16 ms·

Firefox on Ubuntu 22.04 from .deb (not from snap)

256 points by zdw 5y ago

okasaki 5y ago
This was a deal-breaker for me. I don't want a firefox packaged by mozilla themselves as a snap or deb, because I don't consider them trustworthy. At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. I switched to debian instead. Debian packages firefox ESR, which means my config will be stable for longer.
- daenney 5y ago
  You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? > At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not.
  - shrimp_emoji 5y ago
    >You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Yea, I think this is silly. Apps have the power to update themselves out-of-band from the package manager, so, even if you only install it via the package manager, it can do whatever it wants while short-circuiting the maintainers' oversight.
    - plonk 5y ago
      > Apps have the power to update themselves out-of-band from the package manager Isn't that disabled in Ubuntu's Firefox APT package?
    - adhesive_wombat 5y ago
      Well, not directly: they'd need root to overwrite /usr/bin/firefox, which it wouldn't normally (hopefully) run as. They could have latent malicious code which gets packaged and that could download a payload and execute that (or already contains the attack). But a program without such a pre-existing ability won't be able to update itself to a version that does.
  - IceWreck 5y ago
    The do change the defaults and enable/disable features during compile time. This is very different than going through every line of code and patching something they dont like. I'm not OP, but I too consider Firefox published by my distribution (Fedora) to be more trustworthy than Mozilla's official distribution channel.
  - bubblethink 5y ago
    I think there is some merit to it, at least as far as dubious features with auto opt-in go. It's not so much that the distro will save you from a hostile firefox or chromium. Rather, it'll give you the modicum of dignity by preventing you from being enrolled in these. In the best case, it prevents upstream from further rolling out such features due to the pushback. In the worst case, you get a small heads up about what's coming down the pipe inevitably anyway and you can plan accordingly.
  - okasaki 5y ago
    > You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? I have to use a web browser. > For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Reading and respoding to the changelogs is substantially better than no review.
    - throwaway82652 5y ago
      >I have to use a web browser. No you don't, I suggest getting a different career outside the IT department, if it really bothers you that much. No reason to take the path of most resistance with something that makes you unhappy. >Reading and respoding to the changelogs is substantially better than no review. No, not really. The reason this stuff with snap is happening to begin with is because distro maintainers don't have the resources to maintain a ton of patches on top of a giant browser that releases every month, even if they knew there was something objectionable in the changelog there may not be anything they can do about it in a reasonable amount of time.
  - anothernewdude 5y ago
    Not when Mozilla will just disable things like ublock origin and umatrix, without telling the user. browsing the web is *dangerous* without them.
  - vetinari 5y ago
    > You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Exactly. The distribution maintainers are reviewers, who can remove the unwanted parts: https://pagure.io/fesco/issue/1518 https://pagure.io/fesco/issue/1518 > Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Actually, Redhat and SuSE guys are active in the development, especially the linux-specific functionality. However, when they package it, they don't have to follow Mozilla's agenda.
  - flomo 5y ago
    Just posting in agreement. I'd like my Firefox direct from Mozilla, without being molested by some rando 'maintainer' who could do things like null-out SSL code or include their personal "standard violating" config (and has). As ultra-paranoid as some people on HN are, they suddenly weirdly trusting of mostly unaccountable volunteers. Backdooring some distro firefox would be a lot easier than backdooring your CPU.
- goosedragons 5y ago
  Are distributions more trustworthy here? Mint for example has in the past fiddled with Firefox's default search to IMO anyways to an annoying degree that I stopped using it. Knife can go both ways here.
- bscphil 5y ago
  > At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. Unfortunately, Mozilla has enough power that AFAIK they've pretty much run roughshod over the distributions. Pretty much the only software I know of that can do that. It's mostly through enforcing their trademark. If you know of a mainstream Linux distribution where the maintainers actually care enough to patch Firefox to remove all advertisements (including Pocket), sponsorships, and other by-default telemetry, I would love to hear about it and would consider switching to such a distribution for that reason alone. (Not because I'm incapable of patching Firefox myself or using LibreWolf, but because this shows that the maintainers care and have the correct priorities.)
  - blihp 5y ago
    Debian's told them where to stick it once or twice.
- pabs3 5y ago
  The Debian package of Firefox ESR is created by a Mozilla employee, who is also a Debian member.
fuckcensorship 5y ago
I prefer to just use LibreWolf [1] instead. [1]: https://librewolf.net/ https://librewolf.net/
- fsflover 5y ago
  How fast does it get the security updates? How does it fight against the duopoly of Google and Apple on the web?
  - Quarrel-Cactus 5y ago
    > How fast does it get the security updates? They don't specify, but it seems frequent enough in my experience. Here is what the Web site says: "LibreWolf is always built from the latest Firefox stable source, for up-to-date security and features along with stability." > How does it fight against the duopoly of Google and Apple on the web? It uses Gecko rather than Blink or WebKit if that's what your question is asking. It's just standard Firefox with privacy tweaks and patches applied out of the box.
    - fsflover 5y ago
      > It uses Gecko rather than Blink or WebKit if that's what your question is asking. By not using Firefox, you remove the funds from the WebKit development. And it costs millions. If LibreWolf doesn't present itself as Firefox, it also decreases the visible Firefox usage, helping the duopoly.
      - tomrod 5y ago
        I'm okay with this. Firefox makes enough money without my marginal contribution further enriching Mozilla execs, your FOMO/FUD notwithstanding. I used Firefox until they lost site of their core target, and killed their mobile app's quality and extensions.
        antifa 5y ago
        What's wrong with their mobile app's quality and extensions? FF is essentially the only good browser on Android AFAIK, plus it supports extensions on Android.
Kwpolska 5y ago
This is much better than the Snap. Snaps are slow and tend to ignore themes and preferences of various kinds. > Since the package comes from a PPA unattended-upgrades will not upgrade it automatically, unless you enable this origin: You probably don’t want Firefox to update automatically, without your knowledge. A Firefox upgrade means you must immediately restart the browser. If this happens in the background while you’re doing something important, it can easily ruin your day.
- yoavm 5y ago
  My Firefox updates automatically, and it never told me to immediately restart the browser. Most of the times I don't notice it at all, and sometimes I notice a small blue dot on the top right hamburger menu that asks me to restart. Never forced me, just asks. Moving from Arch to Debian I was disappointed not to find a Developer Edition package, but the official Linux release works just fine and I personally enjoy the auto-update mechanism.
  - ghostly_s 5y ago
    Mine prompts me to restart when I load a new page, no option to postpone as fat as I've seen.
    - perihelions 5y ago
      The option is here: about:preferences#general ("Check for updates but let you choose to install them", if English localization)
      - kbrosnan 5y ago
        That pref is not present because it does not apply to distro updated Firefox such as a .deb.
    - TingPing 5y ago
      Because postponing isn't possible, the files changed from under it and their behavior is undefined.
cardanome 5y ago
I hate how Ubuntu is pushing snap. There is only disadvantages installing Firefox from snap. I am glad I am using Linux Mint which shields me from this insanity for now. Solutions like flatpack/snap/appimage are great (though I like snap the least) but they are for extra stuff. As much as possible should be handled by the native package manager.
- timbit42 5y ago
  I switched to Linux Mint.
- silisili 5y ago
  I just don't get why they keep doubling down on snaps. Most people really, really hate them. Most people find them slow. They used to just reply their testing doesn't find it slow, too bad so sad. I say 'used to' because I gave up long ago so haven't bothered checking.
  - hypothesis 5y ago
    Are those people paying customers? Likely the idea is to let upstream to package once and ship it on all supported platforms. This way there is no constant support/packaging required from distro itself. As to why snap format specifically, that’s probably allows them to make changes as needed without asking anyone.
    - sgc 5y ago
      Right, but if in the process you take your great code and turn it into a crappy deliverable, that's on you. You don't get praise for taking serviceable software and bogging it down while locking out end users on an open source platform. You don't give a f*k. We get it. Further, if you are tunnel-vision focused on profit, remember that if you lose your end users, you lose your only means to eventual income.
      - hypothesis 5y ago
        I’m just acknowledging the reality. There is now a very nice summary comment from worik elsewhere in the thread, but basically end-users are no longer the same from Canonical’s perspective and so it’s probably wise to thank them for good things they did and move on.
darkwater 5y ago
I thought I needed that, because I quickly went back to the repo .deb version when they initially switched to the snap version, but actually the snap version in 22.04 works pretty well for me, I still have not found a broken usecase.
- kgwxd 5y ago
  It starts up way slower. I didn't notice at first but then I installed the deb version trying to troubleshoot other issues, it didn't solve those problems, but I immediately noticed how much faster it starts, even with the same settings and extensions installed as before.
  - darkwater 5y ago
    Yes it did previously (when it was forced the 1st time with...20.10 I guess?) but on 22.04 at least the feeling is basically the same that with the .deb I had on 21.10. I upgraded a month ago when it was still in beta so my memory might be already tricking me.
ailtonbsj_ 5y ago
I already had done this where I work. We are using a own build version of Xubuntu. https://github.com/winunix/xubuntu-winunix https://github.com/winunix/xubuntu-winunix
squarefoot 5y ago
Snap should be an extreme measure when there are no other means to use some obscure package that can't be run using the stock kernel or libraries. Resorting to it for common popular software is such a bad decision. I'm not a Ubuntu user as I rather prefer Debian and Manjaro; hopefully they'll never do the same.
- anothernewdude 5y ago
  Canonical love making bizarre decisions like this. Just look at Unity and Mir.
  - Darmody 5y ago
    Unity made sense, snap doesn't.
    - GekkePrutser 5y ago
      Yes unity wasn't bad and it wasn't shoved down your throat.
      - rstat1 5y ago
        I mean it was the default environment on Ubuntu distros for years...I would say it was more forced than Snaps are.
        iiix 5y ago
        I don't know if I'd agree; with Unity you could just install a new DE & switch environments without fuss. My biggest problem with Snap is that trying to install something like Chromium via apt, will, most likely unbeknownst to the user, just install the Snap version instead.
        2143 5y ago
        This. I recently installed Chromium via apt, and it actually installed the snap! I mean, if I wanted the snap I'll use the snap command. If it's not available via apt just say so and quit. I don't want it to install the snap version when I asked for the apt (.deb) thing. In this particular case the means to the end matters.
mise_en_place 5y ago
I just use chromium from flatpak, never had any issues with it. I can also switch to Ungoogled Chromium if I wanted to.
- smallerfish 5y ago
  Who packages it and how do you know you can trust them? Fun fact: the Jetbrains flatpak images are _not_ packages by Jetbrains. If you ask Jetbrains about them, they will tell you it's a random third party (/enthusiatic community volunteer) who packaged them up. Flatpak is a shitshow and should be avoided until and only if Flathub gets better control over packaging.
  - vetinari 5y ago
    No, they are not from the original vendors... but also the original vendors were not interested in providing flatpaks themselves, so the community stepped in. I have yet to see any volunteer to refuse handing off maintenance of the flatpak package to upstream. If they listened to your advice, there would be no flathub at all.
    - smoldesu 5y ago
      Even still, is there a good reason anyone would take the performance/security/size hit instead of grabbing the official deb file?
      - vetinari 5y ago
        You might be using a distribution where .deb file won't help you much. Another reason might be, that you are getting an extra sandbox.
        smoldesu 5y ago
        The sandbox does you no good if you can't confirm that the software running inside it isn't adversarial. It's a catch-22.
tedunangst 5y ago
Why not use the tgz file directly?
- sp332 5y ago
  Dependency checking?
  - tedunangst 5y ago
    I guess. It's not hard to figure out what it needs and install them, though. It's what I do on my debuntu systems.
- Nasreddin_Hodja 5y ago
  Yes, I already use Thunderbird from official tarballs and going to do so for Firefox after upgrading to 22.04.
jcastro 5y ago
I get people don't like snaps but adding a third-party repository with root access to your computer is not doing anyone any favors. Even if it is run by a trusted community member a PPA will never have the guarantees of the packages in the distro.
- zamalek 5y ago
  Given that the main contention with Snap is the first-launch performance, a viable alternative is Flatpak. I run nearly everything from it. The bizarre thing about the Snap performance issue is that it isn't present on other distros. I have heard that Snap is really, uh, snappy on Arch (although I am seriously not bothered to try it myself).
  - brnt 5y ago
    Although I've no snap experience, first launch performance of Flatpak apps is a good reason for me to steer clear.
    - jcastro 5y ago
      Flatpaks splat the files on disk just like your traditional package manager, you shouldn't be seeing any performance difference.
      - brnt 5y ago
        It loads however a lot more, either a Gnome or KDE base, and it shows. I've tested a few apps with their tarball/rpm versions vs Flatpak, and the latter takes seconds more, consistently. Pretty fast NVME drive too.
wheelerof4te 5y ago
This is why I love and still use Debian. Debian 7 was the first Linux distro that just worked on my old PC. Believe it or not, only Debian had no screen flicker on my old NVIDIA GeForce MX 440. Plus, it was the only distro in 2013th that had a non-free driver for that card (96-something-legacy). Imagine how old that card is when they considered it legacy in Debian 7.
- password4321 5y ago
  I still install Ubuntu 18 LTS, after it falls out of favor I will be moving on to Debian, all to dodge snaps.
worik 5y ago
Of course there is the option of moving away from Ubuntu Canonical did good work with Ubuntu, bringing the first very good desktop distribution that was usable from a mass audience. But time has moved on, and Canonical has moved on, too. Snap makes a of of sense for a lot of purposes. But for geeks and their desktops, not so much. Canonical is no longer interested in us. A breakdown of a relationship is always stressful, but in this case we have just grown apart, and now we both need change. I wish Canonical all the best in their pursuit of profits in cloud software and systems, and in the IoT world (where snaps are ideal). I am in another relationship now. We have both moved on
- sgt 5y ago
  If geeks and their desktops are out, the only thing remaining for Ubuntu is server and cloud. That is okay, actually, but a bit sad.
  - nvrspyx 5y ago
    I mean, that's where large majority of their efforts have been for the last couple of years, at least. It's self-inflicted.
    - pjmlp 5y ago
      There is no money in desktop, it is self inflicted by the Linux community themselves.
      - nvrspyx 5y ago
        You're right. Self-inflicted was the wrong term to use here. I just meant that Canonical themselves, in some part, have been pushing the desktop crowd away, even if it's a feedback loop between Canonical and the community like you allude to. I just wish they had followed a similar approach as Red Hat have, where they're still able to place a significant amount of effort into the desktop side of things thanks to their enterprise offering and specialized focuses, like embedded systems for automobiles, which I believe is where much of the Pipewire work came about for example. That's not to say Red Hat is perfect or a crowning example of a Linux company "done right". Rather, it's just an example.
ameminator 5y ago
I hate snap. I hate how they are being pushed by Ubuntu. Here's the link I followed to completely remove snap from my Ubuntu installation: https://askubuntu.com/questions/1280707/how-to-uninstall-snap https://askubuntu.com/questions/1280707/how-to-uninstall-sna...
carlsborg 5y ago
The .tgz has never failed me across various distros and time.
rubyist5eva 5y ago
I’ve seen enough people putting off the chrome zero day updates to understand why Mozilla is resorting to a snap package for updates.
Thaxll 5y ago
Since Firefox can auto update itself you can just download the tar.gz directly. https://www.mozilla.org/en-US/firefox/all/#product-desktop-release https://www.mozilla.org/en-US/firefox/all/#product-desktop-r...
- rovr138 5y ago
  I always do this. I download the tar, extract it, put it on /opt/firefox and then create whatever shortcut I need. Been doing this for years. That way I don't have to wait until the repo or ppa's are updated.
- amelius 5y ago
  Doesn't the .deb version auto-update?
  - Izkata 5y ago
    Ubuntu has unattended-upgrades, which installs security updates through apt without user intervention. Firefox is included in this, it doesn't use firefox's auto-update mechanism.
g105b 5y ago
Wow, this kind of article shouldn't be a thing in 2022. It reminds me of the old days of Linux when you had to hack xorg.conf to get your second monitor to work -- but now it's a hack to get your web browser to work!
lin83 5y ago
Is the linked PPA [1] actually maintained by Mozilla or is it volunteers? I can't tell. The uploader looks like a freelancer and the PPA owner hasn't been active on Mozilla's Bugzilla in over a decade. [1] https://launchpad.net/~mozillateam/+archive/ubuntu/ppa https://launchpad.net/~mozillateam/+archive/ubuntu/ppa
- jcastro 5y ago
  People in this thread (and the author of the article) are under the assumption that Mozilla is running this PPA, it's run by the community. That being said ricotz has been participating in the Ubuntu community for a very long time, and from a practical standpoint you'll probably be ok. There's a good reason for Ubuntu to push people away from PPAs as distribution methods for end users and instead use them for what they were original supposed to be used for, make it easy for distro developers to fire up repos for testing/development with the intent of that work making it back into distro and Debian. Snaps have lots of problems but using the distro-staging PPA isn't a good idea either.
  - lin83 5y ago
    I'm pretty sure the owner of the “Mozilla Team” team PPA [1] has been dead since 2013 [2]. He is also listed as an Administrator. If someone were to comprise his account via his old email, e.g. if he used a now expired domain that could be registered, they could use this PPA to deliver a backdoored Firefox build to thousands of users and steal their passwords, tokens and SSH keys. Community support is great but without a proper security team and enforced secutiry processes the PPAs are very dangerous. [1] https://wiki.ubuntu.com/JohnVivirito https://wiki.ubuntu.com/JohnVivirito [2] https://www.dignitymemorial.com/obituaries/apex-nc/john-vivirito-5422868 https://www.dignitymemorial.com/obituaries/apex-nc/john-vivi...
    - hda111 5y ago
      Thanks for letting us know. Will use the snap then.
    - cjwatson44 5y ago
stormbrew 5y ago
Oh cool, I guess this headline saved me from the frustration of upgrading any of my computers to ubuntu 22.04. Bad enough chrome was in a snap in the last (couple?) if firefox is now too I have to assume the whole OS is basically unusable if you force snap off. Time to switch to a different distro I suppose.
- rsolva 5y ago
  Give the latest Fedora a spin! After 10 years of Arch I have been pleasantly suprised by the completeness and performance of Fedora since version 34. Version 36 is set to be released in a couple of days.
ur-whale 5y ago
What happens on 22.04 when you apt purge snapd ?
- 6581 5y ago
  snapd gets purged.
akdor1154 5y ago
Well there's another reason to shill Pop OS.. they have been de-snapping Ubuntu with great success for a while now. With that said their 22.04 isn't out for a while and it sounds like there is a lot more involved for them this time around (just from reading this hn discussion)
- sen 5y ago
  I switched to Pop about a year ago and absolutely love it so far. It’s been one of the most flawless experiences I’ve had with a Linux distro (as a life long “user” but not very good at the fiddly stuff).
michaelmrose 5y ago
I rather feel like we are making things more complicated than needed in recent years. In ubuntu 14.04 8 years ago firefox plus treestyle tabs and adblock plus made a nice combination. Firefox was installed by default and one could go to the addons menu and in about 30 seconds install those 2 and have right off a decent experience. Unattended-upgrades wasn't part of the default ubuntu install and everything updated at once. When you told it to. Now to have the same experience you need to understand the difference between snap and apt and why you would want one vs the other. You need to understand ppas. You need to know how ppas interact with unattended-upgrades. You need to understand config files are in etc. You need to know how config file directories work. You need to know how to pin a package. It appears but I'm not sure that you need to know the difference between purge and remove. Now if you want treestyle tabs to actually hide top tabs you need to figure out the weirdness of firefox profile dirs where its in ~/.mozilla/firefox/my-cat-walked-right-over-my-keyboard-and-had-a-fight-with-my-other-cat. Create a folder called chrome and inside it userChrome.css and either understand css or just blindly paste in some css someone else provided. Then you need to open up about:config and change an arcane setting to make the above actually do something. 90% of that is actually useful understandings. Hey its not like css is only for themeing firefox and knowing about:config exists exposes useless things out of scope of normal configuration but in no universe should I wish my browser wasn't half as fast as windows and I wish tabs were on the side lead to that exiting 3 hour tour 1. 1 https://youtu.be/cfR7qxtgCgY https://youtu.be/cfR7qxtgCgY We can start having the professor run this ship instead of Gilligan any time now. Firefox should be a Debian package by default. Installing a package from a PPA shouldn't bear on how its updated. Installing should be via a singular cli. If snap is to be integrated it should be an argument to that cli even if its not apt. Explicitly telling it to install the deb version should simply cause it to prefer that version thereafter. Absolutely none of this should require touching a config file in /etc. On the firefox they should have found a way for an addon to hide the tabs a while ago and if the user explicitly drops a css file in their profile directory it shouldn't be gated by a setting in about:config. Meanwhile your firefox profile should be something like ~/.config/firefox/default-profile What the hell is wrong with people.
- Izkata 5y ago
  > Now if you want treestyle tabs to actually hide top tabs you need to figure out the weirdness of firefox profile dirs where its in ~/.mozilla/firefox/my-cat-walked-right-over-my-keyboard-and-had-a-fight-with-my-other-cat. Create a folder called chrome and inside it userChrome.css and either understand css or just blindly paste in some css someone else provided. Also it's not just "understand CSS" - if you want to do it yourself you have to enable a special firefox debug mode to be able to inspect its UI and find the right IDs/etc.
fb03 5y ago
I used to love ubuntu and have been a xubuntu promoter between friends for quite a while, but now I am considering moving away from it, given that they are more and more aggressively pushing people to use their halfbaked binary store solution, which sounds insane, given we already have a pretty "apt" package manager which can install and solve a dependency graph just fine. People that moved away from Ubuntu because of the same crap, what are you using now? What other distros can I use without getting too crazy on configuring shit? My use case is booting a Linux box to develop Python/Rust apps, maybe a docker/docker compose in there and that's it. Don't get me wrong, I love what distros like Nix are doing, but I don't have 16 years anymore and all the free time in the world to tweak my environment to oblivion. I just want to boot an environment which is somewhat standard, run Pycharm, VSCode, and code my shit on. Thanks in advance.
- rstat1 5y ago
  I moved to using Fedora and its been pretty solid. Recently started using the Silverblue variant which is pretty well suited to do things in containers due to the readonly nature of its root filesystem. There are some aspects that are annoying (like installing software) but that not something I do frequently so its fine. And if you're not a GNOME fan, there's a KDE version of Silverblue called Kinoite or something similar that's basically the same thing but with KDE instead of GNOME. My reasons weren't necessarily because of Snaps because Fedora has Flatpaks which are the same useless crap from my perspective. It was mostly just because I wanted things to be closer to current releases. Otherwise its been solid.
- nine_k 5y ago
  Something like Pop! OS, maybe? (I personally went radical and run Void Linux. It has no systemd, basically every package is just built from upstream sources nightly, etc. Surprisingly, it's about as fiddly as a Debian box.)
- foresto 5y ago
  > what are you using now? I switched to Debian. The core of my system is now Debian Stable. For the handful of packages that I want to be newer, I either pull from Debian backports or backport the Debian Unstable package myself (just a simple rebuild in most cases). Flatpak is my last resort for one or two apps that aren't yet available in Debian. Since I don't trust the flathub/pypi/npm "accept software from anyone" model, I try to mitigate the additional risk with a few extra steps: I'm choosy about which flatpaks I'm willing to use, I scrutinize the permissions they try to grant themselves, and I install them only after rebuilding them myself with any unwanted components or overreaching permissions stripped out. (Flatpak's permissions model is broken in my view, but I think it could be fixed, and it is at least a starting place for working toward decent app isolation.) I'll miss some of Ubuntu's Launchpad services (free multi-architecture build farm, free package hosting, user-friendly bug tracker) but I don't value those conveniences as much as I value the benefits of traditional packaging for my core tools. Overall, I'm happy with the switch.
wintermutestwin 5y ago
I wish there was a distro that packaged Firefox with all of the must have extensions already installed (especially uBlock and Sideberry - I don't understand how anyone could use a browser with ads or without side tabs).
- spear 5y ago
  Not exactly what you asked for but Fedora does package a few extensions [separately] -- uBlock Origin, Noscript, and some others.
LeoPanthera 5y ago
The Valve Steam Deck, which runs a fork of Arch Linux, is, I hope, going to be the final decider in the sandbox format war. It comes preconfigured to run Flatpaks, and while you can install stuff via Arch's Pacman, anything installed that way is erased whenever there's a software update, while Flatpaks persist. So it's in the user's interest to use Flatpaks, and on mine, the Flatpak of RetroArch, as an example, works perfectly with zero extra configuration.
Izkata 5y ago
> Since the package comes from a PPA unattended-upgrades will not upgrade it automatically, unless you enable this origin For anyone still on 18.04 or 20.04 and not yet ready to upgrade or move off of ubuntu, you can add firefox to the "Unattended-Upgrade::Package-Blacklist" list in /etc/apt/apt.conf.d/50unattended-upgrades https://askubuntu.com/questions/1279041/disabling-firefox-background-upgrades https://askubuntu.com/questions/1279041/disabling-firefox-ba...
davidgerard 5y ago
BTW, if you do a do-release-upgrade to get to Xubuntu 22.04, you need to also do: sudo apt install xdg-desktop-portal-gtk or the Firefox snap won't be able to save or upload files, 'cos that lets it use the file picker. They included that package on the ISO, so fresh installs work - but they forgot to add it as a dependency for xubuntu-meta. (Dunno if it's fixed yet, wasn't a few days ago.)
fulafel 5y ago
It's a big archievement that the snap sandboxing has gotten seamless enough to support this. Looking forward to having more sandboxed apps. But the snap system needs more transparency and auditability so we can know what goes into them, like the ppa system does has.
_huayra_ 5y ago
As a recovering long-time Ubuntu user, I encourage everyone to strongly think about whether they need to stick with it. If you need stability, there are plenty of RHEL offshots (e.g. Centos, whatever became of "old Centos" that was relaunched elsewhere), and my personal recommendation as a "drop-in"-ish replacement: OpenSUSE Tumbleweed. It's a rolling distro that has the heck tested out of it by SUSE, and I've been rolling forward an install on my laptop for years without any issue. No more worrying about whether I need to dedicate some time to clean-install my Ubuntu workstation after the dist-upgrade inevitably doesn't work correctly...
rsyring 5y ago
I'll be sticking with Ubuntu b/c A) it's relatively stable B) it ships w/ ZFS by default and C) it's so popular that software creators often put it at the top of the priority list for Linux OS support. I understand the concerns about snaps. Look, if you want control, you have it. Uninstall it and find other installation options including reviewing and building yourself. What I've realized over time is that for the far majority of things, I just want it to work b/c I have better things to spend my time on. I can appreciate that software devs have the same feeling regarding supporting the various Linux distros. It's less time and troubleshooting to just pick a single target like snap. Many of us want Linux desktops to gain in popularity...I can see how snap (or it's competitors) can help make that come true. I have my doubts about something like LXC being shipped as a snap, I'm curious to see how things will play out with shipping more server software through snaps. I understand why the push towards snaps would be viewed more negatively for server applications. I would like software to be heavily sandboxed by default. Why should any software I want to use have access to my ssh agent or all of my files? Firefox should have access to almost nothing except a limited part of the file system and the network, right? I'm not sure we are there yet, but I think this type of software packaging, "containerization", and isolation is a good direction to be heading. There are things I don't like about snap and I kind of wish one of the alternatives would win. At the very least, hopefully they will challenge snap to be better and the ecosystem itself will benefit.
deleted 5y ago
[deleted]
mrtweetyhack 5y ago
voidr 5y ago
I have been pushing Ubuntu on the server, even in places where CentOS was more popular and I was pushing it in the container world as well. When they started forcing snaps, I could no longer use it for containers, therefore I started abandoning it for servers as well in favour of Debian. Snaps are horrible for containers because of their moving parts and I don't believe that they are any good for the server either because last time I checked: you could not have your private snap repository.
rcarmo 5y ago
I just disabled snap and moved to Edge on my test Ubuntu 22.04 install: https://taoofmac.com/space/blog/2022/04/12/2330 https://taoofmac.com/space/blog/2022/04/12/2330
thiht 5y ago
Genuine question : why do you even care if your app is packaged as a deb or as a snap? What does it change for you as a user?
- hoppyhoppy2 5y ago
  The most visible difference, even to people who don't care about software freedom or technical differences, is that the Snap version of Firefox takes a while to start after clicking on the icon, while other versions (including the Flatpak-packaged version) are zippy to start.
okamiueru 5y ago
I'd recommend a slightly differently approach. First of, remove snap all-together. Continue removing snap packages until there are none left. sudo snap remove firefox sudo snap remove gnome-3-38-2004 sudo snap remove gtk-common-themes sudo snap remove core20 sudo snap remove bare sudo snap remove snapd Remove snap completely: sudo apt purge snapd Then instead of adding the ppa, use flatpak with flathub (https://flatpak.org/setup/Ubuntu https://flatpak.org/setup/Ubuntu)
- rsolva 5y ago
  This is the way. Or just install the latest version of Fedora, where Flatpak is a first class citizen and everything Just Works.
  - arunkant 5y ago
    Using Pop os for some time. working great
Nasreddin_Hodja 5y ago
I will just use official tarballs https://www.mozilla.org/en-US/firefox/all/#product-desktop-release https://www.mozilla.org/en-US/firefox/all/#product-desktop-r...
auraham 5y ago
Wonder what other applications are from snap by default.
- hypothesis 5y ago
  Chromium I think. Basically anything that is a moving target.
  - suprjami 5y ago
    I've been using the Linux Mint Chromium deb for ages with similar tricks to this post. The Mint Firefox package is more difficult, it needs an override package which breaks Ubuntu, but Chromium is standalone.
  - asddubs 5y ago
    the webkit based midori browser too
  - 0xbadcafebee 5y ago
    It never hit me before now, but I just realized that "constantly upgrading software" is only a thing because corporations are cheap and impatient. Web browsers need to be constantly upgraded mostly because they need constant feature add-ons. They need constant feature add-ons because they want the browser to be able to render all the features of native apps with JavaScript/HTML/CSS, but they can't possibly develop every feature all at once. So they drip, drip, drip out the features. They also can't thoroughly test all the features ahead of time (permutations would require hundreds of millions, if not billions, of tests per release) so they kick the releases out to beta users and collect bug and crash reports, and fix enough of them to call it stable and then kick a release out. Imagine if cars worked like that. "We know you're driving on the highway, but we need to reboot your car because we have a new feature (radio shuffle mode!)"
    - hypothesis 5y ago
      I see frequently on HN this idea that big company behind said web browser can simply throw more devs at it, adding things and features (useful or not) and simply drown any competitors with churn of changes. But you still want security patches too, so you have to install and keep up to date with upstream. Is this also causing relentless update cycle? I think so.

256 points by zdw 5y ago

This was a deal-breaker for me. I don't want a firefox packaged by mozilla themselves as a snap or deb, because I don't consider them trustworthy. At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. I switched to debian instead. Debian packages firefox ESR, which means my config will be stable for longer.

daenney 5y ago
You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? > At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not.
- shrimp_emoji 5y ago
  >You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Yea, I think this is silly. Apps have the power to update themselves out-of-band from the package manager, so, even if you only install it via the package manager, it can do whatever it wants while short-circuiting the maintainers' oversight.
  - plonk 5y ago
    > Apps have the power to update themselves out-of-band from the package manager Isn't that disabled in Ubuntu's Firefox APT package?
  - adhesive_wombat 5y ago
    Well, not directly: they'd need root to overwrite /usr/bin/firefox, which it wouldn't normally (hopefully) run as. They could have latent malicious code which gets packaged and that could download a payload and execute that (or already contains the attack). But a program without such a pre-existing ability won't be able to update itself to a version that does.
- IceWreck 5y ago
  The do change the defaults and enable/disable features during compile time. This is very different than going through every line of code and patching something they dont like. I'm not OP, but I too consider Firefox published by my distribution (Fedora) to be more trustworthy than Mozilla's official distribution channel.
- bubblethink 5y ago
  I think there is some merit to it, at least as far as dubious features with auto opt-in go. It's not so much that the distro will save you from a hostile firefox or chromium. Rather, it'll give you the modicum of dignity by preventing you from being enrolled in these. In the best case, it prevents upstream from further rolling out such features due to the pushback. In the worst case, you get a small heads up about what's coming down the pipe inevitably anyway and you can plan accordingly.
- okasaki 5y ago
  > You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? I have to use a web browser. > For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Reading and respoding to the changelogs is substantially better than no review.
  - throwaway82652 5y ago
    >I have to use a web browser. No you don't, I suggest getting a different career outside the IT department, if it really bothers you that much. No reason to take the path of most resistance with something that makes you unhappy. >Reading and respoding to the changelogs is substantially better than no review. No, not really. The reason this stuff with snap is happening to begin with is because distro maintainers don't have the resources to maintain a ton of patches on top of a giant browser that releases every month, even if they knew there was something objectionable in the changelog there may not be anything they can do about it in a reasonable amount of time.
- anothernewdude 5y ago
  Not when Mozilla will just disable things like ublock origin and umatrix, without telling the user. browsing the web is *dangerous* without them.
- vetinari 5y ago
  > You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Exactly. The distribution maintainers are reviewers, who can remove the unwanted parts: https://pagure.io/fesco/issue/1518 https://pagure.io/fesco/issue/1518 > Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Actually, Redhat and SuSE guys are active in the development, especially the linux-specific functionality. However, when they package it, they don't have to follow Mozilla's agenda.
- flomo 5y ago
  Just posting in agreement. I'd like my Firefox direct from Mozilla, without being molested by some rando 'maintainer' who could do things like null-out SSL code or include their personal "standard violating" config (and has). As ultra-paranoid as some people on HN are, they suddenly weirdly trusting of mostly unaccountable volunteers. Backdooring some distro firefox would be a lot easier than backdooring your CPU.
goosedragons 5y ago
Are distributions more trustworthy here? Mint for example has in the past fiddled with Firefox's default search to IMO anyways to an annoying degree that I stopped using it. Knife can go both ways here.
bscphil 5y ago
> At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. Unfortunately, Mozilla has enough power that AFAIK they've pretty much run roughshod over the distributions. Pretty much the only software I know of that can do that. It's mostly through enforcing their trademark. If you know of a mainstream Linux distribution where the maintainers actually care enough to patch Firefox to remove all advertisements (including Pocket), sponsorships, and other by-default telemetry, I would love to hear about it and would consider switching to such a distribution for that reason alone. (Not because I'm incapable of patching Firefox myself or using LibreWolf, but because this shows that the maintainers care and have the correct priorities.)
- blihp 5y ago
  Debian's told them where to stick it once or twice.
pabs3 5y ago
The Debian package of Firefox ESR is created by a Mozilla employee, who is also a Debian member.

fuckcensorship 5y ago

I prefer to just use LibreWolf [1] instead. [1]: https://librewolf.net/ https://librewolf.net/

fsflover 5y ago
How fast does it get the security updates? How does it fight against the duopoly of Google and Apple on the web?
- Quarrel-Cactus 5y ago
  > How fast does it get the security updates? They don't specify, but it seems frequent enough in my experience. Here is what the Web site says: "LibreWolf is always built from the latest Firefox stable source, for up-to-date security and features along with stability." > How does it fight against the duopoly of Google and Apple on the web? It uses Gecko rather than Blink or WebKit if that's what your question is asking. It's just standard Firefox with privacy tweaks and patches applied out of the box.
  - fsflover 5y ago
    > It uses Gecko rather than Blink or WebKit if that's what your question is asking. By not using Firefox, you remove the funds from the WebKit development. And it costs millions. If LibreWolf doesn't present itself as Firefox, it also decreases the visible Firefox usage, helping the duopoly.
    - tomrod 5y ago
      I'm okay with this. Firefox makes enough money without my marginal contribution further enriching Mozilla execs, your FOMO/FUD notwithstanding. I used Firefox until they lost site of their core target, and killed their mobile app's quality and extensions.
      - antifa 5y ago
        What's wrong with their mobile app's quality and extensions? FF is essentially the only good browser on Android AFAIK, plus it supports extensions on Android.

Kwpolska 5y ago

This is much better than the Snap. Snaps are slow and tend to ignore themes and preferences of various kinds. > Since the package comes from a PPA unattended-upgrades will not upgrade it automatically, unless you enable this origin: You probably don’t want Firefox to update automatically, without your knowledge. A Firefox upgrade means you must immediately restart the browser. If this happens in the background while you’re doing something important, it can easily ruin your day.

yoavm 5y ago
My Firefox updates automatically, and it never told me to immediately restart the browser. Most of the times I don't notice it at all, and sometimes I notice a small blue dot on the top right hamburger menu that asks me to restart. Never forced me, just asks. Moving from Arch to Debian I was disappointed not to find a Developer Edition package, but the official Linux release works just fine and I personally enjoy the auto-update mechanism.
- ghostly_s 5y ago
  Mine prompts me to restart when I load a new page, no option to postpone as fat as I've seen.
  - perihelions 5y ago
    The option is here: about:preferences#general ("Check for updates but let you choose to install them", if English localization)
    - kbrosnan 5y ago
      That pref is not present because it does not apply to distro updated Firefox such as a .deb.
  - TingPing 5y ago
    Because postponing isn't possible, the files changed from under it and their behavior is undefined.

cardanome 5y ago

I hate how Ubuntu is pushing snap. There is only disadvantages installing Firefox from snap. I am glad I am using Linux Mint which shields me from this insanity for now. Solutions like flatpack/snap/appimage are great (though I like snap the least) but they are for extra stuff. As much as possible should be handled by the native package manager.

timbit42 5y ago
I switched to Linux Mint.
silisili 5y ago
I just don't get why they keep doubling down on snaps. Most people really, really hate them. Most people find them slow. They used to just reply their testing doesn't find it slow, too bad so sad. I say 'used to' because I gave up long ago so haven't bothered checking.
- hypothesis 5y ago
  Are those people paying customers? Likely the idea is to let upstream to package once and ship it on all supported platforms. This way there is no constant support/packaging required from distro itself. As to why snap format specifically, that’s probably allows them to make changes as needed without asking anyone.
  - sgc 5y ago
    Right, but if in the process you take your great code and turn it into a crappy deliverable, that's on you. You don't get praise for taking serviceable software and bogging it down while locking out end users on an open source platform. You don't give a f*k. We get it. Further, if you are tunnel-vision focused on profit, remember that if you lose your end users, you lose your only means to eventual income.
    - hypothesis 5y ago
      I’m just acknowledging the reality. There is now a very nice summary comment from worik elsewhere in the thread, but basically end-users are no longer the same from Canonical’s perspective and so it’s probably wise to thank them for good things they did and move on.

darkwater 5y ago

I thought I needed that, because I quickly went back to the repo .deb version when they initially switched to the snap version, but actually the snap version in 22.04 works pretty well for me, I still have not found a broken usecase.

kgwxd 5y ago
It starts up way slower. I didn't notice at first but then I installed the deb version trying to troubleshoot other issues, it didn't solve those problems, but I immediately noticed how much faster it starts, even with the same settings and extensions installed as before.
- darkwater 5y ago
  Yes it did previously (when it was forced the 1st time with...20.10 I guess?) but on 22.04 at least the feeling is basically the same that with the .deb I had on 21.10. I upgraded a month ago when it was still in beta so my memory might be already tricking me.

ailtonbsj_ 5y ago

I already had done this where I work. We are using a own build version of Xubuntu. https://github.com/winunix/xubuntu-winunix https://github.com/winunix/xubuntu-winunix

squarefoot 5y ago

Snap should be an extreme measure when there are no other means to use some obscure package that can't be run using the stock kernel or libraries. Resorting to it for common popular software is such a bad decision. I'm not a Ubuntu user as I rather prefer Debian and Manjaro; hopefully they'll never do the same.

anothernewdude 5y ago
Canonical love making bizarre decisions like this. Just look at Unity and Mir.
- Darmody 5y ago
  Unity made sense, snap doesn't.
  - GekkePrutser 5y ago
    Yes unity wasn't bad and it wasn't shoved down your throat.
    - rstat1 5y ago
      I mean it was the default environment on Ubuntu distros for years...I would say it was more forced than Snaps are.
      - iiix 5y ago
        I don't know if I'd agree; with Unity you could just install a new DE & switch environments without fuss. My biggest problem with Snap is that trying to install something like Chromium via apt, will, most likely unbeknownst to the user, just install the Snap version instead.
        2143 5y ago
        This. I recently installed Chromium via apt, and it actually installed the snap! I mean, if I wanted the snap I'll use the snap command. If it's not available via apt just say so and quit. I don't want it to install the snap version when I asked for the apt (.deb) thing. In this particular case the means to the end matters.

mise_en_place 5y ago

I just use chromium from flatpak, never had any issues with it. I can also switch to Ungoogled Chromium if I wanted to.

smallerfish 5y ago
Who packages it and how do you know you can trust them? Fun fact: the Jetbrains flatpak images are _not_ packages by Jetbrains. If you ask Jetbrains about them, they will tell you it's a random third party (/enthusiatic community volunteer) who packaged them up. Flatpak is a shitshow and should be avoided until and only if Flathub gets better control over packaging.
- vetinari 5y ago
  No, they are not from the original vendors... but also the original vendors were not interested in providing flatpaks themselves, so the community stepped in. I have yet to see any volunteer to refuse handing off maintenance of the flatpak package to upstream. If they listened to your advice, there would be no flathub at all.
  - smoldesu 5y ago
    Even still, is there a good reason anyone would take the performance/security/size hit instead of grabbing the official deb file?
    - vetinari 5y ago
      You might be using a distribution where .deb file won't help you much. Another reason might be, that you are getting an extra sandbox.
      - smoldesu 5y ago
        The sandbox does you no good if you can't confirm that the software running inside it isn't adversarial. It's a catch-22.

tedunangst 5y ago

Why not use the tgz file directly?

sp332 5y ago
Dependency checking?
- tedunangst 5y ago
  I guess. It's not hard to figure out what it needs and install them, though. It's what I do on my debuntu systems.
Nasreddin_Hodja 5y ago
Yes, I already use Thunderbird from official tarballs and going to do so for Firefox after upgrading to 22.04.

jcastro 5y ago

I get people don't like snaps but adding a third-party repository with root access to your computer is not doing anyone any favors. Even if it is run by a trusted community member a PPA will never have the guarantees of the packages in the distro.

zamalek 5y ago
Given that the main contention with Snap is the first-launch performance, a viable alternative is Flatpak. I run nearly everything from it. The bizarre thing about the Snap performance issue is that it isn't present on other distros. I have heard that Snap is really, uh, snappy on Arch (although I am seriously not bothered to try it myself).
- brnt 5y ago
  Although I've no snap experience, first launch performance of Flatpak apps is a good reason for me to steer clear.
  - jcastro 5y ago
    Flatpaks splat the files on disk just like your traditional package manager, you shouldn't be seeing any performance difference.
    - brnt 5y ago
      It loads however a lot more, either a Gnome or KDE base, and it shows. I've tested a few apps with their tarball/rpm versions vs Flatpak, and the latter takes seconds more, consistently. Pretty fast NVME drive too.

wheelerof4te 5y ago

This is why I love and still use Debian. Debian 7 was the first Linux distro that just worked on my old PC. Believe it or not, only Debian had no screen flicker on my old NVIDIA GeForce MX 440. Plus, it was the only distro in 2013th that had a non-free driver for that card (96-something-legacy). Imagine how old that card is when they considered it legacy in Debian 7.

password4321 5y ago
I still install Ubuntu 18 LTS, after it falls out of favor I will be moving on to Debian, all to dodge snaps.

worik 5y ago

Of course there is the option of moving away from Ubuntu Canonical did good work with Ubuntu, bringing the first very good desktop distribution that was usable from a mass audience. But time has moved on, and Canonical has moved on, too. Snap makes a of of sense for a lot of purposes. But for geeks and their desktops, not so much. Canonical is no longer interested in us. A breakdown of a relationship is always stressful, but in this case we have just grown apart, and now we both need change. I wish Canonical all the best in their pursuit of profits in cloud software and systems, and in the IoT world (where snaps are ideal). I am in another relationship now. We have both moved on

sgt 5y ago
If geeks and their desktops are out, the only thing remaining for Ubuntu is server and cloud. That is okay, actually, but a bit sad.
- nvrspyx 5y ago
  I mean, that's where large majority of their efforts have been for the last couple of years, at least. It's self-inflicted.
  - pjmlp 5y ago
    There is no money in desktop, it is self inflicted by the Linux community themselves.
    - nvrspyx 5y ago
      You're right. Self-inflicted was the wrong term to use here. I just meant that Canonical themselves, in some part, have been pushing the desktop crowd away, even if it's a feedback loop between Canonical and the community like you allude to. I just wish they had followed a similar approach as Red Hat have, where they're still able to place a significant amount of effort into the desktop side of things thanks to their enterprise offering and specialized focuses, like embedded systems for automobiles, which I believe is where much of the Pipewire work came about for example. That's not to say Red Hat is perfect or a crowning example of a Linux company "done right". Rather, it's just an example.

ameminator 5y ago

I hate snap. I hate how they are being pushed by Ubuntu. Here's the link I followed to completely remove snap from my Ubuntu installation: https://askubuntu.com/questions/1280707/how-to-uninstall-snap https://askubuntu.com/questions/1280707/how-to-uninstall-sna...

carlsborg 5y ago

The .tgz has never failed me across various distros and time.

rubyist5eva 5y ago

I’ve seen enough people putting off the chrome zero day updates to understand why Mozilla is resorting to a snap package for updates.

Thaxll 5y ago

Since Firefox can auto update itself you can just download the tar.gz directly. https://www.mozilla.org/en-US/firefox/all/#product-desktop-release https://www.mozilla.org/en-US/firefox/all/#product-desktop-r...

rovr138 5y ago
I always do this. I download the tar, extract it, put it on /opt/firefox and then create whatever shortcut I need. Been doing this for years. That way I don't have to wait until the repo or ppa's are updated.
amelius 5y ago
Doesn't the .deb version auto-update?
- Izkata 5y ago
  Ubuntu has unattended-upgrades, which installs security updates through apt without user intervention. Firefox is included in this, it doesn't use firefox's auto-update mechanism.

g105b 5y ago

Wow, this kind of article shouldn't be a thing in 2022. It reminds me of the old days of Linux when you had to hack xorg.conf to get your second monitor to work -- but now it's a hack to get your web browser to work!

lin83 5y ago

Is the linked PPA [1] actually maintained by Mozilla or is it volunteers? I can't tell. The uploader looks like a freelancer and the PPA owner hasn't been active on Mozilla's Bugzilla in over a decade. [1] https://launchpad.net/~mozillateam/+archive/ubuntu/ppa https://launchpad.net/~mozillateam/+archive/ubuntu/ppa

jcastro 5y ago
People in this thread (and the author of the article) are under the assumption that Mozilla is running this PPA, it's run by the community. That being said ricotz has been participating in the Ubuntu community for a very long time, and from a practical standpoint you'll probably be ok. There's a good reason for Ubuntu to push people away from PPAs as distribution methods for end users and instead use them for what they were original supposed to be used for, make it easy for distro developers to fire up repos for testing/development with the intent of that work making it back into distro and Debian. Snaps have lots of problems but using the distro-staging PPA isn't a good idea either.
- lin83 5y ago
  I'm pretty sure the owner of the “Mozilla Team” team PPA [1] has been dead since 2013 [2]. He is also listed as an Administrator. If someone were to comprise his account via his old email, e.g. if he used a now expired domain that could be registered, they could use this PPA to deliver a backdoored Firefox build to thousands of users and steal their passwords, tokens and SSH keys. Community support is great but without a proper security team and enforced secutiry processes the PPAs are very dangerous. [1] https://wiki.ubuntu.com/JohnVivirito https://wiki.ubuntu.com/JohnVivirito [2] https://www.dignitymemorial.com/obituaries/apex-nc/john-vivirito-5422868 https://www.dignitymemorial.com/obituaries/apex-nc/john-vivi...
  - hda111 5y ago
    Thanks for letting us know. Will use the snap then.
  - cjwatson44 5y ago

stormbrew 5y ago

Oh cool, I guess this headline saved me from the frustration of upgrading any of my computers to ubuntu 22.04. Bad enough chrome was in a snap in the last (couple?) if firefox is now too I have to assume the whole OS is basically unusable if you force snap off. Time to switch to a different distro I suppose.

rsolva 5y ago
Give the latest Fedora a spin! After 10 years of Arch I have been pleasantly suprised by the completeness and performance of Fedora since version 34. Version 36 is set to be released in a couple of days.

ur-whale 5y ago

What happens on 22.04 when you apt purge snapd ?

6581 5y ago
snapd gets purged.

akdor1154 5y ago

Well there's another reason to shill Pop OS.. they have been de-snapping Ubuntu with great success for a while now. With that said their 22.04 isn't out for a while and it sounds like there is a lot more involved for them this time around (just from reading this hn discussion)

sen 5y ago
I switched to Pop about a year ago and absolutely love it so far. It’s been one of the most flawless experiences I’ve had with a Linux distro (as a life long “user” but not very good at the fiddly stuff).

michaelmrose 5y ago

I rather feel like we are making things more complicated than needed in recent years. In ubuntu 14.04 8 years ago firefox plus treestyle tabs and adblock plus made a nice combination. Firefox was installed by default and one could go to the addons menu and in about 30 seconds install those 2 and have right off a decent experience. Unattended-upgrades wasn't part of the default ubuntu install and everything updated at once. When you told it to. Now to have the same experience you need to understand the difference between snap and apt and why you would want one vs the other. You need to understand ppas. You need to know how ppas interact with unattended-upgrades. You need to understand config files are in etc. You need to know how config file directories work. You need to know how to pin a package. It appears but I'm not sure that you need to know the difference between purge and remove. Now if you want treestyle tabs to actually hide top tabs you need to figure out the weirdness of firefox profile dirs where its in ~/.mozilla/firefox/my-cat-walked-right-over-my-keyboard-and-had-a-fight-with-my-other-cat. Create a folder called chrome and inside it userChrome.css and either understand css or just blindly paste in some css someone else provided. Then you need to open up about:config and change an arcane setting to make the above actually do something. 90% of that is actually useful understandings. Hey its not like css is only for themeing firefox and knowing about:config exists exposes useless things out of scope of normal configuration but in no universe should I wish my browser wasn't half as fast as windows and I wish tabs were on the side lead to that exiting 3 hour tour 1. 1 https://youtu.be/cfR7qxtgCgY https://youtu.be/cfR7qxtgCgY We can start having the professor run this ship instead of Gilligan any time now. Firefox should be a Debian package by default. Installing a package from a PPA shouldn't bear on how its updated. Installing should be via a singular cli. If snap is to be integrated it should be an argument to that cli even if its not apt. Explicitly telling it to install the deb version should simply cause it to prefer that version thereafter. Absolutely none of this should require touching a config file in /etc. On the firefox they should have found a way for an addon to hide the tabs a while ago and if the user explicitly drops a css file in their profile directory it shouldn't be gated by a setting in about:config. Meanwhile your firefox profile should be something like ~/.config/firefox/default-profile What the hell is wrong with people.

Izkata 5y ago
> Now if you want treestyle tabs to actually hide top tabs you need to figure out the weirdness of firefox profile dirs where its in ~/.mozilla/firefox/my-cat-walked-right-over-my-keyboard-and-had-a-fight-with-my-other-cat. Create a folder called chrome and inside it userChrome.css and either understand css or just blindly paste in some css someone else provided. Also it's not just "understand CSS" - if you want to do it yourself you have to enable a special firefox debug mode to be able to inspect its UI and find the right IDs/etc.

fb03 5y ago

I used to love ubuntu and have been a xubuntu promoter between friends for quite a while, but now I am considering moving away from it, given that they are more and more aggressively pushing people to use their halfbaked binary store solution, which sounds insane, given we already have a pretty "apt" package manager which can install and solve a dependency graph just fine. People that moved away from Ubuntu because of the same crap, what are you using now? What other distros can I use without getting too crazy on configuring shit? My use case is booting a Linux box to develop Python/Rust apps, maybe a docker/docker compose in there and that's it. Don't get me wrong, I love what distros like Nix are doing, but I don't have 16 years anymore and all the free time in the world to tweak my environment to oblivion. I just want to boot an environment which is somewhat standard, run Pycharm, VSCode, and code my shit on. Thanks in advance.

rstat1 5y ago
I moved to using Fedora and its been pretty solid. Recently started using the Silverblue variant which is pretty well suited to do things in containers due to the readonly nature of its root filesystem. There are some aspects that are annoying (like installing software) but that not something I do frequently so its fine. And if you're not a GNOME fan, there's a KDE version of Silverblue called Kinoite or something similar that's basically the same thing but with KDE instead of GNOME. My reasons weren't necessarily because of Snaps because Fedora has Flatpaks which are the same useless crap from my perspective. It was mostly just because I wanted things to be closer to current releases. Otherwise its been solid.
nine_k 5y ago
Something like Pop! OS, maybe? (I personally went radical and run Void Linux. It has no systemd, basically every package is just built from upstream sources nightly, etc. Surprisingly, it's about as fiddly as a Debian box.)
foresto 5y ago
> what are you using now? I switched to Debian. The core of my system is now Debian Stable. For the handful of packages that I want to be newer, I either pull from Debian backports or backport the Debian Unstable package myself (just a simple rebuild in most cases). Flatpak is my last resort for one or two apps that aren't yet available in Debian. Since I don't trust the flathub/pypi/npm "accept software from anyone" model, I try to mitigate the additional risk with a few extra steps: I'm choosy about which flatpaks I'm willing to use, I scrutinize the permissions they try to grant themselves, and I install them only after rebuilding them myself with any unwanted components or overreaching permissions stripped out. (Flatpak's permissions model is broken in my view, but I think it could be fixed, and it is at least a starting place for working toward decent app isolation.) I'll miss some of Ubuntu's Launchpad services (free multi-architecture build farm, free package hosting, user-friendly bug tracker) but I don't value those conveniences as much as I value the benefits of traditional packaging for my core tools. Overall, I'm happy with the switch.

wintermutestwin 5y ago

I wish there was a distro that packaged Firefox with all of the must have extensions already installed (especially uBlock and Sideberry - I don't understand how anyone could use a browser with ads or without side tabs).

spear 5y ago
Not exactly what you asked for but Fedora does package a few extensions [separately] -- uBlock Origin, Noscript, and some others.

LeoPanthera 5y ago

The Valve Steam Deck, which runs a fork of Arch Linux, is, I hope, going to be the final decider in the sandbox format war. It comes preconfigured to run Flatpaks, and while you can install stuff via Arch's Pacman, anything installed that way is erased whenever there's a software update, while Flatpaks persist. So it's in the user's interest to use Flatpaks, and on mine, the Flatpak of RetroArch, as an example, works perfectly with zero extra configuration.

Izkata 5y ago

> Since the package comes from a PPA unattended-upgrades will not upgrade it automatically, unless you enable this origin For anyone still on 18.04 or 20.04 and not yet ready to upgrade or move off of ubuntu, you can add firefox to the "Unattended-Upgrade::Package-Blacklist" list in /etc/apt/apt.conf.d/50unattended-upgrades https://askubuntu.com/questions/1279041/disabling-firefox-background-upgrades https://askubuntu.com/questions/1279041/disabling-firefox-ba...

davidgerard 5y ago

BTW, if you do a do-release-upgrade to get to Xubuntu 22.04, you need to also do: sudo apt install xdg-desktop-portal-gtk or the Firefox snap won't be able to save or upload files, 'cos that lets it use the file picker. They included that package on the ISO, so fresh installs work - but they forgot to add it as a dependency for xubuntu-meta. (Dunno if it's fixed yet, wasn't a few days ago.)

fulafel 5y ago

It's a big archievement that the snap sandboxing has gotten seamless enough to support this. Looking forward to having more sandboxed apps. But the snap system needs more transparency and auditability so we can know what goes into them, like the ppa system does has.

_huayra_ 5y ago

As a recovering long-time Ubuntu user, I encourage everyone to strongly think about whether they need to stick with it. If you need stability, there are plenty of RHEL offshots (e.g. Centos, whatever became of "old Centos" that was relaunched elsewhere), and my personal recommendation as a "drop-in"-ish replacement: OpenSUSE Tumbleweed. It's a rolling distro that has the heck tested out of it by SUSE, and I've been rolling forward an install on my laptop for years without any issue. No more worrying about whether I need to dedicate some time to clean-install my Ubuntu workstation after the dist-upgrade inevitably doesn't work correctly...

rsyring 5y ago

I'll be sticking with Ubuntu b/c A) it's relatively stable B) it ships w/ ZFS by default and C) it's so popular that software creators often put it at the top of the priority list for Linux OS support. I understand the concerns about snaps. Look, if you want control, you have it. Uninstall it and find other installation options including reviewing and building yourself. What I've realized over time is that for the far majority of things, I just want it to work b/c I have better things to spend my time on. I can appreciate that software devs have the same feeling regarding supporting the various Linux distros. It's less time and troubleshooting to just pick a single target like snap. Many of us want Linux desktops to gain in popularity...I can see how snap (or it's competitors) can help make that come true. I have my doubts about something like LXC being shipped as a snap, I'm curious to see how things will play out with shipping more server software through snaps. I understand why the push towards snaps would be viewed more negatively for server applications. I would like software to be heavily sandboxed by default. Why should any software I want to use have access to my ssh agent or all of my files? Firefox should have access to almost nothing except a limited part of the file system and the network, right? I'm not sure we are there yet, but I think this type of software packaging, "containerization", and isolation is a good direction to be heading. There are things I don't like about snap and I kind of wish one of the alternatives would win. At the very least, hopefully they will challenge snap to be better and the ecosystem itself will benefit.

deleted 5y ago

[deleted]

mrtweetyhack 5y ago

voidr 5y ago

I have been pushing Ubuntu on the server, even in places where CentOS was more popular and I was pushing it in the container world as well. When they started forcing snaps, I could no longer use it for containers, therefore I started abandoning it for servers as well in favour of Debian. Snaps are horrible for containers because of their moving parts and I don't believe that they are any good for the server either because last time I checked: you could not have your private snap repository.

rcarmo 5y ago

I just disabled snap and moved to Edge on my test Ubuntu 22.04 install: https://taoofmac.com/space/blog/2022/04/12/2330 https://taoofmac.com/space/blog/2022/04/12/2330

thiht 5y ago

Genuine question : why do you even care if your app is packaged as a deb or as a snap? What does it change for you as a user?

hoppyhoppy2 5y ago
The most visible difference, even to people who don't care about software freedom or technical differences, is that the Snap version of Firefox takes a while to start after clicking on the icon, while other versions (including the Flatpak-packaged version) are zippy to start.

okamiueru 5y ago

I'd recommend a slightly differently approach. First of, remove snap all-together. Continue removing snap packages until there are none left. sudo snap remove firefox sudo snap remove gnome-3-38-2004 sudo snap remove gtk-common-themes sudo snap remove core20 sudo snap remove bare sudo snap remove snapd Remove snap completely: sudo apt purge snapd Then instead of adding the ppa, use flatpak with flathub (https://flatpak.org/setup/Ubuntu https://flatpak.org/setup/Ubuntu)

rsolva 5y ago
This is the way. Or just install the latest version of Fedora, where Flatpak is a first class citizen and everything Just Works.
- arunkant 5y ago
  Using Pop os for some time. working great

Nasreddin_Hodja 5y ago

I will just use official tarballs https://www.mozilla.org/en-US/firefox/all/#product-desktop-release https://www.mozilla.org/en-US/firefox/all/#product-desktop-r...

auraham 5y ago

Wonder what other applications are from snap by default.

hypothesis 5y ago
Chromium I think. Basically anything that is a moving target.
- suprjami 5y ago
  I've been using the Linux Mint Chromium deb for ages with similar tricks to this post. The Mint Firefox package is more difficult, it needs an override package which breaks Ubuntu, but Chromium is standalone.
- asddubs 5y ago
  the webkit based midori browser too
- 0xbadcafebee 5y ago
  It never hit me before now, but I just realized that "constantly upgrading software" is only a thing because corporations are cheap and impatient. Web browsers need to be constantly upgraded mostly because they need constant feature add-ons. They need constant feature add-ons because they want the browser to be able to render all the features of native apps with JavaScript/HTML/CSS, but they can't possibly develop every feature all at once. So they drip, drip, drip out the features. They also can't thoroughly test all the features ahead of time (permutations would require hundreds of millions, if not billions, of tests per release) so they kick the releases out to beta users and collect bug and crash reports, and fix enough of them to call it stable and then kick a release out. Imagine if cars worked like that. "We know you're driving on the highway, but we need to reboot your car because we have a new feature (radio shuffle mode!)"
  - hypothesis 5y ago
    I see frequently on HN this idea that big company behind said web browser can simply throw more devs at it, adding things and features (useful or not) and simply drown any competitors with churn of changes. But you still want security patches too, so you have to install and keep up to date with upstream. Is this also causing relentless update cycle? I think so.