Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping FTP support in Firefox 90

blog.mozilla.org

Post reply on HN
Print view View original

301–310 of 350 posts

Re: Stopping FTP support in Firefox 90

#301

Post by da_chicken »

antisol wrote: post #268
da_chicken wrote: post #226

Earlier quoted context omitted.

> So your argument is that because you haven't used it lately, nobody does? I mean, it's opposed by the argument that it used to be popular. It's a pretty low bar. FTP is a protocol that dates to when NCP was the protocol suite that ran the Internet. It was retrofitted to TCP/IP. That's why there's a command session and a data session. The protocol is so old that it dates to a time when IP+port was the unique identif…

>I just don't see many use cases for FTP anymore I'm seeing this a lot today. It's almost like people have forgotten what FTP stands for. The use case is transferring files. >Why would you choose FTP at this point over HTTP(S), SFTP, BitTorrent, etc.? Because I don't have a client for any of the others installed

> The use case is transferring files.

Yes, and it's not particularly unique or well suited to that task over any other protocol.

> Because I don't have a client for any of the others installed

Then I guess you can use telnet for FTP as well as web browsing.

Re: Stopping FTP support in Firefox 90

#302

Post by da_chicken »

desktopninja wrote: post #114
handrous wrote: post #21

Earlier quoted context omitted.

ftps exists. The solution to http wasn't getting rid of it, it was pushing for more https. I'm not saying there weren't good reasons to get rid of ftp support, but that doesn't seem like one.

Surprising how many people don't know about ftps. FTP with SSL.

It's because there's multiple versions which are fundamentally incompatible.

Re: Stopping FTP support in Firefox 90

#303

Post by da_chicken »

RicoElectrico wrote: post #68

Lots of places like US federal institutions or universities use FTP to this day to distribute their open datasetes. Show me an example of actual FTP MITM hack in the wild. Sure loading FTP resources from HTTP(S) context is not a good idea (as would be downloading executables over FTP), but did they actually make any effort to inform the public and owners of FTP servers? I do not think so, I haven't seen it. Mozilla t…

> Lots of places like US federal institutions or universities use FTP to this day to distribute their open datasetes.

Then they can use an FTP client which will perform better anyways. This is Mozilla removing it from their web browser, not L3 black holing port 21 traffic.

Why do you need to use a web browser?

Re: Stopping FTP support in Firefox 90

#304

Post by da_chicken »

handrous wrote: post #126
gruez wrote: post #54

Earlier quoted context omitted.

> This is frustrating. FTP is really handy for distributing some files and there are lots of servers in place that now Firefox users can’t access. Why are people still using ftp rather than http?

For one thing, you can't manage files over the same protocol you use to serve them, with HTTP, without extra application-layer add-ons (WebDAV or custom web file management junk) FTP can both serve and manage, all over one protocol. "But why wouldn't you use some other method to manage your files? Why combine the two?" I dunno, but WordPress is basically that (managing your blog's/site's appearance, content, and serv…

And why can't you just use a dedicated FTP client?

Re: Stopping FTP support in Firefox 90

#305

Post by fomine3 »

antisol wrote: post #164
kragen wrote: post #129

Earlier quoted context omitted.

FTP has been related to web browsing since the beginning of the web 31 years ago. For maybe a decade (the first third of the web so far), most of the WWW was on FTP servers—not just most software downloads, but also most HTML pages. Web browsers are a much better interface to FTP servers than dedicated FTP clients, because you can click a link on an HTML page (either a statically generated directory, possibly on the…

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

I can agree that FTP isn't much a attack vector, but definitely against for XUL.

Re: Stopping FTP support in Firefox 90

#306

Post by fomine3 »

antisol wrote: post #187
johnebgd wrote: post #78

Earlier quoted context omitted.

Agreed. There are old drivers from established vendors that only send drivers over FTP links. It's an edge case these days though as more are moving to https:// links so I can understand the browser vendors wanting to make the code base smaller. They have enough to do. Especially for Mozilla given what they charge for us to use their product.

>I can understand the browser vendors wanting to make the code base smaller. That's an excellent point... ...So they'll be removing their builtin pdf viewer first then, right? That's a much much bigger chunk of code than an ftp client. Or are they both scheduled to be removed at the same time? I suppose that would be reasonable.

Mozilla did great decision for security: develop PDF viewer as pdf.js. It works same as other webapps so no longer considered to attack surface, not like integrated PDF viewer, IIUC.

Re: Stopping FTP support in Firefox 90

#307

Post by antisol »

fomine3 wrote: post #305
antisol wrote: post #164

Earlier quoted context omitted.

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

I can agree that FTP isn't much a attack vector, but definitely against for XUL.

How many in-the-wild attacks did you see using XUL from extensions that were in the curated addons ecosystem, i.e not downloaded and manually installed via extra steps a novice is unlikely to go through?

Re: Stopping FTP support in Firefox 90

#308

Post by fomine3 »

antisol wrote: post #198
jeppesen-io wrote: post #125

Earlier quoted context omitted.

I agree. Creating some friction to encourage the move away from FTP is the right thing to do, for a variety of technical reasons There are times when HN seems to become very negative to a particular topic. In the past I’ve seen it with Kubernetes, systemd or GCP/AWS. I feel it’s that way with Mozilla/Firefox. More often than not, comments on Mozilla/Firefox are very negative then create a feedback loop of negativity.…

> for a variety of technical reasons Please elaborate. In excruciating detail.

For network protocol perspective, FTP is weird old protocol from current view. Forget Active mode since it's no luck under NAPT. Even in Passive mode, it requires NAT device to rewrite address in command, won't work with firewall closing unknown external port without dynamic filtering by packet inspection, and server configuration isn't simple depends on network configuration. Modern network environment like NAT64/DNS64 need special support for FTP. There are no reason to continue using ancient protocol forever.

Re: Stopping FTP support in Firefox 90

#309

Post by fomine3 »

antisol wrote: post #307
fomine3 wrote: post #305

Earlier quoted context omitted.

I can agree that FTP isn't much a attack vector, but definitely against for XUL.

How many in-the-wild attacks did you see using XUL from extensions that were in the curated addons ecosystem, i.e not downloaded and manually installed via extra steps a novice is unlikely to go through?

XUL allows too many modification for browser. It increases attack surface, and it makes hard Firefox developer to modify Firefox's internals to improve things.

Re: Stopping FTP support in Firefox 90

#310

Post by dvfjsdhgfv »

apostacy wrote: post #294
dvfjsdhgfv wrote: post #213

Earlier quoted context omitted.

> I also find the incredibly vague and nonspecific "but security!" scaremongering language to be quite hyperbolic Well, there is nothing vague here: FTP is a cleartext protocol, and we're migrating towards protocols that provide integrity and encryption. Sometimes I think it's a generational thing. I find it hard to accept this, growing up with testing all protocols with Telnet and so on. But unfortunately the Intern…

This is security hypocrisy. HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. Why does your browser scream at you for connecting to an encrypted but unverified site, such as a self signed certificate on a closed network, but have no warnings at all for an unverified and unencrypted HTTP connection? How do you know the…

> When there is inconstancy like this, it usually implies there is something else going on that we aren't seeing. I have a feeling that companies like Google and Apple have an agenda to move people away from having too much outside of their influence.

I think it's both. For one thing, I think they genuinely do care about security, because any high-profile incident involving their products is a cause of embarrassment for them. At the same time, I have a feeling they would prefer people not inspect the traffic moving in and out of their apps, for example.

Post reply on HN