Well it reeks a bit because from the article

"Mozilla could have opted for implementing support for secure FTP in Firefox; a bug was filed 19 years ago to introduce support for SFTP in Firefox but nothing ever came out of it."

Never happened because there was no use case for it.

FTP made some sense to have in a browser because it supported unauthenticated downloads.

SFTP, as a protocol which runs over SSH, basically requires authentication. (You could conceivably set up an SSH server to allow authentication against a "guest" user, but that gives security folks the heebie-jeebies.) So it doesn't really make sense to link to an SFTP resource in a web context, making it very low value to support in a browser.

That is extremely common no? Ex: checking out as an anonymous git user?

> That is extremely common no? Ex: checking out as an anonymous git user?

That almost always happens over the git protocol or git+http, not git+ssh.

The article indicates that it is insecure....

"The main reason why FTP is being removed is that it is considered insecure but Google's decision to remove support from Chrome certainly played a role in Mozilla's decision to remove support as well."

Damn. I should be downvoted, that's pretty blantant i-didnt-read-the-article. Thanks for the clarification.

https://en.wikipedia.org/wiki/File_Transfer_Protocol#Securit... lists many issues. The worst is that FTP transmits user names and passwords in cleartext.

Having said that: nowadays it isn’t uncommon to say “FTP server” for a server running SFTP, its secure replacement, so it isn’t clear to me what exactly is being removed from Firefox.

FTP is FTP.

SFTP is SFTP -- a protocol which runs over SSH -- and Firefox doesn't support that. It wouldn't really make sense for it to do so, either; SFTP more or less requires SSH authentication, making it a poor fit for a web browser.

There is FTPS (FTP + SSL/TLS), which Mozilla might support -- but that's rather rare.

The entirety of changes to one of the files in the past 13 years is here: https://hg.mozilla.org/mozilla-central/log/tip/netwerk/strea...

There's more changes on nsFtpConnectionThread.cpp: https://hg.mozilla.org/mozilla-central/log/tip/netwerk/proto...

Looking at those changes, it's clear that there has been very little substantive modifications to the FTP code itself, as opposed to keeping up with style guide changes, mass renamings, and API changes. So either you believe this 15 year old code is really rock-solid, stable, high-quality code, or you believe that it's a massive pile of bugs and security holes that no one's examined too closely. I know which one I believe.

Perhaps they should take the opportunity to rewrite it in Rust.

If I'm reading the telemetry correctly (https://mzl.la/3bq5oFZ), there are ~6k people who used FTP to download a file in the past week or so. That's not enough users to really justify spending manpower rewriting it.

you should never trust telemetry or analytics to be unspoofed.

You’re suggesting there is a mass campaign to spoof Firefox telemetry and mask high levels of FTP usage?

Even if it's not spoofed, I would conjecture that the set of people using FTP has a large overlap with the set of people who disable telemetry.

im suggesting that everyone i know and thier mother intentionally spoofs any telemetry or analytics they can rather than block it. nothing atypical about it, it is very distinctive to comepletely block fingerprinting analytics telemetry. it is much better to spoof the content rather than block it.

Then everyone you know and particularly their mother is extremely atypical.

have a look around github

the breadcrumbs start here:

https://gist.github.com/MrYar/751e0e5f3f1430db7ec5a8c8aa237b...

https://github.com/search?q=spoof+telemetry

if you know how to do a web search do that. if you cant then sorry about the luck.

The gist talks about disabling telemetry, not spoofing it, and reading the prefs it sets makes it clear that it is actually disabling it.

The github search reports a single repository last updated three years ago, and doesn't appear to even be related to Firefox telemetry at all, as the telemetry appears to be spacecraft telemetry.

Plaintext passwords over the net. Also, it's somewhat painful for NAT because it opens up a second port that isn't a named one, the client sends that port number to the server, then the server opens a connection to the client.

That's for active FTP, which basically nobody uses anymore (since it's incompatible with most firewalls).

Most clients use the passive FTP extension, in which the server sends the client a host/port pair to connect to for the data connection. Still painful, but slightly less so.

For sure it is unencrypted, so it is vulnerable to man-in-the-middle attacks.

A MITM attack occurs when an eavesdropper inserts herself between two people trying to communicate securely. e.g. Alice and Bob may think they're talking to each other over an encrypted link, but they're both talking to Eve. Eve's just taking everything Alice sends, decoding it, copying it, re-encoding it, and sending it on to Bob. A MITM attack is not necessarily the result of bad encryption, but of a failure in authentication. Eve's ability to fool Alice into thinking she is actually Bob is key.

An unencrypted connection (such as plain old FTP) is effectively a broadcast. No attack, MITM or otherwise, is required. Eve just has to listen.

I'm sure the majority of people that still use FTP aren't relying on a browser for access but people still use it. Why not just deprecate standard FTP and only support FTPS and SFTP?

Because that'd amount to the same result as removing FTP. The "installed base" of web-accessible FTPS and SFTP resources is essentially zero, and that's unlikely to change -- if a web site was previously using FTP, they're probably going to move those resources to HTTP/S, not to another protocol which has limited browser support.

> The "installed base" of web-accessible FTPS and SFTP resources is essentially zero

Well that's true of SFTP, browsers don't support that protocol but I think they should. But FTP is still ubiquitous on the internet and most browsers like FF already support FTPS. To me it would make more sense to deprecate FTP like HTTP and warn users when their logging in over an insecure protocol than just kill the feature all together, especially if one of the primary reasons is because "Google did it". FTPS uses the same URI as FTP (ftp://). FTPS is common now, most people don't even realize they're using it. There are those of us that still need to deal with FTP and being able to click on a link in the browser rather than use a separate FTP client is just convenient. Just make it an optional feature and disable it by default.

> Well that's true of SFTP, browsers don't support that protocol but I think they should.

They should not. SSH -- which is used as the transport for SFTP -- is a rather large and complex protocol. Implementing it in browsers would significantly increase their network attack surface, while providing few (if any) new capabilities. (What does SFTP provide to the browser that isn't possible with HTTPS?)

> FTPS is common now, most people don't even realize they're using it.

Can you give an example? There are no major web browsers which currently support FTPS -- it is not present in Chrome, Mozilla, nor Internet Explorer.

ftps? Not to be confused with SFTP.

ftp over ssl

The only FTP I use these days is really SFTP

Last I’ve checked SFTP was much slower than FTP unless you used the HPN-SSH patches. Is this still the case?

Why is this comment grey?

Your monitor is likely running low on black ink.