Slashdot Mirror

Now if there was only a way to control/deploy this through group policy, then Firefox in the Enterprise will really take off.

Run "Firefox Setup.exe -ms" to do a silent install or if you must have a .msi, download it from these guys

FrontMotion Firefox Community Edition has a MSI version that can be pushed out via GPO and also has adm/admx templates available.

If you IT staff can't "deploy" Firefox they are worthless. I can completely understand them not wanting to chase the latest version, preferring to just replace the executable installer package with one that just has the security fixes in it but none of the new math. So all their pre-rolled configs and installation scripts don't have to change.

I'm always amused by people that make statements such as this, condemning an entire department that they know nothing at all about, based on limited and vague information.

But, your assumption suggests a lack of knowledge, on your own part, about Group Policy and its workings. You see, Group Policy Objects(GPO) are far more than just a deployment mechanism. While GPO does indeed provide mass deployment services based on users, machines, organizational units and so forth, it also provides ongoing management services. Options like changing the individual settings and configuration options on one, all or subsets of installations. The ability to turn on and off features of the software based on user, machine OU, etc. The option to remove the software as easily as it was deployed. These and other benefits of GPO make it FAR more powerful than just a deployment tool.

I'll go a step further and say that as a network engineer that has used Linux exclusively as his desktop for the past 11 years, as well as countless Linux servers and appliances; anyone that suggests that Microsoft Windows does not provide the best and most seamless system from an overall integration and management perspective is either willfully ignorant or has no experience in the matter. What the likes of Puppet are starting to provide for Linux servers, Microsoft has been offering for entire global enterprises for a decade or more.

Now, for those that wish to use Firefox and GPO, I point you to Frontmotion who provide a GPO enabled MSI package of Firefox. There are both paid and free offerings that work very well.

But, I agree, this is something that Firefox should have made a priority years ago and is just one more of a fast growing list of reasons to leave Firefox.

Luckily Firefox is open source so someone has taken care of that. http://www.frontmotion.com/Firefox/

Any IT department capable of using Google can easily find it.

I seem to remember that the IE 7 fan's answer to that was along the lines of "why should I waste space on my PC's hard drive with two browsers?"

Firefox is around 80MB. I don't think you can still even buy a hard drive smaller than 80GB. Nobody actually cares about 0.1% of their disk space, it sounds like the guy was just looking for a reason to argue.

And besides, without some sort of MSI version of Firefox that can be administered with the Group Policy system, how will larger companies deploy Firefox alongside IE?

Such things exist.

You appear not to understand how the United States mobile phone market works. The carriers are completely in control of the whole process because smartphones are priced for subsidized sale through a carrier, not sale directly to end users.

The customers can still choose which make of phone they get. Moreover, the carriers might choose who gets OS updates, but they don't really choose what goes in the app stores. And if people start complaining that iOS Safari doesn't support DNSSEC, Apple could easily silence them by publishing a free version-agnostic DNSSEC plugin in the app store.

I have another question: I want to deploy DNSSEC on a web site once my hosting provider supports it. Is the format of a certificate record standardized yet?

There is an RFC.

And which plug-in should I recommend to users of Google Chrome?

It appears that they're working on making the Firefox plugin work for Chrome but it isn't ported yet as of April, see here. There is also this which appears to be related to the same.

Ask and you shall receive: http://frontmotion.com
It offers a free community version and a paid packaging service. Group policies work fine.

this made things easier to manage while deploying FFx:
http://www.frontmotion.com/Firefox/fmfirefox.htm
even helped to deploy FFx with IETab packaged with a GP policy so sharepoint would "work with FFx"

Frontmotion does the ADM / GPO / MSI thing. You just need to go through some extra hoops to make it 'look' like firefox, which sort of negates the MSI deployment, but it's easy enough to roll into an image. Why the Mozilla foundation can't wrap this around they're heads is beyond me. Penis wagging at it's finest apparently.

http://www.frontmotion.com/FMFirefoxCE/

It is brave of you to post here under your account. Thanks.

You might want to pass the word along that commentary like Asa's should always be bracketed with "personal opinion only, does not reflect official policy" type disclaimers.

That being said, I think just making Firefox work with AD GPO would go a long way towards satisfying business users. Maybe an MSI package as well, but the first is a big sticking point. I know FrontMotion has this service, so it can't be impossible.

  Charles

If you make the best car available, you'll serve the needs of both truckers and soccer moms.
If you make the best shoe available, you'll serve the needs of both basketball players and runway models.
If you make the best bicycle available, you'll serve the needs of both mountain bikers and Tour de France riders.
If you make the best gun available, you'll serve the needs of both active military soldiers and police officers.
etc, etc...

Sometimes you need different tools for different jobs. Businesses don't need state of the art, they need stable and centrally administrable. The continued use of IE6 is a testament to that. The rapid release schedule shouldn't be much of a problem since businesses can pick a version and standardize on it. Some emphasis may need to be placed on add-in compatibility across all versions going forward so that businesses that do pick a version don't find themselves in a situation where they're incompatible with the rest of the Mozilla ecosystem. But the central administration tools are completely lacking in Firefox. There is a third-party implementation, but it's never gotten wide-spread adoption...I've never used it, so I can't say whether it's because it doesn't work well or because no one knows about it.

Personally, I'm somewhat disappointed in this stance by Mozilla. The promise of Firefox was to take on IE and it did a pretty good job of competing with it to the point where other browsers needed to be considered. But by ignoring enterprise users, they're not finishing the job of ending IE's dominance everywhere. They're allowing a situation where web developers are still forced to support IE6. That seems like a betrayal to me.

Businesses, at least the ones of any significant size, need Active Directory integration with the ability to push and enforce group policy.

Firefox does not support that natively. FrontMotion does, and we're investigating their product but our business is currently investigating DROPPING Firefox support for internal users.

That's not all.

http://www.frontmotion.com/FMFirefoxCE/

was found almost immediately. Note: AD friendly.

Sucks even more that they refuse to deploy firefox as a normal windows .msi installer.

True. I use FrontMotion's Firefox Community Edition that comes packaged as a MSI installer. We customize it and push it out with Active Directory. It's not perfect, but it works.

Indeed there is aFirefox MSI. We deploy that + ietab plus to get around any apps that don't like Firefox (fewer these days, only thing we use it for now is Exchange Web mail 2007, being that the full featured version only works in IE). We deploy to 100's of desktops without any issues.

once firefox and/or chrome have enterprise tools to make it work with activedirectory

This has been an option for a couple of years now and it hasn't made much difference.

http://www.frontmotion.com/Firefox/

So why not simply turn off Firefox updates and use the group Policy friendly Frontmotion Firefox build? It supports Group Policy Objects and AD, you can even use their MSI packager service to "roll your own" with whatever settings you choose.

I may be a Windows guy, but one of the things I like about FOSS is if there is a problem, somebody will often take the code and find a solution.

My school uses this: http://www.frontmotion.com/Firefox/fmfirefox.htm

From the page above:
Features
* Active Directory deployable and upgradeable.
* Active Directory management through Administrative Templates (*.adm).
* Desktop Icon similar to IE.
* Shell integration similar to IE.
* Set Default browser
* Macromedia Flash plug-in preinstalled
* Detect and upgrades non-MSI installs.
* Can upgrade 3rd party MSI's from patpaul/MIT, Webheat.co.uk, and ZettaServe.
* Able to properly perform uninstalls and restores system associations
* Enhanced functionality like disabled profile migration.

We use Frontmotion's version and deploy through GPO. We supersede to upgrade rather than patching with WSUS. Works well for us. If Mozilla did this in-house they'd get more corporate uptake.

My sincere apologies, I have worked with SMBs and SOHOs so often (small medium business and small office/home office) that I forget some of the acronyms aren't commonplace. yes I was talking about Group Policy Objects, which when you are running a decent sized shop can be worth their weight in gold. With GPO you can set access policies, you can allow/deny addons, etc, really too many features to list. As for most important? GPO allows a top to bottom control of the browser, from access lists, to default startup to allowed addons, allows you to change proxies,centralize deployment and rollout of updates and to send a change through the entire system at the push of a button, it really does give you total control of the browser experience from the server.

Sadly without GPO support Firefox is IMHO MORE dangerous than IE, as with GPO you can really restrict what IE is allowed/not allowed to do, and malware writers are starting to get wise to Firefox. Just yesterday I cleaned out a badly infected PC, where FF had been locked at 3.5.8 and was filled with rogue toolbars. The malware writers had gone in and disabled Firefox's update mechanism, and had filled the extensions with unable to install malware. I had to do a full wipe on Firefox to restore it.

And what is sad is the guys at Frontmotion have done ALL the work for Mozilla, which means it would be beyond trivial to simply bring a few of the Frontmotion guys onboard and roll out "Enterprise Firefox". Personally I think an even better product, which would give Mozilla a serious inroad into the enterprise market, would be an "Enterprise SeaMonkey" with Sunbird calendar support built in, and maybe a good tie in to Exchange and Scalix groupware. This would give enterprise customers a "one stop shop" to replace IE and Outlook, and by allowing an easy hookup to Exchange and Scalix you would have an easy way to run any desktop you want or any backend you desire. Just set it to allow GPO on Windows and all would be golden. sadly it just seems Mozilla has no interest in enterprise markets, which means for the foreseeable future that market will belong to MSFT and IE.

While not provided by Mozilla, the tools are there.

FrontMotion make Firefox Packager. You can use choose a Firefox version, a language and up to ten extensions. Press a button and in a few minutes you can download your customized MSI package ready for deployment.

FirefoxADM is a way of allowing centrally managed locked and/or default settings in Firefox via Group Policy and Administrative Templates in Active Directory.

For restricting users from adding unsupported add-ons, do the following.

1. Restrict Firefox (using FirefoxADM and GPO) to using only digitally signed add-ons.
2. Get, or make, a corporate code-signing key.
3. Sign the .xpi files of your tested and approved add-ons.
4. Make them available on your intranet.

If users claim they can't live without other extensions, have them use your software approval policy and procedures for getting that add-on approved.

The only add-on I "can't live without" is AdBlock Plus. I consider it a security feature, blocking drive-by malware from various 3rd-party banner ads.

Sadly you are wrong. Those that work in corps have been complaining for years about lack of GPO support, and have been repeatedly ignored by Mozilla. It is bad enough that a third party has hacked together GPO support, but since most orgs don't want to deal with third party hacks it don't help much.

The reasoning has been according to Moz developers they want the same Firefox experience across OSes. But we don't use .deb or .dmg on Windows Firefox, do we? It would be trivial for Mozilla to release "Firefox Enterprise" but they won't. Hell they could just bring the Frontmotion guys onboard and have the product ready to go. So I would say that for whatever reason Mozilla doesn't want that business, which means MSFT keeps a lock on the business, and the users will often go home and fire up IE because that is what they use at work. Stupid on the part of Mozilla, but there you go.

I'm able to control my IE deployments down to a microscopic level, all from a single scree (and tied in to many of my other deployed applications). I'm not able to do that with Firefox. I'll gut it out and take my chances with the IE that I can control (including to blackhole communications at a moments notice if there's a problem), rather than Firefox which I cannot.

http://www.frontmotion.com/

The only reason to use IE any more is because you have some custom web app that requires it. IE sucks. It has to be the slowest, most convoluted browser out there now.

http://www.frontmotion.com/Firefox/

There you go, if for some reason a new version of IE is out of the question then there is a MSI version of Firefox that allows you to deploy across numerous computers and use group policies.

Uhhhh...You DO know that Frontmotion offers a Group Policy Friendly Firefox, yes? That they even offer a Community Edition for Group Policy support, and a Firefox packager that lets you even bundle the extensions you desire.

One of the nice things about FOSS is if there is a need the parent company refuses to acknowledge then someone else is free to take that problem on and release their own version.

...that neither works with established systems like Group Policy...

Chrome still might not, but Firefox has 3rd-party support for it.

It took exactly 2 seconds to find a solution on Google. Firefox MSI installer: http://www.frontmotion.com/Firefox/

Or you could just use the nice MSIs made by Frontmotion. They have a community edition with GPO support, even one that allows you to pass it out with preconfigured extensions. One of the nice things about FOSS is if the parent group refuses to see to a need someone else can step up.

You can also get the FrontMotion Firefox MSI. Mozilla is also working on their own MSI builds of Firefox.

JFGI

http://www.frontmotion.com/Firefox/

Have you tried FrontMotion Firefox? It comes in an MSI package. It's basically Firefox with support for Group Policy.

I've had success using Frontotion's Firefox Community Edition. Check it out. http://www.frontmotion.com/Firefox/fmfirefox.htm

...because no other browser comes with the enterprise management tools necessary for large deployments.

It may not be everything that IE has, but there are third-party builds of Firefox designed for enterprise deployment and management.

See here, for one example.

We use Frontmotion Firefox on our network. From the website:

• Active Directory deployable and upgradeable.
• Active Directory management through Administrative Templates (*.adm).
• Desktop Icon similar to IE.
• Shell integration similar to IE.
• Set Default browser
• Macromedia Flash plug-in preinstalled
• Detect and upgrades non-MSI installs.
• Can upgrade 3rd party MSI's from patpaul/MIT, Webheat.co.uk, and ZettaServe.
• Able to properly perform uninstalls and restores system associations
• Enhanced functionality like disabled profile migration.

My school uses a customized version of firefox. No idea if it has this behavior or not, but it is supposedly easier to manage: FrontMotion firefox http://www.frontmotion.com/Firefox/fmfirefox.htm

I know self-reply is bad form, but further Googling shows that the latest version of Firefox is set correctly. It wasn't enterprise-friendly behavior, but then, nor was Microsoft's. At least Firefox's behavior was more than likely inadvertent, simply not being nearly as large a company as Microsoft as well as targeting multiple platforms. Microsoft changes your browser when you update, invisibly. That's more enterprise-unfriendly than anything Firefox has done.

If your IT department can't even use Google, maybe it's time to start looking for a new job...

Or they could roll-out FireFox (with NoScript) as the default browser using Group Policy with FireMotion's FireFox MSI and create shortcuts on the desktop with a target of "iexplore http://your.wretched.old.internal.app.com/".
More security, same ol' craptastic IE6 "experience" for your internal apps.

I think "manageability" might have something to do with the IT department's ability to control settings on hundreds or thousands of computers in an Active Directory environment through Group Policy objects. Do Mozilla, Opera, and Google provide analogous tools to manage thousands of installations of Firefox, Opera, or Chrome?

Standard Firefox builds do not have any ability to be controlled with Active Directory - last time I looked Firefox didn't even have MSI packages available.

I use the Frontmotion build of Firefox in my domain - it lets me control most Firefox settings (including proxy which is what I really needed) using Group Policy.

Firefox has a MSI version that can be deployed on a whole domain: http://www.frontmotion.com/Firefox/index.htm

MSI's are far easier to deploy than EXE's, because they work in a relatively consistent manner (there are some niggles here and there, but you learn those). Every EXE can be packaged differently, some self extracting, some install shield, etc and they all have different switches to get them going, if it can be done at all. Also MSI installs are far easier for deployment software to monitor the progress, so no time delay tricks when moving onto the next app to deploy.

Mozilla may not make MSI's, but you can get them from Front Motion or you can package them yourself with something like AdminStudio, which Is damn trivial because FF isn't intricately tied to the windows backend.

Firefox Community Edition already supports group policy. http://www.frontmotion.com/Firefox/fmfirefox.htm

A good trick, grab a copy of nlite and vlite, work out what are the main drivers you need (in my case, nvidia and intel chipset, nvidia, ati and via graphics, and a usb LAN adapter (trust me on this, always put in a driver for your usb lan adapter, don't asky why, that will become aparent if you ever get an odd machine with a non-standard LAN adapter, atheros I am looking at you).

Then the fun bit, finding .msi files for all your programs you want to load, not too hard, and for those that don't have them there is usually a silent install option, throw em in a command script throw in sysprep (for XP) or just leave the thing without a CD key (for vista) and it makes a nice professional installer.

As for your choices, good selection, just remember, AVG free has no firewall (I would lean toward avast if you absolutely have to use a free one), don't let spybot install its teatimer (arrgggg) itunes, yeah I would load it, but so far of the systems I see coming back less than 2% of them have it on em, so I don't see a reason to, acrobat... ouch, I let people install their own choice of security exploit, been thinking of pushing skype onto my pre-installs, get a lot of people using that these days, I don't put on thunderbird, most users prefer windows mail/outlook express, or so I have found.

And I have NEVER seen a vid CCCP won't play :)

Oh, for those wondering how to silent install firefox cleanly? Check out Frontmotion

Frontmotion Firefox is a specially crippled version of Firefox that enforces Group Policies.

Not my project but a friend of mine works on the FrontMotion Firefox Community Edition project:

"FrontMotion Firefox Community Edition is a customized version of Firefox with the ability to lockdown settings through Active Directory using Administrative Templates. Similar to lockdown settings with mozilla.cfg on one computer, you can now use Administrative Templates to enforce settings across your organization. Use Firefox on your corporate computers to decrease virus incidents and increase overall security. Save time and frustration with our installer that is targeted toward the corporate IT administrator with manageability and upgradeability in mind."

I've never used it but it's sure something I'm considering testing for my network environment.

How about Frontmotions MSI packages?

Damn--it's about time they updated. While providing an awesome service, they were continually several months behind in releases. Not good enough when there's a security update. And none of the companies wanted to pay for the service since IE is 'free'.

How about Frontmotions MSI packages?

Those MSI's actually made me send my resume to that company years ago. That and their pay for products. How can you not love a company that was able to engage in all the windows api trickery they had. Making a non shortcut icon to firefox on the desktop like it was "My Computer." Flash animations for the windows login page. I never paid much attention to the UI, they make it cool.

I have a feeling its a one or two man shop though. I doubt they do much hiring.

How about Frontmotions MSI packages?

Uhh, like this?

Posting AC because I'd feel like a slut if I didn't.

http://www.frontmotion.com/Firefox/

Like this?