Tech: New browsers?

Subject: Tech: New browsers?
From: GUEST,Jon
Date: 07 Sep 18 - 11:54 AM

This started following the breakage of a Cisco SG-200-08 smart switch (3 ports died) the other day. I temporarily fixed the network using a 16 port TP link switch and got a replacement (Netgear GS110TP) switch today.

First off, I thought I might upgrade the firmware on the other 2 (same model) Cisco switches. I find I can’t do it on Firefox, Chromium or Opera via http. I also try to reboot them via the management console and that doesn’t work either. All I get in all cases is a blank pop up window with an OK button.

Anyway, I leave that alone and go to the new Netgear switch. I can do most configuration via Firefox but find it has a “device view” that needs the java plugin but this is not allowed on my Firefox browser or apparently on Chromium.

Anyway, I decide to download an old (picked on 48.2) version of Firefox (just to run “stand alone”, not to replace the OpenSuse v60 installation). I guess I’d also have to get an older version of java with the plugin to install if I want the “device view” bit on the Netgear switch but I left that alone and sure enough the Cisco switches will reboot/upgrade firmware (or at least they pop up the correct dialogs) with the older Firefox browser.

I might have missed something but I’m wondering, are we at a point where we need to keep an old browser just to maintain a system? I think the 2 switch models in question are fairly old in terms of the last firmware update - certainly the Cisco one is - but nonetheless still available new.

Also while pondering things. I find these “insecure” warnings for http annoying. There are sites including a forum, I’m happy with on http plus I’ve devices here, I’d be sure of a print share device, hdhomerun dvb-t tuner, serial ethernet device for starters that simply do not support https, and there may be others, plus I don’t want to eg. set up https for a personal play with apache… Is a time going to come when http is banished and https becomes compulsory?

Subject: RE: Tech: New browsers?
From: Newport Boy
Date: 07 Sep 18 - 12:47 PM

I don't have any difficulty accessing my Netgear router via http using Firefox 62 on MX Linux. I don't have the Java plugin installed but the router page doesn't seem to require it.

As far as I know, you can still enable Java in current versions of Firefox.

On the general question, I think http is dying - there's a lot of pressure to move to https.

Subject: RE: Tech: New browsers?
From: Mick Pearce (MCP)
Date: 07 Sep 18 - 01:08 PM

I think I saw recently that google(?) were actively promoting https over http and trying to get websites to change. As part of that promotion chrome (I think) was routinely issuing the insecure warnings when accessing http sites.

Mick

Subject: RE: Tech: New browsers?
From: GUEST,Jon
Date: 07 Sep 18 - 01:24 PM

Yep. Newport Boy, it’s just this “device view” I can’t get with the up to date FF browser and the Netgear switch.

Mozilla say:

“Why do Java, Silverlight, Adobe Acrobat and other plugins no longer work?
Beginning in Firefox version 52 released March 7, 2017, installed NPAPI plugins are no longer supported in Firefox, except for Adobe Flash. Some of the plugins that will no longer load in Firefox, even though they may be installed on your computer, include Java, Microsoft Silverlight and Adobe Acrobat.”

and with regards to Chrome(and I assume… chromium), Oracle say:

Chrome no longer supports NPAPI (technology required for Java applets)
The Java plug-in for web browsers relies on the cross platform plugin architecture NPAPI, which has been supported by all major web browsers for over a decade. Google's Chrome version 45 (scheduled for release in September 2015) drops support for NPAPI, impacting plugins for Silverlight, Java, Facebook Video and other similar NPAPI based plugins.
Java applications are offered through web browsers as either a web start application (which do not interact with the browser once they are launched) or as a Java applet (which might interact with the browser). This change does not affect Web Start applications, it only impacts applets.
If you have problems accessing Java applications using Chrome, Oracle recommends using Internet Explorer (Windows) or Safari (Mac OS X) instead.

Last bit is pretty unhelpful for a Linux user…

RE the Cisco switches, I don’t think it’s an http issue but some compatibility seems to have been lost in the most up to date versions I have of the three browsers I tried.

Subject: RE: Tech: New browsers?
From: GUEST,Jon
Date: 07 Sep 18 - 03:41 PM

Quite glad I got the Java bit running. I'd not have spotted it via the lights on the switch as they face the back of my desk and I missed it in the text but the simple graphic display of its ports (which is all it gives) did show me that the Netgear switch was supplying a Cisco switch with power (that one can be powered by mains or poe on port 1) which wasn't what I wanted.

Oh well, Firefox 48.2 and Java 8 (Opensuse Leap 15 comes with IcedTea 10 & 11 rather than an Oracle Java and I don't see a plugin to install there) will do me for both types of switch unless I learn something better.

Subject: RE: Tech: New browsers?
From: GUEST,Jon
Date: 07 Sep 18 - 04:13 PM

Too late for me in terms of keeping just one current version of Firefox as it (52 ESR) would have expired in May/June 2018 but I see Firefox offer an extended support release which stays a couple of versions behind the main release.

Subject: RE: Tech: New browsers?
From: DaveRo
Date: 08 Sep 18 - 04:47 PM

GUEST,Jon wrote: Is a time going to come when http is banished and https becomes compulsory?

I doubt it, and I certainly hope not. There are thousands of unsupported http websites out there. Most (all?) if the 'insecure' warnings I see in Firefox are due to 'mixed content' - http content embedded in https pages. That's usually just carelessness. But TV licensing just withdraw their website because of just such an error.

...an extended support release which stays a couple of versions behind the main release

The ESR releases are updated with all security fixes simultaneously with the 'release' version; they don't contain other changes or new features - those are updated every year and users are given 3 months - 2 releases - to test it.

If you need to use an old version of Firefox, for a no-longer-supported feature or proticol, choose the last ESR point release - eg 38.8.0, 45.9.0, 52.9.0.

Subject: RE: Tech: New browsers?
From: treewind
Date: 09 Sep 18 - 02:16 PM

"There are sites including a forum, I’m happy with on http"
There are many sites where https isn't necessary, but a forum where users need passwords to log in isn't one of them.

Those passwords need to be encrypted, or the next time someone logs in from an unsecured public WiFi system (and there are many of those), anyone in range with a laptop and suitable software could grab the password.