Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

331–339 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#331

Post by School-Cotton »

hashhar wrote: post #226
cbmuser wrote: post #222

Earlier quoted context omitted.

I disagree. The compiler is normally something that receives major updates in every new distribution release. That's why language specs exist for. If you are maintaining a large number of machines in an enterprise environment, you're not keen on updating half of the installed system just because you update your browser, simply because the necessary testing and fixing of regressions costs a lot of time and money for n…

You can have multiple Rust toolchains side by side. This is a non-issue in that case. If there's some other usecase that this breaks, I'd like to know about it and see if we can do something to improve the scenario.

The point is that, despite it being possible theoretically, the OpenBSD project does not want to take on the maintenance burden and additional clutter of having 40 (!) separate versions of the compiler toolchain in the ports tree with a new one landing every 6 weeks.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#332

Post by chousuke »

dzsekijo wrote: post #319
chousuke wrote: post #157

Earlier quoted context omitted.

Arch is not an easy distro to use even if you know what you're doing. Every Arch user essentially creates their own distribution which can break at any point depending on their particular environment. You need to take care of all the little things yourself. Personally I didn't experience all that much breakage, but eventually got frustrated by kernel updates breaking hotplug kernel module loading until reboot because…

Once you understand this, it seems to me to be a very simple step to align your kernel upgrades with reboots. I fail to see this as an usability issue.

Well, I still had to manually exclude the kernel every time I wanted to update other packages. It's a minor issue, but an annoying one.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#333

Post by useragent86 »

Carpetsmoker wrote: post #326
kevin_thibedeau wrote: post #273

Earlier quoted context omitted.

Just compile it yourself and put it in /usr/local.

Well, yeah, but that's bypassing the package manager. You can say that in response to pretty much every argument about "I don't like package manager X because Y".

Use "checkinstall" instead of "make install". It builds and installs packages automatically.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#334

Post by ric2b »

fao_ wrote: post #134
markstos wrote: post #29

Earlier quoted context omitted.

Complex apps can bundle their own dependencies-- that's what the Flatpak and Snap package formats do. You can also run Firefox in a Docker or LXD container with it's dependencies. By sharing the X11 or Wayland socket with the docker, the apps can appear on your main desktop.

Yes, and it sounds ideal but I've had a recurring problem where having snap installed on a system increases the boot time, and apps hang on load. They stop hanging when I install the native app, and use that instead.

IIRC that's because Snap's are stored compressed and have to be uncompressed when you first run them after boot.

I think that's because Snap is also meant to be used in IOT where disk space is limited but it definitely should be optional on work machines with lots of disk space.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#335

Post by samantohermes »

smacktoward wrote: post #45
app4soft wrote: post #31

Earlier quoted context omitted.

Waterfox (with Web Extensions) or Pale Moon (with XUL/UXP extensions)

If security is something you’re looking for, “Firefox plus some ancient, unmaintained legacy code and patches jammed in by random third parties” is not substantially more appealing than just Firefox by itself.

Fake news.

1. https://www.palemoon.org/roadmap.shtml

2. https://www.palemoon.org/releasenotes.shtml

3. https://forum.palemoon.org/viewtopic.php?f=65&t=22270

4. https://forum.palemoon.org/viewtopic.php?f=65&t=22399

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#336

Post by samantohermes »

jcranmer wrote: post #92
app4soft wrote: post #74

Earlier quoted context omitted.

> they don't really improve upon anything meaningful both of those have had more issues than Firefox in the past. Please, prove it.

From looking at the commit history of Pale Moon, it is maintained by essentially three people. Their maintenance strategy is to freeze at an old version of Firefox, and randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features. Given the sheer size of the codebase, its inherent complexity (a JIT compiler is going to be very ripe for potential security vulnerabilities), and the utter la…

> randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features

It's not "random", inform yourself: https://www.palemoon.org/roadmap.shtml

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#337

Post by samantohermes »

jcranmer wrote: post #120
superkuh wrote: post #107

Earlier quoted context omitted.

>utter lack of any sign of trying to mitigate these problems (e.g., fuzzing, or even merely attempting to identify security fixes in Firefox that may warrant backporting), And here's where you show you're making it up and haven't even looked at a Pale Moon release notes, http://www.palemoon.org/releasenotes.shtml

I don't read release notes, I read the commits and the patches themselves. Actually, I did check after posting, and they appear to do the bare minimum--port the posted CVEs, which won't even account for all the security bugs. There are definitely several commits I've seen them do where they specifically revert changes that rewrite functionality to be safer, but don't actually fix any specific known security flaw. If…

> Actually, I did check after posting, and they appear to do the bare minimum--port the posted CVEs, which won't even account for all the security bugs

If you actually read the release notes, you wouldn't say this.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#338

Post by samantohermes »

snazz wrote: post #108
superkuh wrote: post #101

Earlier quoted context omitted.

Yes. Firefox forks that forked before Mozilla jumped the shark (v37, then multiprocess, then rust) that evolved into their own thing without all the features/attack surfaces that aren't strictly required for a browser to just render html and execute JS.

Simpler, sure. Safer and more secure, how? There's been a lot of new security features in Firefox recently that you'd be missing out on if you used something that old. You can't put "just" in front of "execute JS" (or "render HTML" for that matter); that's a pretty complex task with a lot of security concerns. I can't imagine that the communities of these Firefox forks can keep up with backporting upstream security f…

What you are saying is not accurate.

1. https://www.palemoon.org/releasenotes.shtml

2. https://forum.palemoon.org/viewtopic.php?f=65&t=22270

3. https://forum.palemoon.org/viewtopic.php?f=65&t=22399

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#339

Post by samantohermes »

elagost wrote: post #40
app4soft wrote: post #31

Earlier quoted context omitted.

Waterfox (with Web Extensions) or Pale Moon (with XUL/UXP extensions)

If I'm to avoid Firefox, I'd like to avoid its forks as well - they don't really improve upon anything meaningful both of those have had more issues than Firefox in the past. I'm thinking smaller than Firefox.

Firefox has been turned into a Chrome copycat with built-in blocklists and Tor Browser Bundle features.

1. https://www.palemoon.org/technical.shtml

2. https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel...

Post reply on HN