Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

111–120 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#111

Post by celticmusic »

bscphil wrote: post #84
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

> I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies It's funny, from your point of view having a centralized repository with a (usually) single (usually) latest version of a lib…

I left arch linux because I got tired of all the breakages, so not a great example.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#112

Post by celticmusic »

jolmg wrote: post #81
ars wrote: post #70

Earlier quoted context omitted.

> The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. I've done it both ways. Centralized works a LOT better. It's not even close. You get a more stable system, and you get security bugs fixed faster, and more reliably. What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. And that's OK.

> What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. Depends on the distro. Archlinux is pretty fast to update packages.

and breaks constantly, which is why I stopped using it.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#113

Post by jcranmer »

rvz wrote: post #56
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Well the reality is, some developers of these complex software complain how their software ported to alternative OSes is difficult to maintain even when the BSD devs would offer to maintain it, which is why the BSDs are always on their own here in terms of porting, testing, packaging and updating the software in question. For example, Chromium. Any BSD developer would know that attempting to upstream their port there…

> For example, Chromium. Any BSD developer would know that attempting to upstream their port there is dead in the water. AFAICT, They Chromium devs only care about Win, Mac, Linux and nothing else. Likewise for Firefox, which is why the BSDs don't get official releases.

Firefox does maintain ports for the BSDs. https://bugzilla.mozilla.org/show_bug.cgi?id=1598511, an OpenBSD-only issue, was fixed less than a month ago.

The BSDs qualify as "Tier 3" in Mozilla's build terminology, which means that the onus is on external contributors to identify problems and propose fixes, as there is no continuous integration support for these architectures.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#114

Post by jcranmer »

app4soft wrote: post #106
jcranmer wrote: post #92

Earlier quoted context omitted.

From looking at the commit history of Pale Moon, it is maintained by essentially three people. Their maintenance strategy is to freeze at an old version of Firefox, and randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features. Given the sheer size of the codebase, its inherent complexity (a JIT compiler is going to be very ripe for potential security vulnerabilities), and the utter la…

I not see any proofs here. Only your personal opinion.

Read https://github.com/MoonchildProductions/UXP/commits/master for yourself.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#115

Post by celticmusic »

AdamJacobMuller wrote: post #95
asveikau wrote: post #18

Earlier quoted context omitted.

I meant small as in code size. In a stable branch you want the size of changes to be small and targeted despite how severe the issue is. You don't want to take on new bugs from patches that aren't related to issues you want to see fixed.

If the change is so small, I don't see why they wouldn't be able to backport the fix? Don't upgrade firefox (and any dependencies), just fix the bug. It would be a lot harder if the actual fix was more complicated and a much more complicated diff. Possible that master has diverged sufficiently from their version that backporting the fix would be unreasonable.

What I find hilarious is that Rust, our lord and saviour, not only didn't prevent the issue, but is actively hampering the fix.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#116

Post by Avamander »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

> praying my Python and other projects survive, just because I want a browser update or a security fix.

You mean you aren't familiar with Python's virtual environment system exactly intended for isolating development dependencies from system ones but you're blaming the distribution. Please.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#119

Post by jolmg »

celticmusic wrote: post #112
jolmg wrote: post #81

Earlier quoted context omitted.

> What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. Depends on the distro. Archlinux is pretty fast to update packages.

and breaks constantly, which is why I stopped using it.

"brake" makes it sound like one would have to reinstall the whole thing. I don't think I've ever had that happen in the 10 years since I started using it for nearly everything.

I've had my drive fail, but that was the drive's fault, and even in that case I also didn't need to reinstall everything. I just copied the good files and reinstalled only the packages whose files got corrupted.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#120

Post by jcranmer »

superkuh wrote: post #107
jcranmer wrote: post #92

Earlier quoted context omitted.

From looking at the commit history of Pale Moon, it is maintained by essentially three people. Their maintenance strategy is to freeze at an old version of Firefox, and randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features. Given the sheer size of the codebase, its inherent complexity (a JIT compiler is going to be very ripe for potential security vulnerabilities), and the utter la…

>utter lack of any sign of trying to mitigate these problems (e.g., fuzzing, or even merely attempting to identify security fixes in Firefox that may warrant backporting), And here's where you show you're making it up and haven't even looked at a Pale Moon release notes, http://www.palemoon.org/releasenotes.shtml

I don't read release notes, I read the commits and the patches themselves. Actually, I did check after posting, and they appear to do the bare minimum--port the posted CVEs, which won't even account for all the security bugs. There are definitely several commits I've seen them do where they specifically revert changes that rewrite functionality to be safer, but don't actually fix any specific known security flaw.

If I really wanted to scare you, I'd tell you about such security-friendly-sounding commits as "we don't want the newest release of the [crypto] library, let's freeze at an older version" or "re-enable support for RC4 in TLS." But that would be unfair, because you'd actually have to read the commit to judge for yourself if I'm quoting them in good context.

Post reply on HN