Firefox ESR uses an older version of NSS than the standard Firefox. Consequences include TLS 1.2 disabled by default, user can enable it, but it is buggier than the lastest version and it does not include new AES-GCM ciphers. The new version also includes support for OCSP stapling, which is supposed to be more privacy friendly than standard OCSP. Pale Moon, which also uses Firefox ESR, has succesfully backported the latest NSS in order to have these advantages.
1 Answer
Every backport costs a significant amount of engineering time. It's not possible due to resource constraints to always track the latest, including libraries. Another point is that the more custom changes we make, the bigger the likelihood of introducing a bug becomes.
