Comment by 66fm472tjy7 | Hacker News Reader

Comment by 66fm472tjy7 | Hacker News Reader

Parent Full thread

The most recent version of IceCat at this time is 60.3.0, published on 2018-11-09 [1], 18 days after upstream [2]. Upstream is currently at 60.7.0, published on 2019-05-20 [3]. This puts IceCat more than half a year behind upstream. Waterfox published their version merging upstream 60.7.0 security fixes before upstream [4].

Using IceCat thus seems to a bad idea security-wise.

I use upstream ESR ever since FF disabled add-ons since they let their cert expire [5] and the release channel version ignores the 'xpinstall.signatures.required' flag.

[1] http://ftp.gnu.org/gnu/gnuzilla/60.3.0/

[2] https://ftp.mozilla.org/pub/firefox/releases/60.3.0esr/

[3] https://ftp.mozilla.org/pub/firefox/releases/60.7.0esr/

[4] https://www.waterfox.net/blog/waterfox-56.2.10-release-downl...

[5] https://arstechnica.com/information-technology/2019/05/firef...

I'm not sure what URL is technically supposed to be the correct one, but they do seem to have updated through at least 60.5: http://devel.trisquel.info/repos/packages/icecat/pool/main/i... Trisquel in general seems to be pretty dead, looking at their git.

While I'm not sure whether that includes any backported security fixes or not, you're right that this is concerning. Perhaps building it yourself is the way to go.

>I use upstream ESR ever since FF disabled add-ons since they let their cert expire [5]

Unless I'm mistaken that bug would have bitten you on ESR as well. The expired certificate was an intermediate used to sign most of the addons on AMO. If ESR wasn't using that certificate then it wouldn't have been able to validate those addons. Correct me if I'm wrong.

Looking at their SCM, they updated to the newest upstream less than two days ago [1]. However, the change appears trivial, so it might be feasible to track upstream if building from source as long as their customization scripts remain compatible.

> that bug would have bitten you on ESR as well

Sorry, I didn't word that clearly. ESR was affected, but the signature check could be disabled from about:config. The release channel had that flag listed, but it had no effect.

[1] http://git.savannah.gnu.org/cgit/gnuzilla.git/log/

Ah, I didn't realize ESR did that. (And frankly I'm surprised it does.) One of the things I change when I build Firefox for myself is allowing the disabling of addon signings via about:config.

Reply on news.ycombinator.com