OpenBSD won't update Firefox, advises users to switch to ESR
undeadly.org
undeadly.org
I wonder if there are others who support this opinion that desktop Unix has very complicated future unless complex apps will begin to bundle their own libraries.
EDIT: And of course for security reasons - but then you only upgrade the affected player and not huge parts of your installed base. What I want to say - this is all about the ruling design philosophy.
However, the default way an AppStream is made eschews parallel installation support.
Red Hat will make parallel-installable AppStreams whenever it is needed. And they can incorporate the content of one AppStream in another if need be.
It's a good idea in general, and it would be cool to solve this problem, but modular "streams" as they currently exist have so many edge cases that I don't really suggest using them if you can avoid it.
I think that's because Snap is also meant to be used in IOT where disk space is limited but it definitely should be optional on work machines with lots of disk space.
[1]: https://appimage.org
I really feel it should support containerisation in a similar way as Flatpak does. In my opinion, the idea that any application on your system can can touch all your files and access all your other applications is really problematic. You're always just one broken (intentionally or not) application form having your entire system compromised.
As best as I can tell, the only solutions that even tries to address this is Qubes OS and Flatpak.
The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level.
The way shared libraries are used in Linux is built upon the assumption that package managers and centralized repositories are the right way to do things.
Also, for the most part, the "Arch is unstable" thing hasn't been true for a long time. I find that it's far more stable than Debian or Ubuntu LTS on my machine because of newer kernels containing newer hardware drivers.
As a Debian user, I appreciate that the stuff I install had at least gone through some minimal vetting first. And if I have to add a third party repository or download something myself to run, I'm much more likely to view that as the possibly-dangerous action that it is, and try to actively assess the reputation and trustworthiness of what I'm installing.
That's certainly not an average, noon-technical user thing, though. Vetted app stores are there to help average users avoid malware, assuming they're doing their job properly.
Things like the app store, in for profit scenarios, seem like ways to slip in monopoly control. Brew is an attempt to circumvent it.
I don't want to come across as suggesting they're a bad idea or don't have advantages, just that on balance I've always had a sense there had to be a better way.
Package managers are an easy way to do things, most of the time. That's why brew exists.
They are not a universally good way to distribute and install software. It twists the relationship between the software developer and the user.
The work done in Nix and Guix is interesting in this regard.
Traditional package manager conflate having something with composing something (everything is ambiantly available and interacting). Nix separates those, so you can have every version of everything, and only try to compose things that fit.
I don't want a middleman, I want to get my programs from the developer, and store them using the tools I know (regular files on a filesystem).
Are package managers easy to use (most of the time)? Yes.
Are package managers (as they exist today) a universal, well designed way to distribute software? No, because they impose a middleman.
I've done it both ways. Centralized works a LOT better. It's not even close.
You get a more stable system, and you get security bugs fixed faster, and more reliably.
What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. And that's OK.
Depends on the distro. Archlinux is pretty fast to update packages.
The thing is, the distro maintainers need to decide whether they want a fast moving "latest and greatest" approach, which might break stuff by accident, or go a "slow but always dependable" route, which you can depend on as company, with painful losses if things go south (in which case there should be an express lane for important security fixes).
In my opinion, the reason why Archlinux can be so dependable is that packaging is based on really simple ideas, like not starting or stopping services on installation like Ubuntu would, and that most if not all system files belong to a package. The package manager can do a whole OS installation just by installing the basic packages on a directory different from /. The package format is also really simple. Getting into the guts of Archlinux packaging is really approachable and that makes me feel at ease for whatever trouble I may find myself in.
I've had my drive fail, but that was the drive's fault, and even in that case I also didn't need to reinstall everything. I just copied the good files and reinstalled only the packages whose files got corrupted.
If I sit down in front of my PC and can't do work, it's broken. That I can spend an hour or two fixing it rather than reinstalling is irrelevant.
Certainly, Arch is definitely not a "it just works" OS. It's a tinkerer's OS. Different distros favor different types of users. By what you said, probably something like Ubuntu or Mint is better, something that "just works" with minimal learning curve for someone not familiar with Linux in general and that does not wish to invest the time in learning it. (Not saying that you're not at least familiar with it, but that's what these distros optimize for, I believe.)
Personally I didn't experience all that much breakage, but eventually got frustrated by kernel updates breaking hotplug kernel module loading until reboot because Arch removes kernel modules for the running kernel. This breaks random things like plugging in a USB drive unless you happened to load the module previously, so you're essentially forced to reboot every time you upgrade the kernel or take care to manually exclude it.
I'm grateful for Arch because their wiki is beyond excellent, but I wouldn't recommend it to anyone unless they just want to tinker.
Is your supposition that a "misconfiguration" just "happened" randomly over night?
No, it's a rolling release distribution, software on it will break randomly on updates. You need to read their FAQ, even their official document will tell you this happens and it's not their responsibility due to the rolling release nature of the distribution.
If that's not it, then I've no clue anymore about what you mean as broken.
The specific notice mentions rust dependencies. Rust does not have shared libraries, so a Rust [security] update means all rust binaries must be completely rebuilt. That seems to be part of OpenBSD's concern, and perhaps this has "triggered" the poster.
user blackhaz random forum post found:
> mariourk, you're definitely not alone. The same breakage happens to FreeBSD desktops as well. I have been vocal around the forum a few times about this. Not every desktop user wants to upgrade all their packages every X months. The way the default repositories are structured, the upgrades are forced onto users. I am a huge proponent of using application bundles, like on Mac OS, as quite often those upgrades break complex desktop apps too. I don't mind upgrades but sometimes I need to stick with a specific version of software, or roll back after something went wrong, and if it came as a bundle with its own dependencies, it wouldn't have to depend on other stuff that is being "force-upgraded" periodically.
So his complaint is about the way FBSD handles updates; he is generally incorrect about shared libraries; and his comment is completely OT for this thread.
What's the concern with that, exactly? OpenBSD is a security-focused distribution, do they not do reproducible builds?
Virtually every Linux distribution and BSD share this concern. We've all complained about it to Rust upstream, but they don't care. To them, it's cheap to rebuild every Rust project every time the compiler is updated or the standard library needs a fix.
See for yourself: https://github.com/rust-lang/rfcs/issues/600
What's worse is that a lot of people are forgetting why we do it this way in the first place. While part of it was about saving disk space, the major reason we do this is for being able to fix things in a cheap way and have wide-ranging impact. Without this, things like security fixes to zlib, libvpx, or other important libraries would require finding all their reverse dependencies, patching them, and rebuilding them to incorporate the fixes.
It's incredibly important, but because nobody cares in Rust and Mozilla, we're all doomed...
Nonsense. Rust has shared libraries just as much as C and C++ do. Distributions can and do build individual Rust crates as shared libraries, and crate authors can go further and offer a shared library with a C ABI that remains stable across rustc versions. (The latter is what cbindgen is for.)
The problem here is that the maintainers don't want to keep multiple versions of a crate around, so when any single application uses a newer version it forces an update on all the rest. Which is exactly what Rust's tendency toward static linking avoids.
I use this not as my main browser, but only when I can't avoid visiting "the wild web", meaning unknown or untrusted sites, or even sites that use too much javascript for me to feel safe allowing in my main browser.
For example, Chromium. Any BSD developer would know that attempting to upstream their port there is dead in the water. AFAICT, They Chromium devs only care about Win, Mac, Linux and nothing else. Likewise for Firefox, which is why the BSDs don't get official releases.
I feel some sympathy for OSes like the BSDs that for "some" software they are limited by the arrogance of other open-source maintainers who would rather go for maintaining the convoluted distros and testing with a huge disintegrated software-stack than testing a single unified OS which the BSDs maintain themselves.
Firefox does maintain ports for the BSDs. https://bugzilla.mozilla.org/show_bug.cgi?id=1598511, an OpenBSD-only issue, was fixed less than a month ago.
The BSDs qualify as "Tier 3" in Mozilla's build terminology, which means that the onus is on external contributors to identify problems and propose fixes, as there is no continuous integration support for these architectures.
In other words, Firefox doesn't maintain the port for OpenBSD, OpenBSD developers do.
We mostly don't want official releases, we prefer our package managers.
Firefox is absolutely not like Chromium, Mozilla is very good at accepting patches and the upstream repo pretty much always works on FreeBSD. Just git/hg clone and ./mach build and here it is.
Nowadays (for almost 20 years actually), Windows supports and encourages programs to deploy their dependencies in their own folder.
It is trivial to do for developers and works perfectly for users.
Some people claim security updates are a problem, but many apps do not deal with untrusted input for starters. For those that do, like browsers, servers or your office suite, you really should be using one that is supported and updated automatically.
(The problem with bundling isn't disk space, but composition. Individual applications can compose fine, but libraries can't if they link other libraries at different versions, and use those library's types (ABI) in their own interface (ABI). To solve this problem you need to distinguish between public vs private dependencies in your package manager.)
Oh good, I'm not the only one thinking about this:) My last idea was basically "run nix on top of a BSD (replacing the package manager), then make nix package(s) for the base system". Which sounds doable, actually.
It's funny, from your point of view having a centralized repository with a (usually) single (usually) latest version of a library is a bad thing that may be (and probably isn't) justified by the goal of saving space.
From my point of view having a centralized repository with a (usually) single (usually) latest version of a library is an awesome thing that I would leave any other ecosystem to get, and the space savings is just a bonus that doesn't much matter.
Most dependency maintainers don't provide updates for more than a few versions of their software. When one piece of software depends on -latest and another piece of software depends on -legacy, you can ship both with the central repository model. In the Linux distributions I've used this is a solved problem. Arch Linux has five different versions of the JRE that are separately installable.
Also, personally I've stuck with Arch Linux for 6-7 years now because it's the first distribution I found that consistently works for me, so I don't know that anecdotes will get us very far either way.
To counter with anecdata: I've been running Arch Linux testing repositories for over a year now with no issues whatsoever.
> It is the user who is ultimately responsible for the stability of their own rolling release system. The user decides when to upgrade, and merges necessary changes when required. If the user reaches out to the community for help, it is often provided in a timely manner. The difference between Arch and other distributions in this regard is that Arch is truly a 'do-it-yourself' distribution; __complaints of breakage are misguided and unproductive, since upstream changes are not the responsibility of Arch devs__.
Even their wiki is very clear to inform you that you're at the whims of the package upgrades.
But I also want to point out that "it hasn't broke in a year" is cute, but I ran arch for probably 10+ years until I finally got tired of it and moved to Ubuntu. The last straw was me sitting down to get paying work done and spending half my day trying to recover my work environment. In the 2-3 years since I moved to Ubuntu I've never once sat down at my PC and had something stop working that was working before.
This defense of your favorite distro is especially silly when you think about it logically. Of course a rolling release system is going to have more breakages. The sensible response isn't "it never breaks!", but is instead "that's the nature of rolling release, you opt into it when you choose Arch".
For a long time before using arch I thought too that rolling release might be more unstable, but I have come to the conclusion that quite the opposite might be true.
Maybe you meant debconf? When I was a DD it was an RC bug if your package used debconf to do "magic", i.e. using it as a registry for an application, or not properly re-seeding answers from the configuration and assuming the debconf db was the source of truth.
That's a fist-full of caveats. Arch is willing to upgrade the kernel, maybe you should include a dist-upgrade in the comparison.
I can plan for it? You can see if you're upgrading your kernel. Nothing breaks if you decide not to run an upgrade.
This nonsense is why stable and LTS releases were introduced in the first place.
If I'm faced with a major upgrade of an LTS system, I usually choose to reinstall from scratch, shedding packages I haven't needed for a long time with it. But that happens every couple years or so.
If you're okay with hitting the forums now and then to find out why your desktop has been behaving oddly the last two weeks, rolling is your thing. You won't have to break in your new dist-upgraded or freshly installed system for like two weeks.
If you don't want to play lottery every time you hit enter for that update or if you're a business where you can't afford possibly breaking all your laptops for some security update, stable is your only option.
It's "choose the best tool for the job" I guess.
I like Linux, I don't dislike dealing with the OS. But I want to deal with it on my time. Expecting to get work done and then realizing something is broken and being forced to deal with it is a completely different proposition from picking out a weekend to reinstall your work PC with the newest LTS version.
This goes back to my original point, which we've drifted a little from.
Ubuntu has more unexpected behaving when upgrading than Debian.
A working dist-upgrade should not be something that your OS struggles to provide. Asking people to reinstall their OS isn't an acceptable answer.
Upgrading should not be a lottery.
This argument that you MUST dist-upgrade as soon as the next version is available, and completely ignore the entire idea around LTS, is silly.
This idea that you never want to upgrade from one LTS to the next is equally ridiculous. Upgrading the operating system is part of the package manager's job.
This assertion makes no sense. Debian Stable has always the paragon of stability to the point that it's actually criticised for it. The Debian Testing release is even famous for being more solid than other distro's stable releases.
Breaking changes in Debian are practically only remotely possible in Debian Unstable or if you purposely install packages from backports or PPA repositories that have no assurance of stability or even maintenance.
Why be condescending? The above user has a good point, and your view is clearly against the majority of Arch Linux users.
As I understand it, Arch Linux is like having a pet. It requires constant care and feeding to keep it alive but can be very rewarding (allegedly)
In my experience it happens very rarely and is often quite easily resolved.
>happens very rarely
>is often quite
And the reason for this is because you realize the latest update killed virtualbox and you require it for your work so you need to be able to downgrade and pin the vbox application to a specific version.
Meanwhile, Ubuntu catches the problem and refuses to update the package until it's fixed. Therefore I never even realize there was a breaking update to vbox somewhere.
The difference being that Arch tells me when to tinker because it blew up again, Ubuntu allows me to choose when to tinker because it doesn't.
I just gave a link from their FAQ that clearly states the system will break when packages break and they aren't responsible for it. As another user pointed out, you can go do a search for 'manual intervention' and find years of results on their front page.
Arch Linux users are ok with having their system randomly stop working. I used to be ok with it, until the umpteenth day that I lost half my working day getting the system back up and running.
I went through some hell when I ran Gentoo unstable(~) but for the past several years I've been on Gentoo stable and have very few issues. I've even used it on work laptops at three different companies.
It is definitely more of a do-it-yourself distro than Arch for sure, but I enjoy working with it.
I actually appreciate that Gentoo is set up to allow me to run that command if I want to.
But I did move off of Gentoo due to constant dependency conflicts. They took forever to deal with and they were pretty well guaranteed to happen whenever you didn't hold to a strict and frequent update schedule.
That never seemed acceptable to me and I ended up moving over to Arch Linux for a good 10+ years before the instability of it finally got to me and I moved to Ubuntu.
Having said all of that, I'm glad to hear that Gentoo is stable for you. I really enjoyed my time with Gentoo and I got the feeling that after he left there were mistakes made in terms of everything working reasonably.
Your description of Arch reminds me of an experience I had with linode and arch years back. Due to an internal hardware issue, they basically lost my server. When I went to recreate, I discovered that you couldn't just update the world because it would immediately result in a broken system. You instead had to reconfigure a few things before updating the world.
I no longer use Linode.
At some point the vendor has to take responsibility. That's a large part of why I like Ubuntu, they do. It works every day without me having to worry about it.
Well, no. The point of a rolling release system is that you upgrade by little increments, so you never have a moment when a 'major upgrade' happens and breaks your system or forces a reinstall.
Maybe don't pacman -Syu before work or if you're working the next day? It's not strictly necessary to update every day.
And no one said Arch never breaks, I just provided anecdotal counterevidence that it's really not that bad.
That said, just because you had good luck doesn't mean that it's stable.
Here's the most trivial way I can think to explain this:
Check out Arch News.[0] Ctrl-F (Find) 'manual intervention'. Six years of results on the first page ; 13 instances of 'manual intervention required'.
Reliability != stability. Stability usually implies a platform on which one can use and develop for without expecting common major changes, if ever.
As for the anecdote of using the [Testing] repositories, a users experience with such things really depends on their use of new and currently developing software.
A simple computer with simple peripherals that is used to run emacs all day isn't likely to be broken by the Testing repositories.
Personally , my anecdote : the second someone starts using Arch for something new-fringe (hi-dpi, touch, tablets, SPDIF, SLI, NVRAM, new window managers, new x-windows replacements, prototype schedulers, filesystems, or kernels, PCI pass-through, exotic RAID configurations..) [Testing] repository is an act of masochism. It's only a matter of time before something drops out.
I found that my best bet was chicken sacrifice and Opus Dei-style self flagellation before each [Testing] 'pacman -Syu' . At least then I had a 50/50 chance of the next boot. But, granted, I use a lot of weird or fringe hardware.
All that said : other distributions don't have better [Testing] repositories. It's just that [Testing] is for .. testing. It's unstable by its' very nature.
13 instances of "manual intervention required" over 6 years seems awesome.
I think I did 2 manual interventions during my time using Archlinux, and each time it took maybe 2 minutes, it was just a matter of copy-pasting the commands in Arch News.
Meanwhile you can use RHEL or CentOS and basically leave the thing alone for 5 years.
I probably wouldn't recommend Arch for corporate environments, but at this point I feel I should point out I wouldn't recommend Linux either if you're working in a windows shop.
Distros targeting the same desktop needs are Ubuntu, Mint, Debian-flavors, Fedora, Gentoo, ...
In corporate environment for critical software you would get a contract with an on-call duty and you would only have a limited choice fo supported distros.
There is no defending it, it's a fact of life. You get bleeding edge at the cost of stability.
I've had various non-rolling distros fall apart on all sides within 6 months. With Arch I've had one manual intervention(aka one copy-pasted command) in over a year and one minor issue where I needed to restart a service. That's amazing and something I'll gladly take in exchange for painless and straightforward setup of pretty much anything.
Not to mention with regular backups(that should be done either way) and delaying updates in critical time periods you can easily minimize the risk.
That's the minimum that you should be doing regardless of the OS. And thus, that's not where the risk is at.
It's probably more difficult to understand if you get paid regardless of whether you can get meaningful work done.
But for those of us who live on the other side, losing an unplanned half a day due to an OS issue that actively causes us to lose money, it matters.
Arch is bleeding edge, this means software bugs are far more likely on it.
I had Arch on a laptop I used for my freelance business once and took notes of the time spent on maintenance. So I actually have the numbers and know how much money I wasted compared to the time I used an Ubuntu LTS. Guess how many hours I wasted on repairing breakage on Ubuntu LTS. Exactly zero.
However, I come from a business perspective here. You really don't need an operating system that introduces new versions on a whim in the middle of operations. There's a reason businesses run RHEL/Centos or macOS and whatever has LTS in Windows land: cost of maintenance and reliably wide windows of no possible breakage.
As a business, it's kind of a dodgy position to be at relying on "yeah, randomly upgrading versions worked for me so far. Fingers crossed, lol".
So I'm interested in what people use their Arch Linux for and what didn't work for them on any other stable platform. My personal observations point towards the Arch Linux users being the tinkerers who like to use cutting edge and hose their Debians trying to wedge some newer version into it. While the ones that ran screaming away from Arch pretty much never had the desire to change the underlying system and were happy with a security backport now and then.
You don't want your PHP version to endlessly get updated during your operation when you build your app at a specific version.
It would mean not only you have to take care of distro update gotchas but you have to go through all the breaking changes the language introduces.
Stick with LTS. Rolling is for enthusiasts, though Arch does have put decent efforts on their wiki but I did find errors on minor pages that didn't make it work as written.
I think we'll figure out how to upgrade in the 2-3 years of support PHP has for each version. Trying to compare this to arch's rolling release style is bananas.
100% my experience as well, down to the freelance. I made another comment pointing out that the ones who think it's just a minor issue with Arch get paid whether they're getting meaningful work done or not.
ndiswrapper was the main cause back in the day, shockingly giving Windows drivers access to the Linux kernel can cause problems. The most recent time was when VDPAU was new and I was trying to get HD video playback working on a mini-PC with an nVidia Ion GPU by running a version of the nVidia driver much newer than Ubuntu packaged. Now that I think about it that must have been around a full decade ago.
There were rough patches along the way but, all distros were having the same problem in someway or another (vdpau, fglrx, multi-gpu support, ndiswrapper & wireless stuff, etc.) but it's a set it and forget it affair for a very very long time.
...and obligatory xkcd: https://xkcd.com/963/
The only two major distributions that I used for a sufficient amount of time are Ubuntu and Arch. Arch "unstableness" is exactly what I want most of the time on my personal computer as it's my to-go Petri dish. "Stability" would mean that it's harder for me to break it apart, and make a Frankenstein out of it. That's exactly what I have been experiencing with Ubuntu LTS releases --- stability.
Most of the time, I want to have all the available LLVM versions alongside with all the GCC versions, with all the available binutils (Qemu, Docker, Oracle VBox, etc.) versions on the latest kernel full of my monkey patched printk's. When I finally get to break its back I dive the Wiki for few hours to restore it.
I can imagine a non-office, hacking desktop OS that follows the Arch packaging strategy being highly successful.
I also maintain a few compute servers for 10-20 people. They are on Ubuntu LTS. The packages that I need there are always the ones that just work and don't let anyone do anything "cutting edge".
Arch is rolling release and you take the good with the bad. The ones who try to defend arch as some paragon of stability miss the point that Arch's model is inherently unstable, but it comes with other benefits.
I'm the one who kicked off this entire conversation pointing out that arch is unstable, and it cracks me up watching silly people scramble to try and defend Arch as being some paragon of stability.
No, it's not. That's baked into its identity.
I also agree that you shouldn't run your production database on Arch Linux. It isn't made for workloads like that. But personally I find maintaining Arch Linux+"custom packages"(with AUR) easier then Debian+"latest packages"+"custom packages".
Back here in reality, rolling release is less stable because more bugs in the software get through. And this is a reasonable expectation and not some magical fairyland where bugs never get written so being right up against the dev branch is as stable as being on the stable branch.
We really live in two different software worlds. Every software I'm using has its number of bugs a purely decreasing function of time, especially in the "main" paths and use cases.
If it were true, it means there wouldn't be bugs in the first place because they wouldn't have gotten written. The very fact that the bugs got written implies new bugs can, and will, be introduced.
There's also no need to do that, since nobody prevents users from installing newer versions alongside old ones, and invoking them directly.
Even not considering the fact that different GCC versions can coexist, complaining about this breakage in absolute terms doesn't make any sense. Releases changing default compiler versions inevitably cause more breakages with packages who haven't been updated to be compatible with newer GCC versions. So ultimately it's a matter of choosing the distributions with the appropriate release model, not a matter of Ubuntu/Debian breaking stuff.
Libav has also been deprecated in Ubuntu long ago, so it's not clear what you refer to. If you happen to refer to the transition from and back to ffmpeg, that's very old history.
I'm referring to the libav* libraries which are part of the ffmpeg project (not the horribly-named libav fork) - and external debian repos providing updated version of those (due to better codec support in media players, etc) such as debian-multimedia
I can't remember what I was looking at, but within the past week I ran across a comment that said Arch Linux only supports constant upgrades such as that, and any delays that result in skipping a version are what risk causing breakages. The commenter was very surprised that they were even thinking about supporting a version jump on whatever the thread was about (pretty sure it was somewhere here on HN).
So, your comment is 180 degrees off the mark. Arch exists for people who don't want breakages to happen.
(On the other hand, if you're conditioned by Windows to reinstall the system every year, then Ubuntu might work fine for you.)
Or, for people who don't want breakages but also want/need current software versions.
Debian-based stuff can be pretty nice and stable as well, but on Arch installing and setting up anything usually "just works" without missing dependencies, renamed packages etc.
I think I'll take the planned upgrade, thanks.
I think the main issue/benefit with arch linux is that it wont try to do anything for you, except give you extra instructions for when a package change requires "manual intervention".
I put that in quotes because I don't think of that as breakage, I think of that as normal upkeep. We'll, as long as it's listed.
Anyway, the implications are that things can be stable longer on arch because there is no magic under the hood. But there will be times (though I haven't experienced it myself), where something unexpectedly breaks, and it'll be hard to recover unless you know what your doing... though maybe it's actually easy with the rolling back packages? The package manage does keep copies of old versions of packages, I've just never needed them.
As an example if this, my co worker and I have very similar thinkpad laptops. His graphics start doing wierd things that hes has to go fix after every update (Fedora or Ubuntu, can't remember). I took 4+ hours to get mine working how I want, with research and experimentation, but nothing has broke it since.
More UX anecdote; I use Arch (btw) but trying Manjaro just now for something so I grabed an image from osboxes.org; the system update fails after hitting enter on the default options https://i.imgur.com/OTNRMrH.png
'y' for the last would have continued things, but "ugh, I have to think about something" is breakage to some.
The thing is, my experience with Ubuntu is that there will be times when something unexpectedly breaks, and because of the added complexity, it will be nearly impossible to recover even if you know what you're doing.
PPA breaking is apparently not Ubuntu's fault.
This reasoning assumes that future versions of software are always better. This is certainly not the case. I would like that a working program does not spontaneusly break because a third party "upgrades", thus introducing a new bug. I am willing to give up anything else to be assured that working programs continue to work no matter what.
The conversation in the two posts you replied to isn't about whether you always want to be on the bleeding edge all the time, it's about whether it makes sense to have a centralized repository that contains the latest version on some supported channel, which isn't necessarily the same thing as the latest -nightly. I take the position that it is; that shipping a (potentially) different version of a library with every application is a bad approach which is often less secure and harder to maintain.
There is a new version of the Rust library. In theory, either anything that supports it should be updated selectively (i.e. Firefox) or all consumers should be updated in lockstep. Yet in practice the maintener decided that neither option was feasible so nothing was updated at all. What went wrong here?
You may want to check out Nix. It's a package manager which isolates each program's dependencies; so you can have multiple versions of the same package.
> or a security fix
having a centralized repository like this helps in case a it's a library that needs a security fix, because you only need a single update to apply the fix to all applications. Applications that bundle their own deps (including Docker images) will need to publish their own update with the updated version of the lib.
Nix is a fantastic concept, and I hope it takes over the world. But the NixOS packages are a mess. I tried it for a few months last year before giving up after several packages and even whole collections of packages became unusable even in the stable repository. The repository needs some serious reworking before Nix can really shine.
If you allow every application to choose its own version then they all choose a different one, which means someone then has to continue to maintain every different version of the library separately. Doing that isn't much if any of a reduction in workload compared with getting every application to use the version the distribution ships, and is much more likely to end up with a situation where dozens of versions of the same library exist and half of them are broken in some way.
The better solution is for libraries to only break compatibility between major versions. Then the packager can ship some suitably recent minor version for each major version of the library, at most two or three major versions are supported at any given time which keeps the maintenance overhead feasible, and every application can successfully link against one of those major versions or another.
Supporting the presence of multiple library combinations doesn't mean that you "support" all version combinations in the sense of supporting all combinations of their versions being used in the wild.
It just means when users upgrade they can do so gradually for some sets of packages at a time. You can emulate this on traditional distributions by having a single VM image you use for your browser, then cloning the image, updating packages, and using that one for your E-Mail etc.
Having a mechanism like this should mean less support is needed from the distribution, because system-wide breakages are less likely to occur.
You'll get the same bugs, but users can easily back out say an OpenSSL version with a security fix for the 5% of packages it breaks with, while retaining the fix for their browser & other high-risk packages.
For example, I currently can't upgrade my firefox version on Debian testing because it ">=" depends on a version of a couple of libraries that some 100-200 other packages on my system don't like.
In Debian testing this sort of thing happens occasionally and will get fixed sooner than later, but that it happens at all is just an emergent property of how the versions are managed. If I were to run the latest firefox with those new versions and not touch the other packages until they're recompiled both myself and the package maintainers would be exposed to fewer bugs, not less.
I'd get a bugfixed firefox today, and they wouldn't need to deal with bug reports about a broken upgrade, or firefox bugs in an older version users like me can't upgrade past simply because firefox happens to share the use of a popular OS library.
It's not about combinations. It's about, there's a serious bug in the library and now there are 79 different actively used versions of it that need to be patched instead of 2, which means half of them never get fixed.
> You'll get the same bugs, but users can easily back out say an OpenSSL version with a security fix for the 5% of packages it breaks with, while retaining the fix for their browser & other high-risk packages.
You'll get the same bugs and then the 5% of packages a security update breaks are broken until they're fixed, which should happen promptly because broken packages should be very high priority. Is it really better in that short time for the other 5% of applications to "work" but be insecure and get your system compromised because the new vulnerability is being actively exploited?
The real solution is for sufficient testing to be done during the embargo period so that by the time the new version goes wide it doesn't actually break anything.
> For example, I currently can't upgrade my firefox version on Debian testing because it ">=" depends on a version of a couple of libraries that some 100-200 other packages on my system don't like.
Right, that's a problem. It's valid to need version >= 5.6 of some library, but something has gone wrong if some other package specifically needs version 5.5 -- version 5.6 should be able to satisfy that dependency. Or if it can't then "5.6" should be 6.0 and it should be possible to have 5.x and 6.x installed together, but that should happen only rarely so that at most two or three mutually incompatible versions are in active use at once.
In general the latest version should be able to satisfy applications expecting older versions and then you need only a suitably recent version and nothing else, and the lack of that is the real issue.
Yes I agree that would be a royal pain in the ass, i.e. running something like a Debian where each package would be the equivalent of a docker image with an individual maintainer who'd need to decide when they upgrade OpenSSL.
I'm saying you could have something like a Debian where the build infrastructure and package maintenance works exactly the same, your package is always built against the latest library versions.
But users get a NixOS-like experience where they can partially update their system, now with traditional OS package management an update of a common library & a full system-update are often in practice the same thing.
> Is it really better in that short time for the other 5% of applications to "work" but be insecure and get your system compromised because the new vulnerability is being actively exploited?
On the flip side is it really better that if you're using the other 95% of applications that your security fix is delayed because upstream is finding it a pain to rebuild the patched package for 5% of its users? That's realistically the alternative.
> [...]but that should happen only rarely so that at most two or three mutually incompatible versions are in active use at once[...]
The sum of differing versions in use among a distro's userbase is vastly larger than that, some of those users are deferring security updates because their distro makes upgrading an all-or-nothing experience.
Well, no. Else software on macOS and Windows obviously wouldn't work, since those ship all their libraries along.
It does not matter to the users of my software that I use libraries versions X, Y, Z, what matters is that what they want to happen happens when they click the buttons. e.g. I generally use Qt - there are plenty of bugs, but what matters is that my use cases work, and it is my onus of developer to ensure it.
And it is so much more painful to ensure that it will work correctly without any regression and with best performance for every version across e.g. Qt 5.6 to 5.14, than to just ship Qt 5.14 myself built with only the features I want with all my use cases duly tested.
Not exactly. For the system libraries (e.g. the Windows crypto API) you effectively get one version for the whole system, and it works because the library maintainer (Microsoft) is diligent about maintaining backwards compatibility between versions. Whereas for applications that include their own copy of e.g. OpenSSL, that problem does occur there. When there is a vulnerability discovered in OpenSSL, every developer using it has to update their application instead of a library package maintainer doing it once, and if any application is no longer maintained (or just never updated to the latest version) it's now insecure indefinitely.
> And it is so much more painful to ensure that it will work correctly without any regression and with best performance for every version across e.g. Qt 5.6 to 5.14, than to just ship Qt 5.14 myself built with only the features I want with all my use cases duly tested.
You don't have to ensure it works with every version ever made, only the one the distribution ships.
This is made much easier if the library developer designates specific versions as stable and then stable distributions use those versions, because then working against the two or three actively maintained stable versions is all you need to work anywhere.
yet people have to ship microsoft DLLs left and right since behaviour sometimes still break. One breakage is enough to convince stakeholders to do that.
> When there is a vulnerability discovered in OpenSSL, every developer using it has to update their application instead of a library package maintainer doing it once, and if any application is no longer maintained (or just never updated to the latest version) it's now insecure indefinitely.
On the other hand, I had software who broke, as in, core features became unoperational due to openssl distro updates and changes of default policies. My users much prefer having working potentially unsafe software in the exceptional case where the software would connect to the network (eg reading a youtube stream in VLC or something like that) that non-working software.
> You don't have to ensure it works with every version ever made, only the one the distribution ships.
Which is "every version ever made" because people are still rocking Debian Wheezy or Ubuntu 12.04 and want to use my software
Do they, though? Or are they just unaware of what "insecure" means?
Sure, if you frame it as "[technobabble about TLS certificates], click 'continue' to make the software work?", they'll chose the insecure-but-working option.
But if you frame it as "your Internet Service Provider, government, and possible third-parties may be notified you are watching this video, do you want to proceed?", some of them might think twice, depending on what country they live in and what the video is.
In principle true, yes. But it comes with a cost. Even the nixpkgs Firefox maintainers are considering to only ship Firefox ESR starting with NixOS 20.03:
https://discourse.nixos.org/t/firefox-on-19-09-could-be-mark...
Maintainers also sometimes need to patch software to conform to their distribution's norm. For example, Debian patches it to accept extensions installed with APT.
And I'm glad distribution maintainers always recompile software themselves, it helps making sure:
1. binaries are really made from the open source code (I know, it's not bullet-proof)
2. it's actually humanly possible to actually compile it from source (my pet peeve in this area is Kafka: it's used everywhere, but no one seems to know how to actually fully compile it from sources anymore)
Name checks out...
They put countless hours into stitching roadkill into a complex quilt and then scoff at users who complain on the rotting stench.
They split packages from the creators into multiple pieces to meet their own idiosyncratic aesthetics. Firefox and other pieces of complex software should reside entirely in its own hierarchy. I have been using Linux and FreeBSD since 1997, SunOS and OSF/1 before that, this is good as it gets folks.
The only hope is Nix, OSX, Qubes and folks that care about progress. Everyone else is building ships in bottles.
Although as far as package management in Qubes you’re still stuck with dnf and apt. But they’re pushing progress in other ways. (Are you able to run nix on qubes?)
Not easy to find a good middle ground and still supporting progress.
[2] https://guix.gnu.org/manual/en/html_node/Reduced-Binary-Seed...
You mean you aren't familiar with Python's virtual environment system exactly intended for isolating development dependencies from system ones but you're blaming the distribution. Please.
If you want to use multiple versions of Python and pin them, you should use something like asdf [1] and its Python plugin [2]. It's a version manager with support for many languages and more. I used it for Elixir, Node, PHP, Ruby and even PostgreSQL (I need different database versions in different projects.) I never used it for Python because I'm OK with being on the latest version so far.
With asdf I would expect to do something like this
asdf install python 3.7.5
mkdir my375project
cd my375project
asdf local python 3.7.5 # pick the version to use here
python3 -m venv py375 --python=~/.asdf/installs/python/3.7.5/bin/python
~/.virtualenvs/py375/bin/activate
Even virtualenvs themselves can cause the breakage. Take "pylibtiff". It embeds a copy of libtiff. But, it's old and incompatible with other libraries on the base system. This can be libraries it depends upon, or it could be another copy of the same library. Either way, virtualenvs can cause more problems than they solve.
I fully agree with what OpenBSD has decided, I think the only thing worse that compiling Firefox is Gnome 3 :)
Threads have nothing to do with that and don't increase memory usage due to dependencies.
Firefox, Libreoffice and others big applications typically take a long time to compile because they have so much stuff built-in instead of depending on the system libs. They gain a lot of stability and predictability but you can have dependent libs with security issues too.
I spoke to the gentoo firefox package maintainer last night. He even has firefox building on aarch64 with musl, so things are pretty good. For more common targets, there's also the option of using the official binaries from Mozilla.
Gentoo policy is to attempt to provide a way to use system libraries where possible except when those libraries are too heavily modified. If something breaks, they use the bundled package. You can see that's currently happening with harfbuzz in firefox until they bringup the patch: https://github.com/gentoo/gentoo/blob/master/www-client/fire...
From experience, it's usually fine to use system libs when available unless those system libs are unstable or development releases. Then all bets are off.
I also think that large projects should just vendor their dependencies, including compilers, so you git clone the thing, type "bazel build", and have a working binary. (I am fine if the dependencies are not checked in to the repository, a bazel WORKSPACE file is fine with me. It records a checksum for all dependencies, so even if you reach out to the Internet to get it, you get the same bytes as the developers working on the code.)
Building and distributing software should be very simple. But it's not, because of an accumulation of legacy tools (shared libraries) and practices ("please install these 6000 dependencies to build our project").
My point here is to be able to install a new package when it's out, without disrupting the whole environment. For FreeBSD, for example, the new Firefox is already available. I have installed it, and it wouldn't run. I had to auto-update 300 MB of other stuff, including LibreOffice, PyCharm and even TeXLive, to get the system up to date for the new Firefox to be able to run.
If you're saying "your distribution can't automatically update you if libc is vulnerable to something", that's true. More CPU time is required to react to major vulnerabilities, as everything has to be recompiled. However, it's not much CPU time, and the downsides of requiring more compute time are lower than the upsides of knowing exactly where your dependencies come from. And having your "getting started" instructions be "1) install bazel 2) bazel run //your:binary".
I have no problems with the standard approach. Actually, it makes me feel safe: a maintainer fixes a vulnerability in a shared library and all apps are fixed. If all apps shipped their own libraries I'd have to download a new version of all apps, if they ever care to fix their code.
Containerization satisfies the contract the application expects.
That is really the problem it fixes, dependency hell and dynamic linking.
If most people are using containers because “applications were never designed to be compiled entirely static”, developers should start designing their applications so they can be compiled entirely static.
In pre-history this tool worked ok for some things, I don't believe it still functions on modern systems.
You assert that, but is that really true? Updating "stable" distro should be non-event, the very opposite of disruptive.
Imagine you're rolling out *nix 5000 endpoints; change is going to make the problem hard, so the idea is stables ABI/APIs should be the same, so it can like a platform you can build against.
The problem is, browsers pretty much have to be the latest versions, or websites won't work, and most hardware improvements are going to need a new kernel (which to be fair, given linus don't break user space position, is a probably safer than updating userspace), so it doesn't necessarily work for all use cases.
A common approach in webdev has been to keep current, but run a test suite so you know what breaks, and deal with it when it happens, but I don't think the average infrastructure person has kept up with web dev here, and unless you're running containers, you're probably still on a stable OS.
I heard it can tolerate two different applications using different versions of the same dependency...
> praying my Python and other projects survive [...]
And this is exactly why I never update. Every 10 years or so I go through the pain of installing a new version of the OS, mostly because the browser no longer works on most websites. But then, now that the web becomes more and more uninteresting to me, I might as well keep the current version until the hardware breaks down.
Security? Sure, but not at the cost of ruining half of my installed software on a regular basis!
If there was a statically linked version of BSD, I would switch to it in the blink of an eye.
(I’m trying to do something similar by downgrading to an old version of macOS more-or-less permanently, because I don’t like where the platform has gone.)
I think that there is in general no technical problem to have multiple versions of the same library installed (files in /usr/lib are versioned anyway and for other data the libraries can be compiled with prefix including version).
Then, package system could handle different major/minor versions of libraries as different entities, handle upgrade of major/minor versions through dependencies from installed/upgraded packages, and only upgrade library directly for patch-version change (i.e. security bugfix).
In such setup, there would be several instances of a popular library installed on a system, but not say hundreds partial instances statically compiled-in to applications. And it still allows simple updates of libraries for patch fixes.
This is really sad. It seems that we are moving from the complexity of shared libraries to the complexity of "docker images" and the like, where the whole OS is embedded in each program for convenience. The sweet spot of static executables has been shamefully bypassed.
In contrast on linux I have exactly one updater and can be certain my software uses the fixed version. I don't care about disk space saving or RAM savings (though those are nice), I care that stuff gets fixed and is secure. If you don't enforce that you trade convenience (for the developers, not the user) for security.
Can anyone explain what is behind? Is it symptomatic for any programs with those dependency? Especially curious about rust because it seems to be hyped very much lately (I have almost zero rust experience and even less bias about it, just being curious)
now if the complaint is solely about rust, not specifically FF, then that's a different story. it might indeed be that FF is the only package using Rust right now?
The fast releae cycle of Rust might not help though.
Which honestly sounds like a totally awesome and legit reason to use -esr. Keep -current current with upstream, stable branch gets patches from firefox-esr.
Keep in mind stable patches to the ports tree are pretty rare on OpenBSD. They didn't do them as binary packages until fairly recently, either.
The security patch is actually quite severe and has been reported to be in active use.
https://www.mozilla.org/en-US/security/advisories/mfsa2020-0...
https://www.cisecurity.org/advisory/vulnerability-in-mozilla...
In a stable branch you want the size of changes to be small and targeted despite how severe the issue is. You don't want to take on new bugs from patches that aren't related to issues you want to see fixed.
It would be a lot harder if the actual fix was more complicated and a much more complicated diff. Possible that master has diverged sufficiently from their version that backporting the fix would be unreasonable.
As far as I understand, you cannot call it Firefox anymore if you deviate from upstream (which is understandable, because upstream doesn't want to get bug reports for custom changes):
https://www.mozilla.org/en-US/foundation/trademarks/distribu...
Modern packaging has changed the approach to bundle dependencies-- using more disk space and bandwidth but isolating apps from each other and allowing independent upgrade cycles. Flatpak and Snap work like that and the title wave of interest in containers on servers is related, as server containers are also used to isolate dependency stacks.
Flatpak and Snap are Linux-specific, though. If the BSDs had a comparable solution to package GUI apps along with their dependencies, I presume that Firefox would be one of the first apps to get that treatment.
That way, the users always have working applications. Some applications may take more time to be up to date with their dependencies, but at least some of them can be updated asap without worrying about the others.
For example, I use Debian 10 stable on my laptop, on which I installed Snapd. I then installed Firefox with Snap, and I can be confident that Firefox will have the latest security updates, while keeping the system stable (some parts of the system are probably unsecure, but at least everything still work, they will be updated later)
Although, I would like to point that, while the storage space issue is solved with current tech, the bandwidth is still an issue when on mobile data.
On your personal system it probably works really well. In reality tracking thousands of containers on top of operating systems which are using different methodologies gets really complex and in reality isnt ever really done well. At least in my experience. ( granted fortune 100 / 500 never does anything well :) )
What seems to be happening is the burden of the developer to maintain dependencies is now shifted to operations to maintain the automation that manages the various versions of containers because the complexity is too great to do it any other way.
What I see happening in the application of this model is very similar to train wrecks. You see the crash coming for a long time but cant do anything to stop it.
If you don't know about Pledge and Unveil you can think of it as similar to Firejail sandboxing from Linux but on steroids. It dynamically limits the types of kernel calls and filesystem addresses a process can make use of so if a rogue thread causes a process to perform an illegal operation under the Pledge rules OpenBSD will kill the process with SIGTERM. Whats more Pledge and Unveil allow the process to execute whatever calls are needed when the program initializes itself but it will relinquish the privilege to run those calls for the remainder of the program's runtime once it no longer needs them (after init).
- Firefox is hard to package so they won't package it (on stable).
- OpenBSD-current users are not affected as firefox has already been committed.
- Firefox-ESR is still maintained.
> (thanks to cbindgen and rust dependencies) on the stable branch (as this would require testing all rust consumers)
Can someone explain what they mean with this? What have other non firefox rust consumers to do with firefox being packaged?
The best guess I have is that to package firefox they need to package cbindgen and rust. And if they package cbindgen and rust officially all packages using it would now need to be tested as now (potentially) all their dependencies have been packaged?? But this seems strange TBH.
EDIT: So I guess they still will package Firefox-ESR on stable? Which will have (or maybe already has) all that dependencies, too? So it's just about having to do that packaging less often?
Through I wonder a bit why they don't automate the tests (maybe the computation cost?). (E.g. rust automatically runs the tests of all libraries/programs published on crates.io to find regressions, through that takes a day or so to complete).
Now what?
Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed?
And all this to only get automated tests passing. Any regressions in behavior not tested are not noticed (or more likely, noticed by users much later, requiring further investigation at that point in time to narrow down the Rust backport as the cause).
In the meantime, this packager’s work on other OpenBSD packages in -current (what most OpenBSD developers actually use day‐to‐day) completely stops.
That’s some insight into the mindset of a software packager. Non‐security backports to language runtimes are a serious maintenance burden.
Discard the outdated assumption that a single installed dependency version is sufficient for all packages, and then improve the packaging system to permit multiple releases of Rust, Python, etc. to coexist as dependencies so that packages can migrate gradually over time rather than forcibly whenever one crosses the line.
Homebrew does a fine job of this. Installing python@2 doesn’t necessarily mean it’ll be made “the default”, but it does make it available for dependencies without interfering with the default python 3 package.
EDIT: NixOS does this right: https://news.ycombinator.com/item?id=22023086
NixOS changes a lot of things to make it all work. If you're willing to pay that tax for the sake of package management, great! People who use BSDs generally aren't.
Rust is designed to support multiple toolchains with rustup. I've got the following installed on my desktop box:
stable-x86_64-apple-darwin
nightly-2018-12-14-x86_64-apple-darwin
nightly-arm-unknown-linux-gnueabihf
nightly-x86_64-apple-darwin (default)> Now what?
> Spend two weeks investigating all the test failures? Backporting updates to these packages as well, all while users are patiently waiting for their Firefox to have its zero‐day fixed? Are the tests even correct? Were they failing before and nobody noticed?
Yes, people do exactly that. It's part of running a "rolling" distro, see e.g. the Debian Testing transition tracker at https://release.debian.org/transitions/ - These transitions are running essentially all the time; they're only "put on hold" as a first step in the process of making a new stable release. And even then, newer versions of packages such as rust can still enter stable as part of an "unrelated" security update.
And we do that too—for OpenBSD -current. But we have neither the manpower nor the interest to do such work for old releases.
* switch to a shorter stable release cycle (4 weeks, 6 weeks, etc.) with dynamic releases (e.g. if a zero day happens, fix current, and do a new stable release)
* switch to only supporting -current
* switch to something like Nix to allow stable users to "switch" some packages from stable to current, without having to bump their whole system (this would have allowed stable users to update their Firefox-stable to Firefox-current)
A good packaging process should not assume that downstream packages can be trusted to have meaningful processes. Relying on Firefox having -esr releases is a temporary workaround.
It's a small miracle things like Rust are supported on OpenBSD at all, let alone things outside of -current.
The policy suggests that ESR will update infrequently to the latest Rust-stable at each major .0 release, so as long as 6.7-stable and ESR end up having the same Rust stable version, that will work out. That’s a coincidence-based success, not a certain one, though.
[0] https://support.mozilla.org/en-US/kb/switch-to-firefox-exten...
My biggest problem with most browsers is tied to how they handle tab management and lacks basic features that should be there without installing an extension.
Example - stacking, auto closing, filter, finder etc. Not hiding tabs after certain number of them.
edit: more info here at https://vivaldi.com/features/tab-management/
Blocks all trackers, fingerprinting and mining scripts by default, based on Chromium. Built-in IPFS, Webtorrent and Tor: https://brave.com/
Please, prove it.
And here's where you show you're making it up and haven't even looked at a Pale Moon release notes, http://www.palemoon.org/releasenotes.shtml
If I really wanted to scare you, I'd tell you about such security-friendly-sounding commits as "we don't want the newest release of the [crypto] library, let's freeze at an older version" or "re-enable support for RC4 in TLS." But that would be unfair, because you'd actually have to read the commit to judge for yourself if I'm quoting them in good context.
1. You don't seem to think the Pale Moon has value, nor that it should be used.
2. You say you don't read their release notes--which makes sense if you don't think it's worthy.
However:
3. You say you do spend time reading their patches--which doesn't make sense if you don't think it's worthy.
4. Their release notes frequently mention "defense-in-depth" patches which are their own work, not, as you put it, to "randomly backport patches purely to try to keep somewhat up-to-date"--which conflicts with your claims about their work.
So you say you read their patches, yet you don't appear to read all of them. And you say you don't read their release notes, yet you speak as if you have comprehensive knowledge of their work.
Then you say something that's supposed to be scary, but then you say that it might not actually be scary, and you won't tell us whether it actually is.
So, regardless of whether Pale Moon is valuable or useful or secure to any degree, isn't your comment a textbook example of FUD? What's your purpose here?
If you actually read the release notes, you wouldn't say this.
It's not "random", inform yourself: https://www.palemoon.org/roadmap.shtml
1. https://www.palemoon.org/technical.shtml
2. https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel...
Pale Moon and the like aren't just ancient Firefox code. And without all the 'features' Firefox keeps adding in that are irrelevant to a browser that renders html and executes JS they're just as secure.
The up shot is Pale Moon's maintainers decided they don't trust Let's Encrypt for spurious reasons. But if you use Pale Moon you've probably never noticed this because Let's Encrypt is cross-signed, and so even though Pale Moon claims not to trust them, the cross-signature makes everything still work because they didn't intervene.
So that's a bad decision, combined with total incompetence to produce the appearance where everything looks fine.
That's exactly the sort of thing in a browser that should make people run away screaming.
In the years that followed Pale Moon wanted to keep StartSSL (the outfit which straight up lied to us about issuing clearly bogus certificates for money, Pale Moon's maintainers apparently feel that this shows "integrity") and described Mozilla's distrust decision as a "foot gun". How did that work out? Oh right, it turns out that everybody else doesn't trust liars either and so Pale Moon eventually went along with this because as others explained in practice they're mostly just applying patches blind to core Firefox subsystems like NSS.
I don't think there is a viable alternative to Firefox unless you accept a simple web experience and use eg w3m
No.
Building a good browser is hard. Typically you can get something "safer" (from a privacy/business model perspective) and/or "simpler" (from a development perspective) relatively easily - see KHTML and other niche efforts. But when it comes to "more secure" while supporting modern web features, you need a lot of skilled eyeballs on code and a lot of people trying to break things. You achieve that either with tons of visibility, or with tons of money. Those small projects have neither. Mozilla has both.
Brave and Vivaldi are still forks of Chromium, Waterfox is a fork of Firefox. Thus you are not going to find any updated alternatives like those on the BSDs anytime soon.
Meanwhile, WebKit-based browsers doesn't seem to suffer from the overuse of dependencies and multiple languages nor does it have packaging hell unlike Chromium and Firefox.
why is that?
In comparison historically Firefox has been more aggressive about pulling in 3rd-party dependencies like cairo, ANGLE, etc.
(You could count ANGLE as a 3rd-party dependency for Blink, I suppose, but I don't because AFAIK it's a Google project originally)
KDE has "Falkon".
Both are quite good.
Full circle!
1. https://www.palemoon.org/releasenotes.shtml
It's basically a lightweight interface to webkit. There's only so light one can go, however; a browser basically ships an entire rendering stack and big chunks of an OS, and with all the weird features and backwards compatibility issues that have accumulated, one can only go so small.
In the C/C++ world, you specify the language version using a flag passed to the compiler. e.g. -std=c++98
In most other programming languages, you specify language version by installing multiple copies of the compiler/interpreter and running the corresponding version.
The C/C++ way works fine if your language spec is updated once every 3 years. It does not work fine for anything much more frequent than that. Until recently C and C++ were popular enough that the other approach didn't need to be accommodated. Now it does.
It's true that C/C++ compilers usually have a flag that gates language features. However, you're still using the same libc not matter which standard you've picked. For example, there were some changes made to format strings in C99, like parsing hexadecimal numbers with scanf. If you have a C99 libc, you'll always get that behavior, even if you specified "-std=c89".
https://doc.rust-lang.org/nightly/edition-guide/editions/cre...
Every new version of the Rust compiler brings changes to the language, so the language you're actually using depends on the tuple (compiler version, edition), not just on the edition.
But you are correct to point out that old Rust editions will get new language features if they do not break existing code.
https://hacks.mozilla.org/2018/12/rust-2018-is-here/
The release process claims that the changes in new Rust releases are purely additive and backward compatible; the only exception is soundness fixes, which I'd expect affect a negligible amount of code.
This is not at all similar to C++ standards, and the specific case being discussed in this post demonstrates exactly why!
Barring bugs in implementations, developers could develop against whatever version of the compiler they like, and as long as it supports the same language version, distro or OS maintainers wouldn’t have to update theirs, and everything would work.
I worked on an open-source project that targeted C++11. It could build on basically any Linux distro you can imagine, even ones with very old versions of GCC. (it didn’t support BSD, but for unrelated reasons).
This is the point the Rust project seems to miss when harping on about backwards compatibility: forwards compatibility is just as important.
However the Firefox project has decided to always require the latest stable Rust release. https://news.ycombinator.com/item?id=22022834
In practice for C++ I've found it expedient to whitelist some subset of functionality from newer standards, because there's often useful features that already work in the major 3 compilers, but it'll be another 3 years until the last of the compilers adds the last obscure bits for full support of the new standard.
Also broken is maintaining multiple packages that package multiple versions of the same package with combinations of external, frequently changing platform packages like rubygems that are packaged manually. Multiple versions of the same package should share common recipe declarations as much possible and be managed more cleanly. Native extensions should be built automatically in CI/CD using polling or notifications rather than manual methods that too often lead to outdated, vulnerable dependencies and create too much pointless, repetitious busywork.
- it's much bigger and resourceful than openbsd maintainers.
- it decided to adopt this fancy update policy, and instead of making it easy/seamless, left it up to the whole open source community to play catch up.
Well played.
If you are maintaining a large number of machines in an enterprise environment, you're not keen on updating half of the installed system just because you update your browser, simply because the necessary testing and fixing of regressions costs a lot of time and money for no real gain for both users and administrators.
Have you ever heard of any program requiring a 6-weeks-old-or-newer version of GCC or Clang, and failing to build on older ones?
"Stable" is just a name -- Rust stable is anything but.