2

I'm on Debian and there are two options to use Firefox - either download it from mozilla.org or download from Debian repositories. What are the pros and cons of each way and which is preferred?

If there is be a vulnerability in the code, will those using the package manager be disadvantaged because they will receive the update later or everybody will receive it at the same time?

I know that Firefox can check for updates by itself so if I download it from repositories, will it download the update also from repositories (and I guess it may take a bit longer for the update to appear in the repos) or directly from Mozilla?

Improve this question
4
  • Mozilla maintains an official Debian repository so update should roll out to the repo and to their website pretty simultaneously. As of a general practice, it's better to fetch packages from official repos then from the website. The reason is that it's more secure and you would get any future updates automatically (because if you fetched it from the website you still have to download newer version manually). Download packages from the website only if you have a good reason for it (i.e. Vagrant package in Debian repos is usually very outdated, so I download it from Hashicorp website).
    – ddnomad
    Commented Apr 2, 2017 at 19:32
  • @ddnomad in Firefox’s case, you do get future updates automatically even with a “manual” download from the Mozilla website.
    – Stephen Kitt
    Commented Apr 2, 2017 at 19:44
  • @StephenKitt indeed, but it's not true for a lot of other packages
    – ddnomad
    Commented Apr 2, 2017 at 19:45
  • @ddnomad agreed (and you did say “as a general practice”), but I get the impression the OP is asking about Firefox specifically because of its ability to update itself.
    – Stephen Kitt
    Commented Apr 2, 2017 at 19:53

1 Answer 1

Reset to default
6

If you install Firefox in Debian 8 from the Debian repositories, you’ll get the latest version of the ESR 45 release. Updates tend to be available in the Debian security repositories pretty much at the same time as they’re made available for auto-updates in the ESR channels used by Firefox itself; the latest release, 45.8, was uploaded to Debian and released to the Firefox update channels on March 7 2017.

In Debian 9, you’ll get the latest ESR, whichever that is (Firefox is one of the packages where major version bumps are allowed into the stable release); as of early 2019, that’s 60.3, with 60.5 coming soon.

If you install Firefox from Mozilla, you’ll probably get the latest non-ESR release instead. You can also get this as a Debian package from the Debian testing and unstable repositories, as the firefox package.

If you’re the only user on your system, I’m not sure there are many pros or cons. One big advantage of using a package to install your browser is that it can then satisfy the various dependencies from other parts of the system (e.g. your desktop environment). If you stick to the “stable” packages, you’ll get security support without any habit-changing updates; whether that’s a pro or a con depends on what you’re looking for. Other than that, security-wise both approaches are similar (for single user systems, again); note in particular that the Debian Firefox packages are maintained by a Mozilla employee (both in the main repositories and in the Debian Mozilla repositories).

Improve this answer
4
  • Thanks! You also mentioned that it depends whether I'm the only user on the system. Why does it matter? Doesn't installing a program from package manager install it only for the current user?
    – yeti
    Commented Apr 2, 2017 at 19:10
  • 3
    No, installing a program from the package manager installs it for everyone (and updates are available for everyone). If you manually install Firefox from mozilla.org, and make it available for everyone, it won’t be able to update itself (unless you make it world-writeable which is probably not a good idea).
    – Stephen Kitt
    Commented Apr 2, 2017 at 19:13
  • Debian Mozilla repos: "I am running Debian [Jessie] and I want to install [Firefox] version [Release] » Sorry, this version is not available."
    – sourcejedi
    Commented Apr 2, 2017 at 21:00
  • @sourcejedi yes, only the ESRs are packaged for Jessie (but 52 ESR is very recent).
    – Stephen Kitt
    Commented Apr 3, 2017 at 4:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .