6 ms·

Using forks of unsupported Firefox versions/features (this, Pale Moon, etc.) is a good way to introduce vulnerabilities into your daily browsing. Firefox ESR s

Using forks of unsupported Firefox versions/features (this, Pale Moon, etc.) is a good way to introduce vulnerabilities into your daily browsing. Firefox ESR should be the addons stopgap of choice while they’re ported.

Santosh83 9y ago
Pale Moon reportedly backports security patches.
- minitech 9y ago
  Sure – not trying would be obscenely irresponsible. But: 1. I don’t trust them to do that right 2. You’re later to get the same patches 3. You can’t backport patches for removed features
  - superkuh 9y ago
    It's funny that you say these things with such confidence when you're demonstrably wrong (ie, 3) by simply looking at the Pale Moon update logs and the 'Defense in Depth' "fixes" for vulnerabilities that don't exist in PM but do in FF which are changed anyway just to be sure. http://www.palemoon.org/releasenotes.shtml http://www.palemoon.org/releasenotes.shtml
    - minitech 9y ago
      #3 is a weird one to take issue with. Unless by “demonstrably wrong” you mean “objectively right”? You can’t backport a patch from a fork for a feature that doesn’t exist in that fork. You can make your own patch. XUL ones can come from ESR… except when you don’t fork ESR. Oops! A fork has to be able to maintain the browser as well or better than the Firefox community does right now, and again, I don’t trust any of the fork teams to do that. You’re also misrepresenting what “Defense in Depth” changelog entries in Pale Moon mean. For two of the five on the current page: CVE-2017-7809 was fixed by Firefox; NPAPI plugins aren’t supported anymore. The other three aren’t specific and don’t link to an issue tracker or patch, so it’s hard to say.
      - superkuh 9y ago
        Well, 1 is your opinion so it's hard to change that. 2 is obvious and not really a problem. So the only thing you had was 3. And no, I mean demonstrably wrong. But you are right that all the useless attack surfaces that Firefox has (ie, WebGl, Websockets, Pocket, etc) aren't in Pale Moon. Luckily for PM it doesn't need to do as well or better than Firefox because it simply doesn't have all the excess "features".
        minitech 9y ago
        Maybe an example will make it clearer to you what #3 means. Firefox stops supporting certain types of extensions. Firefox stops making security patches to this (eventually) removed feature. Because there are no patches, you can’t backport them to your fork. From this, we have the objectively correct > 3. You can’t backport patches for removed features which is just as obvious as 2 – and they are important.
        superkuh 9y ago
        Ah, I finally get what you're saying. You're complaining that forks will have to support code that Mozilla no longer does. Yeah. That's the point of forks.
        tialaramex 9y ago
        They're not complaining, they are pointing out that this is a bunch of work that Palemoon's authors need to do, just to be no worse than Firefox. Work there isn't much evidence of them doing.
        Dylan16807 9y ago
        > Pocket That's just a plain extension they bundled...
        eropple 9y ago
        WebSocket is useless? WebGL is useless? I mean, you're entitled to your opinions, but these are pushing the envelope of silly.
- yuhong 9y ago
  This reminds me of: https://news.slashdot.org/comments.pl?sid=8898847&cid=51735125 https://news.slashdot.org/comments.pl?sid=8898847&cid=517351...
deleted 9y ago
[deleted]
edflsafoiewq 9y ago
We'll see if 52 ESR reaches end-of-life before webextensions acquire the needed functionality to do the ports.
bkdbkd 9y ago
Practicality aside, benefit #4 of open source is just this. That you can fork and with some dexterity include things that fit your purpose like Security fixes, while leaving out those you don't
- sp332 9y ago
  Practicality aside, you could install a Developer Edition of Firefox, set extensions.legacy.enabled to true, and keep using your extensions until the underlying XUL APIs get removed.
  - betterunix2 9y ago
    Maybe I want to use my extensions until the WebExtensions API is up to the task?
    - deleted 9y ago
      [deleted]
    - sp332 9y ago
      Yeah, ideally. They're still adding on features pretty quickly.
  - Sylos 9y ago
    Have you tried this and it worked well for you? Mozilla has shifted around and swapped out tons of code in Firefox since the official deprecation of XUL extensions. So, I imagine most XUL extensions will be broken by now just on that account.

Santosh83 9y ago

Pale Moon reportedly backports security patches.

minitech 9y ago
Sure – not trying would be obscenely irresponsible. But: 1. I don’t trust them to do that right 2. You’re later to get the same patches 3. You can’t backport patches for removed features
- superkuh 9y ago
  It's funny that you say these things with such confidence when you're demonstrably wrong (ie, 3) by simply looking at the Pale Moon update logs and the 'Defense in Depth' "fixes" for vulnerabilities that don't exist in PM but do in FF which are changed anyway just to be sure. http://www.palemoon.org/releasenotes.shtml http://www.palemoon.org/releasenotes.shtml
  - minitech 9y ago
    #3 is a weird one to take issue with. Unless by “demonstrably wrong” you mean “objectively right”? You can’t backport a patch from a fork for a feature that doesn’t exist in that fork. You can make your own patch. XUL ones can come from ESR… except when you don’t fork ESR. Oops! A fork has to be able to maintain the browser as well or better than the Firefox community does right now, and again, I don’t trust any of the fork teams to do that. You’re also misrepresenting what “Defense in Depth” changelog entries in Pale Moon mean. For two of the five on the current page: CVE-2017-7809 was fixed by Firefox; NPAPI plugins aren’t supported anymore. The other three aren’t specific and don’t link to an issue tracker or patch, so it’s hard to say.
    - superkuh 9y ago
      Well, 1 is your opinion so it's hard to change that. 2 is obvious and not really a problem. So the only thing you had was 3. And no, I mean demonstrably wrong. But you are right that all the useless attack surfaces that Firefox has (ie, WebGl, Websockets, Pocket, etc) aren't in Pale Moon. Luckily for PM it doesn't need to do as well or better than Firefox because it simply doesn't have all the excess "features".
      - minitech 9y ago
        Maybe an example will make it clearer to you what #3 means. Firefox stops supporting certain types of extensions. Firefox stops making security patches to this (eventually) removed feature. Because there are no patches, you can’t backport them to your fork. From this, we have the objectively correct > 3. You can’t backport patches for removed features which is just as obvious as 2 – and they are important.
        superkuh 9y ago
        Ah, I finally get what you're saying. You're complaining that forks will have to support code that Mozilla no longer does. Yeah. That's the point of forks.
        tialaramex 9y ago
        They're not complaining, they are pointing out that this is a bunch of work that Palemoon's authors need to do, just to be no worse than Firefox. Work there isn't much evidence of them doing.
      - Dylan16807 9y ago
        > Pocket That's just a plain extension they bundled...
      - eropple 9y ago
        WebSocket is useless? WebGL is useless? I mean, you're entitled to your opinions, but these are pushing the envelope of silly.
yuhong 9y ago
This reminds me of: https://news.slashdot.org/comments.pl?sid=8898847&cid=51735125 https://news.slashdot.org/comments.pl?sid=8898847&cid=517351...

deleted 9y ago

[deleted]

edflsafoiewq 9y ago

We'll see if 52 ESR reaches end-of-life before webextensions acquire the needed functionality to do the ports.

bkdbkd 9y ago

Practicality aside, benefit #4 of open source is just this. That you can fork and with some dexterity include things that fit your purpose like Security fixes, while leaving out those you don't

sp332 9y ago
Practicality aside, you could install a Developer Edition of Firefox, set extensions.legacy.enabled to true, and keep using your extensions until the underlying XUL APIs get removed.
- betterunix2 9y ago
  Maybe I want to use my extensions until the WebExtensions API is up to the task?
  - deleted 9y ago
    [deleted]
  - sp332 9y ago
    Yeah, ideally. They're still adding on features pretty quickly.
- Sylos 9y ago
  Have you tried this and it worked well for you? Mozilla has shifted around and swapped out tons of code in Firefox since the official deprecation of XUL extensions. So, I imagine most XUL extensions will be broken by now just on that account.