F-Droid

hideshow 4 child comments

[–] SatyrSack@feddit.org 11 points 2 years ago (3 children)

The issue preventing updates should be resolved soon thanks to @linsui fixing it!

What is wrong with updating?

parent

[–] WhyJiffie@sh.itjust.works 23 points 2 years ago (2 children)

it was mentioned in a This Week In F-droid blog post around September. basically google fucked up an important development library, and any firefox forks (possibly some other apps too) could not be built anymore normally. of course google was unwilling to fix the issue, so linsui (and F-droid member) fixed the build process somehow, possibly temporarily.

you may ask how is this not a problem for the official release of the firefox app, and my answer is that they probably build this component for themselves, and fixed the problem in house (if they had it at all)

parent

[–] SatyrSack@feddit.org 4 points 2 years ago (1 child)

Right, but that comment that I quoted from the F-Droid forum makes it sound like there is some sort of issue updating to a build with the vulnerability patched. My Mull is on 131.0.3, and I do not remember having an issue updating it.

parent

[–] N4CHEM@lemmy.ml 12 points 2 years ago

You're probably getting your Mull updates via the DivestOS repository, not the official F-Droid repository.

parent

[–] N4CHEM@lemmy.ml 47 points 2 years ago*

There was a critical vulnerability found on Firefox some days ago: CVE-2024-9680. Fennec and Mull are forks of Firefox. They both fixed this issue already in their source code, BUT there is a problem preventing F-Droid from building these updated, fixed versions.

In the case of Mull, you can download the updated version from the DivestOS F-Droid repository: https://divestos.org/fdroid/official/, but if you are currently using the F-Droid version you will need to uninstall it first, since they have different signatures.

[–] Kajika@lemmy.ml 34 points 2 years ago* (last edited 2 years ago)

The current version has a critical security vulnerability (https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/) but to fix it the new version compiled against libclang version 27 but Google decided to remove it from Android so the building pipeline needs to be adjusted.

There's a long discussion: https://gitlab.com/relan/fennecbuild/-/merge_requests/63 , about building the newer version

In the meanwhile the app is a security hazard.

[–] mac@lemm.ee 25 points 2 years ago* (last edited 2 years ago)

There should really be push notifications around installed apps with known vulns... Its tracked here: https://forum.f-droid.org/t/vulnerability-warnings-in-f-droid-app/20505

Could someone with a gitlab account open a feature request on the f droid repo?

I tried to open an account but it required email + cell phone (it picked up my VoIP number) and a credit card....

EDIT: I generated an RSS feed based off of Mozilla's known vuln list. If anyone knows of a better way to do this, please let me know!

[–] Quintus@lemmy.ml 21 points 2 years ago (6 children)

Are these two from the same maintainer? If not, considering that they both use Firefox Android as their base, does this mean there is a vulnerability in Firefox Android?

hideshow 6 child comments

[–] Piwix@lemm.ee 36 points 2 years ago (1 child)

There was and it was fixed by the looks of it. Guessing these apps have not urgently pulled the fixes in and released an update, so F-droid is urging people not to use the apps until so

parent

[–] WhyJiffie@sh.itjust.works 11 points 2 years ago

they pulled the fixes, but couldn't build because google fucked up the NDK. my other comment has more details

parent

[–] kitnaht@lemmy.world 21 points 2 years ago* (last edited 2 years ago) (3 children)

Yes, there was a remote code execution vulnerability in the CSS engine of firefox a little while ago. If you're on desktop version 131 or lower, update to 131.0.3 when possible. I don't know how the versioning works for the Android versions here...

parent

[–] Redjard@lemmy.dbzer0.com 11 points 2 years ago (2 children)

173? What happened to firefox versions? We just started the 130s

parent

https://nvd.nist.gov/vuln/detail/CVE-2024-9680

[–] kitnaht@lemmy.world 13 points 2 years ago* (1 child)

shit, woops. I've got memory issues, my bad. Let me fix that rq. Thanks for catching it.

parent

[–] Redjard@lemmy.dbzer0.com 9 points 2 years ago

Yeah that seems about right.

I don't know how the versioning works for the Android versions here...

Android has the same versions as desktop here, which is why there is no differentiation. The main chunk of firefox is platform independent (and even used in thunderbird too).

So any firefox android app and fork thereof needs that version 131.0.3+ too (unless it is esr which is 128 currently).

parent

[+] ma1w4re@lemm.ee 13 points 2 years ago* (last edited 1 year ago)

[deleted]

[+] orcrist@lemm.ee 10 points 2 years ago* (last edited 1 year ago) (2 children)

[deleted]

[–] N4CHEM@lemmy.ml 19 points 2 years ago*

You can download an updated version of Mull with the security vulnerability fixed, from the DivestOS F-Droid repository: https://divestos.org/fdroid/official/. If you currently have the F-Droid version of Mull installed you will need to uninstall it first.

parent

[–] 3dogsinatrenchcoat@slrpnk.net 9 points 2 years ago

You can get the updated mull from the divestos repo, the issue is fixed there

parent

[–] DishonestBirb@lemmy.world 9 points 2 years ago* (20 children)

Uninstalling my primary browser isn't really a practical solution, what am I supposed to use, Chrome? How about fixing the version they're shipping? Or should I be looking somewhere other than F-Droid for Android Firefox?

hideshow 20 child comments

[–] cyberwolfie@lemmy.ml 13 points 2 years ago* (3 children)

I changed to the Divest-repo for Mull, and they have an updated version that has fixed these security issues.

ETA: Different signing keys though, so you can't just update it, but have to reinstall.

parent

[–] Moah@lemmy.blahaj.zone 2 points 2 years ago (2 children)

How do you do that?

parent

[–] cyberwolfie@lemmy.ml 4 points 2 years ago (1 child)

You add https://divestos.org/apks/official/fdroid/repo/ as a repo in F-Droid settings. After that you can choose which repo to prefer for Mull.

parent

[–] Moah@lemmy.blahaj.zone 2 points 2 years ago

Thank you

parent

[–] kazaika@lemmy.world 11 points 2 years ago (4 children)

Theyre the distributor, the dont fix apps and its not their job to do so. Getting the same app from a different source wont change anything

hideshow 4 child comments

parent

[–] Swedneck@discuss.tchncs.de 5 points 2 years ago (3 children)

huh? no one's asking them to fix firefox, we're asking that they just ship the latest version.

the warning states that several vulnerabilities have been fixed since firefox version 130, f-droid's latest version of the package is 129: that very much makes it sound like the problem is wholly caused by f-droid not making version 130 available.

parent

[–] AlpacaChariot@lemmy.world 6 points 2 years ago

To ship it they have to work out how to build that version themselves from source though - that's their whole thing. It's not like a normal app store where they take pre-built binaries from the developer.

parent

[–] kazaika@lemmy.world 2 points 2 years ago

Well ok if thats the case you are completely right, as long as there isnt some kind of issue and others have already updated the package pushing security fixes asap is indeod important

https://f-droid.org/packages/de.marmaro.krt.ffupdater/

parent

load more comments (1 reply)

[–] ace_garp@lemmy.world 3 points 2 years ago

Iceraven is a Mozilla based standin.

Can install FFUpdater here:

and then select it from there.

parent

[–] victorz@lemmy.world 2 points 2 years ago (8 children)

I just install Firefox from the Play Store. 🤷‍♂️ Is that bad?

hideshow 8 child comments

parent

[–] x00z@lemmy.world 8 points 2 years ago (7 children)

Yes

hideshow 7 child comments

parent

[–] victorz@lemmy.world 5 points 2 years ago (6 children)

Why?

hideshow 6 child comments

parent

[–] x00z@lemmy.world 1 point 2 years ago (5 children)

Goggle bad :^)

hideshow 5 child comments

parent

[–] victorz@lemmy.world 3 points 2 years ago (4 children)

But Firefox good..? Serious replies only please, I really am curious.

hideshow 4 child comments

parent

[–] abbenm@lemmy.ml 2 points 2 years ago (1 child)

But Firefox good…?

Yes! They are the most important alternative to major corporate backed browsers, helping sustain a diversified browser ecosystem so that no one company can monopolize the web, and push it toward standards that reinforce their monopoly. Google has tried to lock down the phone, app market, browsing experience that sustains their ad networks, and regularly pushes new standards that de-emphasize things like RSS, and that break ad blocking functionality to sustain their monopoly and invade privacy.

Firefox reverses or mitigates most of those and are explicitly driven by a mission of sustaining an open web with standards that don't bend the web to corporate dominance. Google's cheeky dont be evil mantra was in reference to exactly the things they are doing now, and it's a little too on the nose to their actual behavior so it's no longer a slogan of theirs, cheeky or otherwise.

parent

load more comments (1 reply)

load more comments (2 replies)

load more comments (1 reply)

[–] GolfNovemberUniform@lemmy.ml 6 points 2 years ago (3 children)

It doesn't say anything like that in Droid-ify. I don't remember any recent reports of vulnerabilities either.