With the way Mozilla’s management has been going, they might as well stop HTTP support as well :^)
ssh would be a huge improvement over http. I'd be all for it.
I do like the idea of repurposing Firefox into an SSH browser.
Stopping FTP support in Firefox 90
281–290 of 350 posts
Re: Stopping FTP support in Firefox 90
#282Earlier quoted context omitted.
I think the concept of the WWW as a vast library of accumulating knowledge was a nice vision but it was never a reality, and even less so today. Every time someone stops paying a server bill, a part of that vast library disappears forever. URLs change all the time without redirects, closing doors in the library, usually for good. Protocols go out of fashion (Gopher anybody? FTP?). That's why we have important service…
Wayback is probably not a good example here, though, because it backs up neither (to use your examples) Gopher nor FTP. There are some images of such sites on the Internet Archive, but these are site dumps people have taken steps to manually upload. I submit that won't be the majority.
The Wayback Machine doesn't have very good coverage of FTP, but it's not literally zero: https://web.archive.org/web/2002*/ftp://sunsite.unc.edu/pub/...
Re: Stopping FTP support in Firefox 90
#283Earlier quoted context omitted.
Vault? “Not on the internet IoT” is basically the domain of either large industrial/commercial entities who already pay engineers to design and operate their gear (and for whom there are a number of viable internal-PKI platforms) or hobbyist tech people who want to do fancy segmentation of their IoT gear (and for whom there are a host of open source PKI helpers). The general human in 2021 who buys IoT gear puts it on…
The general human in 2021 who buys IoT gear puts it on their Wifi and goes back to other things. Fallacy of the "general human" aside...how do you configure it? How do you configure your Wifi in the first place? The app- and service-centric world that people have been forced into by the laziness of developers, the desire for surveillance data, and the deprecation of browser features, is the worst of all possible worl…
I think we took a left turn midway between my comment and your reply. You asked how people should handle universal TLS for internet-disconnected systems.
The answer I gave addressed that directly: there are commercial and open source tools for doing so (MSCA, Vault, EJBCA, smallstep, FreeIPA, to name a few). But the overwhelming majority of actual individual users do not desire to segment their IoT devices off the internet. That’s not a “fallacy”, that’s just a fact.
It’s clear that you have objections to the current state of general purpose computing, and desire that technology existed differently. But that’s a pretty far step away from the topic here.
Re: Stopping FTP support in Firefox 90
#284Earlier quoted context omitted.
> I cannot for the life of me remember the last time I landed on a page with FTP or had to use FTP in any way. I had to use it this past weekend to get some firmware from the vendor for a network switch. ¯\_(ツ)_/¯
That was mentioned elsewhere and I agree that is a legit use case. But why would you use a web browser to get there, and not the built in client in your OS or one of many other client choices?
Many oses don't come with FTP clients anymore either. I don't think Windows still does. They removed FTP and telnet in Windows 7 IIRC.
Not that I'll really miss it in Firefox but still...
Re: Stopping FTP support in Firefox 90
#285Earlier quoted context omitted.
> I never suggested removing a language used by millions of people. Let me be more specific: Pruning support for old formats and protocols is a feature, not a bug. You're contradicting yourself here; Hebrew is a language used by millions of people (about ten million, so 99.9% of the world's population does not use it) and also an old format (about 3000 years old). "Pruning" support for old formats makes history inacc…
We are at an impasse that can only be solved by data: how many unique users downloaded a document via an FTP URI in a web browser in a month? If I were a betting man, I'd wager it's less than the unique number of users who visited a webpage rendered using Hebrew, but we don't know. Hopefully the browser makers will be transparent with this telemetry.
Precisely what I'm arguing is that we should stop destroying access to all information except the most popular—I'm astounded to find that you disagree! That is not an impasse that can be resolved by data.
Popularity is not a valid measure of value. The July 02021 issue of People magazine sold 3 million copies, in a single month, and is almost completely devoid of value. (Maybe in 02068 it will provide valuable insights into vapid 02020s US popular culture.) Amazon tells me Claude Shannon's Mathematical Theory of Communication is outsold by 185,210 other books at present, so perhaps it has sold 100 copies this month, but it is the foundation of data compression, error correction, and significant amounts of artificial intelligence work. One Hundred Years of Solitude has sold about 50 million copies—over the past 54 years, so perhaps it sells 80,000 copies a month, 40 times less than the July 02021 issue of People. (But probably less; it probably doesn't sell as much as it did 30 years ago.)
40:1 is more than the ratio between the number of HTTPS servers and the number of anonymous FTP servers.
Re: Stopping FTP support in Firefox 90
#286Earlier quoted context omitted.
> even the security part seems to be about HTTPS, right? No, I mean that a lot of FTP servers by default want you to do password authentication (yes, in cleartext); by default they grant access to your whole filesystem; and a minimal FTP server is significantly more complicated than a minimal HTTP server, and so it's more likely to contain vulnerabilities. Also, by default, most FTP servers support writing to files,…
> by default they grant access to your whole filesystem Do they? Do FTP servers usually just open up everything to any host? That's not the way I've used them. Don't they usually default to sharing one directory and nothing else? > Also, by default, most FTP servers support writing to files That's kinda what file system permissions are there for, and it is usually pretty configurable in the server, right? > This HTTP…
> Do FTP servers usually just open up everything to any host?
Typically they do not allow anonymous access by default, but do not discriminate by host.
> That's not the way I've used them. Don't they usually default to sharing one directory and nothing else?
That's a good default, but historically speaking you had to chroot them to get that behavior. Nowadays you could use Docker.
> [Writing to files] is kinda what file system permissions are there for, and it is usually pretty configurable in the server, right?
Running a server that includes code to write to files is unnecessary for serving up web pages, and it's more likely to accidentally result in the server writing to files than running a server that doesn't. You're more likely to misconfigure a server that's pretty configurable than one that isn't. Filesystem permissions are generally far looser than you want for anonymous access over the internet; I don't want random strangers to read my /etc/passwd or see which versions of what Python modules I have installed, much less create files in /tmp. Filesystem permissions are only usable in the first place (for uploading files) if the FTP server has the authority to set its user ID to the user ID of the authenticated FTP user, which means it needs to run as root until after they've authenticated. Also it means I need to add my FTP users to my real /etc/passwd and /etc/shadow.
> is this relevant to something that asks if FTP is needed over HTTP on the protocol level?
My point with the two-kilobyte secure (?) HTTP server is that FTP is a bad protocol. The reason browsers should continue to support FTP is not that FTP possesses some kind of unparalleled technical excellence, the way NNTP and IRC could be argued to; it's that FTP, however janky it may be, is still useful, and providing better access to existing FTP repositories is one of the main reasons the WWW was created in the first place.
> If this was a priority then I'm guessing that over the last decade or so getting ftps or sftp working in the browser would have been worked on.
There's relatively little advantage to ftps or sftp over unencrypted FTP for anonymous access—you aren't sending the FTP server any files or credentials, just the names of files you want—and no advantage for backward compatibility, since the existing FTP servers you want backward compatibility with aren't running ftps/sftp.
Re: Stopping FTP support in Firefox 90
#287Earlier quoted context omitted.
Not everyone has a FTP client installed in the system, or a FTP client that can be launched with the server to open (Windows explorer can open FTP servers but I don't think you could with a link. But I'm not sure). A lot of sites, especially old ones, are build with the assumption that every browser can access FTP links as you would with HTTP. And so for example a download section is a link to a FTP server. To me rem…
Who is this user, who needs an FTP client, but only sometimes, and doesn't know where to find one?
Me. I don't want to install a FTP client for the 2 times at year that I go to a site to download something (typically drivers for some obsolete device) and the download is from an FTP server.
And yes, if I have the URL I can use curl to download the file from FTP, even if downloading it from the browser would be easier. But most of the times there is a link to the server directory, with multiple files to select. Yes I can use Windows explorer and connect to the FTP server and browse it, but to be fair, or just open Internet Explorer and past the FTP link.
Re: Stopping FTP support in Firefox 90
#288I don't understand all the negativity around this. People complained when Firefox added Pocket, in part because they took a browser extension and made it a feature that was ostensibly unrelated to web browsing. Now they're taking an old feature that's definitely not related to web browsing and removing it, and people are still complaining? Firefox can't be everything. It should focus on being a great browser and not…
Because pocket was a useless addition and dropping ftp:/ support breaks approximately 150 million valid links.
Pocket is worse than useless. It's ad-filled, privacy invading, garbage. For all the potential security problems with using FTP, pocket is a lot riskier since you can be certain your data will be sent to 3rd parties and you'll have ads pushed at you by using it.
Re: Stopping FTP support in Firefox 90
#289Earlier quoted context omitted.
Mozilla is struggling and is trying to focus its resources in a way that will let them build sustainable revenue and browser share. I hope they succeed
RIP Mozilla. It's a shame that at the beginning the browser was pretty good.
It's still a really good browser, you just have spend a lot of time and effort beating it into submission, removing/disabling anti-features, and installing 3rd party add-ons to get it there. Once you do however, it's the best bet you have at a secure, privacy respecting, modern web browser.
Re: Stopping FTP support in Firefox 90
#290I don't understand all the negativity around this. People complained when Firefox added Pocket, in part because they took a browser extension and made it a feature that was ostensibly unrelated to web browsing. Now they're taking an old feature that's definitely not related to web browsing and removing it, and people are still complaining? Firefox can't be everything. It should focus on being a great browser and not…
I agree. Creating some friction to encourage the move away from FTP is the right thing to do, for a variety of technical reasons There are times when HN seems to become very negative to a particular topic. In the past I’ve seen it with Kubernetes, systemd or GCP/AWS. I feel it’s that way with Mozilla/Firefox. More often than not, comments on Mozilla/Firefox are very negative then create a feedback loop of negativity.…
If I'm hard on Mozilla/Firefox it's only because I love it, think it's valuable/important, and want it to be the best it can be.
When Google or MS does something shitty with their browsers I pretty much expect it from them and I'm partially insulated from their bad behaviors since I avoid using those browsers. When Mozilla acts badly though I'm often personally impacted.
I'm actually okay with them getting rid of FTP support (although I think leaving it there, but disabled by default was a better way to go - FTP links are pretty common out there) but I'm not at all surprised by the backlash.