Firefox's massive overhaul moves to beta

This is exactly the reason why you should never use built in PDF readers:

https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/

 

yeah I always disable built in pdf readers.

 

The most popular PDF app, Adobe Reader, is not an example of a safe app either.

 

Is a built-in PDF reader inherently less safe than a standalone reader?

 

Not always. Given example, Firefox's built-in PDFViewer is certainly -- now that latest 39.0.3 has fixed a flaw -- much, much, much safer than Adobe's PDF Reader. Speaking of Adobe, a cup of coffee for who tells me if there is an Adobe application that is safe, or rather that is not unsafe.

 

Who in their right mind uses Adobe anyway. They did implement a sandbox though, which should make it harder to exploit.

Not necessarily, but this bug in Firefox was quite serious. The good news is that with SBIE you can restrict browsers from getting access to your private or most important data.

 

I don't know about elsewhere but I can tell you that the number of sites here in France, Administration included!, that tie a PDF file to Adobe Reader is amazing. Like you have your PDF file ready and the site ads "Adobe Reader required to read your fie. Download here etc...". Even on top-notch sites, a beginner will download/install Adobe Reader because the site did not state "You need a PDF reader to view the file" but "You need Adobe Reader". Now, is this plain stupidity, inherited from computer schools academic short-sight ("You'll use IE for browsing and Adobe for PDF...) or merely a contractual relation to Adobe, no idea. But it is a pain. PDF is not an Adobe propriety format, let it be said and repeated. You guys know that anyway. Just mentioning it for a Sunday afternoon visitor (Hi, there!).

Please carry on

 

Yes good point.

 

I believe it's just a holdover from the days when PDF was a proprietary format controlled by Adobe (see Wikipedia). It became an open standard in 2008 and of course now there are many free PDF readers (and printers)...but we digress...

 

I don't know who would, I install Sumatra on any Windows PC I set up, but the point was that being a desktop app doesn't make it safe.

 

Here is some more info about Firefox's PDF reader vulnerability:

http://www.welivesecurity.com/2015/08/11/firefox-under-fire-anatomy-of-latest-0-day-attack/

 

I uninstalled Adobe's reader on Windows years ago. For a while I used PDF-XC, but now I too use Sumatra and have even replaced Adobe with it on relative's machines. Nobody needs Adobe.

 

Mozilla’s self-destruct course continues: major add-on compatibility changes announced (by ghacks)

 

https://blog.mozilla.org/addons/2015/08/21/the-future-of-developing-firefox-add-ons/

 

From the ghacks article

I have a few unsigned addons I cant do without, so I will be staying at the last release of Firefox that supports unsigned addons.

Logitech Setpoint (Smooth scrolling of Logitech mouse)
HTTPS Finder
HTTPS Everywhere (Available at AMO too)
Random Agent Spoofer (The full version from Github)
Privacy Badger
Webroot Password Manager

 

The decisions is yours. However, anyone who thinks they might end up in such a position would be wise to consider other potential options such as:

1. The unbranded release build, if it ever materializes and is available to your locale
2. The ESR/Enterprise solution, if it ever materializes and is workable in your environment
   
3. Another Mozilla based browser.

The first two had potential... may still have some potential... but I think more people need to explicitly show an interest. As in try to politely, but very firmly, pressure Mozilla into following through and releasing decent alternatives. This also has bearing on #3, because as Mozilla guts their code base for Firefox, others who build from that code base are affected. So:

https://lists.mozilla.org/listinfo/addons-user-experience
https://mail.mozilla.org/listinfo/enterprise

and any other angles you can think of. Especially if it is in meat space.

 

HTTPS Everywhere is now signed.

 

I will probably move onto Waterfox/Palemoon if they allow unsigned addons. Anyone using Icecat?

Yeah, noticed now.