5 ms·

Please do not assume people are not running current release just because they are lazy and have not upgraded. The user experience was degraded at FF57 for many

by beezle 7y ago

Please do not assume people are not running current release just because they are lazy and have not upgraded. The user experience was degraded at FF57 for many individuals who need extensions that will not work with ff>56 or that developers have abandoned out of frustration with Mozilla. When all the extensions I find necessary are functional (or with suitable replacements) I will switch.

amaccuish 7y ago
Well you are running an unsupported version, so Mozilla doesn't have to concern themselves with backports. If you still want to use your extensions AND receive browser updates, you should move to a different browser (maybe waterfox?)
tonny747 7y ago
I would be more concerned about all the other vulnerabilities in FF56 then just this one. https://www.cvedetails.com/vulnerability-list.php?vendor_id=452&product_id=3264&version_id=247526&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=129&sha=28863b172d3049516253c74838fd83a11a5a61fe https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
Zardoz84 7y ago
https://xkcd.com/1172/ https://xkcd.com/1172/
Zardoz84 7y ago
Obligatory xkcd reference https://xkcd.com/1172/ https://xkcd.com/1172/
floatingatoll 7y ago
Firefox 56 is unlikely to ever receive security patches every again. You are incredibly vulnerable by staying behind.
roblabla 7y ago
If you don't want Firefox Quantum, you should still switch to a supported browser that kept XUL, such as Basilisk. Also I'm curious, what extensions are missing? Most of my pre-quantum extensions, such as Tree Style Tabs, have been updated now.
- coldpie 7y ago
  > I'm curious, what extensions are missing? There are a couple I sorely miss. Disable Ctrl-Q died, and so did Toggle Animated GIFs. Now I have to keep an extra tab open with a warn-on-page-close handler to prevent Ctrl-Q fat-fingering from killing my session. And I've just disabled video/GIF animations entirely, instead of using the cool extension which let me start/stop them on demand. I also used to have a cool cookie exporter extension, which was useful in combination with wget for scraping sites that required a login. I admit I haven't searched for a replacement, though, so maybe there is one.
gdfasfklshg4 7y ago
I get the annoyance with deprecating extensions. But seriously the <edit>main</edit> person you are harming by running vulnerable un-patched software is yourself. EDIT: s/the only person/the main person/
- sgift 7y ago
  If only this was true. People with unpatched software running are prime targets for inclusion in a botnet and then they are damaging other with their reckless behavior.
userbinator 7y ago
This is exactly the problem with the culture that's formed around software and the security industry in general --- people are using the excuse of "security" to force other utterly unwanted and hostile changes, and then act surprised and angry when people don't update. Doubly so when the advice given is basically "bend over and take it" --- especially when Mozilla has made statements like this in the past: https://blog.mozilla.org/security/2013/01/29/putting-users-in-control-of-plugins/ https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." In any case, I hope NoScript is one of the extensions you're already using, because this is another vulnerability that requires JS to exploit. JS off by default already gets rid of the vast majority of them.
- jamespo 7y ago
  Not sure how Mozilla are forcing anything
  - userbinator 7y ago
    The tone-deafness of the comments here is astounding. The fact that these posts are rapidly downvoted further reinforces my point. It's not just Mozilla, it's the whole "update culture": "you must take these important fixes for remotely-exploitable vulnerabilities, and also all of that other stuff" --- of which everyone would probably want the former, but no one really wants the latter. When the "choice" of browsers that can view the majority of sites, including advanced JavaScript, is basically between Firefox or the various flavours of Chrom(e/ium), there is no real choice! tl;dr: To say I am annoying with the state of things is an enormous understatement. The browser culture is getting more and more user-hostile and "security" is being used as an excuse to put users under the noose, this encouragement of "learned helplessness" is insane. Fuck this idiotic "it's for your security" bullshit.
    - apostacy 7y ago
      I'm sorry you are getting downvoted. You are absolutely correct. I've gotten in many discussions about this exact same thing on HN. I at one point I had an exchange with someone about terrible bad Pale Moon was because it let users do things like override HSTS settings, and otherwise undo decisions that Mozilla had made.[1] I actually have highly specialized profiles that make heavy use of XUL addons that I have developed over the years for very specific things, and I hate how careful I have to be that an update won't come and delete them. It would be one line of code to make a backup of a profile before "upgrading" it... [1]: https://news.ycombinator.com/item?id=19527615 https://news.ycombinator.com/item?id=19527615 Anyway, it's a much bigger problem, and it's cultural as much as technological. And you're not alone and you're not crazy for seeing it.

by beezle 7y ago

amaccuish 7y ago

Well you are running an unsupported version, so Mozilla doesn't have to concern themselves with backports. If you still want to use your extensions AND receive browser updates, you should move to a different browser (maybe waterfox?)

tonny747 7y ago

I would be more concerned about all the other vulnerabilities in FF56 then just this one. https://www.cvedetails.com/vulnerability-list.php?vendor_id=452&product_id=3264&version_id=247526&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=129&sha=28863b172d3049516253c74838fd83a11a5a61fe https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Zardoz84 7y ago

https://xkcd.com/1172/ https://xkcd.com/1172/

Zardoz84 7y ago

Obligatory xkcd reference https://xkcd.com/1172/ https://xkcd.com/1172/

floatingatoll 7y ago

Firefox 56 is unlikely to ever receive security patches every again. You are incredibly vulnerable by staying behind.

roblabla 7y ago

If you don't want Firefox Quantum, you should still switch to a supported browser that kept XUL, such as Basilisk. Also I'm curious, what extensions are missing? Most of my pre-quantum extensions, such as Tree Style Tabs, have been updated now.

coldpie 7y ago
> I'm curious, what extensions are missing? There are a couple I sorely miss. Disable Ctrl-Q died, and so did Toggle Animated GIFs. Now I have to keep an extra tab open with a warn-on-page-close handler to prevent Ctrl-Q fat-fingering from killing my session. And I've just disabled video/GIF animations entirely, instead of using the cool extension which let me start/stop them on demand. I also used to have a cool cookie exporter extension, which was useful in combination with wget for scraping sites that required a login. I admit I haven't searched for a replacement, though, so maybe there is one.

gdfasfklshg4 7y ago

I get the annoyance with deprecating extensions. But seriously the <edit>main</edit> person you are harming by running vulnerable un-patched software is yourself. EDIT: s/the only person/the main person/

sgift 7y ago
If only this was true. People with unpatched software running are prime targets for inclusion in a botnet and then they are damaging other with their reckless behavior.

userbinator 7y ago

This is exactly the problem with the culture that's formed around software and the security industry in general --- people are using the excuse of "security" to force other utterly unwanted and hostile changes, and then act surprised and angry when people don't update. Doubly so when the advice given is basically "bend over and take it" --- especially when Mozilla has made statements like this in the past: https://blog.mozilla.org/security/2013/01/29/putting-users-in-control-of-plugins/ https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." In any case, I hope NoScript is one of the extensions you're already using, because this is another vulnerability that requires JS to exploit. JS off by default already gets rid of the vast majority of them.

jamespo 7y ago
Not sure how Mozilla are forcing anything
- userbinator 7y ago
  The tone-deafness of the comments here is astounding. The fact that these posts are rapidly downvoted further reinforces my point. It's not just Mozilla, it's the whole "update culture": "you must take these important fixes for remotely-exploitable vulnerabilities, and also all of that other stuff" --- of which everyone would probably want the former, but no one really wants the latter. When the "choice" of browsers that can view the majority of sites, including advanced JavaScript, is basically between Firefox or the various flavours of Chrom(e/ium), there is no real choice! tl;dr: To say I am annoying with the state of things is an enormous understatement. The browser culture is getting more and more user-hostile and "security" is being used as an excuse to put users under the noose, this encouragement of "learned helplessness" is insane. Fuck this idiotic "it's for your security" bullshit.
  - apostacy 7y ago
    I'm sorry you are getting downvoted. You are absolutely correct. I've gotten in many discussions about this exact same thing on HN. I at one point I had an exchange with someone about terrible bad Pale Moon was because it let users do things like override HSTS settings, and otherwise undo decisions that Mozilla had made.[1] I actually have highly specialized profiles that make heavy use of XUL addons that I have developed over the years for very specific things, and I hate how careful I have to be that an update won't come and delete them. It would be one line of code to make a backup of a profile before "upgrading" it... [1]: https://news.ycombinator.com/item?id=19527615 https://news.ycombinator.com/item?id=19527615 Anyway, it's a much bigger problem, and it's cultural as much as technological. And you're not alone and you're not crazy for seeing it.