9 ms·

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard tha

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all. If having the small amount of code to do FTP support in there is making your job really hard, that would seem to indicate to me that you're not very good at your job. I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic, a repeat of the borderline lies mozilla peddled when they decided to dump xul for webextensions. It seems to me that the removal of features like this amounts to "I don't use/understand it, therefore I'm going to assume it's not useful to anybody". Of course, Mozilla being out of touch with its user base is hardly news, so this comes as no surprise at all to me. (While I'm talking about browsers and particularly mozilla, I'd just like to take a moment to congratulate them on finally getting their market share down below that of edge. They've been working hard at driving firefox into the ground for a long time now, and I'm sure they must be feeling very proud to have finally achieved this important milestone in their seemingly unending quest to achieve that holy grail of 0 users. So I'd just like to say: Nice work, Mozilla!)

dvfjsdhgfv 5y ago
> I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic Well, there is nothing vague here: FTP is a cleartext protocol, and we're migrating towards protocols that provide integrity and encryption. Sometimes I think it's a generational thing. I find it hard to accept this, growing up with testing all protocols with Telnet and so on. But unfortunately the Internet has changed a lot, and especially bad and unscrupulous people learned how to find all possible and sometimes very creative ways to abuse whatever had been created in the past. So I understand that cleartext POP3, IMAP, SMTP and FTP authentication should go away. Anonymous FTP is a slightly different beast though. Security-wise, it has the same weaknesses as regular HTTP. But nobody is removing HTTP support from web browsers (yet). So I'm a bit sorry to see it removed from FireFox. There are many better things to copy from Chrome.
- antisol 5y ago
  >there is nothing vague here: FTP is a cleartext protocol Sometimes there's nothing wrong with transferring stuff in cleartext. Screaming vague and meaningless "for security!" mantras isn't helpful.
- GekkePrutser 5y ago
  You can still test those protocols with OpenSSL stunnel :)
- apostacy 5y ago
  This is security hypocrisy. HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. Why does your browser scream at you for connecting to an encrypted but unverified site, such as a self signed certificate on a closed network, but have no warnings at all for an unverified and unencrypted HTTP connection? How do you know the context that I am using a plaintext protocol in? How do you know I'm not connecting over a patch cable to the computer next to me? How do you know I'm not connecting over an SSH tunnel? The user should easily be able to override these safety measures. The only argument I have heard this is that the user could be tricked into disabling security mechanisms. But that is true of anything in computing. The user could be tricked into typing in rm -rf. When there is inconstancy like this, it usually implies there is something else going on that we aren't seeing. I have a feeling that companies like Google and Apple have an agenda to move people away from having too much outside of their influence.
  - da_chicken 5y ago
    > HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. This is true, but it ignores the fact that the web has been moving towards depreciation of HTTP in favor of HTTPS. While FTP is an established standard, FTPS is kind of a nightmare with different and incompatible variants.
    - antisol 5y ago
billyhoffman 5y ago
> ftp is a relatively simple protocol, not particularly complicated to implement Parts of it are, sure, but parts of it are an absolutely horror show (The client opens a port, and then the server connects back to it!?), text conversion and binary modes that's based on ASCII, different list formats, etc. It's not great. Worse, it doesn't support the good stuff like implicit TLS extensions > Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all. Not at all. Continuing to support FTP means continuing to defend attack surface that's implemented as 20 year-old code, to deliver a feature that in 2021 the majority of people do not use. It's a cost-benefit analysis. I want Mozilla to do more. If they believe removing FTP support enables them to do more, I'll all for it.
- antisol 5y ago
  >It's not great It's simpler than a pdf viewer. >It's a cost-benefit analysis If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost. >I want Mozilla to do more. At this point I'm afraid we're just going to have to agree to disagree. For the last 5+ years, Every time Mozilla "do more", I throw up in my mouth a little.
  - oblio 5y ago
    > If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost. Every time I clicked a PDF online, I dreaded the external viewer opening (especially Adobe Reader). I very much liked when they integrated a PDF viewer. Chrome also has one. I'm willing to bet the internal PDF viewer has at least 100x (more likely 1000x) the users the FTP client had.
    - antisol 5y ago
      Sounds like you had a shitty pdf viewer installed. Which is not my problem. Why was I forced to install a substandard, feature-poor, ridiculously slow pdf viewer that I never wanted and which took over as the default pdf viewer against my wishes and without asking me, just because you couldn't be bothered to install a decent one? >I'm willing to bet the internal PDF viewer has at least 100x (more likely 1000x) the users the FTP client had. Yeah, that tends to happen when you change the defaults without asking.
apostacy 5y ago
> (While I'm talking about browsers and particularly mozilla, I'd just like to take a moment to congratulate them on finally getting their market share down below that of edge. They've been working hard at driving firefox into the ground for a long time now, and I'm sure they must be feeling very proud to have finally achieved this important milestone in their seemingly unending quest to achieve that holy grail of 0 users. So I'd just like to say: Nice work, Mozilla!) Well said. And the more they fail, the more they double down. But their decisions go beyond incompetence. They might as well be controlled opposition, actively undermining open web technologies. They deprecated RSS support with very flimsy justifications, but they make supporting the latest DRM standards a top priority, because they are terrified of losing the blessing of Netflix.
- antisol 5y ago
  > They might as well be controlled opposition, actively undermining open web technologies. Yeah, this pretty much sums it up. A conspiracy minded person might accuse them of all kinds of nasty shenanigans, especially given who their primary finding source is these days. >They deprecated RSS support with very flimsy justifications, but they make supporting the latest DRM standards a top priority, because they are terrified of losing the blessing of Netflix. Oh now you're just being cynical. RSS support was like 150 lines of code! A huge attack surface! And it was invented before the year 2000! That makes it useless! As for DRM, I'm sure that encryption algorithms are much simpler to implement and have less attack surface than an RSS reader, and that Mozilla added this tech for my own good, and that I just don't understand how it's useful to me because I'm a dumb.
fomine3 5y ago
I can agree that FTP isn't much a attack vector, but definitely against for XUL.
- antisol 5y ago
  How many in-the-wild attacks did you see using XUL from extensions that were in the curated addons ecosystem, i.e not downloaded and manually installed via extra steps a novice is unlikely to go through?
  - fomine3 5y ago
    XUL allows too many modification for browser. It increases attack surface, and it makes hard Firefox developer to modify Firefox's internals to improve things.
    - antisol 5y ago
      you didn't answer my question. I asked how many times you saw this exploited in the wild, not "how would an attack theoretically work".
      - antisol 5y ago
        Yeah, that's what I thought.

dvfjsdhgfv 5y ago

> I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic Well, there is nothing vague here: FTP is a cleartext protocol, and we're migrating towards protocols that provide integrity and encryption. Sometimes I think it's a generational thing. I find it hard to accept this, growing up with testing all protocols with Telnet and so on. But unfortunately the Internet has changed a lot, and especially bad and unscrupulous people learned how to find all possible and sometimes very creative ways to abuse whatever had been created in the past. So I understand that cleartext POP3, IMAP, SMTP and FTP authentication should go away. Anonymous FTP is a slightly different beast though. Security-wise, it has the same weaknesses as regular HTTP. But nobody is removing HTTP support from web browsers (yet). So I'm a bit sorry to see it removed from FireFox. There are many better things to copy from Chrome.

antisol 5y ago
>there is nothing vague here: FTP is a cleartext protocol Sometimes there's nothing wrong with transferring stuff in cleartext. Screaming vague and meaningless "for security!" mantras isn't helpful.
GekkePrutser 5y ago
You can still test those protocols with OpenSSL stunnel :)
apostacy 5y ago
This is security hypocrisy. HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. Why does your browser scream at you for connecting to an encrypted but unverified site, such as a self signed certificate on a closed network, but have no warnings at all for an unverified and unencrypted HTTP connection? How do you know the context that I am using a plaintext protocol in? How do you know I'm not connecting over a patch cable to the computer next to me? How do you know I'm not connecting over an SSH tunnel? The user should easily be able to override these safety measures. The only argument I have heard this is that the user could be tricked into disabling security mechanisms. But that is true of anything in computing. The user could be tricked into typing in rm -rf. When there is inconstancy like this, it usually implies there is something else going on that we aren't seeing. I have a feeling that companies like Google and Apple have an agenda to move people away from having too much outside of their influence.
- da_chicken 5y ago
  > HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. This is true, but it ignores the fact that the web has been moving towards depreciation of HTTP in favor of HTTPS. While FTP is an established standard, FTPS is kind of a nightmare with different and incompatible variants.
  - antisol 5y ago

billyhoffman 5y ago

> ftp is a relatively simple protocol, not particularly complicated to implement Parts of it are, sure, but parts of it are an absolutely horror show (The client opens a port, and then the server connects back to it!?), text conversion and binary modes that's based on ASCII, different list formats, etc. It's not great. Worse, it doesn't support the good stuff like implicit TLS extensions > Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all. Not at all. Continuing to support FTP means continuing to defend attack surface that's implemented as 20 year-old code, to deliver a feature that in 2021 the majority of people do not use. It's a cost-benefit analysis. I want Mozilla to do more. If they believe removing FTP support enables them to do more, I'll all for it.

antisol 5y ago
>It's not great It's simpler than a pdf viewer. >It's a cost-benefit analysis If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost. >I want Mozilla to do more. At this point I'm afraid we're just going to have to agree to disagree. For the last 5+ years, Every time Mozilla "do more", I throw up in my mouth a little.
- oblio 5y ago
  > If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost. Every time I clicked a PDF online, I dreaded the external viewer opening (especially Adobe Reader). I very much liked when they integrated a PDF viewer. Chrome also has one. I'm willing to bet the internal PDF viewer has at least 100x (more likely 1000x) the users the FTP client had.
  - antisol 5y ago
    Sounds like you had a shitty pdf viewer installed. Which is not my problem. Why was I forced to install a substandard, feature-poor, ridiculously slow pdf viewer that I never wanted and which took over as the default pdf viewer against my wishes and without asking me, just because you couldn't be bothered to install a decent one? >I'm willing to bet the internal PDF viewer has at least 100x (more likely 1000x) the users the FTP client had. Yeah, that tends to happen when you change the defaults without asking.

apostacy 5y ago

> (While I'm talking about browsers and particularly mozilla, I'd just like to take a moment to congratulate them on finally getting their market share down below that of edge. They've been working hard at driving firefox into the ground for a long time now, and I'm sure they must be feeling very proud to have finally achieved this important milestone in their seemingly unending quest to achieve that holy grail of 0 users. So I'd just like to say: Nice work, Mozilla!) Well said. And the more they fail, the more they double down. But their decisions go beyond incompetence. They might as well be controlled opposition, actively undermining open web technologies. They deprecated RSS support with very flimsy justifications, but they make supporting the latest DRM standards a top priority, because they are terrified of losing the blessing of Netflix.

antisol 5y ago
> They might as well be controlled opposition, actively undermining open web technologies. Yeah, this pretty much sums it up. A conspiracy minded person might accuse them of all kinds of nasty shenanigans, especially given who their primary finding source is these days. >They deprecated RSS support with very flimsy justifications, but they make supporting the latest DRM standards a top priority, because they are terrified of losing the blessing of Netflix. Oh now you're just being cynical. RSS support was like 150 lines of code! A huge attack surface! And it was invented before the year 2000! That makes it useless! As for DRM, I'm sure that encryption algorithms are much simpler to implement and have less attack surface than an RSS reader, and that Mozilla added this tech for my own good, and that I just don't understand how it's useful to me because I'm a dumb.

fomine3 5y ago

I can agree that FTP isn't much a attack vector, but definitely against for XUL.

antisol 5y ago
How many in-the-wild attacks did you see using XUL from extensions that were in the curated addons ecosystem, i.e not downloaded and manually installed via extra steps a novice is unlikely to go through?
- fomine3 5y ago
  XUL allows too many modification for browser. It increases attack surface, and it makes hard Firefox developer to modify Firefox's internals to improve things.
  - antisol 5y ago
    you didn't answer my question. I asked how many times you saw this exploited in the wild, not "how would an attack theoretically work".
    - antisol 5y ago
      Yeah, that's what I thought.