Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

The return of Iceweasel

Posted Sep 25, 2006 18:09 UTC (Mon) by dlang (✭ supporter ✭, #313)
Parent article: The return of Iceweasel

you say that firefox ships version 1.0.4, however remember that debian decided it was too hard to really backport changes and instead ships the new version under the old version number (in order to comply with their 'now version changes' policy, something that never made sense to me)

I can't see this policy causing anything other then confusion with bug reports, so I really understand the mozilla attitude.

David Lang

(Log in to post comments)

The return of Iceweasel

Posted Sep 25, 2006 18:28 UTC (Mon) by cventers (subscriber, #31465) [Link]

> you say that firefox ships version 1.0.4, however remember that debian
> decided it was too hard to really backport changes and instead ships
> the new version under the old version number (in order to comply with
> their 'now version changes' policy, something that never made sense to
> me)

Really? That's pretty shocking!

> I can't see this policy causing anything other then confusion with bug
> reports, so I really understand the mozilla attitude.

Well, I can see where such a move by Debian would (if it is true) be a
really bad thing. I fully understand and agree that Mozilla can do
whatever it wants to with its own code and trademarks. But even in light
of Debian's apparent wrongdoing in release management, I don't think the
Mozilla Foundation's attitude or policy is acceptable. I hope (and
believe) Debian will stick to its guns on the DFSG issue, both for
reasons of creating a quality end-user experience and for reasons of free
software policy.

The return of Iceweasel

Posted Sep 25, 2006 20:06 UTC (Mon) by k8to (subscriber, #15413) [Link]

Ships in etch or in stable? Etch currently has firefox
1.5.dfsg+1.5.0.6-4, which is 1.5.0.6.

The return of Iceweasel

Posted Sep 25, 2006 22:05 UTC (Mon) by joey (subscriber, #328) [Link]

Alexander Sack is doing a lot of work to backport firefox security fixes the the version 1.0.4 in Debian stable. Here's the changelog for it so you can verify it yourself:

http://packages.debian.org/changelogs/pool/main/m/mozilla...

Or you could look at the actual patches, which probably do include code from newer versions, and judge for yourself how well it's being done. Which I've not done, but I'll trust the references to "backporting" in the changelog over your rumor.

The return of Iceweasel

Posted Sep 25, 2006 23:11 UTC (Mon) by drag (subscriber, #31333) [Link]

Did you mean 'No version changes' policy?

Makes perfect sense to me. With Free software and probably any other software stuff authors don't realy have a very good track record of not breaking something. Changing dependancies, changing configuration files. Introducing new bugs.

With Debian Stable it's stable as in 'unchanging'.

I mean with people's experiances in other distros it would seem obvious...
Like how my brother was using Ubuntu I installed for him.
Time to update his system to keep it secure.. like I told him too.

So he updates.. and now firefox is broken. Ok.. fixed that for him.
Later on he updates.. and now X is broken. Ok.. fixed that for him.
Later on he updates.. and now something else is broken.

It's a never ending cycle.

Same thing with Fedora. They do huge updates of X right mid-life of the distro. How the hell does that make sense? What is the point of doing releases at all if your going to do that? It would be easier on the users just to track changes to 'Fedora Core Forever' and get breakage in small bite sized portions.

Same thing with every other distro that I've ever used. If they do version changes mid-life of the distro then stuff gets broken. There is a reason why authors do have versions. Because different versions are pretty much different programs. Sometimes in small ways, sometimes in large ways.

I don't realy mind that a whole lot most of the time.

On a personal desktop, who cares? I like having new versions. But if it's a machine that I just want to keep running why would I want to fix stuff when I shouldn't have to? So I like it when distros backport security fixes.

Of course I know it's not a automatic fix for breakage coming from updates.. Bad things still happen. But it's a good start.

The return of Iceweasel

Posted Sep 25, 2006 23:53 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]

that's the policy I'm referring to.

in and of itself it can be a good thing.

however prior articles here on LWN about firefox upgrades on Debian have stated that debian developers decided that backporting mozilla patches was too hard and so they re-branded the new version as the old version number as the 'patch'

If this is no longer being done then good for them.

however, given the number of changes that are takeing place in firefox (many in response to holes discovered in it) updateing the old version to fix all the bugs found in the new version sounds like a nearly impossible task (similar to backporting all bugfixes in the kernel to a prior version, once the versions diverge more then a little bit the patches no longer apply to both cleanly)

The return of Iceweasel

Posted Sep 27, 2006 17:05 UTC (Wed) by Lovechild (guest, #3592) [Link]

Do we really have to listen to this Fedora X update FUD again, it was proposed and considered like any update request followed by a rejection. Fedora don't do massive updates aside the kernel but that's a rather special case and DaveJ does an amazing job keeping the bugcount down (backporting fixes of any kind in the kernel is timeconsuming compared to rebasing and less error prone).

The return of Iceweasel

Posted Sep 26, 2006 6:23 UTC (Tue) by hooty (subscriber, #7374) [Link]

That is not at all the case, we have backported the fixes in almost all cases. I think one release we did just use the of it to the previous release because all it contained was security fixes. But in general that's not what's been happening and now we are on our own.