357
If, like me, you've relied on Fennec as a more tolerable version of Firefox for Android, you may have gotten some bad news in the latest F-droid update cycle.
Fennec has fallen so far behind on updates that serious security patches implemented by Mozilla in Firefox haven't been applied to the fork, and Fennec is therefore still breachable.
The developer responded two weeks ago that they were "short on time", and there still isn't a new, secure version available. This appears to be due to that recurring weak link in open source development: small teams, confronted by real life demands like time and money?
It's just very unfortunate timing. Google removed some library Firefox depended on in NDK and it meant developers need to make significant changes to their packaging system. At the same time critical vulnerably was discovered in Firefox. On top of that, everything happened when main developer of Fennec was away from home and short on time. But from what I've seen on Fennec gitlab most of the work is done so you should expect update soon.
Yep, it's this. Annoying change, but from what I was reading, perfectly solvable with a little time. Unfortunately the dev was moving house, so they fell a version behind at the worst possible moment, but they're aware of the issue. I'm not too concerned.
Had it not been for FDroid's warning, I wouldn't have even realized Fennec was a version behind (now 2). Normally it's not that big a deal.
Firefox 130 was released on the 3th of September, almost 2 months ago. This didn't just happen in a short time frame.
Fennec being a version behind for over a month because the dev was absent wouldn't normally be that big a deal if not for the vulnerability being discovered.