Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Plans to Deprecate FTP URL Support in Chrome

pulltech.net

Post reply on HN
Print view View original

141–150 of 350 posts

Re: Google Plans to Deprecate FTP URL Support in Chrome

#141

Post by tannhaeuser »

kccqzy wrote: post #6
TylerE wrote: post #5

Not bothered by this. No one should be running FTP in 2019. It sends passwords in plain text for christ's sake.

No one really uses FTP to transmit anything secret or confidential. Most of the time the password to that FTP server is just "guest" and the same file can also be retrieved by HTTP without authentication.

I guess many old website maintenance workflows still rely on ftp'ing HTML and assets to the web server (though not through browsers). I personally have recommended clients to switch over to ssh/scp 15 years ago if they can help it but their hosting package might not support it. The optimal, made-for-purpose protocol for this use case is WebDAV but I'm not sure it's still supported out-of-the-box by all major OSs and/or hosting packages.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#143

Post by Ayesh »

pmarin wrote: post #122
userbinator wrote: post #66

Considering that Google (search) still lists plenty of FTP results, many of which have been extremely useful to me, this seems like another move to bully the Internet into what Google wants it to be. Will it start removing those results, effectively censoring another huge chunk of the Internet? It's already hard enough to find older/more obscure information, and FTP sites are more likely to be in that category. Also,…

They can’t serve adsense from a FTP server.

A rogue crazy-totally-legit-not-virus-ad-company.xyz can put movie.wmv.exe in the list.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#144

Post by MiscIdeaMaker99 »

My take is that they didn't want to invest resources into making the FTP client secure in Chrome because it's usage is low, so they just decided that it'd be better to just remove it entirely. Whatever.

Anyway, it's not like Chrome couldn't send the URL to a dedicated FTP client. Hell, it could even be another browser like Firefox. It's not going to be the end of the world -- just not as seamless of an experience and one would like.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#145

Post by tialaramex »

kuschku wrote: post #139
clhodapp wrote: post #126

Earlier quoted context omitted.

They do though: 1) They are distributing executables to their users over a MITM-able channel. That is not acceptable. 2) A bunch of their users will have a much tougher time downloading their drivers when Chrome stops supporting FTP.

The drivers are cryptographically signed so the MitM-able channel is absolutely irrelevant. The users will just have to stop using Chrome. Supporting Google software is always just a pain in the ass (and I've gotta know as developer of Android apps)

Actually a MitMable channel makes the "it's just cryptographically signed" thing into a heap more trouble.

Bad guys can now replay old drivers, which were cryptographically signed, as the latest drivers.

So then you need to build cryptographically signed metadata structures, so that you can tell that these were the latest drivers as of some recent moment. You need to have this idea of freshness, and a mechanism to ensure it's kept up to date.

There's a period of several years where Linux distros split into two camps: One camp used HTTPS and so it was fine, and the other camp would have a bug where bad guys could cause something unexpected with a MitM attack, and they'd patch it, and then some new bug would be found, and they'd patch that and repeat...

It isn't _impossible_ to get there, Fedora can safely update over insecure protocols today as far as we know. Or, you can skip all that noise and just do HTTPS as RHEL itself had been doing for many years by that point.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#146

Post by gone35 »

userbinator wrote: post #66

Considering that Google (search) still lists plenty of FTP results, many of which have been extremely useful to me, this seems like another move to bully the Internet into what Google wants it to be. Will it start removing those results, effectively censoring another huge chunk of the Internet? It's already hard enough to find older/more obscure information, and FTP sites are more likely to be in that category. Also,…

Indeed; by the same "security" logic, why not get rid of HTTP too then? (Or SMTP, for that matter?)

The point of "organize the world's information and make it universally accessible and useful" is to do precisely that: to organize the world's information and make it universally accessible and useful -- long tails included. But I guess for them it's not...

(Also, I can't believe the Chrome team is so strapped it can't afford to support or harden the feature, as some in the bug tracker suggest [1]. This is Google we are talking about, not some tiny open source project!)

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=333943

Re: Google Plans to Deprecate FTP URL Support in Chrome

#147

Post by clhodapp »

kuschku wrote: post #139
clhodapp wrote: post #126

Earlier quoted context omitted.

They do though: 1) They are distributing executables to their users over a MITM-able channel. That is not acceptable. 2) A bunch of their users will have a much tougher time downloading their drivers when Chrome stops supporting FTP.

The drivers are cryptographically signed so the MitM-able channel is absolutely irrelevant. The users will just have to stop using Chrome. Supporting Google software is always just a pain in the ass (and I've gotta know as developer of Android apps)

Sure. You can't easily replace the driver with a self-written, malicious driver without exploiting some sort of deep Windows vulnerability. However, executable code can perform all manner of mischief without being a driver. Anyway, I don't think HP's TechOps underachievement is going to convince anyone to switch their browser. Instead, HP'll just have someone spend a week or two setting up an HTTPS file server and everyone will move on. It's better for their users and it's less effort than trying to have a battle to defend FTP of all things.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#148

Post by hos234 »

thrwyway9448 wrote: post #137
userbinator wrote: post #66

Considering that Google (search) still lists plenty of FTP results, many of which have been extremely useful to me, this seems like another move to bully the Internet into what Google wants it to be. Will it start removing those results, effectively censoring another huge chunk of the Internet? It's already hard enough to find older/more obscure information, and FTP sites are more likely to be in that category. Also,…

>Will it start removing those results, effectively censoring another huge chunk of the Internet? speaking as an evil overlord, the most illegal extension of Google's search monopoly would be to redirect those results through Google Drive in a way that forces users to go through Google Drive to see and access the full link or download any of its contents. By the way, Google, would you like me to apply as a product man…

They aren't evil man. They are just well programmed robots constantly searching for things to over-optimize. They hit their metrics every day and then plug into their charging stations. That's it.

Give it a few years and they will deprecate Android for security reasons.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#149

Post by PascLeRasc »

untog wrote: post #61
tim58 wrote: post #50

Earlier quoted context omitted.

I'm not fine with this. I'm of the mindset that code written 20 years ago should run today. This is a breaking change on a critical piece of internet infrastructure. Google, by nature of operating the most popular web browser, has a moral obligation to the community to provide a stable environment. There are something like 10^9 webpages out there. How many of these will become less accessible because of this change?…

> I'm of the mindset that code written 20 years ago should run today. I'm of the mindset that it should be possible to rub code written 20 years ago, but not always the same way you run code written more recently. Emulation, virtual machines etc all allow access to old work without hobbling future development with backwards compatibility concerns (see: Windows). In this case, there are plenty of free and open source…

A large number of academic labs share data by hosting it over FTP. You can harp on about better methods or whatever but these people do not care and don't have time/energy to start caring.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#150

Post by read_if_gay_ »

notatoad wrote: post #74
tim58 wrote: post #50

Earlier quoted context omitted.

I'm not fine with this. I'm of the mindset that code written 20 years ago should run today. This is a breaking change on a critical piece of internet infrastructure. Google, by nature of operating the most popular web browser, has a moral obligation to the community to provide a stable environment. There are something like 10^9 webpages out there. How many of these will become less accessible because of this change?…

>I'm of the mindset that code written 20 years ago should run today. Given that chrome didn't exist 20 years ago, this seems like a fairly absurd position to apply to this situation. No code from 20 years ago relies on chrome having ftp support.

The number 20 is probably an upper bound.
Post reply on HN