12 ms·
Deprecate FTP support (deprecated)
- metalliqaz 6y ago"The current FTP implementation in Google Chrome has no support for encrypted connections (FTPS), nor proxies. Usage of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client. In addition more capable FTP clients are available on all affected platforms." Says it all right there
- tannhaeuser 6y ago> Usage of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client Investing into much more complex browser extensions such as eg QUIC has necessarily even lower usage. Basically, this rationale for removing FTP support is made up/self-delusional when the reality is that Chrome devs want to drop "legacy" features to focus on others.
- perardi 6y agoThat’s a powerful set of scare quotes around “legacy”. FTP, by any reasonable definition, is legacy, and if you need FTP, you have FileZilla, or the terminal.
- Spivak 6y agoFTP is legacy in the sense that it hasn’t hasn’t had the masses giving it love but it’s not dead by any stretch. ProFTPD, pure-ftpd, and vsftpd are all active projects that are shipped with every major Linux distro. It has first class support on Windows through IIS. Every platform has native clients for it. FTP is guilty of not being cool anymore but letting it die completely seems like such a waste. FTP could be the already widely-supported solution to the send a file between two devices problem that has a million bespoke solutions. Oh well.
- viraptor 6y ago> FTP could be the already widely-supported solution to the send a file between two devices problem It really couldn't. It has no discovery, no active identity validation story, issues with NAT traversal, relies on filesystem abstraction, ... In sending a file between two devices the actual file sending is the most trivial part and the only part that FTP can do (in the old and clunky let's-split-control-and-data way). We deserve better.
- Spivak 6y agoHTTP also relies on a the filesystem abstraction, it doesn't stop web servers from presenting virtual versions. The advantage that FTP has is ubiquitous and broad device support. FTP can provide the transport and authentication for a huge variety of devices and provide an instant user story of how to connect with older devices. Discovery and NAT traversal are external to the transport protocol anyway and would be just supporting _ftp._tcp records and the normal TURN/STUN servers.
- viraptor 6y agoHTTP does not use filesystem abstraction. The path in HTTP requests is completely unrelated to files and just looks like a file path. FTP has actual stateful filesystem traversal commands. PWD / CWD / CDUP / ... . Of course it can be faked, but why bother? I understood devices in the comment as personal devices for end users rather than servers. In that case discovery is really not external. Same with NAT - it's a difference between "kind of works sometimes" and "is designed to work with it". See Skype's initial success. Or how SIP documents NAT behaviour extensively https://tools.ietf.org/html/rfc6314 https://tools.ietf.org/html/rfc6314
- perardi 6y agoUh-huh. So, uh, use those clients? Chrome will presumably even send ftp:// links to those clients.
- matthewmacleod 6y agoI guarantee more people use QUIC daily than use FTP.
- anonymousiam 6y agoFTP is 40 years old. I wonder if the same thing could be said about QUIC and FTP 40 years from now...
- yuliyp 6y agoAnd 40 years from now we might be removing QUIC support from whatever we have in place of web browsers.
- anonymousiam 6y agoYes, but in that probable future, FTP will still exist somewhere.
- userbinator 6y ago...because of Google's own efforts in pushing QUIC.
- deleted 6y ago[deleted]
- pmarin 6y agotl;dr they can not put AdSense in a FTP server.
- missblit 6y agoIn case it wasn't clear: deprecating FTP in Chrome was temporarily deprecated for awhile, but then that deprecation was deprecated. In the end leaving FTP in Chrome as deprecated.
- pram 6y agodepreception!
- remote_phone 6y ago“Deprecate” is the most misused technical word I’ve seen in the last 10 years. A whole generation of engineers seem to believe deprecate means to “remove support” or to remove entirely. Like “I just deprecated that function and deleted 100 lines of code.“ It actually means to “discourage use”. It’s the first step for a feature to be removed. You deprecate something and let the users know that they shouldn’t use it if possible and in the future it will be removed. If you used a deprecated API, it means the API is no longer encouraged to be used, but it doesn’t mean the API is removed or that support is withdrawn.
- jayflux 6y agoYou’re not wrong, but the definition seems to have stuck at this point (and it’s been used this way for a lot longer than 10 years, more like double that). I think historically it comes from the fact that when someone “deprecates” their API, they usually abandon it at the same time (because it’s replaced) making the 2 actions synonymous with each other in the tech industry.
- deleted 6y ago[deleted]
- eesmith 6y agoI hadn't heard about this as a synonym for abandonment or replacement before, only the "discourage use" definition, with a possible eye towards future removal. It can't have been that well known. It isn't mentioned on the Wikipedia page https://en.wikipedia.org/wiki/Deprecation https://en.wikipedia.org/wiki/Deprecation . That links to things like http://openjdk.java.net/jeps/277 http://openjdk.java.net/jeps/277 which include quotes like "Very few deprecated APIs were actually removed, leading some people to believe that nothing would ever be removed. On the other hand, other people believed that everything that was deprecated might eventually be removed, which was never the intent either." Or in Python, https://www.python.org/dev/peps/pep-0004/ https://www.python.org/dev/peps/pep-0004/ " This PEP defines a procedure for removing modules from the standard Python library. Usage of a module may be 'deprecated', which means that it may be removed from a future Python release." That terminology is still in use; in https://www.python.org/dev/peps/pep-0632/ https://www.python.org/dev/peps/pep-0632/ published last month, titled "Deprecate distutils module" you can read "In Python 3.10 and 3.11, distutils will be formally marked as deprecated. ... In Python 3.12, distutils will no longer be installed by make install or any of the first-party distribution." That's a two year period where it's deprecated but not removed. Further in the text you can read "Deprecate but do not delete", telling me they aren't viewed as synonyms.
- DaiPlusPlus 6y agoGood. I think FTP is being kept-alive only by legacy fintech (doesn’t the US ACH depend on banks exchanging CSV or TSV files over FTP?) and low-end shared webhosting services that are too afraid to offer SSH to their customers. But I don’t understand why FTP didn’t receive much love from the IETF+etc in the early 2000s to keep it relevant. I know many saw WebDAV as the future, but that was too idealistic imo. Why didn’t any of the FTP server vendors get-together to fix their collective shit instead of letting it die? (No, PASV-mode doesn’t count).
- jjoonathan 6y agoWhy reinvent SFTP?
- zrm 6y agoThe main reason is FTP is often used with untrusted external third parties and configured by enterprise IT staff who only half know what they're doing, and SFTP is really SSH. That makes it really easy to misconfigure it in such a way that the SFTP users can get a shell, which is a giant footgun. Meanwhile the biggest problem with FTPS is just that people misconfigure their own firewalls to prohibit outgoing connections to arbitrary ports for no good reason. (Spoiler alert: All the bad outgoing stuff these days is on TCP/443). Which fails by getting your users to complain to you to fix it, instead of failing by silently giving attackers instant RCE.
- marcthe12 6y agoI wonder if you can run sftp over Https.
- hobs 6y agoAlso every enterprise business that I have heard of - FTP isnt going away anytime soon.
- kstrauser 6y agoI'm not sure what could have been done to make a new FTP that was better than SFTP. FTP had a couple of edge cases that were very nifty (like connect to server 1; connect to server 2; tell server 2 to listen; tell server 1 to send to server 2's port; voila, transfer from server1 to server 2 without ever transferring the data to your own host!) but I don't know that anyone ever actually used them. SFTP came along as basically a working, feature-complete replacement. Once it became production-ready, I don't think there was anywhere for FTP to go.
- superkuh 6y agoBrowsers are slowly shifting away from being browsers and becoming exclusively locked down engines controlled by your feudal lord to run javascript applications.
- bastawhiz 6y agoWhen was "being an FTP client" really ever criteria for being a web browser? Use the right tool for the job.
- icedchai 6y agoEarly on, through the early 2000's, I'd say yes. ftp:// links were often posted on web sites. There was some expectation that clicking those links worked and would download a file. These days? Why bother...
- jandrese 6y agoThe big advantage of FTP is that server support for resuming partial downloads was generally supported, unlike HTTP. Of course the browsers never implemented the resume feature so there wasn't much incentive to use FTP in the browser. Plus Internet connections got better so the need to work around your shitty connection diminished over time.
- LambdaComplex 6y agoHTTP supports range requests, which can be used to resume partial downloads.
- oxinabox 6y agoDoes Windows Explorer still have a built in FTP mode? I think I first used it in Windows 98. And it was still there in Windows 7. It could even do upload which I've never seen a browser offer.
- AnIdiotOnTheNet 6y agoStill there in 10.
- anonymousiam 6y agoThe security problems with FTP extend beyond plain-text authentication. Back when MITM attacks were first becoming popular, FTP was a favorite target. Any executable or installer could be compromised to gain a foothold on the target system.
- tambourine_man 6y agoThe only Windows feature I’m jealous of.
- oxinabox 6y agoI am sure I have done similar in one of the Linux file managers. Maybe Nautilus? Probably many. Never tried in Mac/Finder
- ratww 6y agoFinder has a "Connect to Server" option in the menu. Or you can type an ftp:// URL in Safari and it opens there.
- tambourine_man 6y agoIt does, but it’s read only.
- forgotpwd16 6y ago
- nashashmi 6y agoI am irate at this news. I know ftp is not secure. Not even by a small margin. It is just like http, back when you could still trust network engineers like you could telephone companies. But it is MAD useful. Before file sharing went mainstream, before corporate networks allowed users to upload files to random websites, before file limits went away, before storage space became infinite, ftp was open and available to all people. I actually had a client tell me that our corporate ftp server was blocked by their firewall. It turned out that they were just too lazy to type in the password. So I crafted a link with the password built in! That was how flexible ftp was!!! And if I ever wanted someone to share files with me, I would send them the same ftp link with username and password built in, and tell them to paste it into windows explorer. And they could share files with me. If the client wanted to send link to someone else for download, $he could!!! That was how amazing ftp was. Everyone supported (except iOS). It was tried and proven. I just don’t understand this idea behind letting it go.
- ludamad 6y agoSomehow I don't think crafting a link with a password in it is the best example for arguing for its place in the future :) What sort of migration effort does this cause you?
- nashashmi 6y agoMigration? You mean what other services I can use? If I have a 4 gb file, few services allow me to transfer such a heavy file. And when they do, it’s possible my client has that service blocked from their corporate system. Plus very few services allow me to send my clients a link where they can upload to. Again, if they do, it is blocked. Ftp is never blocked.
- skissane 6y ago> I know ftp is not secure FTP isn't inherently insecure. The protocol supports TLS, Kerberos, GSSAPI. It is just that quite a few clients (including major web browsers) and servers don't implement those extensions, or even when they are implemented people don't know about them and don't use them. A lot of people are under the false impression that the only way to secure FTP is to move to SFTP.
- userbinator 6y agoI still find useful things with Google searches that are hosted on FTP, so this seems very odd and unfortunate. I'd say the "file-based web" is still very much alive. A lot of those files I've come across (usually old software and docs) are unlikely to be found anywhere else, as I'm not even sure if archive.org archives FTP sites. IMHO this is a significant part of the Internet that must be kept alive, because it holds invaluable amounts of irreplaceable data.
- causality0 6y agoNot to mention all the cool stuff you could find by navigating up the directory listing.
- surround 6y agoThe Internet Archive is able to save FTP sites. I don’t know if they actively crawl for them, though.
- dancemethis 6y agoPlease deprecate the term 'deprecate' in favor of the non-bullshit, sincere and direct "depreciate".
- surround 6y agoI don’t think anyone here has mentioned that Firefox is also deprecating FTP.
- arantius 6y agohttps://blog.mozilla.org/addons/2020/04/13/what-to-expect-for-the-upcoming-deprecation-of-ftp-in-firefox/ https://blog.mozilla.org/addons/2020/04/13/what-to-expect-fo...
- vosper 6y agoFor the many people in this thread who seem to think somehow Google is single-handedly killing FTP everywhere for everyone, please refer to the first paragraph in the linked site. Here it is, for the lazy (emphasis mine) > Usage of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client. In addition more capable FTP clients are available on all affected platforms. So chill, you'll still be able to get your stuff via FTP. They're not taking it out of search results or anything, and yes, maybe in 40 years people will still be using FTP for stuff. It's fine, you just won't be using Chrome for it.
- johnklos 6y agoChrome is dumb. I feel bad for all you Chrome users who will end up assuming that Google's idea of the Internet is normal.
- lgats 6y agoLast I checked, chrome canary on Mac would prompt Finder to open any FTP links, completely removing any FTP action from chrome.