Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

81–90 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#81

Post by jolmg »

ars wrote: post #70
sandov wrote: post #41

Earlier quoted context omitted.

I'll go one step further: The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. The way shared libraries are used in Linux is built upon the assumption that package managers and centralized repositories are the right way to do things.

> The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. I've done it both ways. Centralized works a LOT better. It's not even close. You get a more stable system, and you get security bugs fixed faster, and more reliably. What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. And that's OK.

> What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in.

Depends on the distro. Archlinux is pretty fast to update packages.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#82

Post by Ericson2314 »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

I have been interested in finding BSD users who are interested in https://nixos.org/nix/ or even a NixOS/kBSD. It solves all these problems and in my view is the continuation of the spirit of the port system.

(The problem with bundling isn't disk space, but composition. Individual applications can compose fine, but libraries can't if they link other libraries at different versions, and use those library's types (ABI) in their own interface (ABI). To solve this problem you need to distinguish between public vs private dependencies in your package manager.)

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#83

Post by Ericson2314 »

espadrine wrote: post #68
abtinf wrote: post #61

Earlier quoted context omitted.

Why are they “wrong at a fundamental level”?

I believe they are suboptimal for the same reason that lexical binding won over dynamic binding in language design: it is easier to reason with immutable bindings, and to maintain as little global state as possible. The work done in Nix and Guix is interesting in this regard.

I wouldn't say nix isn't anti-centralization, I'd say it's policy-agnostic. At the end of the day, not everything composes, only things whose interface is in some way compatible.

Traditional package manager conflate having something with composing something (everything is ambiantly available and interacting). Nix separates those, so you can have every version of everything, and only try to compose things that fit.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#84

Post by bscphil »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

> I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies

It's funny, from your point of view having a centralized repository with a (usually) single (usually) latest version of a library is a bad thing that may be (and probably isn't) justified by the goal of saving space.

From my point of view having a centralized repository with a (usually) single (usually) latest version of a library is an awesome thing that I would leave any other ecosystem to get, and the space savings is just a bonus that doesn't much matter.

Most dependency maintainers don't provide updates for more than a few versions of their software. When one piece of software depends on -latest and another piece of software depends on -legacy, you can ship both with the central repository model. In the Linux distributions I've used this is a solved problem. Arch Linux has five different versions of the JRE that are separately installable.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#85

Post by Qerub »

floatingatoll wrote: post #24
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

RedHat’s “streams” model will certainly do a much better job of handling this than the other distributions do today. I hope that the need for having multiple parallel versions of a dependency coexist is incorporated into the other distros, because I’ve lost a lot of sanity this past two decades to the assumption that “one installed version should be enough for anybody” on Linux and BSD servers.

AppStream does not allow installation of multiple versions of the same app AFAIK. I believe this is what they refer to in the clumsy sentence "The one disadvantage of Application Streams from SCLs is that no two streams can be installed at the same time in to the same userspace. However, in our experience, this is not a common use case and is better served using containerization or virtualization to provide a second userspace." in the linked article in the sibling comment.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#86

Post by anjbe »

zozbot234 wrote: post #78
anjbe wrote: post #23

Earlier quoted context omitted.

Okay, suppose someone backporting a Rust update runs a big batch of tests and finds, say, two dozen packages with regressions. Now what? Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed? And all this to only get a…

> Okay, suppose someone backporting a Rust update runs a big batch of tests and finds, say, two dozen packages with regressions. > Now what? > Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed? Yes, people do exact…

> Yes, people do exactly that. It's part of running a "rolling" distro

And we do that too—for OpenBSD -current. But we have neither the manpower nor the interest to do such work for old releases.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#87

Post by archi42 »

jolmg wrote: post #81
ars wrote: post #70

Earlier quoted context omitted.

> The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. I've done it both ways. Centralized works a LOT better. It's not even close. You get a more stable system, and you get security bugs fixed faster, and more reliably. What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. And that's OK.

> What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. Depends on the distro. Archlinux is pretty fast to update packages.

This! Our company OpenSUSE Tumbleweeds were still vulnerable on Friday. On Arch, the package was already available for two days then.

The thing is, the distro maintainers need to decide whether they want a fast moving "latest and greatest" approach, which might break stuff by accident, or go a "slow but always dependable" route, which you can depend on as company, with painful losses if things go south (in which case there should be an express lane for important security fixes).

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#88

Post by LeoPanthera »

jackhalford wrote: post #33
markstos wrote: post #29

Earlier quoted context omitted.

Complex apps can bundle their own dependencies-- that's what the Flatpak and Snap package formats do. You can also run Firefox in a Docker or LXD container with it's dependencies. By sharing the X11 or Wayland socket with the docker, the apps can appear on your main desktop.

none of those solutions apply the BSDs though

Can you run graphical applications inside a BSD jail?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#89

Post by Gaelan »

shpx wrote: post #79
elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

The only true alternative I see on the horizon is https://servo.org/ from Mozilla, but it's still a work-in-progress.

My understanding is that there will never be a consumer-facing browser called "Servo." Instead, pieces of Servo will get merged into Firefox as they become production-ready (this has already begun). Presumably, eventually everything will be merged in and Servo will stop existing as a separate project.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#90

Post by LeoPanthera »

elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

GNOME has "GNOME Web", previously known as Epiphany.

KDE has "Falkon".

Both are quite good.

Post reply on HN