3 ms·
In case of security fixes, you will stay unpatched for a bit less time. ESR is intended for places that really don't like any form of change like rigid enterpri
by jillesvangurp 3y ago
In case of security fixes, you will stay unpatched for a bit less time. ESR is intended for places that really don't like any form of change like rigid enterprises and banks and such. End users should probably steer clear of that unless they have a good reason not to; which they generally don't. Except for a false sense of security.
I personally don't see a good reason to opt out of security changes for any longer than strictly necessary and that's exactly what you do when using ESR. First they get backported by Mozilla. That's after normal users receive them. This takes time. Then testing takes place because they don't want to push out a hasty fix for ESR. This takes more time. And then third party packagers need to pick up the changes and repackage (which is mostly pointless and adds more time). And then eventually it rolls out days/weeks/months after normal users have long received the patches. I don't seen any good reason for such lengthy delays for normal users. In some big companies where they manually review updates for workstations it's a compromise between the extra work and stability. But the tradeoff is timely access to security fixes; which ESR simply doesn't provide.
- ndriscoll 3y agoEnd users also have plenty of reason to dislike change. Change tends to mean things like exciting new spying and UI regressions. Meanwhile, security concerns are often overblown. If you're just using your browser for e.g. email, news, facebook, youtube, netflix, amazon, and your bank, and not venturing out into the seedier parts of the web, you're probably at ~0% risk of some RCE exploit. In any case, an adblocker is probably better protection than auto-updates.
- IWeldMelons 3y agoYep. vaapi was crashing on several builds in a row on a popos machine, till it magically stopped doing that 2 weeks ago. ESR though, worked just fine.
- gcp 3y agoChange tends to mean things like exciting new spying and UI regressions Or missing out on new anti-fingerprinting and anti-tracking improvements. Note that adblockers don't generally do the former.
- Dalewyn 3y agoI don't see a problem waiting for alpha- and beta-testing to finish first before the new code is distributed to actual normal users. Note, the "normal users" you describe are involuntary testers who got forced into the role because keeping testers on the payroll is so last century.
- Tijdreiziger 3y agoThe voluntary testers are the Firefox Nightly and Firefox Beta users, not the Firefox stable users.
- Dalewyn 3y agoI said involuntary testers. The guys who sign up for the nightlies and beta know full well what they signed up for, but not the involuntary testers aka "normal users".
- Tijdreiziger 3y agoYour premise is flawed. The testers are the Nightly and Beta users, not the stable users.
- jillesvangurp 3y agoI've been using the beta channel for ages. Never has been a problem for me. The stable channel is stable as advertised. It's rock solid. ESR is not so much about adding even more stability and more about just guaranteeing long periods without any changes whatsoever in order to cut down on testing cost that big IT departments have for any kind of change. Insisting on an ESR release on what is effectively a poorly supported type of operating system where every install is basically a snow flake that heavily relies on it's users being able to fix all sorts of weird issues (i.e. every Desktop Linux distribution ever) is a bit weird and overly selective.
- smegger001 3y agoI used the ESR version for a while because it was still deb packaged rather than a snap pack and the snap firewalling blocked a plugin I used that had to talk to another program. Unfortunately the ESR version has also moved to snap. So I am glad to here Mozilla team is moving to make a native deb package available.