cross-posted from: https://leminal.space/post/11699480
If, like me, you’ve relied on Fennec as a more tolerable version of Firefox for Android, you may have gotten some bad news in the latest F-droid update cycle.
Fennec has fallen so far behind on updates that serious security patches implemented by Mozilla in Firefox haven’t been applied to the fork, and Fennec is therefore still breachable.
The developer responded two weeks ago that they were “short on time”, and there still isn’t a new, secure version available. This appears to be due to that recurring weak link in open source development: small teams, confronted by real life demands like time and money?
If they’re short on volunteer time to merge new Firefox work then you can either wait until they have time or do the update work yourself and submit pull requests. Calling them out for not volunteering fast enough isn’t terribly helpful.
I’m not trying to call out anybody, just informing Fennec users who may not yet be aware of the issue. In fact, rather than blaming the developer I pointed to the larger problem of small (and, I assume, underfunded) teams.
If I could contribute to the update, I would, but I’m not a programmer. I wouldn’t trust myself with that kind of work, and neither should you.