Browser HTTP file upload is still terrible for file transfer. One of the last bastions of Flash, regretfully.
FTP Must Die
11–20 of 119 posts
Re: FTP Must Die
#12FTP is definitely outdated, and there are better uses in many circumstances. But I find some of these criticisms a bit odd. The client listening was largely solved by 'passive' mode, and just about every server and client supports this now. The firewall and NAT interaction is awkward, but most modern firewalls can deal with this automatically (as long as there's no SSL involved) And yes, the RFC is 20 years old. But…
PASV mode came with its own security drama, and doesn't address the core issue with the (absolutely pointless) multiple-connection model of FTP.
And so, yes, firewalls and NATs "interact" with FTP --- because they all had to be hacked specifically to deal with the FTP protocol, which moots your rebuttal --- but in doing so they create additional security issues, like the NAT pinning stuff Samy Kamkar posted last year.
It shouldn't be necessary for middleboxes to hack in support for protocols by in-place editing TCP streams and dynamically changing filter/translation rules based on stuff that happens inside of connections. But, thanks to FTP, they do have to do that.
And for what? FTP is even on its own terms a terrible file transfer protocol! For instance, look at how it handles (or, commonly, doesn't handle) file listings.
FTP is an anachronism. It has no more reason to exist today than TFTP --- both were designed to make up for constraints in client software that simply no longer exist anywhere.
Re: FTP Must Die
#13Browser HTTP file upload is still terrible for file transfer. One of the last bastions of Flash, regretfully.
Browsers are terrible at file upload. The weakness here isn't really in the protocol.
Re: FTP Must Die
#14Time and time again I resort to FTP to transfer files between computers that won't talk to each other via system-provided file systems. Mac Windows file sharing is so unreliable that I don't even try to use the system any more and just go straight to FTP. But yeah I hate the protocol itself.
Have you tried using SCP? I don't know if Windows comes with a client but a quick search turned up a few options. It is my goto method for transferring files these days but I admittedly don't use Windows.
WinSCP has served me well over the years:
Re: FTP Must Die
#15Time and time again I resort to FTP to transfer files between computers that won't talk to each other via system-provided file systems. Mac Windows file sharing is so unreliable that I don't even try to use the system any more and just go straight to FTP. But yeah I hate the protocol itself.
Have you tried using SCP? I don't know if Windows comes with a client but a quick search turned up a few options. It is my goto method for transferring files these days but I admittedly don't use Windows.
I'd love to know the transfer speed differences between SCP, SFTP and FTP - because when I can view both ends of the wire then security is less of a concern than transfer time.
Re: FTP Must Die
#16It's been a long time since I've been involved with transferring files to and from clients, but even five years or so ago I recall enabling IIS's WebDAV mode in preference to handling customer-support calls about getting FTP working. Of course, WebDAV is still a ball of horror, even if it's not as bad as FTP, so please let's all stick to SFTP from now on?
So you had XP boxes connecting via WebDAV? I think I'd take FTP over having to support that.
Re: FTP Must Die
#17I don't think FTP must die so much as RSYNC MUST LIVE.
(Seriously, people forget how awesome rsync is. And it tunnels/compresses nicely over SSH)
Re: FTP Must Die
#18There is something pretty cool that one can do with the FTP protocol: FXP transfers to perform an inter-server file transfer: https://en.wikipedia.org/wiki/File_eXchange_Protocol
Re: FTP Must Die
#19Browser HTTP file upload is still terrible for file transfer. One of the last bastions of Flash, regretfully.
Huh? You mean the same Flash that can't display a list of paths to local user files to the user for "security reasons" so the user can do batch uploads? I agree with the sibling comment, browser-based file upload sucks.
Re: FTP Must Die
#20FTP is definitely outdated, and there are better uses in many circumstances. But I find some of these criticisms a bit odd. The client listening was largely solved by 'passive' mode, and just about every server and client supports this now. The firewall and NAT interaction is awkward, but most modern firewalls can deal with this automatically (as long as there's no SSL involved) And yes, the RFC is 20 years old. But…
FTP is as obsolete as telnet and has no place being alive today.
SSH and SCP provide a much more secure alternative. SFTP is a hack that suffers from all the same problems.