Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #188120 > unrolled thread

Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]

Back to article view | Back to linux.debian.user

Contents

  Re: Password managers [WAS: Re: when do I get a browsere that will do  internet purchases?] Jeremy Nicoll <jn.ml.dbn.25@letterboxes.org> - 2017-10-20 14:00 +0200
    Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?] "Garreau\, Alexandre" <galex-713@galex-713.eu> - 2017-10-20 21:50 +0200
      Re: Password managers [WAS: Re: when do I get a browsere that will  do internet purchases?] The Wanderer <wanderer@fastmail.fm> - 2017-10-20 22:20 +0200
        Firefox Future and Config [WAS: Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]] "Garreau\, Alexandre" <galex-713@galex-713.eu> - 2017-10-21 00:10 +0200
          Re: Firefox Future and Config [WAS: Re: Password managers [WAS: Re:  when do I get a browsere that will do internet purchases?]] The Wanderer <wanderer@fastmail.fm> - 2017-10-21 00:30 +0200
            Re: Firefox Future and Config [WAS: Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]] "Garreau\, Alexandre" <galex-713@galex-713.eu> - 2017-10-21 01:40 +0200
          Re: Firefox Future and Config [WAS: Re: Password managers] Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-10-23 09:30 +0200

#188120 — Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]

On Fri, 20 Oct 2017, at 02:27, Garreau, Alexandre wrote:

> I’d especially like to notice that there are the packages
> *xul-ext-gnome-keyring* and *xul-ext-kwallet5* which make both Firefox
> and Thunderbird use respectively GNOME and KDE’s password
> managers. That’s way more secure imho, and especially with the package
> xul-ext-pwdhash.

But haven't Mozilla, just phased-out xul support in Firefox, requiring
extensions to be written using the 'web-extensions' API?

https://developer.mozilla.org/en-US/Add-ons/WebExtensions

-- 
Jeremy Nicoll - my opinions are my own.

[toc] | [next] | [standalone]

#188134 — Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]

Maybe these extensions will be remade and repackaged with web-extensions
then (afaik it’s a good move, yet breaking all the old apps forever is
bad, they should re-integrate it after I while I’d personally prefer).

Waiting for this, XUL extensions I install through Debian on stable are
perfectly working (maybe if they, dunno, keep easy for distros like
debian to patch firefox in order to keep XUL support some time that’d
help?), so that’s probably for a too recent, or even future, version
that XUL doesn’t work anymore…

[toc] | [prev] | [next] | [standalone]

#188135 — Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]

[Multipart message — attachments visible in raw view] — view raw

On 2017-10-20 at 15:46, Garreau, Alexandre wrote:

> Maybe these extensions will be remade and repackaged with
> web-extensions then (afaik it’s a good move, yet breaking all the old
> apps forever is bad, they should re-integrate it after I while I’d
> personally prefer).
> 
> Waiting for this, XUL extensions I install through Debian on stable
> are perfectly working (maybe if they, dunno, keep easy for distros
> like debian to patch firefox in order to keep XUL support some time
> that’d help?), so that’s probably for a too recent, or even future,
> version that XUL doesn’t work anymore…

It will happen with Firefox 57, which I believe was just released, or
ESR 59, which is due out along with Firefox 59 - in other words, if I'm
not mistaken, probably in January.

Past that point, your only options are:

* Find (and/or make) an extension which does what you need in a way that
is compatible with WebExtensions. In some cases - most prominently,
anything that needs to modify the Firefox UI - this will not happen; the
Mozilla developers explicitly do not want to support doing that.

* Switch to one of the Firefox forks; Waterfox and Pale Moon are the two
best-spoken-of that I know of, and of course there's always still
Seamonkey (although that diverged far enough back that I'd be surprised
if many modern pre-WebExtensions Firefox extensions were still
compatible with it out-of-the-box).

* Stick with ESR52, avoiding upgrades, until some better solution
presents itself - however many years that takes.

For myself, unless Debian decides to start packaging one of the forks
which retains compatibility with the "long tail" of extensions, I will
be taking option three. (At least three of the addons which I consider
non-negotiably critical explicitly need to perform UI modification as
part of the features for which I want them, and at least two of them are
entirely unmaintained except by me.)

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [next] | [standalone]

#188137 — Firefox Future and Config [WAS: Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]]

Wait, do you mean overriding password manager, and TreeStyleTabs will
certainly and definitely stop to work?

Would it be realistic to find some way to make Debian maintain patches/a
fork (or package GNU IceCat and work with them? why isn’t any fork
packaged into Debian? ’cause Firefox isn’t known to be that cool for
their decisions) that could still do that? Possibly still supporting XUL
plus WebExtensions of course, but also maybe some extended version of
WebExtensions that allow this kind of stuff?

[toc] | [prev] | [next] | [standalone]

#188138 — Re: Firefox Future and Config [WAS: Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]]

[Multipart message — attachments visible in raw view] — view raw

(Please learn to quote properly. Failure to quote at all is arguably
even worse than top-posting.)

On 2017-10-20 at 18:07, Garreau, Alexandre wrote:

> Wait, do you mean overriding password manager, and TreeStyleTabs
> will certainly and definitely stop to work?

I don't know about TreeStyleTabs. I recall hearing that a solution was
in place for at least some vertical-tabs extensions, but I have not been
following WebExtensions progress closely, simply because the stress of
knowing that I'm going to be left behind anyway is not good for my
psychological health.

The other I don't know about, but I wouldn't be terribly confident about
it. Check with the developers of the extension(s) you're concerned
about; if they'll be supported as WebExtensions, the developers will
probably already have made releases which include that support.

> Would it be realistic to find some way to make Debian maintain
> patches/a fork (or package GNU IceCat and work with them?

Not really. A proper fork of a project the size of Firefox is a MAJOR
project, particularly if you aren't going to be able to draw on
importing upstream's work anymore (because they're rewriting their base
to the point where the patches they write won't be applicable).

Plus, part of the reason why Mozilla has decided to drop XUL support
(part and parcel of the WebExtensions move) is that they find that the
work involved in maintaining it and keeping up further development based
on it is unsustainable - and that's Mozilla, which if I'm not mistaken
is a much larger and better-funded organization than Debian is.

It would not be completely impossible for a volunteer-basis organization
to come together and pick up the work and contribute funds to pay for
the infrastructure and so forth, but as it hasn't really happened in all
these years of Mozilla, the odds of it happening now aren't great either.

> why isn’t any fork packaged into Debian?

As I understand it, because that would mean having to support two very
similar codebases for security patches, which is double the work for the
security team and for relatively little return.

Beyond that, probably also people haven't been coming out of the
woodwork to volunteer to package them.

The former concern may be less significant in the future if Firefox
diverges far enough from the XUL codebase of the forks that there isn't
really much duplication, but even if so, that doesn't guarantee that the
security team will be willing to accept having both.

> ’cause Firefox isn’t known to be that cool for their decisions) that
> could still do that? Possibly still supporting XUL plus WebExtensions
> of course,

As above, this would quickly become unmaintainable in the absence of a
much larger outpouring of sustained, skilled volunteer effort than is
likely to occur.

Even if such a volunteer work were to get going, it would be better to
have it be independent of Debian, for a variety of reasons. (And basing
it on one of the existing forks would probably be a good idea, if only
because they probably already have some of that volunteer developer
base.)

> but also maybe some extended version of WebExtensions that allow this
> kind of stuff?

About the closest thing I can think of to this would be something akin
to what the recent Firefox versions have had: supporting both
WebExtensions and XUL extensions side-by-side, and also supporting
"hybrid" extensions (one type embedded inside the other) which can talk
to both APIs to some degree.

Firefox only supported those for transitional purposes, but it might not
be impossible to keep them around as a thing of their own - although the
effort required to do so, particularly long-term, would probably be
prohibitive.

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [next] | [standalone]

#188139 — Re: Firefox Future and Config [WAS: Re: Password managers [WAS: Re: when do I get a browsere that will do internet purchases?]]

On 20/10/2017 at 18:22, The Wanderer wrote:
> (Please learn to quote properly. Failure to quote at all is arguably
> even worse than top-posting.)

Sorry, when I’m answering to all or the main part of a message
completely I find it clearer to try to begin answering with a sole mail,
but thank for the remind of the public convention

> simply because the stress of knowing that I'm going to be left behind
> anyway is not good for my psychological health.

I understand quite well :/ happens often for me…

> Plus, part of the reason why Mozilla has decided to drop XUL support
> (part and parcel of the WebExtensions move) is that they find that the
> work involved in maintaining it and keeping up further development based
> on it is unsustainable - and that's Mozilla, which if I'm not mistaken
> is a much larger and better-funded organization than Debian is.

Damn, Firefox is really that kind of gigantic never-stable software
that’s horrible for that kind of thing (recall me the concept forged by
some french librist about “liberator software”, complementar to the
“free software” concept but about sociomaterial constraints limiting
material freedom of the users), quite the opposite of software such as
TeX and their symbolic tangential versionning… Maybe it is even
intrinsic to the web…

[toc] | [prev] | [next] | [standalone]

#188195 — Re: Firefox Future and Config [WAS: Re: Password managers]

"Garreau, Alexandre" writes:
> Wait, do you mean overriding password manager, and TreeStyleTabs will
> certainly and definitely stop to work?

TreeStyleTab is already ported to the new Web Extensions:
  https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/
It says "Compatible with Firefox 57+" right at the top besides the name.

Ansgar

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web