4 ms·

Agreed. There are old drivers from established vendors that only send drivers over FTP links. It's an edge case these days though as more are moving to https:/

Agreed. There are old drivers from established vendors that only send drivers over FTP links. It's an edge case these days though as more are moving to https:// https:// links so I can understand the browser vendors wanting to make the code base smaller. They have enough to do. Especially for Mozilla given what they charge for us to use their product.

tyingq 5y ago
Maybe nice if they (Mozilla and/or Google) would make a site somewhat like https://webftp.dreamhost.com/ https://webftp.dreamhost.com/ that would accept url parameters to sort of proxy ftp requests. Wouldn't help for internal network ftp servers, but would ease the publicly accessible part. (Note that the dreamhost site has a little link icon in the lower left that will generate a link/landing page with all the important bits filled out.)
- xg15 5y ago
  Wouldn't make that security worse? Then any FTP connection would have to be proxied through a third-party, which has all opportunity to monitor or MITM the files. This in particular as FTP is often used to transfer non-public files. Alternatively, Firefox could allow standalone clients to register for the ftp:// uri scheme (I think that's already possible) and, if no client is registered, redirect to some info page that explains the situation and offers links to standalone clients.
  - tyingq 5y ago
    Perhaps if it only supported anonymous ftp. That's most of the links that will get broken. For that, there is no real security consideration. What exists is plain text all around with deliberately exposed passwords.
    - II2II 5y ago
      That is not what Mozilla is claiming: > The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. I don't know how realistic that type of attack is and compromised authentication is likely worse, but both are cases that Mozilla cannot fix since they are inherent to the protocol itself.
      - tyingq 5y ago
        I guess, but they aren't deprecating http downloads, which have the same problem as anonymous ftp.
        II2II 5y ago
        For the majority of people, the lack of FTP support would go unnoticed so it is easy to depreciate and remove. I wouldn't be surprised if the same happens to HTTP (in general) once a certain threshold has been reached for HTTPS. I also wouldn't be surprised if they start adding warnings about insecure transfer methods for particular file types at a much earlier date.
antisol 5y ago
>I can understand the browser vendors wanting to make the code base smaller. That's an excellent point... ...So they'll be removing their builtin pdf viewer first then, right? That's a much much bigger chunk of code than an ftp client. Or are they both scheduled to be removed at the same time? I suppose that would be reasonable.
- fomine3 5y ago
  Mozilla did great decision for security: develop PDF viewer as pdf.js. It works same as other webapps so no longer considered to attack surface, not like integrated PDF viewer, IIUC.
  - antisol 5y ago
    Oh cool! I didn't realise that their entire JS engine was formally verified!
    - deleted 5y ago
      [deleted]

tyingq 5y ago

Maybe nice if they (Mozilla and/or Google) would make a site somewhat like https://webftp.dreamhost.com/ https://webftp.dreamhost.com/ that would accept url parameters to sort of proxy ftp requests. Wouldn't help for internal network ftp servers, but would ease the publicly accessible part. (Note that the dreamhost site has a little link icon in the lower left that will generate a link/landing page with all the important bits filled out.)

xg15 5y ago
Wouldn't make that security worse? Then any FTP connection would have to be proxied through a third-party, which has all opportunity to monitor or MITM the files. This in particular as FTP is often used to transfer non-public files. Alternatively, Firefox could allow standalone clients to register for the ftp:// uri scheme (I think that's already possible) and, if no client is registered, redirect to some info page that explains the situation and offers links to standalone clients.
- tyingq 5y ago
  Perhaps if it only supported anonymous ftp. That's most of the links that will get broken. For that, there is no real security consideration. What exists is plain text all around with deliberately exposed passwords.
  - II2II 5y ago
    That is not what Mozilla is claiming: > The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. I don't know how realistic that type of attack is and compromised authentication is likely worse, but both are cases that Mozilla cannot fix since they are inherent to the protocol itself.
    - tyingq 5y ago
      I guess, but they aren't deprecating http downloads, which have the same problem as anonymous ftp.
      - II2II 5y ago
        For the majority of people, the lack of FTP support would go unnoticed so it is easy to depreciate and remove. I wouldn't be surprised if the same happens to HTTP (in general) once a certain threshold has been reached for HTTPS. I also wouldn't be surprised if they start adding warnings about insecure transfer methods for particular file types at a much earlier date.

antisol 5y ago

>I can understand the browser vendors wanting to make the code base smaller. That's an excellent point... ...So they'll be removing their builtin pdf viewer first then, right? That's a much much bigger chunk of code than an ftp client. Or are they both scheduled to be removed at the same time? I suppose that would be reasonable.

fomine3 5y ago
Mozilla did great decision for security: develop PDF viewer as pdf.js. It works same as other webapps so no longer considered to attack surface, not like integrated PDF viewer, IIUC.
- antisol 5y ago
  Oh cool! I didn't realise that their entire JS engine was formally verified!
  - deleted 5y ago
    [deleted]