In a complete non-surprise, Mozilla hammers final nail in FTP's coffin by removing it from Firefox
- Reference: 1626864521
- News link: https://www.theregister.co.uk/2021/07/21/firefox_ends_ftp_support/
- Source link:
The company explained yesterday that it will end FTP support in Firefox 90 as part of its drive to a browser that's all HTTPS, all the time.
Mozilla [1]announced its FTP-flaying intentions way back in 2015, and said the change was necessary because the protocol lacked proper encryption. The resulting transfer of files in the clear represented an obvious security issue, as it meant miscreants could easily download, steal and even transmit modified data.
[2]The coming of Wi-Fi 6 does not mean it's time to ditch your cabled LAN. Here's why
[3]The Ultimate Collection of Winsock Software goes offline for good
[4]We're not saying this is how SolarWinds was backdoored, but its FTP password 'leaked on GitHub in plaintext'
[5]We're not saying this is how SolarWinds was backdoored, but its FTP password 'leaked on GitHub in plaintext'
[6]Google's FLoC flies into headwinds as internet ad industry braces for instability
The org's [7]blog post says the protocol was disabled by default with version 88, which launched in April of this year. Users won't have to take any action to further rid themselves of the tech, as any auto-update to version 90 will do it for them.
Edge and Chrome have stopped supporting FTP, although Chrome performed a [8]temporary backtrack in 2020 due to COVID-19 demands.
[9]
FTP sites can be accessed with Internet Explorer. However, Microsoft plans to [10]retire the browser on June 15, 2022.
[11]
Safari never fully supported FTP, choosing instead to hand off OS X FTP calls to the Finder. These days Apple is deprecating FTP from all versions of its OS — even the command-line hasn't supported FTP since OS X 10.13.
An Apple developer looking for FTP download support can still use API NSURLSession, as long as they don't need to upload or use any other FTP operations, or run FTP downloads in the background on iOS. Generally, Apple's advice is " [12]don't use FTP ".
[13]
Users keen for retro file transfers can turn to a dedicated FTP program. The likes of [14]Filezilla are still around, and still being developed — [15]version 1.0.0 rc4 of Filezilla Server emerged just this week.
AWS [16]launched a cloud FTP service called AWS Transfer Family in April 2020. Supporting a dying protocol may seem an odd choice, but there's always someone wanting to stick with legacy systems. ®
Get our [17]Tech Resources
[1] https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/
[2] https://www.theregister.com/2021/07/14/will_i_ever_ditch_my_cabled_lan/
[3] https://www.theregister.com/2021/01/27/tucows_downloads_closes/
[4] https://www.theregister.com/2020/12/16/solarwinds_github_password/
[5] https://www.theregister.com/2020/12/16/solarwinds_github_password/
[6] https://www.theregister.com/2021/04/17/google_floc_adoption/
[7] https://blog.mozilla.org/security/2021/07/20/stopping-ftp-support-in-firefox-90/
[8] https://www.theregister.com/2020/04/15/ftp_chrome_deprecation_on_hold/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YPhEndos60B3AeB2I8gK7QAAAMg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[10] https://www.theregister.com/2021/05/20/internet_explorer_death_day_set/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPhEndos60B3AeB2I8gK7QAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://developer.apple.com/forums/thread/97469
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPhEndos60B3AeB2I8gK7QAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://filezilla-project.org/
[15] https://filezilla-project.org/versions.php?type=server
[16] https://www.theregister.com/2020/04/27/aws_adds_ftp_and_ftps_to_new_transfer_family/
[17] https://whitepapers.theregister.com/
Re: fond ftp memories
FTP is still useful for data that has not real value but without the (S) prefixed most sec bods will go ballistic if they find any FTP clients on the network. God forbid an FTP server or port 21 is found to still be open, "Nail 'em up!" the cry is heard!
Re: fond ftp memories
No better protocol for ISO images.
They have removed FTP before they implemented an SCP or SFTP replacement?
Should this not be logged as a bug report?
For my own software, I tend to implement replacements *before* I remove obsolete features. Does this not make sense to everyone?
scp and sftp are available on Windows.
https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement
Alternatively, install Windows Subsystem for Linux and install your favourite linux distro on it.
Debian and Ubuntu seem to be the most reliable on Windows from my testing. Of those, I prefer Debian.
Be honest; did you actually use FTP in a web browser?
Web browser clients only offered the ability to download; for uploading even windows explorer was a better solution than offered by any of the web browsers.
Which is a moot point, given that everybody used Filezilla for FTP sites because it was the best tool for the job.
The classic one that I used from browser was ftp.idsoftware.com
It was a good experience. Being able to download from a plain list of files without Javascript, adverts and other nonsense.
Using FTP in a browser
Yes, I absolutely still do, or at least I did until Fx 90 landed. (In fact, I pref'd it back on in Firefox 88 and 89.) Adobe in particular still maintains an FTP site with patches and other updates for software new and old. HP's FTP site is also still running, and quite handy for products they have "forgotten" about, or at least it is when they haven't helpfully purged the files from there as well.
It won't be as convenient to use a standalone FTP program for quick downloads like this.
*Did* I? Yes, countless times over the years where firing up a full-fat FTP client would have been overkill.
*Do* I still? On occasion, when dealing with firmware/driver updates for certain bits of hardware where the manufacturer hasn't felt the need to spend/waste any time on providing a HTML front end to their download folder, and just points you in the direction of the relevant location on their FTP site instead...
Personal opinion
I use scp and sftp when I want a secure file transfer. Using those protocols through a browser defeats the purpose. Likewise normal ftp is a sufficient security disaster that I would only consider it on an air-gapped network. Putting a cloud in the middle is as daft as requiring javascript for internet banking.
https is the replacement. At least as far as browsers go. Can't remember the last time I fired up a pure ftp session simply to download something. For the rest, Mozilla did go into considerable detail when they made the announcement.
Winscp is your friend
https://winscp.net/eng/download.php
Re: Winscp is your friend
Yes, I greatly prefer winscp to filezilla.
Ah, the joys of the mid90s, finding ftp sites full of mp3s.
Re: Winscp is your friend
That WinSCP library has been so useful, lock it into PowerShell scripts and you have some very usable and flexible features for automating stuff.
The guy who develops WinSCP is one of the true unsung heroes of modern IT!
Root cause.
One might be driven to ask WTF it was doing in a bloody browser in the first place!
Oh yes: "Oooo. Lusers lurve this tool. I know, we'll build it into our browser and they'll use that rather than XYZ browser, 'cos they're lazy bastards who hate using the right tool for the job if it takes an extra two seconds.".
See also: Adjustable spanner / swiss army knife.
References: Bloatware. Attack surface.
Re: Root cause.
Yes because browsing a site then clicking a link is such a luser (how old are you?) thing to do. It is so stupid compared to browsing the site, right clicking and copying the link to get the address, opening up ftp client, setting all the required permissions and then downloading.
How's the crank handle on your car?
Re: Root cause.
The crank handle on my ftp client could get shell globs, recursively fetch directories and continue a download that had been interrupted. Some of these features may be available on modern vehicles with built in starter motors but I am sure the user interface changes with the moon. For anything non-trivial I still use wget or curl.
Don't be too proud of this technological terror that has been created for you. You can still suffer the death of a thousand mouse clicks.
Re: Root cause.
[1]Zawinski's Law
Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can.
More seriously, in the case of Firefox it came from Netscape, which was an "Internet suite" that included email, FTP, browsing, even support for Gopher. It was an era when ISPs used to give people email and free web-hosting with their internet.
It was useful back then.
Zawinski also said (in 1998!):
We're at the beginning of an industry, and this could all turn into television again. It could be controlled by a small number of companies who decide what we see and hear. And there's a lot of precedent for that.
Probably not a difficult prediction, but accurate nonetheless. Though if he'd tried to pick winners, he'd have got it wrong because at least two of them didn't exist yet.
[1] https://en.wikipedia.org/wiki/Jamie_Zawinski#Notable_Quotes
Not used FTP for well over a decade, mostly due to securiuty concerns. I tend to use winscp - usually over a VPN as well (depending on what I've transferring and to where).
but there's always someone wanting to stick with legacy systems.
When you have some older machines running in their own little world, a simple protocol like FTP is useful for shifting files around.
Re: but there's always someone wanting to stick with legacy systems.
I think that Kermit was better - I used it all the time about 40 years ago. The nice thing about Kermit and FTP was that they made it easy to move files between different operating environments.
Re: but there's always someone wanting to stick with legacy systems.
Then SFTP would be the alternative, especially since Secure Shell is now the preferred remote login method, and SFTP uses Secure Shell as the wrapper. Meaning if you ssh onto your server, then you should be able to sftp onto it just as easily.
Cleanliness is next to godliness
I can appreciate removing FTP from what is essentially an HTTPS client. Let's do one thing and do it well.
But I know at least one book publishing site which limits large HTTPS uploads and requires that your 1,000 page illustrated wannabee blockbuster be uploaded via FTP/SFTP. And there are all those other places where a robust connection is more important than speed.
Long live SFTP.
Still using plain-vanilla FTP for telemetry.
Will have to upgrade it to SFTP eventually.
Firefox was not quite the last bastion to support ftp: Konqueror still does. (Just tried it in Kubuntu 20.04.)
FTP and Firefox
I had to grit my teeth yesterday when I was forced to use M$ Internet Explorer to access an ftp site after Firefox refused.
fond ftp memories
In the early 90s, I worked at Data General. We engineers had just received Sun workstations, to use for schematic capture. No instruction, just dropped on our desks. We felt our way around SunOS, and discovered all the Unix tools, including nntp and ftp...and, for me, comp.os.minix. Because Unix was so much neater than Windows 3.1.
I spent a good bit of time downloading Linux floppy images of tsx-11.mit.edu and decwrl.dec.com. ftp was the way you did that sort of thing, pre-web. It was also how you got things like image and waveform manipulation tools, which you ftp'd off the author's host and compiled for your machine. No packages back then, and "open source" wasn't really a term people used. They just put the code up on their machines and you ftp'd it.
I used ftp recently to deliver design files to my PCB layout contractor. Still available on the Win10 command line...for that [almost] old-timey Unix feel...