5 ms·

Are any of these fixes being backported to 56.x? I am not ready to upgrade to 57+ yet.

JohnTHaller 9y ago
Use Firefox ESR 52.x. Firefox 56 is insecure and should not be used: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/ https://www.mozilla.org/en-US/security/known-vulnerabilities...
orf 9y ago
Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.
- danjoc 9y ago
  >Immediately stop using 56, downgrade to the LTS or upgrade to 57 58 is the fixed version. >I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people clinging to 56/52 like debris from a shipwreck. Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this.
  - blacksmith_tb 9y ago
    It broke add-ons that weren't being maintained, primarily. It's true that for some users, this would be very unpleasant, but I have five extensions working fine here in 59.0b5 (including important security/usability ones like uBlock Origin and Stylus).
    - Khoth 9y ago
      That's not my experience. The addons I use that it broke were all being maintained, but FF57 didn't provide any API to replace what they were using before, so their authors reluctantly abandoned them or provided limited, crippled versions that don't work properly.
  - mastax 9y ago
    > 58 is the fixed version. FTA: This issue did not affect Firefox for Android or Firefox 52 ESR. > That's because 57 was a complete dumpster fire. I disagree. > It broke all the add ons. Yes, it did. They probably should've made 56 an ESR. > Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this. They must not be doing a very good job, since I've seen the death of long-loved addons mentioned in every Firefox thread on HN for years.
  - geofft 9y ago
    Clinging to 52 ESR until August 28 is fine. That's what it's there for. Clinging to 56 is ... well, it's your decision to use what software you want, that's what free software is all about, but since half the point of the changes in 57 was improved security architecture, clinging to 56 and expecting fixes for security bugs seems ill-advised.
- pjmlp 9y ago
  Here is one sad reason. Customer controlled environment, where the only browsers are IE 11 and FF ESR, and having Chrome is considered security violation, because their IT cannot control it the same way.
  - bugmen0t 9y ago
    ESR is 52. There is absolutely no good reason to use anything but ESR or the properly maintained version. It will only get you into trouble.
moosingin3space 9y ago
56 will never get backported security fixes of any kind. For the record, neither will 57, as 58 is the current stable version. Mozilla does not apply security fixes to versions of Firefox other than the latest stable and the latest ESR.

Use Firefox ESR 52.x. Firefox 56 is insecure and should not be used: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/ https://www.mozilla.org/en-US/security/known-vulnerabilities...

orf 9y ago

Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.

danjoc 9y ago
>Immediately stop using 56, downgrade to the LTS or upgrade to 57 58 is the fixed version. >I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people clinging to 56/52 like debris from a shipwreck. Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this.
- blacksmith_tb 9y ago
  It broke add-ons that weren't being maintained, primarily. It's true that for some users, this would be very unpleasant, but I have five extensions working fine here in 59.0b5 (including important security/usability ones like uBlock Origin and Stylus).
  - Khoth 9y ago
    That's not my experience. The addons I use that it broke were all being maintained, but FF57 didn't provide any API to replace what they were using before, so their authors reluctantly abandoned them or provided limited, crippled versions that don't work properly.
- mastax 9y ago
  > 58 is the fixed version. FTA: This issue did not affect Firefox for Android or Firefox 52 ESR. > That's because 57 was a complete dumpster fire. I disagree. > It broke all the add ons. Yes, it did. They probably should've made 56 an ESR. > Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this. They must not be doing a very good job, since I've seen the death of long-loved addons mentioned in every Firefox thread on HN for years.
- geofft 9y ago
  Clinging to 52 ESR until August 28 is fine. That's what it's there for. Clinging to 56 is ... well, it's your decision to use what software you want, that's what free software is all about, but since half the point of the changes in 57 was improved security architecture, clinging to 56 and expecting fixes for security bugs seems ill-advised.
pjmlp 9y ago
Here is one sad reason. Customer controlled environment, where the only browsers are IE 11 and FF ESR, and having Chrome is considered security violation, because their IT cannot control it the same way.
- bugmen0t 9y ago
  ESR is 52. There is absolutely no good reason to use anything but ESR or the properly maintained version. It will only get you into trouble.

moosingin3space 9y ago

56 will never get backported security fixes of any kind. For the record, neither will 57, as 58 is the current stable version. Mozilla does not apply security fixes to versions of Firefox other than the latest stable and the latest ESR.