Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping FTP support in Firefox 90

blog.mozilla.org

Post reply on HN
Print view View original

311–320 of 350 posts

Re: Stopping FTP support in Firefox 90

#311

Post by oblio »

antisol wrote: post #250
billyhoffman wrote: post #231

Earlier quoted context omitted.

> ftp is a relatively simple protocol, not particularly complicated to implement Parts of it are, sure, but parts of it are an absolutely horror show (The client opens a port, and then the server connects back to it!?), text conversion and binary modes that's based on ASCII, different list formats, etc. It's not great. Worse, it doesn't support the good stuff like implicit TLS extensions > Supporting FTP isn't some b…

>It's not great It's simpler than a pdf viewer. >It's a cost-benefit analysis If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost. >I want Mozilla to do more. At this point I'm afraid we're just going to have to agree to disagree. For the last 5+ years, Every time Mozilla "do more", I throw up in my mouth a little.

> If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost.

Every time I clicked a PDF online, I dreaded the external viewer opening (especially Adobe Reader). I very much liked when they integrated a PDF viewer. Chrome also has one.

I'm willing to bet the internal PDF viewer has at least 100x (more likely 1000x) the users the FTP client had.

Re: Stopping FTP support in Firefox 90

#312

Post by raxxorrax »

acabal wrote: post #36

I don't understand all the negativity around this. People complained when Firefox added Pocket, in part because they took a browser extension and made it a feature that was ostensibly unrelated to web browsing. Now they're taking an old feature that's definitely not related to web browsing and removing it, and people are still complaining? Firefox can't be everything. It should focus on being a great browser and not…

FTP is something completely different to Pocket. FTP is a standardized protocol.

Browsers never had decent ftp support, true. They just allow you to list directories and download stuff. But on the other hand, the FTP support doesn't cost anything. Don't know much about Pocket to be honest, but this form of integration is much worse than to support a protocol.

Aside from that, maybe using http for downloads is the better alternative today.

Re: Stopping FTP support in Firefox 90

#313

Post by antisol »

apostacy wrote: post #299
antisol wrote: post #164

Earlier quoted context omitted.

I'd just like to add to this that ftp is a relatively simple protocol, not particularly complicated to implement. It's not a constantly fluctuating standard that requires a team of 50 developers to keep pace with. Supporting FTP isn't some big technical challenge. The code has been there in the firefox codebase for nearly 20 years now, running just fine. All you need to do to continue to support ftp is nothing at all…

> (While I'm talking about browsers and particularly mozilla, I'd just like to take a moment to congratulate them on finally getting their market share down below that of edge. They've been working hard at driving firefox into the ground for a long time now, and I'm sure they must be feeling very proud to have finally achieved this important milestone in their seemingly unending quest to achieve that holy grail of 0…

> They might as well be controlled opposition, actively undermining open web technologies.

Yeah, this pretty much sums it up. A conspiracy minded person might accuse them of all kinds of nasty shenanigans, especially given who their primary finding source is these days.

>They deprecated RSS support with very flimsy justifications, but they make supporting the latest DRM standards a top priority, because they are terrified of losing the blessing of Netflix.

Oh now you're just being cynical. RSS support was like 150 lines of code! A huge attack surface! And it was invented before the year 2000! That makes it useless!

As for DRM, I'm sure that encryption algorithms are much simpler to implement and have less attack surface than an RSS reader, and that Mozilla added this tech for my own good, and that I just don't understand how it's useful to me because I'm a dumb.

Re: Stopping FTP support in Firefox 90

#314

Post by antisol »

fomine3 wrote: post #309
antisol wrote: post #307

Earlier quoted context omitted.

How many in-the-wild attacks did you see using XUL from extensions that were in the curated addons ecosystem, i.e not downloaded and manually installed via extra steps a novice is unlikely to go through?

XUL allows too many modification for browser. It increases attack surface, and it makes hard Firefox developer to modify Firefox's internals to improve things.

you didn't answer my question.

I asked how many times you saw this exploited in the wild, not "how would an attack theoretically work".

Re: Stopping FTP support in Firefox 90

#315

Post by oblio »

phkahler wrote: post #160
TheRealPomax wrote: post #117

Earlier quoted context omitted.

No, they're breaking with accessing a part of the internet that web browsers used to support, an no one does anymore. They are most certainly not break the web itself. These are different things: if you need FTP (and let's be real: you don't), then as a user you still have TONS of options available to you, and as a host even legacy systems using ancient versions of Apache can already serve file listings as standard w…

>> Your web browser doesn't need to support FTP. Your browser doesn't NEED to natively support .pdf but it does and you've probably used that feature. I mean you could have it launch an external .pdf viewer, which is a FAR more complex piece of software than the little FTP protocol code they're disabling here. Your browser doesn't NEED to support TABs. Your OS is already equipped with the ability to run multiple inst…

Q: What do your NEED scenarios have in common?

A: Popularity.

Re: Stopping FTP support in Firefox 90

#316

Post by antisol »

da_chicken wrote: post #300
apostacy wrote: post #294

Earlier quoted context omitted.

This is security hypocrisy. HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. Why does your browser scream at you for connecting to an encrypted but unverified site, such as a self signed certificate on a closed network, but have no warnings at all for an unverified and unencrypted HTTP connection? How do you know the…

> HTTP is a cleartext protocol. Why does your browser quietly navigate to any HTTP site you throw at it? Anonymous FTP isn't any less secure than HTTP. This is true, but it ignores the fact that the web has been moving towards depreciation of HTTP in favor of HTTPS. While FTP is an established standard, FTPS is kind of a nightmare with different and incompatible variants.

No, it doesn't.

The parent explicitly mentions that there are no warnings for a cleartext http connection, but warnings for an encrypted connection to a self-signed certificate.

This is security theatre, not actual security.

Re: Stopping FTP support in Firefox 90

#317

Post by antisol »

fomine3 wrote: post #308
antisol wrote: post #198

Earlier quoted context omitted.

> for a variety of technical reasons Please elaborate. In excruciating detail.

For network protocol perspective, FTP is weird old protocol from current view. Forget Active mode since it's no luck under NAPT. Even in Passive mode, it requires NAT device to rewrite address in command, won't work with firewall closing unknown external port without dynamic filtering by packet inspection, and server configuration isn't simple depends on network configuration. Modern network environment like NAT64/DN…

How is NAT the browser's problem? You're about 10,000 words short of "excruciating", and about half a dozen reasons short of "a variety"

>There are no reason to continue using ancient protocol forever.

You undermine yourself with statements like this. I explicitly asked for excruciating detail. This response essentially sums up to "because I said so".

...and it's empirically incorrect, too: You can find a ton of reasons where people need FTP today if you look through this discussion. So many that I'm not going to bother repeating them here.

Re: Stopping FTP support in Firefox 90

#318

Post by antisol »

fomine3 wrote: post #306
antisol wrote: post #187

Earlier quoted context omitted.

>I can understand the browser vendors wanting to make the code base smaller. That's an excellent point... ...So they'll be removing their builtin pdf viewer first then, right? That's a much much bigger chunk of code than an ftp client. Or are they both scheduled to be removed at the same time? I suppose that would be reasonable.

Mozilla did great decision for security: develop PDF viewer as pdf.js. It works same as other webapps so no longer considered to attack surface, not like integrated PDF viewer, IIUC.

Oh cool! I didn't realise that their entire JS engine was formally verified!

Re: Stopping FTP support in Firefox 90

#319

Post by antisol »

da_chicken wrote: post #301
antisol wrote: post #268

Earlier quoted context omitted.

>I just don't see many use cases for FTP anymore I'm seeing this a lot today. It's almost like people have forgotten what FTP stands for. The use case is transferring files. >Why would you choose FTP at this point over HTTP(S), SFTP, BitTorrent, etc.? Because I don't have a client for any of the others installed

> The use case is transferring files. Yes, and it's not particularly unique or well suited to that task over any other protocol. > Because I don't have a client for any of the others installed Then I guess you can use telnet for FTP as well as web browsing.

who said I have telnet installed?

Re: Stopping FTP support in Firefox 90

#320

Post by antisol »

oblio wrote: post #311
antisol wrote: post #250

Earlier quoted context omitted.

>It's not great It's simpler than a pdf viewer. >It's a cost-benefit analysis If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost. >I want Mozilla to do more. At this point I'm afraid we're just going to have to agree to disagree. For the last 5+ years, Every time Mozilla "do more", I throw up in my mouth a little.

> If it were, they'd have never added a pdf viewer in the first place. Everyone already had one. Near-zero benefit, huge cost. Every time I clicked a PDF online, I dreaded the external viewer opening (especially Adobe Reader). I very much liked when they integrated a PDF viewer. Chrome also has one. I'm willing to bet the internal PDF viewer has at least 100x (more likely 1000x) the users the FTP client had.

Sounds like you had a shitty pdf viewer installed. Which is not my problem.

Why was I forced to install a substandard, feature-poor, ridiculously slow pdf viewer that I never wanted and which took over as the default pdf viewer against my wishes and without asking me, just because you couldn't be bothered to install a decent one?

>I'm willing to bet the internal PDF viewer has at least 100x (more likely 1000x) the users the FTP client had.

Yeah, that tends to happen when you change the defaults without asking.

Post reply on HN