back to article It's 2018 and… wow, you're still using Firefox? All right then, patch these horrid bugs

Mozilla's Firefox has been patched to address more than 30 CVE-listed security vulnerabilities. The open-source browser has been updated in both its regular (Firefox 58) and extended support (ESR 52.6) flavors. You should install these as soon as possible. The Firefox 58 update includes fixes for critical memory corruption …

Page:

  1. Brian Miller

    Where's the Rust?

    I thought that Firefox had gone whole-hog with a Rust engine. Guess not everything has been rewritten yet.

    1. bazza Silver badge

      Re: Where's the Rust?

      It'll be interesting to see where they go with Rust. From what I've heard the parts that have been Rusted-up are remarkably good, so perhaps they are strongly motivated to get on with rewriting the remainder.

      From what I've seen Rust is rapidly becoming the language to use. High level enough to make life easy (though the learning curve is a bit steep), fast, and some really nice tricks, yet low level enough to be a systems language.

      The warning signs for everyone are in the Redox OS project; they've done an awful lot of code in a pretty short time. From ground up to an OS that boots and runs a GUI in the time they've taken is pretty impressive. It would interesting to compare their progress to Google's Fuchsia (AFAIK written in C/C++)

    2. Reginald Marshall

      Re: Where's the Rust?

      I thought that Firefox had gone whole-hog with a Rust engine.

      Not whole-hog, which would be bad engineering, but several parts of the browser engine have been replaced with components written in Rust, the largest being the style system. There is a nice overview in the slides accompanying a talk by one of Mozilla engineers. Briefly: FF is 9M lines of C/C++, 160K of which was the old style system, now replaced by an 85K-line rewrite in Rust.

      More Rust components will appear in the future.

      1. Destroy All Monsters Silver badge

        Re: Where's the Rust?

        Good stuff.

        1. matjaggard

          Re: Where's the Rust?

          It looks like a poor-man's Pascal to me and I had even more trouble compiling Rust than I did C. Who wants to download code for a dependency from a master branch of some untrusted github repo and then compile it themselves?!

    3. PNGuinn
      Joke

      Re: Where's the Rust?

      AS Neddy Seagoon would have said "What, what, what, what?

      Is this going to be the excuse that propels the 'fox into 3 figure version numbers?

      Enquiring minds etc ...

  2. Notas Badoff

    It's 2018 and… wow, you're still using ...

    clickbait headlines?

    1. Gene Cash Silver badge

      Re: It's 2018 and… wow, you're still using ...

      I have to say "nope, I stopped using Firefox at v44..."

      1. werdsmith Silver badge

        Re: It's 2018 and… wow, you're still using ...

        I stopped using firefox because it was not compatible with my suspend/sleep mode habit instead of powering off restart. It would eventually fill RAM and stop the PC working. It's been fine ever since FF was uninstalled.

      2. Updraft102

        Re: It's 2018 and… wow, you're still using ...

        I stopped at 56. Started with Firefox way back when it was Phoenix, but no more. Still in the neighborhood, though, with Waterfox... the way Firefox should have gone instead of the way it went.

    2. Anonymous Coward
      Anonymous Coward

      Re: It's 2018 and… wow, you're still using ...

      it's 2018 and we still fall for them, so yeah, they do :/

  3. veti Silver badge

    Dear Mozilla, there's more to life than security

    How about some fixes for the new stability issues you introduced with Quantum?

    1. Anthropornis
      Linux

      Re: Dear Mozilla, there's more to life than security

      What stability issues ?

      On linux x86_64 57.0{,.4} and 58.0 since late beta have been very stable. Sound in 58 and the betas, on some setups, has been a problem - but I've now got sound working with both pulse and alsa (different installs, obviously - some of my older retained previous systems don't have pulse). And no crashes apart from when I deliberately close Xorg with a large number of open tabs so that I can go back to an earlier system on the same machine (mainly kept for restoring from backups when I do trash the main system, but sometimes booted to check how things used to be if people report problems). And yes, these machines are largely used for building everything from source, to find regressions.

      Hell, it even still builds without stylo if you want to take that route (or haven't installed clang - what is it about LLVM users that makes them think everybody installs all the optional extras ?).

      But *building* firefox (and more particularly rustc - what, you think I don't build from source ?) OTOH can be a PITA. If you use a distro, be glad they will suffer the pain to build it for you ;-)

      Oh, and I had to use 57.0.4 on a win10 machine in the past week - not something I like using, but firefox was working fine.

      1. Teiwaz

        Re: Dear Mozilla, there's more to life than security

        What Stability issues

        Have to agree - pre 57, I was using Firefox less and less and Waterfox and Chromium more and more - since 57, waterfox has been uninstalled as unstable Chromium may well be next if it 'aw snap's me again.....

        Loads fast and is light and nippier than it's been in years.

        On Archlinux (even when also running Plasma).

      2. Dan 55 Silver badge

        Re: Dear Mozilla, there's more to life than security

        Any page on The Guardian's website will make it crash while rendering, at least on my mobile.

        1. AMBxx Silver badge
          Joke

          Re: Dear Mozilla, there's more to life than security

          >> Any page on The Guardian's website will make it crash

          Another reason to use Firefox!

        2. Adam 52 Silver badge

          Re: Dear Mozilla, there's more to life than security

          I see the same, but intermittent. I think there are some ad / ad networks / ad blocker detection scripts that are setting it off. If I clear my cookies to get a different set of ads it works again.

        3. Anonymous Coward
          Anonymous Coward

          Re: Dear Mozilla, there's more to life than security

          >Any page on The Guardian's website will make it crash while rendering, at least on my mobile.

          The only reason I get crashes is because I punch the screen when the Grauniad appears, equally awful as the Daily Mail.

          1. Anonymous Coward
            Anonymous Coward

            Re: equally awful as the Daily Mail.

            Because racism and anti-racism are as bad as each other! Ok, people aren't born racist, but just because someone's decided that they want to discriminate on race doesn't mean we should discriminate against them!! Two wrongs don't make a right so we should stick with just racism rather than doubling up the discrimination! It's simple maths so can't be argued with!!

            1. Anonymous Coward
              Anonymous Coward

              Re: equally awful as the Daily Mail.

              anti-racism is a generous way of describing the Guardian.

              They're both twats. Just different kinds of twat, neither of which are the good kind.

        4. bexley

          Re: Dear Mozilla, there's more to life than security

          The Guardian makes your firefox crash? I would consider that an advantage to using firefox, you can avoid the daily outrage generated by far left ¨journalism¨ and lead a happier life for it.

          The guardian! I ask you...

    2. K.o.R

      Re: Dear Mozilla, there's more to life than security

      How about an official MSI package?

      1. A Non e-mouse Silver badge

        @K.o.R Re: Dear Mozilla, there's more to life than security

        How about an official MSI package?

        www.frontmotion.com/firefox/ But as it's not a Mozilla/Firefox official site, you have no way of knowing if they're putting dodgy stuff into the MSIs.

        1. K.o.R

          Re: @K.o.R Dear Mozilla, there's more to life than security

          Yes, hence my use of the word "official". Frontmotion's is the one I do use.

      2. phuzz Silver badge
        Gimp

        Re: Dear Mozilla, there's more to life than security

        If you're looking for an MSI package because you want to deploy it with Group Policy, bare in mind that Microsoft have pretty much given up on Group Policy Software Deployment, so it might be worth finding an alternative if you can.

        1. K.o.R

          @phuzz Re: Dear Mozilla, there's more to life than security

          Because of course they are. It's not like MSI GP deployment is easy and just works, is it?

          Office is the real PITA for deployment. Maybe MDT can do something useful for it.

    3. Anonymous Coward
      Anonymous Coward

      Re: Dear Mozilla, there's more to life than security

      > "How about some fixes for the new stability issues you introduced with Quantum?"

      Can't say I've ever had it crash since the Quantum rewrite..? (even tried the Guardian after Dan.55's comments)

    4. Anonymous Coward
      Anonymous Coward

      Re: Dear Mozilla, there's more to life than security

      I think that, since, 57 came out, I've had to restart Firefox twice, both times because there were updates it thought I should have.

      So, not unstable for some people.

  4. Jim Mitchell

    DTMF?

    Just what does WebRTC have to do with DTMF? DTMF is the tones your push-button phone makes when you push the buttons (vs the rotary kind).

    1. Sven Coenye

      Re: DTMF?

      WebRTC can be used to initiate phone calls. (It probably has voice synthesis as well. In case your internet goes down, it can dial out to blab on on you...)

      https://hacks.mozilla.org/2015/11/webrtc-sending-dtmf-in-firefox/

      "Until recently, there had been very little interest expressed by developers to make use of this interface; and, as a consequence, it has been a relatively low priority for the Firefox WebRTC team"

      Might explain a few issues mentioned...

    2. jake Silver badge

      Re: DTMF?

      See RFC 4733.

  5. oldtaku Silver badge
    Devil

    Firefox really is the worst

    Except for Chrome, Safari, Opera, and Edge.

    Chrome is a bloated pig that chokes and dies like an infant with how many tabs as I leave open, Safari is long dead on my platforms, Edge is right out because of lack of extensions, Opera is somehow grossly overfeatured and underfeatured at the same time (though it'd be my next choice), and don't even talk about the Linux only browsers.

    You picks your tradeoffs. Which is why sometimes my browser is Lynx.

    1. AMBxx Silver badge

      Re: Firefox really is the worst

      Oddly, I've reached a point where I use different browsers for different use cases.

      Firefox for general browsing.

      Edge for anything Microsoft related - Office 365, Azure portal

      IE for Facebook to prevent facebook leaching into anything else.

      Chrome without any extensions for testing or where an extension is causing problems with a site.

      Opera just pisses me off to much to have an entry.

    2. teknopaul

      Re: Firefox really is the worst

      Try yandex. I prefer ruskies spying on me to the yanks. :)

      Looks good too. Not too much chrome but what there is is slick.

      Oh and everything works.

      1. GrapeBunch
        Windows

        Re: Firefox really is the worst

        I must really have been using an old version. Had to upgrade 4 times to bring ff to current level 58. Sad to see one of my favourite add-ons "Faviconize Tab" (allowed each tab to be thin down to the width of a favicon) gone. FF 58 "kindly" allows you to list legacy add-ons no longer supported, then "helpfully" suggests that you may search for replacements, but when you press the button, it's just a dumb old list of all add-ons.

        To be even-handed in criticism, Opera hasn't had its most distinctive and useful feature since Opera 12 (2011?). The feature was "Create Follower Tab". This opened a new, initially blank tab. Whenever you clicked in the current tab, it displayed the content in the Follower Tab, and the current tab stayed loaded. Usually way more handy than the now ubiquitous "Open Link in New Tab". Even then it was buggy to the extent that it didn't remember Follower Tabs between sessions. In the new session, the Follower Tab became a tab like any other. I like to say that "It ain't Opera until it has Follower Tabs". Vivaldi also doesn't have it.

        I use Opera developer, Vivaldi, Firefox, simultaneously (24GB RAM helps) with lots of tabs open. Certain sites work better with one than with an other. Multiple accounts at the same site, easy this way instead of logging out and in. I use Sleipnir a bit. Otter rarely. Installed Pale Moon recently, but lightly used. Uninstalled Chrome years ago as hopeless. It must have improved a lot for people to be using it in 2018. My Security Prime Directive is never to use MS products in Windows unless absolutely necessary, because "undocumented features"; so no Edge, and no IE for decades. Guilty secret: I use Process Explorer. Lame excuse: it isn't "really" an MS product. Finally, Lynx. Sorry, it's difficult to get back to a text-only interface. But it's been used in the last couple of years, for sites blushed by the deepest scepticism, but profoundly wanting to be read.

        Sorry, there isn't an icon for "Prepare for boring, me young buckaroos."

        1. DanceMan

          Re: Create Follower Tab

          Might I suggest Tab Mix Plus. I used to use it in FF and still do in Pale Moon. It gives you complete control over tabs. For years I have used it to open nearly everything I click on in a new tab.

      2. To Mars in Man Bras!

        Re: Firefox really is the worst

        Plus one for Yandex Browser.

        It seems to be a re-skinned version of Opera so, if you like Opera, give it a whirl —especially if, like me, you want to run the same browser across all your devices.

        It's the only Android browser (outside of Firefox) that supports extensions* (both Opera and Chrome ones). But, unlike Firefox it doesn't run like a slug on mogadon

        *[the extensions code is currently being rewritten. So, only the alpha version supports them at the moment]

    3. RedCardinal

      Re: Firefox really is the worst

      I concur.

      I'll stick with Firefox thanks.

  6. Chas E. Erath

    slower than molasses

    I've been using this Firefox browser since the early Netscape days - I can't argue that it's slower than dirt (despite the rewrite). However - I don't trust google, so Opera is my next choice. (IE is not a contender (as I've been using linux for a very long time)).

    And so now - on slow machines, I lean toward Opera.

    1. Lars Silver badge
      Go

      Re: slower than molasses

      "I lean toward Opera.". There is also Vivaldi to consider.

      1. Naselus

        Re: slower than molasses

        "There is also Vivaldi to consider."

        Honestly, I'd consider Vivaldi long before I looked to Opera these days.

        1. JLV

          Re: slower than molasses

          +1 My primary is FF, but its RAM consumption is ghastly, even with the new Quantum. 2-3GB after running a while is common and 700MB @ startup, no tabs is as well.

          Like Chrome, similarly chubby, they play great tricks with distributing their flabbiness through several helper processes that make it look like they don't hog as much. Yes, yes, I know the process splitups have other legitimate uses, but I saw enough fawning remarks about Chrome RAM footprint when it first came out to be cynical.

          Vivaldi OTOH seems to run on 400-500 MB most of the time. Esp odd when compared with its sire's Chrome footprint. Does unloading all of Google's snoopiness really save that much?

          It's still missing some stuff - try viewing the rest of a truncated gmail message for example - but looking interesting already.

          And, no, didn't come to V. from Opera.

          1. davidp231

            Re: slower than molasses

            "Vivaldi OTOH seems to run on 400-500 MB most of the time. Esp odd when compared with its sire's Chrome footprint. Does unloading all of Google's snoopiness really save that much?"

            Be interesting to compare Vivaldi to Chromium (Chrome's sire). Google added their slurpy good(bad)ness and DRM support so Netflix will run in it, and called it Chrome.

    2. davidp231

      Re: slower than molasses

      Opera? You may as well slap Chrome on, because ultimately that's all it is.

  7. Anonymous Coward
    Anonymous Coward

    Quantum has extinguished the Fire, now it's just Focks.

    I still use version 51 - disabled javascript, java, flash and it works great with my addons.

  8. Colonel Mad

    So last year

    I'm on 59

    1. Anonymous Coward
      Anonymous Coward

      Re: So last year

      @Mad: Doesn't sound particularly mad.

    2. This post has been deleted by its author

  9. Chronos
    Facepalm

    Clickbait title indeed.

    If it's a choice between various ad flingers or Mozilla it's a bloody no-brainer. Some of those vulns don't affect the clueful anyway. It's 2018 and... wow, you still have WebRTC enabled¹?

    ¹ about:config, media.peerconnection.enabled, false

  10. jms222

    x86 and modern browsers deserve each other

    Both are incredibly over-complicated messes with thousands of variants and bits stuck on even if they're all supposedly to a standard. Nobody truly understands them or the security implications.

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like