News for hackers. Stuff that matters.
Re:Arbitrary code execution through unsanitized browser UI by forgotmypw on Wednesday January 31, 2018 @05:53PM (#16278304)
Are any of these fixes being backported to 56.x? I am not ready to upgrade to 57+ yet.
Re:Arbitrary code execution through unsanitized browser UI by orf on Wednesday January 31, 2018 @06:12PM (#16278425)
Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it.

Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.

Re:Arbitrary code execution through unsanitized browser UI by pjmlp on Thursday February 01, 2018 @12:52AM (#16279860)
Here is one sad reason.

Customer controlled environment, where the only browsers are IE 11 and FF ESR, and having Chrome is considered security violation, because their IT cannot control it the same way.

Re:Arbitrary code execution through unsanitized browser UI by bugmen0t on Thursday February 01, 2018 @04:49AM (#16280612)
ESR is 52. There is absolutely no good reason to use anything but ESR or the properly maintained version. It will only get you into trouble.
Re:Arbitrary code execution through unsanitized browser UI by danjoc on Wednesday January 31, 2018 @07:06PM (#16278717)
>Immediately stop using 56, downgrade to the LTS or upgrade to 57

58 is the fixed version.

>I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason.

That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people clinging to 56/52 like debris from a shipwreck. Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this.

Re:Arbitrary code execution through unsanitized browser UI by mastax on Wednesday January 31, 2018 @07:27PM (#16278809)
> 58 is the fixed version.

FTA: This issue did not affect Firefox for Android or Firefox 52 ESR.

> That's because 57 was a complete dumpster fire.

I disagree.

> It broke all the add ons.

Yes, it did. They probably should've made 56 an ESR.

> Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this.

They must not be doing a very good job, since I've seen the death of long-loved addons mentioned in every Firefox thread on HN for years.

Re:Arbitrary code execution through unsanitized browser UI by blacksmith_tb on Wednesday January 31, 2018 @07:22PM (#16278786)
It broke add-ons that weren't being maintained, primarily. It's true that for some users, this would be very unpleasant, but I have five extensions working fine here in 59.0b5 (including important security/usability ones like uBlock Origin and Stylus).
Re:Arbitrary code execution through unsanitized browser UI by Khoth on Thursday February 01, 2018 @05:05AM (#16280675)
That's not my experience. The addons I use that it broke were all being maintained, but FF57 didn't provide any API to replace what they were using before, so their authors reluctantly abandoned them or provided limited, crippled versions that don't work properly.
Re:Arbitrary code execution through unsanitized browser UI by geofft on Thursday February 01, 2018 @12:29AM (#16279798)
Clinging to 52 ESR until August 28 is fine. That's what it's there for.

Clinging to 56 is ... well, it's your decision to use what software you want, that's what free software is all about, but since half the point of the changes in 57 was improved security architecture, clinging to 56 and expecting fixes for security bugs seems ill-advised.

Re:Arbitrary code execution through unsanitized browser UI by JohnTHaller on Wednesday January 31, 2018 @06:05PM (#16278376)
Use Firefox ESR 52.x. Firefox 56 is insecure and should not be used: https://www.mozilla.org/en-US/security/known-vulnerabilities...
Re:Arbitrary code execution through unsanitized browser UI by moosingin3space on Wednesday January 31, 2018 @09:59PM (#16279379)
56 will never get backported security fixes of any kind. For the record, neither will 57, as 58 is the current stable version. Mozilla does not apply security fixes to versions of Firefox other than the latest stable and the latest ESR.