Why shockwave flash plug-in in Z5?

olaf · November 20, 2017

I just installed zotero 5 standalone on my mac as firefox does not work with z4 anymore. After installation I noticed, that zotero 5 has an shockwave flash plug-in installed. Does Z5 need that plug-in for working correct? I also can not select the option "ask to activate" (in order to see when it might be needed) but only choose between "always activate" and "never activate".

adamsmith · November 20, 2017

nope, that's just an artefact of the platform. You can disable it.

olaf · November 20, 2017

thanks for the quick response. I will disable it, since Flash is known for security issues (although by now less important since it is only in the zotero platform not the browser itself)

dstillman · November 20, 2017

And to be clear, Flash certainly isn't something that Zotero includes. If it's showing up, it's still installed as a plugin on your system (in /Library/Internet Plug-Ins or ~/Library/Internet Plug-Ins).

olaf · November 21, 2017

I see, Z5 inherits for the standalone platform what was/is before installed in firefox.
Now I used and still use the shockwave flash plug-in in FF with "ask before activate" mode so I can decide on a case by case base, if I activate flash to view specific content on a webpage. It seems that Zotero does not inherit that preference from FF.
I know that flash has a general reputation of frequent security issues. I do not know if this affects an zotero installation, since I do not view webpages with zotero. Maybe when I store a screenshot of an malicious prepared webpage into zotero? If so it would be nice if Z5 could deactivate the plug-in by default. I am shure that many users are not aware that they have installed the plug-in (I myself only noticed when I was installing zotfile add-on).