Facts about Debian, Mozilla® Firefox® and Ubuntu

or How Mozilla® Corporation is FUDing on Debian. Again.

This time, Christopher Beard, Mr Mozilla® Marketing is talking about Firefox® in Ubuntu, that it's great, Ubuntu is a good boy, that it cooperates with Mozilla®, and that by cooperating, it can use the great Firefox® name and logo.

To be honest, I don't care that Ubuntu calls Firefox® Firefox® instead of Iceweasel or whatever. I don't care that Ubuntu doesn't care about freedom as much as Debian does. I could not care less.

But, indeed, I do care about (yet other) false claims about Firefox® in Debian.

Let's see what Christopher has to say about it:

I understand that Ubuntu is based upon Debian. Is that the same or different than the IceWeasel browser that Debian is shipping with their latest release?
It's different. The patches that Debian applied to the Mozilla source code (which then resulted in their IceWeasel product) are more significant in scope than those in what Ubuntu is shipping (and branding as an official Mozilla Firefox release). Firefox in Ubuntu represents a somewhat more modest set of divergences from original Mozilla source code.

Let's check out what it is about. And as I don't want people to doubt my words, I'll give you, readers, the ability to check for yourself what it is all about.

First, please download the latest currently available patch for Firefox® 2.0 beta 2 in Debian. It has been in experimental for some weeks now. It is a bit different from the patch I described earlier, so I'll also tell you what has been changed since this 2.0b2 patch:

  • security/coreconf/rules.mk is not patched for the perl dependencies thing any more because the patch (taken from bugzilla #325148) has been applied in Firefox® 2.0rc1
  • The patch from bugzilla #336056 has been applied because the directory in which we would build the 2.0rc1 version contained a ~ character, which would make the build fail because of this bug.
  • The patch from bugzilla #294879 has been applied for obvious reasons. It has been applied later in the Firefox® 2.0 release process.

(Also note that another change has been done since then, which is actually reverting a previous patch on gfx/src/gtk/mozilla-decoder.cpp, that was adding code that became dead code when we changed the way to fix the bug.)

Next, please download the official and supported Firefox® diff from Ubuntu.

Uncompress both these diff files, and create two directories (let's call them ubuntudiff and debdiff) which will contain the individual patches for each file. To fill these directories, please use the following commands:

$ filterdiff --strip=1 firefox_2.0+0dfsg-0ubuntu3.diff > ubuntu.diff
$ filterdiff --strip=1 firefox_1.99+2.0b2+dfsg-1.diff > deb.diff
$ cd ubuntudiff
$ splitdiff -d -a ../ubuntu.diff
$ cd ../debdiff
$ splitdiff -d -a ../deb.diff

If you don't have the splitdiff and filterdiff utilities, you can get them from the patchutils tools (you will also need another of these tools later).

Now, let's have fun with these split patches...

Files that are only patched in Debian: (excluding any file that would be in the debian subdirectory, that contains maintainer scripts for build and installation)

$ LANG=C diff -ru debdiff/ ubuntudiff/ | grep "^Only in deb" | grep -v debian | wc -l
6

So, that's 6 files that Debian patches that Ubuntu doesn't. Let's check what they are:

$ LANG=C diff -ru debdiff/ ubuntudiff/ | grep "^Only in deb" | grep -v debian

(reordering result for convenience)

Only in debdiff/: browser_base_content_aboutDialog.xul

Adds rows=5 to the user agent textbox so as to display the user agent string uncut by default

Only in debdiff/: content_html_content_src_nsGenericHTMLElement.cpp
Only in debdiff/: content_html_content_src_nsHTMLInputElement.cpp
Only in debdiff/: dom_src_base_nsGlobalWindow.cpp

It's a patch I submitted in bugzilla #343953 and that got applied in Firefox® 2.0. No surprise the patch is not applied on Ubuntu.

Only in debdiff/: extensions_reporter_Makefile.in

Patch I submitted in bugzilla #354413 and that got applied in Firefox® 2.0.

Only in debdiff/: security_coreconf_rules.mk

Patch from bugzilla #325148 that got applied in Firefox® 2.0 (see above), and a small patch to build the NSS library with debugging symbols (put -g in CFLAGS).

That leaves only 2 small patches : CFLAGS = -g added to security/coreconf/rules.mk and rows=5 to browser/base/content/aboutDialog.xul

Files that are only patched in Ubuntu: (same exceptions as for Debian)

$ LANG=C diff -ru debdiff/ ubuntudiff/ | grep "^Only in ubuntu" | grep -v debian | wc -l
45

Yes, that's right, that's 45 files that Ubuntu patches that Debian doesn't. Most are windows sizes and similar things that upstream can't get right because they are values adapted to Windows, but that also includes some changes to the code and some other things.

Let's now check differences in files that are patched in both. It's a bit of shell black magic, but you can check by hand that it does nothing wrong :

$ LANG=C diff -ru debdiff/ ubuntudiff/ | filterdiff -p1 -x configure -x debian"*" | lsdiff --strip=1 | while read f; do diff -u debdiff/$f ubuntudiff/ | awk "! /^---|^\+\+\+|^ |^[-+]*\@\@/ { print \"$f\"; exit}"; done

That gives a list of patch files that have more differences than line numbers changes, and that do not apply to the debian directory or the configure script (which is generated from configure.in), which is what we really want to compare here. You can take this list and run interdiff between these files from the ubuntudiff and debdiff directories. I'll explain for you what these differences are:

  • Makefile.in: Ubuntu adds a line in order to install the NSS include files,
  • browser_app_Makefile.in: Patch from bugzilla #314927 applied by Debian
  • browser_app_profile_firefox.js: (interdiff fails because the changes apply to different versions of the file) Ubuntu changes the homepage, and sets profile.allow_automigration to false,
  • config_autoconf.mk.in: Ubuntu changes includedir and idldir,
  • configure.in: Ubuntu changes MOZ_APP_DISPLAYNAME, and adds some echos,
  • gfx_src_gtk_nsFontMetricsXft.cpp: Ubuntu sets FC_ANY_METRICS to some patterns,
  • intl_lwbrk_src_nsJISx4501LineBreaker.cpp: Patch from bugzilla #161826 applied by Debian for sparc64, which is not an architecture supported by Ubuntu,
  • modules_libpref_src_init_all.js: Ubuntu changes some default fonts from serif to sans-serif, while Debian changes fonts for serif, sans-serif and monospace (setting to generic names instead of Times, Helvetica and Courier) ; I think both should be applied in Debian, actually. Ubuntu also sets dom.event.contextmenu.enabled to false,
  • security_nss_lib_freebl_unix_rand.c: (interdiff fails because the changes apply to different versions of the file): both patches have the exact same effect, but are different due to changes to original file between 2.0rc1 and 2.0 final.

Overall, Ubuntu applies the same set of patches as Debian, plus some more. A somewhat more modest set of divergences, huh ?!?

For what it's worth, Ubuntu, like Debian, builds its Firefox® with flat chrome and pango enabled.

What's different in the shipping Ubuntu version of Firefox than the proposed Debian version of Firefox (that didn't ultimately ship)?
Technically, changes include fixes to the User Agent string and the feed preview, a well as addressing issues of coherent branding. More significant than any specific difference in code, however, is Ubuntu's commitment to work together with Mozilla and our community on releases going forward to insure product quality and integrity.
Why are you working with Ubuntu when you wouldn't work with Debian?
We did try to work with Debian and would prefer a situation in which we work together. Ultimately, Debian took a position that was consistent with their own policies, and not compatible with some of the exceptions to Mozilla trademark policies that we offered. While we understand and respect their decision not to work with us under our branding guidelines, Mozilla believes that brands like Firefox are important for consumer protection. In any event, Ubuntu developers are working closely with Mozilla developers to insure product quality and features that are what users expect when they use Mozilla Firefox, which means that they'll ship (and will continue to ship) a fully branded version.

Reading between the lines, that means Debian is not working with Mozilla. It's not like we're submitting patches. No. Never. Ever. I'm also glad to hear from Asa Dotzler, in comments to Mr Beard's article, that this great collaboration with Ubuntu will lead to patches applied to Firefox® (I guess the paid Canonical employees having more time to deal with Mozilla® than the volunteer Debian maintainers may have helped, especially considering they didn't have to do all what we already prepared). Anyways, it's not like some of the patches we sent got applied.

So, while I'm at it, here is an exhaustive list of the bugs where we took or sent the patches that are applied to Iceweasel: #51429, #161826, #252033, #258429, #273524, #287150, #289394, #294879, #307168, #307418, #314927, #319012, #322806, #323114, #325148, #326245, #330628, #331781, #331785, #331818, #333289, #333308, #343953, #345077, #345079, #345080, #345413.

These don't cover the following patches (see the rationale for these in my previous article):

  • security/manager/Makefile.in, security/nss/cmd/shlibsign/Makefile: Don't build the shlib signatures, see the rationale in my previous article,
  • security/nss/cmd/shlibsign/manifest.mn: Don't build the mangle utility,
  • browser/app/Makefile.in: Force linking against libxpcom.so despite -Wl,--as-needed,
  • browser/app/profile/firefox.js, gfx/src/gtk/fontEncoding.properties, modules/libpref/src/init/all.js: Preferences changes,
  • browser/base/content/aboutDialog.xul: That's one of the patches that Debian applies that Ubuntu doesn't. See above,
  • config/autoconf.mk.in: Remainings of an old patch for pangocairo, which is now useless, and setting of mozappdir,
  • config/rules.mk, configure.in: Patch from Thiemo Seufer to increase stability and performance on mips, useless upstream until bugzilla #258429 is fixed, but on my to_send list,
  • extensions/inspector/Makefile.in: Something that should be added to #331785, but well, it's WONTFIX, anyway,
  • layout/build/Makefile.in, layout/build/nsLayoutModule.cpp: Change to the Gecko string,
  • modules/libpref/src/nsPrefService.cpp: Add a preferences directory for /etc/firefox/pref,
  • widget/src/gtk2/nsWindow.cpp: Extended mouse buttons support, on my to_send list,
  • configure.in, xpcom/reflect/xptcall/src/md/unix/Makefile.in: Basic patch for bugzilla #343975,
  • configure.in: Check for pangoxft.

It's so great to spend a great amount of time on a package, send patches, try to understand how things work to get patches applied, and yet, see such denial and false claims about our work. So please, Christopher, Asa, and the others, just stop talking about Debian, it will be better for everyone.

PS for Rob in comments out there: No, ColorZilla won't work on Ubuntu, because of the ABI incompatibility I explained in my previous entry, that Mozilla® doesn't seem to care much about.

2006-10-26 22:48:01+0900

firefox

Both comments and pings are currently closed.

26 Responses to “Facts about Debian, Mozilla® Firefox® and Ubuntu”

  1. Nico Dietrich Says:

    Mike, thank you very much for claryfying all that in detail! I’m really impressed by your patience – I’m already getting angry reading those stupid comments out there…

  2. Dao Says:

    I wonder why you’re talking about the brand-new Firefox 2 again and again, whereas the whole issue is a bit older. IceWeasel is in its infancy, but didn’t Debian patch Firefox 1.0.4 for ages?

    By the way, adding ® to every Mozilla-related word makes you look like a silly troll.

  3. Ming Hua Says:

    In reply to Dao’s “but didn’t Debian patch Firefox 1.0.4 for ages?” argument:

    I think it’s then Mozilla’s responsibility to specify which version of Debian package they are talking about when they say “The patches that Debian applied to the Mozilla source code are more significant in scope than those in what Ubuntu is shipping”. I don’t think comparing firefox 2.0 in Ubuntu (which is mentioned in Christopher Beard’s blog post) with firefox 1.0.4 in Debian is fair. And if that is Christopher’s intention, but without explicitly saying it, I feel that’s even worse than an accusation without fact-checking first (which is what it seems to me now).

  4. Simon Says:

    Nice troll, really shows how mature the debian side is in the discussion. No wonder people prefers Ubuntu where one doesn’t have to deal with the arrogance of debian developers.

  5. aperry Says:

    Simon: Wow. Talk about trolling. I’m an Ubuntu user, although I have not waited for them to discover Linux and know what Ubuntu owes to Debian and DDs like Mike here. No wonder DDs get angry with people like you around. Talk about arrogance too.

    Mike: Thanks for taking the time to do that. Contrary to what some might say, I do think facts like those are what is needed on this subject, more than thoughts by people who have no idea.

  6. Jordi Says:

    Bravo Mike!

    Pay attention to your feed, it’s doing weird things to the bit of thep ost where you link to the Debian diff, so it looks very wrong in Planet Debian.

    glandium> fixed, thanks :)

    And congratulations for the very detailed dissection of the patches, it really sheds bright light on the usual claims.

    I wish other distributions, Ubuntu included, would join the effort to put some pressure on Mozilla.com about these issues. If it’s only Debian, I’m afraid we won’t be able to change things at all, whether if some other big distributions joined either the Iceweasel initiative or at least started conversations with mozilla about the current situation, I think they might see the issues are not “Debian fundamentalism specific“.

    I love when people accuse Debian (or GNU, for the same reason) of being radicals or fundamentalists, etc. I wonder if distributions would still be using XFree86 >= 4.4, or Motif, or QPL 1.0 Qt libraries, etc., if Debian hadn’t said *no* from day one and got support for other distributions.

  7. trewas Says:

    Looking at bug #354622 the real showstopper seems to the requirement that to use Firefox trademark, official logo (icon) must be used. The logo has unfortunately non-free license. Mozilla and Debian then dug their trenches: Mozilla by not being willing to change the license (or make an exception for Debian), and Debian by not willing to bend DFSG to allow the logo with non-free license. If that issue cannot not be settled, there’s no much point in further discussions about patching policies or cooperation. I guess when looked from either side, it seems that the other one is unreasonable…

  8. Kellito Says:

    Dear Mike!

    Thank you very much for this detailed clarification. I am a user of Ubuntu, but I know that Ubuntu owes everything to Debian. Stupid people are ignorant and don’t want to acknowledge that _fact_. There would have been no Ubuntu without Debian. People like Dao, Simon always existed and will always exist. They don’t comprehend the meaning of the word Freedom, they have surrended their freedom, and will gladly take away yours.

    I have been a fan of Mozilla Firefox just before this incident with Debian. As with all good music bands when they turn commercial at some point, their music is much less attractive, MoCo is not attractive any more. MoCo doesn’t care about freedom – their new found god is market share. For people who really care about their freedom, the relationship with MoCo (C)(R)(TM) ends here. Good bye MoCo – I am turning to Konqi and IceWeasel on Ubuntu for a truly free browser experience.

  9. Lucas Nussbaum’s Blog » Blog Archive » Debian, Ubuntu, Mozilla® Firefox®, wearing hats, and Epiphany Says:

    […] With my Debian hat, I really like how Mike Hommey chose to discuss facts, with references, in his reply to Chris Beard’s post. When it is possible, going back to the facts is really the best thing to do to avoid the usual FUD. It’s not really a surprise that this intelligent behaviour came from the Debian side. […]

  10. Rado Says:

    I’m no developer, I’m user (Mepis) and I think I understand both sides’ point of view. To be honest, I don’t care if program is open source but I do care that I have all my sw legally. That’s why I use Opera browser and am happy. But why Debian (which tries to be pure opensource and free) allow all those non-free repositories containing even illegal software? I know those repos are not officially supported, but still they are there…
    If I don’t agree with Mozilla, I can stop using their product (the same as with Microsoft). So why all this flame occurs? Let Debian use this Iceweasel browser and all will be happy – Mozilla will be happy with their trademark thing, Debian with their pure opensource thing.

  11. Kevin McCarty Says:

    Mike: You rule for posting this!

    Rado: Debian has no say in what third parties do with tools to build .debs and create repositories — if we did, those tools wouldn’t be Free Software. I think the only way we could legally force a third party repository to remove software would be if copyrights of Debian developers were violated (for instance, shipping a .deb of dpkg without shipping a source package, in violation of the GPL). Generally it’s up to a copyright holder to enforce its own copyrights.

  12. Boga Says:

    Sorry, but I can’t see what makes Debian “mature” in the discussion. Complaining about FUD and writing “Mozilla” obsessively with the little ® doesn’t fit together. Mozilla got into the issue of branding open source software for building a strong brand that is recognized for open-source’s sake. So Firefox is a brand and one has to accept Mozillas decision, which has nothing to do with being legally classified as a corporation. If there are problems in the way Mozilla interacts with Debian, one could write them down and publish them in an honest and calm way (which would abandon irony or sarcasm).

  13. Roshan Shariff Says:

    I’m not too sure about this, but I seem to recall a decision a while ago on the Ubuntu side to upload entire new versions of Firefox even to stable releases, because of the difficulty of selectively backporting security fixes. IIRC it had something to do with Mozilla lumping together features and bugfixes in new releases, and not releasing security patches that apply cleanly to older versions. Since Debian AFAIK doesn’t follow this policy, the Moz could have concerns. Of course, I may be utterly wrong, in which case please hold back on the flaming ;)

    I seem to recall a problem with Ubuntu Breezy (?) when the Mozilla site would warn users they were running a version with known security bugs, when in fact the fixes had been backported to that version.

    Of course, backporting newer versions has its own problems, since almost all programs that need a HTML renderer use Gecko, and the ABI changes spell major trouble. I can only hope xulrunner will solve this problem

  14. Baptiste Says:

    Boga: please tell me why it is immature to respond to lies (about Debian not contributing their patches, or about their code being “crappy”, or whatever) with facts ?

    Oh yeh, the little Rs are ironic. So what ? Are the Mozilla folks so full of themselves, that they can’t handle this ?

  15. Joergen Ramskov Says:

    Nice post. This issue has been mentioned at lwn.net as well. I’m sad to see 2 open source projects getting hostile like this. I don’t know enough about it to point my finger at anyone so I’ll refrain from doing that.

    One thing I have noticed though: Mozillas way of handling updates works just fine for the MS Windows world, but *nix works differently and Mozilla doesn’t seem to really care about that. I get the feeling they mostly care about Windows which is probably also were the majority of their users are, but I don’t think that is a good enough reason to provide better support for Windows.

    Anyway, I’m mostly using Konqy :)

  16. Boga Says:

    “(which would abandon irony or sarcasm)” meant that I understood the irony in your post.

    It is not about mature or immature, but I wanted to express that *both sides* would profit of a calm discussion. My criterion for a mature position would be to stay calm although one thinks the other side to lie. If, as you say, Debians Firefox is less patched than Ubuntus, there should be no problem after clarifying these facts towards Mozilla (directly) without the need of ironic side blows. Why not writing an (open) Mail to Mozilla stating that you analyzed patches in Ubuntu and Debian, that things they publish are not true and so Mozillians should stop saying this?

  17. Diwaker Says:

    Mike: thanks for the clarifications. I use both Ubuntu and Debian. While the Ubuntu team is doing a great work (kudos to Mark and the rest of the gang) and I admire them for that, my respect for Ubuntu DDs and other volunteers is much _much_ deeper. I hope people don’t try to blow this issue up as “Mozilla and Ubuntu vs. Debian”. It was silly of Chris’s post to try and portray Ubuntu like the good poster-child. These are fundamental differences in policies and should be treated as such — no less, no more.

  18. Mark Shuttleworth » Blog Archive » Firefox and Ubuntu Says:

    […] I’m sure many folks are aware of the tension between Mozilla and Debian over the use of the name “Firefox” for the web browser package. A good exchange of comments between Chris Beard of Mozilla, and Mike Hommey of Debian highlights some of the challenges involved. […]

  19. Robert Fendt Says:

    Thanks Mike for the informative post (and the one before). I am happily using Debian on some machines and Ubuntu on others, and was wondering what would Ubuntu make so much better in Mozilla Corp’s book, actually. Turns out: nothing, except that they simply have a more lax attitude both regarding patches in “stable” releases and non-free parts in the main rep. The result seems to be Mozilla outright lying about their reasons.

    At the moment I am using SwiftFox on my Debian boxes (at least I haven’t spotted IceWeasel in the repositories yet), and can hardly wait for IceWeasel to be uploaded. To the people complaining about Firefox being an important “trademark” for “open source” and Debian hurting them: Firefox might be open-sourced, but it sure is not “free software”, as current events have shown. And Debian is not just about being “open”, it is about freedom. If you do not care about this and “just want a working machine”, go use Ubuntu. Considering their attitude to patches in stable releases and their habit of frequently breaking the a release through security updates, it is not exactly what I would call “working”, however.

    And another side note. People that are not concerned with licensing issues and license compatibility have brought us the whole cdrecord mess. “wodim” maybe working, more or less, but it still contains a whole lot of those arrogant “this was tampered with, booh!” messages by Schilling, which he does not want to be removed– on the other hand he used to claim cdrecord was GPL. Depending on which statement is the more binding, we may yet end up with no CD recording application in Etch, or cdrecord in non-free without security patches or the like. Boy am I sick of some people’s arrogant attitude, and boy am I sick of other people ignoring such issues so long they turn in great big messes.

  20. Jesse Ruderman Says:

    Thanks for the high signal-to-noise post about the code differences between Debian’s Iceweasel and Mozilla Firefox. But it seems to me that the trademark and logo issues were the real reason Debian renamed its version of the browser, not code differences. Hopefully someone on the Debian side will make a similarly high signal-to-noise post explaining why Debian seems to believe that an open-source but trademarked application is “not free enough” and must be renamed even if there are no substantial disagreements about the code. (What I’ve heard so far centers on the logo being “non-free”, rather than the trademark being “non-free”, but concentrating on the logo doesn’t make sense to me since the logo and the trademarked name have exactly the same requirements for use.)

  21. KtecK Blog - Syndicated » Blog Archive » Firefox and Ubuntu Says:

    […] I’m sure many folks are aware of the tension between Mozilla and Debian over the use of the name “Firefox” for the web browser package. A good exchange of comments between Chris Beard of Mozilla, and Mike Hommey of Debian highlights some of the challenges involved. […]

  22. Jed Says:

    Wow. Seeing that Debian has non-free AND it’s own logo is not *free*, this whole posts and anti-fudding is lame.

    Lets forget about trademarks and any legal issues just for a moment.

    So I’m a Company called ‘X’, and I make a opensource browser called ‘Y’.
    Simply put I obviously release the code under an OS license and am perfectly happy with people forking the code, I do make one request however. If anyone does fork it, and applies any changes that I have not approved, please don’t call it ‘Y’ as I want people running ‘Y’ to be running what I made. You can call your’s “You company’s Y”, but not just ‘Y’ as I don’t want to confuse my users, specifically I offer support for ‘Y’, so if 20 browsers are called ‘Y’, I’m going to have a damn hard time figuring out if you really have my ‘y’ or someone elses.

    This is completely reasonable. Even if my request isn’t legally bindable, the simple fact that I’m asking you to do that should be enough. If you can’t respect me and my request, then get the hell away from my code.

    This isn’t a hard issue to understand.

    I agree with others above, if both Debian and Mozilla contibuters would just shut the F up, and actually blog/communicate in a mature way, this wouldn’t be the issue it is now.

  23. MrCopilot Says:

    The solution in my mind is a simple no-brainer. Firefox’s debian package maintainer should work for Mozilla. Mozilla keeps patches in house, approves for quality and can release FireFox under its own name in the debian format.

    Why is this not a viable option? Anyone?

    Alternative 2: FirefoxD, Problem Solved, No Splitting up brand Name Recognition like the current IceWeasel solution, No Trademark Problem.

    Why is this not a viable option? Mark? Moz? Debs?

  24. Chris Hildebrandt Says:

    Thanks Mark for your ongoing, valuable and serious work!

    What most of us in this this discussion don’t say, is the obvious, actually. Mozilla has finally joined and is part now of “Our Corporate America”. It has created and needs to protect now intellectual property, following the example of many other property claimers.

    However, some Mozilla gals & guys already forgot where this value=money came from and belongs to – the community. Mr. SpaceInvader might by the way suffer the same disease (intentionally forgetting who actually did the work and deserves the respect and recognition).

    Debian is one of the most important stable bastions of freedom and honesty in this “New World Order”. Let’s continue our support and contribution to Debian, and let’s continue to join code/freedom/ownership in a true and persistent way which is for the profit of everybody.

  25. mik Says:

    IMHO, it was not a good idea to add the registered trademark sign to every occurrence of the word Mozilla.
    It takes a lot of moral authority from your words. Why?
    Because it adds a purely rhetorical/polemical flavor to an argument that claims (and as I’m well inclined to believe: rightly) to be purely rational and based on neutral facts. These are two different levels and mixing polemics into rational argument is heavily damaging the credibility of the latter. Please consider to remove this polemics.

  26. Kevin Says:

    How old are you? This sounds like junior high playground antics to me.