firefox secretly removes vital functionality within stable ESR release

PMc

PMc

Hi,

as already mentioned here, recently I ran into what has now been identified as a firefox issue.

Due to the complex relationship between the application, the web proxy, the authentication protocol software, various caching levels and a solid bunch of local modifications, it was rather difficult and time-consuming to identify the culprit, only that it somehow did appear around 2026Q1 - or more specifically maybe due to the upgrade of firefox 140.5esr to 140.7esr - but that being a maintenance upgrade only in an ESR and therefore (up to now, that is) extremely unlikely to insert breaking changes or remove vital functionality.

So, at first I asked at this place, in order to get info if there were any important modifications in the upgrade. But nobody even bothered to answer at all.

Then it appeared things would continue to work - but that was only because of caching, or other clients, where 2026Q1 was not yet installed, would periodically repair the cache in the app server. And I had other things to attend.

On wednesday or thursday. after the other clients had been upgraded, the trouble reappeared. I was able to do a bit more solid debugging, and in my perception it became difficult to imagine any other culprit than the firefox.

So I finally decided to no longer wait on nobody answering, and instead to really bother the firefox people with a bug report.

Within only half a day the bug was confirmed, and even identified with a change that introduced the problem.

But now comes the real absurdity: Me, the person who is actually suffering the malfunction, I am not allowed to know that change!

I probably (given I knew the nature of the issue) just want to fetch a reverse diff, drop it into my deploy chain, and be done with the issue - things will then repair themselves, and I have a lot of other matters to attend.

But instead, these people entertain themselves discussing on severity and whatever and operating their own self-made buerocracy, apparently thinking the users are just consumers, stupid sheep waiting to be fed with their advertisements while praising the almighty lord developer; with no need to know what these are doing. :(

There is a reason why running ESR release - it is because one cannot afford breakage. Sure, mistakes can always happen, and that is why I keep a full source codebase where everything is compiled locally, so it can be repaired rightaway.
But if now developers run their thing as a closed shop, where you're not allowed to know what was intended and why it failed, this gets difficult. Certainly I can download the full gitrepo, work myself thru the changes, and finally figure out what goes on. But why is that necessary, when somebody else already has the full details of the issue?
 
It gets still better... while I am looking at the stdout of the firefox to find anything useful there, the output is constantly distorted by these messages:

console.error: "Failed to fetch https://ads.mozilla.org/v1/ads:" "NetworkError when attempting to fetch resource."

Normally these would be drowned within ~/.xsession-errors And apparently this site is blocked, some upstream seems to consider it as fraudulent or spam or whatever. But what does the firefox want there? I don't recall having asked it to do that.
 
Nothing them clowns at Mozilla do surprises me anymore they have completely lost their way. If there was anywhere near another descent open source browser engine to use I would not be using one of the forks right now either, I would have dumped it completely by now. Good to read you managed to sort out their latest example of incompetence.
 
PMc said:
Certainly I can download the full gitrepo, work myself thru the changes, and finally figure out what goes on
Click to expand...
Is there a public facing git repo with web interface? If so why not just look at issues and commits? I'd guess that ESR is on a separate branch so just look at things related to that branch.
If you actually wrote a bug do you get notified on any updates to the bug? Devs may not actually discuss/root cause in the bug, but when it gets closed there will likely be a git commit referenced that you can go look up.
I am in no way suggesting the devs attitude is correct, just other ways to skin a cat.
 
mer said:
Is there a public facing git repo with web interface? If so why not just look at issues and commits? I'd guess that ESR is on a separate branch so just look at things related to that branch
Click to expand...
Yeah basically I was just to lazy to consider searching the gitrepo.
But after waiting two days fruitlessly, I did. I have given you the link already - see above.

What You can see there is a reference to a PR, but that PR is not accessible, There are also some links to phabricators, but I don't understand our phabricator, and I might assume that is also a closed shop.

So what I have is the source diff, which is obvious from the respective commit. And I can read that sourcecode and understand it. And that sourcecode is so utter nonsense. It is not only broken code that cannot work,even if it would work, it would achieve no more than user-admin quarrels. Specifically: the user can no longer SSO to a certain host unless the admin has explicitely allowed it. (But the current implementation only achieves that nobody can SSO to any host anymore.)

So much I can read from the code. But what should be achived with this? What's the rationale, did anybody discuss this in any way? That I cannot read from the code.

mer said:
If you actually wrote a bug do you get notified on any updates to the bug? Devs may not actually discuss/root cause in the bug, but when it gets closed there will likely be a git commit referenced that you can go look up.
I am in no way suggesting the devs attitude is correct, just other ways to skin a cat.
Click to expand...

Thanks, yeah, I thought along that line already. Sooner or later somebody will have to comment on this, and then a few more details might become visible.

But there are two more interesting rsp. unpleasant things here.

First the interesting one: that firefox 1407 is out for quite a couple of days now , and I was the only one noticing that it doesn't work?!?. Who else is using kerberos? No one? That would be in line with other observations: nobody talks about kerberos, here or anywhere. There is no userbase.
But then, why change things at all? Who has requested that? Somebody who wants to stay in hiding?

And there is another, much more disgusting aspect: the banned site, https:/ /ads.mozilla.org, when you get around to read it, it is really shocking.
It basically says anyone can give Mozilla money in order to fuck their users. Mozilla is a pimp.

Over all, this gets more and more the taste of a mobster affair.
 
PMc said:
Yeah basically I was just to lazy to consider searching the gitrepo.
But after waiting two days fruitlessly, I did. I have given you the link already - see above.

What You can see there is a reference to a PR, but that PR is not accessible, There are also some links to phabricators, but I don't understand our phabricator, and I might assume that is also a closed shop.

So what I have is the source diff, which is obvious from the respective commit. And I can read that sourcecode and understand it. And that sourcecode is so utter nonsense. It is not only broken code that cannot work,even if it would work, it would achieve no more than user-admin quarrels. Specifically: the user can no longer SSO to a certain host unless the admin has explicitely allowed it. (But the current implementation only achieves that nobody can SSO to any host anymore.)

So much I can read from the code. But what should be achived with this? What's the rationale, did anybody discuss this in any way? That I cannot read from the code.



Thanks, yeah, I thought along that line already. Sooner or later somebody will have to comment on this, and then a few more details might become visible.

But there are two more interesting rsp. unpleasant things here.

First the interesting one: that firefox 1407 is out for quite a couple of days now , and I was the only one noticing that it doesn't work?!?. Who else is using kerberos? No one? That would be in line with other observations: nobody talks about kerberos, here or anywhere. There is no userbase.
But then, why change things at all? Who has requested that? Somebody who wants to stay in hiding?

And there is another, much more disgusting aspect: the banned site, https:/ /ads.mozilla.org, when you get around to read it, it is really shocking.
It basically says anyone can give Mozilla money in order to fuck their users. Mozilla is a pimp.

Over all, this gets more and more the taste of a mobster affair.
Click to expand...
I know it gets frustrating and for the record was not "blaming" anyone, just offering observations based on my experiences.
A problem with software that can be configured lots of ways is testing typically only tests the most common configurations. It's not right but given limited resources for testing, it's unfortunate reality.
 
You must log in or register to reply here.
Back
Top