3 ms·
> [...] --ftp-passwd="$(ILCAMPAIGNCASH_FTP_PASSWD)" ftp://ftp.elections.il.gov/[...] Is that using traditional (plaintext) FTP? Is it listening on port 21?
by pdkl95 8y ago
> [...] --ftp-passwd="$(ILCAMPAIGNCASH_FTP_PASSWD)" ftp://ftp.elections.il.gov/[...]
Is that using traditional (plaintext) FTP? Is it listening on port 21?
~ $ ftp ftp.elections.il.gov
Connected to ftp.elections.il.gov (163.191.231.32).
220-Microsoft FTP Service
220 SBE
Name (ftp.elections.il.gov): ^C
It looks like they are sending their password in plaintext. aria2 supports SFTP, so they should really talk to elections.il.gov about moving to SFTP or any other protocol that doesn't send the password in plaintext.
- jwilk 8y agoThis FTP server supports TLS: 211-Extended features supported: LANG EN* UTF8 AUTH TLS;TLS-C;SSL;TLS-P; PBSZ PROT C;P; CCC HOST SIZE MDTM REST STREAM I didn't check if aria2 would actually use it, but I doubt it. Re alternatives to FTP: as far as only downloads are concerned, HTTPS should be way easier to set up than SFTP.
- danso 8y agoI imagine there would be other systems (state-owned and private) that use the FTP server, and maybe in a way that changing protocols is inexplicably full of friction. I wonder why the elections server, assuming it only contains records legal to distribute to the public, is even password protected. Maybe it was a policy when govt bandwidth was scarce. California, for example, has campaign finance data on a public webserver: https://www.californiacivicdata.org/ https://www.californiacivicdata.org/ And the FEC has an API, but has long had the data hosted on public FTP: https://classic.fec.gov/finance/disclosure/ftp_download.shtml https://classic.fec.gov/finance/disclosure/ftp_download.shtm...