Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #166648 > unrolled thread

Iceweasel security updates?

Back to article view | Back to linux.debian.user

Contents

  Iceweasel security updates? Harris Paltrowitz <harris1nyc@gmail.com> - 2016-04-12 15:10 +0200
    Re: Iceweasel security updates? Lisi Reisz <lisi.reisz@gmail.com> - 2016-04-12 15:50 +0200
      Re: Iceweasel security updates? Harris Paltrowitz <harris1nyc@gmail.com> - 2016-04-12 16:20 +0200
        Re: Iceweasel security updates? Lisi Reisz <lisi.reisz@gmail.com> - 2016-04-12 17:10 +0200
          Re: Iceweasel security updates? Harris Paltrowitz <harris1nyc@gmail.com> - 2016-04-12 17:50 +0200
            Re: Iceweasel security updates? The Wanderer <wanderer@fastmail.fm> - 2016-04-12 18:10 +0200
              Re: Iceweasel security updates? Lisi Reisz <lisi.reisz@gmail.com> - 2016-04-12 18:20 +0200
              Re: Iceweasel security updates? Harris Paltrowitz <harris1nyc@gmail.com> - 2016-04-12 21:10 +0200
            Re: Iceweasel security updates? Lisi Reisz <lisi.reisz@gmail.com> - 2016-04-12 18:20 +0200
              Re: Iceweasel security updates? Harris Paltrowitz <harris1nyc@gmail.com> - 2016-04-12 18:30 +0200
    Re: Iceweasel security updates? Stefan Monnier <monnier@iro.umontreal.ca> - 2016-04-12 16:30 +0200
    Re: Iceweasel security updates? The Wanderer <wanderer@fastmail.fm> - 2016-04-12 17:20 +0200

#166648 — Iceweasel security updates?

Hey all,

Recently when I started using Debian I noticed that the version of 
Iceweasel that Jessie comes with is 38.7.1, whereas the latest Firefox 
is 45.  I also noticed that when I visit www.citibank.com using 
Iceweasel 38.7.1 the Citibank website tells me that my browser is out of 
date and not supported, and that "for a better online banking 
experience" I should update my browser.  However, this appears to be 
just a warning as the site appears to allow me to log in to my account, 
although I haven't tried this yet as I'm still trying to determine 
whether Iceweasel 38.7.1 is secure enough for online banking...  or 
whether I'm just being too paranoid!

The Firefox website says that Firefox 38.7.1 is an ESR release (in fact 
it was evidently just released on 3/16/16); I therefore assume that 
security updates will be continuously provided for it until it reaches 
end of life, after which I would move to the next browser version that 
Debian officially supports.

Is it therefore safe to assume that Iceweasel 38.7.1 will be receiving 
all relevant/important security updates, which should therefore make me 
feel comfortable using it for online banking?

Thanks in advance.
Harris

[toc] | [next] | [standalone]

#166651

On Tuesday 12 April 2016 14:09:12 Harris Paltrowitz wrote:
> Hey all,
>
> Recently when I started using Debian I noticed that the version of
> Iceweasel that Jessie comes with is 38.7.1, whereas the latest Firefox
> is 45.  I also noticed that when I visit www.citibank.com using
> Iceweasel 38.7.1 the Citibank website tells me that my browser is out of
> date and not supported, and that "for a better online banking
> experience" I should update my browser.  However, this appears to be
> just a warning as the site appears to allow me to log in to my account,
> although I haven't tried this yet as I'm still trying to determine
> whether Iceweasel 38.7.1 is secure enough for online banking...  or
> whether I'm just being too paranoid!
>
> The Firefox website says that Firefox 38.7.1 is an ESR release (in fact
> it was evidently just released on 3/16/16); I therefore assume that
> security updates will be continuously provided for it until it reaches
> end of life, after which I would move to the next browser version that
> Debian officially supports.
>
> Is it therefore safe to assume that Iceweasel 38.7.1 will be receiving
> all relevant/important security updates, which should therefore make me
> feel comfortable using it for online banking?
>
> Thanks in advance.
> Harris

What's wrong with using firefox-release as is now recommended?  On Wheezy I 
have Firefox 45.0.1.
http://mozilla.debian.net/
Remember to use "jessie" not "wheezy" if that is what you are running.

Lisi

[toc] | [prev] | [next] | [standalone]

#166653

On 04/12/2016 09:43 AM, Lisi Reisz wrote:
> On Tuesday 12 April 2016 14:09:12 Harris Paltrowitz wrote:
>> Hey all,
>>
>> Recently when I started using Debian I noticed that the version of
>> Iceweasel that Jessie comes with is 38.7.1, whereas the latest Firefox
>> is 45.  I also noticed that when I visit www.citibank.com using
>> Iceweasel 38.7.1 the Citibank website tells me that my browser is out of
>> date and not supported, and that "for a better online banking
>> experience" I should update my browser.  However, this appears to be
>> just a warning as the site appears to allow me to log in to my account,
>> although I haven't tried this yet as I'm still trying to determine
>> whether Iceweasel 38.7.1 is secure enough for online banking...  or
>> whether I'm just being too paranoid!
>>
>> The Firefox website says that Firefox 38.7.1 is an ESR release (in fact
>> it was evidently just released on 3/16/16); I therefore assume that
>> security updates will be continuously provided for it until it reaches
>> end of life, after which I would move to the next browser version that
>> Debian officially supports.
>>
>> Is it therefore safe to assume that Iceweasel 38.7.1 will be receiving
>> all relevant/important security updates, which should therefore make me
>> feel comfortable using it for online banking?
>>
>> Thanks in advance.
>> Harris
> What's wrong with using firefox-release as is now recommended?  On Wheezy I
> have Firefox 45.0.1.
> http://mozilla.debian.net/
> Remember to use "jessie" not "wheezy" if that is what you are running.
>
> Lisi
>

I tried Firefox 45 last week but as you may remember from my recent 
emails, I experienced major issues with choppy videos in Youtube using 
Firefox 45, but not with Iceweasel 38.7.1.  I've since done a Debian 
re-install and I want to start fresh using optimal applications, so I'd 
like to stick with 38.7.1 (as it appears to be more compatible with 
Jessie) but I'm curious about the security updates to it.

Harris

[toc] | [prev] | [next] | [standalone]

#166657

On Tuesday 12 April 2016 15:14:08 Harris Paltrowitz wrote:
> On 04/12/2016 09:43 AM, Lisi Reisz wrote:
> > On Tuesday 12 April 2016 14:09:12 Harris Paltrowitz wrote:
> >> Hey all,
> >>
> >> Recently when I started using Debian I noticed that the version of
> >> Iceweasel that Jessie comes with is 38.7.1, whereas the latest Firefox
> >> is 45.  I also noticed that when I visit www.citibank.com using
> >> Iceweasel 38.7.1 the Citibank website tells me that my browser is out of
> >> date and not supported, and that "for a better online banking
> >> experience" I should update my browser.  However, this appears to be
> >> just a warning as the site appears to allow me to log in to my account,
> >> although I haven't tried this yet as I'm still trying to determine
> >> whether Iceweasel 38.7.1 is secure enough for online banking...  or
> >> whether I'm just being too paranoid!
> >>
> >> The Firefox website says that Firefox 38.7.1 is an ESR release (in fact
> >> it was evidently just released on 3/16/16); I therefore assume that
> >> security updates will be continuously provided for it until it reaches
> >> end of life, after which I would move to the next browser version that
> >> Debian officially supports.
> >>
> >> Is it therefore safe to assume that Iceweasel 38.7.1 will be receiving
> >> all relevant/important security updates, which should therefore make me
> >> feel comfortable using it for online banking?
> >>
> >> Thanks in advance.
> >> Harris
> >
> > What's wrong with using firefox-release as is now recommended?  On Wheezy
> > I have Firefox 45.0.1.
> > http://mozilla.debian.net/
> > Remember to use "jessie" not "wheezy" if that is what you are running.
> >
> > Lisi
>
> I tried Firefox 45 last week but as you may remember from my recent
> emails, I experienced major issues with choppy videos in Youtube using
> Firefox 45, but not with Iceweasel 38.7.1.  I've since done a Debian
> re-install and I want to start fresh using optimal applications, so I'd
> like to stick with 38.7.1 (as it appears to be more compatible with
> Jessie) but I'm curious about the security updates to it.

Would firefox-esr (same site) solve that?  I wouldn't bank on many updates for 
iceweasel now it is somewhat deprecated.  

Lisi

[toc] | [prev] | [next] | [standalone]

#166660

On 04/12/2016 11:06 AM, Lisi Reisz wrote:
> On Tuesday 12 April 2016 15:14:08 Harris Paltrowitz wrote:
>> I tried Firefox 45 last week but as you may remember from my recent
>> emails, I experienced major issues with choppy videos in Youtube using
>> Firefox 45, but not with Iceweasel 38.7.1.  I've since done a Debian
>> re-install and I want to start fresh using optimal applications, so I'd
>> like to stick with 38.7.1 (as it appears to be more compatible with
>> Jessie) but I'm curious about the security updates to it.
> Would firefox-esr (same site) solve that?  I wouldn't bank on many updates for
> iceweasel now it is somewhat deprecated.
>
> Lisi
>

I realize now that the selection list on that Mozilla/Debian website has 
several release options that I don't understand -- besides esr/45 (which 
is the version I had problems with) there's release, beta and aurora.  
Do you know what the differences are here?

Cheers
Harris

[toc] | [prev] | [next] | [standalone]

#166661

[Multipart message — attachments visible in raw view] — view raw

On 2016-04-12 at 11:43, Harris Paltrowitz wrote:

> On 04/12/2016 11:06 AM, Lisi Reisz wrote:
> 
>> On Tuesday 12 April 2016 15:14:08 Harris Paltrowitz wrote:
>> 
>>> I tried Firefox 45 last week but as you may remember from my
>>> recent emails, I experienced major issues with choppy videos in
>>> Youtube using Firefox 45, but not with Iceweasel 38.7.1.  I've
>>> since done a Debian re-install and I want to start fresh using
>>> optimal applications, so I'd like to stick with 38.7.1 (as it
>>> appears to be more compatible with Jessie) but I'm curious about
>>> the security updates to it.
>> 
>> Would firefox-esr (same site) solve that?  I wouldn't bank on many
>> updates for iceweasel now it is somewhat deprecated.
> 
> I realize now that the selection list on that Mozilla/Debian website
> has several release options that I don't understand -- besides esr/45
> (which is the version I had problems with) there's release, beta and
> aurora. Do you know what the differences are here?

The Firefox development process follows a type of cascading release:
http://www.askvg.com/mozilla-updates-firefox-update-channels-nightly-aurora-beta-and-release/

There are nightly builds, which are compiled every night from the public
source tree (assuming it actually builds at the moment), and made
available for developer use. These are bleeding-edge, potentially
unstable and buggy code.

There's the 'Aurora' release channel, which is the next stage of
stability after nightly builds. It's more or less the "experimental
release" niche, the first step towards designating something as a
release; think of it as comparable to an alpha release. After the old
'Aurora' becomes the new 'Beta', a version of the latest nightly code
becomes the new Aurora. Not every new patch gets into Aurora - only
patches which the developers agree are important for the coming release.

There's the 'Beta' release channel, which is the next stage of stability
after Aurora. After the old 'Beta' becomes the new 'Release' version,
the old Aurora becomes the new Beta. As with Aurora, not every new patch
gets into Beta - and the standards for what qualifies to get in are
tighter than with Aurora.

There's the 'Release' release channel, which is what gets published as a
new official Firefox version. Once every six weeks (or thereabouts), the
old Beta becomes the new Release. No patches at all are accepted into
Release, unless a critically urgent oh-shit-that's-bad issue is
discovered and the developers decide to make a "chemspill" point release
(e.g., the difference between 45.0 and 45.0.1).

There's the 'ESR' release channel, which is maintained over roughly a
year-long period. Once every seven Firefox major versions (which come
once every six weeks), a copy of the new Release version becomes the new
ESR. In theory, only security and stability patches make it into the
ESR; new features, and anything which might introduce a regression, are
verboten. (In practice, the developers sometimes don't live up to that
ideal.)


The more you need stability, the lower down this list you should go
with. The newer and faster you need new features and potential bug fixes
(at the risk of new bugs being _added_), the higher up the list you
should go with.

For myself, I always recommend that anyone not actively developing
Firefox should run the ESR.

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [next] | [standalone]

#166662

On Tuesday 12 April 2016 17:08:10 The Wanderer wrote:
> On 2016-04-12 at 11:43, Harris Paltrowitz wrote:
> > On 04/12/2016 11:06 AM, Lisi Reisz wrote:
> >> On Tuesday 12 April 2016 15:14:08 Harris Paltrowitz wrote:
> >>> I tried Firefox 45 last week but as you may remember from my
> >>> recent emails, I experienced major issues with choppy videos in
> >>> Youtube using Firefox 45, but not with Iceweasel 38.7.1.  I've
> >>> since done a Debian re-install and I want to start fresh using
> >>> optimal applications, so I'd like to stick with 38.7.1 (as it
> >>> appears to be more compatible with Jessie) but I'm curious about
> >>> the security updates to it.
> >>
> >> Would firefox-esr (same site) solve that?  I wouldn't bank on many
> >> updates for iceweasel now it is somewhat deprecated.
> >
> > I realize now that the selection list on that Mozilla/Debian website
> > has several release options that I don't understand -- besides esr/45
> > (which is the version I had problems with) there's release, beta and
> > aurora. Do you know what the differences are here?
>
> The Firefox development process follows a type of cascading release:
> http://www.askvg.com/mozilla-updates-firefox-update-channels-nightly-aurora
>-beta-and-release/
>
> There are nightly builds, which are compiled every night from the public
> source tree (assuming it actually builds at the moment), and made
> available for developer use. These are bleeding-edge, potentially
> unstable and buggy code.
>
> There's the 'Aurora' release channel, which is the next stage of
> stability after nightly builds. It's more or less the "experimental
> release" niche, the first step towards designating something as a
> release; think of it as comparable to an alpha release. After the old
> 'Aurora' becomes the new 'Beta', a version of the latest nightly code
> becomes the new Aurora. Not every new patch gets into Aurora - only
> patches which the developers agree are important for the coming release.
>
> There's the 'Beta' release channel, which is the next stage of stability
> after Aurora. After the old 'Beta' becomes the new 'Release' version,
> the old Aurora becomes the new Beta. As with Aurora, not every new patch
> gets into Beta - and the standards for what qualifies to get in are
> tighter than with Aurora.
>
> There's the 'Release' release channel, which is what gets published as a
> new official Firefox version. Once every six weeks (or thereabouts), the
> old Beta becomes the new Release. No patches at all are accepted into
> Release, unless a critically urgent oh-shit-that's-bad issue is
> discovered and the developers decide to make a "chemspill" point release
> (e.g., the difference between 45.0 and 45.0.1).
>
> There's the 'ESR' release channel, which is maintained over roughly a
> year-long period. Once every seven Firefox major versions (which come
> once every six weeks), a copy of the new Release version becomes the new
> ESR. In theory, only security and stability patches make it into the
> ESR; new features, and anything which might introduce a regression, are
> verboten. (In practice, the developers sometimes don't live up to that
> ideal.)
>
>
> The more you need stability, the lower down this list you should go
> with. The newer and faster you need new features and potential bug fixes
> (at the risk of new bugs being _added_), the higher up the list you
> should go with.
>
> For myself, I always recommend that anyone not actively developing
> Firefox should run the ESR.

But in this case it was the ESR with which he was having problems, so it might 
be worth trying something else - and release is what Debian offers by 
default.

Lisi

[toc] | [prev] | [next] | [standalone]

#166665

On 04/12/2016 12:08 PM, The Wanderer wrote
> The Firefox development process follows a type of cascading release:
> http://www.askvg.com/mozilla-updates-firefox-update-channels-nightly-aurora-beta-and-release/
>
> There are nightly builds, which are compiled every night from the public
> source tree (assuming it actually builds at the moment), and made
> available for developer use. These are bleeding-edge, potentially
> unstable and buggy code.
>
> There's the 'Aurora' release channel, which is the next stage of
> stability after nightly builds. It's more or less the "experimental
> release" niche, the first step towards designating something as a
> release; think of it as comparable to an alpha release. After the old
> 'Aurora' becomes the new 'Beta', a version of the latest nightly code
> becomes the new Aurora. Not every new patch gets into Aurora - only
> patches which the developers agree are important for the coming release.
>
> There's the 'Beta' release channel, which is the next stage of stability
> after Aurora. After the old 'Beta' becomes the new 'Release' version,
> the old Aurora becomes the new Beta. As with Aurora, not every new patch
> gets into Beta - and the standards for what qualifies to get in are
> tighter than with Aurora.
>
> There's the 'Release' release channel, which is what gets published as a
> new official Firefox version. Once every six weeks (or thereabouts), the
> old Beta becomes the new Release. No patches at all are accepted into
> Release, unless a critically urgent oh-shit-that's-bad issue is
> discovered and the developers decide to make a "chemspill" point release
> (e.g., the difference between 45.0 and 45.0.1).
>
> There's the 'ESR' release channel, which is maintained over roughly a
> year-long period. Once every seven Firefox major versions (which come
> once every six weeks), a copy of the new Release version becomes the new
> ESR. In theory, only security and stability patches make it into the
> ESR; new features, and anything which might introduce a regression, are
> verboten. (In practice, the developers sometimes don't live up to that
> ideal.)
>
>
> The more you need stability, the lower down this list you should go
> with. The newer and faster you need new features and potential bug fixes
> (at the risk of new bugs being _added_), the higher up the list you
> should go with.
>
> For myself, I always recommend that anyone not actively developing
> Firefox should run the ESR.
>


Thanks for all the details, W!  This should definitely come in handy.

[toc] | [prev] | [next] | [standalone]

#166663

On Tuesday 12 April 2016 16:43:47 Harris Paltrowitz wrote:
> On 04/12/2016 11:06 AM, Lisi Reisz wrote:
> > On Tuesday 12 April 2016 15:14:08 Harris Paltrowitz wrote:
> >> I tried Firefox 45 last week but as you may remember from my recent
> >> emails, I experienced major issues with choppy videos in Youtube using
> >> Firefox 45, but not with Iceweasel 38.7.1.  I've since done a Debian
> >> re-install and I want to start fresh using optimal applications, so I'd
> >> like to stick with 38.7.1 (as it appears to be more compatible with
> >> Jessie) but I'm curious about the security updates to it.
> >
> > Would firefox-esr (same site) solve that?  I wouldn't bank on many
> > updates for iceweasel now it is somewhat deprecated.
> >
> > Lisi
>
> I realize now that the selection list on that Mozilla/Debian website has
> several release options that I don't understand -- besides esr/45 (which
> is the version I had problems with) there's release, beta and aurora.
> Do you know what the differences are here?

Aurora is alpha and will be 47 - a long way from release-ready - and beta is 
almost release-ready, so probably 46.  If you had trouble with esr45, why not 
try release?  It should be up to date and stable.  esr45 is supposed to be 45 
long term support - but 45 might still be sufficiently different not to have 
the bug.  I currently have 45.0.1 on Wheezy.  I have just checked and so has 
my husband on Jessie.

Lisi

[toc] | [prev] | [next] | [standalone]

#166664

On 04/12/2016 12:16 PM, Lisi Reisz wrote:
> Aurora is alpha and will be 47 - a long way from release-ready - and 
> beta is almost release-ready, so probably 46. If you had trouble with 
> esr45, why not try release? It should be up to date and stable. esr45 
> is supposed to be 45 long term support - but 45 might still be 
> sufficiently different not to have the bug. I currently have 45.0.1 on 
> Wheezy. I have just checked and so has my husband on Jessie. Lisi 


I've actually decided to just stay with Iceweasel 38.7.1, as I've 
learned (from the excellent responses here) that this ESR version should 
be considered adequately safe.

[toc] | [prev] | [next] | [standalone]

#166655

> Recently when I started using Debian I noticed that the version of Iceweasel
> that Jessie comes with is 38.7.1, whereas the latest Firefox is 45.  I also
> noticed that when I visit www.citibank.com using Iceweasel 38.7.1 the
> Citibank website tells me that my browser is out of date and not supported,

FWIW, it' frequent to get this message regardless of your browser's
version, simply because they don't recognize "Iceweasel", as opposed to
"Firefox".

> Is it therefore safe to assume that Iceweasel 38.7.1 will be receiving all
> relevant/important security updates, which should therefore make me feel
> comfortable using it for online banking?

Yes.


        Stefan

[toc] | [prev] | [next] | [standalone]

#166658

[Multipart message — attachments visible in raw view] — view raw

On 2016-04-12 at 09:09, Harris Paltrowitz wrote:

> Hey all,
> 
> Recently when I started using Debian I noticed that the version of 
> Iceweasel that Jessie comes with is 38.7.1, whereas the latest
> Firefox is 45.  I also noticed that when I visit www.citibank.com
> using Iceweasel 38.7.1 the Citibank website tells me that my browser
> is out of date and not supported, and that "for a better online
> banking experience" I should update my browser.  However, this
> appears to be just a warning as the site appears to allow me to log
> in to my account, although I haven't tried this yet as I'm still
> trying to determine whether Iceweasel 38.7.1 is secure enough for
> online banking...  or whether I'm just being too paranoid!
> 
> The Firefox website says that Firefox 38.7.1 is an ESR release (in
> fact it was evidently just released on 3/16/16); I therefore assume
> that security updates will be continuously provided for it until it
> reaches end of life, after which I would move to the next browser
> version that Debian officially supports.
> 
> Is it therefore safe to assume that Iceweasel 38.7.1 will be
> receiving all relevant/important security updates, which should
> therefore make me feel comfortable using it for online banking?

Firefox 38 is an ESR release version of Firefox, which receives
security-update releases (once every six weeks, plus emergency
micro-version bumps when an urgent oh-shit-this-is-bad fix-it-now
problem is discovered).

38.7.1 is the _last_ update to the ESR 38 line; unless something leads
Mozilla to break from their longstanding established practice, there
will be no more 38.x releases. ESR 45 has already been released, and in
fact is up to (as of sometime today) 45.0.2 after two of those
oh-shit-fix-it-now releases.

For the last year or two, Debian has been tracking the ESR directly, so
the next Iceweasel/Firefox package update(s) will involve transitioning
from the 38ESR line to the 45ESR line. Exactly when those updates will
hit I don't know; I don't monitor the correct forums to be in the loop
on that planning.

That said, I'm still using 38.7.1 myself, and until Firefox 46 is
released (at the same time as Firefox ESR 45.1.0, six weeks after the
release of 38.7.0 and 45) it should still be safe enough.

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web