On Thu, 2016-01-07 at 13:48 -0700, Chris Murphy wrote:
OK well at this point it looks like the short term Fedora 24 time
frame choices are:
1. Firefox <current> which likely won't provide a code signing check
disable knob. But users still have the choice to download Firefox
or nightly, or developer versions which do have a know. Or install
Epiphany or Icecat.
2. Firefox ESR 45, which by default enforces signed extensions, but
has a knob to disable this. The download it is suggests ESR 45 for
life of Fedora 24 at least by default; the user would have to
install a different Firefox package to be on the current rolling
I have no real strong preference between 1 and 2. Both protect users
by default. Both provide an option for users to opt out of enforced
code signing checks.
There is also 5. Debian's Iceweasel, which is more similar to upstream
Firefox than Icecat. Icecat has some nice privacy features that we
probably want, but it also comes with LibreJS. I strongly recommend
against shipping LibreJS in our default web browser.
I think 2. Firefox ESR seems like the best option for F22 and F23. I
don't think that's a good option for F24; we should be shipping the
latest version of Firefox/Iceanimal going forward.