Mozilla deploys Firefox safety net for corporate mindreaders
Security fixes applied to as-yet-undisclosed older builds
Posted in Management, 11th January 2012 19:03 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Mozilla has pledged to update old versions of Firefox with security fixes, granting enterprises extra time to test and deploy major upgrades of the browser safe in the knowledge that vulnerabilities in existing installations will be patched.
It's not clear which builds will fall onto Mozilla's safety net, however, so IT departments are more or less left to bet on running the right versions on their corporate machines.
Announced on Tuesday, the Firefox Extended Support Release (ESR) will maintain builds of desktop Firefox for a period of 54 weeks, covering nine full releases of Mozilla's browser, the non-profit said.
Each ESR will be updated with point releases that will be limited to what Mozilla called "high-risk/impact security vulnerabilities" - those risks considered "critical" and "high". Functional enhancements and stability fixes in new point releases won't be back ported.
Once the 54 weeks is up, that's it according to Mozilla:
When an ESR reaches end-of-life, no further point releases or chemspill updates will be offered for that ESR, and an update to the latest supported version of the ESR (or Desktop Firefox, if the ESR for that platform is discontinued) will be offered to users of the end-of-lifed version.
The versions of Firefox that will qualify as ESRs is left to Mozilla's discretion. Based on the original ESR proposal, outlined by Mozilla vice-president of products Jay Sullivan here, it will be the non-profit that anoints the versions of Firefox that receives extended coverage. Sullivan's blog talks of an ESR period of 42 weeks but that has been pushed out 54 weeks under the finished plan.
Based on a handy chart, here and some accompanying text from Mozilla it does seem that ESRs will not accompany each version of Firefox. This means you will have to pre-empt Mozilla in picking the versions of Firefox considered important enough to qualify for ESR support.
Nobody from Mozilla was available to clarify this aspect of the ESR at the time of publication. ESRs will start with Firefox 10, currently in beta.
The ESR programme was introduced by Mozilla's Enterprise Working Group after the rapid release cycles seen in 2011 were criticised for not giving enterprises enough time to test new versions of Firefox with their apps, extensions and plug-ins.
At one point last year, one of Mozilla's top figures Asa Dotzler dismissed the importance of corporate users in response to disapproval from an adopter who'd spent months readying 500,000 corporate users for Firefox 4 when Mozilla released Firefox 5.
Mozilla chief executive Gary Kovacs subsequently tweeted that enterprise customers are important to Mozilla and Firefox. "Enterprises are built of people, and Mozilla is fundamentally about people. We support Firefox users wherever they are," he said. ®
Watch Now : Virtual Machine Movement with Hyper-V
COMMENTS
ESR's one year apart won't help much - you'd start out with FF 10 in April '12, after 2 months testing, and then updates would stop in March 2013, with the release of FF19, but you wouldn't be able to deploy it until you'd had 2 months to test it.
Every 4th major release would make more sense, so that Enterprises could jump every 9 months, instead of every 6 weeks.
But you're right, we'll know that Mozilla is serious about Enterprise users when they include GPO support and MSI installers.
Agreed
Centralized patch and settings management FTW. I've got mandatory security configuration requirements to implement if I allow Firefox, and it's a dog to finetune and lock the relevant user settings.
It is not the stability of IE6 that keeps corporations using it, it's the fact that at the time they invested large sums of money in applications that make use of IE6's "enhanced" functionality, which newer browsers don't offer. Moving browsers in this case necessitates substantial expense in replacing these applications, and in some cases a newer version of the application may not even exist.
The moral here, if any, is not to put all of your eggs in one basket - unless you're certain that suitable alternative baskets will be available in the future, should the one you choose prove to have been made from poo and razor wire.
How is it not clear which Firefox will be an ESR?
I'm perplexed here - the article seems to make out that no-one will know ahead of time which Firefox release will become an ESR, but then also says that Firefox 10 will be an ESR and there will be a new ESR every 54 weeks (which would be every 9 Firefox releases roughly - so Firefox 19 would be the following ESR and so on).
I'm also confused by the first commenter here who implies that Firefox ESR won't get bugs fixed quickly. The ESR releases will get incremental updates (e.g. 10.0.1 or whatever) which will be pushed out quickly if it's a critical fix.
Having said all that, I suspect only corporations will want the Firefox ESR release (because any non-security-related improvements - especially speed/snappiness - will be spaced a year apart) and those corps running Windows on their intranet are also going to want Group Policy options and MSI installers - 7 year old bugs in Mozilla's bugzilla that still have no resolution in sight...
Counter Intuitive
It would be logical to think that a large organisation would like faults fixed ASAP. After all, why would anyone want faults or security flaws any longer than necessary? You might also wonder why they would not want to make use of improvements to increase productivity.
If you wonder this, have a look at big corporations world wide (including my employer, They are the last users if IE6. Microsoft takes a lot of stick form the technically aware because they did not change it for years. This is because, despite all its flaws, MS is very aware what business wants and that is stability at any cost and this is what Microsoft is good at providing.
The rest of us just need to make sure that we do not install the corporate version of FF.
Enabling efficient data center monitoring
The new Office Garage series:
IT infrastructure monitoring strategies
