ra2 studio - Fotolia


VSphere HTML5 Web Client offers improved security over the C# client

Security issues plaguing the Adobe Flash Player and C# have pushed enterprises like VMware to introduce the vSphere HTML5 Web Client.

VMware's recent decision to move away from the C# client to the vSphere HTML5 Web Client had little to do with the former's features and a lot more about the software in which the product is written. VMware joined the growing legion moving away from Adobe Flash clients. The change improves enterprises' security posture but provides them with a less robust product, at least for the moment.

Available since 1996, Adobe Flash Player emerged as a popular option for developers building multimedia applications.

"Adobe Flash use became ubiquitous because for a long period there really was no widely supported alternative," stated Robert Westervelt, research manager at IDC.

The product has been integrated into most web browsers, downloaded hundreds of millions of times, and used to deliver content on billions of webpages.

The 'kill Flash' movement gains traction

Even though Flash has been widely deployed, the software has problems, especially when it comes to security. In fact, NTT Group listed the top 10 security vulnerabilities in 2015 and all of them involved Flash.Therefore it shouldn't come as a suprise VMware match the switch to the vSphere HTML5 Web Client. 

"Attackers pounced on the ubiquitous nature of Flash and had assistance because of public availability of the source code and a cache of popular attack toolkits that made it easy enough for just about anyone to carry out an attack campaign," Westervelt said.

The problems have been so widespread that, as far back as 2010, Apple's Steve Jobs recommended that developers stop using the Adobe software and shortly after, Facebook security boss Alex Stamos reiterated the same sentiment. Mozilla disabled all Flash plug-ins in its Firefox browser, and a social networking group, Occupy Flash, formed with the goal of eliminating Flash's use.

C# popular, but flawed

HTML5 is no panacea -- it doesn't fully replace all the multimedia capabilities that Flash supported.
Robert Westerveltresearch manager at IDC

Debuting in 2003, the C# client was developed in Adobe Flex, a Flash application development platform that works well with Microsoft Windows systems, and has been adopted by many enterprises.

Like many vendors, VMware has been thinking about moving away from Flash and one potential shift was with its C# client. In a blog post, Vishwa Srikaanth, a product manager at VMware, said, "The decision to go with Flash was made years ago, before HTML5 and developer tools were ready. The situation has changed, and we've been working very hard on removing the dependency on Flash to improve performance, stability and security."

VSphere HTML5 Web Client emerges an alternative

To make the switch, VMware needed a multimedia alternative. In February 2011, the World Wide Web Consortium (W3C) began working on a multimedia HTML client. The HTML5 specification was published at the end of 2012 and compliant products started to emerge near the end of 2014.

The new standard has appealing features in addition to improved security. Its modern design often performs better than Flash. In addition, vendors -- and, therefore, users -- do not have to pay runtime licenses to use the software.

In March, VMware became the latest supplier to move away from Flash. Its new vSphere HTML5 Web Client is being distributed as an appliance inside a VM and been designed to work with vSphere 6.0 environments. The offering's feature set includes support for:

  • VM power operations  -- common cases
  • VM edit settings -- simple CPU, memory, disk changes
  • VM console
  • VM and host summary pages
  • VM migration -- only to a host
  • Clone to template/VM
  • Create VM on a host -- limited
  • Additional monitoring views -- performance charts, tasks, events
  • Global views -- recent tasks, alarms -- view only

VSphere HTML5 Web Client is better, but not perfect

Although the C# client had its fair share of issues and there is a lot of hype for the vSphere HTML5 Web Client, the new client presents its own challenges.

"HTML5 is no panacea -- it doesn't fully replace all the multimedia capabilities that Flash supported," Westervelt said.

There are more development tools for Flash than for HTML5. Older applications may not work well with the W3C standard.

Given the nascent stage of the VMware software, a few bugs have emerged: Simple search only delivers about 50 objects of a single type. Hosts that are in a Virtual SAN (VSAN) cluster are not able to provide additional options -- such as VSAN data migration selector -- when being placed in Maintenance mode. URLs entered before logging into Fling are not passed on after logging in.

When you visit a client's page before the server has completely started up, it might not load the strings and you could get a message such as summaryView.guestFullName within the views or action menus.

Such problems are often found with new software, and VMware has been working to address the various issues.

Flash has been a very popular multimedia development tool that unfortunately attracted hackers as well as enterprise developers. Consequently, VMware has decided to help its customers migrate away from the insecure offering to a system based on HTML5 with the vSphere HTML5 Web Client.

Next Steps

Can HTML5 save YouTube from Flash security issues?

With HTML5 in the picture, the days of Flash are numbered

Dig Deeper on VMware basics