Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Plans to Deprecate FTP URL Support in Chrome

pulltech.net

Post reply on HN
Print view View original

151–160 of 350 posts

Re: Google Plans to Deprecate FTP URL Support in Chrome

#151

Post by marble-drink »

userbinator wrote: post #66

Considering that Google (search) still lists plenty of FTP results, many of which have been extremely useful to me, this seems like another move to bully the Internet into what Google wants it to be. Will it start removing those results, effectively censoring another huge chunk of the Internet? It's already hard enough to find older/more obscure information, and FTP sites are more likely to be in that category. Also,…

The drive towards "HTTPS everything" has merely caused users to forget what it is and therefore simply trust Google. Needless to say, this is exactly what they would want.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#152

Post by laurentl »

userbinator wrote: post #90
clouddrover wrote: post #82

Earlier quoted context omitted.

> this seems like another move to bully the Internet into what Google wants it to be Bully them back. Don't use Google search and don't use Chrome.

Easier said than done, especially when most of the population doesn't care either because they're too young or too nontechnical; actually, I already don't use Chrome, but their search (which still shows FTP sites...) is, despite slowly getting worse too, still giving a wider breadth of sites most of the time. Bing and DDG help fill in the gaps.

I switched my default search engine in FF to Qwant a few months back. You have to re-learn to formulate clear search queries (no magic pixie dust^H years of browsing history to help it read your mind) but I find that it mostly works.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#153

Post by BucketSort »

untog wrote: post #61
tim58 wrote: post #50

Earlier quoted context omitted.

I'm not fine with this. I'm of the mindset that code written 20 years ago should run today. This is a breaking change on a critical piece of internet infrastructure. Google, by nature of operating the most popular web browser, has a moral obligation to the community to provide a stable environment. There are something like 10^9 webpages out there. How many of these will become less accessible because of this change?…

> I'm of the mindset that code written 20 years ago should run today. I'm of the mindset that it should be possible to rub code written 20 years ago, but not always the same way you run code written more recently. Emulation, virtual machines etc all allow access to old work without hobbling future development with backwards compatibility concerns (see: Windows). In this case, there are plenty of free and open source…

Brb, forgot to rub my code today.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#154

Post by m0dest »

tialaramex wrote: post #145
kuschku wrote: post #139

Earlier quoted context omitted.

The drivers are cryptographically signed so the MitM-able channel is absolutely irrelevant. The users will just have to stop using Chrome. Supporting Google software is always just a pain in the ass (and I've gotta know as developer of Android apps)

Actually a MitMable channel makes the "it's just cryptographically signed" thing into a heap more trouble. Bad guys can now replay old drivers, which were cryptographically signed, as the latest drivers. So then you need to build cryptographically signed metadata structures, so that you can tell that these were the latest drivers as of some recent moment. You need to have this idea of freshness, and a mechanism to en…

This.

I've seen a lot of naive designs where signed data is downloaded via an unsigned control channel. At the very least, they are vulnerable to replay attacks. Beyond that, it enables more selective blocking/filtering to prevent clients from accessing specific data.

Let's not forget the lost "confidentiality" aspect of TLS either. Your request for HP_Drivers_2019_Update.exe is now broadcasting to the Internet: "Hey I'm running a vulnerable, unpatched device! Last chance to hack me!"

Re: Google Plans to Deprecate FTP URL Support in Chrome

#155

Post by iforgotpassword »

duskwuff wrote: post #119
yjftsjthsd-h wrote: post #80

Earlier quoted context omitted.

What big attack surface? The client? FTP is an ugly/stupid protocol, but it's not really complex (I suspect it's far simpler than HTTP).

FTP has some pretty serious quirks. Active-mode FTP is probably the craziest one by modern standards -- the client opens a port and asks the server to connect to it to send a file. Needless to say, this is effectively unusable on the modern Internet. Its replacement, passive-mode FTP, has the server open a port instead; this configuration is merely incompatible with most load balancers.

Active ftp is dead. I wouldn't be surprised if browsers don't support it out at least don't default to it since as you said it would break things for 99% of users. Running a server that's not configured properly for passive transfers is effectively a server that's useless. So if it would make someone sleep better at night I'd be fine with removing active transfer support from browser clients. Switch to filezilla if you're a power user or want to do some 1337 FXP tricks.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#156

Post by dijit »

tialaramex wrote: post #145
kuschku wrote: post #139

Earlier quoted context omitted.

The drivers are cryptographically signed so the MitM-able channel is absolutely irrelevant. The users will just have to stop using Chrome. Supporting Google software is always just a pain in the ass (and I've gotta know as developer of Android apps)

Actually a MitMable channel makes the "it's just cryptographically signed" thing into a heap more trouble. Bad guys can now replay old drivers, which were cryptographically signed, as the latest drivers. So then you need to build cryptographically signed metadata structures, so that you can tell that these were the latest drivers as of some recent moment. You need to have this idea of freshness, and a mechanism to en…

Drivers have versions in them, it's part of the driver itself and therefor cryptographically signed.

People like to cargo cult TLS as if it's the only option but it's really not, even debian doesn't use https (and gets quite a bit of backlash despite understanding very well their security model): https://whydoesaptnotusehttps.com/

Re: Google Plans to Deprecate FTP URL Support in Chrome

#157

Post by iforgotpassword »

userbinator wrote: post #90
clouddrover wrote: post #82

Earlier quoted context omitted.

> this seems like another move to bully the Internet into what Google wants it to be Bully them back. Don't use Google search and don't use Chrome.

Easier said than done, especially when most of the population doesn't care either because they're too young or too nontechnical; actually, I already don't use Chrome, but their search (which still shows FTP sites...) is, despite slowly getting worse too, still giving a wider breadth of sites most of the time. Bing and DDG help fill in the gaps.

Try switching to ddg and append !g every time the results seem to suck. That's how I did it and after about a month it was just fine. In fact over time I felt like I did the !g thing less and less, because you somehow get a feel for when ddg actually sucks or not. Or maybe I unconsciously started formulating queries differently.

But if you really think it would be right to switch away from Google, give yourself a month of pain and then decide if you can live this new life. ;-)

Re: Google Plans to Deprecate FTP URL Support in Chrome

#158

Post by thrwyway9448 »

hos234 wrote: post #148
thrwyway9448 wrote: post #137

Earlier quoted context omitted.

>Will it start removing those results, effectively censoring another huge chunk of the Internet? speaking as an evil overlord, the most illegal extension of Google's search monopoly would be to redirect those results through Google Drive in a way that forces users to go through Google Drive to see and access the full link or download any of its contents. By the way, Google, would you like me to apply as a product man…

They aren't evil man. They are just well programmed robots constantly searching for things to over-optimize. They hit their metrics every day and then plug into their charging stations. That's it. Give it a few years and they will deprecate Android for security reasons.

isn't that just your guess though? Zealous over-optimization only gets you so far: illegally extending a monopoly requires active malice and disdain. Really removing users' choice. Forcing them to use your products.

For example one of the things I would do as an evil product manager at Google is introduce active detection of Firefox - even if the user agent string has been set to Chrome to get me to serve unbroken pages. I would have engineers actively fingerprint Firefox, and if I figure out the user is using Firefox, serve them broken pages. (Even if it works perfectly well in Firefox if they pass my detection, and even if they identify as Chrome.)

Would this attitude be a good fit for a product manager for Google? I'm really evil.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#159

Post by TeMPOraL »

elcomet wrote: post #133
userbinator wrote: post #66

Considering that Google (search) still lists plenty of FTP results, many of which have been extremely useful to me, this seems like another move to bully the Internet into what Google wants it to be. Will it start removing those results, effectively censoring another huge chunk of the Internet? It's already hard enough to find older/more obscure information, and FTP sites are more likely to be in that category. Also,…

> everyone knows FTP is plaintext You mean no one knows that FTP is plaintext except a minority of users which happens to be on HN. Google is optimizing its browser for the majority, chrome is not a power-user browser. Maybe they'll add an option to enable ftp or something. > drivers, which I'd say are a significant part of FTP use I'm not sure how that's true. Every time I used FTP, it was not for drivers. All the d…

> Google is optimizing its browser for the majority, chrome is not a power-user browser.

That is a problem. We have browser engine duopoly, and really everyone is doing whatever Google wants anyway. So as they're optimizing against power users, they're making the whole web much worse.

Re: Google Plans to Deprecate FTP URL Support in Chrome

#160

Post by bartread »

userbinator wrote: post #84
yjftsjthsd-h wrote: post #80

Earlier quoted context omitted.

What big attack surface? The client? FTP is an ugly/stupid protocol, but it's not really complex (I suspect it's far simpler than HTTP).

I'm surprised the article claims there are still bugs, because one would think (hope) that a protocol over 30 years old with an implementation over a decade old should've received its last bugfix long ago and become truly stable by now.

What? Like OpenSSL:

https://en.wikipedia.org/wiki/Heartbleed

(I mean, I'm not overjoyed at the deprecation of FTP support because I used it just yesterday, but let's at least be honest here. The protocol might be decades old but the implementations aren't necessarily, and if they're being actively maintained there's always the possibility of introducing new bugs.)

Post reply on HN