Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

FTP support is still a big attack surface for the client that has to be managed, regardless of wire security.

But my gut reaction to reading this concern is actually: why do you think this is “bullying” and not “opening the door for a niche competitor”?



Because a 'niche competitor' is not really a competitor and would be invisible to almost everyone. And because sich a competitor would require extra work to use, so it would be unpopular.


What big attack surface? The client? FTP is an ugly/stupid protocol, but it's not really complex (I suspect it's far simpler than HTTP).


FTP has some pretty serious quirks. Active-mode FTP is probably the craziest one by modern standards -- the client opens a port and asks the server to connect to it to send a file. Needless to say, this is effectively unusable on the modern Internet. Its replacement, passive-mode FTP, has the server open a port instead; this configuration is merely incompatible with most load balancers.


Active ftp is dead. I wouldn't be surprised if browsers don't support it out at least don't default to it since as you said it would break things for 99% of users. Running a server that's not configured properly for passive transfers is effectively a server that's useless. So if it would make someone sleep better at night I'd be fine with removing active transfer support from browser clients. Switch to filezilla if you're a power user or want to do some 1337 FXP tricks.


It's not much different than old versions of TLS.


In ftp, the ftp server is designed to act as the load balancer. (Just have the firewall point each port to a different IP.)

Also, this enables linear scale out, since not all ftp data nodes (not sure what the correct term was) need to store all of the data that’s being served, and you can store multiple copies of each file.

Come to think of it, I’m not sure why HDFS exists, given that you can just use a ftp server cluster for the same effect.


Oh, absolutely! I said it was ugly/stupid from personal experience:) But it's a form of stupid that can be condensed into a single state diagram that would fit on half a sheet of paper, so I'm not super concerned about it.


I'm surprised the article claims there are still bugs, because one would think (hope) that a protocol over 30 years old with an implementation over a decade old should've received its last bugfix long ago and become truly stable by now.


What? Like OpenSSL:

https://en.wikipedia.org/wiki/Heartbleed

(I mean, I'm not overjoyed at the deprecation of FTP support because I used it just yesterday, but let's at least be honest here. The protocol might be decades old but the implementations aren't necessarily, and if they're being actively maintained there's always the possibility of introducing new bugs.)


It was introduced into the software in 2012

That's not the "stable protocol that's been around for decades" situation that FTP is in.


> That's not the "stable protocol that's been around for decades" situation that FTP is in.

That is literally the point I was making when I said, "if they're being actively maintained there's always the possibility of introducing new bugs."

Moreover, just because a library had its last fix a decade (or whatever) ago is no guarantee that unfixed bugs do not lie undiscovered in it.


The protocol is buggy AF. All that crap about sending data over a separate TCP connection, the weird way you have to deal with state and authentication; ftp is an utter shitshow. Just because a protocol is old doesn't mean it's matured to perfection. Telnet is old, so is RCS, and UUCP.

Many protocols evolve not by being replaced by incrementally better point releases, but rather by being supplanted entirely by a better designed alternative.

FTP effectively evolved into HTTP for this use case, and scp/sftp for the authenticated file transfer use case.


Can you give an example of a piece of software of reasonable complexity (network/file handling, etc) that has solidified like this?


TeX


Everything in the openbsd base image.


qmail


Sqlite


The other ones I might give a pass to as I can't find where the update history lives, but this is untrue - https://www.sqlite.org/changes.html


Are you referring to this bit:

and there are other bugs in the implementation which further demotivates the FTP support.

To me that reads as there are bugs in Chrome's implementation of FTP.

Did you take that to mean the author intended to convey the message that the FTP protocol has bugs?


FTP can be implemented in such away that it exposes no more potential for attack than html/http.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: