Firefox forks might be a reasonable short-term solution to the current era of Mozilla paper cuts, but the crisis is ultimately driven by economics.
Browser dev and maintenance is expensive and that pressure is pushing Mozilla towards the same underhanded, advertiser-driven strategies embraced by google et al.
At best firefox-forks are a less well funded version of what Mozilla used (at least publicly) aim for.
@mcc @sarahjamielewis An honest, vulnerable and naive question: how fast do we really need security response to be?
I mean, I've often ran browsers several versions out-of-date (either by disabling auto-updates on my phone, or by installing an alternative .deb over Ubuntu's) and I have only updated when I found that a particular site stopped working. All seemed ok.
Again, not a rhetorical question and not me saying "maybe we don't need fast updates". I'm asking why should I not be doing this.
Most of the time you will be fine, ad-blockers and the fact that most people stick the the same small set of sites most of the time minimize the attack surface greatly.
But then once every 2 years or so, something like the web-p vuln happens and any image loading becomes a potential full-system takeover. At that point you really do want fast update rollout.
@sarahjamielewis @mcc Thanks! That matches my general feeling of "how bad can it be to access Wikipedia on a year-old version of a browser".
My feeling is that this makes a firefox-fork that's upgrading on a best-effort volunteer basis somewhat of a viable option for someone like me, but not something we could go around recommending for family and the public at large the same way we've been campaining for Firefox over all these years...
@mcc @sarahjamielewis I'm typing this from my personal laptop running the last version of GoboLinux I helped build. Half of its packages are from 2017. Its kernel is Linux 4.x. Every package was compiled by either by me or a friend, save for LibreOffice and Firefox.
The only thing in it I have on semi-auto-update is Firefox, which is running from the upstream binaries with "auto-update on restart" (and I don't restart it for weeks or sometimes months). That's how much I trusted Mozilla. :(
@hisham_hm @mcc @sarahjamielewis
I wonder whether the applications like Firefox are not exactly the best candidates for giving up and using #Flatpak only. Although, perhaps #GoboLinux is exactly the distro, which doesn’t want to use Flatpaks?
@hisham_hm @mcc @sarahjamielewis
I think it is different on different distros.
Without trying to have much of an opinion of my own, let me post here (a bit old, yes) link to https://youtu.be/4WuYGcs0t6I by @sysrich
#OpenSUSE #Tumblweed #Rolling_release #MicroOS #Moldavite #Flatpak
@mcepl @mcc @sarahjamielewis @sysrich
Before even watching the video:
> I think it is different on different distros.
Yes, that's what I meant. I'm sure Flatpak works well on some distros. But the point of those all-in-one packages was to abstract us from the underlying distro. (I do understand how hard/unfeasible it is to get full universality — just saying that in my experience with a VERY nonstandard distro, _the AppImages I tried_ did better.)
Sarah Jamie Lewis
mcc
Hisham
Matěj Cepl 🇪🇺 🇨🇿 🇺🇦