Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla will remove FTP support in Firefox

ghacks.net

Post reply on HN
Print view View original

41–50 of 86 posts

Re: Mozilla will remove FTP support in Firefox

#41

Post by _jal »

im3w1l wrote: post #12
liquidify wrote: post #3

I'm curious as to how many people use FTP in the browser?

Firmwares, drivers, distro isos, tarballs are traditionally distributed on (anonymous) ftp. Given that such downloads should be authenticated using ftp is non-ideal though, I guess.

Yeah, this. I suppose the closest substitute will be to configure directory listings at the http server, although I suspect UX people will get their hooks in to make it pretty instead of efficient. (Ever tried to find something specific but not currently promoted on Dell's site?)

Re: Mozilla will remove FTP support in Firefox

#42

Post by OptionX »

getpolarized wrote: post #15

I love discussions about browsers on Hacker News! They're amazing. Half the people ranting how some insanely complicated technical decision is going to ruin the world, the other half yelling at them that this is necessary, others ranting about how the vendor is evil for some reason, etc. Just lovely!

1. Open comment section in a browser related topic. 2. Complains about the people discussing a browser related topic. 3. ???? 4. Profit

Re: Mozilla will remove FTP support in Firefox

#44

Post by beloch »

okraszo wrote: post #9
yingw787 wrote: post #2

Are there security issues with FTP, or do people just not use it enough because HTTP supplants it? I haven't used FTP in a while to download files.

For sure it is unencrypted, so it is vulnerable to man-in-the-middle attacks.

A MITM attack occurs when an eavesdropper inserts herself between two people trying to communicate securely. e.g. Alice and Bob may think they're talking to each other over an encrypted link, but they're both talking to Eve. Eve's just taking everything Alice sends, decoding it, copying it, re-encoding it, and sending it on to Bob. A MITM attack is not necessarily the result of bad encryption, but of a failure in authentication. Eve's ability to fool Alice into thinking she is actually Bob is key.

An unencrypted connection (such as plain old FTP) is effectively a broadcast. No attack, MITM or otherwise, is required. Eve just has to listen.

Re: Mozilla will remove FTP support in Firefox

#45

Post by duskwuff »

calvinmorrison wrote: post #10
yingw787 wrote: post #2

Are there security issues with FTP, or do people just not use it enough because HTTP supplants it? I haven't used FTP in a while to download files.

Well it reeks a bit because from the article "Mozilla could have opted for implementing support for secure FTP in Firefox; a bug was filed 19 years ago to introduce support for SFTP in Firefox but nothing ever came out of it."

Never happened because there was no use case for it.

FTP made some sense to have in a browser because it supported unauthenticated downloads.

SFTP, as a protocol which runs over SSH, basically requires authentication. (You could conceivably set up an SSH server to allow authentication against a "guest" user, but that gives security folks the heebie-jeebies.) So it doesn't really make sense to link to an SFTP resource in a web context, making it very low value to support in a browser.

Re: Mozilla will remove FTP support in Firefox

#46

Post by arkitaip »

liquidify wrote: post #3

I'm curious as to how many people use FTP in the browser?

I would genuinely be surprised if even 5% of users used FTP in the last year. But damn do I wish they kept the feature in; Firefox should distinguish itself as the tech worker's browser, sorta like a forensics live CD that has every imaginable tool you need for deep work.

Re: Mozilla will remove FTP support in Firefox

#47

Post by jcranmer »

saagarjha wrote: post #37
jcranmer wrote: post #27

Earlier quoted context omitted.

The entirety of changes to one of the files in the past 13 years is here: https://hg.mozilla.org/mozilla-central/log/tip/netwerk/strea... There's more changes on nsFtpConnectionThread.cpp: https://hg.mozilla.org/mozilla-central/log/tip/netwerk/proto... Looking at those changes, it's clear that there has been very little substantive modifications to the FTP code itself, as opposed to keeping up with style guide change…

Perhaps they should take the opportunity to rewrite it in Rust.

If I'm reading the telemetry correctly (https://mzl.la/3bq5oFZ), there are ~6k people who used FTP to download a file in the past week or so. That's not enough users to really justify spending manpower rewriting it.

Re: Mozilla will remove FTP support in Firefox

#48

Post by coribuci »

Fiveplus wrote: post #19
coribuci wrote: post #8

One more reason not to use firefox. Firefox became the younger brother of Chrome. Why they can't be independent and think for themselves ?

No Gecko and no Chrome? I'm waiting for you to say we should all start using Brave. Please say it.

> No Gecko and no Chrome? I'm waiting for you to say we should all start using Brave. Please say it.

To be honest i like Seamonkey :) Maybe i am too old.

Re: Mozilla will remove FTP support in Firefox

#49

Post by duskwuff »

weare138 wrote: post #18
okraszo wrote: post #9

Earlier quoted context omitted.

For sure it is unencrypted, so it is vulnerable to man-in-the-middle attacks.

I'm sure the majority of people that still use FTP aren't relying on a browser for access but people still use it. Why not just deprecate standard FTP and only support FTPS and SFTP?

Because that'd amount to the same result as removing FTP. The "installed base" of web-accessible FTPS and SFTP resources is essentially zero, and that's unlikely to change -- if a web site was previously using FTP, they're probably going to move those resources to HTTP/S, not to another protocol which has limited browser support.

Re: Mozilla will remove FTP support in Firefox

#50

Post by jmercouris »

arkitaip wrote: post #46
liquidify wrote: post #3

I'm curious as to how many people use FTP in the browser?

I would genuinely be surprised if even 5% of users used FTP in the last year. But damn do I wish they kept the feature in; Firefox should distinguish itself as the tech worker's browser, sorta like a forensics live CD that has every imaginable tool you need for deep work.

The tech workers browser is Next: https://github.com/atlas-engineer/next

source: biased developer :-)

Post reply on HN