Why can't we use Firefox?

[will_]

I asked our county-supplied technician recently why we could not install Firefox alongside IE on staff laptops. I understand it's a personal choice, but I prefer it because I find it less prone to the appearance of endless toolbars and the latest new dialogue box that seems to appear weekly.

He didn't have a problem with the element of personal choice but said that Firefox could not be used because it does not use / respect Group Policy Objects (GPOs). I understand what GPOs are but have had only limited dealings with them.

My question is whether it is really necessary to rely on client software (i.e. the browser) to enforce security restrictions. Is this not a task better achieved with restrictions at infrastructure level (i.e. the network / proxy / ISP - which is also provided by county)? I am talking about staff-only machines, if it makes any difference.

[elsiegee40]

Firefox is a PITA to maintain on a network IMO... a new version every 10 minutes (OK 6weeks) ... although allegedly things will improve with Version 10 that has just been released.

This thread Firefox 10 is out! amongst others will explain the antipathy many have developed to it.

Your county tech is right in that it cannot be controlled through GPO and we use GPO to lock everything down to ensure network security and stability.

[Michael]

That's right, Firefox (currently) does not support GPOs, but this is something that is coming very soon on Mozilla's development schedule.

Google have published ADM/ADMX files you can import, so you can control Chrome just as you would Internet Explorer.

Without GPOs, configuring browser restrictions, proxy settings, homepage settings etc... can become tedious.

As for your question (if I've understood correctly), web filtering for example is typically controlled/managed at county level, but your establishment also has a responsibility to ensure internal security is maintained to a high level. This includes browsers, Windows itself and Office too. Internet Explorer is very easy to update centrally and is the most comprehensive browser in terms of GPOs available.

Firefox lately has gone through 6 versions in 7 months and they're currently up to version 10 now. It's a ridiculous release schedule and keeping up is proving difficult. It's not something I'd recommend for deployment in a school or business. If you are looking for a viable alternative, look at Chrome as this does have GPOs available.

[will_]

Without GPOs, configuring browser restrictions, proxy settings, homepage settings etc... can become tedious.

This is the information I was after. Thanks.

Firefox lately has gone through 6 versions in 7 months and they're currently up to version 10 now. It's a ridiculous release schedule and keeping up is proving difficult.

Wow, I had no idea the updates had become that frequent! I agree, that is ridiculous.

If you are looking for a viable alternative, look at Chrome as this does have GPOs available.

Thanks. I might ask, although I think I know what the answer will be. Would Chrome have "it's own" GPOs, or would it respect IE's?

[Chris_Cook]

Group policy allows a few people to manage and configure large numbers of pcs very quickly, for example setting up a new proxy, adding a troublesome site to the trusted sites group, or setting it to use compatibility view. If everyone is running their own favourite browser, then these all need to be configured or the settings distributed to end users who then have to become admins of their own computers, rather than doing the job they are paid to do. Even having a few PCs with unique configurations can take up a large amount of time for the technician, who should really be doing other stuff like making things work.

Unfortunatly in this job, you can't please everybody, and its a mistake to try. Without meaning to sound harsh, the technician is paid to provide a working solution, not to provide everyone with their perfect setup.

[will_]

Without meaning to sound harsh, the technician is paid to provide a working solution, not to provide everyone with their perfect setup.

Doesn't sound harsh at all. I'm a teacher by day but a techy at the weekend.

[Arthur]

Firefox lately has gone through 6 versions in 7 months and they're currently up to version 10 now. It's a ridiculous release schedule and keeping up is proving difficult. It's not something I'd recommend for deployment in a school or business. If you are looking for a viable alternative, look at Chrome as this does have GPOs available.

This sentence doesn't make any sense! Google Chrome has also had 6 releases in 7 months (and 17 days, to be exact).

[Chris_Cook]

What I like about chrome is that it just gets on with it, and applies the upgrade on the next restart of chrome. It seems every time i start firefox, it needs its hand holding through an update, and then says its broken half my addons.

I think chrome uses its own gpos independantly of ie.

[tin]

This sentence doesn't make any sense! Google Chrome has also had 6 releases in 7 months (and 17 days, to be exact).

Haha I agree entirely with this, and Firefox apparently is starting with the silent update on next restart lark.

Nonetheless I also agree the release schedule and in particular version numbering of both is utter foolishness - google have a lot to answer for there.

I personally use firefox everywhere as when there's a problem to troubleshoot, it's the only one that doesn't lie horribly when there is a proxy or firewall problem.

I do wish however they'd get their act together and obey MSIE's gpo's if they are present. Some schools I work in entirely rely on the fact that IE is locked down, and no other browser can be run/installed as a security policy. Unfortunately we jointly looked long and hard at alternatives and the answers were not clear to see

[Michael]

This sentence doesn't make any sense! Google Chrome has also had 6 releases in 7 months (and 17 days, to be exact).

It makes perfect sense, but you're right about the release schedules. Firefox has no official GPOs whereas Google Chrome does. The point I was making was if will_ wants an alternative to Internet Explorer, Chrome is probably the better choice at the moment.

Chrome updates itself automatically and it has official GPOs, just like IE. Firefox doesn't at the moment. Managing Firefox in a network just isn't realistic at all.

[will_]

Some schools I work in entirely rely on the fact that IE is locked down, and no other browser can be run/installed as a security policy.

Yes, I suspect that's where we're headed.

[Duke5A]

Firefox Community Edition is a quasi fork that makes use of GPO templates. You can get it here:

FrontMotion Firefox Community Edition

I've been using it in my district for three years now and with the GPO templates you can control every single option in Firefox's about:config page. It's on orders of magnitude more configurable than IE. FirefoxCE is typically only a couple days behind the official release schedule in updating. The MSI packages make pushing out extremely easy too.