Mozilla Announces Long Term Support Version of Firefox 249
mvar writes "After a meeting held last Monday regarding Mozilla Firefox Extended Support Release, the new version was announced yesterday in a post on Mozilla's official blog: 'We are pleased to announce that the proposal for an Extended Support Release (ESR) of Firefox is now a plan of action. The ESR version of Firefox is for use by enterprises, public institutions, universities, and other organizations that centrally manage their Firefox deployments. Releases of the ESR will occur once a year, providing these organizations with a version of Firefox that receives security updates but does not make changes to the Web or Firefox Add-ons platform.'"
Good (Score:5, Insightful)
This is a nice solution to the problem everyone has been complaining about.
I really see no complaints to this move.
(inb4 shill)
Re:Good (Score:5, Insightful)
Re:Good (Score:5, Informative)
Re:Good (Score:5, Interesting)
Exactly!
In fact I think they only did the Firefox-LTS version because people got the idea to fork it [in-other-news.com], not because they really listen to their users. Maybe somebody could threaten to do a Thunderbird-fork...
However, Thunderbird is not as profitable (important) as Firefox. Firefox brings in AFAIK 100 Million/year while Thunderbird probably brings close to nothing.
Re:Good (Score:5, Insightful)
ESR's support is only for a year though, it seems? It might take institutions 2-3 months to decide it's worth upgrading to. A 2 year solution seems like a better, long term plan. In 2002-2009, having your web browser being a year out of date meant losing out on a lot of features and security fixes, but in the last 2 years innovations have really slowed down and I think 2 years support (as opposed to 1) would give institutions a lot more reason to stick to Firefox. Think of it - the many 4 year undergrad students (perhaps the less technically inclined student) would only have to experience one change in the web browser in their college career in school computer labs, etc. By changing this yearly, you're just adding another thing to the pile of the "annual make sure it all works together without crashing checklist".
Re:Good (Score:5, Insightful)
Er... Browsers are adding security improvements and features at a much much faster rate now than in the 2002-2009 timeframe. This is true at least for Microsoft, Mozilla, and Google.
In the specific case of Mozilla, it has about 60x more employees now than in 2002 (and 3x what it had in 2009). It would be _really_ odd if improvement rate were actually slower as a result, since the codebase was already quite mature in 2002.
Re:Good (Score:5, Interesting)
I would assume LTS would include security fixes, but would be a feature freeze with only security updates (improvements)? Did I mis-read the blurb when it said "providing these organizations with a version of Firefox that receives security updates but does not make changes to the Web or Firefox Add-ons platform"?
Honestly I could care less about most new features, 99.99% of the time features add extra clutter and are better executed as plugins anyways.
Re: (Score:2, Insightful)
How much less could you care?
How important is this topic to you?
Personally I couldn't care less, even if I tried. I have no interest.
Re:Good (Score:4, Insightful)
The LTS would include critical security fixes. It wouldn't include all minor security fixes or general architectural improvements that improve security-in-depth, because typically those have visible effects and the whole point of the LTS is to avoid such effects. Or put another way, "does not make changes to the Web or Firefox Add-ons platform" excludes a wide range of security improvements.
To be more specific, fixing an exploitable crash is LTS material. Adding JIT hardening or process separation or something like HTTP Strict Transport security or UI changes to improve the ability of users to make informed security decisions are all not LTS material.
Re:Good (Score:4)
You've got to draw the line somewhere though. I would be very nervous to have a bunch of untested updates running around on my network, especially if my job/performance review/bonus depended on the quality of someone elses' untested code.
I'm not especially keen to answer my boss about a security exploit in a new feature that ruined the company by saying "yeah we just let it update itself, i don't really get involved in all that. it seems to work ok most of the time, I'm sure we'll catch it in time NEXT time". At least in the real world if something happens you can fall back on "we're using the secure version that we've tested against known exploits; this new exploit was out of our hands. Since we're familiar with the software we have, we were able to reduce the damage by X".
Re:Good (Score:4)
Oh, I understand perfectly why a managed deployment environment might want an LTS release, both to ease deployment and for the practical "well, we tested it against the things we knew about" bit.
My point was that not updating your browser for 2 years right now will leave you with a browser that's considered hopelessly insecure by the standards of the day (not preventing entire new classes of attacks, etc), even if you patch actual exploitable security holes that come up.
Re: (Score:3)
I like Firefox, but all the constant short freezes are really aggravating. Despite what the trolls say, Firefox doesn't use that much RAM on a typical desktop and is reasonably quick, but those regular freezes are really annoying and ought to be something that they can be fixed, those weren't a problem before Mozilla switched to this asinine release schedule.
I honestly have no idea whether it's just a coincidence or there's a causal relationship, but it is really annoying.
Re:Good (Score:4, Informative)
Re: (Score:2)
It might take institutions 2-3 months to decide it's worth upgrading to.
They will continue to offer security patches for the old ESR 3 months after the new ESR is released. That is enough time to test and deploy the release. It isn't enough time to wait for third party web apps to fix their shit, but based on how long it took them to fix their IE6-dependent shit, no length of support will be long enough for them.
Think of it - the many 4 year undergrad students (perhaps the less technically inclined student) would only have to experience one change in the web browser in their college career in school computer labs, etc.
Actually more than half of students are running chrome or firefox, and upgrading frequently, even the less technically inclined.
By changing this yearly, you're just adding another thing to the pile of the "annual make sure it all works together without crashing checklist".
All the universities I have attended hav
Re: (Score:2)
Agreed
According to the actual proposal they plan to support them for 54 weeks with an overlap of 12 weeks.
That is very little overlap between releases in which to plan your upgrade policy and since the changes won't come at any particular time of year it will be difficult to tie it in with other upgrades.
Re: (Score:2)
It might take institutions 2-3 months to decide it's worth upgrading to.
2-3 months? Try 2-3 years, if you let them. I remember back in 2009, when there was a huge campaign to kill IE6 here in Norway, like a majority of the news sites in the country including all the top ones, government sites, our version of eBay and such had banners saying you're using an outdated browser, upgrade now. It just became one big flash mob, it even hit slashdot [slashdot.org]. Now IE7 was released in 2006 so this had been coming for years. But at a client of mine I talked to a guy in IT and he was embarrassed to
Re: (Score:2)
Re: (Score:2)
Enterprise customers who aren't ACs may think differently as later posts indicate....
Re: (Score:2)
You know, that campaign would probably work better if you logged in.
Just sayin'
Enterprises Will Like This! (Score:4, Insightful)
Now if there was only a way to control/deploy this through group policy, then Firefox in the Enterprise will really take off.
-th3r3isnospoon
Re:Enterprises Will Like This! (Score:4, Funny)
Re:Enterprises Will Like This! (Score:4, Interesting)
Not only this, but mozilla officially stated in their blog that they will actively work to prevent people from getting ESR version, so only the corporations have access to it "because it shouldn't be the fix for add-on breaking problem".
Basically, "you will have the problems we shove down your throats and you will like them", once again.
Re:Enterprises Will Like This! (Score:5, Informative)
Re:Enterprises Will Like This! (Score:4, Interesting)
Re:Enterprises Will Like This! (Score:4, Insightful)
There's no commercial gain in so doing, it's built anyway -- so people may as well use it, it won't affect support particularly -- just move questions perhaps. So where is the harm in giving people freedom of choice? Is freedom of choice not intrinsic in the philosophy of open source software?
I suspect the only reason for limiting the ESR version is vanity and arrogance. FF's arrogant developers know fine well that the ESR version would quickly become the default version of FF out there. It is exactly what everyone wants, a stable version of the software without new, worthless, feature-bloat ever two weeks.
FF developers, why not just have balls to admit you fucked up? Give people a free choice between ESR or the rapid-deployment constant-flux FF versions. See which people prefer -- and then run with that, and concentrate more on that version.
Really, what is the fucking point on forcing your idiotic ideas on users who really want something else? That's why you are too cowardly to make ESR freely available. And we know it.
Re:Enterprises Will Like This! (Score:4, Insightful)
The reason for limiting the ESR version as much as they propose is almost certainly resource (people) limitations.
By the way, insults to the actual developers who work on code for software that you evidently like (or presumably you just wouldn't care about this issue), only discourage those developers from being interested in your opinion.
Re: (Score:3)
Re:Enterprises Will Like This! (Score:4, Insightful)
a chrome ripoff
That. I wish I could buy a billboard in front of wherever Mozilla's people work and put up:
If we wanted Chrome, we'd use Chrome. Bring back Firefox.
Sincerely,
Everyone who used Firefox before the versions numbers went haywire
in MASSIVE text as a daily reminder of the old glory days.
Seriously, I shouldn't have to rearrange and twiddle with everything to get Firefox as much like 3.6 as possible every time I install it. What true UI improvements have we had since then? I can think of two: tabs that don't resize while I'm hovering on them, and tab groups. Why was the rest of it randomized?
Also, what's with the stupid launch defaults? I close Firefox when I want a clean slate, not a glorified minimize. "Restore my windows and tabs from last time" is antithetical to the whole idea of closing all the tabs! Can you imagine if Windows restored all your programs and junk from last time? People would come unglued.
Also, we live in an age of large LCD displays. I can spare a few pixels of screen space to keep the bookmarks and buttons I use all day long visible instead of burying them somewhere underneath gloss and shiny.
One last gripe: Tools > Add-ons should take me to Extensions, not the "Wonderful World of Stuff You Could Bloat Your Firefox With." I go to Add-ons to remove extensions other programs installed without asking far more often than I feel the urge to add bloviated toolbars. Speaking of which, can we finally make Firefox ask before allowing programs (like nearly every AV, Skype, whatever) to hang their useless (or worse, Google-search-invading) lampshade in Extensions?
Re: (Score:3, Informative)
Also, what's with the stupid launch defaults? I close Firefox when I want a clean slate, not a glorified minimize. "Restore my windows and tabs from last time" is antithetical to the whole idea of closing all the tabs!
I've just spent 5 hours experimenting with customizing the installer for a company deployment and so I've repeatedly uninstalled and reinstalled Firefox, deleting %appdata%\Mozilla each time. Every time I started it up, it would open about:home and nothing else. It puts a button at the bottom of that screen to restore your last session, but that's it.
Also, we live in an age of large LCD displays. I can spare a few pixels of screen space to keep the bookmarks and buttons I use all day long visible instead of burying them somewhere underneath gloss and shiny.
The bookmarks toolbar? Click the Bookmarks button and check View Bookmarks Toolbar. In the time you took to whine about it, you could have turned it on and off
Re: (Score:2)
The reason for limiting the ESR version as much as they propose is almost certainly resource (people) limitations.
That makes absolutely no sense. Are you seriously suggesting the readiness of the software will depend on limiting how many people use it?
Either the software is usable or it's not. The code has no way of knowing how many people are using it.
Re: (Score:3)
Moz' approach to product improvement is like clearing a minefield. Not by careful detection and painstaking removal. By herding livestock through the field.
Giving sheep the option of staying in fields which have already been cleared of mines is counterproductive.
Re: (Score:2)
The problem with it is that it has little to do with the actual programmers and everything to do with the dumbasses that are running the project. The changes seems to be having adverse effects and rather than recognizing it and doing something about it, they're continue to chase version numbers without understanding why they're getting blowback.
Re: (Score:2)
Out of curiosity, on what bizarre system do you have ETB mapped to the BS/DEL-like action?
Re: (Score:3)
Re:Enterprises Will Like This! (Score:5, Informative)
FrontMotion Firefox Community Edition [frontmotion.com] has a MSI version that can be pushed out via GPO and also has adm/admx templates available.
Re:Enterprises Will Like This! (Score:5, Informative)
Now if there was only a way to control/deploy this through group policy, then Firefox in the Enterprise will really take off.
Run "Firefox Setup.exe -ms" to do a silent install or if you must have a .msi, download it from these guys [frontmotion.com]
Re: (Score:3)
This will be good news for everyone who just wants to browse the web and doesn't need their browser to change every other week. In other words, just about everyone. I expect most users will be on ESR before long.
Re: (Score:2)
This would be somewhat bad, because the ESR will almost certainly be less secure than regular releases. It'll get fixes for critical security bugs, but will _not_ get architecture changes designed to improve security in depth, pretty much by definition.
Re: (Score:3)
> but will _not_ get architecture changes
I wish they would not change the architecture ever 5 weeks...
This. Isn't "architecture" supposed to be something you do once, do right, and then leave the heck alone? If it was supposed to change rapidly, it'd be "fashion". And your architecture should have been designed to accommodate extensions (not fundamental rewrites) from the beginning. If you have to rebuild your foundations every six weeks in a way that breaks existing stuff, that's an admission that you got the design totally wrong.
No, don't say "but we have no way of testing whether our fundamental underlyi
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Even Microsoft said they will create a new version of IE every year soon.
Re: (Score:3)
Re: (Score:3)
No, the problem is developing mission critical apps tied to a single Firefox version (or to Firefox, period). Supporting older FF versions is just putting make-up on the pig.
Re: (Score:2)
Re:Enterprises Will Like This! (Score:5, Funny)
Re: (Score:3)
Re:Enterprises Will Like This! (Score:4, Informative)
Uh, Chrome's even worse than Firefox when it comes to forced upgrades...
Who is paying? (Score:2, Insightful)
Who is paying for Mozilla products?
Do they have any paying customers in Europe or Asia?
Re: (Score:2)
meaning Mozilla will try to get a larger userbase for firefox, so that the next round it needs more money, It can ask for more money from bing/google/yahoo or whoever is willing to pay for the defualt browser spot for firefox.
so do they have paying customors outside north america? no, it doesn't matter, its the market firefox is trying to expand into to get money later
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No. Firefox is, at least for now.
Search engine companies frequently bid on being the default search provider for a browser, with the exception of IE and Chrome which, as they are made by companies that also make search engines, don't offer themselves up to the competition.
If a browser has higher market share, they can get more money from the search engines, because they're worth more.
Re: (Score:2)
Yes, of course, but he said:
In fact, all browsers that have a significant market share are paid by google.
IE certainly has significant market share, and isn't being financed by Google.
ESR? (Score:5, Funny)
I'm going to keep reading this as the Eric S. Raymond release.
Not long enough (Score:2, Interesting)
Once per year is still too quick, IMHO. In my experience, 2-4 years (or more!) would better fit enterprise expectations.
Re: (Score:2)
Re: (Score:2)
Microsoft said they will also move to one release per year.
Re: (Score:2)
Re: (Score:2)
"Once per year is still too quick, IMHO. In my experience, 2-4 years (or more!) would better fit enterprise expectations."
It's a gesture to quiet grumbling on sites like this. It's obviously not intended to work.
Re: (Score:2)
The real problem is the dependency management the customers have to do.
A longer release cycle will provide organizations more time to build up dependencies on the existing software. If support increases from 1 year to 2 years, that means organizations will build up two years worth of problems. When they finally are forced to upgrade, it will be more than twice as painful.
For example, let's assume that an average of three packages need to be upgraded for each year that passes. If they sat on the same rele
Did they fire Asa? (Score:5, Insightful)
This is still reactive damage control to foolish arrogance by Asa "we don't give a crap about enterprises" Dotzler.
That's what you get why you hire a fanboy to become the voice of your company.
Re:Did they fire Asa? (Score:5, Informative)
Re: (Score:2)
This is still reactive damage control to foolish arrogance by Asa "we don't give a crap about enterprises" Dotzler. That's what you get why you hire a fanboy to become the voice of your company.
Indeed. Let me provide a link [zdnet.co.uk] to go with your insight.
By the way is the about box still showing the version number [mozillazine.org]?, I'm still on 3.6.
Re: (Score:2)
Yes it is. It also still falsely tells you it's up to date if it can't check: https://bugzilla.mozilla.org/show_bug.cgi?id=679742 [mozilla.org]
Re: (Score:2)
Why 3.6, by the way? The current version (9, I think) is faster, uses less memory, and ...
The last I used was 8 or 7. I was tempted to try it because of the promised dramatic reduction in memory use. I didn't find any reduction, plus I found some pages scrolled with lots of lag (I persisted for two or three weeks but it was just too painful). I tried version 4 too, along with many betas and release candidates - I used to monitor the latest alphas, betas and release candidates but I quit that when they started putting out betas for general release.
Hope they are serious (Score:3)
I just hope they are actually serious about this extended support version. Their other "enterprise" efforts in the past have mostly just been talk.
And then there is still the problem that even if you, the company, are now on the new long term supported version, the beta testers^h^h^h^h^h^h^h^h^h^h^h^h general public will be on newer versions that potentially may do things differently. If your corporate application is also public facing then you still have a problem.
Personally I would encourage regular users to stick with the long term supported version as well.
Re:Hope they are serious (Score:4, Insightful)
Then you would be hurting those regular users, since the ESR will almost certainly be less secure than the regular version; the longer into its year of life you get the more this will be true.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
GP Integration? (Score:2)
Supported Lifetime? (Score:2)
I would suggest that 30 months be the minimum support window: two full years since release plus some overlap time between release N being available and version N-2 dropping off security patch support. Like to Ubuntu's LTS
Comment removed (Score:5, Interesting)
Re: (Score:2)
Don't believe your abuser (Score:2)
Re: (Score:2)
Re: (Score:2)
Are there really that many enterprises using Firefox? In recent times Firefox has become ALMOST as bad of a security risk of Internet Explorer.
Firefox seems more focused on adding features (and new versions) rather than fixing bugs.
http://www.computerworld.com/s/article/9140582/Firefox_flaws_account_for_44_of_all_browser_bugs [computerworld.com].
Re: (Score:2)
Are there really that many enterprises using Firefox?
No, because there isn't currently a LTS version.
Re: (Score:2)
Can you point us to a report that backs that up or we're just supposed to believe an Anonymous Coward? ;)
And even if there were "reports"... nothing is easier than to set up a small spiderweb of blogs referencing each other claiming whatever you want in whatever "flowery" and buzzword-laden language you want.
Heck, he web is full of reports that claim that horde-blinkers are good for websites or other such nonsense.
Re: (Score:2)
Re: (Score:2)
Why don't you just uncheck the box that says "Permanently store this exception"?
Re: (Score:2)
Why don't you import the keys used for signing into Firefox? That should take care of it.
Re: (Score:2)
In fact is even worse than importing thousands of keys to FF, this used to work "just fine" with the oldish firefox (6 months?). Now it's MUCH worse, sometimes the certificates get regenerated (I'm not sure if it's when you reconfig the box or when you lose power or if it's only limited to really old hardware). I don't have the box in front of me but it's a known issue.
Anyway what happens is that you can't "add exception", "get certificate", etc. The workaround is just to remove all certificates AND then ad
Re: (Score:2)
I haven't verified this, but I found this tip online:
Go to Tools > Options > Advanced > Encryption Tab
Click the "Validation" button, and uncheck the checkbox for checking validity
Re: (Score:2)
How would I get the key that's used for signing for the https page for an HP ILO?
Presumably from HP.
Re: (Score:2)
So, as I say, I'll have a version of Firefox that doesn't care about SSL problems.
Or next time you can choose ILO systems from a vendor that implements TLS properly.
Re: (Score:3)
Just use sslstrip [thoughtcrime.org] locally as a proxy; as the name says, it'll strip the SSL from the connection (while leaving it encrypted from the ssltrip software to the server), so Firefox and Java will only see unencrypted HTTP.
Don't forget to disable the proxy (there are nice addons for 1-click toggling) before browsing the big bad web.
Now, can I have my fifty? Oh wait, Paypal. Thanks, but no thanks.
Re:Oh good. ANOTHER browser to support. (Score:5, Informative)
1. It is only one version to support and you can run it next to the latest version of Firefox. I would think this is a good thing if it keeps the people that do not what all those changes on the same older version instead of, some users on 6, some users on 7, some users on 8.
2. What you are looking for is called the "Add-on Compatibility Reporter":
https://addons.mozilla.org/en-US/firefox/addon/add-on-compatibility-reporter/ [mozilla.org]
It was obviously meant for a different purpose, so with that name it makes it kind of hard to find.
Re:Oh good. ANOTHER browser to support. (Score:4, Informative)
Re: (Score:2)
> Shouldn't Firefox instead concentrate on not
> invalidating Addons for EVERYONE?
That change is in Firefox 10, shipping in less than 3 weeks.
But "enterprises" (which includes schools and libraries, not just corporations) care about things other than extensions; they have all these intranet apps to worry about too, which normal users do not have to deal with. And intranet apps have a tendency to be coded like it's 1999 (heavy dependence on browser bugs and nonstandard features, targeting only one brow
Re: (Score:2)
Version 10 no longer invalidates addons.
Version 12 (I believe) will do silent updates.
Re: (Score:2)
That's all fine and dandy, unless of course you are living in reality.
One of the chief reasons IE6 persisted so long is the extreme prevalence of amazingly terrible “wow, we pay what for this” web apps at the heart of so many businesses. Fixing the problem of constant major browser versions is a lot simpler than fixing the "we'll take the cheapest option you have" business mentality problem.
Re: (Score:2)
Long term is relative... When there are browsers out there with support for 10 years, this still seems very short sighted.
I'm sure you'd agree that the 11-year (so far!) support cycle for IE6 has been a boon to consumers and web developers; Mozilla is indeed short-sighted not to want to replicate that rousing success!
Re: (Score:2)
I stopped recommending it long ago. I recommend Chrome instead.
Reasons do not exist to run FF without add-ons.
Add-ons are its only virtue, and competitors would do well to note that.
Offer a STABLE browser with many add-ons which duplicate the functionality of those for Firefox, and users can move away and not look back.
Re: (Score:2)
Re: (Score:2)
You have to admit it's a pain to edit a dozen XPIs every time there's a new release. And I'm still not sure why they felt addons need to be tied to "application version numbers" instead of "interface IDs." That's a 20 year old lesson completely wasted on them.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)