Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

21–30 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#21

Post by smartmic »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Hm. For me this is a question about interface design (vs. implementation). IMHO Unix programming philosophy is a lighthouse how to solve this commendable. In an ideal world you should have to upgrade base program and dependent libraries only if their interfaces have changed.

EDIT: And of course for security reasons - but then you only upgrade the affected player and not huge parts of your installed base. What I want to say - this is all about the ruling design philosophy.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#23

Post by anjbe »

dathinab wrote: post #11
floatingatoll wrote: post #6

Earlier quoted context omitted.

It appears that they are unwilling to update to the latest Rust-stable release due to the testing burden on the OpenBSD-stable team; which then conflicts with the Firefox Rust update policy of, as I read it, ‘latest Firefox stable will use latest Rust stable’. https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox

Ok thanks, I guess this is somewhat understandable. Through I wonder a bit why they don't automate the tests (maybe the computation cost?). (E.g. rust automatically runs the tests of all libraries/programs published on crates.io to find regressions, through that takes a day or so to complete).

Okay, suppose someone backporting a Rust update runs a big batch of tests and finds, say, two dozen packages with regressions.

Now what?

Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed?

And all this to only get automated tests passing. Any regressions in behavior not tested are not noticed (or more likely, noticed by users much later, requiring further investigation at that point in time to narrow down the Rust backport as the cause).

In the meantime, this packager’s work on other OpenBSD packages in -current (what most OpenBSD developers actually use day‐to‐day) completely stops.

That’s some insight into the mindset of a software packager. Non‐security backports to language runtimes are a serious maintenance burden.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#24

Post by floatingatoll »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

RedHat’s “streams” model will certainly do a much better job of handling this than the other distributions do today. I hope that the need for having multiple parallel versions of a dependency coexist is incorporated into the other distros, because I’ve lost a lot of sanity this past two decades to the assumption that “one installed version should be enough for anybody” on Linux and BSD servers.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#25

Post by thrwaway69 »

elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

I use vivaldi. It provides a lot of customization for my taste unlike others.

My biggest problem with most browsers is tied to how they handle tab management and lacks basic features that should be there without installing an extension.

Example - stacking, auto closing, filter, finder etc. Not hiding tabs after certain number of them.

edit: more info here at https://vivaldi.com/features/tab-management/

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#26

Post by floatingatoll »

newnewpdro wrote: post #16

Can't the required rust version be (temporarily) treated as part of firefox then, and not bother building everything else using rust with that version?

It seems likely the OpenBSD would consider such a patch if it were presented to them, but they might also reject it due to ideals they hold that outsiders can’t predict.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#27

Post by alwillis »

elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

Brave.

Blocks all trackers, fingerprinting and mining scripts by default, based on Chromium. Built-in IPFS, Webtorrent and Tor: https://brave.com/

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#28

Post by floatingatoll »

anjbe wrote: post #23
dathinab wrote: post #11

Earlier quoted context omitted.

Ok thanks, I guess this is somewhat understandable. Through I wonder a bit why they don't automate the tests (maybe the computation cost?). (E.g. rust automatically runs the tests of all libraries/programs published on crates.io to find regressions, through that takes a day or so to complete).

Okay, suppose someone backporting a Rust update runs a big batch of tests and finds, say, two dozen packages with regressions. Now what? Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed? And all this to only get a…

> Now what?

Discard the outdated assumption that a single installed dependency version is sufficient for all packages, and then improve the packaging system to permit multiple releases of Rust, Python, etc. to coexist as dependencies so that packages can migrate gradually over time rather than forcibly whenever one crosses the line.

Homebrew does a fine job of this. Installing python@2 doesn’t necessarily mean it’ll be made “the default”, but it does make it available for dependencies without interfering with the default python 3 package.

EDIT: NixOS does this right: https://news.ycombinator.com/item?id=22023086

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#29

Post by markstos »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Complex apps can bundle their own dependencies-- that's what the Flatpak and Snap package formats do. You can also run Firefox in a Docker or LXD container with it's dependencies. By sharing the X11 or Wayland socket with the docker, the apps can appear on your main desktop.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#30

Post by SaxonRobber »

alwillis wrote: post #27
elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

Brave. Blocks all trackers, fingerprinting and mining scripts by default, based on Chromium. Built-in IPFS, Webtorrent and Tor: https://brave.com/

Also a botnet
Post reply on HN