135
Mozilla Now Offers an Official Firefox RPM Package for RPM-Based Linux Distros (9to5linux.com)
submitted 6 months ago by to c/linux@programming.dev
14 comments fedilink hide all child comments
 

Mozilla announced today in a blog post that it is now offering an RPM package of the Firefox open-source web browser for RPM-based GNU/Linux distributions, with an initial focus on the Firefox Nightly releases.

Mozilla already provided a DEB binary package for Debian-based systems, so they’re now offering the same native package installation of Firefox for RPM-based systems, making it a lot easier for users of RPM-based distributions to update their Firefox installations to the latest version on the day of the release.

Using the RPM package over the official binary package offers some benefits, such as better performance due to advanced compiler-based optimizations, hardened binaries with all security flags enabled, access to the latest Firefox releases as fast as possible, and you won’t have to create your own .desktop file anymore

you are viewing a single comment's thread
view the rest of the comments
[–] 22 points 6 months ago (3 children)

The Firefox Flatpak has much weaker isolation because the Flatpak sandbox interferes with the browser sandbox. This means a malicious site can compromise other sites and even the whole browser with a single exploit instead of the two normally required (which is a significant degradation in protection). The specific part blocked by Flatpak is user namespace sandboxing by Firefox. If you can help it, DO NOT install as Flatpak. Snap does not have this problem, but nobody likes Snap. Chromium has a similar problem as a Flatpak.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 6 months ago (1 child)

    Is this because everything runs as root inside Flatpak? Wouldn't it be possible to run as non-root inside Flatpak?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 10 points 6 months ago (1 child)

    No, nothing runs as root in a Flatpak. The problem is that Flatpak stops apps from using unprivileged user namespaces, which is used by all modern browsers to isolate web contents. Because the browser (Firefox) can't use namespaces, a malicious website can use a single exploit instead of needing to chain two separate exploits, making it significantly more likely to break the sandbox.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •