Firefox 68 ESR: what administrators need to know
Mozilla Firefox will be upgraded to version 68.0 next Tuesday. The new version is the base for the next Extended Support Release (ESR) version of the Firefox web browser. Organizations and home users who run Firefox ESR have until October 22, 2019 to upgrade to the new ESR versions.
Mozilla will release two additional updates for the soon-to-be-replaced version of Firefox ESR to give organizations enough time to test the new release and perform the upgrade.
Firefox 68.0 and Firefox ESR 68 share most features; there are, however, some differences between the two versions of the Firefox web browser.
Here is what is different and what has changed:
- No WebRender support. WebRender is still in development. Mozilla added WebRender support in Firefox 67 but enabled it only for a small number of Firefox users.
- System Certificates. Firefox uses its own certification store by default. Firefox ESR 68 uses the certificate store of the operating system by default, and not the Firefox certification store. Organizations who want to change that need to set the preference security.enterprise_roots.enabled to false on about:config or through other means.
- Man-in-the-Middle detection deactivated. Firefox 68 detects connection issues caused by man-in-the-middle interference; this detection is deactivated in Firefox ESR 68.0 because of the use of system certificates. Organizations need to set the preference security.certerrors.mitm.auto_enable_enterprise_roots to true to enable it.
- Service Workers disabled. Firefox ESR does not support Service Workers by default. The feature can be enabled if it is required. Admins need to set the preference dom.serviceWorkers.enabled to true to enable it.
- Push Notifications disabled. Similarly, push notifications are not enabled by default in Firefox ESR. Admins need to set the preference dom.push.enabled to true to enable the feature in Firefox ESR.
- Disable add-on signing requirement. Firefox ESR is the only release version of the Firefox web browser that supports the deactivation of the browser's add-on signing requirement. The feature is enabled by default. Admins may disable it by setting the preference xpinstall.signatures.required to false.
- SearchEngines Policy is ESR exclusive. Allows admins to set the default search engine.
- All other policies that were ESR exclusive in Firefox 60 ESR are not exclusive anymore.
- Legacy Profiles. Firefox ESR 68 supports the new one-profile per installation dedicated profiles directive of the Firefox web browser. Admins may set the variable MOZ_LEGACY_PROFILES to disable the feature.
- Downgrade protection. Firefox 67 and newer support downgrade protections to prevent issues caused by running downgraded versions of Firefox. Admins may set the variable MOZ_ALLOW_DOWNGRADE or run Firefox with --allow-downgrade to disable the functionality.
Firefox users who don't run the ESR version of the browser can set several of the options as well, e.g. to disable push notifications in Firefox or disable Service Workers.
Now You: Do you run Firefox, if so, which version and why? (via Sören Hentzschel)
I’m also still facing the issue of the Download File/Save Dialog box freezing when I try to create a new folder, or else change the view of the files or folders. I also tried the same procedure under Waterfox Current (which I believe is based on Firefox v70.) If I go to my Event Log in Windows, there is an Event ID 10010 and a DCOM timeout error for {3EEF301F-B596-4C0B-BD92-013BEAFCE793}, which I have learned is the Desktop Undo Manager. I’ve tried a new profile, reinstalling Firefox ESR, and turning on or off Hardware Acceleration – no difference.
I’m considering Pale Moon as an option, but I really would like to stick to Firefox ESR. But then what’s going to happen when the next ESR hits in late 2020? What changes are down the pipe?
Any suggestions on suppressing “Important News” on first launch. It is about:newinstall when a new version of the browser is launched the 1st time. I asked on https://support.mozilla.org/en-US/questions/1271296 and so far have not found a solution.
I just found out that FF ESR 68.0 sets two cookies that I can’t find anywhere else except when I run Ccleaner. That’s the only place (in Cleaner) I can see and delete them. And FF sets them back every time I run FF. Anyone has a solution to stop FF from setting them back?
Kinda late to the party but one of the things about CCleaner I never understood was the list of cookies it reported that couldn’t be found anywhere in the OS, browsers or any other utility. It appeared CC collected, then never deleted every cookie set, even after they were deleted outside CC. Possibly a ruse to make CC seem more valuable.
I quit worrying about them and after CC became a data collector, quit using it. Forced me to learn more about the OS, browsers and sytem level blockers, a good thing.
I upgraded to FireFox 68. Prior to that upgrade I have modified about:config to stop autoplay. After the upgrade, autoplay has returned. Sometimes I have to click pause/stop on Yahoo article videos multiple times now. It seems like every FireFox upgrade changes the way autoplay is handled. Why does this keep happening?
Hi;
I have been using firefox for 20 years. Your version 68 has serious bugs. An example of this is the
firefox security user ids and password file. It does not fill in the userid and password correctly for
any of the sites I regularly access. I restored my machine to an earlier date and now it works just fine again. I will not upgrade until you guys fix this and other things! Please do this soon, as I really love
using firefox.
Thank you.
I posted this same question in the Firefox 68 release information thread. Has anyone figured out a way to hide the Content Blocking Shield Icon from the address bar? I hate it. I like the idea of content blocking, but I don’t need to see the icon all of the time.
I have the shield blocked. Thanks to everyone for their help!
Appears that my UserChrome.css customizations for tab bar location DO NOT work. I indeed have toolkit.legacyUserProfileCustomizations.stylesheets set to “TRUE”, but tabs will not go below the address bar.
Never mind. I now understand that there were changes in Firefox 65 and higher. I obtained new userChrome.css code, and now it works.
I just received the update for 60.8 ESR, so I have to guess that ESR v68 is also being rolled out. Will I be offered it, or do I have to seek out v68?
Also if someone can aswer the WebRender question I have. Can v68 ESR be manually set to run on WebRender?
Jody, I don’t use ESR. According to Mozilla (https://www.mozilla.org/en-US/firefox/organizations/), ESR upgrades are only offered when version x.2.0 is out of the new version.
As far as WebRender is concerned, check for the existance of gfx.webrender.all. See https://www.ghacks.net/2019/05/20/firefox-webrender-rollout-begins-with-the-release-of-firefox-67/
Thank you Martin. That pref existed in v60 ESR as well, but was never enabled when I check about:support.
Thanks for the ESR info. :)
Ever since the certificate meltdown/debacle, I’ve been using the FF Developer edition, which just upgraded to 69. Apart from the persistent bookmarks on the bookmark toolbar randomly rearranging themselves (haven’t come across a sensible solution (sync?) – anyone?), I’m happy. I use Waterfox or SeaMonkey to use legacy add-ons since it became untenable to continue using 56.
“Do you run Firefox, if so, which version and why?”
I run Waterfox as my daily driver, because I can configure it to meet my needs and preferences, which I cannot do with the more recent versions of Firefox.
I’d been testing Firefox since the Quantum release in the hopes that it will become a better solution for me. That hasn’t happened yet (and, in many ways, Firefox is getting worse for me with every release).
Looking at the list of changes, I noticed:
“Disable add-on signing requirement. Firefox ESR is the only release version of the Firefox web browser that supports the deactivation of the browser’s add-on signing requirement. The feature is enabled by default. Admins may disable it by setting the preference xpinstall.signatures.required to false.”
Mozilla plans to offer a $5 per month “subscription-based ad-free Internet experience” version of Firefox.
The distinct possibility exists that, in non-ESR version of Firefox, they intend to disable ad-blocking extensions which would directly compete with those plans.
If you think that you might simply downgrade to an earlier version of the program, there’s this too:
“Downgrade protection. Firefox 67 and newer support downgrade protections to prevent issues caused by running downgraded versions of Firefox. Admins may set the variable MOZ_ALLOW_DOWNGRADE or run Firefox with –allow-downgrade to disable the functionality.”
That is, for now. Mozilla has a history of phasing out options and features in Firefox by first allowing them to be optional via about:config, then removing the preference from there in later versions.
Of course, such a move as I describe in all the above might lead to a massive bailout of end users and their migration to another browser.
Let’s hope I’m wrong about all this. Social engineering such as I speculate about here can backfire in a big way.
Remember Netscape?
Netscape wasn’t open-source. Also, if Mozilla blocks anti-malware extension like uBlock Origin, they are done. You really think Mozilla is taking the risk? And the downgrade protection does no apply to new installs. If you want to use an older version, just uninstall the current version and install the old one. There’s nothing that can prevent you from doing it.
hi martin.
thanks so much as always for your great articles.
i always pray for you, request divine especial mercy for you and appreciate your great efforts!
for your question i should say yes: the best browser in the universe for me is firefox and thanks God, after five years of using internet, i found the best version of firefox to keep and use it forever without updating anymore!
firefox 47 is the best version for me and remains the best forever.
i love it very much and there is no any essential feature or change in newer versions that i really need!
God bless you!
On win10, I run the release branch as of late, but will switch when esr 68 is released.
With debian linux, the default is the esr branch, and is stable. There, it is easy to just download the tarball of latest release and extract it to /opt. That way you get both esr and general release. (just use the -P command line switch with the first run to keep profiles straight). Nothing wrong with some variety.
ESR 60. Overall the ESR’s seem to run more smoothly than the release versions and most of the fluff (pocket, containers, etc. isn’t present.) Also, many of the privacy settings one would make on release versions have already been made. There are considerably fewer about: config settings present.
I moved to ESR a few versions ago when the release versions were plagued with botched updates and more and more junkware was being included resulting in overall rough browsing behavior.
I use Firefox ESR portable versions, as a backup browser to Chrome, for years. Current version : 60.7.2esr (64-bit)
I’m still on 66.03, waiting until the next “fully functional” version is released.
Mozilla has become like M$, it’s best to delay and wait for all the bugs to be worked out by others.
Firefox 67 is “fully functional”. If you have problems and you can’t solve these you should ask for help in a support forum. But you should never use an old browser with known security vulnerabilities, that’s just stupid.
@Max
The latest version of Firefox ESR has the same security patches as the most recent regular Firefox release. The major difference that main release version is getting new functions every 6-8 weeks, and ESR version every 1 year.
Firefox 67 is fully functional, but it is buggy. Most problems recently are caused by Fission project.
Isn’t that what Firefox Beta and Nightly are for?
@Hunter
I can see, that many bugs which are noticed in Nightly or Beta are still present in regular release version. So slowly I am getting the same conclusion as Dave that regular release (and first ESR cycles) is just Beta2. And ESR version after 2-3 cycles is getting cleaned from most bugs.
See that Webrender is introduced in FF67 for NVidia/Win10 and in FF68 for AMD/Win10, but it is not present in FF68 ESR. Why? Because is still buggy and not optimized (it is working, but it is using a lot of RAM and CPU).
Also Firefox 67 was really terrible with plenty different bugs causing data loss.
Maybe Mozilla should rename Firefox some versions? –
* Nightly => Alpha
* Beta => Beta
* release => Gamma
* ESR => release
:)
“what administrators need to know”
Asa Dotzler 2011
“Enterprise has never been (and I’ll argue, shouldn’t be) a focus of ours.”
Totally irrelevant because things change. Enterprise is a bigger focus since Firefox 60.
“Bigger focus” eh, that train had left the station waaaaay before Fx 60, as usual just talk.
Martin, thanks for the heads up regarding the new ESR version of Firefox!
I currently run Firefox ESR 60 as my primary browser, but I intend to upgrade to ESR 68 when it will be available.
Firefox releases only, no ESR because I prefer a small step for tranquility to a giant leap for worries.
At the very first release of Firefox Quantum I had switched to non-Quantum ESR in order to keep on using my legacy add-ons but found it far too cumbersome to jump to the next ESR with all the modifications at once. ESR only postpones the inevitable. Maybe worthy for companies but as a simple user I see no advantage, at least not for myself.
Can WebRenderer be enabled manually on v68 ESR? And be made to operate successfully?
Now (from a few weeks ago), my normal use browser is “Firefox ESR”.
The reason is the advantage of the unique features as described in this topic.
The performance of the ESR version is stable, and the fact that updates are limited to security support is also a relief material.
But I also use Developer Edition and Nightly build for the latest trends (test) and add-on collaboration.
It is depending on the situation, but, Tor browser, Waterfox, Pale Moon and Brave are also one of my favorites.
Postscript:
“ESR” is unsuitable for users who like the latest trends. However, for users who are cautious about those trends or needs for stability, it may be a better option than the Release (Stable) version.
ESR version is
Generally said to be for corporate use, but because quality (function and performance) management for that is established, it is also suitable for general use.
It is also advantageous in terms of privacy management (from the release version).
Soon, the ESR version will undergo a major upgrade (v60.x to v68.x), but it is possible to postpone implementation date for up to about three months (scheduled to October 23.2019).
So, it is also useful for users who are concerned about bugs.
ESR（Extended Support Release） FAQ
https://www.mozilla.org/en-US/firefox/organizations/