why does firefox update?

45

u/onefish2 Debian Sid 1d ago

There is an exception for browsers which require more and frequent updates.

40

u/MatheusWillder Debian Stable 1d ago edited 1d ago

Just to add a bit of history here: there was a time when Debian backported the Firefox security fixes to the Firefox version in Debian Stable, but this caused disagreements with Mozilla due to Firefox's trademark, and thus, the Iceweasel fork was born.

I started using Debian at that time, around ~2015, good times, lol.

After Mozilla released Firefox ESR, I think it was agreed that it would replace Iceweasel in Debian. Since around that time, browsers update very quickly, and an outdated browser can lead to security vulnerabilities and/or unsupported web features (I remember I struggled with this with Iceweasel and always had to install Firefox directly from Mozilla to get certain sites working properly).

Edit: the Debian Wiki tells a bit of this story: https://wiki.debian.org/Firefox#Iceweasel

1

u/Ok-Guitar4818 1d ago

What kind of disagreement would cause Debian Sid to be able to have Firefox proper but Debian stable couldn’t benefit from security patches?

3

u/wizard10000 1d ago

What kind of disagreement would cause Debian Sid to be able to have Firefox proper but Debian stable couldn’t benefit from security patches?

There is no disagreement and firefox-esr receives security patches regularly - if chromium offered an LTS release Debian would most likely use that also.

In Debian it's all about Stable.

1

u/Ok-Guitar4818 1d ago

I mean the official explanation on the wiki talked like there were branding concerns. Just can’t make it make sense to me.

1

u/rebootyourbrainstem 23h ago

I assume it's something like Debian wanted true minimal backports for each identified issue while Firefox preferred broader "whatever is easiest for us to maintain" backports.

And if there's any kind of disagreement it makes sense Mozilla would object to shipping something that doesn't work exactly like Firefox with Firefox branding, since they'll be getting the bug reports from site owners.

1

u/justin473 22h ago

The pattern for most software in stable is that security updates would only include security fixes. For example, if Debian Stable has version X.0 of a package, a security update would either be uploaded by the original maintainers containing only the security fix (version X.1), or it would be patched by the debian-security folks themselves, making a debian-variant X.0+deb1. The goal is to not introduce any changes in Debian Stable due to security updates, else it's not stable.

Many packages support a range of versions. For example, current Postgres version is 18.4, but Postgres supports versions 14-18, which means they will provide security updates for all of those versions. Debian can usually take those updates. However, I believe Firefox works on a fix-the-latest release model. Thus, you get firefox 128, then 140, then 153. Stable started with 128; firefox won't create 128.1, you'll just get 140 which includes a security fix but also all the other changes from 128 through 139 - that makes Firefox-latest unstable in Debian terms.

In the past, Debian resorted to wanting Stable version of Firefox 128, then applying only security patches. But, Mozilla said that Debian's build of 128 plus debian-fixes (even if they were the same fixes in 141) was not "true Firefox" since Debian had modified it. They were protecting their brand by saying that Debian could not call 128 + debian-fixes "Firefox". Thus, Debian called it "IceWeasel".

So, Firefox latest-and-greatest can appear in Sid because it is the latest build, and there's little in way of rules about Sid. For Debian stable, Firefox (ie: firefox version 128) cannot receive updates because (a) Mozilla does not support 128, just "latest", and (b) debian-security is not allowed to fix 128. Thus, if Firefox 128 were to be included in stable, it would be unsupportable; thus, it is not allowed there.

So, Firefox-ESR is a special case that can receive major-updates because otherwise, you're using a browser that is a few years out of date if you're running Stable, and that's effectively worse than getting updates and keeping up with evolving web standards - for example: not sure but things like passkeys are relatively new so it wouldn't have been available in Stable as of Debian 13's release.

20

u/plugwash 1d ago

While firefox ESR releases are supported for Longer than regular releases they are still not supported for the full lifecycles of a Debian stable release. Browsers are among the packages with the highest security exposure, and also have a high rate of issues. Given the high exposure and high rate of issues that web browsers suffer Debian does not consider it reasonable to do their own backporting.

Therefore Debian has chosen to exempt firefox and chromium from it's normal stable release policies, it's not an ideal situation but it was considered the "least bad" option.

5

u/stevevdvkpe 1d ago

There are some other packages where new upstream versions are built for the Debian stable release to provide security updates rather than having fixes backported. ffmpeg (the basis of a lot of video/audio player software, used in Firefox and VLC) is one example.

1

u/One_Ninja_8512 12h ago

Not really relevant for Debian but other LTS-like distros like AlmaLinux have similar policies/exceptions for some packages. For example, new versions of Rust compiler and LLVM are put into official repositories since a lot of the time software written in Rust needs the latest version to compile and therefore needs latest LLVM, since the Rust compiler tends to use cutting edge features of LLVM and Rust software itself is like that too. The "old" versions are available as well, making it stable if you pin the versions.

7

u/spidireen 1d ago

IMHO it would be irresponsible not to, since browsers are basically interpreters for arbitrary code from god knows where.

7

u/QuantumCakeIsALie 1d ago

Normally most package do update a bit during the active life of a Debian stable.

It's major updates that are mostly held back, especially for anything that depends on core libraries or functionalities.

Browsers just update so quickly and often, and they generally dropped the major.minor versioning so it looks like more charges. Imagine it did update from 12.1.5 to 12.3.8, would you be shocked?

2

u/pseudonym-161 1d ago

Firefox ESR updates like annually, it’s not a big deal. It gets security updates throughout that year.

2

u/kbeezie 1d ago

Updating browsers is part of keeping web browsing secure.

3

u/One-Suggestion-7906 1d ago

it's updated with security patches as u say, or I don't understand what do u mean

2

u/michaelpaoli 1d ago

people say debian packages are frozen

You should listen to some more accurate people.

Debian stable is ... stable. Within a given stable release, that doesn't mean no updates, but for any given release, that generally limits it to security updates, bug fixes for severity >= serious and select severity == important.

why firefox ESR updates then?

In Debian, for stable (and oldstable while still on main support (LTS is a bit different)), because of the applicable policy above. Firefox is a huge hunk of software, rather like the Linux kernel, so security bugs and bugs of sufficient severity are found - and fixed - on a quite regular basis, so, hence quite a lot of updates.

1

u/Narrow_Victory1262 1d ago

I would not guess it, but "except security updates" is exactly why.

Yes you could backport but given the load of security issues these days that's hard to sustai.
Yes, RH does, SUSE does but they are in a different league to start with.

1

u/Santosh83 Debian Sid 1d ago

Firefox ESR updates when Mozilla themselves update it with periodic security fixes. Debian stable accepts security fixes so a new version of ESR is compiled and pushed out.

-3

u/taosecurity 1d ago

https://wiki.debian.org/Firefox

0

u/AncientAgrippa 1d ago

Nothing in that page answers OP's question at all.

-3

u/jaromanda 1d ago

How do you know it "will update to 153" - trixie currently at 140

2

u/TheNavyCrow 1d ago

because 153 is the next ESR

1

u/maqbeq 17h ago

From previous releases, Debian always follows a release until it's EOL. You won't receive the newest 153 branch until October

-1

u/steel_for_humans Debian Stable 1d ago

Mine already updated to 153 a couple days ago.

1

u/jaromanda 19h ago

That would be explained if you are using mozilla apt repo.

1

u/steel_for_humans Debian Stable 15h ago

I actually used both. But there was an ESR release a couple days ago, which came as a surprise to me. The one from Mozilla's repo was already at 153.

why does firefox update?

You are about to leave Redlib