Re:OpenBSD won't update Firefox, advises users to switch to ESR
by progval on Tuesday January 14, 2020 @01:28PM
(#22047750)
> My users much prefer having working potentially unsafe software in the exceptional case where the software would connect to the network (eg reading a youtube stream in VLC or something like that) that non-working software.
Do they, though? Or are they just unaware of what "insecure" means?
Sure, if you frame it as "[technobabble about TLS certificates], click 'continue' to make the software work?", they'll chose the insecure-but-working option.
But if you frame it as "your Internet Service Provider, government, and possible third-parties may be notified you are watching this video, do you want to proceed?", some of them might think twice, depending on what country they live in and what the video is.
yet people have to ship microsoft DLLs left and right since behaviour sometimes still break. One breakage is enough to convince stakeholders to do that.
> When there is a vulnerability discovered in OpenSSL, every developer using it has to update their application instead of a library package maintainer doing it once, and if any application is no longer maintained (or just never updated to the latest version) it's now insecure indefinitely.
On the other hand, I had software who broke, as in, core features became unoperational due to openssl distro updates and changes of default policies. My users much prefer having working potentially unsafe software in the exceptional case where the software would connect to the network (eg reading a youtube stream in VLC or something like that) that non-working software.
> You don't have to ensure it works with every version ever made, only the one the distribution ships.
Which is "every version ever made" because people are still rocking Debian Wheezy or Ubuntu 12.04 and want to use my software