Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

181–190 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#181

Post by elcomet »

ars wrote: post #73
asveikau wrote: post #13

Earlier quoted context omitted.

They don't want to need to update Rust in order to do a presumably small security patch on Firefox. Which honestly sounds like a totally awesome and legit reason to use -esr. Keep -current current with upstream, stable branch gets patches from firefox-esr. Keep in mind stable patches to the ports tree are pretty rare on OpenBSD. They didn't do them as binary packages until fairly recently, either.

Can they not backport the patch to the existing version of Firefox?

No, they'd have to change the name of the browser.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#182

Post by Conan_Kudo »

Qerub wrote: post #85
floatingatoll wrote: post #24

Earlier quoted context omitted.

RedHat’s “streams” model will certainly do a much better job of handling this than the other distributions do today. I hope that the need for having multiple parallel versions of a dependency coexist is incorporated into the other distros, because I’ve lost a lot of sanity this past two decades to the assumption that “one installed version should be enough for anybody” on Linux and BSD servers.

AppStream does not allow installation of multiple versions of the same app AFAIK. I believe this is what they refer to in the clumsy sentence "The one disadvantage of Application Streams from SCLs is that no two streams can be installed at the same time in to the same userspace. However, in our experience, this is not a common use case and is better served using containerization or virtualization to provide a second…

You can define AppStreams/modules that are parallel installable. Indeed, that's how the Python AppStreams are set up right now.

However, the default way an AppStream is made eschews parallel installation support.

Red Hat will make parallel-installable AppStreams whenever it is needed. And they can incorporate the content of one AppStream in another if need be.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#183

Post by bibyte »

celticmusic wrote: post #111
bscphil wrote: post #84

Earlier quoted context omitted.

> I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies It's funny, from your point of view having a centralized repository with a (usually) single (usually) latest version of a lib…

I left arch linux because I got tired of all the breakages, so not a great example.

Sometimes it feels like I am living in an alternate reality. After I started using Arch Linux as my main OS I was fully prepared for it to break every few months. But it's been more then 2 years (maybe even 3 or 4 ?) and not one breakage. Also keep in mind that I update it every single day. From time to time I check the Arch Linux news site to see if anything needs manual intervention. So far I haven't needed to do anything.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#184

Post by millettjon »

l0b0 wrote: post #140
progval wrote: post #105

Earlier quoted context omitted.

> auto-update more than a thousand packages, praying my Python and other projects survive, just because I want a browser update You may want to check out Nix. It's a package manager which isolates each program's dependencies; so you can have multiple versions of the same package. > or a security fix having a centralized repository like this helps in case a it's a library that needs a security fix, because you only ne…

> You may want to check out Nix. Nix is a fantastic concept, and I hope it takes over the world. But the NixOS packages are a mess. I tried it for a few months last year before giving up after several packages and even whole collections of packages became unusable even in the stable repository. The repository needs some serious reworking before Nix can really shine.

I've been using it for 2 years with very few problems.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#185

Post by hendry »

rascul wrote: post #163
tobias2014 wrote: post #144

Earlier quoted context omitted.

This is funny, I could tell exactly the same story the other way around. I came as a 10+ year Debian user to Archlinux because it did too much automagic under the hood that broke and took a lot of time to fix. No breakage on arch because no automagic behind your back. For a long time before using arch I thought too that rolling release might be more unstable, but I have come to the conclusion that quite the opposite…

Could you give some examples of the automagic stuff Debian does under the hood?

debhelper

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#186

Post by rleigh »

Avamander wrote: post #116
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

> praying my Python and other projects survive, just because I want a browser update or a security fix. You mean you aren't familiar with Python's virtual environment system exactly intended for isolating development dependencies from system ones but you're blaming the distribution. Please.

Virtualenvs don't protect you completely. If any of the modules in the virtualenv depend upon libraries on the host system, and a lot of Python modules do either directly or indirectly, then there is a chance of breakage if any of the ABIs of these modules break or there's an incompatible ABI between any of the modules.

Even virtualenvs themselves can cause the breakage. Take "pylibtiff". It embeds a copy of libtiff. But, it's old and incompatible with other libraries on the base system. This can be libraries it depends upon, or it could be another copy of the same library. Either way, virtualenvs can cause more problems than they solve.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#187

Post by Conan_Kudo »

zozbot234 wrote: post #71
jiveturkey wrote: post #57

Earlier quoted context omitted.

Yes it does actually work and has for decades. The poster is either confused or doing something different, I expect. The specific notice mentions rust dependencies. Rust does not have shared libraries, so a Rust [security] update means all rust binaries must be completely rebuilt. That seems to be part of OpenBSD's concern, and perhaps this has "triggered" the poster. user blackhaz random forum post found: > mariourk…

> Rust does not have shared libraries, so a Rust [security] update means all rust binaries must be completely rebuilt. What's the concern with that, exactly? OpenBSD is a security-focused distribution, do they not do reproducible builds?

Because rebuilding everything all the bloody time is expensive.

Virtually every Linux distribution and BSD share this concern. We've all complained about it to Rust upstream, but they don't care. To them, it's cheap to rebuild every Rust project every time the compiler is updated or the standard library needs a fix.

See for yourself: https://github.com/rust-lang/rfcs/issues/600

What's worse is that a lot of people are forgetting why we do it this way in the first place. While part of it was about saving disk space, the major reason we do this is for being able to fix things in a cheap way and have wide-ranging impact. Without this, things like security fixes to zlib, libvpx, or other important libraries would require finding all their reverse dependencies, patching them, and rebuilding them to incorporate the fixes.

It's incredibly important, but because nobody cares in Rust and Mozilla, we're all doomed...

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#188

Post by pferde »

NelsonMinar wrote: post #51
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Dumb solution with a blunt hammer; why not run Firefox in a container like Docker?

I do something like that. I have a separate minimal chroot directory with just Firefox installed and configured, and use systemd-nspawn to start a container. The container is using a snapshot (btrfs) of the chroot directory, which gets deleted when I close the Firefox instance.

I use this not as my main browser, but only when I can't avoid visiting "the wild web", meaning unknown or untrusted sites, or even sites that use too much javascript for me to feel safe allowing in my main browser.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#189

Post by lmilcin »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

If you are praying every time you are updating your distro you might be wanting to switch to Linux.

I heard it can tolerate two different applications using different versions of the same dependency...

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#190

Post by progval »

microtonal wrote: post #155
progval wrote: post #105

Earlier quoted context omitted.

> auto-update more than a thousand packages, praying my Python and other projects survive, just because I want a browser update You may want to check out Nix. It's a package manager which isolates each program's dependencies; so you can have multiple versions of the same package. > or a security fix having a centralized repository like this helps in case a it's a library that needs a security fix, because you only ne…

You may want to check out Nix. It's a package manager which isolates each program's dependencies; so you can have multiple versions of the same package. In principle true, yes. But it comes with a cost. Even the nixpkgs Firefox maintainers are considering to only ship Firefox ESR starting with NixOS 20.03: https://discourse.nixos.org/t/firefox-on-19-09-could-be-mark... https://github.com/NixOS/nixpkgs/pull/72126

I won't blame them. Firefox is a huge piece of software, and is updating every month. It's a bit shitty of Mozilla to expect every single distribution (most of which are run by volunteers) to package all their new dependencies and check everything works every single month.
Post reply on HN