If, like me, you’ve relied on Fennec as a more tolerable version of Firefox for Android, you may have gotten some bad news in the latest F-droid update cycle.
Fennec has fallen so far behind on updates that serious security patches implemented by Mozilla in Firefox haven’t been applied to the fork, and Fennec is therefore still breachable.
The developer responded two weeks ago that they were “short on time”, and there still isn’t a new, secure version available. This appears to be due to that recurring weak link in open source development: small teams, confronted by real life demands like time and money?
A bit of backstory on how we got here - in June 2024 Mozilla chose to (a) integrate the source tree of Firefox Mobile into their huge monorepo (“gecko-dev”), and (b) move the source off of Github onto their own git servers (“Mozilla Central”). You can read about it in the now-archived old repo:
- https://github.com/mozilla-mobile/firefox-android
- https://github.com/mozilla-mobile/firefox-android/wiki#upcoming-migration-to-mozilla-central
This was then compounded by a core Android build kit (“NDK”) choosing to remove parts of the toolchain which is/was used to build Firefox releases (ergo, forcing another change to build process):
Together these have caused a bit of a kerfuffle in getting new releases compiled and released via the official F-Droid methodology. See the other comment about the Mull version in their private repo, they’re having to use a Mozilla pre-built clang (a compiler toolchain) now to make it work for the time being.
Quick update for anyone still reading this thread:
@fdroidorg@floss.social As with any other app, we flagged Fennec and Mull with KnownVuln until the app is updated. Contributors fixed the issues that delayed versions 130 and later. Stand by for the build.
