back to article It's 2018 and… wow, you're still using Firefox? All right then, patch these horrid bugs

Mozilla's Firefox has been patched to address more than 30 CVE-listed security vulnerabilities. The open-source browser has been updated in both its regular (Firefox 58) and extended support (ESR 52.6) flavors. You should install these as soon as possible. The Firefox 58 update includes fixes for critical memory corruption …

  1. Brian Miller

    Where's the Rust?

    I thought that Firefox had gone whole-hog with a Rust engine. Guess not everything has been rewritten yet.

    1. bazza Silver badge

      Re: Where's the Rust?

      It'll be interesting to see where they go with Rust. From what I've heard the parts that have been Rusted-up are remarkably good, so perhaps they are strongly motivated to get on with rewriting the remainder.

      From what I've seen Rust is rapidly becoming the language to use. High level enough to make life easy (though the learning curve is a bit steep), fast, and some really nice tricks, yet low level enough to be a systems language.

      The warning signs for everyone are in the Redox OS project; they've done an awful lot of code in a pretty short time. From ground up to an OS that boots and runs a GUI in the time they've taken is pretty impressive. It would interesting to compare their progress to Google's Fuchsia (AFAIK written in C/C++)

    2. Reginald Marshall

      Re: Where's the Rust?

      I thought that Firefox had gone whole-hog with a Rust engine.

      Not whole-hog, which would be bad engineering, but several parts of the browser engine have been replaced with components written in Rust, the largest being the style system. There is a nice overview in the slides accompanying a talk by one of Mozilla engineers. Briefly: FF is 9M lines of C/C++, 160K of which was the old style system, now replaced by an 85K-line rewrite in Rust.

      More Rust components will appear in the future.

      1. Destroy All Monsters Silver badge

        Re: Where's the Rust?

        Good stuff.

        1. matjaggard

          Re: Where's the Rust?

          It looks like a poor-man's Pascal to me and I had even more trouble compiling Rust than I did C. Who wants to download code for a dependency from a master branch of some untrusted github repo and then compile it themselves?!

    3. PNGuinn
      Joke

      Re: Where's the Rust?

      AS Neddy Seagoon would have said "What, what, what, what?

      Is this going to be the excuse that propels the 'fox into 3 figure version numbers?

      Enquiring minds etc ...

  2. Notas Badoff

    It's 2018 and… wow, you're still using ...

    clickbait headlines?

    1. Gene Cash Silver badge

      Re: It's 2018 and… wow, you're still using ...

      I have to say "nope, I stopped using Firefox at v44..."

      1. werdsmith Silver badge

        Re: It's 2018 and… wow, you're still using ...

        I stopped using firefox because it was not compatible with my suspend/sleep mode habit instead of powering off restart. It would eventually fill RAM and stop the PC working. It's been fine ever since FF was uninstalled.

      2. Updraft102

        Re: It's 2018 and… wow, you're still using ...

        I stopped at 56. Started with Firefox way back when it was Phoenix, but no more. Still in the neighborhood, though, with Waterfox... the way Firefox should have gone instead of the way it went.

    2. Anonymous Coward
      Anonymous Coward

      Re: It's 2018 and… wow, you're still using ...

      it's 2018 and we still fall for them, so yeah, they do :/

  3. veti Silver badge

    Dear Mozilla, there's more to life than security

    How about some fixes for the new stability issues you introduced with Quantum?

    1. Anthropornis
      Linux

      Re: Dear Mozilla, there's more to life than security

      What stability issues ?

      On linux x86_64 57.0{,.4} and 58.0 since late beta have been very stable. Sound in 58 and the betas, on some setups, has been a problem - but I've now got sound working with both pulse and alsa (different installs, obviously - some of my older retained previous systems don't have pulse). And no crashes apart from when I deliberately close Xorg with a large number of open tabs so that I can go back to an earlier system on the same machine (mainly kept for restoring from backups when I do trash the main system, but sometimes booted to check how things used to be if people report problems). And yes, these machines are largely used for building everything from source, to find regressions.

      Hell, it even still builds without stylo if you want to take that route (or haven't installed clang - what is it about LLVM users that makes them think everybody installs all the optional extras ?).

      But *building* firefox (and more particularly rustc - what, you think I don't build from source ?) OTOH can be a PITA. If you use a distro, be glad they will suffer the pain to build it for you ;-)

      Oh, and I had to use 57.0.4 on a win10 machine in the past week - not something I like using, but firefox was working fine.

      1. Teiwaz

        Re: Dear Mozilla, there's more to life than security

        What Stability issues

        Have to agree - pre 57, I was using Firefox less and less and Waterfox and Chromium more and more - since 57, waterfox has been uninstalled as unstable Chromium may well be next if it 'aw snap's me again.....

        Loads fast and is light and nippier than it's been in years.

        On Archlinux (even when also running Plasma).

      2. Dan 55 Silver badge

        Re: Dear Mozilla, there's more to life than security

        Any page on The Guardian's website will make it crash while rendering, at least on my mobile.

        1. AMBxx Silver badge
          Joke

          Re: Dear Mozilla, there's more to life than security

          >> Any page on The Guardian's website will make it crash

          Another reason to use Firefox!

        2. Adam 52 Silver badge

          Re: Dear Mozilla, there's more to life than security

          I see the same, but intermittent. I think there are some ad / ad networks / ad blocker detection scripts that are setting it off. If I clear my cookies to get a different set of ads it works again.

        3. Anonymous Coward
          Anonymous Coward

          Re: Dear Mozilla, there's more to life than security

          >Any page on The Guardian's website will make it crash while rendering, at least on my mobile.

          The only reason I get crashes is because I punch the screen when the Grauniad appears, equally awful as the Daily Mail.

          1. Anonymous Coward
            Anonymous Coward

            Re: equally awful as the Daily Mail.

            Because racism and anti-racism are as bad as each other! Ok, people aren't born racist, but just because someone's decided that they want to discriminate on race doesn't mean we should discriminate against them!! Two wrongs don't make a right so we should stick with just racism rather than doubling up the discrimination! It's simple maths so can't be argued with!!

            1. Anonymous Coward
              Anonymous Coward

              Re: equally awful as the Daily Mail.

              anti-racism is a generous way of describing the Guardian.

              They're both twats. Just different kinds of twat, neither of which are the good kind.

        4. bexley

          Re: Dear Mozilla, there's more to life than security

          The Guardian makes your firefox crash? I would consider that an advantage to using firefox, you can avoid the daily outrage generated by far left ¨journalism¨ and lead a happier life for it.

          The guardian! I ask you...

    2. K.o.R

      Re: Dear Mozilla, there's more to life than security

      How about an official MSI package?

      1. A Non e-mouse Silver badge

        @K.o.R Re: Dear Mozilla, there's more to life than security

        How about an official MSI package?

        www.frontmotion.com/firefox/ But as it's not a Mozilla/Firefox official site, you have no way of knowing if they're putting dodgy stuff into the MSIs.

        1. K.o.R

          Re: @K.o.R Dear Mozilla, there's more to life than security

          Yes, hence my use of the word "official". Frontmotion's is the one I do use.

      2. phuzz Silver badge
        Gimp

        Re: Dear Mozilla, there's more to life than security

        If you're looking for an MSI package because you want to deploy it with Group Policy, bare in mind that Microsoft have pretty much given up on Group Policy Software Deployment, so it might be worth finding an alternative if you can.

        1. K.o.R

          @phuzz Re: Dear Mozilla, there's more to life than security

          Because of course they are. It's not like MSI GP deployment is easy and just works, is it?

          Office is the real PITA for deployment. Maybe MDT can do something useful for it.

    3. Anonymous Coward
      Anonymous Coward

      Re: Dear Mozilla, there's more to life than security

      > "How about some fixes for the new stability issues you introduced with Quantum?"

      Can't say I've ever had it crash since the Quantum rewrite..? (even tried the Guardian after Dan.55's comments)

    4. Anonymous Coward
      Anonymous Coward

      Re: Dear Mozilla, there's more to life than security

      I think that, since, 57 came out, I've had to restart Firefox twice, both times because there were updates it thought I should have.

      So, not unstable for some people.

  4. Jim Mitchell

    DTMF?

    Just what does WebRTC have to do with DTMF? DTMF is the tones your push-button phone makes when you push the buttons (vs the rotary kind).

    1. Sven Coenye

      Re: DTMF?

      WebRTC can be used to initiate phone calls. (It probably has voice synthesis as well. In case your internet goes down, it can dial out to blab on on you...)

      https://hacks.mozilla.org/2015/11/webrtc-sending-dtmf-in-firefox/

      "Until recently, there had been very little interest expressed by developers to make use of this interface; and, as a consequence, it has been a relatively low priority for the Firefox WebRTC team"

      Might explain a few issues mentioned...

    2. jake Silver badge

      Re: DTMF?

      See RFC 4733.

  5. oldtaku Silver badge
    Devil

    Firefox really is the worst

    Except for Chrome, Safari, Opera, and Edge.

    Chrome is a bloated pig that chokes and dies like an infant with how many tabs as I leave open, Safari is long dead on my platforms, Edge is right out because of lack of extensions, Opera is somehow grossly overfeatured and underfeatured at the same time (though it'd be my next choice), and don't even talk about the Linux only browsers.

    You picks your tradeoffs. Which is why sometimes my browser is Lynx.

    1. AMBxx Silver badge

      Re: Firefox really is the worst

      Oddly, I've reached a point where I use different browsers for different use cases.

      Firefox for general browsing.

      Edge for anything Microsoft related - Office 365, Azure portal

      IE for Facebook to prevent facebook leaching into anything else.

      Chrome without any extensions for testing or where an extension is causing problems with a site.

      Opera just pisses me off to much to have an entry.

    2. teknopaul

      Re: Firefox really is the worst

      Try yandex. I prefer ruskies spying on me to the yanks. :)

      Looks good too. Not too much chrome but what there is is slick.

      Oh and everything works.

      1. GrapeBunch
        Windows

        Re: Firefox really is the worst

        I must really have been using an old version. Had to upgrade 4 times to bring ff to current level 58. Sad to see one of my favourite add-ons "Faviconize Tab" (allowed each tab to be thin down to the width of a favicon) gone. FF 58 "kindly" allows you to list legacy add-ons no longer supported, then "helpfully" suggests that you may search for replacements, but when you press the button, it's just a dumb old list of all add-ons.

        To be even-handed in criticism, Opera hasn't had its most distinctive and useful feature since Opera 12 (2011?). The feature was "Create Follower Tab". This opened a new, initially blank tab. Whenever you clicked in the current tab, it displayed the content in the Follower Tab, and the current tab stayed loaded. Usually way more handy than the now ubiquitous "Open Link in New Tab". Even then it was buggy to the extent that it didn't remember Follower Tabs between sessions. In the new session, the Follower Tab became a tab like any other. I like to say that "It ain't Opera until it has Follower Tabs". Vivaldi also doesn't have it.

        I use Opera developer, Vivaldi, Firefox, simultaneously (24GB RAM helps) with lots of tabs open. Certain sites work better with one than with an other. Multiple accounts at the same site, easy this way instead of logging out and in. I use Sleipnir a bit. Otter rarely. Installed Pale Moon recently, but lightly used. Uninstalled Chrome years ago as hopeless. It must have improved a lot for people to be using it in 2018. My Security Prime Directive is never to use MS products in Windows unless absolutely necessary, because "undocumented features"; so no Edge, and no IE for decades. Guilty secret: I use Process Explorer. Lame excuse: it isn't "really" an MS product. Finally, Lynx. Sorry, it's difficult to get back to a text-only interface. But it's been used in the last couple of years, for sites blushed by the deepest scepticism, but profoundly wanting to be read.

        Sorry, there isn't an icon for "Prepare for boring, me young buckaroos."

        1. DanceMan

          Re: Create Follower Tab

          Might I suggest Tab Mix Plus. I used to use it in FF and still do in Pale Moon. It gives you complete control over tabs. For years I have used it to open nearly everything I click on in a new tab.

      2. To Mars in Man Bras!

        Re: Firefox really is the worst

        Plus one for Yandex Browser.

        It seems to be a re-skinned version of Opera so, if you like Opera, give it a whirl —especially if, like me, you want to run the same browser across all your devices.

        It's the only Android browser (outside of Firefox) that supports extensions* (both Opera and Chrome ones). But, unlike Firefox it doesn't run like a slug on mogadon

        *[the extensions code is currently being rewritten. So, only the alpha version supports them at the moment]

    3. RedCardinal

      Re: Firefox really is the worst

      I concur.

      I'll stick with Firefox thanks.

  6. Chas E. Erath

    slower than molasses

    I've been using this Firefox browser since the early Netscape days - I can't argue that it's slower than dirt (despite the rewrite). However - I don't trust google, so Opera is my next choice. (IE is not a contender (as I've been using linux for a very long time)).

    And so now - on slow machines, I lean toward Opera.

    1. Lars Silver badge
      Go

      Re: slower than molasses

      "I lean toward Opera.". There is also Vivaldi to consider.

      1. Naselus

        Re: slower than molasses

        "There is also Vivaldi to consider."

        Honestly, I'd consider Vivaldi long before I looked to Opera these days.

        1. JLV

          Re: slower than molasses

          +1 My primary is FF, but its RAM consumption is ghastly, even with the new Quantum. 2-3GB after running a while is common and 700MB @ startup, no tabs is as well.

          Like Chrome, similarly chubby, they play great tricks with distributing their flabbiness through several helper processes that make it look like they don't hog as much. Yes, yes, I know the process splitups have other legitimate uses, but I saw enough fawning remarks about Chrome RAM footprint when it first came out to be cynical.

          Vivaldi OTOH seems to run on 400-500 MB most of the time. Esp odd when compared with its sire's Chrome footprint. Does unloading all of Google's snoopiness really save that much?

          It's still missing some stuff - try viewing the rest of a truncated gmail message for example - but looking interesting already.

          And, no, didn't come to V. from Opera.

          1. davidp231

            Re: slower than molasses

            "Vivaldi OTOH seems to run on 400-500 MB most of the time. Esp odd when compared with its sire's Chrome footprint. Does unloading all of Google's snoopiness really save that much?"

            Be interesting to compare Vivaldi to Chromium (Chrome's sire). Google added their slurpy good(bad)ness and DRM support so Netflix will run in it, and called it Chrome.

    2. davidp231

      Re: slower than molasses

      Opera? You may as well slap Chrome on, because ultimately that's all it is.

  7. Anonymous Coward
    Anonymous Coward

    Quantum has extinguished the Fire, now it's just Focks.

    I still use version 51 - disabled javascript, java, flash and it works great with my addons.

  8. Colonel Mad

    So last year

    I'm on 59

    1. Anonymous Coward
      Anonymous Coward

      Re: So last year

      @Mad: Doesn't sound particularly mad.

    2. This post has been deleted by its author

  9. Chronos
    Facepalm

    Clickbait title indeed.

    If it's a choice between various ad flingers or Mozilla it's a bloody no-brainer. Some of those vulns don't affect the clueful anyway. It's 2018 and... wow, you still have WebRTC enabled¹?

    ¹ about:config, media.peerconnection.enabled, false

  10. jms222

    x86 and modern browsers deserve each other

    Both are incredibly over-complicated messes with thousands of variants and bits stuck on even if they're all supposedly to a standard. Nobody truly understands them or the security implications.

    1. Anonymous Coward
      Anonymous Coward

      Re: x86 and modern browsers deserve each other

      Yes, but they throw in an original Colonial Marines Motion Detector for free!! Come on, you know you want to get onboard!

  11. Pascal Monett Silver badge
    Stop

    "could be exploited by dodgy webpages to execute malicious code within the browser"

    Not if you have NoScript (or equivalent).

    As usual.

    I'm a bit tired of all these articles on browser vulnerabilities that never, ever mention JavaScript blockers. They are the first line of defense and, in my view, they are as good as Star Wars ISD shields. Nothing gets through unless you allow it.

    So yeah, maybe Firefox has some security issues in the core, but NoScript is the active energy shield that is protecting it and it is impenetrable.

    Let's get JS blockers on all the other platforms, shall we ?

    1. sabroni Silver badge

      Re: "could be exploited by dodgy webpages to execute malicious code within the browser"

      Just fixing browsers so they only run scripts from the domain you're visiting would be a start. Then if I'm compromised on your site it's because you served me a bad script, you can take it down and fix it. B if you're serving from multiple domains you don't control then your being irresponsible and lazy.

      When i downloaded an app i don't expect to have to pick up components from a dozen other sites to get it working, how come we allow "web apps" to behave like this?

    2. JLV

      Re: "could be exploited by dodgy webpages to execute malicious code within the browser"

      Hold on, I am a huge fan of NoScript. But it's not uncommon that some stupid site can barely be usable until you've Temporarily Enabled a dozen or so scripts. Totally with @Sabroni on this.

      Yes, you can just decide to bail on these sites, but if for some reason you need to proceed, it's best if the core is as clean as possible.

      Thinking of the trend towards forcing you to buy movie tickets in advance online for example, another reason why I avoid movie theaters. Those sites are some of the nastiest piles of steaming crud built by drunk illiterate coding monkeys and have JS from all over the place. You'd think parting you with $15/seat for yet another sequel would be enough payday, but no, gotta add ads and trackers.

      NoScript can save our bacon but does absolve FF from doing their part.

      1. Baldrickk

        Re: "could be exploited by dodgy webpages to execute malicious code within the browser"

        You can usually ( at least you can in the cinemas and theatres near me ) phone up to book in advance, then pick your tickets up from the front desk, avoiding the website entirely.

        When I go to the Cinema, it is most commonly with a voucher that precludes online bookings, so that helps a lot.

  12. Unicornpiss

    Misc

    Yes, I'm still using Firefox... at least on PCs. The user interface is just light years beyond Chrome IMHO, though Chrome performs perfectly well.

    On mobile devices I find the last release of FF to be utterly unusable---deathly slow and crashes from just zooming in or resizing items.

    1. Baldrickk

      Re: Misc

      FF on my mobe seems to work just fine. The mobile UI is just slightly more clunky than it should be - but only just.

      I'm finding myself using it more and more on mobile, and it's my browser of choice on the desktop.

  13. 0laf
    Trollface

    Why the Snark?

    Sorry I quite like FF and I found the v57+ to be fast and stable. Much better than the non-quantum versions.

    Previously I had to switch to Edge to use my online banking. For some reason bank sites are the biggest PITA for me in browsers.

  14. Martin Maloney
    FAIL

    Firefox display issue

    I'm running Linux Mint 17.3 64-bit MATE version. I always install all updates, including, of course, Firefox, as soon as they appear.

    On some Web pages, Firefox sometimes fails to load all the graphics. Instead there is just a blank box.

    Chrome doesn't have this problem.

  15. Anonymous Coward
    Anonymous Coward

    FF55 - still can't give up my extensions.

    1. Anonymous Coward
      Anonymous Coward

      Some replacements are starting to show up on AMO. I've replaced everything except SSLeuth.

  16. Sir Loin Of Beef

    What is wrong with Firefox?

    1. Updraft102

      "What is wrong with Firefox?"

      Its addon API is a little lacking. It could use something better... something more powerful than the webextensions stuff.

  17. Anonymous Coward
    Linux

    Firefox open-source security vulnerability bugs

    Are these horrid bugs fully exploitable under Linux or Apple Mac OS X or that other OS that can never be mentioned by name in relation to software defects. Besides aren't all these flaws related to defects in the memory management unit embedded in the underlying hard/soft solution. You know the innovative integrated solution that can't isolate one processes memory from another.

  18. ckm5

    Destroys all saved data

    Fucking annoyingly, the FF update destroys ALL your saved data, including all your saved login data.

    I've used FF for donkeys years and never had this problem, but now I've lost possibly hundreds of logins.

    Oh well, just another fuck you from some engineers who couldn't give a shit less about user experience.

    1. Mark #255

      Re: Destroys all saved data

      It sounds like your profile became corrupted and your Firefox has created a fresh profile.

      Mozilla Support has some help

      You may be able to recover the logins.

    2. Updraft102

      Re: Destroys all saved data

      "Fucking annoyingly, the FF update destroys ALL your saved data, including all your saved login data.

      I've used FF for donkeys years and never had this problem, but now I've lost possibly hundreds of logins."

      Just restore from your backup.

      You do have backups, don't you? If the data means even a little to you, surely you have backups!

  19. codejunky Silver badge

    hmm

    I have always used firefox since leaving IE (aka knowing better) and I have been critical of the direction to look more like chrome, style over substance, memory hogging, etc. But today I updated FF (ubuntu) and it seems to have a firework up its backside, it is blazing! I have said for some time I would like them to focus on performance and improving the user experience (instead of pockets and other 'features') and I just wanted to say my experience today seems to suggest they have done so.

    It has been a while before I praised a recent achievement of firefox so I am happy to have something positive about it now.

  20. adam payne

    It's 2018 and… wow, you're still using Firefox? All right then, patch these horrid bugs

    Yep still using Firefox after all these years.

  21. jockbroon

    It's 2018 and...

    ...wow, I'm still reading The Register?

    Because despite being a site run by so-called "IT professionals", they somehow make the decision to belittle people for using what is currently the best open source web browser?

    Maybe The Register staff would prefer we all switch to Chrome so that Google can reap more of our sweet, sweet data.

    Seriously, whoever wrote this title... bad fucking show.

    1. diodesign (Written by Reg staff) Silver badge

      Re: Seriously, whoever wrote this title...

      ...was me and I respectfully suggest you:

      # apt-get install senseofhumor

      C.

    2. illiad

      Re: It's 2018 and best open source web browser?

      yes, that is a VERY personal question... it depends what end of the geek/ normal scale you are on... :P :)

      speed, speed, speed!!!

      - Then you will be using something with almost NO functionality, just to prove you have the fastest...

      Its MS, it must be good!! yea, keep believing the lies...

      Its famous, industry standard, so managers say its ok to use it!

      - yes, based on an **ancient** report (about FF 10 or summat???) that 'da management' have understood.. - so no moaning about 'unknown software, even though FF60 is awfully top heavy, and has a 'new' eg 'ruined', 'too new' app structure alienating all those app devs.. :/

      I only keep the last good one (V52) for tesing and 'keep the boss happy'..

      I use a good 'mozilla open source' version call Pale moon, that adds a good graphics engine, good functionality. and has even copied over most good old FF addons for use!

      This is NOT for 'mad geeks', just for those who want a good browser like FF 20 used to be.. :)

    3. illiad

      Re: It's 2018 and...

      yes, the register is STILL 'telling it like it is' unlike 'auntie beeb' , that takes 5 or 6 days to realize 'spectre' is a thing.... :O

      no stoopid chatter, just straight news.. :) :)

      IF you WANT 'stoopid chatter' , well look for Alistair Dabbs.. :D :D

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like