Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

51–60 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#51

Post by NelsonMinar »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Dumb solution with a blunt hammer; why not run Firefox in a container like Docker?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#52

Post by ethbro »

toyg wrote: post #42
elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

> is there something safer, simpler, and more secure? No. Building a good browser is hard. Typically you can get something "safer" (from a privacy/business model perspective) and/or "simpler" (from a development perspective) relatively easily - see KHTML and other niche efforts. But when it comes to "more secure" while supporting modern web features, you need a lot of skilled eyeballs on code and a lot of people tryi…

Also, it's a never-ending task, given web evolution.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#53

Post by stanferder »

zozbot234 wrote: post #50
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Outside packages should NOT be disrupted given semver. The whole point of using shared objects (dynamically-linked libraries) is so that when a problem arises you can update whatever pieces of code in a centralized, system-wide store and every single one of the projects you use can benefit from the new, up-to-date version. Using the latest version is just the right thing to do.

Does it actually work though? It seems like there is a significant difference between the expectation that semantic versioning should result in no disruption, and the experience of the parent to your comment. I'd be interested to know exactly what went wrong that lead that poster to be pessimistic.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#54

Post by jblow »

barrkel wrote: post #43
markstos wrote: post #35

Earlier quoted context omitted.

This is the old packaging design where disk space and bandwidth were expensive, so you tried to have one version of each library or package on disk. This design leads to cascading complexity and breakage when many package depend on the same library and some need different versions of the library. Modern packaging has changed the approach to bundle dependencies-- using more disk space and bandwidth but isolating apps…

Shared libraries aren't just about reducing disk space and bandwidth consumption; it's also about fixing bugs in one place fixing it for all consumers. It requires discipline to only fix bugs and not break consumers, though, and therein lies the devil.

The notion that it's about fixing bugs in one place is revisionist. It's not what people thought they were for when they were introduced.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#55

Post by antpls »

barrkel wrote: post #43
markstos wrote: post #35

Earlier quoted context omitted.

This is the old packaging design where disk space and bandwidth were expensive, so you tried to have one version of each library or package on disk. This design leads to cascading complexity and breakage when many package depend on the same library and some need different versions of the library. Modern packaging has changed the approach to bundle dependencies-- using more disk space and bandwidth but isolating apps…

Shared libraries aren't just about reducing disk space and bandwidth consumption; it's also about fixing bugs in one place fixing it for all consumers. It requires discipline to only fix bugs and not break consumers, though, and therein lies the devil.

Shared libraries just don't work anymore. That's one of the reasons behind Go and containers.

That way, the users always have working applications. Some applications may take more time to be up to date with their dependencies, but at least some of them can be updated asap without worrying about the others.

For example, I use Debian 10 stable on my laptop, on which I installed Snapd. I then installed Firefox with Snap, and I can be confident that Firefox will have the latest security updates, while keeping the system stable (some parts of the system are probably unsecure, but at least everything still work, they will be updated later)

Although, I would like to point that, while the storage space issue is solved with current tech, the bandwidth is still an issue when on mobile data.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#56

Post by rvz »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Well the reality is, some developers of these complex software complain how their software ported to alternative OSes is difficult to maintain even when the BSD devs would offer to maintain it, which is why the BSDs are always on their own here in terms of porting, testing, packaging and updating the software in question.

For example, Chromium. Any BSD developer would know that attempting to upstream their port there is dead in the water. AFAICT, They Chromium devs only care about Win, Mac, Linux and nothing else. Likewise for Firefox, which is why the BSDs don't get official releases.

I feel some sympathy for OSes like the BSDs that for "some" software they are limited by the arrogance of other open-source maintainers who would rather go for maintaining the convoluted distros and testing with a huge disintegrated software-stack than testing a single unified OS which the BSDs maintain themselves.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#57

Post by jiveturkey »

stanferder wrote: post #53
zozbot234 wrote: post #50

Earlier quoted context omitted.

Outside packages should NOT be disrupted given semver. The whole point of using shared objects (dynamically-linked libraries) is so that when a problem arises you can update whatever pieces of code in a centralized, system-wide store and every single one of the projects you use can benefit from the new, up-to-date version. Using the latest version is just the right thing to do.

Does it actually work though? It seems like there is a significant difference between the expectation that semantic versioning should result in no disruption, and the experience of the parent to your comment. I'd be interested to know exactly what went wrong that lead that poster to be pessimistic.

Yes it does actually work and has for decades. The poster is either confused or doing something different, I expect.

The specific notice mentions rust dependencies. Rust does not have shared libraries, so a Rust [security] update means all rust binaries must be completely rebuilt. That seems to be part of OpenBSD's concern, and perhaps this has "triggered" the poster.

user blackhaz random forum post found:

> mariourk, you're definitely not alone. The same breakage happens to FreeBSD desktops as well. I have been vocal around the forum a few times about this. Not every desktop user wants to upgrade all their packages every X months. The way the default repositories are structured, the upgrades are forced onto users. I am a huge proponent of using application bundles, like on Mac OS, as quite often those upgrades break complex desktop apps too. I don't mind upgrades but sometimes I need to stick with a specific version of software, or roll back after something went wrong, and if it came as a bundle with its own dependencies, it wouldn't have to depend on other stuff that is being "force-upgraded" periodically.

So his complaint is about the way FBSD handles updates; he is generally incorrect about shared libraries; and his comment is completely OT for this thread.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#58

Post by klodolph »

jblow wrote: post #54
barrkel wrote: post #43

Earlier quoted context omitted.

Shared libraries aren't just about reducing disk space and bandwidth consumption; it's also about fixing bugs in one place fixing it for all consumers. It requires discipline to only fix bugs and not break consumers, though, and therein lies the devil.

The notion that it's about fixing bugs in one place is revisionist. It's not what people thought they were for when they were introduced.

This isn’t history, the relevant question is what shared libraries are for, not what they were intended to be for.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#59

Post by ubercow13 »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Is the shared library issue actually related to this? In the OP they are talking about a Rust upgrade which is presumably only a build-time dependency.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#60

Post by microcolonel »

Analemma_ wrote: post #47
sandov wrote: post #41

Earlier quoted context omitted.

I'll go one step further: The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. The way shared libraries are used in Linux is built upon the assumption that package managers and centralized repositories are the right way to do things.

I agree, and I think that people are too emotionally invested in the package manager concept to back out now. I mean, for years Linux proponents have been touting it as the key advantage over software distribution on Macs/PCs.

I mean, it is a key advantage, on ArchLinux. If you don't have a rolling release, it's pure pain: you're often just stuck with old versions of software which aren't any more stable than the current stable release.
Post reply on HN