5 ms·

This is frustrating. FTP is really handy for distributing some files and there are lots of servers in place that now Firefox users can’t access. One can argue

This is frustrating. FTP is really handy for distributing some files and there are lots of servers in place that now Firefox users can’t access. One can argue that servers should upgrade, and that’s valid. But they don’t and they likely won’t do this just harms Firefox’s user base and is one more reason I no longer recommend Firefox. They just don’t seem user friendly as they once were. I would expect Mozilla to advocate for more FTP as a cheap way of distributing files.

tptacek 5y ago
People made exactly the same arguments, almost to the letter, about universalizing TLS. The arguments were made in good faith, often by very clueful people, but it's hard to dispute the positive results of the change. FTP needs to go.
- sschueller 5y ago
  While we are at it, let's remove the domain name and replace it with something readable and maybe just default to Google without the ability to change your home or maybe Facebook. /s
  - tptacek 5y ago
    You could have said that, too, about universal TLS.
    - nitrogen 5y ago
      Is there a solution yet for universal TLS with offline "IoT" (but not on the Internet) devices?
      - akerl_ 5y ago
        Vault? “Not on the internet IoT” is basically the domain of either large industrial/commercial entities who already pay engineers to design and operate their gear (and for whom there are a number of viable internal-PKI platforms) or hobbyist tech people who want to do fancy segmentation of their IoT gear (and for whom there are a host of open source PKI helpers). The general human in 2021 who buys IoT gear puts it on their Wifi and goes back to other things.
        nitrogen 5y ago
        The general human in 2021 who buys IoT gear puts it on their Wifi and goes back to other things. Fallacy of the "general human" aside...how do you configure it? How do you configure your Wifi in the first place? The app- and service-centric world that people have been forced into by the laziness of developers, the desire for surveillance data, and the deprecation of browser features, is the worst of all possible worlds. Devices have full network connectivity, so that security camera you bought becomes part of a botnet, hacks your laptop, and installs ransomware or steals your financial info/bitcoin wallet. Companies control your house and your data, so when they disappear, or when Nest pushes out a bad firmware update, your devices (and your thermostat!) stop working. Technology is realizing only a small fraction of its promise, and rather than empowering people, is acting as just another set of shackles that binds people to the whims of the powerful. The best instruments for changing that, namely web browsers and truly independent, user-owned devices, are being destroyed one small step at a time. So, in 2021, the question stands, and you've made no attempt to answer it -- how is any device supposed to break out of this sinkhole and restore the power of technology, if browsers block local devices' UIs, and users can't even configure the device without the blessing of Google or Apple?
        akerl_ 5y ago
        I think we took a left turn midway between my comment and your reply. You asked how people should handle universal TLS for internet-disconnected systems. The answer I gave addressed that directly: there are commercial and open source tools for doing so (MSCA, Vault, EJBCA, smallstep, FreeIPA, to name a few). But the overwhelming majority of actual individual users do not desire to segment their IoT devices off the internet. That’s not a “fallacy”, that’s just a fact. It’s clear that you have objections to the current state of general purpose computing, and desire that technology existed differently. But that’s a pretty far step away from the topic here.
- dmux 5y ago
  And it completely cut off older devices from being able to access content that often didn't need to be transferred over TLS.
  - tptacek 5y ago
    Shrug! It's commercial infrastructure, not a fetish. You saw the same arguments when the Python Cryptography library started adopting Rust to replace memory-unsafe C code in their C library. People running, like, DEC Alphas in their basements for sport were furious. It was on the front page of HN for several days. It blew over, because nobody really cares about those people in a durable, meaningful way. Same situation with FTP. It's dead. Stick a fork in it.
    - dmux 5y ago
      Absolutely not the same situation. There are numerous mentions in this very thread about industries / sectors that still heavily rely on FTP. There's hundreds of millions of dollars worth of contracts that rely on data being transferred using that protocol. This isn't people enjoying retro computing. This is day-to-day operations.
      - tptacek 5y ago
        And they'll make do without Firefox and Chrome, just like the DEC Alpha in the basement didn't explode when the Cryptography team moved away from C. For whatever it's worth: those industries should not be relying on FTP. FTP is bad. But I'm not advocating to ban it from the Internet; rather, I'm just saying, nobody should make software security compromises of any sort to continue supporting it.
      - tedunangst 5y ago
        A hundred million dollars is probably sufficient to hire some consultants to maintain Firefox 89.
metalliqaz 5y ago
I'm a Firefox user, and Firefox doesn't support torrents. Yet, I can access torrents. Because of course you can have dedicated protocol handlers that do the job better than the download manager baked into the browser. Sure, there might be a user that doesn't know how to get a good FTP tool. But how many FTP servers are they accessing? Probably not enough of those to justify the maintenance effort.
- tomc1985 5y ago
  The concern here is more that a lot of old websites embed ftp:// URLs into their links, which this will break. Now they have to be handled by an external protocol handler, and I'd bet most of us don't have one set up, so things will be a little bumpy for a bit
lallysingh 5y ago
FTA: "To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user’s device using the FTP protocol." It removes a malware vector going through Firefox. But seriously, who's serving FTP but doesn't serve HTTPS?
tomc1985 5y ago
I used to agree with this, but with how easy it is to run MITM attacks these days I think there is a pretty compelling argument for removing plaintext FTP. I don't think FTPS should go, but tbh I don't think I have ever encountered an FTPS server in-the-wild. It's one thing to have your password stolen, but another thing entirely to have your download and its shasum/md5sum/whatever sidecar file replaced in-flight
gruez 5y ago
> This is frustrating. FTP is really handy for distributing some files and there are lots of servers in place that now Firefox users can’t access. Why are people still using ftp rather than http?
- handrous 5y ago
  For one thing, you can't manage files over the same protocol you use to serve them, with HTTP, without extra application-layer add-ons (WebDAV or custom web file management junk) FTP can both serve and manage, all over one protocol. "But why wouldn't you use some other method to manage your files? Why combine the two?" I dunno, but WordPress is basically that (managing your blog's/site's appearance, content, and server-side plugins, over the same interface/protocol that serves the blog/site) but for blogs & websites, and it's damn near the most successful Web project ever, so there must be something to it unless that's not a big reason for its success (and I'm pretty sure it is). I can certainly see the appeal if your main focus is serving files, or providing file-serving hosting to others (say, other departments, or to paying clients, or whatever). One daemon to configure for the whole task.
  - da_chicken 5y ago
    And why can't you just use a dedicated FTP client?
    - handrous 5y ago
      It's been nice to be able to link to ftp-served files or directories on websites and have that Just Work, ever since FTP was added to web browsers. You may as well say, "why have embedded video on the web? Just open video links in VLC."
duskwuff 5y ago
> there are lots of [FTP] servers in place... Define "lots". Chrome dropped FTP support in late 2020 and basically nobody noticed. The vast majority of the remaining public FTP servers are also accessible over HTTP. > I would expect Mozilla to advocate for more FTP as a cheap way of distributing files. In what sense is FTP "cheap"? What makes it any different from HTTP in that regard?
- dmux 5y ago
  >basically nobody noticed Maybe people outside of the tech world failed to notice, but it was discussed here at the time: https://hn.algolia.com/?q=chrome+ftp https://hn.algolia.com/?q=chrome+ftp
- jeppesen-io 5y ago
  That's funny - I did't notice myself. No idea it was removed
- qubidt 5y ago
  > Define "lots" a ton of government and scientific datasets are provided over FTP
  - Symbiote 5y ago
    The majority are also available on HTTP. It saves a lot of confused users at other government / scientific institutions, where the firewall blocks FTP.
    - qubidt 5y ago
      Even accounting for that (ignoring that the data served over FTP and HTTP aren't always perfectly equivalent), it still leaves a lot of stuff that is only served over ftp. Google found it a convincing enough argument to warrant re-enabling ftp support last year, in light of the pandemic: https://www.theregister.com/2020/04/15/ftp_chrome_deprecation_on_hold/ https://www.theregister.com/2020/04/15/ftp_chrome_deprecatio... That doesn't mean I'm against deprecation completely. But you can't pretend it won't affect people
EMM_386 5y ago
I have been using Firefox since Phoenix/Firebird, so over 20 years, and have never once used it's FTP feature. I've used FTP, fairly heavily back at an old job that required it, but I have an FTP client. They are a dime a dozen for every platform. But I haven't used FTP at all in at least a decade. Mozilla should focus their efforts in their web browser on web browsing. If you need to FTP, Gopher, or torrent over the internet, you can grab a client that does those things.

tptacek 5y ago

People made exactly the same arguments, almost to the letter, about universalizing TLS. The arguments were made in good faith, often by very clueful people, but it's hard to dispute the positive results of the change. FTP needs to go.

sschueller 5y ago
While we are at it, let's remove the domain name and replace it with something readable and maybe just default to Google without the ability to change your home or maybe Facebook. /s
- tptacek 5y ago
  You could have said that, too, about universal TLS.
  - nitrogen 5y ago
    Is there a solution yet for universal TLS with offline "IoT" (but not on the Internet) devices?
    - akerl_ 5y ago
      Vault? “Not on the internet IoT” is basically the domain of either large industrial/commercial entities who already pay engineers to design and operate their gear (and for whom there are a number of viable internal-PKI platforms) or hobbyist tech people who want to do fancy segmentation of their IoT gear (and for whom there are a host of open source PKI helpers). The general human in 2021 who buys IoT gear puts it on their Wifi and goes back to other things.
      - nitrogen 5y ago
        The general human in 2021 who buys IoT gear puts it on their Wifi and goes back to other things. Fallacy of the "general human" aside...how do you configure it? How do you configure your Wifi in the first place? The app- and service-centric world that people have been forced into by the laziness of developers, the desire for surveillance data, and the deprecation of browser features, is the worst of all possible worlds. Devices have full network connectivity, so that security camera you bought becomes part of a botnet, hacks your laptop, and installs ransomware or steals your financial info/bitcoin wallet. Companies control your house and your data, so when they disappear, or when Nest pushes out a bad firmware update, your devices (and your thermostat!) stop working. Technology is realizing only a small fraction of its promise, and rather than empowering people, is acting as just another set of shackles that binds people to the whims of the powerful. The best instruments for changing that, namely web browsers and truly independent, user-owned devices, are being destroyed one small step at a time. So, in 2021, the question stands, and you've made no attempt to answer it -- how is any device supposed to break out of this sinkhole and restore the power of technology, if browsers block local devices' UIs, and users can't even configure the device without the blessing of Google or Apple?
        akerl_ 5y ago
        I think we took a left turn midway between my comment and your reply. You asked how people should handle universal TLS for internet-disconnected systems. The answer I gave addressed that directly: there are commercial and open source tools for doing so (MSCA, Vault, EJBCA, smallstep, FreeIPA, to name a few). But the overwhelming majority of actual individual users do not desire to segment their IoT devices off the internet. That’s not a “fallacy”, that’s just a fact. It’s clear that you have objections to the current state of general purpose computing, and desire that technology existed differently. But that’s a pretty far step away from the topic here.
dmux 5y ago
And it completely cut off older devices from being able to access content that often didn't need to be transferred over TLS.
- tptacek 5y ago
  Shrug! It's commercial infrastructure, not a fetish. You saw the same arguments when the Python Cryptography library started adopting Rust to replace memory-unsafe C code in their C library. People running, like, DEC Alphas in their basements for sport were furious. It was on the front page of HN for several days. It blew over, because nobody really cares about those people in a durable, meaningful way. Same situation with FTP. It's dead. Stick a fork in it.
  - dmux 5y ago
    Absolutely not the same situation. There are numerous mentions in this very thread about industries / sectors that still heavily rely on FTP. There's hundreds of millions of dollars worth of contracts that rely on data being transferred using that protocol. This isn't people enjoying retro computing. This is day-to-day operations.
    - tptacek 5y ago
      And they'll make do without Firefox and Chrome, just like the DEC Alpha in the basement didn't explode when the Cryptography team moved away from C. For whatever it's worth: those industries should not be relying on FTP. FTP is bad. But I'm not advocating to ban it from the Internet; rather, I'm just saying, nobody should make software security compromises of any sort to continue supporting it.
    - tedunangst 5y ago
      A hundred million dollars is probably sufficient to hire some consultants to maintain Firefox 89.

metalliqaz 5y ago

I'm a Firefox user, and Firefox doesn't support torrents. Yet, I can access torrents. Because of course you can have dedicated protocol handlers that do the job better than the download manager baked into the browser. Sure, there might be a user that doesn't know how to get a good FTP tool. But how many FTP servers are they accessing? Probably not enough of those to justify the maintenance effort.

tomc1985 5y ago
The concern here is more that a lot of old websites embed ftp:// URLs into their links, which this will break. Now they have to be handled by an external protocol handler, and I'd bet most of us don't have one set up, so things will be a little bumpy for a bit

lallysingh 5y ago

FTA: "To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user’s device using the FTP protocol." It removes a malware vector going through Firefox. But seriously, who's serving FTP but doesn't serve HTTPS?

tomc1985 5y ago

I used to agree with this, but with how easy it is to run MITM attacks these days I think there is a pretty compelling argument for removing plaintext FTP. I don't think FTPS should go, but tbh I don't think I have ever encountered an FTPS server in-the-wild. It's one thing to have your password stolen, but another thing entirely to have your download and its shasum/md5sum/whatever sidecar file replaced in-flight

gruez 5y ago

> This is frustrating. FTP is really handy for distributing some files and there are lots of servers in place that now Firefox users can’t access. Why are people still using ftp rather than http?

handrous 5y ago
For one thing, you can't manage files over the same protocol you use to serve them, with HTTP, without extra application-layer add-ons (WebDAV or custom web file management junk) FTP can both serve and manage, all over one protocol. "But why wouldn't you use some other method to manage your files? Why combine the two?" I dunno, but WordPress is basically that (managing your blog's/site's appearance, content, and server-side plugins, over the same interface/protocol that serves the blog/site) but for blogs & websites, and it's damn near the most successful Web project ever, so there must be something to it unless that's not a big reason for its success (and I'm pretty sure it is). I can certainly see the appeal if your main focus is serving files, or providing file-serving hosting to others (say, other departments, or to paying clients, or whatever). One daemon to configure for the whole task.
- da_chicken 5y ago
  And why can't you just use a dedicated FTP client?
  - handrous 5y ago
    It's been nice to be able to link to ftp-served files or directories on websites and have that Just Work, ever since FTP was added to web browsers. You may as well say, "why have embedded video on the web? Just open video links in VLC."

duskwuff 5y ago

> there are lots of [FTP] servers in place... Define "lots". Chrome dropped FTP support in late 2020 and basically nobody noticed. The vast majority of the remaining public FTP servers are also accessible over HTTP. > I would expect Mozilla to advocate for more FTP as a cheap way of distributing files. In what sense is FTP "cheap"? What makes it any different from HTTP in that regard?

dmux 5y ago
>basically nobody noticed Maybe people outside of the tech world failed to notice, but it was discussed here at the time: https://hn.algolia.com/?q=chrome+ftp https://hn.algolia.com/?q=chrome+ftp
jeppesen-io 5y ago
That's funny - I did't notice myself. No idea it was removed
qubidt 5y ago
> Define "lots" a ton of government and scientific datasets are provided over FTP
- Symbiote 5y ago
  The majority are also available on HTTP. It saves a lot of confused users at other government / scientific institutions, where the firewall blocks FTP.
  - qubidt 5y ago
    Even accounting for that (ignoring that the data served over FTP and HTTP aren't always perfectly equivalent), it still leaves a lot of stuff that is only served over ftp. Google found it a convincing enough argument to warrant re-enabling ftp support last year, in light of the pandemic: https://www.theregister.com/2020/04/15/ftp_chrome_deprecation_on_hold/ https://www.theregister.com/2020/04/15/ftp_chrome_deprecatio... That doesn't mean I'm against deprecation completely. But you can't pretend it won't affect people

EMM_386 5y ago

I have been using Firefox since Phoenix/Firebird, so over 20 years, and have never once used it's FTP feature. I've used FTP, fairly heavily back at an old job that required it, but I have an FTP client. They are a dime a dozen for every platform. But I haven't used FTP at all in at least a decade. Mozilla should focus their efforts in their web browser on web browsing. If you need to FTP, Gopher, or torrent over the internet, you can grab a client that does those things.