How? They dropped FTP support a few versions ago (https://blog.mozilla.org/addons/2021/04/15/built-in-ftp-impl...).
Firefox deprecated FTP in 2015, and required it be manually re-enabled since April last year (FF88), and completely removed it in July (FF90), this year.
I was assuming that they will drop support by the end of this year, didn't follow it up recently so I missed the update in July about it.
This is so true. Especially since the pandemic the sheer amount of CVEs are hard to follow through and evaluate whether they're relevant for your own tech stack or not.
Great. And while I blame Mozilla for much, this isn't their fault.
I almost feel as if end users should need a network license, and if they get too many tickets, no license for them!
And yes, it is not realistic.
If these clients are on Windows... tell them to use Windows Explorer.. it has FULL ftp capabilities.
You don't need a browser for ftp, or even an FTP specific program.
You cannot even uninstall or disable it as it disables the entire desktop.
Note that I am not talking about Internet Explorer (which is related, but not the same thing)
It's pretty seamless. There's lots of ftp supporting clients. Give it a go
You can insert a dozen strange answers here.
For example, one answer?
1)
A client of mine has an FTP site, and their customers access it. Those customers have an IT policy which does not allow them to install other software, for security reasons.
Thus, keeping and old version of firefox around is what their customers do.
(Yes, this is insane and bizarre beyond belief. The security policy is working against security, and the fact that the security policy doesn't care about an old browser is insane. Yet there it is.)
2)
I have a client with employees around the world. They are usually very secure. However, these employees seem to be the complete opposite of computer literate. Every step they take, every task assigned, is accompanied with PDF files and wiki walkthroughs of "here is menu item X, click this, then menu item Y", along with screenshots, and enlargements of menu items.
All their training is rote. They don't know how to use software, only how to click this, then that, as per pictures and doc, then entire report in the form that pops up.
If anything deviates -- tech support.
I honestly don't know how it is possible to find people capable of doing a job with diligence, competence, and intelligence, but require this level of hand holding, yet I see it myself, through this client, constantly.
Like I said ... strange and bizarre.
While I am sure this client will eventually manage to upgrade its staff, they have been researching clients, testing them, re-working all documentation, and even rolling out 'test upgrades' for employees!
And of course this takes time, naturally they are short staffed, and it requires management buy in at every step.
And getting people to modify about:config? That's way, waaay too complex. So they're stuck on an old browser, which they aren't supposed to use for anything but FTP, yet these employees are the sort that call a browser "google", and don't know the difference between firefox and chrome.
So you can be sure they're using an old version.
--
Again, I don't blame Mozilla for this.
This is the sort of stuff which makes me think 'maybe people need a license, like a driver's license, to be on the internet, they're too dangerous otherwise'.
But of course, as I said initially... not easy or realistic to roll out.
Now that I think of it, though, maybe it should be "businesses need a license to be on the internet". The important part here being, if you have constant breeches, and your infra gets used to launch endless attacks, you get fined until you go out of business.
Would you pass on that memo to the Chrome developers, please?
CORS was basically ineffective in a lot of ways because it only works - by design - with newer servers that send those headers and with newer browsers that actually respect the headers and not simply ignore them. It was also ineffective for older servers from pre-CORS ages. The never break the web mentality didn't work out for this scenario.
Looking forward to this! Finally the LOIC and routersploit web implementations are ineffective. Now drop support for ftp in the web browser and we are good to go.
(̶F̶i̶r̶e̶f̶o̶x̶ ̶c̶a̶n̶ ̶s̶t̶i̶l̶l̶ ̶b̶e̶ ̶a̶b̶u̶s̶e̶d̶ ̶t̶o̶ ̶D̶D̶o̶S̶ ̶v̶i̶a̶ ̶f̶t̶p̶ ̶u̶r̶l̶s̶)̶
edit: correction: I was wrong: Firefox finally phased out ftp support this year in July.