5 ms·

Good. I think FTP is being kept-alive only by legacy fintech (doesn’t the US ACH depend on banks exchanging CSV or TSV files over FTP?) and low-end shared webh

Good. I think FTP is being kept-alive only by legacy fintech (doesn’t the US ACH depend on banks exchanging CSV or TSV files over FTP?) and low-end shared webhosting services that are too afraid to offer SSH to their customers. But I don’t understand why FTP didn’t receive much love from the IETF+etc in the early 2000s to keep it relevant. I know many saw WebDAV as the future, but that was too idealistic imo. Why didn’t any of the FTP server vendors get-together to fix their collective shit instead of letting it die? (No, PASV-mode doesn’t count).

jjoonathan 6y ago
Why reinvent SFTP?
- zrm 6y ago
  The main reason is FTP is often used with untrusted external third parties and configured by enterprise IT staff who only half know what they're doing, and SFTP is really SSH. That makes it really easy to misconfigure it in such a way that the SFTP users can get a shell, which is a giant footgun. Meanwhile the biggest problem with FTPS is just that people misconfigure their own firewalls to prohibit outgoing connections to arbitrary ports for no good reason. (Spoiler alert: All the bad outgoing stuff these days is on TCP/443). Which fails by getting your users to complain to you to fix it, instead of failing by silently giving attackers instant RCE.
  - marcthe12 6y ago
    I wonder if you can run sftp over Https.
hobs 6y ago
Also every enterprise business that I have heard of - FTP isnt going away anytime soon.
kstrauser 6y ago
I'm not sure what could have been done to make a new FTP that was better than SFTP. FTP had a couple of edge cases that were very nifty (like connect to server 1; connect to server 2; tell server 2 to listen; tell server 1 to send to server 2's port; voila, transfer from server1 to server 2 without ever transferring the data to your own host!) but I don't know that anyone ever actually used them. SFTP came along as basically a working, feature-complete replacement. Once it became production-ready, I don't think there was anywhere for FTP to go.
- cecja 6y ago
  Oh god... that's a blast from the past trust me little nerds used it to transfer warez from site to site or pub a long time ago.
- wazoox 6y ago
  Cross-sending is called FXP in video and is(was?) used extensively by all broadcasters, TV channels, etc. So much that it's a must-have functionality for any storage system in this domain.
  - jasonjayr 6y ago
    Given SFTP is ssh based, it seems like it could support agent forwarding + an FXP-like mechanism to jump from server to Server w/o transferring to the controlling host ...
  - mobilemidget 6y ago
    I remember it more from the times when illegal releases were raced to ftp servers to be downloaded by everybody, pre torrent.
- yjftsjthsd-h 6y ago
  > I'm not sure what could have been done to make a new FTP that was better than SFTP. Or HTTPS, IMO; it supports file download/upload, user/pass access control, and encryption. It's a little annoying to have HTTP subsume yet another thing, but it's actually pretty decent at this one.
tannhaeuser 6y ago
I think the use case for WebDAV as an opt-in HTTP extension for managing files on a web server is different from FTP-in-browsers which I understand to be mainly FTP downloads rather than asset uploads.
kube-system 6y ago
It's definitely not just fintech. FTP is commonly used in any industry that complies with EDI standards... which is most of them. Back when EDI formats were first implemented, FTP was the gold standard for sending files across a network, and so that's what basically every large company implemented. Now, many years later, the network effect keeps those systems in place.
smitty1110 6y ago
I was using FTP in AdTech in Q2 of last year. We always had a bit of a chuckle when the onboarding client was so strict about security and obfuscation, but the platform they wanted the data deployed at didn't have any security for uploads. I've moved to a new industry, so I don;t know if this is still the case, but when I left the platform in question had no intention of changing.
skissane 6y ago
> I think FTP is being kept-alive only by legacy fintech (doesn’t the US ACH depend on banks exchanging CSV or TSV files over FTP?) and low-end shared webhosting services that are too afraid to offer SSH to their customers. FTPS is still used in mainframe and minicomputer systems as well. This is because FTP has native support for transferring record-oriented files – STRU R and MODE B/C. Those features are generally not implemented by FTP clients or servers on Linux/macOS/Unix/Windows/etc. Unlike FTP, SFTP does not have native support for record-oriented file transfer. I understand that GridFTP is still used in high-performance computing applications. GridFTP extends FTP with features such as parallel data transfers targeted at transferring massive data sets (terabytes, even petabytes in size) over very high bandwidth links. (Aspera performs better but is proprietary; GridFTP is an open standard with open source implementations.)
xab31 6y ago
It's still used quite heavily in research also (medical is what I'm familiar with). NCBI puts a lot of critical data on FTP, as do individual researchers. In the case of NCBI, the actual transfer protocol usually used is Aspera, but you use the FTP server to find what files you are going to download using Aspera (which is CLI only AFAIK). Thus in this workflow, browser support for FTP is actually important. I would say that the reason it hasn't changed is that it does its job fine. It serves files. It's one of the simplest ways to do so, and I lament that in my sphere the biggest apparent replacement is Dropbox. I agree with one comment above that "legacy" code for FAANG is apparently "features which we can't monetize".
- diggernet 6y ago
  ...and centralize.

jjoonathan 6y ago

Why reinvent SFTP?

zrm 6y ago
The main reason is FTP is often used with untrusted external third parties and configured by enterprise IT staff who only half know what they're doing, and SFTP is really SSH. That makes it really easy to misconfigure it in such a way that the SFTP users can get a shell, which is a giant footgun. Meanwhile the biggest problem with FTPS is just that people misconfigure their own firewalls to prohibit outgoing connections to arbitrary ports for no good reason. (Spoiler alert: All the bad outgoing stuff these days is on TCP/443). Which fails by getting your users to complain to you to fix it, instead of failing by silently giving attackers instant RCE.
- marcthe12 6y ago
  I wonder if you can run sftp over Https.

hobs 6y ago

Also every enterprise business that I have heard of - FTP isnt going away anytime soon.

kstrauser 6y ago

I'm not sure what could have been done to make a new FTP that was better than SFTP. FTP had a couple of edge cases that were very nifty (like connect to server 1; connect to server 2; tell server 2 to listen; tell server 1 to send to server 2's port; voila, transfer from server1 to server 2 without ever transferring the data to your own host!) but I don't know that anyone ever actually used them. SFTP came along as basically a working, feature-complete replacement. Once it became production-ready, I don't think there was anywhere for FTP to go.

cecja 6y ago
Oh god... that's a blast from the past trust me little nerds used it to transfer warez from site to site or pub a long time ago.
wazoox 6y ago
Cross-sending is called FXP in video and is(was?) used extensively by all broadcasters, TV channels, etc. So much that it's a must-have functionality for any storage system in this domain.
- jasonjayr 6y ago
  Given SFTP is ssh based, it seems like it could support agent forwarding + an FXP-like mechanism to jump from server to Server w/o transferring to the controlling host ...
- mobilemidget 6y ago
  I remember it more from the times when illegal releases were raced to ftp servers to be downloaded by everybody, pre torrent.
yjftsjthsd-h 6y ago
> I'm not sure what could have been done to make a new FTP that was better than SFTP. Or HTTPS, IMO; it supports file download/upload, user/pass access control, and encryption. It's a little annoying to have HTTP subsume yet another thing, but it's actually pretty decent at this one.

tannhaeuser 6y ago

I think the use case for WebDAV as an opt-in HTTP extension for managing files on a web server is different from FTP-in-browsers which I understand to be mainly FTP downloads rather than asset uploads.

kube-system 6y ago

It's definitely not just fintech. FTP is commonly used in any industry that complies with EDI standards... which is most of them. Back when EDI formats were first implemented, FTP was the gold standard for sending files across a network, and so that's what basically every large company implemented. Now, many years later, the network effect keeps those systems in place.

smitty1110 6y ago

I was using FTP in AdTech in Q2 of last year. We always had a bit of a chuckle when the onboarding client was so strict about security and obfuscation, but the platform they wanted the data deployed at didn't have any security for uploads. I've moved to a new industry, so I don;t know if this is still the case, but when I left the platform in question had no intention of changing.

skissane 6y ago

> I think FTP is being kept-alive only by legacy fintech (doesn’t the US ACH depend on banks exchanging CSV or TSV files over FTP?) and low-end shared webhosting services that are too afraid to offer SSH to their customers. FTPS is still used in mainframe and minicomputer systems as well. This is because FTP has native support for transferring record-oriented files – STRU R and MODE B/C. Those features are generally not implemented by FTP clients or servers on Linux/macOS/Unix/Windows/etc. Unlike FTP, SFTP does not have native support for record-oriented file transfer. I understand that GridFTP is still used in high-performance computing applications. GridFTP extends FTP with features such as parallel data transfers targeted at transferring massive data sets (terabytes, even petabytes in size) over very high bandwidth links. (Aspera performs better but is proprietary; GridFTP is an open standard with open source implementations.)

xab31 6y ago

It's still used quite heavily in research also (medical is what I'm familiar with). NCBI puts a lot of critical data on FTP, as do individual researchers. In the case of NCBI, the actual transfer protocol usually used is Aspera, but you use the FTP server to find what files you are going to download using Aspera (which is CLI only AFAIK). Thus in this workflow, browser support for FTP is actually important. I would say that the reason it hasn't changed is that it does its job fine. It serves files. It's one of the simplest ways to do so, and I lament that in my sphere the biggest apparent replacement is Dropbox. I agree with one comment above that "legacy" code for FAANG is apparently "features which we can't monetize".

diggernet 6y ago
...and centralize.