3 ms·

See also this comment further up in the bug: "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather t

by dao- 10y ago

See also this comment further up in the bug: "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users. I don't know if we'll get to the point where they can just ship a re-packaged bundle with some pref flips and add-ons, but the more of their patches we incorporate into mozilla-central the easier it will be for them to apply their remaining patches each release." (https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16 https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16)

technomancy 10y ago
It's worrying to me that they imply ESR is less secure; isn't the whole point that it gets security fixes applied to it? Less churn should make it more secure.
- tedmiston 10y ago
  > Maintenance of each ESR, through point releases, is limited to high-risk/high-impact security vulnerabilities and in rare cases may also include off-schedule releases that address live security vulnerabilities. Backports of any functional enhancements and/or stability fixes are not in scope. https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/
  - technomancy 10y ago
    Damn; I assumed since it was shipped in Debian Stable it had all the same guarantees as the rest of the distro, but I guess the browser codebases tend to be such security disasters that they can't necessarily keep up.
    - mgbmtl 10y ago
      Projects release new versions of software not just for new features, but (one would hope) constant improvements to the underlying architecture. Firefox in particular has been evolving quickly, with many of under-the-hood improvements that may not fix "high-risk" security issues, but constantly improve security directly or indirectly (e10s?). You can't expect maintainers of an ESR to backport all those things. There's always a risk in adopting the latest version of a program, but there's also a risk with keeping the old, less actively maintained version. I get burned all the time with Debian Stable, running into bugs fixed in the latest version but not backported. (nonetheless, I do prefer Debian Stable to most other solutions) A project I'm involved in even has an automatic "toxic code" warning for PRs on known functions/classes that need to be refactored, and where monkey-patching will likely cause other security issues one way or another.
- rictic 10y ago
  Speculating but some new features are security features, like support for additional CSP directives, cipher suites, that sort of thing.
- yuhong 10y ago
  An example is "Slaughterhouse" (see https://bugzilla.mozilla.org/show_bug.cgi?id=929539 https://bugzilla.mozilla.org/show_bug.cgi?id=929539 and http://bholley.net/blog/2016/the-right-fix.html http://bholley.net/blog/2016/the-right-fix.html). This is not the only incident where Mozilla people have suggested hiding bugs until an old ESR goes end of life BTW.

by dao- 10y ago

technomancy 10y ago

It's worrying to me that they imply ESR is less secure; isn't the whole point that it gets security fixes applied to it? Less churn should make it more secure.

tedmiston 10y ago
> Maintenance of each ESR, through point releases, is limited to high-risk/high-impact security vulnerabilities and in rare cases may also include off-schedule releases that address live security vulnerabilities. Backports of any functional enhancements and/or stability fixes are not in scope. https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/
- technomancy 10y ago
  Damn; I assumed since it was shipped in Debian Stable it had all the same guarantees as the rest of the distro, but I guess the browser codebases tend to be such security disasters that they can't necessarily keep up.
  - mgbmtl 10y ago
    Projects release new versions of software not just for new features, but (one would hope) constant improvements to the underlying architecture. Firefox in particular has been evolving quickly, with many of under-the-hood improvements that may not fix "high-risk" security issues, but constantly improve security directly or indirectly (e10s?). You can't expect maintainers of an ESR to backport all those things. There's always a risk in adopting the latest version of a program, but there's also a risk with keeping the old, less actively maintained version. I get burned all the time with Debian Stable, running into bugs fixed in the latest version but not backported. (nonetheless, I do prefer Debian Stable to most other solutions) A project I'm involved in even has an automatic "toxic code" warning for PRs on known functions/classes that need to be refactored, and where monkey-patching will likely cause other security issues one way or another.
rictic 10y ago
Speculating but some new features are security features, like support for additional CSP directives, cipher suites, that sort of thing.
yuhong 10y ago
An example is "Slaughterhouse" (see https://bugzilla.mozilla.org/show_bug.cgi?id=929539 https://bugzilla.mozilla.org/show_bug.cgi?id=929539 and http://bholley.net/blog/2016/the-right-fix.html http://bholley.net/blog/2016/the-right-fix.html). This is not the only incident where Mozilla people have suggested hiding bugs until an old ESR goes end of life BTW.