Technology

59708 readers

2383 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

354

The Fennec Android browser is currently behind on Firefox security updates, deemed unsafe by F-droid (leminal.space)

submitted 1 month ago by halm@leminal.space to c/technology@lemmy.world

54 comments fedilink hide all child comments

If, like me, you've relied on Fennec as a more tolerable version of Firefox for Android, you may have gotten some bad news in the latest F-droid update cycle.

Fennec has fallen so far behind on updates that serious security patches implemented by Mozilla in Firefox haven't been applied to the fork, and Fennec is therefore still breachable.

The developer responded two weeks ago that they were "short on time", and there still isn't a new, secure version available. This appears to be due to that recurring weak link in open source development: small teams, confronted by real life demands like time and money?

you are viewing a single comment's thread
view the rest of the comments

[–] scsi@lemm.ee 42 points 1 month ago (2 children)

A bit of backstory on how we got here - in June 2024 Mozilla chose to (a) integrate the source tree of Firefox Mobile into their huge monorepo ("gecko-dev"), and (b) move the source off of Github onto their own git servers ("Mozilla Central"). You can read about it in the now-archived old repo:

This was then compounded by a core Android build kit ("NDK") choosing to remove parts of the toolchain which is/was used to build Firefox releases (ergo, forcing another change to build process):

https://github.com/android/ndk/issues/2010

Together these have caused a bit of a kerfuffle in getting new releases compiled and released via the official F-Droid methodology. See the other comment about the Mull version in their private repo, they're having to use a Mozilla pre-built clang (a compiler toolchain) now to make it work for the time being.

[–] halm@leminal.space 6 points 1 month ago

Thanks for the context! Much appreciated.

[–] scsi@lemm.ee 1 points 1 month ago

Quick update for anyone still reading this thread:

@fdroidorg@floss.social As with any other app, we flagged Fennec and Mull with KnownVuln until the app is updated. Contributors fixed the issues that delayed versions 130 and later. Stand by for the build.

https://floss.social/@fdroidorg/113384089915217604