Mozilla deploys Firefox safety net for corporate mindreaders

Mozilla has pledged to update old versions of Firefox with security fixes, granting enterprises extra time to test and deploy major upgrades of the browser safe in the knowledge that vulnerabilities in existing installations will be patched. It's not clear which builds will fall onto Mozilla's safety net, however, so IT …

[Spanners]

Counter Intuitive

It would be logical to think that a large organisation would like faults fixed ASAP. After all, why would anyone want faults or security flaws any longer than necessary? You might also wonder why they would not want to make use of improvements to increase productivity.

If you wonder this, have a look at big corporations world wide (including my employer, They are the last users if IE6. Microsoft takes a lot of stick form the technically aware because they did not change it for years. This is because, despite all its flaws, MS is very aware what business wants and that is stability at any cost and this is what Microsoft is good at providing.

The rest of us just need to make sure that we do not install the corporate version of FF.

[Anonymous Coward]

It is not the stability of IE6 that keeps corporations using it, it's the fact that at the time they invested large sums of money in applications that make use of IE6's "enhanced" functionality, which newer browsers don't offer. Moving browsers in this case necessitates substantial expense in replacing these applications, and in some cases a newer version of the application may not even exist.

The moral here, if any, is not to put all of your eggs in one basket - unless you're certain that suitable alternative baskets will be available in the future, should the one you choose prove to have been made from poo and razor wire.

[Richard Lloyd]

How is it not clear which Firefox will be an ESR?

I'm perplexed here - the article seems to make out that no-one will know ahead of time which Firefox release will become an ESR, but then also says that Firefox 10 will be an ESR and there will be a new ESR every 54 weeks (which would be every 9 Firefox releases roughly - so Firefox 19 would be the following ESR and so on).

I'm also confused by the first commenter here who implies that Firefox ESR won't get bugs fixed quickly. The ESR releases will get incremental updates (e.g. 10.0.1 or whatever) which will be pushed out quickly if it's a critical fix.

Having said all that, I suspect only corporations will want the Firefox ESR release (because any non-security-related improvements - especially speed/snappiness - will be spaced a year apart) and those corps running Windows on their intranet are also going to want Group Policy options and MSI installers - 7 year old bugs in Mozilla's bugzilla that still have no resolution in sight...

[Al Jones]

ESR's one year apart won't help much - you'd start out with FF 10 in April '12, after 2 months testing, and then updates would stop in March 2013, with the release of FF19, but you wouldn't be able to deploy it until you'd had 2 months to test it.

Every 4th major release would make more sense, so that Enterprises could jump every 9 months, instead of every 6 weeks.

But you're right, we'll know that Mozilla is serious about Enterprise users when they include GPO support and MSI installers.

[Danvighar]

Agreed

Centralized patch and settings management FTW. I've got mandatory security configuration requirements to implement if I allow Firefox, and it's a dog to finetune and lock the relevant user settings.