4 ms·

Any reason FTP doesn't work ? I imagine you could run an FTP server on a Raspberry Pi

jandrese 5y ago
Being completely plaintext makes it unacceptable for many use cases in the modern world. It's also a touch more complicated than it needs to be for the standard use case. Binary vs. ASCII transfer mode (and ASCII is the default most of the time even though it only very rarely makes sense). Plus the whole passive vs. active mode thing. Too many footguns and no security rule it out.
- lucgommans 5y ago
  If you're running FTP as plaintext you're indeed doing it wrong, I'm not sure that that must be what GP meant. Not as if we explicitly mention (START)TLS for every other protocol that supports it.
  - SilverRed 5y ago
    You can't have secure FTP without a certificate and you can't have a certificate without DNS/domain names unless you want to manually add certificates around which is bad UX again. The ideal situation would be some universal airdrop which will never happen. The next easiest solution is to use cloud storage and send a link to the other person.
    - lucgommans 5y ago
      Yeah, that's fair. I think FileZilla shows who signed the cert, but yeah it still gives that pop-up asking the user to decide and I haven't checked whether they verify that signer against the system CA list. Either way, that's as canon as FTP clients get and since they don't have it, indeed it's mostly opportunistic encryption. (Not that relying on the CA system rather than TOFU'ing or sharing a fingerprint is without problems of its own, but that's a discussion for another thread.)
Fiahil 5y ago
Ftp could work, but the ux is very bad
- offtop5 5y ago
  Then you could just implement your own client. There are already dozens of not hundreds of FTP clients for any device you could imagine, if you don't like the ux take an open source one and clean it up a bit.
BatteryMountain 5y ago
I use an ftp-server on my Android phone, works great! https://f-droid.org/en/packages/be.ppareit.swiftp_free/ https://f-droid.org/en/packages/be.ppareit.swiftp_free/ I guess you can install in on multiple devices (Android phones and tablets), then use a file explorer that supports ftp or use a dedicated ftp client, to then transfer between each other. But accessing my phone from my computers via ftp (Fedora and Windows 10) is a piece of cake and reliable - don't even need anything like filezilla. To stop changing ip's: I recommend having a static ip range in your router instead of using dhcp (or some routers/dhcp server can allocate the same ip address to the same mac address), so all of your devices ip's stay stable (on newer phones, you have to disable the random mac address feature though).

Being completely plaintext makes it unacceptable for many use cases in the modern world. It's also a touch more complicated than it needs to be for the standard use case. Binary vs. ASCII transfer mode (and ASCII is the default most of the time even though it only very rarely makes sense). Plus the whole passive vs. active mode thing. Too many footguns and no security rule it out.

lucgommans 5y ago
If you're running FTP as plaintext you're indeed doing it wrong, I'm not sure that that must be what GP meant. Not as if we explicitly mention (START)TLS for every other protocol that supports it.
- SilverRed 5y ago
  You can't have secure FTP without a certificate and you can't have a certificate without DNS/domain names unless you want to manually add certificates around which is bad UX again. The ideal situation would be some universal airdrop which will never happen. The next easiest solution is to use cloud storage and send a link to the other person.
  - lucgommans 5y ago
    Yeah, that's fair. I think FileZilla shows who signed the cert, but yeah it still gives that pop-up asking the user to decide and I haven't checked whether they verify that signer against the system CA list. Either way, that's as canon as FTP clients get and since they don't have it, indeed it's mostly opportunistic encryption. (Not that relying on the CA system rather than TOFU'ing or sharing a fingerprint is without problems of its own, but that's a discussion for another thread.)

Fiahil 5y ago

Ftp could work, but the ux is very bad

offtop5 5y ago
Then you could just implement your own client. There are already dozens of not hundreds of FTP clients for any device you could imagine, if you don't like the ux take an open source one and clean it up a bit.

BatteryMountain 5y ago

I use an ftp-server on my Android phone, works great! https://f-droid.org/en/packages/be.ppareit.swiftp_free/ https://f-droid.org/en/packages/be.ppareit.swiftp_free/ I guess you can install in on multiple devices (Android phones and tablets), then use a file explorer that supports ftp or use a dedicated ftp client, to then transfer between each other. But accessing my phone from my computers via ftp (Fedora and Windows 10) is a piece of cake and reliable - don't even need anything like filezilla. To stop changing ip's: I recommend having a static ip range in your router instead of using dhcp (or some routers/dhcp server can allocate the same ip address to the same mac address), so all of your devices ip's stay stable (on newer phones, you have to disable the random mac address feature though).