[arch-general] Firefox without signature checking

[respiranto]

On 2016-01-03 06:11, Kyle Terrien wrote:
> On 01/02/2016 05:24 PM, Magnus Therning wrote:
>> The larger, and very philosophical question is "How user un-friendly can
>> upstream make it before Arch decides to *not* package as upstream
>> intends?" (Answering this requires keeping in mind that Arch users are
>> unlikely to fall squarely into the target group of upstream.)
> 
> This is a very good question to ask imho.  In a perfect world, we would
> just fork and be done with it.  However, it is not a perfect world.
> Forking requires time and effort, and it generally kills the software.
> (Here I am with several installs that have both Firefox and Pale Moon
> for compatibility reasons.)

What is wrong with e.g. IceWeasel, IceCat, Abrowser?
And in which regard does forking "kill the software"?
Especially if it only means applying certain patches upon each update of
the original project?

I totally agree with the decision of Arch's developers.
If we stick with Firefox as provided upstream, this simplifies much:
- Less work for the Arch developers
- The features are exactly as expected, i.e. there is no Arch Firefox.
- If the users dislike upstreams decisions, they will use a possibly
newly created fork instead. If that achieves a sufficiently big user
base, it will most likely be taken into the official Arch repositories.
This has the side effect of making the original less popular and thereby
making them think about their decision.

> Most Arch users definitely do not fall into Mozilla's target group (an
> imaginary "average Joe" as I like to call it).  We made this decision
> when we decided to install Arch as opposed to Ubuntu, Mint, OpenSUSE, or
> any other distro that does a decent job of configuring itself
> automatically.

In my opinon, it is actually very simple:
If somebody does not fall into Mozilla's target group, he either
- does not use it or
- accepts that Mozilla does not care about his needs.

When one decides to install Arch, one does also decide to get software
as provided by upstream, patched as little as possible.