Hacker News new | ask | show | jobs
by jillesvangurp 885 days ago
In case of security fixes, you will stay unpatched for a bit less time. ESR is intended for places that really don't like any form of change like rigid enterprises and banks and such. End users should probably steer clear of that unless they have a good reason not to; which they generally don't. Except for a false sense of security.

I personally don't see a good reason to opt out of security changes for any longer than strictly necessary and that's exactly what you do when using ESR. First they get backported by Mozilla. That's after normal users receive them. This takes time. Then testing takes place because they don't want to push out a hasty fix for ESR. This takes more time. And then third party packagers need to pick up the changes and repackage (which is mostly pointless and adds more time). And then eventually it rolls out days/weeks/months after normal users have long received the patches. I don't seen any good reason for such lengthy delays for normal users. In some big companies where they manually review updates for workstations it's a compromise between the extra work and stability. But the tradeoff is timely access to security fixes; which ESR simply doesn't provide.

3 comments

End users also have plenty of reason to dislike change. Change tends to mean things like exciting new spying and UI regressions. Meanwhile, security concerns are often overblown. If you're just using your browser for e.g. email, news, facebook, youtube, netflix, amazon, and your bank, and not venturing out into the seedier parts of the web, you're probably at ~0% risk of some RCE exploit. In any case, an adblocker is probably better protection than auto-updates.
Yep. vaapi was crashing on several builds in a row on a popos machine, till it magically stopped doing that 2 weeks ago. ESR though, worked just fine.
Change tends to mean things like exciting new spying and UI regressions

Or missing out on new anti-fingerprinting and anti-tracking improvements. Note that adblockers don't generally do the former.

I used the ESR version for a while because it was still deb packaged rather than a snap pack and the snap firewalling blocked a plugin I used that had to talk to another program. Unfortunately the ESR version has also moved to snap. So I am glad to here Mozilla team is moving to make a native deb package available.
I don't see a problem waiting for alpha- and beta-testing to finish first before the new code is distributed to actual normal users.

Note, the "normal users" you describe are involuntary testers who got forced into the role because keeping testers on the payroll is so last century.

The voluntary testers are the Firefox Nightly and Firefox Beta users, not the Firefox stable users.
I've been using the beta channel for ages. Never has been a problem for me. The stable channel is stable as advertised. It's rock solid. ESR is not so much about adding even more stability and more about just guaranteeing long periods without any changes whatsoever in order to cut down on testing cost that big IT departments have for any kind of change.

Insisting on an ESR release on what is effectively a poorly supported type of operating system where every install is basically a snow flake that heavily relies on it's users being able to fix all sorts of weird issues (i.e. every Desktop Linux distribution ever) is a bit weird and overly selective.

I said involuntary testers. The guys who sign up for the nightlies and beta know full well what they signed up for, but not the involuntary testers aka "normal users".
Your premise is flawed. The testers are the Nightly and Beta users, not the stable users.