4 ms·
FTP is definitely outdated, and there are better uses in many circumstances. But I find some of these criticisms a bit odd. The client listening was largely so
by omh 15y ago
FTP is definitely outdated, and there are better uses in many circumstances. But I find some of these criticisms a bit odd.
The client listening was largely solved by 'passive' mode, and just about every server and client supports this now.
The firewall and NAT interaction is awkward, but most modern firewalls can deal with this automatically (as long as there's no SSL involved)
And yes, the RFC is 20 years old. But so are many RFCs for long-established veteran protocols that we use all over the net.
In many cases I'd be happy to see FTP replaced (all those anonymous FTP servers may as well be HTTP now), but it's really not that bad.
- tptacek 15y agoPASV mode came with its own security drama, and doesn't address the core issue with the (absolutely pointless) multiple-connection model of FTP. And so, yes, firewalls and NATs "interact" with FTP --- because they all had to be hacked specifically to deal with the FTP protocol, which moots your rebuttal --- but in doing so they create additional security issues, like the NAT pinning stuff Samy Kamkar posted last year. It shouldn't be necessary for middleboxes to hack in support for protocols by in-place editing TCP streams and dynamically changing filter/translation rules based on stuff that happens inside of connections. But, thanks to FTP, they do have to do that. And for what? FTP is even on its own terms a terrible file transfer protocol! For instance, look at how it handles (or, commonly, doesn't handle) file listings. FTP is an anachronism. It has no more reason to exist today than TFTP --- both were designed to make up for constraints in client software that simply no longer exist anywhere.
- justincormack 15y agoHave used tftp for net booting, those legacy bioses cant do anything else, as it really is trivial...
- tptacek 15y agoHas there been a piece of equipment shipped in the last 10 years that legitimately couldn't get a TCP running to bootstrap itself? That's why TFTP exists: to avoid the need for TCP.
- yuhong 15y agoWell, remember that until recently, BIOSes ran in real mode with it's memory constraints (remember the 640k limit?).
- deleted 15y ago[deleted]
- harshreality 15y agoOnly tftp is widely supported by embedded ROMs, for netboot or for loading a new firmware for embedded devices with broken OS images. It's not a matter of getting TCP running. You'd need a basic http transfer client, too. Not many network bootloaders or firmware loaders support anything other than tftp. iPXE supports http. Get iPXE into embedded bootloaders for new firmware loading, and into network device ROMs for network booting, and then people can switch. Until then, it's tftp because that's what everyone supports.
- vog 15y agoIndeed. TFTP serves its purpose pretty well. FTP doesn't.
- astrodust 15y agoFTP is as obsolete as telnet and has no place being alive today. SSH and SCP provide a much more secure alternative. SFTP is a hack that suffers from all the same problems.
- hackermom 15y agoHow do you mean, SFTP is a hack that suffers from all the same problems? SFTP is a new protocol, it's not the same as FTP. It doesn't concern itself with data port nonsense, and while it doesn't offer authentication or secure transfers in itself, there is - at least to my knowledge - no SFTP solution available that doesn't perform SFTP via an underlying mechanism for secure auth/transfer.
- MatthewPhillips 15y agoFTP is platform agnostic. As uncool as it may be it's the only realistic choice for companies to share sensitive data.
- pilif 15y agoWhile passive FTP solved the issue for the client, it totally breaks if the server is behind a NAT, so you are back to the firewall needing knowledge of the inner workings of the protocol. having the two separate connections really is an anachronism which proves to be a big hassle or all parties. And not even IPv6 will slve this one as a firewall still needs to know what port to let data through. And because the PORT command lists IP addresses, you can't even transparently run FTP over v6. It's one of te protocols where users need to have special protocol awareness beyond the length of the IP address.
- jaylevitt 15y agoOne important firewall that can't deal with it: Amazon's NAT images for EC2. AFAICT, there's no way to run an ftp client behind Amazon's NAT unless you open all outbound ports, because the server is still the one that specifies which port the client should use for its PASV connection. I think most firewalls solve this by actually rewriting the FTP packets on the fly (IIRC Cisco calls these "fixups"). That's seriously, seriously broken.