21 ms·
Chromium: FTP resources will be marked “Not Secure”
- Piskvorrr 9y agoGood. I'm very much surprised that FTP still exists in this century.
- taf2 9y agoHey let's integrate. Okay want to just FTP the files over? Sure thing
- icebraining 9y agoWhy not just SFTP the files over?
- taf2 9y agoI agree, so let ask Hey should I use SFTP or FTP Nah, FTP is fine Okay, thanks
- Piskvorrr 9y agoIn my experience, this strongly correlates with "...and your password is l3tme1n." "Wait, isn't that insecure?" "Nah, it's fine, who would want to hack us anyway?" In other words, anyone offering FTP as an integration path in 2017 is most likely wide open for a host of other security holes.
- victorNicollet 9y agoSome people only have FTP as a client capability. We support FTP, FTPS and SFTP, and we constantly push for SFTP with key-based authentication, but every so often FTP is really the only solution that the client is willing to pay for.
- Piskvorrr 9y agoFTP, but no HTTP(S)? I have a hard time believing that.
- victorNicollet 9y agoFor most of these clients, "FTP support" takes the form of a configuration page in their data export wizard, with fields like "host", "username", "password" and "path". If there isn't an "HTTP" checkbox, then they don't have HTTP support.
- teej 9y agoMy experience is that when people say FTP a lot of the times they can mean SFTP.
- crispyambulance 9y ago... or FTPS (which is different from SFTP) !
- laumars 9y agoDifferent but still worse than SFTP: FTPS suffers from all the same problems as FTP (lack of definitive standard for FTP commands nor their returns, poor client server relationship due to the data port being a callback, no standard for native compression, etc) bar the clear text problem* . But ironically the encryption then creates a new issue with clients behind NATing due to the aforementioned lack of client/server distinction. I don't think there is really much excuse not to run SFTP instead of FTP(S) given that most clients already support it. Or use one of the numerous other sharing / transfer protocols available to us now. * unless you misconfigure FTPS that is
- mjevans 9y agoFTPS lets you (easily) use entirely virtual (custom to the FTPS server) users. SFTP requires the use 'real' users (maybe not with fancy daemon software or a headache of PAM rules).
- laumars 9y ago...or virtual machines, containers, or even just defining valid groups in sshd_config. There is a whole multitude of ways of separating out SFTP users, it's really not a hard job to do. Equally a lot of Linux FTP daemons defaults to using /etc/passwd users too. So What you're describing is a configuration detail the administrator needs to be aware of regardless of what transfer server they set up. In that regard FTP is no different from SFTP (or vise versa)
- spydum 9y ago
- victorNicollet 9y agoI'm not sure whether I would pick FTPS or SFTP as the superior protocol for automated file transfer (HTTPS is rather poor, although HTTPS-to-S3 is getting close). On the one hand, SFTP has built-in support for key-based security (client authenticates with its own key, and checks the server's key), but the protocol itself is a mess that pretty much assumes the server is a UNIX box with a typical file system. We had the interesting challenge of writing a windows-based SFTP server that stores data on Azure Storage, and even the most surprising things (like one command to create an empty file, followed by another command to upload to that file) turn into a silly mess, not to mention the difficulty of setting up an SSH server on Windows. FTPS gets those things right: security is based on SSL (more implementations available) and most file-altering operations are done with single commands. On the other hand, it's still password-based (although encrypted) and the data-channel-versus-control-channel problem becomes a mess with load balancing.
- icebraining 9y agoWhy is HTTPS rather poor?
- Piskvorrr 9y agoUpload is too simplistic by default (input type=file), other solutions (html5) are somewhat problematic to implement. Also, recursive download requires some thinking.
- unilynx 9y agoThere's also webdav, or simply, HTTP PUT, which works through any firewall and simply requires 'curl' on the client side. Recursive is still a problem (but the unstandardised list format of FTP isn't that much better)
- victorNicollet 9y agoNo support for directory listing, no support for "last modified date", no support for key-based authentication. Of course, you can use WebDAV (but it's not HTTPs) or do kinda-FTP-over-HTTPS by listing directories in a specific format (but it's not a standard anymore).
- Piskvorrr 9y agoData crosses the public internet in plaintext. Auditors unhappy.
- ams6110 9y agoExcept maybe I've gpg-encrypted the files for the recipient before sending them. Users unhappy.
- Piskvorrr 9y agoIs that more common than HTTPS, simpler, and a standard feature of FTP? I daresay not. In other words, you're making up a convoluted scenario and pretending it's still plain FTP, even though your toolchain got far more esoteric.
- striking 9y agoThat's how banks send records to each other, iirc. Instead of changing the protocol, they just wrapped the data.
- aianus 9y agoAt least in Canada the last bank integration I worked on was FTPS (FTP over SSL). Files were otherwise in plaintext with account numbers and everything.
- Operyl 9y agoThere were a few blog posts posted here from a payroll company not too far back. They explicitly kept using the term “SFTP” so I have some hope that at least a good portion of banks aren’t completely broken. EDIT: http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-1/ http://engineering.gusto.com/how-ach-works-a-developer-persp... I was misremembering a bit. They said “secure FTP” and then just said FTP thereafter.
- user5994461 9y ago
- IgorPartola 9y agoMaybe we need a generic HTTPS fileserver. It's just too easy to apt-get install an FTP server.
- icebraining 9y agoIf you download Caddy with the "http.webdav" plugin, you get a single binary that can do the regular FTP tasks, plus autoconfigures SSL with Let's Encrypt :)
- IgorPartola 9y agoI really need to give caddy a try!
- LarryMade2 9y agoFTP is still valid for larger files - mainly in the printing industry where job uploads could easily be multiple hundreds of MBs, some now use 3rd party document transfer sites but most still rely on FTP (usually with a password access)
- AndrewDucker 9y agoIs it faster than HTTP?
- Piskvorrr 9y agoNope (both are capable of saturating a line). Also, does it protect the data in transit? Nope (HTTPS does, rarely do I see plain HTTP any more). Does it have resume capabilities? Nope. Does it play well with NAT or proxies? Nope. Does it mangle data in transfer? Yes. The only thing that keeps FTP around is its ubiquity.
- eganist 9y agoPedantic correction: > Does it have resume capabilities? Nope. See RFC 959, > RESTART (REST) > > The argument field represents the server marker at which > file transfer is to be restarted. This command does not > cause file transfer but skips over the file to the specified > data checkpoint. This command shall be immediately followed > by the appropriate FTP service command which shall cause > file transfer to resume. And it would seem the definition from the RFC isn't even what's commonly implemented anymore, per https://cr.yp.to/ftp/retr.html https://cr.yp.to/ftp/retr.html (ctrl/cmd+f "The REST verb" no quotes) Finally, if we're including HTTPS and comparing HTTP v FTP, why not include FTPS? https://en.wikipedia.org/wiki/FTPS https://en.wikipedia.org/wiki/FTPS (edit: probably because Chrome doesn't support it. Heh.)
- mmahemoff 9y agoI remember the collective joy when ncftp [1] turned up as an alternative to the default ftp client, suddenly making it possible to resume FTP transfers. An important feature when you've initiated a large (several MB) file with a dialup modem but someone in the house needs to make a phone call. IIRC FTP clients throughout the '90s were actually more reliable than browsers at resuming downloads. 1. https://en.wikipedia.org/wiki/NcFTP https://en.wikipedia.org/wiki/NcFTP
- Crontab 9y agoI find anonymous ftp to still be useful for distributing files to users. But for personal files? No.
- Piskvorrr 9y agoWith the alternatives of HTTP, HTTPS, rsync, Bittorrent and whatnot, what is the advantage of FTP? Even HTTP clients are more prevalent nowadays.
- user5994461 9y agorsync => linux only bittorent => not available out of the box and prohibited in all companies
- mfontani 9y agohttps://www.itefix.net/cwrsync https://www.itefix.net/cwrsync is just one rsync (client) for Windows, I'm sure there are more, including the Cygwin one
- tempay 9y agorsync is also available on macOS. I guess you mean "not Windows" (which is also incorrect, though it's not as ubiquitous as on Linux).
- damnyou 9y agoBoth Facebook and Twitter use BitTorrent to deploy binaries onto production machines.
- Theodores 9y agoSo if rsync is only for Linux then how does everyone else do any work? On Linux it is the preferred option, there is delete mode, ability to ignore folders and differential compression. It just works. Plus you don't have to move a mouse around. The other common way for me to upload or download files is with version control. Imagine if we integrated git into the browser and server to have something vastly more sensible.
- chrisper 9y agoFTPS is quite slow on my gbit machine when uploading large files compared to just FTP. I think it's due to the handshake of SSL. Next I want to see if FTP over OPENVPN is faster.
- peterwwillis 9y agoHTTPS is not a file transfer protocol, nor is it a network service designed for transferring files. People don't realize this until they need to send several gigabytes/terabytes of files in different directories with different permissions owned by different users, and suddenly they need to implement an FTP server over HTTP. Not to mention server-to-server syncing. FTP is still very useful, and is depended upon by tons of corporations for bulk transfers and sensitive transactions. It is trivial to add SSL to FTP, or use SFTP if your clients/servers support it.
- spydum 9y agoSort of disagree.. HTTP (and HTTPS by extension) have become the veritable Swiss Army knife of the internet. It's not just for hypertext anymore.
- nashashmi 9y agoFTP is way nicer than any of the other services that can be used. To send someone a file, I send them a link that they can easily use to download from the FTP site. ftp://[UserName]:[Password]@ftp.site.com/readme.txt It also allows them to upload stuff to it too.
- ChrisSD 9y agoFirefox Send[0] is a pretty easy way to do one-to-one file sharing. As a bonus the file is encrypted before being transferred and decrypted after download. [0] https://send.firefox.com/ https://send.firefox.com/
- graphememes 9y agooh boy... you're really peddling a web service over a self hosted and completely self owned system? has the ability to develop and work on technology dropped this low? this is a regression.
- ChrisSD 9y agoCreating and maintaining a self hosted and completely self owned system that's secure and functional is a fun project but it is hardly necessary for one-to-one file transfer. So yes I'm "peddling" a free web service over a DIY approach, especially as securing a public server isn't quite as trivial as you make it sound. It does take knowledge and sustained effort.
- dvfjsdhgfv 9y agoIt depends on what services you are exposing. If it's just SSH and HTTP, the risk and difficulties are really low if you follow a few simple rules. The bonus is that you can learn many interesting things in an experiential, personal way.
- dvfjsdhgfv 9y agoThis kind of approach is quite common nowadays, not only because people have different priorities, but also because there are strong financial incentives to promote "products and services" (websites that help you do something). The rest of us is happily using self-hosted services wondering how anyone else is handing their own data on a plate to complete strangers.
- takeda 9y agoIt exists because HTTP is not a good replacement for it. It's especially mediocre when you want to download/upload multiple files like a directory with many files inside of it. A friend recently shared with me his file collection, through OwnCloud. It was such a pain to download. Each file is a separate link. I can't use wget to pull it, because of authentication. It had some cli tools, but it was buggy and couldn't make it work. And of course no ftp. Essentially it forced me to click every single file. I couldn't even verify the files downloaded correctly. FTP is actually great for what it does and with clients like lftp it's fairly enjoyable to use. If you want to kill it, better make a worthy alternative.
- zaggynl 9y agoOwncloud/Nextcloud has WebDAV support as well, though that's not great either I guess :/
- rootkea 9y ago> I can't use wget to pull it, because of authentication. What are you talking about? Wget supports --user and --password options.
- GuB-42 9y agoBesides the lack of encryption and proper authentication in the base protocol, it also has a two ports requirement that make it troublesome with firewalls/NAT. The two port system allows a separate, text based control protocol with the ability to transfer files between two remote systems (FXP). These features don't really matter anymore and the second one is a security nightmare. A better alternative would be SFTP, which is based on SSH and is pre-installed on most UNIX-like system. The only problem is that web browsers don't support it natively.
- deleted 9y ago[deleted]
- DonHopkins 9y agoI liked to leave a file in the top level public ftp directory called "README" that contained just the line: README: No such file or directory. Somebody once emailed me complaining they couldn't read that file. I told them to run "emacs README" because emacs could solve any problem. Never heard back!
- fiddlerwoaroof 9y agoHe's probably still trying to quit emacs
- victorNicollet 9y agoM-x vim-keys-mode, then :q ?
- EGreg 9y agohttps://medium.freecodecamp.org/one-out-of-every-20-000-stack-overflow-visitors-is-just-trying-to-exit-vim-5a6b6175e7b6 https://medium.freecodecamp.org/one-out-of-every-20-000-stac...
- thinkMOAR 9y agoIn my humble opinion, i find the label 'not encrypted' better fitting than 'not secure'. [ edit after replies ] Agreed, perhaps i unrightfully assumed people now what 'encrypted' means. Growing up with computers i don't know any better and sometimes forget or can't properly imagine what layman know and don't know.
- Operyl 9y agoTo the users they’re trying to target here, Not Secure makes a lot more sense than Not Encrypted I think.
- mattrick 9y agoIMO, "Not Secure" means a lot more to the layperson than "Not Encrypted". They're trying to push HTTPS adoption by punishing websites that don't use it. Sure "Not Encrypted" is more accurate, but not everybody is going to know what that means.
- cesarb 9y agoHTTPS is more than just "encrypted", it's also "authenticated". That is, plain-text HTTP and FTP is not only "Not Encrypted", but also "Not Authenticated"; saying "Not Secure" captures both properties at the same time.
- Gracana 9y ago"Authenticated" is debatable. Someone has spent a few minutes on a third-party website to enable the green checkbox. Whether that means they are who you think they are is another matter.
- tentaTherapist 9y agoYeah, it's authenticated but only to the degree that you know that they own the domain name, and there are no other guarantees that they are who they say they are. Secure is way too strong a word.
- paulddraper 9y ago
- lousken 9y agodoes chrome even support ftps?
- forgot-my-pw 9y agoIt doesn't according to the 3rd comment in the link.
- tazeg95 9y agobecause it's a language for beginners
- graphememes 9y agoToday, reading the comments, I have learned that a lot of hacker news readers do not understand FTP.
- snakeanus 9y agoFTP nowadays is only useful for fetching resources from very old sites. Everyone I know has switched over to sftp and other ssh-based solutions.