Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

131–140 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#131

Post by c0nducktr »

superkuh wrote: post #101
elagost wrote: post #22

Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?

Yes. Firefox forks that forked before Mozilla jumped the shark (v37, then multiprocess, then rust) that evolved into their own thing without all the features/attack surfaces that aren't strictly required for a browser to just render html and execute JS.

Pretty sure this bug existed in v36 as well.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#132

Post by haroldp »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Would it be possible to run Firefox in it's own jail? All of my FreeBSD boxen are servers, so I don't have any experience with this but... put your crustier apps in containers so they don't poop in your main sandbox. Works for servers

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#133

Post by fao_ »

chmln wrote: post #123
celticmusic wrote: post #111

Earlier quoted context omitted.

I left arch linux because I got tired of all the breakages, so not a great example.

This has to be one of the most inaccurate memes of all time. To counter with anecdata: I've been running Arch Linux testing repositories for over a year now with no issues whatsoever.

I ran a stable arch system for 4 years with only one breaking change introduced. Everything else was minor with clear instructions on how to solve it on either main page or the forums

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#134

Post by fao_ »

markstos wrote: post #29
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Complex apps can bundle their own dependencies-- that's what the Flatpak and Snap package formats do. You can also run Firefox in a Docker or LXD container with it's dependencies. By sharing the X11 or Wayland socket with the docker, the apps can appear on your main desktop.

Yes, and it sounds ideal but I've had a recurring problem where having snap installed on a system increases the boot time, and apps hang on load. They stop hanging when I install the native app, and use that instead.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#135

Post by saagarjha »

andrekandre wrote: post #127
rvz wrote: post #46

Earlier quoted context omitted.

The downvotes in this section clearly show the real state of browser technologies and the few choice one will have if they use an alternative OS. Brave and Vivaldi are still forks of Chromium, Waterfox is a fork of Firefox. Thus you are not going to find any updated alternatives like those on the BSDs anytime soon. Meanwhile, WebKit-based browsers doesn't seem to suffer from the overuse of dependencies and multiple l…

> Meanwhile, WebKit-based browsers doesn't seem to suffer from the overuse of dependencies and multiple languages nor does it have packaging hell unlike Chromium and Firefox. why is that?

WebKit is commonly used on many platforms, so I’d guess that plays a big role in it.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#136

Post by saagarjha »

snazz wrote: post #103
LeoPanthera wrote: post #90

Earlier quoted context omitted.

GNOME has "GNOME Web", previously known as Epiphany. KDE has "Falkon". Both are quite good.

I'd still be seriously concerned about how few eyeballs they get with regards to security---Google has entire fleets of machines dedicated to fuzzing every line of Chromium code and both Chrome and Firefox use advanced sandboxing to make it so that a single exploit in the JavaScript engine wouldn't be able to result in user-level remote code execution. I'm sure they're both probably fine (if nothing else from securit…

GNOME Web is based on WebKit, while Falkon has migrated away from QtWebKit to QtWebEngine, which is Chromium based.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#137

Post by LeoPanthera »

saagarjha wrote: post #136
snazz wrote: post #103

Earlier quoted context omitted.

I'd still be seriously concerned about how few eyeballs they get with regards to security---Google has entire fleets of machines dedicated to fuzzing every line of Chromium code and both Chrome and Firefox use advanced sandboxing to make it so that a single exploit in the JavaScript engine wouldn't be able to result in user-level remote code execution. I'm sure they're both probably fine (if nothing else from securit…

GNOME Web is based on WebKit, while Falkon has migrated away from QtWebKit to QtWebEngine, which is Chromium based.

It's slightly ironic for KDE, as Blink is a fork of WebKit, which itself is a fork of KHTML, which was originally the KDE HTML renderer.

Full circle!

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#138

Post by geggam »

antpls wrote: post #55
barrkel wrote: post #43

Earlier quoted context omitted.

Shared libraries aren't just about reducing disk space and bandwidth consumption; it's also about fixing bugs in one place fixing it for all consumers. It requires discipline to only fix bugs and not break consumers, though, and therein lies the devil.

Shared libraries just don't work anymore. That's one of the reasons behind Go and containers. That way, the users always have working applications. Some applications may take more time to be up to date with their dependencies, but at least some of them can be updated asap without worrying about the others. For example, I use Debian 10 stable on my laptop, on which I installed Snapd. I then installed Firefox with Snap…

The idea of this is great.

On your personal system it probably works really well. In reality tracking thousands of containers on top of operating systems which are using different methodologies gets really complex and in reality isnt ever really done well. At least in my experience. ( granted fortune 100 / 500 never does anything well :) )

What seems to be happening is the burden of the developer to maintain dependencies is now shifted to operations to maintain the automation that manages the various versions of containers because the complexity is too great to do it any other way.

What I see happening in the application of this model is very similar to train wrecks. You see the crash coming for a long time but cant do anything to stop it.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#139

Post by jmclnx »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

It is not disk space you should be concerned with saving, but real memory usage. I wonder how much memory a statically liked Firefox uses under a heavy load. I checked with esr (what I use) and it is about a bit more that 1.3G excluding shared. So as firefox creates threads, I would think memory could get tight with a statically linked FF.

I fully agree with what OpenBSD has decided, I think the only thing worse that compiling Firefox is Gnome 3 :)

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#140

Post by l0b0 »

progval wrote: post #105
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

> auto-update more than a thousand packages, praying my Python and other projects survive, just because I want a browser update You may want to check out Nix. It's a package manager which isolates each program's dependencies; so you can have multiple versions of the same package. > or a security fix having a centralized repository like this helps in case a it's a library that needs a security fix, because you only ne…

> You may want to check out Nix.

Nix is a fantastic concept, and I hope it takes over the world. But the NixOS packages are a mess. I tried it for a few months last year before giving up after several packages and even whole collections of packages became unusable even in the stable repository. The repository needs some serious reworking before Nix can really shine.

Post reply on HN