Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping FTP support in Firefox 90

blog.mozilla.org

Post reply on HN
Print view View original

261–270 of 350 posts

Re: Stopping FTP support in Firefox 90

#261

Post by nitrogen »

akerl_ wrote: post #195
nitrogen wrote: post #165

Earlier quoted context omitted.

Is there a solution yet for universal TLS with offline "IoT" (but not on the Internet) devices?

Vault? “Not on the internet IoT” is basically the domain of either large industrial/commercial entities who already pay engineers to design and operate their gear (and for whom there are a number of viable internal-PKI platforms) or hobbyist tech people who want to do fancy segmentation of their IoT gear (and for whom there are a host of open source PKI helpers). The general human in 2021 who buys IoT gear puts it on…

The general human in 2021 who buys IoT gear puts it on their Wifi and goes back to other things.

Fallacy of the "general human" aside...how do you configure it? How do you configure your Wifi in the first place?

The app- and service-centric world that people have been forced into by the laziness of developers, the desire for surveillance data, and the deprecation of browser features, is the worst of all possible worlds.

Devices have full network connectivity, so that security camera you bought becomes part of a botnet, hacks your laptop, and installs ransomware or steals your financial info/bitcoin wallet. Companies control your house and your data, so when they disappear, or when Nest pushes out a bad firmware update, your devices (and your thermostat!) stop working.

Technology is realizing only a small fraction of its promise, and rather than empowering people, is acting as just another set of shackles that binds people to the whims of the powerful. The best instruments for changing that, namely web browsers and truly independent, user-owned devices, are being destroyed one small step at a time.

So, in 2021, the question stands, and you've made no attempt to answer it -- how is any device supposed to break out of this sinkhole and restore the power of technology, if browsers block local devices' UIs, and users can't even configure the device without the blessing of Google or Apple?

Re: Stopping FTP support in Firefox 90

#262

Post by TheRealPomax »

hulitu wrote: post #189
TheRealPomax wrote: post #121

Earlier quoted context omitted.

Yeah, really gonna need some numbers here, though, because literally no one I know younger than 40 even knows what FTP is, let alone having used it. Even Apache 1 can expose dirs over http instead of ftp, there is literally no reason for FTP unless you want uploads. In which case: no you don't, you want sftp at the very least, because you care about the fact that you want data that gets uploaded to be your data, not…

no one I know younger than 40 even knows what http or https is. Https can also be MITM.

HTTPS can be MITM'd, but absolutely not trivially, unlike FTP.

Re: Stopping FTP support in Firefox 90

#263

Post by antisol »

jedberg wrote: post #249
JackGreyhat wrote: post #244

Earlier quoted context omitted.

You asked for a scenario in which you need ftp in 2021. You handled my example by switching to another program, such as finder or explorer. That's fine. Do you agree that your user experience decreased by having to switch programs?

> Do you agree that your user experience decreased by having to switch programs? No, because it opened automatically and was nearly seamless. I didn't even notice that I'd been moved to Finder at first.

hahaha.

"my UX wasn't diminished"

"nearly seamless"

That's pretty funny.

Re: Stopping FTP support in Firefox 90

#264

Post by TheRealPomax »

wizzwizz4 wrote: post #188
TheRealPomax wrote: post #121

Earlier quoted context omitted.

Yeah, really gonna need some numbers here, though, because literally no one I know younger than 40 even knows what FTP is, let alone having used it. Even Apache 1 can expose dirs over http instead of ftp, there is literally no reason for FTP unless you want uploads. In which case: no you don't, you want sftp at the very least, because you care about the fact that you want data that gets uploaded to be your data, not…

> because literally no one I know younger than 40 even knows what FTP is, let alone having used it. How many of them know what TLS is? Yet they've probably used it. With computers, you don't need to know what something is to have used it.

Sure, they also use C6H12O6 every day, and interbank networks, but if we listed everything that wasn't similar to FTP we'd be here a while. FTP is "a thing" you intentionally use. You connect to FTP servers, and upload or download files, in the same way that HTTP is a thing you intentionally use to consumer web pages. TLS it just an aspect of how connections are negotiated and is on a completely different rung of the ladder of abstraction.

Re: Stopping FTP support in Firefox 90

#265

Post by kragen »

acabal wrote: post #248
kragen wrote: post #129

Earlier quoted context omitted.

FTP has been related to web browsing since the beginning of the web 31 years ago. For maybe a decade (the first third of the web so far), most of the WWW was on FTP servers—not just most software downloads, but also most HTML pages. Web browsers are a much better interface to FTP servers than dedicated FTP clients, because you can click a link on an HTML page (either a statically generated directory, possibly on the…

I think the concept of the WWW as a vast library of accumulating knowledge was a nice vision but it was never a reality, and even less so today. Every time someone stops paying a server bill, a part of that vast library disappears forever. URLs change all the time without redirects, closing doors in the library, usually for good. Protocols go out of fashion (Gopher anybody? FTP?). That's why we have important service…

It's true that there are many existing causes for the decay of the web, and we should work to fix those. But that becomes more and more difficult when we add more and more causes to the decay.

That's not two important services you've named, but only one, and at some point it will be destroyed; it's only temporary. Hopefully it will last a few decades.

Brewster Kahle, the founder of archive.org, has a saying:

Governments burn libraries.

Re: Stopping FTP support in Firefox 90

#266

Post by SahAssar »

JackGreyhat wrote: post #257
SahAssar wrote: post #245

Earlier quoted context omitted.

> Webserver access permissions vs. ftp server permissions for example? What I'm saying is: is there a meaningful difference? Both need to bind to a port that is privileged and read files from the served directory. There is no difference between a ftpserver and a webserver from a permissions/privilege perspective.

Well, that's right. There is no meaningful difference in the sense that they both have to serve files from a storage backend, over a port to a frontend. I was comparing ftp folder permissions with webserver htaccess permissions. What I really ment was access control.

Gotcha, but htaccess is specific to one server (apache). You can leave that out for basic things for basic use cases (just set read/write as you would for a normal unix user) and for more granular things you need to configure FTP just like you need HTTP.

Re: Stopping FTP support in Firefox 90

#267

Post by kragen »

joshmanders wrote: post #259
kragen wrote: post #224

Earlier quoted context omitted.

Just because you don't often visit the Russian Medieval Manuscripts wing doesn't mean we should burn it down, jedberg.

This argument would be okish if FireFox removing FTP was like burning it down, but it's not. A browser removing FTP protocol isn't the end of FTP. There's a myriad of FTP clients you can still use.

Okay, yes, it's more like burning the card catalog, not the actual books. The books are still there, but the links that tell you where to find the book you want don't work.

Re: Stopping FTP support in Firefox 90

#268

Post by antisol »

da_chicken wrote: post #226
antisol wrote: post #166

Earlier quoted context omitted.

So your argument is that because you haven't used it lately, nobody does? Seems legit.

> So your argument is that because you haven't used it lately, nobody does? I mean, it's opposed by the argument that it used to be popular. It's a pretty low bar. FTP is a protocol that dates to when NCP was the protocol suite that ran the Internet. It was retrofitted to TCP/IP. That's why there's a command session and a data session. The protocol is so old that it dates to a time when IP+port was the unique identif…

>I just don't see many use cases for FTP anymore

I'm seeing this a lot today. It's almost like people have forgotten what FTP stands for.

The use case is transferring files.

>Why would you choose FTP at this point over HTTP(S), SFTP, BitTorrent, etc.?

Because I don't have a client for any of the others installed

Re: Stopping FTP support in Firefox 90

#269

Post by 542458 »

martin1975 wrote: post #135

I think this is a bad idea - many URLs are encoded as ftp still, e.g. when downloading tarballs, zips and such - does this mean clicking on an FTP URL now will require launching an external ftp app instead of downloading the file? I'm ok if FTP browsing is suspended through the browser, but abandoning FTP altogether in the browser is a bad idea. It's an old protocol and still very useful, albeit not in its unencrypte…

I’m not sure I buy that there are that many links encoded as FTP that you’d hit during normal browsing. Chrome dropped support a year or so ago, so any website depended on FTP already has required a separate FTP client for 85% of users.

It also doesn't really do a good job of transferring files - the protocol is slow and is incompatible with lots of firewall setups.

Re: Stopping FTP support in Firefox 90

#270

Post by billyhoffman »

kragen wrote: post #253
billyhoffman wrote: post #231

Earlier quoted context omitted.

> ftp is a relatively simple protocol, not particularly complicated to implement Parts of it are, sure, but parts of it are an absolutely horror show (The client opens a port, and then the server connects back to it!?), text conversion and binary modes that's based on ASCII, different list formats, etc. It's not great. Worse, it doesn't support the good stuff like implicit TLS extensions > Supporting FTP isn't some b…

It's not a well-designed protocol, but it's still a relatively simple protocol. Your reasoning, that "Continuing to support $x means continuing to defend attack surface that's implemented as $y year-old code, to deliver a feature that in $z the majority of people do not use," would ultimately consign every feature on the web to the book-burners' flames, except for the worthless minority of features that the majority…

Straw men are not helpful. I never suggested removing a language used by millions of people. Let me be more specific: Pruning support for old formats and protocols is a feature, not a bug.

Let's pick something else from this golden age of "browsing HTML pages via the FTP protocol" that people on this thread keep professing: XBM images, the very first image format ever supported by browsers, and used when Marc Andreessen literally invented the IMG tag [0].

XBM is a crazy simple image format [1]. Yet, because it is essentially C code that defines a buffer size and then gives you a char array, caused security bugs over and over [2] in all major browsers. Since virtually no one was using XBM images, the browsers all removed support for it [3].

The browsers removed code that was already written, and abandoned functionality that had already existed, because it reduced attack surface supporting something that virtually no website was using. Exactly like FTP support.

0 - https://eager.io/blog/to-what-extent-did-marc-andreessen-inv...

1- https://en.wikipedia.org/wiki/X_BitMap

2- https://www.cvedetails.com/google-search-results.php?q=xbm+i...

3- https://en.wikipedia.org/wiki/X_BitMap#Support

Post reply on HN