Security advisory, update Firefox and Thunderbird

[Moderator Brian Masinick]

Helpful

Up

0

::

Yeah, I hope that our own repo and/or the MX Linux repos get a version with security updates. The alternative is to use the newest antiX release or download directly from Mozilla.

It’s not that difficult to get the Mozilla binary packages. Nevertheless if I can spare a few minutes I will attempt to write a simple script to install them.

If anyone wants to beat me to it, feel free to do that.

--
Brian Masinick

[Member sybok]

Helpful

Up

0

::

Hi, I am not sure if installation to root is needed and I prefer to run it as is.
What do you consider the (e.g. security) benefits to be?
Of course, the local file I use can be modified by some malicious code.
On the other hand, does one trust the downloaded binary more than the one installed via package installer?

I did run the unpacked binary from another local account on the desktop and it loaded the profile of that (another) account as expected.
You can simply
1) create an alias in BASH such as:
alias firefox='[ -f /path/to/binary/file ] && /path/to/binary/file --private-window 2>/dev/null || firefox-esr'
2) modify custom shortcuts in the same way
3) modify desktop icon by modifying its “target” (not quite sure how it is called since currently using fluxbox).

[Member ModdIt]

Helpful

Up

0

::

sybok wrote

On the other hand, does one trust the downloaded binary more than the one installed via package installer?

I would trust the downloads more if checksums were provided by mozilla, maybe they can be viewed by advanced users on alpha centauuri
I at least have not found any nearer..

Still waiting for the written in a few spare minutes download script from our most senior proffessional forum member, I am sure we can
all learn some finer points from his offer.

I also am unsure what makes more sense security wise, install a Firefox package to opt or run from home. @ present I leave ESR updates to
the distro. Have a cleaned up FF recent in home for a couple of special sites.

I now prefer LibreWolf.

• This reply was modified 7 months, 2 weeks ago by ModdIt.

[Member Robin]

Helpful

Up

0

::

Well, I did it this way:

— Downloaded the proper package for my architecture and language from mozilla site (see some postings above), checked the checksum.
— Extracted its content (using sudo) to ‘/opt/firefox-102.3.0esr’ system folder
— Sat the existing firefox-esr package in apt to hold: sudo apt-mark hold firefox-esr (to avoid later overwriting of menu entries and configuration by arbitrary installation of unwanted outdated packages; didn’t apt purge the old package in order to keep all settings and system integration)
— Added the alias in antiX Control Center → System → Alias for the x-www-browser entry to point to /opt/firefox-102.3.0esr/firefox, priority 100.
— Edited /usr/share/applications/firefox-esr file, line Exec= to point to /opt/firefox-102.3.0esr/firefox %u now.
— Ran sudo desktop-menu –write-out-global to apply the new menu setting.
— Created a backup copy of my existing ~/mozilla/firefox folder.

Then started the new firefox the first time. It comes up properly, identifying itself as version 102.3.0esr.
— Allowed to make itself the default system browser.
— Deny to import profiles (doesn’t work, need to do this manually later)
— Deny all its stupid questions you don’t like.
Once firefox was completely up, closed it.

In ~/mozilla/firefox are two files, “installs.ini” and “profiles.ini”
Open both of them, look for the new default, profile and install entries, and change the cryptic name of the new entries to the name of your existing profile folder. If I remember corectly you have to do it in three places. Twice in “profiles.ini” file and once in “installs.ini”. Save the files, close them and restart firefox. Btw, when running on an antiX Live system it is a good idea to move this profile folder to a place on your harddrive and add the path to the entries. This way you won’t ran out of RAM any longer when firefox tries to cache tons of stuff to its config folder within your home directory, which is in RAM when running on Live. Then you’ll have to set the value IsRelative= for this profile from 1 to 0 in the profiles.ini file. Really ini? Hey, this is pure windows style 😉 Ok, time to start this beast again.

This time it should come up with all your settings, bookmarks, history, stored passwords, even addons you had installed, etc. exactly as you have left your previous installation, even opening on startup the proper pages (if this was set before already).

BUT you will have still to check the settings (Menu edit → settings, all sections) anyway. Mozilla resets in this process your search engine if you dare not to use their beloved google, but e.g. startpage instead. They tell you even they won’t let you any longer… But that’s nonsense, just reset it in the settings to your favourite engine. This way check all settings and restore as needed, back to what you’ve had before. Most settings are kept properly, but some are not (e.g. search engine, search proposals, phone-home functionallity, automatic proposals for installation of addons).

I’m fine with this new version. Don’t see any disadvantages on this 32bit single-core 2GB RAM notebook. Seems to make even more efficiently use of the ressources, no need any longer to reduce the parallel threads of firefox to 1 as in the old version.

Now the question to the browser gurus here: Did I miss something, in this process, something which should urgently be done still?

Windows is like a submarine. Open a window and serious problems will start.

[Member Robin]

Helpful

Up

0

::

Btw, checksum files are right next to the downloads:
http://releases.mozilla.org/pub/firefox/releases/102.3.0esr/
Not that difficult to find.

Windows is like a submarine. Open a window and serious problems will start.

[Member ModdIt]

Helpful

Up

0

::

Hi Robin, user normalo, me too searches for download firefox which results in
offer at

https://www.mozilla.org/de/firefox/new/

or for en just changing lang code. No checksums offered.
From there you can follow links around the universe.
Same goes when selecting ESR.
Why, not displayed when user selects version and language to download.

I would say because Mozilla does not want users to check what they have been delivered
especialy with regard to the experimental features/hidden extensions which have at times
not been the same for all users or even in consecutive downloads of latest.

Moz is likely somewhat more careful with LTS but that is spekulation.

It makes sense to go to browser features folder and delete the hidden extensions you do
not use or need. We have a perfectly good non remotely executable screenshot tool, I always
delete that. Plenty in older threads is still valid too.
The less firefox does in the background the better it runs.

Not sure how much of the LibreWolf setup could be carried over to 32 Bit LTS. I moved a lot to
the 64 bit fox while figuring out how many of the no compile changes work.
I much prefer (actualy intensly dislike mozillas setup) the quiet unclutterred interface of LibreWolf,
got LTS to look and feel pretty much the same.

• This reply was modified 7 months, 2 weeks ago by ModdIt.

[Member blur13]

Helpful

Up

0

::

Good news, latest firefox-esr made it into buster. Guess the LTS is good for something.

apt-cache policy firefox-esr
firefox-esr:
Installed: 102.3.0esr-1~deb10u2
Candidate: 102.3.0esr-1~deb10u2
Version table:
*** 102.3.0esr-1~deb10u2 500
500 http://security.debian.org buster/updates/main amd64 Packages
100 /var/lib/dpkg/status
91.12.0esr-1~deb10u1 500
500 http://ftp.se.debian.org/debian buster/main amd64 Packages

[Member Robin]

Helpful

Up

0

::

Really good News, blur13, many thanks for this hint. I wouldn’t have believed this would ever come. But…
This time they actually didn’t forget the 32bit architecture on buster.

$ apt-cache policy firefox-esr
firefox-esr:
  Installiert: 78.15.0esr-1~deb10u1
  Installationskandidat: 102.3.0esr-1~deb10u2
  Versionstabelle:
 *** 102.3.0esr-1~deb10u2 500
        500 http://security.debian.org buster/updates/main i386 Packages
        100 /var/lib/dpkg/status
     78.15.0esr-1~deb10u1 500
        500 http://ftp.de.debian.org/debian buster/main i386 Packages

So I’ll revert the manual installation steps described above and install from the repos via apt instead.
All’s well that ends well.

Windows is like a submarine. Open a window and serious problems will start.

[Author]

Posts