Earlier quoted context omitted.
I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…
> I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic Well, there is nothing vague here: FTP is a cleartext protocol, and we're migrating towards protocols that provide integrity and encryption. Sometimes I think it's a generational thing. I find it hard to accept this, growing up with testing all protocols with Telnet and so on. But unfortunately the Intern…
Stopping FTP support in Firefox 90
271–280 of 350 posts
Re: Stopping FTP support in Firefox 90
#272Earlier quoted context omitted.
Transferring huge files. The client is FileZilla.
Why not use SFTP or rsync at this point?
https://support.cerberusftp.com/hc/en-us/articles/203333215-...
Rsync is not available on the target machine.
Re: Stopping FTP support in Firefox 90
#273Earlier quoted context omitted.
I don't get how any of your comment is about HTTP vs FTP, even the security part seems to be about HTTPS, right? If we are talking about FTP and HTTP (not FTPS or SFTP and HTTPS) is there any meaningful difference?
> even the security part seems to be about HTTPS, right? No, I mean that a lot of FTP servers by default want you to do password authentication (yes, in cleartext); by default they grant access to your whole filesystem; and a minimal FTP server is significantly more complicated than a minimal HTTP server, and so it's more likely to contain vulnerabilities. Also, by default, most FTP servers support writing to files,…
Do they? Do FTP servers usually just open up everything to any host? That's not the way I've used them. Don't they usually default to sharing one directory and nothing else?
> Also, by default, most FTP servers support writing to files
That's kinda what file system permissions are there for, and it is usually pretty configurable in the server, right?
> This HTTP server I wrote
Love it, but I have no experience writing assembly, and almost no experience writing C, so I cannot say anything more (I just don't have the experience or knowledge). I still have to ask though, is this relevant to something that asks if FTP is needed over HTTP on the protocol level?
> But none of that is relevant to whether we should break functionality that has been core to the WWW project for 31 years.
I think the question here is if it needs to be in the browser though? There are plenty of protocols in wide use on WWW that are not browser supported and considering that none of the "secure" variants of FTP are supported in browsers it does not seem out of the question to remove this.
If this was a priority then I'm guessing that over the last decade or so getting ftps or sftp working in the browser would have been worked on.
Re: Stopping FTP support in Firefox 90
#274Earlier quoted context omitted.
FTP has been related to web browsing since the beginning of the web 31 years ago. For maybe a decade (the first third of the web so far), most of the WWW was on FTP servers—not just most software downloads, but also most HTML pages. Web browsers are a much better interface to FTP servers than dedicated FTP clients, because you can click a link on an HTML page (either a statically generated directory, possibly on the…
I think the concept of the WWW as a vast library of accumulating knowledge was a nice vision but it was never a reality, and even less so today. Every time someone stops paying a server bill, a part of that vast library disappears forever. URLs change all the time without redirects, closing doors in the library, usually for good. Protocols go out of fashion (Gopher anybody? FTP?). That's why we have important service…
Re: Stopping FTP support in Firefox 90
#275Earlier quoted context omitted.
Here is a real world example: http://tenfourfox.blogspot.com/2019/08/chrome-murders-ftp-li...
A "real world example" involving a single HTML file (not even a web site, just a bare file!) from 1997 is pretty weak.
Re: Stopping FTP support in Firefox 90
#276Earlier quoted context omitted.
It's not a well-designed protocol, but it's still a relatively simple protocol. Your reasoning, that "Continuing to support $x means continuing to defend attack surface that's implemented as $y year-old code, to deliver a feature that in $z the majority of people do not use," would ultimately consign every feature on the web to the book-burners' flames, except for the worthless minority of features that the majority…
Straw men are not helpful. I never suggested removing a language used by millions of people. Let me be more specific: Pruning support for old formats and protocols is a feature, not a bug. Let's pick something else from this golden age of "browsing HTML pages via the FTP protocol" that people on this thread keep professing: XBM images, the very first image format ever supported by browsers, and used when Marc Andrees…
You're contradicting yourself here; Hebrew is a language used by millions of people (about ten million, so 99.9% of the world's population does not use it) and also an old format (about 3000 years old). "Pruning" support for old formats makes history inaccessible; "pruning" support for old protocols requires constant effort to keep your servers compatible with whatever is fashionable with today's cascade of attention-deficit teenagers [CADT].
And if we follow your originally stated reasoning, "Continuing to support $x means continuing to defend attack surface that's implemented as $y year-old code, to deliver a feature that in $z the majority of people do not use," we ineluctably arrive at the conclusion that we should remove support for languages used by millions of people.
Taken literally, we should remove support for all languages, since no language is used by more than 50% of the world population, but in keeping with the principle of charity, I interpreted your "majority" as "vast majority". I'm not sure where exactly the vast-majority cutoff lies: a feature that 90% of people do not use? That would include all natural languages except English and Chinese. 95%? All languages except those, Hindi, and Spanish. (In particular, it leaves out all those RTL languages that cause so much complication in text rendering, like Arabic.) 99%? That leaves 20 languages, but not, for example, Persian, Swahili, Italian, or Thai. Even a cutoff of 99.9% might leave out Hebrew, Uighur, and Greek.
What percentage of users do you think use View Source? The web inspector? Printing?
That's not a strawman argument; it's a slippery-slope argument. And, I think, it's a valid slippery-slope argument. If we are going to avoid removing support for these things, we need a better basis on which to make the decision than, "Continuing to support $x means continuing to defend attack surface that's implemented as $y year-old code, to deliver a feature that in $z the [vast] majority of people do not use."
I do agree that there needs to be some kind of cutoff. Gopher is probably below it; WAIS and XBM certainly are. But FTP?
XBM was never very widely used in web pages because it didn't support color, grayscale, or compression, although for a little while it was the only image format supported by browsers that supported transparency. I did put it on a few of my web pages, but as soon as Netscape added support for transparent pixels in GIFs, I switched over and never looked back. This would have been about 01994.
By contrast, there are about 1.1 million anonymous FTP servers today, one out of every 4000 public IP addresses, and about one for every 30 HTTP(S) servers: https://zakird.com/papers/dsn-ftp.pdf That's more than the number of HTTP servers that existed for the first seven years of the Web, up to 01997: https://news.netcraft.com/archives/2021/05/31/may-2021-web-s...
You can be sure that there's millions of people using them. Probably more people than speak Hebrew, in fact.
Re: Stopping FTP support in Firefox 90
#277Earlier quoted context omitted.
> Define "lots" a ton of government and scientific datasets are provided over FTP
The majority are also available on HTTP. It saves a lot of confused users at other government / scientific institutions, where the firewall blocks FTP.
Google found it a convincing enough argument to warrant re-enabling ftp support last year, in light of the pandemic: https://www.theregister.com/2020/04/15/ftp_chrome_deprecatio...
That doesn't mean I'm against deprecation completely. But you can't pretend it won't affect people
Re: Stopping FTP support in Firefox 90
#278Earlier quoted context omitted.
Straw men are not helpful. I never suggested removing a language used by millions of people. Let me be more specific: Pruning support for old formats and protocols is a feature, not a bug. Let's pick something else from this golden age of "browsing HTML pages via the FTP protocol" that people on this thread keep professing: XBM images, the very first image format ever supported by browsers, and used when Marc Andrees…
> I never suggested removing a language used by millions of people. Let me be more specific: Pruning support for old formats and protocols is a feature, not a bug. You're contradicting yourself here; Hebrew is a language used by millions of people (about ten million, so 99.9% of the world's population does not use it) and also an old format (about 3000 years old). "Pruning" support for old formats makes history inacc…
Hopefully the browser makers will be transparent with this telemetry.
Re: Stopping FTP support in Firefox 90
#279Earlier quoted context omitted.
Firefox didn't support directly opening and rendering HTML files via ftp:// URLs anyways, it'd just download them like a normal FTP client. I can't even remember the last browser I used that supported that. You can't kill what has been dead for decades already.
Actually, yes, it did, until Firefox 61 when FTP subresources were disallowed from HTTPS, and Firefox 70 when HTML pages over FTP were converted to downloads as well.
Re: Stopping FTP support in Firefox 90
#280Earlier quoted context omitted.
> because literally no one I know younger than 40 even knows what FTP is, let alone having used it. How many of them know what TLS is? Yet they've probably used it. With computers, you don't need to know what something is to have used it.
Sure, they also use C6H12O6 every day, and interbank networks, but if we listed everything that wasn't similar to FTP we'd be here a while. FTP is "a thing" you intentionally use. You connect to FTP servers, and upload or download files, in the same way that HTTP is a thing you intentionally use to consumer web pages. TLS it just an aspect of how connections are negotiated and is on a completely different rung of the…
Nope. I just clicky the link.