6 ms·

Mozilla will release Firefox directly via snaps https://blog.mozilla.org/futurereleases/2016/04/21/firefox-default-browser-for-linux-users-ubuntu-new-snap-form

by dz0ny 10y ago

Mozilla will release Firefox directly via snaps https://blog.mozilla.org/futurereleases/2016/04/21/firefox-default-browser-for-linux-users-ubuntu-new-snap-format-coming-soon/ https://blog.mozilla.org/futurereleases/2016/04/21/firefox-d...

hansjorg 10y ago
What is the significance of this? Doesn't Canonical already update the package (lagging a day or two behind the official release) for the lifetime of the Ubuntu version?
- takno 10y ago
  I'd guess that Firefox is a fairly good candidate for this kind of packaging just because it has relatively few external dependencies, and lots of Mozilla-specific dependencies which are rarely used by other software
- rawfan 10y ago
  Firefox is going to be used as a testbed for snap packages.
- stubish 10y ago
  It will be Firefox, in a sandbox, out of the box.
symtos 10y ago
Using binaries provided by Mozilla is not a good idea (unless they do things differently with the snaps). They are not hardened in any way; ie. no PIE (rendering ASLR pretty much useless), no stack canaries, no relro, ..., making it a lot easier to exploit any given sec-related bug. $ hardening-check ./firefox ./firefox: Position Independent Executable: no, normal executable! Stack protected: no, not found! Fortify Source functions: no, only unprotected functions found! Read-only relocations: no, not found! Immediate binding: no, not found! Absolutely ridiculous given the amount of vulns likely to linger in its codebase. It should also be noted that Firefox is one of the few packages that Canonical keeps aligned with Mozilla releases (even 12.04 LTS has the latest firefox), and: $ hardening-check /usr/lib/firefox/firefox /usr/lib/firefox/firefox: Position Independent Executable: yes Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: yes
- cat-dev-null 10y ago
  More "innovations" which "justify" their own existence with novelty, but eliminate useful properties, backward compatibility, interoperability and standards with blissful ignorance. Standardization is a Good Thing(TM)... many formats creates a confusing dependency hell across multiple systems. Deb/apt works well. This will be deprecated in 6 months after a major security incident. Canonical is mismanaged and capricious, and this is just another in a long line of examples.

by dz0ny 10y ago

hansjorg 10y ago

What is the significance of this? Doesn't Canonical already update the package (lagging a day or two behind the official release) for the lifetime of the Ubuntu version?

takno 10y ago
I'd guess that Firefox is a fairly good candidate for this kind of packaging just because it has relatively few external dependencies, and lots of Mozilla-specific dependencies which are rarely used by other software
rawfan 10y ago
Firefox is going to be used as a testbed for snap packages.
stubish 10y ago
It will be Firefox, in a sandbox, out of the box.

symtos 10y ago

Using binaries provided by Mozilla is not a good idea (unless they do things differently with the snaps). They are not hardened in any way; ie. no PIE (rendering ASLR pretty much useless), no stack canaries, no relro, ..., making it a lot easier to exploit any given sec-related bug. $ hardening-check ./firefox ./firefox: Position Independent Executable: no, normal executable! Stack protected: no, not found! Fortify Source functions: no, only unprotected functions found! Read-only relocations: no, not found! Immediate binding: no, not found! Absolutely ridiculous given the amount of vulns likely to linger in its codebase. It should also be noted that Firefox is one of the few packages that Canonical keeps aligned with Mozilla releases (even 12.04 LTS has the latest firefox), and: $ hardening-check /usr/lib/firefox/firefox /usr/lib/firefox/firefox: Position Independent Executable: yes Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: yes

cat-dev-null 10y ago
More "innovations" which "justify" their own existence with novelty, but eliminate useful properties, backward compatibility, interoperability and standards with blissful ignorance. Standardization is a Good Thing(TM)... many formats creates a confusing dependency hell across multiple systems. Deb/apt works well. This will be deprecated in 6 months after a major security incident. Canonical is mismanaged and capricious, and this is just another in a long line of examples.