4 ms·
Mandate SFTP instead?
by richardwhiuk 8y ago
Mandate SFTP instead?
- tptacek 8y agoSFTP is far more complicated than HTTP file upload, which doesn't require support for SSH to function.
- lawl 8y agoThat's a bit of an oversimplification I think. That HTTP upload is/should be wrapped in a TLS connection. Now, I'm not familiar enough with either of those in such detail to be able to say which one is more complicated, but I have a suspicion.
- tptacek 8y agoModern TLS is less complicated than SSH, but even if it weren't, running two competing cryptographic transports is more complicated than just running one. SFTP also provides what is in effect a shell (or, charitably, a remote filesystem), baked into the protocol. For example, SFTP has SETSTAT, which lets you set file attributes. None of what SFTP allows you to do is particularly difficult in HTTP (some of them are made harder by browsers, but that argument doesn't cary any weight since SFTP already requires you to use something other than a browser), but at the same time, none of them need to be baked into a file transfer protocol, either.
- richardwhiuk 8y agoIf you only want file uploads, sure, but that's not all FTP is used for - if you do just want file uploads, sure POST to your hearts content. But designing a HTTP API to implement the function that FTP gives you sounds like madness.
- iofiiiiiiiii 8y agoFTP is not only file uploads, you know. What about all the other filesystem manipulation? You can't simplify it to uploads.
- tptacek 8y agoThe conversation about FTP always revolves around uploads because that's the thing browsers didn't actually do in the 1990s. (20 years later, browsers can pretty much do everything FTP does.)