No backport of Firefox 2.o to Dapper

[Myriam Schweingruber]

Binary package hint: firefox

Dapper being a LTS distribution, why are there no backports of Firefox 2.0 to Dapper yet? Security updates in Firefox 1.5 will cease at the end of this month. People get worried seriously about that!

[ricky_ds (ifa-2he9)]

From http://www.mozilla.org/news.html

Firefox 1.5.0.x will be maintained with security and stability updates until April 24, 2007. All users are strongly encouraged to upgrade to Firefox 2. Firefox 1.5.0.10 is available for download from http://www.mozilla.com/firefox/all-older.html.

[Freddy Martinez (freddymartinez9)]

Need to grab information from the team, I will address this at the next meeting. Feedback on this report will be back soon.

[Alexander Sack (asac)]

On Sun, Mar 04, 2007 at 07:36:31PM -0000, Myriam Schweingruber wrote:
> Public bug reported:
>
> Binary package hint: firefox
>
> Dapper being a LTS distribution, why are there no backports of Firefox
> 2.0 to Dapper yet? Security updates in Firefox 1.5 will cease at the end
> of this month. People get worried seriously about that!
>

Security support will go on. At least linux distributors will maintain
1.5 branch for some time.

 - Alexander

[Myriam Schweingruber (myriam)]

@Alexander: are you giving an official statement of Ubuntu here or is this just a guess?
Understand that people have Ubuntu 6.06 LTS installed on their computers and are somewhat puzzled if they learn that Firefox security updates _are_ discontinued on the Mozilla side. Unless there is some official statement about this issue from Ubuntu/Canonical, the issue is still up and serious enough. Long Term Support means several years, and we don't even have an explanation or statement of any kind from Ubuntu about Firefox in Dapper, _this_ is the bug.
So people, don't just suggest: "upgrade to version 2.0", plain users want to hear this from Ubuntu people.No comment or statement is just bad communication policy, IMHO.

[Daniel T Chen (crimsun)]

Alexander is the Ubuntu Firefox maintainer and a Canonical employee. His word is precisely as it reads.

[Myriam Schweingruber (myriam)]

Le Lundi, 5. Mars 2007, Daniel T Chen a écrit :
> Alexander is the Ubuntu Firefox maintainer and a Canonical employee. His
> word is precisely as it reads.

Thanks Daniel for clarifying, sorry for my sceptical reaction, but it was far
from clear from Alexanders email address what his position was with
Canonical :-/
Understand that for "outsiders" who are not into Launchpad and IRC everyday
it's simply not possible to know who is who. There is no list of that kind
and as everyone with a Launchpad account can post...

May I suggest some wiki or static web page stating that Canonical ensures
security updates of Firefox 1.5 during the whole Dapper LTS cycle that I
could hand out to "my" LTS "customers"?
I know I'm bothering but some clear communication would be really handy,
especially having naive users getting mad about security issues since I
showed them the amount of contamination of their former Windows
installations. Every other day someone drops a "Oh but Firefox 1.5 is not
supported anymore" somewhere and this ads a lot of confusion to freshly
converted minds :-)

--
Protect your freedom, join the Fellowship of FSFE!
http://www.fsfe.org
Please don't send me proprietary file formats,
use ISO standard ODF instead (ISO/IEC 26300)

[Colin Watson (cjwatson)]

Hi Myriam,

As Daniel said, Alexander is a reliable source with regard to Ubuntu's Firefox packaging. Alexander asked me (as his manager) to look into this bug. I recognise that it is useful to have a clear statement on the Ubuntu project's position on Firefox 1.5 support in Dapper. I've put together the following wiki page, which I believe accurately reflects our position and which I hope helps you:

  http://wiki.ubuntu.com/DapperFirefoxSupport

I noted to Alexander that, if and when Firefox 1.5 support from sources other than the Mozilla project (i.e. the group of Linux distributors he mentioned) appears to be waning, it would be prudent to begin preparation of Firefox 2.0 packages via dapper-backports. However, I expect it to be a good deal of work to get all the relevant packages updated and working properly, and Alexander has many other things to do, so I am not asking him to do this at this time (and thus this bug remains open). We'll certainly keep an eye on the situation.

[Spyros Theodoritsis (madmetal)]

well firefox 1.5 has been extended to the middle of May but still no backport for firefox 2.0 at dapper..
i know its difficult to do so but its crucial for most people and firefox is a programme most people use..
(i am not sure if its the proper way to highlight it...)

[Kilz (kilz)]

The lack of a backport is of major concern to amd64 users of Dapper. There is no way to easily replace the 64bit version of Firefox like there is with the 32bit version. I also think the statment that it is complex to get Firefox 2.0 running on Dapper to be a slight bit of an exageration. The 32bit binaries from mozilla of Firefox 2.0 can be ran from a folder on someones desktop without installing anything. Unfortunatly that cant be done with the 64bit version as mozilla dosent supply 64bit binaries, and replacing the 64bit browser with a 32bit one would cause a lot of problems.

[disabled.user (disabled.user-deactivatedaccount)]

Sorry, this may be a bit OT.

Some quick links to HOWTOs which should give some ideas how to integrate a vanilla 32 bit Firefox in Ubuntu 64 bit:

[1] http://doc.gwos.org/index.php/AMD64_Firefox32
[2] http://ubuntuforums.org/showthread.php?p=1174435

I roughly followed [1] when I added the vanilla 32 bit Firefox 1.5 to Breezy 64 bit, the upgrade to Dapper (quite some months ago...) and vanilla Firefox 2.0 worked flawlessly. And if someone just wants a working flash plugin in Firefox 64 bit, consider using nspluginwrapper:

[3] http://gwenole.beauchesne.info/projects/nspluginwrapper/
[4] http://packages.debian.org/cgi-bin/search_packages.pl?searchon=names&subword=1&version=all&release=all&keywords=nspluginwrapper

Since a package is provided from upstream (Debian Sid) [4], nspluginwrapper should be available in Gutsy 64 bit soon.

[Kilz (kilz)]

hk47,
I know its possible to install a 32bit Firefox on the amd64 version. I wrote one of the howto's you have linked to. But that doesnt solve some problems. One is that you cant print a page from the 32bit browser. Another is that in kde the browser doesnt use some of the themes. There are also other problems.
But you have linked to the solution, and the problem. The solution is nspluginwrapper. It has gotten better. But Firefox 1.5 64bit in Dapper is now at end of life. IMHO that is a major problem because the browser isnt being patched any more. Mozilla is strongly recommending everyone to upgrade.
You also mention that nspluginwrapper is going to be avilable in Gutsy 64 soon. Nspluginwrapper is now good enough that we might be able to stop using a hacked in 32bit browser. But just as its ready, the browser in Dapper becomes a problem.
Some people like myself relied on what was promised about Dapper. That it would get support untill 2009 on the desktop. This is a major test imho, a test of if we can trust what we were told. A test that Im sure other people are looking at, as Dapper was the first long term release. Will the developers and Canonical deliver on what was promised, or will they wait untill something blows up in their faces? Because if they do, they might lose a lot of creditability. Once you loose that, it can be hard to regain.
Believe me, if I could find a 64bit version that would work for dapper or could compile one on dapper I would have already made it available. But the 64bit binaries are not available from Mozilla. I have an error when trying to compile that wont go away and no one has answered the posts I have made about the compiling errors on the english forums.

[disabled.user (disabled.user-deactivatedaccount)]

I for my part would be happy if Firefox stayed at 1.5 in Dapper. Unfortunately, AFAIK there's no Plastikfox-theme available for Firefox 2, so I would lose my (cosmetical) KDE integration with an upgraded Firefox. Debian shows that it's possible to support an outdated Firefox securitywise; Firefox in Sarge is still at 1.0.4. But I'm quite sure that nobody begrudges Sarge's Firefox maintainers for their job, and Debian announced that they "cannot predict it today, but during the lifetime of etch the Debian Security Team may come to a point where supporting Mozilla products is no longer feasible and announce the end of security support for Mozilla products"[1].

And as an add on to your last paragraph; (careful, rhetorical rant ahead!) how can the FLOSS community blame Adobe for not releasing a 64 bit Flash plugin for Firefox, when not even Mozilla Corp. supplies and supports a "retail" 64 bit Firefox themselves? Isn't it quite a shame, that the vendor of one of the worlds mostly used open source software (just my personal assumption) behaves just as ignorant regarding 64 bit computing as the rest of the closed source vendors?

Sometimes I must ask myself, why I'm not switching to Konqueror for web browsing. Ah, yes, nspluginwrapper doesn't work with Konqueror (*bites himself*).

[1] http://www.debian.org/releases/stable/i386/release-notes/ch-information.en.html#s-mozilla-security

[Kilz (kilz)]

Another option I just came across is Seiftweasel. Its a free and open source project. It is an optimized build of Firefox with free to use branding. http://sourceforge.net/projects/swiftweasel It has AMD64 and i386 versions of its 2.0.0.3 firefox build avilable as .deb files. They install and work on Dapper.

[disabled.user (disabled.user-deactivatedaccount)]

It seems that security fixes will be backported to Dapper's Firefox 1.5.0.12 from now on. That's keeping up Debian's spirit of keeping stable releases "versionally stable", which is a great thing IMO.

References:
Bug #126727
http://www.ubuntu.com/usn/usn-490-1

[Myriam Schweingruber (myriam)]

Since Dapper LTS has been replaced by Hardy LTS and Firefox is available at least in 2.x and even 3.0 versions, this wish should be closed.