Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping FTP support in Firefox 90

blog.mozilla.org

Post reply on HN
Print view View original

251–260 of 350 posts

Re: Stopping FTP support in Firefox 90

#251

Post by photon-torpedo »

jacquesm wrote: post #110
acabal wrote: post #93

Earlier quoted context omitted.

Browsers opening an ftp:// link can simply prompt to open it in a different program, much like they did PDFs in the past. (I also don't think a browser should have to be a great PDF renderer, but here we are.)

And such programs can and will be downloaded from disreputable sites packed with malware and other junk, because the user needs that file. The great thing of having this stuff concentrated in a single program is that at least you have only one vendor relationship to consider.

Users googling for an ftp client have a good chance to land on filezilla, a client that has a history of bundling with unwanted software.

The net security impact of dropping ftp support from the browser may well be negative.

Re: Stopping FTP support in Firefox 90

#252

Post by jedberg »

throw0101a wrote: post #247
jedberg wrote: post #163

Earlier quoted context omitted.

> but FTP is still a widely used protocol. I cannot for the life of me remember the last time I landed on a page with FTP or had to use FTP in any way. Even lists of file downloads are http pages where I just click on the file.

> I cannot for the life of me remember the last time I landed on a page with FTP or had to use FTP in any way. I had to use it this past weekend to get some firmware from the vendor for a network switch. ¯\_(ツ)_/¯

That was mentioned elsewhere and I agree that is a legit use case. But why would you use a web browser to get there, and not the built in client in your OS or one of many other client choices?

Re: Stopping FTP support in Firefox 90

#253

Post by kragen »

billyhoffman wrote: post #231
antisol wrote: post #164

Earlier quoted context omitted.

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

> ftp is a relatively simple protocol, not particularly complicated to implement Parts of it are, sure, but parts of it are an absolutely horror show (The client opens a port, and then the server connects back to it!?), text conversion and binary modes that's based on ASCII, different list formats, etc. It's not great. Worse, it doesn't support the good stuff like implicit TLS extensions > Supporting FTP isn't some b…

It's not a well-designed protocol, but it's still a relatively simple protocol.

Your reasoning, that "Continuing to support $x means continuing to defend attack surface that's implemented as $y year-old code, to deliver a feature that in $z the majority of people do not use," would ultimately consign every feature on the web to the book-burners' flames, except for the worthless minority of features that the majority of people do use. Chinese HTML text support, I suppose, and biometric authentication, and whatever the latest video codec is.

After all, it's 02045. Who watches videos encoded in VP9 now anyway? It's been obsolete since 02028! Or reads English text? Much less Hebrew? The majority of people do not use those features. Why should we continue to defend that attack surface?

Re: Stopping FTP support in Firefox 90

#254

Post by throw0101a »

jedberg wrote: post #252
throw0101a wrote: post #247

Earlier quoted context omitted.

> I cannot for the life of me remember the last time I landed on a page with FTP or had to use FTP in any way. I had to use it this past weekend to get some firmware from the vendor for a network switch. ¯\_(ツ)_/¯

That was mentioned elsewhere and I agree that is a legit use case. But why would you use a web browser to get there, and not the built in client in your OS or one of many other client choices?

Because the firmware link came in an e-mail advisory, and I clicked on it, and it launched by web browser, which then saved it in my "Downloads" directory.

Re: Stopping FTP support in Firefox 90

#255

Post by antisol »

dvfjsdhgfv wrote: post #213
antisol wrote: post #164

Earlier quoted context omitted.

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

> I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic Well, there is nothing vague here: FTP is a cleartext protocol, and we're migrating towards protocols that provide integrity and encryption. Sometimes I think it's a generational thing. I find it hard to accept this, growing up with testing all protocols with Telnet and so on. But unfortunately the Intern…

>there is nothing vague here: FTP is a cleartext protocol

Sometimes there's nothing wrong with transferring stuff in cleartext.

Screaming vague and meaningless "for security!" mantras isn't helpful.

Re: Stopping FTP support in Firefox 90

#256

Post by mananaysiempre »

klodolph wrote: post #33
amelius wrote: post #29

Earlier quoted context omitted.

Perhaps one day we can have a programming language that allows us to write software that doesn't rot or corrode.

You can continue to use most command-line FTP programs without problem. Since the terminal is a fairly stable interface, programs written long ago often have no problem compiling and running on modern systems, or only require small changes.

I wouldn’t actually say that, but it may be more of a problem of ecosystem maturity and priorities than it is one of interface stability: I work under Linux and love it, but getting a 20- or 30-year-old program to compile or run under it is surprisingly more painful than doing the same for a Win32 program of similar age, despite the ostensible stability and undeniably better documentation, including that of historical issues, in the former case. (To be fair, getting an old DOS program to compile or run anywhere except a full VM is an absolute nightmare, even if it can sometimes be offloaded to DOSBox maintainers.)

Re: Stopping FTP support in Firefox 90

#257

Post by JackGreyhat »

SahAssar wrote: post #245
JackGreyhat wrote: post #238

Earlier quoted context omitted.

Well, I'm not saying running ftp to serve html is better. All I'm saying is that it can sometimes be the only supported option, or viable option. And there are major differences. Webserver access permissions vs. ftp server permissions for example?

> Webserver access permissions vs. ftp server permissions for example? What I'm saying is: is there a meaningful difference? Both need to bind to a port that is privileged and read files from the served directory. There is no difference between a ftpserver and a webserver from a permissions/privilege perspective.

Well, that's right. There is no meaningful difference in the sense that they both have to serve files from a storage backend, over a port to a frontend. I was comparing ftp folder permissions with webserver htaccess permissions. What I really ment was access control.

Re: Stopping FTP support in Firefox 90

#258

Post by JackGreyhat »

jedberg wrote: post #249
JackGreyhat wrote: post #244

Earlier quoted context omitted.

You asked for a scenario in which you need ftp in 2021. You handled my example by switching to another program, such as finder or explorer. That's fine. Do you agree that your user experience decreased by having to switch programs?

> Do you agree that your user experience decreased by having to switch programs? No, because it opened automatically and was nearly seamless. I didn't even notice that I'd been moved to Finder at first.

Try pressing the back button.

Re: Stopping FTP support in Firefox 90

#259

Post by joshmanders »

kragen wrote: post #224
jedberg wrote: post #163

Earlier quoted context omitted.

> but FTP is still a widely used protocol. I cannot for the life of me remember the last time I landed on a page with FTP or had to use FTP in any way. Even lists of file downloads are http pages where I just click on the file.

Just because you don't often visit the Russian Medieval Manuscripts wing doesn't mean we should burn it down, jedberg.

This argument would be okish if FireFox removing FTP was like burning it down, but it's not. A browser removing FTP protocol isn't the end of FTP. There's a myriad of FTP clients you can still use.

Re: Stopping FTP support in Firefox 90

#260

Post by kragen »

SahAssar wrote: post #243
kragen wrote: post #235

Earlier quoted context omitted.

> I get the "strip-mall vision of the WWW as a means to sell people things they don't need" complaint, but that does not seem related to the protocol discussion of HTTP and FTP at all. Web pages that are profit-making ventures, with employees dedicated to working around the latest browser featurectomies, will have no trouble with this sort of constant change. Web pages that are just HTML files that someone uploaded t…

I don't get how any of your comment is about HTTP vs FTP, even the security part seems to be about HTTPS, right? If we are talking about FTP and HTTP (not FTPS or SFTP and HTTPS) is there any meaningful difference?

> even the security part seems to be about HTTPS, right?

No, I mean that a lot of FTP servers by default want you to do password authentication (yes, in cleartext); by default they grant access to your whole filesystem; and a minimal FTP server is significantly more complicated than a minimal HTTP server, and so it's more likely to contain vulnerabilities. Also, by default, most FTP servers support writing to files, and HTTP servers don't. I'm not talking about eavesdropping on the protocol itself or packet spoofing, which I agree are equally easy with FTP and unencrypted HTTP.

This HTTP server I wrote is, I think, 324 instructions of machine code, and it doesn't use any libraries: http://canonical.org/~kragen/sw/dev3/server.s. I think it's plausible that it contains no security vulnerabilities, other than a DoS by flooding it with connections. I have a fair bit of confidence that it doesn't have an exploitable RCE vulnerability. I'm not sure if there's ever been an FTP server we could say that about.

But none of that is relevant to whether we should break functionality that has been core to the WWW project for 31 years.

Post reply on HN