Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping FTP support in Firefox 90

blog.mozilla.org

Post reply on HN
Print view View original

291–300 of 350 posts

Re: Stopping FTP support in Firefox 90

#291

Post by autoexec »

RicoElectrico wrote: post #68

Lots of places like US federal institutions or universities use FTP to this day to distribute their open datasetes. Show me an example of actual FTP MITM hack in the wild. Sure loading FTP resources from HTTP(S) context is not a good idea (as would be downloading executables over FTP), but did they actually make any effort to inform the public and owners of FTP servers? I do not think so, I haven't seen it. Mozilla t…

> Mozilla these days has very weird priorities. Their decisions should not feel so unilateral or "because Chrome does it"

I agree. The attempts to be more and more like Chrome are especially confusing to me. Maybe they just want to copy what's popular but the thing they seem to miss is that if people wanted a browser that was just like chrome they'd probably just use chrome. The removal of choice, customization, and control over Firefox is what's going to drive people away. Those are the features that attracted most of us to Firefox in the first place.

Re: Stopping FTP support in Firefox 90

#292

Post by autoexec »

UI_at_80x24 wrote: post #49

Let's look at this from the other end of the horse. FTP is a horrible kludge that needs to be depreciated. SFTP is better. The number of ports needed, holes punched in firewalls, everything sent in plain-text, inability to traverse NAT without more kludge and hacky work-arounds. We only tolerate it because it was the only thing that worked. There are better/newer methods that should be embraced. We don't bemoan the d…

I was sad to see firefox drop support for Gopher too. I'm not very active in the gophersphere these days, but I guess there's a certain nostalgia in playing around with these old/depreciated/near forgotten protocols and a sense of comfort knowing that they're still out there and being used in little corners of the net even as most people never stray from HTTP-land.

Re: Stopping FTP support in Firefox 90

#293

Post by floatboth »

alerighi wrote: post #206
floatboth wrote: post #176

Earlier quoted context omitted.

It's very obscure. Most things (mostly shared hosting lol) went straight to SSH's SFTP instead.

SFTP is mainly a *NIX thing. And it's a terrible hack built on top of a protocol meant to be something really different. Also, while in theory SFTP can be as secure as FTPS, in practice it's not. How many people really check that the server public key signature it's the correct one? You know that annoying message that appears the first time you connect to a server and you have to say yes and if you don't it will not…

At least in the pre-Let'sEncrypt era, lots of the shared hosting providers that gave you SFTP as an upgrade over plaintext FTP also used self-signed certs for their HTTPS admin panels :D

Server identity keys can be checked using SSHFP DNS records signed with DNSSEC, but that is not really mainstream unfortunately.

Re: Stopping FTP support in Firefox 90

#294

Post by apostacy »

dvfjsdhgfv wrote: post #213
antisol wrote: post #164

Earlier quoted context omitted.

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

> I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic Well, there is nothing vague here: FTP is a cleartext protocol, and we're migrating towards protocols that provide integrity and encryption. Sometimes I think it's a generational thing. I find it hard to accept this, growing up with testing all protocols with Telnet and so on. But unfortunately the Intern…

This is security hypocrisy.

HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP.

Why does your browser scream at you for connecting to an encrypted but unverified site, such as a self signed certificate on a closed network, but have no warnings at all for an unverified and unencrypted HTTP connection?

How do you know the context that I am using a plaintext protocol in? How do you know I'm not connecting over a patch cable to the computer next to me? How do you know I'm not connecting over an SSH tunnel?

The user should easily be able to override these safety measures.

The only argument I have heard this is that the user could be tricked into disabling security mechanisms. But that is true of anything in computing. The user could be tricked into typing in rm -rf.

When there is inconstancy like this, it usually implies there is something else going on that we aren't seeing. I have a feeling that companies like Google and Apple have an agenda to move people away from having too much outside of their influence.

Re: Stopping FTP support in Firefox 90

#295

Post by Anthony-G »

jedberg wrote: post #163
kragen wrote: post #129

Earlier quoted context omitted.

FTP has been related to web browsing since the beginning of the web 31 years ago. For maybe a decade (the first third of the web so far), most of the WWW was on FTP servers—not just most software downloads, but also most HTML pages. Web browsers are a much better interface to FTP servers than dedicated FTP clients, because you can click a link on an HTML page (either a statically generated directory, possibly on the…

> but FTP is still a widely used protocol. I cannot for the life of me remember the last time I landed on a page with FTP or had to use FTP in any way. Even lists of file downloads are http pages where I just click on the file.

I use FTP in the browser once in a blue moon. Out of curiosity, I checked my browser history to search for instances of opening FTP URLs in the recent past. I found two:

* ftp://ftp.isc.org/isc/ – also available as http://ftp.isc.org/isc/

* ftp://ftp.oreilly.com/pub/ – only available as FTP

For the O’Reilly URI, it’s convenient to be able to click on directory links in the browser and then open HTML and PDF files without requiring another program.

So, it’s nice to have native FTP handling in Firefox for the odd time I’d use it but I can understand why Mozilla decided to remove it.

Re: Stopping FTP support in Firefox 90

#296

Post by kragen »

Anthony-G wrote: post #295
jedberg wrote: post #163

Earlier quoted context omitted.

> but FTP is still a widely used protocol. I cannot for the life of me remember the last time I landed on a page with FTP or had to use FTP in any way. Even lists of file downloads are http pages where I just click on the file.

I use FTP in the browser once in a blue moon. Out of curiosity, I checked my browser history to search for instances of opening FTP URLs in the recent past. I found two: * ftp://ftp.isc.org/isc/ – also available as http://ftp.isc.org/isc/ * ftp://ftp.oreilly.com/pub/ – only available as FTP For the O’Reilly URI, it’s convenient to be able to click on directory links in the browser and then open HTML and PDF files wit…

ftp://ftp.oreilly.com/pub/freebooks/mh/index.htm is an example of an HTML web page served over FTP with relative links. It's worked fine for 25 years (though I bet 25 years ago the URL was only ftp://ftp.ora.com/pub/freebooks/mh/index.htm, which still works) with very little effort on the part of the redoubtable crew at O'Reilly and Associates. Now it's being broken. Intentionally. For no good reason.

Re: Stopping FTP support in Firefox 90

#297

Post by TedDoesntTalk »

duskwuff wrote: post #227
TedDoesntTalk wrote: post #215

Earlier quoted context omitted.

The Apple 2 Asimov repo is FTP and something I use every week.

You mean the one that's available over HTTP(S)? https://www.apple.asimov.net/

Yep that one but I don’t want to use HTTPS

Re: Stopping FTP support in Firefox 90

#298

Post by apostacy »

billyhoffman wrote: post #231
antisol wrote: post #164

Earlier quoted context omitted.

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

> ftp is a relatively simple protocol, not particularly complicated to implement Parts of it are, sure, but parts of it are an absolutely horror show (The client opens a port, and then the server connects back to it!?), text conversion and binary modes that's based on ASCII, different list formats, etc. It's not great. Worse, it doesn't support the good stuff like implicit TLS extensions > Supporting FTP isn't some b…

> It's a cost-benefit analysis. I want Mozilla to do more. If they believe removing FTP support enables them to do more, I'll all for it.

This was the justification for removing RSS support.

And look at what Mozilla has chosen to develop instead.

Re: Stopping FTP support in Firefox 90

#299

Post by apostacy »

antisol wrote: post #164
kragen wrote: post #129

Earlier quoted context omitted.

FTP has been related to web browsing since the beginning of the web 31 years ago. For maybe a decade (the first third of the web so far), most of the WWW was on FTP servers—not just most software downloads, but also most HTML pages. Web browsers are a much better interface to FTP servers than dedicated FTP clients, because you can click a link on an HTML page (either a statically generated directory, possibly on the…

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

> (While I'm talking about browsers and particularly mozilla, I'd just like to take a moment to congratulate them on finally getting their market share down below that of edge. They've been working hard at driving firefox into the ground for a long time now, and I'm sure they must be feeling very proud to have finally achieved this important milestone in their seemingly unending quest to achieve that holy grail of 0 users. So I'd just like to say: Nice work, Mozilla!)

Well said. And the more they fail, the more they double down.

But their decisions go beyond incompetence. They might as well be controlled opposition, actively undermining open web technologies.

They deprecated RSS support with very flimsy justifications, but they make supporting the latest DRM standards a top priority, because they are terrified of losing the blessing of Netflix.

Re: Stopping FTP support in Firefox 90

#300

Post by da_chicken »

apostacy wrote: post #294
dvfjsdhgfv wrote: post #213

Earlier quoted context omitted.

> I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic Well, there is nothing vague here: FTP is a cleartext protocol, and we're migrating towards protocols that provide integrity and encryption. Sometimes I think it's a generational thing. I find it hard to accept this, growing up with testing all protocols with Telnet and so on. But unfortunately the Intern…

This is security hypocrisy. HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. Why does your browser scream at you for connecting to an encrypted but unverified site, such as a self signed certificate on a closed network, but have no warnings at all for an unverified and unencrypted HTTP connection? How do you know the…

> HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP.

This is true, but it ignores the fact that the web has been moving towards depreciation of HTTP in favor of HTTPS.

While FTP is an established standard, FTPS is kind of a nightmare with different and incompatible variants.

Post reply on HN