5 ms·
FTP support is still a big attack surface for the client that has to be managed, regardless of wire security. But my gut reaction to reading this concern is ac
by CGamesPlay 7y ago
FTP support is still a big attack surface for the client that has to be managed, regardless of wire security.
But my gut reaction to reading this concern is actually: why do you think this is “bullying” and not “opening the door for a niche competitor”?
- yjftsjthsd-h 7y agoWhat big attack surface? The client? FTP is an ugly/stupid protocol, but it's not really complex (I suspect it's far simpler than HTTP).
- userbinator 7y agoI'm surprised the article claims there are still bugs, because one would think (hope) that a protocol over 30 years old with an implementation over a decade old should've received its last bugfix long ago and become truly stable by now.
- a_t48 7y agoCan you give an example of a piece of software of reasonable complexity (network/file handling, etc) that has solidified like this?
- kevin_thibedeau 7y agoTeX
- jarfil 7y agoqmail
- kibibu 7y agoSqlite
- a_t48 7y agoThe other ones I might give a pass to as I can't find where the update history lives, but this is untrue - https://www.sqlite.org/changes.html https://www.sqlite.org/changes.html
- hedora 7y agoEverything in the openbsd base image.
- bartread 7y agoWhat? Like OpenSSL: https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed (I mean, I'm not overjoyed at the deprecation of FTP support because I used it just yesterday, but let's at least be honest here. The protocol might be decades old but the implementations aren't necessarily, and if they're being actively maintained there's always the possibility of introducing new bugs.)
- userbinator 7y agoIt was introduced into the software in 2012 That's not the "stable protocol that's been around for decades" situation that FTP is in.
- bartread 7y ago> That's not the "stable protocol that's been around for decades" situation that FTP is in. That is literally the point I was making when I said, "if they're being actively maintained there's always the possibility of introducing new bugs." Moreover, just because a library had its last fix a decade (or whatever) ago is no guarantee that unfixed bugs do not lie undiscovered in it.
- TheSpiceIsLife 7y agoAre you referring to this bit: and there are other bugs in the implementation which further demotivates the FTP support. To me that reads as there are bugs in Chrome's implementation of FTP. Did you take that to mean the author intended to convey the message that the FTP protocol has bugs?
- tylerl 7y agoThe protocol is buggy AF. All that crap about sending data over a separate TCP connection, the weird way you have to deal with state and authentication; ftp is an utter shitshow. Just because a protocol is old doesn't mean it's matured to perfection. Telnet is old, so is RCS, and UUCP. Many protocols evolve not by being replaced by incrementally better point releases, but rather by being supplanted entirely by a better designed alternative. FTP effectively evolved into HTTP for this use case, and scp/sftp for the authenticated file transfer use case.
- duskwuff 7y agoFTP has some pretty serious quirks. Active-mode FTP is probably the craziest one by modern standards -- the client opens a port and asks the server to connect to it to send a file. Needless to say, this is effectively unusable on the modern Internet. Its replacement, passive-mode FTP, has the server open a port instead; this configuration is merely incompatible with most load balancers.
- iforgotpassword 7y agoActive ftp is dead. I wouldn't be surprised if browsers don't support it out at least don't default to it since as you said it would break things for 99% of users. Running a server that's not configured properly for passive transfers is effectively a server that's useless. So if it would make someone sleep better at night I'd be fine with removing active transfer support from browser clients. Switch to filezilla if you're a power user or want to do some 1337 FXP tricks.
- dmix 7y agoIt's not much different than old versions of TLS.
- yjftsjthsd-h 7y agoOh, absolutely! I said it was ugly/stupid from personal experience:) But it's a form of stupid that can be condensed into a single state diagram that would fit on half a sheet of paper, so I'm not super concerned about it.
- hedora 7y agoIn ftp, the ftp server is designed to act as the load balancer. (Just have the firewall point each port to a different IP.) Also, this enables linear scale out, since not all ftp data nodes (not sure what the correct term was) need to store all of the data that’s being served, and you can store multiple copies of each file. Come to think of it, I’m not sure why HDFS exists, given that you can just use a ftp server cluster for the same effect.
- kwhitefoot 7y agoBecause a 'niche competitor' is not really a competitor and would be invisible to almost everyone. And because sich a competitor would require extra work to use, so it would be unpopular.
- earenndil 7y agoFTP can be implemented in such away that it exposes no more potential for attack than html/http.