Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping FTP support in Firefox 90

blog.mozilla.org

Post reply on HN
Print view View original

191–200 of 350 posts

Re: Stopping FTP support in Firefox 90

#191

Post by dmux »

Symbiote wrote: post #144
dmux wrote: post #115

Earlier quoted context omitted.

FTP is still heavily used in the energy industry too. We upload an enormous amount of minute-by-minute meter data at work via FTP to various energy providers.

You should probably report this as a data breach, since meter data sounds like personal data, and FTP isn't encrypted. And you aren't using Firefox anyway, it has never supported FTP uploads.

I'm not sure if you're trying to be antagonistic with this reply or not. I also didn't feel it was important for me to outline the entirety of the data pipeline -- I merely wanted to point out that FTP is still in heavy use in some industries.

To address your concerns though: meter data is not ingested via FTP. That's done using other protocols. It's transferred b2b via FTP over private tunnels. And you're correct Firefox is not used for uploading data. If it were possible it wouldn't even be a good choice given the volume of data we deal with. It is, however, used heavily for accessing the uploaded data by Operations and other teams.

Re: Stopping FTP support in Firefox 90

#192

Post by alerighi »

acabal wrote: post #93
jacquesm wrote: post #79

Earlier quoted context omitted.

Because pocket was a useless addition and dropping ftp:/ support breaks approximately 150 million valid links.

Browsers opening an ftp:// link can simply prompt to open it in a different program, much like they did PDFs in the past. (I also don't think a browser should have to be a great PDF renderer, but here we are.)

Not everyone has a FTP client installed in the system, or a FTP client that can be launched with the server to open (Windows explorer can open FTP servers but I don't think you could with a link. But I'm not sure).

A lot of sites, especially old ones, are build with the assumption that every browser can access FTP links as you would with HTTP. And so for example a download section is a link to a FTP server.

To me removing it is stupid. Is it a security concern? Not really. Also not having it in the browser will not make security better, a person that needs it will use it with another client. Will make the browser faster or smaller? Not really, a FTP client is something really simpler, and browser have them since ever.

Re: Stopping FTP support in Firefox 90

#195

Post by akerl_ »

nitrogen wrote: post #165
tptacek wrote: post #52

Earlier quoted context omitted.

You could have said that, too, about universal TLS.

Is there a solution yet for universal TLS with offline "IoT" (but not on the Internet) devices?

Vault?

“Not on the internet IoT” is basically the domain of either large industrial/commercial entities who already pay engineers to design and operate their gear (and for whom there are a number of viable internal-PKI platforms) or hobbyist tech people who want to do fancy segmentation of their IoT gear (and for whom there are a host of open source PKI helpers).

The general human in 2021 who buys IoT gear puts it on their Wifi and goes back to other things.

Re: Stopping FTP support in Firefox 90

#196

Post by SahAssar »

kragen wrote: post #129
acabal wrote: post #36

I don't understand all the negativity around this. People complained when Firefox added Pocket, in part because they took a browser extension and made it a feature that was ostensibly unrelated to web browsing. Now they're taking an old feature that's definitely not related to web browsing and removing it, and people are still complaining? Firefox can't be everything. It should focus on being a great browser and not…

FTP has been related to web browsing since the beginning of the web 31 years ago. For maybe a decade (the first third of the web so far), most of the WWW was on FTP servers—not just most software downloads, but also most HTML pages. Web browsers are a much better interface to FTP servers than dedicated FTP clients, because you can click a link on an HTML page (either a statically generated directory, possibly on the…

You're saying it was normal (and is even today) to show HTML files over ftp links? I've never seen a browser do HTML over ftp, and while I am a youngster compared to HTTP (I stared to do web stuff in the early 2000's) the sites where I've seen that had both HTTP and FTP modes the ftp mode only downloaded the file, it did not show it.

> More broadly, this is a tradeoff between the traditional vision of the WWW as a vast library, in which human knowledge accumulates over time and becomes accessible to all, and the strip-mall vision of the WWW as a means to sell people things they don't need.

I don't get this at all.

* Are you saying FTP is a fundamentally better protocol to download files than HTTP?

* Are you saying that it would be easier to run a FTP server than a HTTP server?

* Do you think that FTP-only-sites generally depend on HTML-over-FTP for browsing? Because that's something I've never seen AFAIK, either they use HTTP-only or HTML-over-HTTP for browsing and FTP for download.

I get the "strip-mall vision of the WWW as a means to sell people things they don't need" complaint, but that does not seem related to the protocol discussion of HTTP and FTP at all.

Re: Stopping FTP support in Firefox 90

#197

Post by 1vuio0pswjnm7 »

Didnt Chrome remove ftp first. Is Firefox just following suit. Need to check.

Mozilla's explanation/justification here for removing ftp is quite flimsy. It presumes there could never, ever be any possible situation in which a user wants to use a browser for ftp. Whether now or in the future. It just does not add up. There are no specific references to ftp-based exploits, or other examples of how ftp is harmful. Who uses ftp for transfers of unencrypted files containing sensitive data over the open internet. ftp can be useful for stuff that is not sensitive and for transfers over the local network between devices (no internet connection required).

It makes sense to remove ftp if the web is just for advertising and sales. Why would any "consumer" need ftp.

Fortunately the text-only browser I use is probably not going to remove ftp. But any decline in ftp use that results from the decisions of these advertising-dependent organisations is concerning.

Re: Stopping FTP support in Firefox 90

#198

Post by antisol »

jeppesen-io wrote: post #125
acabal wrote: post #36

I don't understand all the negativity around this. People complained when Firefox added Pocket, in part because they took a browser extension and made it a feature that was ostensibly unrelated to web browsing. Now they're taking an old feature that's definitely not related to web browsing and removing it, and people are still complaining? Firefox can't be everything. It should focus on being a great browser and not…

I agree. Creating some friction to encourage the move away from FTP is the right thing to do, for a variety of technical reasons There are times when HN seems to become very negative to a particular topic. In the past I’ve seen it with Kubernetes, systemd or GCP/AWS. I feel it’s that way with Mozilla/Firefox. More often than not, comments on Mozilla/Firefox are very negative then create a feedback loop of negativity.…

> for a variety of technical reasons

Please elaborate. In excruciating detail.

Re: Stopping FTP support in Firefox 90

#199

Post by zamadatix »

sschueller wrote: post #32
MiscIdeaMaker99 wrote: post #7

I expect this to have very little impact on anything.

Well I'm going to move all my documents and files that are available for download to a public ftp. If you use Firefox you won't have access, sorry.

> If you use Firefox you won't have access, sorry.

Or Chrome, Edge, Safari... even IE. They'll have to use an FTP client.

Re: Stopping FTP support in Firefox 90

#200

Post by ocdtrekkie »

1vuio0pswjnm7 wrote: post #197

Didnt Chrome remove ftp first. Is Firefox just following suit. Need to check. Mozilla's explanation/justification here for removing ftp is quite flimsy. It presumes there could never, ever be any possible situation in which a user wants to use a browser for ftp. Whether now or in the future. It just does not add up. There are no specific references to ftp-based exploits, or other examples of how ftp is harmful. Who u…

I do suspect a likely reason is because while secure FTP protocols exist, they are often not well-supported by both servers and web browsers alike. So while FTP can be secure, the implementation in practice often is not, and Firefox and Chrome are both pushing a "literally everything over HTTPS" mentality. (I have significant reservations about this concept, but in a world where they're shoving your DNS requests through HTTPS, it isn't surprising they are also want file transfers to be through HTTPS.)

You can see here where the GUI didn't support FTP over SSL, and then eventually got marked WONTFIX because they decided to deprecate FTP entirely instead: https://bugzilla.mozilla.org/show_bug.cgi?id=85464

Post reply on HN