3 ms·

They don't want to need to update Rust in order to do a presumably small security patch on Firefox. Which honestly sounds like a totally awesome and legit reas

They don't want to need to update Rust in order to do a presumably small security patch on Firefox. Which honestly sounds like a totally awesome and legit reason to use -esr. Keep -current current with upstream, stable branch gets patches from firefox-esr. Keep in mind stable patches to the ports tree are pretty rare on OpenBSD. They didn't do them as binary packages until fairly recently, either.

jszymborski 7y ago
"presumably small security patch" The security patch is actually quite severe and has been reported to be in active use. https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-0... https://www.cisecurity.org/advisory/vulnerability-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2020-004/ https://www.cisecurity.org/advisory/vulnerability-in-mozilla...
- asveikau 7y ago
  I meant small as in code size. In a stable branch you want the size of changes to be small and targeted despite how severe the issue is. You don't want to take on new bugs from patches that aren't related to issues you want to see fixed.
  - AdamJacobMuller 7y ago
    If the change is so small, I don't see why they wouldn't be able to backport the fix? Don't upgrade firefox (and any dependencies), just fix the bug. It would be a lot harder if the actual fix was more complicated and a much more complicated diff. Possible that master has diverged sufficiently from their version that backporting the fix would be unreasonable.
    - celticmusic 7y ago
      What I find hilarious is that Rust, our lord and saviour, not only didn't prevent the issue, but is actively hampering the fix.
    - asveikau 7y ago
      That's a good point. Perhaps they don't have deep Firefox expertise and resources to test. Perhaps it's better to let Mozilla decide what gets backported to esr and how to do it.
    - danieldk 7y ago
      If the change is so small, I don't see why they wouldn't be able to backport the fix? Don't upgrade firefox (and any dependencies), just fix the bug. As far as I understand, you cannot call it Firefox anymore if you deviate from upstream (which is understandable, because upstream doesn't want to get bug reports for custom changes): https://www.mozilla.org/en-US/foundation/trademarks/distribution-policy/ https://www.mozilla.org/en-US/foundation/trademarks/distribu...
  - jszymborski 7y ago
    Ah, my mistake :) That makes sense!
ars 7y ago
Can they not backport the patch to the existing version of Firefox?
- elcomet 7y ago
  No, they'd have to change the name of the browser.

jszymborski 7y ago

"presumably small security patch" The security patch is actually quite severe and has been reported to be in active use. https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-0... https://www.cisecurity.org/advisory/vulnerability-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2020-004/ https://www.cisecurity.org/advisory/vulnerability-in-mozilla...

asveikau 7y ago
I meant small as in code size. In a stable branch you want the size of changes to be small and targeted despite how severe the issue is. You don't want to take on new bugs from patches that aren't related to issues you want to see fixed.
- AdamJacobMuller 7y ago
  If the change is so small, I don't see why they wouldn't be able to backport the fix? Don't upgrade firefox (and any dependencies), just fix the bug. It would be a lot harder if the actual fix was more complicated and a much more complicated diff. Possible that master has diverged sufficiently from their version that backporting the fix would be unreasonable.
  - celticmusic 7y ago
    What I find hilarious is that Rust, our lord and saviour, not only didn't prevent the issue, but is actively hampering the fix.
  - asveikau 7y ago
    That's a good point. Perhaps they don't have deep Firefox expertise and resources to test. Perhaps it's better to let Mozilla decide what gets backported to esr and how to do it.
  - danieldk 7y ago
    If the change is so small, I don't see why they wouldn't be able to backport the fix? Don't upgrade firefox (and any dependencies), just fix the bug. As far as I understand, you cannot call it Firefox anymore if you deviate from upstream (which is understandable, because upstream doesn't want to get bug reports for custom changes): https://www.mozilla.org/en-US/foundation/trademarks/distribution-policy/ https://www.mozilla.org/en-US/foundation/trademarks/distribu...
- jszymborski 7y ago
  Ah, my mistake :) That makes sense!

ars 7y ago

Can they not backport the patch to the existing version of Firefox?

elcomet 7y ago
No, they'd have to change the name of the browser.