Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

71–80 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#71

Post by zozbot234 »

jiveturkey wrote: post #57
stanferder wrote: post #53

Earlier quoted context omitted.

Does it actually work though? It seems like there is a significant difference between the expectation that semantic versioning should result in no disruption, and the experience of the parent to your comment. I'd be interested to know exactly what went wrong that lead that poster to be pessimistic.

Yes it does actually work and has for decades. The poster is either confused or doing something different, I expect. The specific notice mentions rust dependencies. Rust does not have shared libraries, so a Rust [security] update means all rust binaries must be completely rebuilt. That seems to be part of OpenBSD's concern, and perhaps this has "triggered" the poster. user blackhaz random forum post found: > mariourk…

> Rust does not have shared libraries, so a Rust [security] update means all rust binaries must be completely rebuilt.

What's the concern with that, exactly? OpenBSD is a security-focused distribution, do they not do reproducible builds?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#72

Post by int_19h »

zozbot234 wrote: post #50
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Outside packages should NOT be disrupted given semver. The whole point of using shared objects (dynamically-linked libraries) is so that when a problem arises you can update whatever pieces of code in a centralized, system-wide store and every single one of the projects you use can benefit from the new, up-to-date version. Using the latest version is just the right thing to do.

Semver is not a given in practice. Many libraries haven't adopted it, some of those that claim to break things in practice, and the very definition of a "breaking change" can mean different things - sometimes depending on the consumer (this is especially true for cross-language interactions).

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#73

Post by ars »

asveikau wrote: post #13
smartmic wrote: post #4

> being too complicated to package (thanks to cbindgen and rust dependencies) Can anyone explain what is behind? Is it symptomatic for any programs with those dependency? Especially curious about rust because it seems to be hyped very much lately (I have almost zero rust experience and even less bias about it, just being curious)

They don't want to need to update Rust in order to do a presumably small security patch on Firefox. Which honestly sounds like a totally awesome and legit reason to use -esr. Keep -current current with upstream, stable branch gets patches from firefox-esr. Keep in mind stable patches to the ports tree are pretty rare on OpenBSD. They didn't do them as binary packages until fairly recently, either.

Can they not backport the patch to the existing version of Firefox?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#74

Post by app4soft »

elagost wrote: post #40
app4soft wrote: post #31

Earlier quoted context omitted.

Waterfox (with Web Extensions) or Pale Moon (with XUL/UXP extensions)

If I'm to avoid Firefox, I'd like to avoid its forks as well - they don't really improve upon anything meaningful both of those have had more issues than Firefox in the past. I'm thinking smaller than Firefox.

> they don't really improve upon anything meaningful both of those have had more issues than Firefox in the past.

Please, prove it.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#75

Post by int_19h »

jiveturkey wrote: post #63
wbl wrote: post #9

Earlier quoted context omitted.

The problem is updating the rust toolchain requires testing all other ports with that dependency to make sure nothing broke.

it wouldn't necessarily. you could just update rust, build firefox and test that. leave the others alone (with older rust). now if the complaint is solely about rust, not specifically FF, then that's a different story. it might indeed be that FF is the only package using Rust right now?

BSD ports tree can be thought of as versioned as a whole, and packages are basically a snapshot of one particular state of it. If you update one port, and it's a dev dependency for other ports, their packages will reflect that.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#76

Post by int_19h »

floatingatoll wrote: post #28
anjbe wrote: post #23

Earlier quoted context omitted.

Okay, suppose someone backporting a Rust update runs a big batch of tests and finds, say, two dozen packages with regressions. Now what? Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed? And all this to only get a…

> Now what? Discard the outdated assumption that a single installed dependency version is sufficient for all packages, and then improve the packaging system to permit multiple releases of Rust, Python, etc. to coexist as dependencies so that packages can migrate gradually over time rather than forcibly whenever one crosses the line. Homebrew does a fine job of this. Installing python@2 doesn’t necessarily mean it’ll…

Python 2/3 is not a representative example, because it's actually designed to be installed side-by-side by the authors. Many libraries and apps on Unix are not.

NixOS changes a lot of things to make it all work. If you're willing to pay that tax for the sake of package management, great! People who use BSDs generally aren't.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#77

Post by fooqux »

microcolonel wrote: post #60
Analemma_ wrote: post #47

Earlier quoted context omitted.

I agree, and I think that people are too emotionally invested in the package manager concept to back out now. I mean, for years Linux proponents have been touting it as the key advantage over software distribution on Macs/PCs.

I mean, it is a key advantage, on ArchLinux. If you don't have a rolling release, it's pure pain: you're often just stuck with old versions of software which aren't any more stable than the current stable release.

It's only pure pain if you want bleeding edge AND stability. Non-rolling releases are just fine if you only need new features once a year.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#78

Post by zozbot234 »

anjbe wrote: post #23
dathinab wrote: post #11

Earlier quoted context omitted.

Ok thanks, I guess this is somewhat understandable. Through I wonder a bit why they don't automate the tests (maybe the computation cost?). (E.g. rust automatically runs the tests of all libraries/programs published on crates.io to find regressions, through that takes a day or so to complete).

Okay, suppose someone backporting a Rust update runs a big batch of tests and finds, say, two dozen packages with regressions. Now what? Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed? And all this to only get a…

> Okay, suppose someone backporting a Rust update runs a big batch of tests and finds, say, two dozen packages with regressions.

> Now what?

> Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed?

Yes, people do exactly that. It's part of running a "rolling" distro, see e.g. the Debian Testing transition tracker at https://release.debian.org/transitions/ - These transitions are running essentially all the time; they're only "put on hold" as a first step in the process of making a new stable release. And even then, newer versions of packages such as rust can still enter stable as part of an "unrelated" security update.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#79

Post by shpx »

elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

The only true alternative I see on the horizon is https://servo.org/ from Mozilla, but it's still a work-in-progress.
Post reply on HN