OpenBSD won't update Firefox, advises users to switch to ESR • Hacker News Board

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#11

Post by dathinab » Sat, Jan 11, 2020, 10:42 PM UTC

floatingatoll wrote: post #6

dathinab wrote: post #5

So basically: - Firefox is hard to package so they won't package it (on stable). - OpenBSD-current users are not affected as firefox has already been committed. - Firefox-ESR is still maintained. > (thanks to cbindgen and rust dependencies) on the stable branch (as this would require testing all rust consumers) Can someone explain what they mean with this? What have other non firefox rust consumers to do with firefox…

It appears that they are unwilling to update to the latest Rust-stable release due to the testing burden on the OpenBSD-stable team; which then conflicts with the Firefox Rust update policy of, as I read it, ‘latest Firefox stable will use latest Rust stable’. https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox

Ok thanks, I guess this is somewhat understandable.

Through I wonder a bit why they don't automate the tests (maybe the computation cost?). (E.g. rust automatically runs the tests of all libraries/programs published on crates.io to find regressions, through that takes a day or so to complete).

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#12

Post by compuguy » Sat, Jan 11, 2020, 10:43 PM UTC

floatingatoll wrote: post #6

dathinab wrote: post #5

So basically: - Firefox is hard to package so they won't package it (on stable). - OpenBSD-current users are not affected as firefox has already been committed. - Firefox-ESR is still maintained. > (thanks to cbindgen and rust dependencies) on the stable branch (as this would require testing all rust consumers) Can someone explain what they mean with this? What have other non firefox rust consumers to do with firefox…

It appears that they are unwilling to update to the latest Rust-stable release due to the testing burden on the OpenBSD-stable team; which then conflicts with the Firefox Rust update policy of, as I read it, ‘latest Firefox stable will use latest Rust stable’. https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox

They will still have to update rust when the next major version of Firefox ESR is pushed out this June/July...

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#13

Post by asveikau » Sat, Jan 11, 2020, 10:46 PM UTC

smartmic wrote: post #4

> being too complicated to package (thanks to cbindgen and rust dependencies) Can anyone explain what is behind? Is it symptomatic for any programs with those dependency? Especially curious about rust because it seems to be hyped very much lately (I have almost zero rust experience and even less bias about it, just being curious)

They don't want to need to update Rust in order to do a presumably small security patch on Firefox.

Which honestly sounds like a totally awesome and legit reason to use -esr. Keep -current current with upstream, stable branch gets patches from firefox-esr.

Keep in mind stable patches to the ports tree are pretty rare on OpenBSD. They didn't do them as binary packages until fairly recently, either.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#14

Post by blackhaz » Sat, Jan 11, 2020, 10:50 PM UTC

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - once in a while I have to say "screw it" and auto-update more than a thousand packages, praying my Python and other projects survive, just because I want a browser update or a security fix.

I wonder if there are others who support this opinion that desktop Unix has very complicated future unless complex apps will begin to bundle their own libraries.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#15

Post by anjbe » Sat, Jan 11, 2020, 10:51 PM UTC

compuguy wrote: post #12

floatingatoll wrote: post #6

Earlier quoted context omitted.

It appears that they are unwilling to update to the latest Rust-stable release due to the testing burden on the OpenBSD-stable team; which then conflicts with the Firefox Rust update policy of, as I read it, ‘latest Firefox stable will use latest Rust stable’. https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox

They will still have to update rust when the next major version of Firefox ESR is pushed out this June/July...

OpenBSD has a six‐month release cycle; Firefox-ESR backports will be able to use whatever version of Rust is in 6.7-stable (release coming this May).

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#16

Post by newnewpdro » Sat, Jan 11, 2020, 10:54 PM UTC

Can't the required rust version be (temporarily) treated as part of firefox then, and not bother building everything else using rust with that version?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#17

Post by jszymborski » Sat, Jan 11, 2020, 10:56 PM UTC

asveikau wrote: post #13

smartmic wrote: post #4

> being too complicated to package (thanks to cbindgen and rust dependencies) Can anyone explain what is behind? Is it symptomatic for any programs with those dependency? Especially curious about rust because it seems to be hyped very much lately (I have almost zero rust experience and even less bias about it, just being curious)

They don't want to need to update Rust in order to do a presumably small security patch on Firefox. Which honestly sounds like a totally awesome and legit reason to use -esr. Keep -current current with upstream, stable branch gets patches from firefox-esr. Keep in mind stable patches to the ports tree are pretty rare on OpenBSD. They didn't do them as binary packages until fairly recently, either.

"presumably small security patch"

The security patch is actually quite severe and has been reported to be in active use.

https://www.mozilla.org/en-US/security/advisories/mfsa2020-0...

https://www.cisecurity.org/advisory/vulnerability-in-mozilla...

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#18

Post by asveikau » Sat, Jan 11, 2020, 10:58 PM UTC

jszymborski wrote: post #17

asveikau wrote: post #13

Earlier quoted context omitted.

They don't want to need to update Rust in order to do a presumably small security patch on Firefox. Which honestly sounds like a totally awesome and legit reason to use -esr. Keep -current current with upstream, stable branch gets patches from firefox-esr. Keep in mind stable patches to the ports tree are pretty rare on OpenBSD. They didn't do them as binary packages until fairly recently, either.

"presumably small security patch" The security patch is actually quite severe and has been reported to be in active use. https://www.mozilla.org/en-US/security/advisories/mfsa2020-0... https://www.cisecurity.org/advisory/vulnerability-in-mozilla...

I meant small as in code size.

In a stable branch you want the size of changes to be small and targeted despite how severe the issue is. You don't want to take on new bugs from patches that aren't related to issues you want to see fixed.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#19

Post by floatingatoll » Sat, Jan 11, 2020, 10:59 PM UTC

anjbe wrote: post #15

compuguy wrote: post #12

Earlier quoted context omitted.

They will still have to update rust when the next major version of Firefox ESR is pushed out this June/July...

OpenBSD has a six‐month release cycle; Firefox-ESR backports will be able to use whatever version of Rust is in 6.7-stable (release coming this May).

> We expect esr releases will stay on the same minimum Rust version, so backporting security fixes may require Rust compatibility work too.

The policy suggests that ESR will update infrequently to the latest Rust-stable at each major .0 release, so as long as 6.7-stable and ESR end up having the same Rust stable version, that will work out. That’s a coincidence-based success, not a certain one, though.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#20

Post by jszymborski » Sat, Jan 11, 2020, 11:00 PM UTC

asveikau wrote: post #18

jszymborski wrote: post #17

Earlier quoted context omitted.

"presumably small security patch" The security patch is actually quite severe and has been reported to be in active use. https://www.mozilla.org/en-US/security/advisories/mfsa2020-0... https://www.cisecurity.org/advisory/vulnerability-in-mozilla...

I meant small as in code size. In a stable branch you want the size of changes to be small and targeted despite how severe the issue is. You don't want to take on new bugs from patches that aren't related to issues you want to see fixed.

Ah, my mistake :) That makes sense!