4 ms·

This was a deal-breaker for me. I don't want a firefox packaged by mozilla themselves as a snap or deb, because I don't consider them trustworthy. At least when

This was a deal-breaker for me. I don't want a firefox packaged by mozilla themselves as a snap or deb, because I don't consider them trustworthy. At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. I switched to debian instead. Debian packages firefox ESR, which means my config will be stable for longer.

daenney 5y ago
You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? > At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not.
- shrimp_emoji 5y ago
  >You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Yea, I think this is silly. Apps have the power to update themselves out-of-band from the package manager, so, even if you only install it via the package manager, it can do whatever it wants while short-circuiting the maintainers' oversight.
  - plonk 5y ago
    > Apps have the power to update themselves out-of-band from the package manager Isn't that disabled in Ubuntu's Firefox APT package?
  - adhesive_wombat 5y ago
    Well, not directly: they'd need root to overwrite /usr/bin/firefox, which it wouldn't normally (hopefully) run as. They could have latent malicious code which gets packaged and that could download a payload and execute that (or already contains the attack). But a program without such a pre-existing ability won't be able to update itself to a version that does.
- IceWreck 5y ago
  The do change the defaults and enable/disable features during compile time. This is very different than going through every line of code and patching something they dont like. I'm not OP, but I too consider Firefox published by my distribution (Fedora) to be more trustworthy than Mozilla's official distribution channel.
- bubblethink 5y ago
  I think there is some merit to it, at least as far as dubious features with auto opt-in go. It's not so much that the distro will save you from a hostile firefox or chromium. Rather, it'll give you the modicum of dignity by preventing you from being enrolled in these. In the best case, it prevents upstream from further rolling out such features due to the pushback. In the worst case, you get a small heads up about what's coming down the pipe inevitably anyway and you can plan accordingly.
- okasaki 5y ago
  > You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? I have to use a web browser. > For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Reading and respoding to the changelogs is substantially better than no review.
  - throwaway82652 5y ago
    >I have to use a web browser. No you don't, I suggest getting a different career outside the IT department, if it really bothers you that much. No reason to take the path of most resistance with something that makes you unhappy. >Reading and respoding to the changelogs is substantially better than no review. No, not really. The reason this stuff with snap is happening to begin with is because distro maintainers don't have the resources to maintain a ton of patches on top of a giant browser that releases every month, even if they knew there was something objectionable in the changelog there may not be anything they can do about it in a reasonable amount of time.
- anothernewdude 5y ago
  Not when Mozilla will just disable things like ublock origin and umatrix, without telling the user. browsing the web is *dangerous* without them.
- vetinari 5y ago
  > You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Exactly. The distribution maintainers are reviewers, who can remove the unwanted parts: https://pagure.io/fesco/issue/1518 https://pagure.io/fesco/issue/1518 > Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Actually, Redhat and SuSE guys are active in the development, especially the linux-specific functionality. However, when they package it, they don't have to follow Mozilla's agenda.
- flomo 5y ago
  Just posting in agreement. I'd like my Firefox direct from Mozilla, without being molested by some rando 'maintainer' who could do things like null-out SSL code or include their personal "standard violating" config (and has). As ultra-paranoid as some people on HN are, they suddenly weirdly trusting of mostly unaccountable volunteers. Backdooring some distro firefox would be a lot easier than backdooring your CPU.
goosedragons 5y ago
Are distributions more trustworthy here? Mint for example has in the past fiddled with Firefox's default search to IMO anyways to an annoying degree that I stopped using it. Knife can go both ways here.
bscphil 5y ago
> At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. Unfortunately, Mozilla has enough power that AFAIK they've pretty much run roughshod over the distributions. Pretty much the only software I know of that can do that. It's mostly through enforcing their trademark. If you know of a mainstream Linux distribution where the maintainers actually care enough to patch Firefox to remove all advertisements (including Pocket), sponsorships, and other by-default telemetry, I would love to hear about it and would consider switching to such a distribution for that reason alone. (Not because I'm incapable of patching Firefox myself or using LibreWolf, but because this shows that the maintainers care and have the correct priorities.)
- blihp 5y ago
  Debian's told them where to stick it once or twice.
pabs3 5y ago
The Debian package of Firefox ESR is created by a Mozilla employee, who is also a Debian member.

daenney 5y ago

You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? > At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not.

shrimp_emoji 5y ago
>You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Yea, I think this is silly. Apps have the power to update themselves out-of-band from the package manager, so, even if you only install it via the package manager, it can do whatever it wants while short-circuiting the maintainers' oversight.
- plonk 5y ago
  > Apps have the power to update themselves out-of-band from the package manager Isn't that disabled in Ubuntu's Firefox APT package?
- adhesive_wombat 5y ago
  Well, not directly: they'd need root to overwrite /usr/bin/firefox, which it wouldn't normally (hopefully) run as. They could have latent malicious code which gets packaged and that could download a payload and execute that (or already contains the attack). But a program without such a pre-existing ability won't be able to update itself to a version that does.
IceWreck 5y ago
The do change the defaults and enable/disable features during compile time. This is very different than going through every line of code and patching something they dont like. I'm not OP, but I too consider Firefox published by my distribution (Fedora) to be more trustworthy than Mozilla's official distribution channel.
bubblethink 5y ago
I think there is some merit to it, at least as far as dubious features with auto opt-in go. It's not so much that the distro will save you from a hostile firefox or chromium. Rather, it'll give you the modicum of dignity by preventing you from being enrolled in these. In the best case, it prevents upstream from further rolling out such features due to the pushback. In the worst case, you get a small heads up about what's coming down the pipe inevitably anyway and you can plan accordingly.
okasaki 5y ago
> You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? I have to use a web browser. > For something the size of Fx, that’s probably not happening as much as you think, unless it’s something publicly announced in changelogs. Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Reading and respoding to the changelogs is substantially better than no review.
- throwaway82652 5y ago
  >I have to use a web browser. No you don't, I suggest getting a different career outside the IT department, if it really bothers you that much. No reason to take the path of most resistance with something that makes you unhappy. >Reading and respoding to the changelogs is substantially better than no review. No, not really. The reason this stuff with snap is happening to begin with is because distro maintainers don't have the resources to maintain a ton of patches on top of a giant browser that releases every month, even if they knew there was something objectionable in the changelog there may not be anything they can do about it in a reasonable amount of time.
anothernewdude 5y ago
Not when Mozilla will just disable things like ublock origin and umatrix, without telling the user. browsing the web is *dangerous* without them.
vetinari 5y ago
> You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Exactly. The distribution maintainers are reviewers, who can remove the unwanted parts: https://pagure.io/fesco/issue/1518 https://pagure.io/fesco/issue/1518 > Your distribution maintainers aren’t reviewing every line of code changes between Fx releases, ESR or not. Actually, Redhat and SuSE guys are active in the development, especially the linux-specific functionality. However, when they package it, they don't have to follow Mozilla's agenda.
flomo 5y ago
Just posting in agreement. I'd like my Firefox direct from Mozilla, without being molested by some rando 'maintainer' who could do things like null-out SSL code or include their personal "standard violating" config (and has). As ultra-paranoid as some people on HN are, they suddenly weirdly trusting of mostly unaccountable volunteers. Backdooring some distro firefox would be a lot easier than backdooring your CPU.

goosedragons 5y ago

Are distributions more trustworthy here? Mint for example has in the past fiddled with Firefox's default search to IMO anyways to an annoying degree that I stopped using it. Knife can go both ways here.

bscphil 5y ago

> At least when it's packaged by the distribution someone has reviewed the changes and can flag up and disable any nonsense that mozilla is adding. Unfortunately, Mozilla has enough power that AFAIK they've pretty much run roughshod over the distributions. Pretty much the only software I know of that can do that. It's mostly through enforcing their trademark. If you know of a mainstream Linux distribution where the maintainers actually care enough to patch Firefox to remove all advertisements (including Pocket), sponsorships, and other by-default telemetry, I would love to hear about it and would consider switching to such a distribution for that reason alone. (Not because I'm incapable of patching Firefox myself or using LibreWolf, but because this shows that the maintainers care and have the correct priorities.)

blihp 5y ago
Debian's told them where to stick it once or twice.

pabs3 5y ago

The Debian package of Firefox ESR is created by a Mozilla employee, who is also a Debian member.