the development release [34]. It is useful when you need an upstream bugfix, can't wait for the next packaged release, and don't feel like installing from source. Note that the PPA is currently lagging behind upstream because of a Github-to-Launchpad importation error [35].
Note that Giovanni Santini follows the Debian packaging rather than the Ubuntu packaging: it recommends pepperflashplugin-nonfree instead of adobe-flashplugin, and creates a new alternative group to symlink to the wrapper instead of using the one already put in place by adobe-flashplugin.
The command for adding a PPA to the system is sudo add-apt-repository ppa:<user>/<ppa-name>.
The wrapper must know the location of the PPAPI plugin it is supposed to wrap. By default, it looks for a file named libpepflashplayer.so in a dozen different directories, where Chrome and the previously listed packages providing the PPAPI plugin would have put it. Among those are [36,37]:
/opt/google/chrome/PepperFlash // Chrome
/usr/lib/adobe-flashplugin // adobe-flashplugin (Ubuntu)
/usr/lib/pepperflashplugin-nonfree // pepperflashplugin-nonfree (Debian)
If the plugin has been installed manually in a different place, or given a different name, its path must be given explicitly in the configuration file /etc/freshwrapper.conf (site-specific) or ~/.config/freshwrapper.conf (user-specific):
# Path to the Pepper Flash plugin
pepperflash_path = "/path/to/libpepflashplayer.so"
See the example configuration file /usr/share/doc/browser-plugin-freshplayer-pepperflash/freshwrapper.conf.example [38] for more configuration options. It shows the default values.
[27] https://github.com/i-rinat/freshplayerplugin/releases
[28] https://packages.debian.org/browser-plugin-freshplayer-pepperflash
[29] https://launchpad.net/ubuntu/+source/freshplayerplugin
[30] http://packages.ubuntu.com/browser-plugin-freshplayer-pepperflash
[31] https://bugs.launchpad.net/ubuntu/+source/freshplayerplugin/+bug/1633678
[32] https://launchpad.net/~nilarimogard/+archive/ubuntu/webupd8
[33] http://www.webupd8.org/2014/05/install-fresh-player-plugin-in-ubuntu.html
[34] https://launchpad.net/~itachi-san/+archive/ubuntu/freshplayerplugin
[35] https://answers.launchpad.net/launchpad/+question/464305
[36] https://github.com/i-rinat/freshplayerplugin/blob/master/src/config_pepperflash.c
[37] https://github.com/i-rinat/freshplayerplugin/blob/master/doc/known-issues.md#failed-to-load-libpepflashplayerso
[38] https://github.com/i-rinat/freshplayerplugin/blob/master/data/freshwrapper.conf.example
The NPAPI plugin stores the LSO cookies in the following locations [39]:
~/.macromedia/Flash_Player/#SharedObjects/
~/.macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/
The default Flash cookie is stored as:
~/.macromedia/Flash_Player/
macromedia.com/support/flashplayer/sys/settings.sol
The PPAPI plugin stores the LSO cookies in ~/.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/#SharedObjects/ when it is used through Google Chrome [39], and in the following location when it is wrapped by Fresh Player Plugin:
~/.config/freshwrapper-data/Shockwave Flash/WritableRoot/#SharedObjects/
The default Flash cookie is stored as:
~/.config/freshwrapper-data/Shockwave Flash/WritableRoot/#SharedObjects/
<8-character-name>/macromedia.com/support/flashplayer/sys/settings.sol
The "Keep until I close Firefox" cookie setting apparently only applies to text cookies, not LSO cookies. If ticked:
--------------------------------------------------------------------
deleted all text cookies, except those with Allow exceptions
--------------------------------------------------------------------
Keep cookies until I close Firefox
--------------------------------------------------------------------
The "Clear history when Firefox closes" preference and "Clear recent history" command have a cookie tickbox that apparently applies to both text and LSO cookies, and doesn't care about exceptions. If ticked:
--------------------------------------------------------------------
deleted all text cookies, even those with Allow exceptions
deleted all LSO cookies in the NPAPI locations (~/.macromedia/...)
cleared the default NPAPI Flash cookie is cleared but not deleted
--------------------------------------------------------------------
Clear cookies when I close Firefox or when I clear recent history
--------------------------------------------------------------------
The LSO cookies in the PPAPI location (~/.config/freshwrapper-data/...) are left untouched, along with the corresponding default Flash cookie, since Firefox doesn't know about PPAPI plugins. To delete these LSO cookies, use BetterPrivacy [40].
By default, BetterPrivacy looks for LSO cookies under ~/.macromedia (NPAPI location). Configure it to look under ~/.config/freshwrapper-data (PPAPI location). By default, the default Flash cookie is neither cleared nor deleted, but there is an option to delete it as well.
The NPAPI storage location may be deleted manually once and for all (rm -r ~/.macromedia), since once the wrapper is installed, the PPAPI plugin will be used, not the NPAPI plugin, so there won't be any new files created in the NPAPI location.
Exception: if the wrapper is from Giovanni Santini's PPA, Firefox detects two Flash plugins: PPAPI through the wrapper, and NPAPI, because the package installs a new alternative group to symlink to the wrapper (flash-mozilla.so), instead of using the one that adobe-flashplugin has already put in place to symlink to the NPAPI plugin (mozilla-flashplugin). Because of that, an empty .macromedia/Flash_Player/macromedia.com/support/flashplayer/sys/settings.sol is created when Firefox tries to clear the default Flash cookie. Oh well.
[39] http://en.wikipedia.org/wiki/Local_shared_object
[40] https://addons.mozilla.org/en-US/firefox/addon/betterprivacy
In case of Flash-related trouble, check the Issues page of the wrapper on GitHub [41]. Answers will probably be there.
Current defaults are for hardware accelerated rendering to be enabled (enable_3d = 1) and hardware accelerated decoding to be disabled (enable_hwdec = 0), said hardware being the GPU of course [38,42].
Version >=54.39.0 of libavcodec is required for compiling the wrapper with hardware accelerated decoding support. But Ubuntu 14.04 only has version 54.35.1, so the WebUpd8 packager (Andrei Alin) compiled the wrapper without hardware accelerated decoding support, because even if he updates his libavcodec, the users of the package can't be expected to have done so [42]. Consequently, switching on hardware accelerated decoding in the configuration file is useless on 14.04, it is not available.
Later releases of Ubuntu have version 56+ of libavcodec, so the wrapper for these releases has most likely been compiled with hardware accelerated decoding support. To turn it on, switch enable_hwdec to 1 in the wrapper's configuration file, and check that enable_vaapi and enable_vdpau are also set to 1 so that hardware accelerated decoding uses VA-API/VDPAU.
The WebUpd8 team maintains other interesting PPAs [43]:
----------------------------------------------------------------------------------------------
ppa:nilarimogard/webupd8 Main PPA, contains Fresh Player Plugin
ppa:webupd8team/nemo|nemo3 Unity-compatible versions of the Nemo file manager (v 2.x or 3.x)
ppa:webupd8team/rhythmbox Newer versions of Rhythmbox
ppa:webupd8team/atraci YouTube-based music player (see also Kaku, Tomahawk, mps-youtube)
ppa:webupd8team/java Oracle Java (instead of OpenJDK Java)
----------------------------------------------------------------------------------------------
[41] https://github.com/i-rinat/freshplayerplugin/issues
[42] i-rinat/freshplayerplugin#194
[43] https://launchpad.net/~webupd8team