5 ms·

Given that FTP is insecure, and we've had SFTP as a replacement since 1999, I honestly don't see anything wrong here. What's really a shame, is that so many pr

Given that FTP is insecure, and we've had SFTP as a replacement since 1999, I honestly don't see anything wrong here. What's really a shame, is that so many providers still only support FTP.

nbsd4lyfe 9y ago
tnftp does HTTP and HTTPS. the command name is a misnomer.
RyJones 9y ago
We only very recently turned off ftp support for Linux kernel mirrors - a red letter day, to be sure
marmaduke 9y ago
that’s a narrow view. Maybe I need to debug an old server on the intranet? Maybe some provider only allows FTP downloads with checksums via HTTPS? Protocols should become useless before dropping the client from standard distributions.
- sbierwagen 9y ago
  If you have ssh access, you have sftp access. If your company still uses rlogin and ftp, then get a new job before they get hacked and blame whoever touched the server last.
  - noobermin 9y ago
    I use a petaflop system everyday to run computational simulations. The tape system is accessed via rcp because it's connected via intranet to the login nodes. I'm not saying ftp over the internet has valid uses, it probably doesn't, but if it's in a controlled environment, why not? What's next, is mac going to obsolete telnet? There goes a host of quick tests you can utilize on a home network.
    - dan1234 9y ago
      telnet doesn't exist on my Mac (High Sierra). It also doesn't exist on my linux server (Debian 9). Easily fixable with `brew install telnet` and `sudo apt install telnet`.
    - majewsky 9y ago
      Nitpick: By telnet, you probably mean ncat. I don't think there's anything on a contemporary home network that speaks RFC 854.
  - vetinari 9y ago
    That's not true - both sftp and scp require server-side support. You can have ssh, but without sftp or scp. OpenWRT ships in this config by default, for example (https://wiki.openwrt.org/doc/howto/sftp.server https://wiki.openwrt.org/doc/howto/sftp.server). The only thing that would work in this situation is FISH.
- __david__ 9y ago
  I know, right? I can't believe they dropped rlogin, too! Yes, I'm being snarky. Dropping it from the standard distribution is a good kick in the butt for anyone backward enough to still rely on plain old ftp in this day and age. Remember passive mode? Remember ascii mode? Oy. Good riddance. Even "telnet" isn't in some base linux systems. Also it's one "brew install lftp" away for anyone who is really can't get around using it.
  - neilalexander 9y ago
    telnet is gone from macOS High Sierra too.
- ubernostrum 9y ago
  Protocols should become useless before dropping the client from standard distributions. This statement is identical to "All operating-system developers must support every protocol ever developed, until the heat death of the universe". I am not exaggerating. No matter the protocol, no matter how obscure it is, somewhere there is at least one person whose workflow is dependent on it and who will complain that it is, as a result, not "useless" and must be supported out-of-the-box by their operating system. Those people can learn to install a client. If any of them happen to be the only user in the world of a given protocol and be doing it solely on machines to which they have no write access, well, they painted themselves into the corner and now can deal with the consequences of it.
  - marmaduke 9y ago
    They aren’t identical statements. FTP is commonplace enough and suddenly dropped. Not so for other more obscure protocols where we expect to install specific software eg TFTP for PXE boot.
- curun1r 9y ago
  > Maybe some provider only allows FTP downloads with checksums via HTTPS? curl -O -u user:password ftp://whatever.site.com/filename Curl comes with MacOS and still supports ftp, even if they removed the ftp executable.
alwillis 9y ago
brew install lftp
- Twisell 9y ago
  Also in the support thread someone complained that they changed order of path so that usr/local/bin/ have priority over usr/bin/. But I’m not sure it’s that bad. Because this way Apple kind of acknowledge that if someone install something in local they must now what they are doing and this because default for users path.
  - tambourine_man 9y ago
    *must know
  - tkxxx7 9y ago
    I much prefer the local priority and will always reorder paths that way on a new machine.
dvfjsdhgfv 9y ago
There is nothing insecure in a protocol by itself. In this case, since it lacks encryption, it shouldn't be used over insecure networks such as the Internet on its own. But it's by no means the only way it's being used. There is a place for FTP, Telnet, TFTP and many other basic protocols - it all depends on how you use them. The only thing that Apple gained by this is that people will use third-party FTP clients (which might be good given Apple's recent lack of focus on security anyway.)

Given that FTP is insecure, and we've had SFTP as a replacement since 1999, I honestly don't see anything wrong here. What's really a shame, is that so many providers still only support FTP.

nbsd4lyfe 9y ago

tnftp does HTTP and HTTPS. the command name is a misnomer.

RyJones 9y ago

We only very recently turned off ftp support for Linux kernel mirrors - a red letter day, to be sure

marmaduke 9y ago

that’s a narrow view. Maybe I need to debug an old server on the intranet? Maybe some provider only allows FTP downloads with checksums via HTTPS? Protocols should become useless before dropping the client from standard distributions.

sbierwagen 9y ago
If you have ssh access, you have sftp access. If your company still uses rlogin and ftp, then get a new job before they get hacked and blame whoever touched the server last.
- noobermin 9y ago
  I use a petaflop system everyday to run computational simulations. The tape system is accessed via rcp because it's connected via intranet to the login nodes. I'm not saying ftp over the internet has valid uses, it probably doesn't, but if it's in a controlled environment, why not? What's next, is mac going to obsolete telnet? There goes a host of quick tests you can utilize on a home network.
  - dan1234 9y ago
    telnet doesn't exist on my Mac (High Sierra). It also doesn't exist on my linux server (Debian 9). Easily fixable with `brew install telnet` and `sudo apt install telnet`.
  - majewsky 9y ago
    Nitpick: By telnet, you probably mean ncat. I don't think there's anything on a contemporary home network that speaks RFC 854.
- vetinari 9y ago
  That's not true - both sftp and scp require server-side support. You can have ssh, but without sftp or scp. OpenWRT ships in this config by default, for example (https://wiki.openwrt.org/doc/howto/sftp.server https://wiki.openwrt.org/doc/howto/sftp.server). The only thing that would work in this situation is FISH.
__david__ 9y ago
I know, right? I can't believe they dropped rlogin, too! Yes, I'm being snarky. Dropping it from the standard distribution is a good kick in the butt for anyone backward enough to still rely on plain old ftp in this day and age. Remember passive mode? Remember ascii mode? Oy. Good riddance. Even "telnet" isn't in some base linux systems. Also it's one "brew install lftp" away for anyone who is really can't get around using it.
- neilalexander 9y ago
  telnet is gone from macOS High Sierra too.
ubernostrum 9y ago
Protocols should become useless before dropping the client from standard distributions. This statement is identical to "All operating-system developers must support every protocol ever developed, until the heat death of the universe". I am not exaggerating. No matter the protocol, no matter how obscure it is, somewhere there is at least one person whose workflow is dependent on it and who will complain that it is, as a result, not "useless" and must be supported out-of-the-box by their operating system. Those people can learn to install a client. If any of them happen to be the only user in the world of a given protocol and be doing it solely on machines to which they have no write access, well, they painted themselves into the corner and now can deal with the consequences of it.
- marmaduke 9y ago
  They aren’t identical statements. FTP is commonplace enough and suddenly dropped. Not so for other more obscure protocols where we expect to install specific software eg TFTP for PXE boot.
curun1r 9y ago
> Maybe some provider only allows FTP downloads with checksums via HTTPS? curl -O -u user:password ftp://whatever.site.com/filename Curl comes with MacOS and still supports ftp, even if they removed the ftp executable.

alwillis 9y ago

brew install lftp

Twisell 9y ago
Also in the support thread someone complained that they changed order of path so that usr/local/bin/ have priority over usr/bin/. But I’m not sure it’s that bad. Because this way Apple kind of acknowledge that if someone install something in local they must now what they are doing and this because default for users path.
- tambourine_man 9y ago
  *must know
- tkxxx7 9y ago
  I much prefer the local priority and will always reorder paths that way on a new machine.

dvfjsdhgfv 9y ago

There is nothing insecure in a protocol by itself. In this case, since it lacks encryption, it shouldn't be used over insecure networks such as the Internet on its own. But it's by no means the only way it's being used. There is a place for FTP, Telnet, TFTP and many other basic protocols - it all depends on how you use them. The only thing that Apple gained by this is that people will use third-party FTP clients (which might be good given Apple's recent lack of focus on security anyway.)