Hacker News Reader

Comment by jamescun | Hacker News Reader

Is FTP that heavily used in 2016? The only use I can see for it now that hasn't been replaced by either a better protocol (i.e. BitTorrent) or a service (i.e. Dropbox) is shared web hosting, even then many now support SFTP (and git).

View on HN

Can confirm that as recently as 2012 most major banks, certainly in the UK, were using FTP for transferring their overnight batch payment files (some even over PSTN). Some have managed to move to SFTP (and FTPS), but i would say it's still heavily used in banking/payments.

We can't use SFTP internally because of policies around encryption, so a lot of our stuff uses FTP to move data around.

uh, is the policy that encryption isn't allowed? SFTP is encrypted, FTP isn't.

Many security groups in corporations inspect network traffic for malicious activity. Encryption prevents this, so policies or technical measures may be introduced to ban or limit its use.

As a side note, several years ago, I had a friend who worked for a small research company that had a ban on encryption software. Installing or using PGP on a company computer would be cause for termination.

I expect to see these ideas become more mainstream. In future, companies may only allow certain encryption technologies on their networks/nodes (ones which they hold keys for).

> is the policy that encryption isn't allowed?

Where I worked moving encrypted files over plain FTP was preferred by the business clients because they controlled the encryption passphrases, whereas using SFTP would require operations support, as ops own certificates and encrypted service endpoints.

Much easier for a business user to encrypt a file on their computer using PGP and FTP it to the recipient, passing the passphrase out of band, than raise a service request to pick-up and transmit a file dropped onto a specific egress zone.

FTP (and SFTP) is very heavily used in enterprise software, especially when two pieces of software are being integrated.

(S)FTP support has been baked into huge ERP systems like Oracle and SAP for years (I would be very surprised if BitTorrent was even on a list of development features), and when you're working with a company who has a $100mm SAP installation, you transfer files using (S)FTP.

I just finished a large integration with SAP where all of the data was transferred using files over SFTP. We have a modern REST API they could use as well, but that would've added a lot longer time to the integration as it wasn't already baked into SAP (plus, moving large files over HTTP is not ideal).

I use FTP to transfer files from my scanner to my PC. Doing that, I don't have to run any vendor written software on my PC. For me that matters. And for such use cases, the limitations in the FTP protocol is of little or no concern.

It's still the most common way I get sent large files by clients. For up and downloading 250 files @ ~250 MB ftp works very well. Although much of that is due to ftp clients as much as the ftp protocol. If all web browsers came with a easy way to select all the files in a directory and simply up/download then in parallel with automatic restart at failure then http would probably be just as good.

Thanks to our friends at cPanel and the hundreds of thousands of web hosts that embrace and evangelize the platform old-school insecure FTP is still popular and strong and often the documented/default way clients are encourage to upload their files.

Why would I use those on the LAN ?

I don't know about you, but I don't trust my LAN and neither should most people. Between crappy routers and infected laptops, we are better off treating it like another branch of the Internet. Even Google has been backing off the "trusted firewalled LAN" model and relying more on edge security.

Don't forget WebDAV.

Did WebDAV ever work reliably?

If WebDAV worked as reliably as FTP more people would use it. Which is actually bad since the tech is rather weak in my opinion. :) So good for the internet that it never really "just worked."

Reply on news.ycombinator.com