Hacker News Reader

Comment by p4bl0 | Hacker News Reader

Is there really a point these days in having the very last release rather than the ESR version packaged by Debian? If so what are the benefits for end users?

View on HN

In case of security fixes, you will stay unpatched for a bit less time. ESR is intended for places that really don't like any form of change like rigid enterprises and banks and such. End users should probably steer clear of that unless they have a good reason not to; which they generally don't. Except for a false sense of security.

I personally don't see a good reason to opt out of security changes for any longer than strictly necessary and that's exactly what you do when using ESR. First they get backported by Mozilla. That's after normal users receive them. This takes time. Then testing takes place because they don't want to push out a hasty fix for ESR. This takes more time. And then third party packagers need to pick up the changes and repackage (which is mostly pointless and adds more time). And then eventually it rolls out days/weeks/months after normal users have long received the patches. I don't seen any good reason for such lengthy delays for normal users. In some big companies where they manually review updates for workstations it's a compromise between the extra work and stability. But the tradeoff is timely access to security fixes; which ESR simply doesn't provide.

End users also have plenty of reason to dislike change. Change tends to mean things like exciting new spying and UI regressions. Meanwhile, security concerns are often overblown. If you're just using your browser for e.g. email, news, facebook, youtube, netflix, amazon, and your bank, and not venturing out into the seedier parts of the web, you're probably at ~0% risk of some RCE exploit. In any case, an adblocker is probably better protection than auto-updates.

Yep. vaapi was crashing on several builds in a row on a popos machine, till it magically stopped doing that 2 weeks ago. ESR though, worked just fine.

Change tends to mean things like exciting new spying and UI regressions

Or missing out on new anti-fingerprinting and anti-tracking improvements. Note that adblockers don't generally do the former.

I don't see a problem waiting for alpha- and beta-testing to finish first before the new code is distributed to actual normal users.

Note, the "normal users" you describe are involuntary testers who got forced into the role because keeping testers on the payroll is so last century.

The voluntary testers are the Firefox Nightly and Firefox Beta users, not the Firefox stable users.

I said involuntary testers. The guys who sign up for the nightlies and beta know full well what they signed up for, but not the involuntary testers aka "normal users".

Your premise is flawed. The testers are the Nightly and Beta users, not the stable users.

I've been using the beta channel for ages. Never has been a problem for me. The stable channel is stable as advertised. It's rock solid. ESR is not so much about adding even more stability and more about just guaranteeing long periods without any changes whatsoever in order to cut down on testing cost that big IT departments have for any kind of change.

Insisting on an ESR release on what is effectively a poorly supported type of operating system where every install is basically a snow flake that heavily relies on it's users being able to fix all sorts of weird issues (i.e. every Desktop Linux distribution ever) is a bit weird and overly selective.

I used the ESR version for a while because it was still deb packaged rather than a snap pack and the snap firewalling blocked a plugin I used that had to talk to another program. Unfortunately the ESR version has also moved to snap. So I am glad to here Mozilla team is moving to make a native deb package available.

They are always adding new stuff, but I use floorp which is based on ESR and well I'm still surviving and internetting even in January 2024. I think you're in good company. I really just need a browser, and firefox is my choice, but floorp is just a bit more customizable in appearence and I like that (no need to mess around with user.css). Let them test and debug the new fangled stuff and I'll get a super stable version by the time it hits ESR

My system, my choice. I'll be testing Mozilla's packages, for sure.

As for Debian's standard response to using non-Debian packages, they have the following wiki entry:

https://wiki.debian.org/DontBreakDebian

If you are a web developer, you would better develop your app using the latest dev tools and targeting the latest web specifications only.

Most companies don't prioritize legacy support, so there is no point in developing for Firefox ESR.

> Most companies don't prioritize legacy support,

On the other hand, the more legacy you support, the larger your potential customer base is. Also, if everyone else in the sector only supports the most recent release of only two browsers, you might have that extended customer base all to yourself.

> you would better develop your app using the latest dev tools and targeting the latest web specifications only.

That is one school of thought.

Another is that you should regularly use the oldest platform (hardware, OS, browser) that you want to support. That way you won't get to two weeks before release, decide you ought to test on a dual-core 4Gb machine like you were planning on supporting, and realise that although it technically runs, it's so frustratingly slow that no-one would want to, but there's not enough time to make the changes you'd need to get it working "acceptably". OTOH, if you were using it on hardware where it ran like a dog for you from the 3rd sprint, you'd probably have got round to making the changes for it to be acceptable on that era platform.

> On the other hand, the more legacy you support, the larger your potential customer base is.

It is more a decision about the trade-off between costs and benefits. Supporting really old browsers like IE is a pain in the ass.

> Another is that you should regularly use the oldest platform (hardware, OS, browser) that you want to support.

It is possible to manually slowing down your browser with dev tools. https://imgur.com/a/99XbwN9

> OTOH, if you were using it on hardware where it ran like a dog for you from the 3rd sprint, you'd probably have got round to making the changes for it to be acceptable on that era platform.

Or perhaps even made saner choices in the first place rather than rambling about "premature optimization".

ESR isn't -that- old. jeesh. If you develop on ESR and it works well it's definitely going to work in something newer. However every web dev I know tries in multiple versions and multiple browsers.

exploit patches

Firefox ESR will receive security patches too, so this argument doesn't apply IMO.

Reply on news.ycombinator.com