Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #224465 > unrolled thread

Firefox non-ESR update needed

Back to article view | Back to linux.debian.user

Contents

  Firefox non-ESR update needed Gary Dale <gary@extremeground.com> - 2020-07-07 00:20 +0200
    Re: Firefox non-ESR update needed Dan Ritter <dsr@randomstring.org> - 2020-07-07 00:30 +0200
      Re: Firefox non-ESR update needed Gary Dale <gary@extremeground.com> - 2020-07-07 05:30 +0200
        Re: Firefox non-ESR update needed <tomas@tuxteam.de> - 2020-07-07 10:00 +0200
      Re: Firefox non-ESR update needed Keith bainbridge <keithrbau@gmail.com> - 2020-07-07 05:50 +0200
        Re: Firefox non-ESR update needed Keith bainbridge <keithrbau@gmail.com> - 2020-07-08 02:20 +0200
    Re: Firefox non-ESR update needed Bob Weber <bobrweber@gmail.com> - 2020-07-07 02:10 +0200
      Re: Firefox non-ESR update needed Gary Dale <gary@extremeground.com> - 2020-07-07 05:40 +0200
        Re: Firefox non-ESR update needed Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-07 09:00 +0200
          Re: Firefox non-ESR update needed Gary Dale <gary@extremeground.com> - 2020-07-07 15:50 +0200
            Re: Firefox non-ESR update needed Greg Wooledge <wooledg@eeg.ccf.org> - 2020-07-07 16:00 +0200
              Re: Firefox non-ESR update needed rhkramer@gmail.com - 2020-07-07 16:10 +0200
                Re: Firefox non-ESR update needed Greg Wooledge <wooledg@eeg.ccf.org> - 2020-07-07 16:30 +0200
                  Re: Firefox non-ESR update needed rhkramer@gmail.com - 2020-07-08 17:20 +0200
                Re: Firefox non-ESR update needed David Wright <deblis@lionunicorn.co.uk> - 2020-07-07 17:40 +0200
                  Re: Firefox non-ESR update needed John Hasler <jhasler@newsguy.com> - 2020-07-07 18:10 +0200
                  Re: Firefox non-ESR update needed Gene Heskett <gheskett@shentel.net> - 2020-07-07 18:10 +0200
                    Re: Firefox non-ESR update needed  John Hasler <jhasler@newsguy.com> - 2020-07-07 18:40 +0200
                      Re: Firefox non-ESR update needed Gene Heskett <gheskett@shentel.net> - 2020-07-07 19:30 +0200
                        Re: Firefox non-ESR update needed Greg Wooledge <wooledg@eeg.ccf.org> - 2020-07-07 19:40 +0200
                        Re: Firefox non-ESR update needed John Hasler <jhasler@newsguy.com> - 2020-07-07 19:50 +0200
                          Re: Firefox non-ESR update needed Richard Hector <richard@walnut.gen.nz> - 2020-07-08 23:20 +0200
                    Re: Firefox non-ESR update needed Peter Ehlert <peter@sdi-baja.com> - 2020-07-07 18:50 +0200
                      Re: Firefox non-ESR update needed Gene Heskett <gheskett@shentel.net> - 2020-07-07 19:30 +0200
                      Re: Firefox non-ESR update needed Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-07 21:20 +0200
                        Re: Firefox non-ESR update needed Joe <joe@jretrading.com> - 2020-07-07 21:40 +0200
                          Re: Firefox non-ESR update needed David Wright <deblis@lionunicorn.co.uk> - 2020-07-07 23:30 +0200
              Re: Firefox non-ESR update needed Gary Dale <gary@extremeground.com> - 2020-07-07 22:30 +0200
                Re: Firefox non-ESR update needed Greg Wooledge <wooledg@eeg.ccf.org> - 2020-07-07 22:50 +0200
                Re: Firefox non-ESR update needed Dan Ritter <dsr@randomstring.org> - 2020-07-07 23:00 +0200
                Re: Firefox non-ESR update needed davidson <davidson@freevolt.org> - 2020-07-07 23:10 +0200
                  Re: Firefox non-ESR update needed davidson <davidson@freevolt.org> - 2020-07-07 23:50 +0200
                Re: Firefox non-ESR update needed Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-08 07:20 +0200

Page 2 of 2 — ← Prev page 1 [2]

#224521

Look at

https://backports.debian.org/

Note that for Firefox you need to go to

https://mozilla.debian.net/

-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#224609

On 8/07/20 5:42 am, John Hasler wrote:
> Look at
> 
> https://backports.debian.org/
> 
> Note that for Firefox you need to go to
> 
> https://mozilla.debian.net/
> 

I think you'll find that mozilla.debian.net is a bit out of date - it
only goes up to stretch.

Richard

[toc] | [prev] | [next] | [standalone]

#224514

On 7/7/20 9:02 AM, Gene Heskett wrote:
> On Tuesday 07 July 2020 11:32:04 David Wright wrote:
>
>> On Tue 07 Jul 2020 at 10:06:08 (-0400), rhkramer@gmail.com wrote:
>>> On Tuesday, July 07, 2020 09:57:54 AM Greg Wooledge wrote:
>>>> If you are the kind of person who MUST HAVE THE LATEST THING, then
>>>> Debian is not meant for you.
>>> Wow, not sure what sparked that response,
>> Probably the fact that there have been a lot of postings about testing
>> recently, which seem to think testing is whatever they want it to be.
>> For example, the thread on testing's imaginary "security policy".
>>
>>> but I will say one thing, you might
>>> run testing if your bank insists you have the latest thing
>>> (browser).
>> Yeh, right. Use the suite that's lacking a security policy to carry
>> out all your financial transactions. ?
>>
>> Cheers,
>> David.
> I'd tend to look at it like this: If the banks IT people think its a big
> enough risk to use the old version, and demands the new one even before
> the paint is dry, then it must be pretty serious and the distros should
> turn up the heat to get it out into the users hands asap. Not sit on it
> till the next release a year hence as seems to happen now, using the
> excuse that it is a new feature and that has to wait for the next
> chapter of the release cycle.
I had that conversation with the IT goofball for my bank (credit union) 
last Monday and Tuesday when they "updated" their crapware and blocked me.

it was far from painless but a couple links to the security statements 
in the Debian Wiki was enough to get a complete backpedal and endorse 
Debian Stable with Firefox-ESR.
Please don't use them as a barometer.

>
> Unfortunately, the public is now so used to some so-called expert crying
> wolf when its a mongrel puppy, that they've gone to the dark side and
> are no longer making that noise in hopes the black hats will be slowed
> in exploiting the newly found vulnerability. So we are left in the
> dark. 'scuse me?
>
> So we the users, are damned if we do, and damned if we don't.
>
> Cheers, Gene Heskett

[toc] | [prev] | [next] | [standalone]

#224518

On Tuesday 07 July 2020 12:26:58 Peter Ehlert wrote:

> On 7/7/20 9:02 AM, Gene Heskett wrote:
> > On Tuesday 07 July 2020 11:32:04 David Wright wrote:
> >> On Tue 07 Jul 2020 at 10:06:08 (-0400), rhkramer@gmail.com wrote:
> >>> On Tuesday, July 07, 2020 09:57:54 AM Greg Wooledge wrote:
> >>>> If you are the kind of person who MUST HAVE THE LATEST THING,
> >>>> then Debian is not meant for you.
> >>>
> >>> Wow, not sure what sparked that response,
> >>
> >> Probably the fact that there have been a lot of postings about
> >> testing recently, which seem to think testing is whatever they want
> >> it to be. For example, the thread on testing's imaginary "security
> >> policy".
> >>
> >>> but I will say one thing, you might
> >>> run testing if your bank insists you have the latest thing
> >>> (browser).
> >>
> >> Yeh, right. Use the suite that's lacking a security policy to carry
> >> out all your financial transactions. ?
> >>
> >> Cheers,
> >> David.
> >
> > I'd tend to look at it like this: If the banks IT people think its a
> > big enough risk to use the old version, and demands the new one even
> > before the paint is dry, then it must be pretty serious and the
> > distros should turn up the heat to get it out into the users hands
> > asap. Not sit on it till the next release a year hence as seems to
> > happen now, using the excuse that it is a new feature and that has
> > to wait for the next chapter of the release cycle.
>
> I had that conversation with the IT goofball for my bank (credit
> union) last Monday and Tuesday when they "updated" their crapware and
> blocked me.
>
I had a similar experience a decade back, essentially matching one from 3 
decades back and found that my threats to move the account were more 
than sufficient to "get it fixed".  Seems as how a middle 5 digit 
checking account carries considerable weight.  I've only had one problem 
since, they changed something that prevented any dates from printing in 
my online statements, they showed onscreen but were blank when printed, 
ruining any chance of using them in court to settle an argument. I 
arrived with smoke coming out of both ears and had the local manager put 
me back on paper statements.  Suits me just fine and I'm no longer out 
the hassle of doing my own statements.  The monthly usually has a "go 
paperless" blow-in that gets recycled by way of the shredder.

> it was far from painless but a couple links to the security statements
> in the Debian Wiki was enough to get a complete backpedal and endorse
> Debian Stable with Firefox-ESR.
> Please don't use them as a barometer.

My experience has been otherwise. Threatening the cash cow with a diet 
works well.

> > Unfortunately, the public is now so used to some so-called expert
> > crying wolf when its a mongrel puppy, that they've gone to the dark
> > side and are no longer making that noise in hopes the black hats
> > will be slowed in exploiting the newly found vulnerability. So we
> > are left in the dark. 'scuse me?
> >
> > So we the users, are damned if we do, and damned if we don't.

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#224526

[Multipart message — attachments visible in raw view] — view raw

On Ma, 07 iul 20, 09:26:58, Peter Ehlert wrote:
> 
> I had that conversation with the IT goofball for my bank (credit 
> union) last
> Monday and Tuesday when they "updated" their crapware and blocked me.
> 
> it was far from painless but a couple links to the security statements in
> the Debian Wiki was enough to get a complete backpedal and endorse Debian
> Stable with Firefox-ESR.
> Please don't use them as a barometer.

+1 on not using banks' IT as reference. The ones at my bank can't even 
get the decimal separator right.


Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#224529

On Tue, 7 Jul 2020 22:10:54 +0300
Andrei POPESCU <andreimpopescu@gmail.com> wrote:

> On Ma, 07 iul 20, 09:26:58, Peter Ehlert wrote:
> > 
> > I had that conversation with the IT goofball for my bank (credit 
> > union) last
> > Monday and Tuesday when they "updated" their crapware and blocked
> > me.
> > 
> > it was far from painless but a couple links to the security
> > statements in the Debian Wiki was enough to get a complete
> > backpedal and endorse Debian Stable with Firefox-ESR.
> > Please don't use them as a barometer.  
> 
> +1 on not using banks' IT as reference. The ones at my bank can't
> even get the decimal separator right.
> 

Yes, my bank occasionally becomes inaccessible to FF, though not
usually for more than about a week, when a cluebat has been wielded. I
switch to Midori until it is fixed. It's a more limited browser, but it
usually seems to handle sites that cause problems for FF.

An odd one recently: a web-only insurance company was returning a 'down
for maintenance' page. After two days, I thought 'this can't be right',
and fired up Midori, and sure enough, no problem. I haven't bothered
finding out what Midori pretends to be (certainly no web designer will
have heard of it), but websites that block FireFox are not good news
for their owners. Had I not already had an account with these people,
this would have been a warning to look elsewhere.

You just can't get the staff...

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#224539

On Tue 07 Jul 2020 at 20:39:05 (+0100), Joe wrote:
> Yes, my bank occasionally becomes inaccessible to FF, though not
> usually for more than about a week, when a cluebat has been wielded. I
> switch to Midori until it is fixed. It's a more limited browser, but it
> usually seems to handle sites that cause problems for FF.
> 
> An odd one recently: a web-only insurance company was returning a 'down
> for maintenance' page. After two days, I thought 'this can't be right',
> and fired up Midori, and sure enough, no problem. I haven't bothered
> finding out what Midori pretends to be

Perhaps what I fired up above my head (it's 94°F outside):

https://www.menards.com/main/lighting-ceiling-fans/ceiling-fans/indoor-ceiling-fans/patriot-lighting-trade-midori-ii-52-led-ceiling-fan/20684/p-1534400991345.htm

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#224532

On 2020-07-07 09:57, Greg Wooledge wrote:
> On Tue, Jul 07, 2020 at 09:45:56AM -0400, Gary Dale wrote:
>> I did install it and it is a single package. It runs fine in parallel with
>> the esr release. Hopefully the maintainers will continue the practice of
>> having firefox and firefox_esr available and bring it to Testing.
> You don't understand what testing *IS*!
>
> Testing is not a "rolling release".
>
> Testing is not a thing you use because it makes you cooler.
>
> Testing is not a thing you use because it has higher version numbers of
> packages, and the sum of all the package version numbers is your score,
> and having a higher score makes you win the game.
>
> Testing is not a thing you use because you're an immature child who thinks
> any package more than a year old is, like, TOO OLD TO BE USED BY ANYONE,
> like ohmygod.
>
> Testing is the NEXT STABLE RELEASE.
>
> Testing is what will become Debian 11, bullseye, in a year or two.
>
> When bullseye is stable, it will not have an unstable firefox package.
>
> When bullseye is stable, it will have firefox-esr, which is a stable
> package (or as close as you can get with a browser), because it is a
> stable release.
>
> Therefore, testing has firefox-esr.
>
> You run testing because you want to help TEST THE NEXT STABLE RELEASE,
> so that you can find bugs in it and report them, and get them fixed
> before the release.
>
> Because they sure as hell will not be fixed AFTER the release.  This is
> your one and only chance.
>
> If you are the kind of person who MUST HAVE THE LATEST THING, then
> Debian is not meant for you.
>
> This includes browsers.

The package maintainers are who make packages stable, not the product 
developers.

There is nothing to prevent a none-esr version of Firefox from making it 
into stable. The maintainers just need to install the bug fix patches 
created to fix the bugs in that particular version. This is exactly what 
they do when significant bugs are found in the stable version of any 
package (in fact, a significant security bug was patched in 
Stretch/Stable a couple of years back that broke things. I had to hold 
the package back until Buster became the new Stable).

I agree that Mozilla's decision to abandon reasonable numbering is a 
problem. But the esr release is a year old at this point and will be 
even older by the time Bullseye becomes stable.

The other issue is what's the point of a non-esr package in SID if it's 
not going to make it down to Testing then Stable? Version 78 is the next 
esr release anyway, so why put the non-esr edition in SID?

Anyway, I run the esr version normally, but having a significantly newer 
version available for those who want it doesn't seem like a bad thing. I 
remember not too long ago when Stable had two versions of Scribus...

[toc] | [prev] | [next] | [standalone]

#224533

On Tue, Jul 07, 2020 at 04:28:16PM -0400, Gary Dale wrote:
> There is nothing to prevent a none-esr version of Firefox from making it
> into stable.

There are several things I can think of.  One of them is "common sense".
Another one is "Debian policy".

But you can't hear anything that violates your assumption set about
testing as a rolling release, so whatever.  Have fun with your computer
however you like.

[toc] | [prev] | [next] | [standalone]

#224536

Gary Dale wrote: 
> There is nothing to prevent a none-esr version of Firefox from making it
> into stable. The maintainers just need to install the bug fix patches
> created to fix the bugs in that particular version. This is exactly what
> they do when significant bugs are found in the stable version of any package
> (in fact, a significant security bug was patched in Stretch/Stable a couple
> of years back that broke things. I had to hold the package back until Buster
> became the new Stable).
> 
> I agree that Mozilla's decision to abandon reasonable numbering is a
> problem. But the esr release is a year old at this point and will be even
> older by the time Bullseye becomes stable.

No, it won't. Mozilla offered 78.0.1esr a few days ago; it is
likely to be the one that goes into Bullseye.

-dsr-

[toc] | [prev] | [next] | [standalone]

#224537

[Multipart message — attachments visible in raw view] — view raw

On Tue, 7 Jul 2020 Gary Dale wrote:
> On 2020-07-07 09:57, Greg Wooledge wrote:
>> On Tue, Jul 07, 2020 at 09:45:56AM -0400, Gary Dale wrote:
>>> I did install it and it is a single package. It runs fine in
>>> parallel with the esr release. Hopefully the maintainers will
>>> continue the practice of having firefox and firefox_esr available
>>> and bring it to Testing.
>> You don't understand what testing *IS*!
>> 
>> Testing is not a "rolling release".
>> 
>> Testing is not a thing you use because it makes you cooler.
>> 
>> Testing is not a thing you use because it has higher version
>> numbers of packages, and the sum of all the package version numbers
>> is your score, and having a higher score makes you win the game.
>> 
>> Testing is not a thing you use because you're an immature child who
>> thinks any package more than a year old is, like, TOO OLD TO BE
>> USED BY ANYONE, like ohmygod.
>> 
>> Testing is the NEXT STABLE RELEASE.
>> 
>> Testing is what will become Debian 11, bullseye, in a year or two.
>> 
>> When bullseye is stable, it will not have an unstable firefox package.
>> 
>> When bullseye is stable, it will have firefox-esr, which is a
>> stable package (or as close as you can get with a browser), because
>> it is a stable release.
>> 
>> Therefore, testing has firefox-esr.
>> 
>> You run testing because you want to help TEST THE NEXT STABLE
>> RELEASE, so that you can find bugs in it and report them, and get
>> them fixed before the release.
>> 
>> Because they sure as hell will not be fixed AFTER the release.
>> This is your one and only chance.
>> 
>> If you are the kind of person who MUST HAVE THE LATEST THING, then
>> Debian is not meant for you.
>> 
>> This includes browsers.
>
> The package maintainers are who make packages stable, not the
> product developers.

People who run testing and report bugs make a significant contribution
to the stability of stable, don't you think?

> There is nothing to prevent a none-esr version of Firefox from
> making it into stable. The maintainers just need to install the bug
> fix patches created to fix the bugs in that particular version.

People who run testing and report bugs make a significant contribution
to the stability of stable, don't you think? (Déjà vu!)

> This is exactly what they do when significant bugs are found in the
> stable version of any package
> (in fact, a significant security bug was patched in Stretch/Stable a
               ^^^^^^^^^^^ ^^^^^^^^
> couple of years back that broke things.
                        ^^^^ ^^^^^ ^^^^^^

You seem to be taking the position that you would like this breakage
in stable to occur more frequently, and for the sake of introducing
fixes of less significance.

Do I misunderstand your position?

> I had to hold the package back until Buster became the new Stable).
[snip]

-- 
What do you want to take off? [hrzF or ?*] F
You were wearing a +0 robe.  The frost giant turns to flee.

[toc] | [prev] | [next] | [standalone]

#224542

[Multipart message — attachments visible in raw view] — view raw

On Tue, 7 Jul 2020 davidson wrote:
> On Tue, 7 Jul 2020 Gary Dale wrote:
>> On 2020-07-07 09:57, Greg Wooledge wrote:
>>> On Tue, Jul 07, 2020 at 09:45:56AM -0400, Gary Dale wrote:
>>>> I did install it and it is a single package. It runs fine in
>>>> parallel with the esr release. Hopefully the maintainers will
>>>> continue the practice of having firefox and firefox_esr available
>>>> and bring it to Testing.
>>> You don't understand what testing *IS*!
>>> 
>>> Testing is not a "rolling release".
>>> 
>>> Testing is not a thing you use because it makes you cooler.
>>> 
>>> Testing is not a thing you use because it has higher version
>>> numbers of packages, and the sum of all the package version numbers
>>> is your score, and having a higher score makes you win the game.
>>> 
>>> Testing is not a thing you use because you're an immature child who
>>> thinks any package more than a year old is, like, TOO OLD TO BE
>>> USED BY ANYONE, like ohmygod.
>>> 
>>> Testing is the NEXT STABLE RELEASE.
>>> 
>>> Testing is what will become Debian 11, bullseye, in a year or two.
>>> 
>>> When bullseye is stable, it will not have an unstable firefox package.
>>> 
>>> When bullseye is stable, it will have firefox-esr, which is a
>>> stable package (or as close as you can get with a browser), because
>>> it is a stable release.
>>> 
>>> Therefore, testing has firefox-esr.
>>> 
>>> You run testing because you want to help TEST THE NEXT STABLE
>>> RELEASE, so that you can find bugs in it and report them, and get
>>> them fixed before the release.
>>> 
>>> Because they sure as hell will not be fixed AFTER the release.
>>> This is your one and only chance.
>>> 
>>> If you are the kind of person who MUST HAVE THE LATEST THING, then
>>> Debian is not meant for you.
>>> 
>>> This includes browsers.
>> 
>> The package maintainers are who make packages stable, not the
>> product developers.
>
> People who run testing and report bugs make a significant contribution
> to the stability of stable, don't you think?
>
>> There is nothing to prevent a none-esr version of Firefox from
>> making it into stable.  The maintainers just need to install the
>> bug fix patches created to fix the bugs in that particular version.
>
> People who run testing and report bugs make a significant contribution
> to the stability of stable, don't you think? (Déjà vu!)

I should add: It seems to me your wishlist proposal entails that
certain resources --both the work of maintainers, and the population
of debian testers prone to use Firefox-- which at present are directed
toward the release cycle of a single package, will henceforth be split
between two packages.

Do you think this is true?

-- 
What do you want to take off? [hrzF or ?*] F
You were wearing a +0 robe.  The frost giant turns to flee.

[toc] | [prev] | [next] | [standalone]

#224570

[Multipart message — attachments visible in raw view] — view raw

On Ma, 07 iul 20, 16:28:16, Gary Dale wrote:
> 
> The package maintainers are who make packages stable, not the product
> developers.

Hmm...
 
> There is nothing to prevent a none-esr version of Firefox from making it
> into stable.

For the particular software named "Firefox" there is. It's Mozilla's 
trademark policy (remember Iceweasel?).

> The maintainers just need to install the bug fix patches
> created to fix the bugs in that particular version. This is exactly what
> they do when significant bugs are found in the stable version of any package
> (in fact, a significant security bug was patched in Stretch/Stable a couple
> of years back that broke things. I had to hold the package back until Buster
> became the new Stable).

Providing security support to software for ~3 years (2 in stable, and 1 
in oldstable) without upstream's cooperation is difficult. For a complex 
and exposed software like Firefox even more so (remember the OpenSSH 
keys issue?). 

> I agree that Mozilla's decision to abandon reasonable numbering is a
> problem. But the esr release is a year old at this point and will be even
> older by the time Bullseye becomes stable.

In my opinion the introduction of the ESR release by Mozilla was a big 
gain for all those who prefer to use the same software for significant 
periods of time (years rather than months) and is a must for any big 
organisation (think 100s or 1000s of users contacting the company IT 
support at every change of browser version).

> The other issue is what's the point of a non-esr package in SID if it's not
> going to make it down to Testing then Stable? Version 78 is the next esr
> release anyway, so why put the non-esr edition in SID?

For sid users, of course ;)

> Anyway, I run the esr version normally, but having a significantly newer
> version available for those who want it doesn't seem like a bad thing. I
> remember not too long ago when Stable had two versions of Scribus...

Sure, feel free to offer your support to the Firefox packaging team 
(err... person?), after you convinced Mozilla to change their trademark 
policy.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web