News for hackers. Stuff that matters.
Re:Shutting down public FTP services by mschuster91 on Tuesday April 25, 2017 @06:25PM (#14198699)
> The web is gradually consuming all that came before it.

It's about cost, too. HTTP can be cached very efficiently, but FTP not at all. If I were the operator in charge and I had the choice between next-to-free caching by nearly anything, be it a Squid proxy, apt-cache or nexus, or no caching and having to maintain expensive servers, I'd choose HTTP.

Re:Shutting down public FTP services by astrodust on Tuesday April 25, 2017 @06:39PM (#14198818)
Exactly. You can offload HTTP to anyone, an HTTP proxy is absolutely trivial to set up, and an HTTP cache is even easier.

FTP is not nearly as trivial, plus it's a stupid, broken protocol that deserves to die. The whole thing is a giant bag of hurt.

Re:Shutting down public FTP services by mschuster91 on Tuesday April 25, 2017 @06:43PM (#14198863)
> FTP is not nearly as trivial, plus it's a stupid, broken protocol that deserves to die.

I agree with you, but FTP has one very valid use case left: easy file sharing, especially for shared hosting. FTP clients are native to every popular OS, from Android to Windows (only exceptions I know are Win Mobile and iOS), and there's a lot of ecosystem built around FTP.

There is SCP and SFTP but they don't really have any kind of widespread usage in the non-professional world.

Re:Shutting down public FTP services by astrodust on Tuesday April 25, 2017 @06:50PM (#14198909)
> [Has] one very valid use case left: easy file sharing, especially for shared hosting.

Nope. Nope. Nope. Not easy. Not secure. Not user friendly. Not anything good. Have an iPhone and need to FTP something? Don't have installation rights on your Windows workstation and need to FTP something? Unpleasant if not confusing as all hell.

Dropbox or a Dropbox-like program is significantly easier to get people on board with.

Any "ecosystem" built around FTP is rotten to the core. Blow it up and get rid of it as soon as you can.

Some vendors insist on using FTP because reasons, but those reasons are always laziness. I can't be the only one that would prefer they use ssh/scp/rsync with actual keys so I can be certain the entity uploading a file is actually them and not some random dude who sniffed the plain-text password off the wire.

Re:Shutting down public FTP services by Spooky23 on Tuesday April 25, 2017 @07:00PM (#14198986)
Huh?

Windows explorer has FTP built into the shell. As does every other desktop OS.

If you care about file integrity, you want to out of band to verify the signatures on the binary anyway.

Dropbox is blocked in most commercial networks and offers no assurance of anything.

Re:Shutting down public FTP services by astrodust on Tuesday April 25, 2017 @07:23PM (#14199145)
Yes, I'm sure walking your accounting department through how to use the command-line FTP tool in Windows is going to work out fantastically well.

Versus drag and drop file to this page. There you go. It's uploading.

That's why I said Dropbox or a Dropbox-like service, of which there are hundreds. Microsoft SharePoint is but one example.

Re:Shutting down public FTP services by sp332 on Tuesday April 25, 2017 @07:36PM (#14199241)
Not that shell. The UI shell. Explorer. You can browse FTP sites just like network file systems, including drag and drop.
Re:Shutting down public FTP services by Spooky23 on Tuesday April 25, 2017 @07:39PM (#14199256)
Go to Start->Run.

Type ftp://ftp-site/path/to/file. Drag and drop to your hearts content.

Re:Shutting down public FTP services by JBReefer on Tuesday April 25, 2017 @08:15PM (#14199444)
When I worked ftp (with accounting departments ironically), the advice was not to do that because the client often corrupted files.
Re:Shutting down public FTP services by derefr on Tuesday April 25, 2017 @07:12PM (#14199069)
The protocol you want is SMB.

Windows has first-class support (obviously); but Samba gives Linux and BSD support that, in modern Desktop Environments, is exactly as good. Mobile devices don't tend to have OS-level support for it, but there are very good libraries to enable individual apps to speak the protocols (look at VLC's mobile apps.)

Even Apple has given up on their own file-sharing protocol (AFP) in favor of macOS machines just speaking SMB to one-another.

Yes, it's not workable over the public Internet. Neither is FTP, any more. If you've got a server somewhere far away, and want all your devices to put files on it, you're presumably versed with configuring servers, so go ahead and set up a WebDAV server on that box. Everything speaks that.

Re:Shutting down public FTP services by mschuster91 on Wednesday April 26, 2017 @03:18AM (#14201091)
> The protocol you want is SMB.

Uh, hell no. Never ever I'd expose a SMB server to the Internet. SMB is really picky when the link has packet loss or latency issues, plus the countless SMB-based security issues.

> Even Apple has given up on their own file-sharing protocol (AFP) in favor of macOS machines just speaking SMB to one-another.

TimeMachine still depends on AFP.

Re:Shutting down public FTP services by 4ad on Wednesday April 26, 2017 @07:38AM (#14202165)
> TimeMachine still depends on AFP.

No, it doesn't:

https://developer.apple.com/library/content/releasenotes/Net...

Re:Shutting down public FTP services by voltagex_ on Tuesday April 25, 2017 @08:07PM (#14199405)
Is there a way to tune SMB to work better over low bandwidth / high latency links? The last time I tried it through a VPN it was working at less than 10kb/s
Re:Shutting down public FTP services by sk5t on Tuesday April 25, 2017 @11:57PM (#14200329)
AFAIK no, other than increasing frame size, CIFS is more or less an inverse latency gauge.

I wonder if GP is pulling our legs about WebDAV. Yuck.

Re:Shutting down public FTP services by astrodust on Tuesday April 25, 2017 @07:24PM (#14199150)
> Mobile devices don't tend to have OS-level support for it...

Yeah, nope. Dead out of the gate. Thanks for playing.

Re:Shutting down public FTP services by derefr on Tuesday April 25, 2017 @07:27PM (#14199169)
Mobile devices don't tend to have OS-level support for anything, though.

The GP comment:

> FTP clients are native to every popular OS, from Android to Windows (only exceptions I know are Win Mobile and iOS)

To rephrase: only 1/3 of mobile OSes support FTP.

Re:Shutting down public FTP services by astrodust on Tuesday April 25, 2017 @07:34PM (#14199219)
Anything web-based works fine on the phone. FTP and SMB do not.

Not working on iOS is like saying "Oh, this road doesn't work with German made cars. That's not a big deal, is it?"

Re:Shutting down public FTP services by derefr on Tuesday April 25, 2017 @07:40PM (#14199263)
But we're talking about picking a thing to replace FTP for the use-cases people were already using FTP for. It doesn't matter if it doesn't do something FTP already doesn't do, because presumably you were already not relying on that thing getting done.
Re:Shutting down public FTP services by astrodust on Wednesday April 26, 2017 @12:13AM (#14200383)
FTP is used to exchange files, a task that HTTP/HTTPS and/or email and/or IM and/or XMPP and/or Skype and/or Slack and/or a hundred other services can do just as well if not better.
Re:Shutting down public FTP services by kevin_thibedeau on Tuesday April 25, 2017 @08:06PM (#14199391)
More like German made cars have been artificially limited so they can't use certain roads.
Re:Shutting down public FTP services by comex on Tuesday April 25, 2017 @11:38PM (#14200253)
...But it does work on iOS. It's just not built in. For example, Transmit for iOS supports FTP, and includes a document provider extension so you can directly access files on FTP servers from any app that uses the standard document picker.

https://panic.com/transmit-ios/

Searching the App Store I also see some apps for SMB, but I don't know whether they have document provider extensions.

Re:Shutting down public FTP services by astrodust on Wednesday April 26, 2017 @12:19AM (#14200402)
You can also send faxes from iOS. What's your point?
Re:Shutting down public FTP services by comex on Wednesday April 26, 2017 @12:57AM (#14200533)
The post I replied to implies that iOS is (somehow) "artificially limited" to be unable to access FTP - or at least I interpreted it that way.

FWIW, I'm not convinced that "web-based" is a better alternative for read/write file access, assuming you mean file manager webapps. No OS can integrate those into the native file picker, so you can't avoid the inefficiency of manually uploading files after changing them. WebDAV works pretty well though, if that counts...

Re:Shutting down public FTP services by astrodust on Wednesday April 26, 2017 @12:19AM (#14200401)
It's just needlessly exclusionary. One of the greatest things about "the web" is it's pretty accessible by anyone with a browser that's at least semi-mostly-standards-compliant.
Re:Shutting down public FTP services by ReverseCold on Tuesday April 25, 2017 @09:04PM (#14199687)
No one uses Windows mobile, that comment was hardly fair. Pretty sure Android is 80%+ share.
Re:Shutting down public FTP services by kalmari on Wednesday April 26, 2017 @03:15AM (#14201076)
even mobile windows/ios/android have ftp and variants support via software but not native.
Re:Shutting down public FTP services by Qantourisc on Wednesday April 26, 2017 @02:45AM (#14200967)
Why is the protocol broken ? Is there something that doesn't work ? Perhaps you mean to say complicated protocol ill-fit for modern times ?
Re:Shutting down public FTP services by terryf on Wednesday April 26, 2017 @04:08AM (#14201313)
Have you looked at the spec? If you do, then you'll understand.

Imagine a file transfer protocol that defines the command to list files in a folder, but does not specify the format of the response other that it should be human-readable.

https://www.ietf.org/rfc/rfc959.txt LIST and NLST commands for example. No way to get a standard list of files with sizes and modification dates. yay!

Oh, and the data connection that is made from the server to the client. That works wonders with firewalls of today.

It was an ok spec when it was invented, but today it's very painful to operate.

Re:Shutting down public FTP services by pikzen on Wednesday April 26, 2017 @07:48AM (#14202197)
Re:Shutting down public FTP services by mato on Tuesday April 25, 2017 @06:43PM (#14198850)
> It's about cost, too. HTTP can be cached very efficiently, but FTP not at all.

It's ironic that you mention cost and caching but lot of services used for software distribution of one kind of another (e.g. Github releases) are following the "HTTPS everywhere" mantra and HTTPS can't be cached anywhere other than at the client.

Re:Shutting down public FTP services by mschuster91 on Wednesday April 26, 2017 @03:16AM (#14201082)
> and HTTPS can't be cached anywhere other than at the client.

No. Nexus for example can certainly cache apt, as well as Squid can do if you provision it with a certificate that's trusted by the client.

Also, Cloudflare supports HTTPS caching if you supply them with the certificate, and if you pay them enough and host some special server that handles the initial crypto handshake you don't even have to hand over your cert/privkey to them (e.g. required by law for banks, healthcare stuff etc)

Re:Shutting down public FTP services by mato on Wednesday April 26, 2017 @06:49AM (#14201991)
To clarify; what I meant is that HTTPS can't be cached by third parties. If I want to run a local cache of anything served over HTTP it's as easy as spinning up a Squid instance. With resources served over HTTPS I can't do that.
Re:Shutting down public FTP services by calpaterson on Tuesday April 25, 2017 @06:53PM (#14198936)
Github probably trust their CDN with their TLS key.

For Debian, packages are secured by PGP in combination with checksums so it's not relevant for them. The debian repos are often HTTP only.

Re:Shutting down public FTP services by agumonkey on Tuesday April 25, 2017 @06:34PM (#14198774)
What we need if FTP over HTTP.
Re:Shutting down public FTP services by mschuster91 on Tuesday April 25, 2017 @06:39PM (#14198815)
Well, there is WebDAV. At least Windows and OS X support it (Windows from Explorer, OS X from Finder), no idea about mainstream Linux/Android/iOS support though. Also, no idea if WebDAV can deal with Unix or Windows permissions, but I did not have that problem when I set up a WebDAV server a year ago.

IIRC WebDAV uses GET for retrieval, so the read parts can be cached by an intermediate proxy and the write part be relayed to the server.

Re:Shutting down public FTP services by donatj on Tuesday April 25, 2017 @06:49PM (#14198902)
As someone who once tried to write a WebDAV server I cannot with good convince recommend it. It's Bizarre extended HTTP protocol that should not exist.
Re:Shutting down public FTP services by mschuster91 on Tuesday April 25, 2017 @06:52PM (#14198928)
Out of curiosity: why did you try to write your own WebDAV server? Apache ships a pretty much works-OOTB implementation - the only thing I never managed to get working was to assign uploaded files the UID/GID of the user who authenticated via HTTP auth to an LDAP server.
Re:Shutting down public FTP services by donatj on Tuesday April 25, 2017 @07:23PM (#14199137)
More specifically a CalDAV server which is a bizarre extension of WebDAV that shouldn't exist. We wanted one to connect to our internal identity server. That project was abandoned.
Re:Shutting down public FTP services by carussell on Tuesday April 25, 2017 @07:46PM (#14199305)
Related: "I Hope WebDAV Dies"[1]

1. https://news.ycombinator.com/item?id=10213657

Re:Shutting down public FTP services by eikenberry on Tuesday April 25, 2017 @07:35PM (#14199226)
Linux has great webdav support with the fuse filesystem, davfs. I used it with my box.net account and it worked fine.

http://savannah.nongnu.org/projects/davfs2

Re:Shutting down public FTP services by astrodust on Tuesday April 25, 2017 @06:37PM (#14198802)
What about Gopher? Will nobody think of Gopher?
Re:Shutting down public FTP services by badsectoracula on Tuesday April 25, 2017 @06:57PM (#14198966)
Actually i thought about Gopher (i even have my own client - http://runtimeterror.com/tools/gopher/ - although it only does text) since it basically behaves as FTP++ with abstract names (sadly most modern gopherholes treat it as hypertext lite by abusing the information nodes).

Gopher generally avoids most of FTP's pitfalls and it is dead easy to implement.

Re:Shutting down public FTP services by dmoreno on Wednesday April 26, 2017 @10:13AM (#14203094)
As a side note, there was a nice podcast about Gopher a few days ago at Techstuff [1]

[1] http://shows.howstuffworks.com/techstuff/what-was-gopher.htm

Re:Shutting down public FTP services by kevin_thibedeau on Tuesday April 25, 2017 @08:08PM (#14199409)
At least there's still Jigdo.