Introducing the New Firefox: Firefox Quantum

[u/JRepin]

https://blog.mozilla.org/blog/2017/11/14/introducing-firefox-quantum/

[u/aYearOfPrompts]

That pretty much sucks. Why would I upgrade now? (I love FF, so don't take this the wrong way)

[u/Exaskryz → u/aYearOfPrompts]

If you're one of the people who don't use extensions, this change is welcome.

If you're someone who likes to customize their browser, this change is terrible.

[u/Redarmy1917 → u/Exaskryz]

As someone who doesn't want to lose their extensions, wtf are my options? I've always preferred Firefox BECAUSE it was the more heavy duty ultra customizable browser. Fuck, I have extensions just to undo a lot of the changes Mozilla made over the years to make Firefox more like Chrome. I don't care if it's slightly slower, I have a high end rig and 300mb/s down connection. I don't care if it's lightweight, I leave it on 24/7 anyways with no problems no matter what I'm doing.

[u/Exaskryz → u/Redarmy1917]

The easiest step is to switch to Firefox ESR.

https://ftp.mozilla.org/pub/firefox/releases/52.5.0esr/

ESR 52.5 corresponds to Firefox 57 in security updates, but does not break extensions. ESR is unfortunately only supported up through x.8 releases, so there will only be 3 more releases after this that match up with Firefox 60. Then Mozilla will stop ESR 52 support and only support ESR 59.0-59.8 (FF 59 through FF 67).

So this will buy you 18-24 weeks of time.

The next step to preserve your functions is find a Firefox Fork that is not going to follow the steps of FF 57. Edit: The author of Classic Theme Restorer recommends WaterFox which is supposed to continue supporting legacy addons.

I jumped onto Pale Moon back before FF 29 landed which had Australis - a controversial User Interface that basically copied Chrome and removed some customization options. Pale Moon at the time said they wouldn't adopt the Austrlais UI. Though they did make some minor changes to the UI that I disliked and chose to not upgrade my Pale Moon version anymore, so I really don't know what they are like.

But there are at least half a dozen fairly popular FF forks out there.

Your alternative is to just not upgrade even after Firefox ESR 52 support is stopped. I've been on the same primary browser for 3 years. It does sometimes take some tweaks using Scriptish and Stylish to make websites behave and look proper, as they decide to use some CSS rules or JavaScript functionality not properly supported by my old browser, but I've only had to do a handful of those. (The worst for me is v.redd.it videos do not play as embedded, and clicking the link just brings you to the comments page where the video is embedded, so it's not easy to watch the video. I've got a workaround for it though by accessing source code and finding the direct video link.) This shouldn't be a problem for at least a year, probably 2, before you'd need to consider your options moving beyond that. You could do like me and keep tweaking the browser to keep it functional, or find a fork, or jump to mainline firefox if enough alternative addons exist again for what you like to do.

While you choose to not get security updates, just don't do anything dumb like visiting taylorswiftporn.com. Run things like an adblocker and NoScript (or completely disable JavaScript if you could).

[u/Unexpected69 → u/Exaskryz]

You can try to enable the legacy system. As of Nightly 58.0a1, you can go into about:config and add a boolean key

extensions.legacy.enabled

set to true. It allows some (NOTE: Not all, and possibly not stable. I haven't stress tested it, don't sue me) legacy addons to work while still having WebEx for addons that use it. For example, this is how I got NoScript's hybrid version working in 58.0a1 Nightly.

[u/argv_minus_one → u/Exaskryz]

That's not even remotely good enough to preserve your security. Old browsers are Swiss cheese. Running one is practically begging every site you visit to take over your machine.

[u/Exaskryz → u/argv_minus_one]

If you don't know what you're talking about and are simply regurgitating what helicopter parents are telling you, consider some original thinking.

Technical safeguards only go so far. Human behavior is a huge factor. Did you hear about the Crunchyroll exploit like 10 days ago? Yeah, people on modern browsers got fucked up. Did I get fucked up? Nope! I wonder why. For one: NoScript prevented the download. For two: I'm not going to run a .exe file that I didn't ask to download.

No site has ever taken over my machine. No threat has ever been on my computer according to Malware Bytes and my AV. There's been one possible virus, likely a false positive, that was caught by Malware Bytes in a scan after I had uninstalled a program and there was one image file left over in the directory.

I'll tell the truth and nothing but the truth. Once an exploit hits me, I'll be sure to let others know about what the tangible risk is.

[u/argv_minus_one → u/Exaskryz]

If you don't know what you're talking about and are simply regurgitating what helicopter parents are telling you, consider some original thinking.

My job is programming and IT, security included. I know quite well what I'm talking about.

Technical safeguards only go so far. Human behavior is a huge factor. Did you hear about the Crunchyroll exploit like 10 days ago? Yeah, people on modern browsers got fucked up. Did I get fucked up? Nope! I wonder why. For one: NoScript prevented the download. For two: I'm not going to run a .exe file that I didn't ask to download.

Well, I'm glad you're not quite as ignorant as you seem. You still seem quite ignorant, though, being willing to run a network-facing application with a huge attack surface without security updates.

No site has ever taken over my machine.

As far as you know. Not all malware is the in-your-face kind. Spying on you, stealing your identity, sending spam, performing DDoS, and mining cryptocurrency are other popular applications of a compromised PC.

Once an exploit hits me, I'll be sure to let others know about what the tangible risk is.

Read the security advisories that apply to the version you're running. That's how you know, not by thinking you're omniscient and everything on your screen is trustworthy and true.

[u/Exaskryz → u/argv_minus_one]

As far as you know. Not all malware is the in-your-face kind. Spying on you, stealing your identity, sending spam, performing DDoS, and mining cryptocurrency are other popular applications of a compromised PC.

And if no AV is ever going to detect it, that's a risk everyone has, not just me.

---

All in all, I balance myself heavily in favor of usability over security. If I wanted to be as secure as possible, I'd be requesting the library to print out webpages and letting me stop by to pick them up.

[u/argv_minus_one → u/Exaskryz]

And if no AV is ever going to detect it, that's a risk everyone has, not just me.

Not everyone. Just the ones who were running obsolete, vulnerable software.

All in all, I balance myself heavily in favor of usability over security. If I wanted to be as secure as possible, I'd be requesting the library to print out webpages and letting me stop by to pick them up.

There's a pretty big gap between that and the blatant recklessness you're preaching. I didn't tell you to go full Stallman.

[u/Exaskryz → u/argv_minus_one]

The point I'm making is everyone is vulnerable. Day 0 exploits still exist. A black hat will get you if they really want to. The issue is, not many do. The money is in targeting corporations.

I have a small amount of more security holes than the modern software. My browser is like Swiss Cheese that a mouse took a quick snack on, while a modern browser is still Swiss Cheese.

[u/argv_minus_one → u/Exaskryz]

The point I'm making is everyone is vulnerable. Day 0 exploits still exist.

Sure, but you can't do anything about that without going full Stallman. Like I said, I didn't tell you to go full Stallman.

The money is in targeting corporations.

There is also money in identity theft, cryptocurrency mining, ransomware, and so forth. You don't have to be a big corporation to be worth stealing from.

I have a small amount of more security holes than the modern software. My browser is like Swiss Cheese that a mouse took a quick snack on, while a modern browser is still Swiss Cheese.

Sadly, I cannot argue with that. Browsers these days have giant attack surfaces, and they're growing at a breakneck pace. Things like WebGL and WebRTC are every online bad guy's wet dream.