5 ms·

> Still, anyone even vaguely concerned with security should have stopped using FTP since sometime in the early 00s. Had the same discussion in 2018. But if th

> Still, anyone even vaguely concerned with security should have stopped using FTP since sometime in the early 00s. Had the same discussion in 2018. But if the weak link in the chain is "our (paying) customer is so tech illiterate that they need a printed out tutorial to use an FTP client, and switching to SFTP would anger all clients", what are you going to do.

earthboundkid 6y ago
In my case, the marketing department was using the FTP server, but their client also supported S3, so I told them to use the S3 credentials instead. In another case around 2015, a coworker started and was learning the system. He found that a web store front was being powered by an FTP box that had a list of items in it, and the FTP box was periodically being updated by someone somewhere, but he couldn't figure out who or where. As far as I know, he never figured it out, and the mystery uploads continue to this day…
- zyemuzu 6y ago
  That's great. I've built similar systems and if I disappeared off the face of the earth the same situation would likely arise... SFTP has its issues but it works.
mattmcknight 6y ago
Sometimes you have to just say no, it's not worth risking the whole business. It's better to just write a client app for the customer that's easier for them to use.
- wpietri 6y ago
  In retrospect, I'm sure that's obvious to SolarWinds as a whole company. But at the time, these decisions get made by particular individuals. They're weighing an eventual low-probability risk to the whole company against direct, short-term impact on something their managers are breathing down their necks about. I'm sure there were hundreds of decisions by dozens SolarWinds managers like this that worked out fine. They made some personally and immediately beneficial choice and got praised for getting things done on time and on budget. The latent problem, be it a security risk, a hidden pile of technical debt, or a cut corner, stayed latent. Unless you can rejig the system to change the odds for those individual decision-makers, things like this will keep happening.
  - rorykoehler 6y ago
    That’s why you need an internal audit team.
- ThePadawan 6y ago
  > It's better to just write a client app for the customer that's easier for them to use. I think you are vastly overestimating the capabilities of the users. They are the sort of person who has been using the same version of FileZilla since 1998 to do their weekly file upload of stock data. To them, nothing could ever be easier. Also, I would not be the engineer to want to write a client app in 2020 with Windows XP / IE6 compatibility.
  - im3w1l 6y ago
    Filezilla supports sftp and ftps.
    - earthboundkid 6y ago
      And S3!
londons_explore 6y ago
I would set up all new customers over something secure. I'd have some flag so that new customers can't use something insecure. If my service was used for private data, I'd force old customers to migrate. If not, I would advise them via a service bulletin, but let them carry on with their insecure setup. I understand that in the world of business, security risks are like any other risk, and a dollar value can be put on every security improvement, and sometimes that dollar value isn't good value for money.
thrower123 6y ago
Usually we would give them a link to a page that they could use to upload a file to Box or OneDrive. It's astounding how big a problem sharing files that are too big for email still is.
- linker3000 6y ago
  I've setup ZendTo for a couple of corporates.. The safe, secure and completely free way to transfer large files around the Web. What is ZendTo? It is a classic problem: you need to send files to someone, or they need to send them to you, and there's no way except email. But they are too large or your administrator won't let you transfer the files by email at all. ZendTo to the rescue! Why ZendTo? ZendTo is a completely free web-based system, which you can run on your own server with complete safety and security. It runs from any Linux / Unix server or virtualisation system, there is no size limit and it will send files 50% faster than by email. https://zend.to/ https://zend.to/
  - dtech 6y ago
    How is this different from any of the 1001 other alternatives to this? Corporate usually isn't happy if you use random services like this.
    - EvanAnderson 6y ago
      Looks like you can self-host, for one.
  - julesfm 6y ago
    It's not a "service". It's a web app you can run on your own hardware/VM. All your data stays in-house. That's exactly why corporates love it. You keep total control. And it's completely open-source (GPL) so you can tweak it if you want to.
- ThePadawan 6y ago
  The original use case was that one (virtual) FTP server could be set up per customer, e.g. at ftp://customer01.contoso.com/stock/. This was easy for the customer to upload their .csv onto (at their own convenience, and their own schedule). How would you set up this push-based flow?

earthboundkid 6y ago

In my case, the marketing department was using the FTP server, but their client also supported S3, so I told them to use the S3 credentials instead. In another case around 2015, a coworker started and was learning the system. He found that a web store front was being powered by an FTP box that had a list of items in it, and the FTP box was periodically being updated by someone somewhere, but he couldn't figure out who or where. As far as I know, he never figured it out, and the mystery uploads continue to this day…

zyemuzu 6y ago
That's great. I've built similar systems and if I disappeared off the face of the earth the same situation would likely arise... SFTP has its issues but it works.

mattmcknight 6y ago

Sometimes you have to just say no, it's not worth risking the whole business. It's better to just write a client app for the customer that's easier for them to use.

wpietri 6y ago
In retrospect, I'm sure that's obvious to SolarWinds as a whole company. But at the time, these decisions get made by particular individuals. They're weighing an eventual low-probability risk to the whole company against direct, short-term impact on something their managers are breathing down their necks about. I'm sure there were hundreds of decisions by dozens SolarWinds managers like this that worked out fine. They made some personally and immediately beneficial choice and got praised for getting things done on time and on budget. The latent problem, be it a security risk, a hidden pile of technical debt, or a cut corner, stayed latent. Unless you can rejig the system to change the odds for those individual decision-makers, things like this will keep happening.
- rorykoehler 6y ago
  That’s why you need an internal audit team.
ThePadawan 6y ago
> It's better to just write a client app for the customer that's easier for them to use. I think you are vastly overestimating the capabilities of the users. They are the sort of person who has been using the same version of FileZilla since 1998 to do their weekly file upload of stock data. To them, nothing could ever be easier. Also, I would not be the engineer to want to write a client app in 2020 with Windows XP / IE6 compatibility.
- im3w1l 6y ago
  Filezilla supports sftp and ftps.
  - earthboundkid 6y ago
    And S3!

londons_explore 6y ago

I would set up all new customers over something secure. I'd have some flag so that new customers can't use something insecure. If my service was used for private data, I'd force old customers to migrate. If not, I would advise them via a service bulletin, but let them carry on with their insecure setup. I understand that in the world of business, security risks are like any other risk, and a dollar value can be put on every security improvement, and sometimes that dollar value isn't good value for money.

thrower123 6y ago

Usually we would give them a link to a page that they could use to upload a file to Box or OneDrive. It's astounding how big a problem sharing files that are too big for email still is.

linker3000 6y ago
I've setup ZendTo for a couple of corporates.. The safe, secure and completely free way to transfer large files around the Web. What is ZendTo? It is a classic problem: you need to send files to someone, or they need to send them to you, and there's no way except email. But they are too large or your administrator won't let you transfer the files by email at all. ZendTo to the rescue! Why ZendTo? ZendTo is a completely free web-based system, which you can run on your own server with complete safety and security. It runs from any Linux / Unix server or virtualisation system, there is no size limit and it will send files 50% faster than by email. https://zend.to/ https://zend.to/
- dtech 6y ago
  How is this different from any of the 1001 other alternatives to this? Corporate usually isn't happy if you use random services like this.
  - EvanAnderson 6y ago
    Looks like you can self-host, for one.
- julesfm 6y ago
  It's not a "service". It's a web app you can run on your own hardware/VM. All your data stays in-house. That's exactly why corporates love it. You keep total control. And it's completely open-source (GPL) so you can tweak it if you want to.
ThePadawan 6y ago
The original use case was that one (virtual) FTP server could be set up per customer, e.g. at ftp://customer01.contoso.com/stock/. This was easy for the customer to upload their .csv onto (at their own convenience, and their own schedule). How would you set up this push-based flow?