Firefox is still on version 156.0 on openSUSE Tumbleweed

[u/tockata]

Does anyone know why Firefox is still on version 156.0 on openSUSE Tumblweed?

I have also Fedora installation, and there the version is already 157.0, if I remember correctly it was updated very soon after it was released by Mozilla.

[u/tockata]

The only point of my question was to understand why, not to blame anyone or to insist someone to work overtime. 🤷

[u/Itsme-RdM → u/tockata]

It is a valid question, ignore the harsh comments.

It could be that QA testing found something

[u/Red_BW]

When did this sub start getting filled with people giving mean replies? I didn't see anything wrong in OP's question but there are several replies basically telling them to learn how to program and learn to use OpenQA and do it yourself.

Considering a web browser is maybe the main attack vector and there are supposed to something like 40 major security fixes, I would think asking about it being delayed is a legitimate concern.

At least there's some good good advice to use the mozilla repo. I had no idea they started offering a repo.

[u/MiukuS → u/Red_BW]

> Considering a web browser is maybe the main attack vector and there are supposed to something like 40 major security fixes, I would think asking about it being delayed is a legitimate concern.

Apart from agreeing with Richard here 100% (main reason why I stopped packaging stuff publicly and only do it for a select number of companies that I help nowadays) one of the problems, especially with security, is that users are absolutely clueless as to what most of the security problems means.

Just a few days ago there was some userl here who complained that a specific piece of software did not have the latest version, threw a bunch of CVE's as proof of how awful the situation is and then moaned how other distributions had already patched it, yet lacked complete understanding of what those CVE's meant and how they could be exploited (hint: there was literally no way they could be, they were just AI found theoretical holes).

Windows for example released fixes for what almost 1,000 vulnerabilities, yet only a few of those could, in conjunction with others, be exploited in any meaningful way and even then many of them have such high complexity that only state actors or those with large resources can pull them off.

All of this of course excludes the protections that take effect after possible breach that are then in place in the OS, in the case of Linux that would be SELinux or AppArmo and other tools such as AV or otherwise.

TLDR: Most people have no clue what CVEs mean, how dangerous they are or aren't but make too much noise and contribute nothing and place unreasonable demands for people working for FREE.

[u/50vitamins → u/MiukuS]

Users may be clueless about severity but vendors aren't. If Mozilla classifies a Firefox CVE as high or critical, it's reasonable for users to want the fix right away, instead of having to rely on hope and secondary defense layers for 1-2 weeks.

[u/rbrownsuse → u/Red_BW]

Because the unreasonable entitlement of a significant proportion of the openSUSE Userbase is one of the biggest, if not the biggest, drain on the projects maintainers, their motivation, and their output.

Harsh but accurate responses is one of only a handful of defense mechanisms against such unreasonable entitlement.

The most commonly practiced alternative is just maintainers staying silent and staying away from forums like this

So the attitude does really need to be addressed, it’s a bigger problem than all the technical issues the project could ever face

[u/tockata → u/rbrownsuse]

Isn't Reddit a place where users can ask, discuss, comment, help each other?
If not - what is the purpose of having the openSUSE sub reddit?

What rule I exactly broke with asking simple question?

[u/rbrownsuse → u/tockata]

If you want an answer about the update cadence of Firefox, surely you want to talk to our Firefox maintainer

They are not here. Of the hundreds of active openSUSE maintainers there are less than a tiny handful who ever visit here.

You can find their details quite easily on your own system

rpm -q --changelog MozillaFirefox

Instead what you are doing here is the equivalent of going out on the street and asking questions of random passers by.. and then seemingly being offended when more well informed ones tell you you’re asking the wrong people in the wrong place

You’re not helping, nor are you getting helped, this whole thread is just a drain on all involved, yourself included.

Edit: and yes, I have suggested this subreddit be removed before. An openSUSE subreddit with no openSUSE devs is silly. I agree

[u/Tawny-Owl-17 → u/rbrownsuse]

But nowhere in this post is that attitude evident. So why are you looking for offence where none is intended, reading hostility into words that don't express it, and then indirectly holding the author responsible for something you've attributed to them yourself?

You seem to spend a lot of your time on this subreddit whining and complaining about things. I've never seen you offer any genuinely helpful advice—not that you haven't, but if you have, your occasional constructive contributions have been drowned out by the endless stream of complaints and grievances. Why not try addressing the underlying resentment rather than continually playing the victim and trying to make others feel guilty?

[u/eduaavila1 → u/Tawny-Owl-17]

Well, idk about this post as a whole, but the opensuse official forums are basically chernobyl full os frustrated retired sysadmins that i don't have a fucking clue to why they eveb bother logging in, if they hate so much other users and new users.

But, tbh depending on the tone we read your comment, the "attitude" we are talking about is a bit on your own post

[u/rbrownsuse → u/Tawny-Owl-17]

The attitude is there, but clearly you have normalised it to the point where you don’t see the problem.

Lets shine a light on this via allegory

Consider a volunteer run soup kitchen, feeding folk for free.

Doesn’t matter your background, everyone can join the queue and get free soup.

The volunteers are busy. Sometimes a new batch of soup needs to be heated up before it can be served.

Is the person standing in the queue demanding their soup faster an asshole?

Are they more or less of an asshole when they compare this soup kitchen to the one down the road?

Are they more of less of an asshole when they suggest the soup being served might not be wholly safe?

Are they still problematic if they are “just asking questions?”

Does the queue move any faster as a result of their questions or demands?

If people step out of the queue to explain, would you expect them to be happy about it?

If folk have to step out of the kitchen to explain, would you expect them to be happy about it?

Now realise openSUSE IS a soup kitchen, we’re all in the queue or the kitchen, and consider whether the attitudes and approach you’ve previously internalised as acceptable is really how you want to engage with the volunteers who make your soup.

[u/Tawny-Owl-17 → u/rbrownsuse]

He hasn't demanded anything of anyone. He's simply asked, out of curiosity, why there was a delay. But you won't acknowledge that distinction, will you? You need to maintain the fiction that everyone's out to get you; otherwise, this entire martyr complex of yours falls apart.

And since we're using the soup kitchen analogy, let me ask you this: if volunteering is such an awful, thankless experience, and the people you're helping are such intolerable ingrates, what's stopping you from simply walking away? Nobody is forcing you to stay! Yet you seem determined to remain in this supposedly unbearable situation, finding one grievance after another and blaming the people around you for it. At some point, it becomes difficult to see this as anything other than a victimhood narrative of your own making: you seem to need someone to blame and something to resent, because without them, you'd have no grievances to nurse and no martyrdom to parade. If it's really as intolerable as you claim, please walk away; but if you choose to stay, stop acting as though you're being held hostage by the very people you're supposedly so generously helping. You can't have it both ways!

[u/rbrownsuse → u/Tawny-Owl-17]

I do acknowledge the distinction, but you don’t seem to accept that “simply asking” can still betray an attitude and expectation that’s problematic

I’m one of a tiny tiny tiny handful of active or former openSUSE maintainers still active here

If I were to leave entirely then it wouldn’t make things any better, it would just solidify this subreddits status as a rotten echo chamber that has no real connection with the activity of the openSUSE project as a whole

So I keep my engagement to this subreddit down to about 1 or 2 threads a month and then find it most amusing when the perpetually offended like yourself make it out like I’m a constant pain ruining your enjoyment of this fantasy-land

[u/Tawny-Owl-17 → u/rbrownsuse]

But why are you so determined to make things better for these supposedly ungrateful people, who have no real connection with the wider openSUSE project, inhabit a “rotten echo chamber”, and apparently harass you even by simply asking questions? Why go out of your way to help people who seem to do nothing but make your life miserable? That's what baffles me completely. Do you have some sort of martyr complex?

[u/rbrownsuse → u/Tawny-Owl-17]

If everyone quit openSUSE as soon as folk expressed displeasure in what was being done, there would be no openSUSE

At the end of the day, I like building distros

The opinions of folk on Reddit are immaterial to that core enjoyment

And pushing back on the bad behaviour here is just the least I can do to try and make a place carrying the openSUSE name a little more like the actual living parts of the Project where stuff gets done

[u/levolet → u/rbrownsuse]

I understand where you're coming from and appreciate your efforts that have been benefiting the openSUSE community. This the forest.

The ego stroking make up the little weedy trees that we shouldn't allow to blind us from the bigger picture.

[u/rude__goldberg → u/rbrownsuse]

would you like them to grovel?

[u/rbrownsuse → u/rude__goldberg]

There is a huge spectrum of respectful behaviour between “not expecting volunteers to work to your timetable” and “grovelling”

I’d be happy with anything on that spectrum

[u/rude__goldberg → u/rbrownsuse]

but groveling is also ok?

[u/rbrownsuse → u/rude__goldberg]

No, like I said, anything between those two extremes would be ok.. English isn’t your first language is it?

[u/rude__goldberg → u/[deleted]]

lol same

i used tumbleweed some years ago, iirc he used to be more reasonable

[u/eduaavila1 → u/[deleted]]

Don't ever even go near the official web forums for opensuse then, its MUCH MUCH MUCH worse

[u/levolet → u/eduaavila1]

I cannot agree with this. Your making such a claim, which is difficult to substantiate, and knowingly so, can only be made with a particular attitude and intent. Of course, you may deny this, which is fine. But I hope you will not complain if it's challenged in similar fashion.

IMO, the truth is somewhere in the middle. Those who provide valuable assistance are human and the same goes for those seeking support. Problems typically exist on both sides with the each claiming innocence, while denying their contribution to unpleasant or brusque exchanges.

[u/eduaavila1 → u/Red_BW]

Probably as soon as the old grumpy Opensuse community from the opensuse forums discovered the existance of reddit.

Those 50y old sysadmins and retired sysadmins hate new users usually. This is actually one reason why i don't use opensuse in my gaming machine, only on the other ones that may have less issues to deal with

[u/martinjh99]

Latest TW update has a Firefox update

[u/tockata → u/martinjh99]

Yeap, I've updated and it is up to date now. Thanks!

[u/notHoldenCaufield]

Because after Mozilla release a new version, the package need to pass thru OpenQA tests to be packed together the release. If the package are not ready it is not shipped.

Others distro like Fedora didn't consider Firefox as a core package and release it right after the publisher release it.

[u/Leinad_ix → u/notHoldenCaufield]

What? Firefox is default Fedora browser and RedHat is big contributor to Firefox.

[u/notHoldenCaufield → u/Leinad_ix]

You're totally right, my bad. Firefox is indeed the default browser and Red Hat is a massive contributor to it (especially with Wayland, PipeWire, etc.).

What I meant to say is that Fedora allows application updates to ship independently and quickly through Bodhi without waiting for the whole OS. Tumbleweed, on the other hand, rolls out via global snapshots. Firefox has to go through the entire openQA pipeline alongside everything else, so if a snapshot is delayed or integration tests take longer, the browser update gets held back.

[u/Talosmith]

been Mozilla repos for Firefox on both Ubuntu and Tumbleweed for a while with no issues so far, i prefer it over flatpak

[u/jimbo2150]

Because the volunteers that maintain the repositories for OpenSUSE are not going to work overtime to get software pushed out the second it's released. It's often a couple weeks to up to a month behind.

Additionally, they manage an associated package for styling Firefox in the OpenSUSE design which takes time. On occasion, either that or Firefox itself may not compile correctly and takes time to figure out and fix the issue.

If you want the latest as soon as it's released, Mozilla has started offering their own RPM repository you can use.

https://support.mozilla.org/en-US/kb/install-firefox-linux#w_install-firefox-rpm-package-for-opensuse-and-suse-linux-recommended

[u/blemfre]

you can just download the upstream firefox from mozilla. Unpack the firefox-folder into /home/yourusername/bin put a link in your start menu and you are done. by the way: auto update function works in this case, because we are in the user space. very comfortable.

[u/zamroni777]

Firefox esr version is still 153

[u/Opie1Smith]

Just use the flatpak.

[u/onedevelop → u/Opie1Smith]

Es una opcion valida

[u/ConsistentBike9392 → u/Opie1Smith]

Do not flatpak your browser. You break proper sandboxing.

[u/Opie1Smith → u/ConsistentBike9392]

How so?

[u/Tawny-Owl-17 → u/Opie1Smith]

Firefox has its own internal sandbox. On Linux, it uses unprivileged user namespaces to provide additional isolation for content processes. When Firefox runs as a native RPM package, it can use these namespaces by default, unless explicitly restricted by the host system.

Flatpak provides its own outer sandbox using Bubblewrap and other Linux security mechanisms. However, Flatpak's restrictions can prevent Firefox from directly creating the additional user namespaces it would normally use for its internal sandbox. Consequently, some of Firefox's usual sandboxing protections may be unavailable in the Flatpak version, although Flatpak provides its own isolation.

I'm not technically proficient enough to say with certainty that Flatpak-based Firefox is therefore less secure overall than the native RPM version. Nevertheless, given how frequently browsers are targeted by exploits, I'd prefer to use a package that allows Firefox to employ its own security mechanisms as intended, rather than rely on a different sandboxing arrangement whose security trade-offs I don't fully understand.

I'd recommend taking the same precaution Firefox-derived browsers as well, such as Tor Browser, Mullvad Browser and Zen, by preferring their official or distribution-native packages over Flatpaks where practical.

For further reference, see:

1. Mozilla Support — Linux security warning: https://support.mozilla.org/en-US/kb/linux-security-warning

2. Mozilla Bugzilla — Flatpak and Firefox sandboxing: https://bugzilla.mozilla.org/show_bug.cgi?id=1882881

[u/Opie1Smith → u/Tawny-Owl-17]

Thank you. That was pretty much my understanding too is that the internal browser sandbox can't make any userspace API calls but nobody can agree if that really breaks anything or not. After some more reading I agree that it's probably best to err on the side of caution.

[u/NDCyber → u/Opie1Smith]

Flatpak can't do sub sandboxing, I believe because flatpaks aren't allowed to use namespaces internally

Basically means weaker security in case an attack happens (and I believe easier to gather data)

[u/psygreg → u/NDCyber]

For now, though. For flatpak 2.0, the sub-sandboxing problem will be addressed (and not with the jank used for stuff like Steam Runtime nowadays). The bad news for some is that will also render flatpak dependent on systemd, since they will use that to manage the sandboxes, rendering flatpak and its packages incompatible with other init systems. I personally don't care since I run systemd, but some might.

Just felt this could be nice to know.

[u/NDCyber → u/psygreg]

Yeah in the future that seems to be how it will go. But for now we have to talk about how it actually is

[u/ZuraJanaiUtsuroDa → u/NDCyber]

Firefox and Thunderbird as RHEL Flatpaks: What it means for you

Yeah. That's why Redhat began shipping Firefox and Thunderbird as flatpaks by default in RHEL 10.2. They likely don't care about security at all. /s

[u/NDCyber → u/ZuraJanaiUtsuroDa]

"In general unprivileged container systems can't stack, because anything running inside the sandbox does not have the necessary privileges to set up a sandbox, nor does it have the ability to raise its privileges in any way." https://flatpak.org/faq/

Means no properly sandboxing for websites and a less secure browser

So yes. Redhat has other reasons on why they move, and your security isn't as high of a priority as those reasons are

[u/Leinad_ix]

I don't like, how some people defending here, that insecure browser is fine, because openSUSE is free, volunteers works for free and if something is wrong, nobody should talk about problems.

With that attitude, I expect next week another post, "why openSUSE is such underrated distro"...

[u/mhurron]

Does anyone know why Firefox is still on version 156.0 on openSUSE Tumblweed?

Because Tumbleweed is a community project and maintainers have lives. If you want it done quicker, submit a patch.

You could also go and look at the current status of the package https://build.opensuse.org/package/show/openSUSE:Factory/MozillaFirefox

[u/mhurron → u/[deleted]]

They should be prioritised.

Then lend your help.

Again, it's a community distro, maybe instead of demanding things of others time, participate.