7 ms·
Hey let's integrate. Okay want to just FTP the files over? Sure thing
by taf2 9y ago
Hey let's integrate.
Okay want to just FTP the files over?
Sure thing
- icebraining 9y agoWhy not just SFTP the files over?
- taf2 9y agoI agree, so let ask Hey should I use SFTP or FTP Nah, FTP is fine Okay, thanks
- Piskvorrr 9y agoIn my experience, this strongly correlates with "...and your password is l3tme1n." "Wait, isn't that insecure?" "Nah, it's fine, who would want to hack us anyway?" In other words, anyone offering FTP as an integration path in 2017 is most likely wide open for a host of other security holes.
- victorNicollet 9y agoSome people only have FTP as a client capability. We support FTP, FTPS and SFTP, and we constantly push for SFTP with key-based authentication, but every so often FTP is really the only solution that the client is willing to pay for.
- Piskvorrr 9y agoFTP, but no HTTP(S)? I have a hard time believing that.
- victorNicollet 9y agoFor most of these clients, "FTP support" takes the form of a configuration page in their data export wizard, with fields like "host", "username", "password" and "path". If there isn't an "HTTP" checkbox, then they don't have HTTP support.
- teej 9y agoMy experience is that when people say FTP a lot of the times they can mean SFTP.
- crispyambulance 9y ago... or FTPS (which is different from SFTP) !
- laumars 9y agoDifferent but still worse than SFTP: FTPS suffers from all the same problems as FTP (lack of definitive standard for FTP commands nor their returns, poor client server relationship due to the data port being a callback, no standard for native compression, etc) bar the clear text problem* . But ironically the encryption then creates a new issue with clients behind NATing due to the aforementioned lack of client/server distinction. I don't think there is really much excuse not to run SFTP instead of FTP(S) given that most clients already support it. Or use one of the numerous other sharing / transfer protocols available to us now. * unless you misconfigure FTPS that is
- mjevans 9y agoFTPS lets you (easily) use entirely virtual (custom to the FTPS server) users. SFTP requires the use 'real' users (maybe not with fancy daemon software or a headache of PAM rules).
- laumars 9y ago...or virtual machines, containers, or even just defining valid groups in sshd_config. There is a whole multitude of ways of separating out SFTP users, it's really not a hard job to do. Equally a lot of Linux FTP daemons defaults to using /etc/passwd users too. So What you're describing is a configuration detail the administrator needs to be aware of regardless of what transfer server they set up. In that regard FTP is no different from SFTP (or vise versa)
- spydum 9y ago
- victorNicollet 9y agoI'm not sure whether I would pick FTPS or SFTP as the superior protocol for automated file transfer (HTTPS is rather poor, although HTTPS-to-S3 is getting close). On the one hand, SFTP has built-in support for key-based security (client authenticates with its own key, and checks the server's key), but the protocol itself is a mess that pretty much assumes the server is a UNIX box with a typical file system. We had the interesting challenge of writing a windows-based SFTP server that stores data on Azure Storage, and even the most surprising things (like one command to create an empty file, followed by another command to upload to that file) turn into a silly mess, not to mention the difficulty of setting up an SSH server on Windows. FTPS gets those things right: security is based on SSL (more implementations available) and most file-altering operations are done with single commands. On the other hand, it's still password-based (although encrypted) and the data-channel-versus-control-channel problem becomes a mess with load balancing.
- icebraining 9y agoWhy is HTTPS rather poor?
- Piskvorrr 9y agoUpload is too simplistic by default (input type=file), other solutions (html5) are somewhat problematic to implement. Also, recursive download requires some thinking.
- unilynx 9y agoThere's also webdav, or simply, HTTP PUT, which works through any firewall and simply requires 'curl' on the client side. Recursive is still a problem (but the unstandardised list format of FTP isn't that much better)
- victorNicollet 9y agoNo support for directory listing, no support for "last modified date", no support for key-based authentication. Of course, you can use WebDAV (but it's not HTTPs) or do kinda-FTP-over-HTTPS by listing directories in a specific format (but it's not a standard anymore).
- Piskvorrr 9y agoData crosses the public internet in plaintext. Auditors unhappy.
- ams6110 9y agoExcept maybe I've gpg-encrypted the files for the recipient before sending them. Users unhappy.
- Piskvorrr 9y agoIs that more common than HTTPS, simpler, and a standard feature of FTP? I daresay not. In other words, you're making up a convoluted scenario and pretending it's still plain FTP, even though your toolchain got far more esoteric.
- striking 9y agoThat's how banks send records to each other, iirc. Instead of changing the protocol, they just wrapped the data.
- aianus 9y agoAt least in Canada the last bank integration I worked on was FTPS (FTP over SSL). Files were otherwise in plaintext with account numbers and everything.
- Operyl 9y agoThere were a few blog posts posted here from a payroll company not too far back. They explicitly kept using the term “SFTP” so I have some hope that at least a good portion of banks aren’t completely broken. EDIT: http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-1/ http://engineering.gusto.com/how-ach-works-a-developer-persp... I was misremembering a bit. They said “secure FTP” and then just said FTP thereafter.
- user5994461 9y ago
- IgorPartola 9y agoMaybe we need a generic HTTPS fileserver. It's just too easy to apt-get install an FTP server.
- icebraining 9y agoIf you download Caddy with the "http.webdav" plugin, you get a single binary that can do the regular FTP tasks, plus autoconfigures SSL with Let's Encrypt :)
- IgorPartola 9y agoI really need to give caddy a try!