The Fennec Android browser is currently behind on Firefox security updates, deemed unsafe by F-droid

Comments

• hypertown@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  It’s just very unfortunate timing. Google removed some library Firefox depended on in NDK and it meant developers need to make significant changes to their packaging system. At the same time critical vulnerably was discovered in Firefox. On top of that, everything happened when main developer of Fennec was away from home and short on time. But from what I’ve seen on Fennec gitlab most of the work is done so you should expect update soon.

  source

  • doctortran@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

    Yep, it’s this. Unfortunate but from what I was reading, solvable with a little time. Unfortunately the dev has been unavailable but will be back soon. I’m not too concerned

    source
  • Nonononoki@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Firefox 130 was released on the 3th of September, almost 2 months ago. This didn’t just happen in a short time frame.

    source

    • doctortran@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

      Fennec being a version behind for over a month because the dev was absent wouldn’t normally be that big a deal if not for the vulnerability being discovered.

      source
• brsrklf@jlai.lu ⁨3⁩ ⁨weeks⁩ ago

  What do you find not tolerable in standard Firefox and what did this browser do that made it better?

  I know firefox is rather memory heavy, but despite that it’s still my go-to browser, both for desktop and mobile.

  source

  • AnyOldName3@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Upstream Firefox doesn’t comply with FDroid’s rules (thanks to the ‘proprietary bits and telemetry’ Handles mentioned), so is only available from the Play Store or as a loose APK that won’t auto-update.

    source

    • noodlejetski@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

      it’s also available from Mozilla’s repos and can be updated using Obtainium download.cdn.mozilla.net/pub/fenix/releases/

      source

      • -> View More Comments
    • deegeese@sopuli.xyz ⁨3⁩ ⁨weeks⁩ ago

      This reads like “they only sell hamburgers at the grocery store, and they don’t sell veggie burgers at the hippie food store because they aren’t vegan”

      source
    • pewgar_seemsimandroid@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago

      obtanium?

      source
  • halm@leminal.space ⁨3⁩ ⁨weeks⁩ ago

    I think this is beside the point here, but as it says in the F-droid description, their build “has proprietary bits and telemetry removed”.

    source
• scsi@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

  A bit of backstory on how we got here - in June 2024 Mozilla chose to (a) integrate the source tree of Firefox Mobile into their huge monorepo (“gecko-dev”), and (b) move the source off of Github onto their own git servers (“Mozilla Central”). You can read about it in the now-archived old repo:

  • github.com/mozilla-mobile/firefox-android
  • github.com/mozilla-mobile/firefox-android/wiki#up…

  This was then compounded by a core Android build kit (“NDK”) choosing to remove parts of the toolchain which is/was used to build Firefox releases (ergo, forcing another change to build process):

  • github.com/android/ndk/issues/2010

  Together these have caused a bit of a kerfuffle in getting new releases compiled and released via the official F-Droid methodology. See the other comment about the Mull version in their private repo, they’re having to use a Mozilla pre-built clang (a compiler toolchain) now to make it work for the time being.

  source

  • halm@leminal.space ⁨3⁩ ⁨weeks⁩ ago

    Thanks for the context! Much appreciated.

    source
  • scsi@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

    Quick update for anyone still reading this thread:

    @fdroidorg@floss.social As with any other app, we flagged Fennec and Mull with KnownVuln until the app is updated. Contributors fixed the issues that delayed versions 130 and later. Stand by for the build.

    floss.social/@fdroidorg/113384089915217604

    source
• gaylord_fartmaster@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  I’ll just throw out Mull from DivestOS’s third-party f-droid repo as an up to date alternative. The newest versions are incompatible with the main repo but here is their explanation:

  Updated Mull to 131.0.0, has 14+1+25 security fixes from the previous 129.0.2 release. In order to resolve the compilation issue introduced in 130, Mull is now compiled using Mozilla’s prebuilt clang toolchain. This however is incompatible with the F-Droid.org inclusion criteria, so these updates (for now at least) will only be available via the DivestOS.org F-Droid repository. Please note, while this adds a prebuilt dependency, the result does still remain FOSS.

  source

  • halm@leminal.space ⁨3⁩ ⁨weeks⁩ ago

    Ah yes, the toolchain changes appear to be a stumbling stone for the Fennec devs as well. That kind of thing doesn’t exactly speed up new releases, I’m sure.

    What are your experiences with Mull? Is it generally compatible with Firefox plugins, and are there performance improvements as well as in security?

    source

    • iturnedintoanewt@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

      IMHO as i have it as my daily browser, it can become troublesome with booking websites (flights, tickets, hotels, restaurant orders, shopping). They don’t like whatever Mull blocks, and at some point during any booking process you’ll be unable to complete it. Sometimes during the payment step, so it can be… Frustrating.

      source

      • -> View More Comments
    • airglow@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      Mull has defaults that improve privacy at the cost of performance and compatibility. They maintain a list of changes that you can reverse through about:config. If Mull seems slow for you, consider re-enabling the JavaScript JIT.

      source
    • gaylord_fartmaster@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      I’ve been using it as my primary browser on Android for years so I don’t really have much to compare it to, but I haven’t had any issues with extension compatibility. It includes changes from Tor browser and Arkenfox so it’s more privacy-focused than on performance.

      source
  • doctortran@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

    The only reason the Fennec devs haven’t announced the same thing is that they’ve been moving but they’re basically working on the same things to get it back on F Droid

    source
  • scsi@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

    The link(s) to add their F-Droid repo if not running DivestOS: divestos.org/pages/our_apps.html#repos

    source

    • burgersc12@mander.xyz ⁨3⁩ ⁨weeks⁩ ago

      Been using Mull, didn’t realize there was newer versions, thanks for the link!

      source
• SaharaMaleikuhm@feddit.org ⁨3⁩ ⁨weeks⁩ ago

  more tolerable version

  It doesn’t even get updates. What are you on about? 😂

  source
• ColdWater@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

  If you want an up-to-date Firefox fork Waterfox is actually available on Android

  source

  • halm@leminal.space ⁨3⁩ ⁨weeks⁩ ago

    Didn’t even know there was a Waterfox for android, good to know.

    source

    • ColdWater@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

      I’m also surprised when I saw it on their website

      source
• s08nlql9@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

  FDroid just posted mastodon.social/…/113384090474799527

  source

  • halm@leminal.space ⁨3⁩ ⁨weeks⁩ ago

    Cool cool, glad to see I may have jumped the gun. But I had cause to try a couple other Firefoxes (Nightly Beta and Mull) in the meantime!

    Now I’ll just be refreshing F-Droid every five minutes until the update comes through 😄

    source
• s08nlql9@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

  For those who want to install standard FF via Obtainium use this:

  download.cdn.mozilla.net/pub/fenix/releases/

  Then add intermediate links

  [0-9]+\.[0-9]+/$
  
  android/$
  
  fenix-[0-9]+\.[0-9]+-android-arm64-v8a/$
  

  source
• mariusafa@lemmy.sdf.org ⁨3⁩ ⁨weeks⁩ ago

  Same, I just switched to mull. Use FFupdater

  source
• jaaaardvark@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

  Is there a way to transfer my browser profile on Android?

  source

  • xan@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago

    Firefox sync? You’ll get bookmarks at least

    source
• cmgvd3lw@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago

  I have Mull installed f-droid.org/…/us.spotco.fennec_dos_21290220.apk

  Should I uninstall?

  Is there any way to export bookmarks from mull, so that I can uninstall it?

  source

  • allan@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    There are newer builds sooner in the divestos repository divestos.org/pages/our_apps#repos

    source
  • doctortran@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

    Honestly, just wait a little bit, both Fennec and Mull will get it sorted soon and you’ll see an update. If the vulnerability is worrying you that much, I’d honestly just download the standard Firefox APK for the time being and use it while waiting on Mull to update on fdroid. It likely won’t be more than a couple days.

    source
  • Teknikal@eviltoast.org ⁨3⁩ ⁨weeks⁩ ago

    I used the Mozilla account sync thing that’s built in but it didn’t restore the extensions, bookmarks and passwords seem to have copied over to the DivestOS one though.

    source
• hendrik@palaver.p3x.de ⁨3⁩ ⁨weeks⁩ ago

  I got the same warning for Mull. Is the patching so extensive? I always thought they have a patchset and just apply that onto the newest Firefox version... Or do they do a full code review on all of the changes?

  source
• finitebanjo@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  More specifically Google made it difficult to update, if I am not mistaken?

  source

  • TeddE@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    I could be mistaken, but since it’s a Mozilla base code and F-Droid distribution chain, I’m not sure where Google can stick it’s thumb in the pie.

    source

    • finitebanjo@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      Mozilla relied on an Android NDK to build correctly, became no longer available right as a firefox vulnerability came out and the Fennec dev was away from home.

      source
• Evil_Shrubbery@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

  “It’s fine” (or will be), just donate & carry on.

  source

  • RecluseRamble@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

    Dangerous attitude when it comes to itsec.

    source

    • Evil_Shrubbery@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

      I know (& agree), I was saying it like exposing my flaw of laziness.

      source
• 96VXb9ktTjFnRi@feddit.nl ⁨3⁩ ⁨weeks⁩ ago

  I’ve been using Fennec. Any one got advise on what would be the best alternative? And please explain why.

  source

  • Nalivai@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    What were its advanta over Firefox?

    source

    • xan@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago

      Fennec F-Droid

      • removes ff telemetry,
      • allows about:config changes,
      • you can enable dev mode for your own extension collection

      source
    • nossaquesapao@lemmy.eco.br ⁨3⁩ ⁨weeks⁩ ago

      Being installable directly from fdroid was what made me use it.

      source

      • -> View More Comments
  • abofim@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago

    Mull browser is also available on fdroid. It is an even better (secure) alternative to firefox as it uses some of tor architecture, from what I know.

    source

    • pineapplelover@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

      I don’t know about tor architecture but it is more hardened

      source
  • doctortran@lemm.ee ⁨3⁩ ⁨weeks⁩ ago

    There’s really no reason to go scrambling for an alternative, it’s a temporary problem.

    source
  • finitebanjo@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    You can update Fennec I heard, just not through the regular means.

    source