Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping FTP support in Firefox 90

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 350 posts

Re: Stopping FTP support in Firefox 90

#81

Post by TonyTrapp »

wila wrote: post #66

>> To date, many malware distribution campaigns launch their attacks by compromising FTP servers Yes.. well, they can do the same by compromising servers that offer the payload via HTTP(S). At least when the payload is ftp, it stands out and you can catch it in your gateway/firewall devices. With https you now need https inspection at the border in order to be able to do that. These MITM devices do tend to cause a lo…

This argument reminds me of how Google refuses to show the server-provided login prompt when doing HTTP basic auth in Chrome (and as a consequence, browsers deriving from it). Some developer argued that someone could MITM the connection and make the basic auth login prompt say "please enter your YouTube credentials" or something like that. Yeah right, if you can MITM the connection, you could just as well inject a much more realistic Google login page. Basic auth really wasn't the actual problem at hand.

Re: Stopping FTP support in Firefox 90

#82

Post by [deleted] »

frettchen wrote: post #18
Nicksil wrote: post #2

>If you are a Firefox user, you don’t have to do anything to benefit from this security advancement. The epitome of corporate speak: "we're taking away a feature of this software. You're welcome." I expect that kind of talk from Google; hearing it from Mozilla makes me a little sad.

I think what really hurts, for me, is that this has become the general tone from Mozilla - whether the changes are ones I'd agree with or not. I remember back when the Spread Firefox campaign was still around - at the time, Firefox and Mozilla in general felt grassroots, fun, and human. Like a club anyone could join and that anyone would want their friends, family, coworkers, and even strangers or people they didn't…

[deleted]

Re: Stopping FTP support in Firefox 90

#83

Post by jacquesm »

_e wrote: post #69
alisonkisk wrote: post #44

Earlier quoted context omitted.

FTP is Internet browsing, it's just not not "web".

Yes, good point. Gopher is internet browsing too but is Firefox the best way to experience FTP and Gopher? How many different protocols should Firefox support? Firefox does not have the same resources as Google so focusing on what Firefox is known to do best such as HTTP and its supporting protocols, like WebSocket, really well looks like a good strategy.

On many systems it is now the only way.

Re: Stopping FTP support in Firefox 90

#84

Post by wolpoli »

Nicksil wrote: post #2

>If you are a Firefox user, you don’t have to do anything to benefit from this security advancement. The epitome of corporate speak: "we're taking away a feature of this software. You're welcome." I expect that kind of talk from Google; hearing it from Mozilla makes me a little sad.

I am fine if Mozilla explains that FTP usage is now very low, based on telemetry and that there are FTP clients available for users.

However, there is no need to characterizes FTP being dangerous by jumping from FTP is old and is in plaintext, to FTP servers are being exploited and used to distribute malware, to FUD-type statement implying that there are [unspecified] exploits now available to attack Firefox if FTP was enabled.

This is just plain disgusting and it leaves a bad taste in my mouth.

Re: Stopping FTP support in Firefox 90

#87

Post by nashashmi »

acabal wrote: post #36

I don't understand all the negativity around this. People complained when Firefox added Pocket, in part because they took a browser extension and made it a feature that was ostensibly unrelated to web browsing. Now they're taking an old feature that's definitely not related to web browsing and removing it, and people are still complaining? Firefox can't be everything. It should focus on being a great browser and not…

Understand this: ftp has been with the browser for 25 years. Ftp has been with the web. Ftp is part of the web. No one cares that ftp is not really what browsers are made for. Browsers is how people access ftp. That’s it. And they have been used in of web pages too.

Re: Stopping FTP support in Firefox 90

#88

Post by Jach »

r00fus wrote: post #62
amelius wrote: post #29

Earlier quoted context omitted.

Perhaps one day we can have a programming language that allows us to write software that doesn't rot or corrode.

As long as code connects to other code, it will need to be updated whenever the other code is updated. Maintenance-free code is a chimera.

Maintenance-free code exists. I'm sorry you haven't experienced work at an org that has 10+ year old code which hasn't changed at all, easily verified by source control. (Has Mozilla published something anywhere about exactly how much work it is to keep FTP support around?) And while not technically 100% free, something closely related that's basically free is lots of 10+ year old code which does need to change sometimes but only as part of a batch of the same change in many places, and that's basically free because it's done automatically by tooling.

Re: Stopping FTP support in Firefox 90

#89

Post by daxuak »

mmastrac wrote: post #60
daxuak wrote: post #51

FTP might be dying in other sectors, but at least in biomed research, I would use FTP anyday when the alternative protocol needs a client app and a bunch of configurations. It's also handy when sharing data. Browser support is important here because those files are often not explored from command line etc, but rather the FTP links are placed on individual pages as a quick download. At least for me, it's much more con…

Why not rsync, scp, https, or any other plethora of much better alternatives?

Maybe I should've put it this way: ff (sometimes?) won't force ftp to use https, had to manually correct it if the url happens to start with ftp://ftp.*. And outside of NCBI, when occasionally sharing >10GB data, ftp (because of inertia) has been handy than the more proper ways and could have no https support.

Re: Stopping FTP support in Firefox 90

#90

Post by tyingq »

johnebgd wrote: post #78
tyingq wrote: post #73

Earlier quoted context omitted.

It's old, but "ftp://" is a valid uri scheme that has established use, and lots of valid links on existing, live web pages. Browsers removing support are breaking part of the web that was working fine.

Agreed. There are old drivers from established vendors that only send drivers over FTP links. It's an edge case these days though as more are moving to https:// links so I can understand the browser vendors wanting to make the code base smaller. They have enough to do. Especially for Mozilla given what they charge for us to use their product.

Maybe nice if they (Mozilla and/or Google) would make a site somewhat like https://webftp.dreamhost.com/ that would accept url parameters to sort of proxy ftp requests.

Wouldn't help for internal network ftp servers, but would ease the publicly accessible part.

(Note that the dreamhost site has a little link icon in the lower left that will generate a link/landing page with all the important bits filled out.)

Post reply on HN