[dredmorbius]

From a UI/UX perspective, yes.

From a security perspective: hell fucking no. You need those updates.

Even if you're just doing plain-jane browsing, with no finance, commerce, professional, government, or personal interaction, you're putting your entire system at risk.

(TailsOS users possibly excepted.)

[elcapitan]

Then why can't I have separate security updates? I'm fed up with some fashion people breaking my software usability all the time, just because some hot new way to arrange tabs has to be tried out.

[dredmorbius]

You sometimes can, though you've got to know what to ask for, and what you're trading off.

FWIW, this is what platforms such as Debian attempt to provide. It's a challenge, and something of a losing battle, especially with complex and fast-moving tools, notably Web browsers, but also development toolkits (scripting languages, Web development environments, etc.). Debian stable attempts to provide a stable feature set + bugfixes for all packages. Increasingly, even on Stable, there is the option to install packages which continue to offer feature updates, including for web browsers. Though there is also the option of an LTS or ESR package install.

These are specified versions with extended bugfix / security support, typically called Long Term Support (LTS) or Extended Service Release (ESR) version of a package. You'll find these with the Linux Kernel, for example.

And yes, Mozilla has an ESR programme which "receives major updates on average every 42 weeks with minor updates such as crash fixes, security fixes and policy updates as needed, but at least every four weeks."

https://www.mozilla.org/en-US/firefox/enterprise/

Firefox ESR is currently at release 78.10.1:

https://www.mozilla.org/en-US/firefox/78.10.1/releasenotes/

I believe that's based on 78.0.1, first released in June, 2020: https://www.mozilla.org/en-US/firefox/78.0.1/releasenotes/

Firefox Desktop is at release 88.0.1, release May 5, 2021.

https://www.mozilla.org/en-US/firefox/88.0.1/releasenotes/

[Minor49er]

Theoretically, perhaps. But I'm not super worried about it. I only visit a handful of sites and have scripts and third-party resources blocked by default and have HTML5 features disabled. I have Firefox (and all of my browsers) sandboxed in my system.

Most of the important bug fixes from Firefox as of late have been in these areas that I have disabled, such as WebGL rendering, responsive design mode, 3D CSS, custom fonts [1], WebRTC [2], and so on.

[1] https://www.mozilla.org/en-US/security/advisories/mfsa2021-1... [2] https://www.mozilla.org/en-US/security/advisories/mfsa2021-1...

I'm more worried about some new feature introducing a security hole through one of these new features intended for modern browsing. Given the number of unfavorable changes that come with every release compared to the number of fixes, though, I'd rather just skip the auto updates for now. I only update when I (reasonably) know that nothing that I'm used to will be irreversibly broken/removed and when I have the time and patience to update my userChrome again to keep things as they are.

[corty]

Security fixes should be totally separate from UI and functionality chhanges. We need more software with long-term-supported stable releases.

Functionality and UI changes breed fear of updates which lessens security.

[dredmorbius]

In an ideal world, absolutely, I agree.

We're not there though.

And there are an number of bug categories (phishing, social engineering, etc.) which intersect on UI/UX.