Hacker News Reader

Comment by userbinator | Hacker News Reader

Considering that Google (search) still lists plenty of FTP results, many of which have been extremely useful to me, this seems like another move to bully the Internet into what Google wants it to be. Will it start removing those results, effectively censoring another huge chunk of the Internet? It's already hard enough to find older/more obscure information, and FTP sites are more likely to be in that category.

Also, I can't be the only one who's absolutely sick of hearing that bloody "security" argument again. Yes, everyone knows FTP is plaintext, and so is HTTP. But drivers, which I'd say are a significant part of FTP use, are almost always themselves signed anyway, and I don't think malware is widely distributed via FTP either (I'm curious why FTPS/SFTP doesn't see to be indexed, or why they didn't decide to add that to the browser instead --- or at least I've never come across a search result that links to one.)

View on HN

There was a time when www was just a part of the Internet and we had www search and ftp search engines. The one I used to use was called "ftpsearch" and the only thing (besides the name) I remember is that it used to say "This server is located in Trondheim" on the front page. A quick web search turns out that it still seems to exist in some form [1]. Unfortunately it apparently doesn't really work anymore.

Maybe it's time to bring ftp search engines back.

[1] http://www.mi.uni-koeln.de/~jbe/ref/ftpsearch/

Ftpsearch.ntnu.no was the one I used to use

I adored this service. I used it many, many times.

Xarchie for me

I just hope this isn't like how Google basically killed off RSS when they killed off the best client that everyone was using (which I've still never heard a good reason why) which I believe played a role in the decline of everyone having a blog.

And yes I know there's some niche support still, just as FTP will live on.

Incredible how that happened. I used Google Reader a lot, adding any interesting blogs I would find. Now I can't find any of them again :/ I think I've got a list saved somewhere, but it was just so easy to go through Reader.

I recommend https://bazqux.com/ -- The death of Reader sprung the life of many pre-existing RSS reader replacements.

Looks good, but having to sign in with a third party - yuk.

Where was this when Reader died! Looks great.

The big problem at the time was there was no good options, even a year or so after and I gave up trying. Everything was 90% of the way or too fancy for such a simple service.

I found it in one of the many HN threads where alternatives were being advertised left and right just as Reader's death was being announced ;) theoldreader is another one I remember from back then.

Ah, apparently I didn't try hard enough then.

>I believe played a role in the decline of everyone having a blog.

Is that really the case though? Wordpress ( Love it or Hate it ), both .com and self hosted is still thriving.

And if people are writing less blog, I think it has more to do with Social Media ( Facebook ) than RSS or Google Search / Reader.

RSS is still alive and well. Podcasting depends on it.

Don't jinx it! Luminary and Apple Podcasts are trying to add exclusive content now.

Podcasts that only work if you buy Apple's hardware? That sounds terrible.

RSS/Atom is alive but not well. It needs more support.

Funny, I use RSS constantly for podcasts and I never made that connection. Good call.

I use RSS every day, I have 3 stops when I want to check on current events, my RSS Feeds, Reddit, and here...

Please share your favorite RSS client

Right now I am mainly using Feedly.

However I have been wanting to selfhost more so evaluating moving to either FreshRSS or TinyRSS,

Weirdly after switching between many self hosted options, including Nextcloud News which lasted the longest, I ended up putting rss2email [0] in docker and configured it to SMTP (it can also deposit them onto an IMAP server directly) articles to my address. I then have an inbox rule that puts it all into a folder and another that deletes items after 7 days. If I want to save an article, I just move it into my "Archive" folder.

Why using email? I switch between phones, OSs etc and it was a bitch to find decent clients for the self hosted options on each OS. I can generally get my email everywhere, via ActiveSync on my phone, WebUI, thunderbird etc. And since I host my mail, the data never leaves my network :) It works really well, though I do sometimes feel like RMS having web pages emailed to me lol

[0] https://github.com/wking/rss2email

Bazqux, basically a GoogleReader clone if Google would still develop it. Works really well on mobile as PWA. Not free, but worth 20-30$ sub a year. Not affiliated, but a happy subscriber for 5-6 years. Everybody who still misses GoogleReader should try it.

https://github.com/bazqux/ https://bazqux.com/

Miniflux for me. There's a paid hosted SaaS option, or you can host it yourself.

https://miniflux.app/

RSS is not a feed to distribute content (podcasts excepted of course!), it is another way to pull you into the same ad infested ecosystem that still thrives today. Google is indeed killing reading but google reader is such an odd product to place blame on.

> everyone knows FTP is plaintext

You mean no one knows that FTP is plaintext except a minority of users which happens to be on HN.

Google is optimizing its browser for the majority, chrome is not a power-user browser. Maybe they'll add an option to enable ftp or something.

> drivers, which I'd say are a significant part of FTP use

I'm not sure how that's true. Every time I used FTP, it was not for drivers. All the drivers I downloaded were over http(s), from constructor websites.

> Google is optimizing its browser for the majority, chrome is not a power-user browser.

That is a problem. We have browser engine duopoly, and really everyone is doing whatever Google wants anyway. So as they're optimizing against power users, they're making the whole web much worse.

Can you please explain to me why you believe optimising against power users is making the internet worse.

I tend to agree with you, but would you mind fleshing this out a bit. Or, if you've written this before please point to it.

I'm not TeMPOraL, but to my understanding:

Chrome is a duopoly, and Firefox tends to get forced in the same direction as Chrome over time -- it's not powerful enough to push the web as a whole in a different direction.

If Chrome was not a duopoly, this would not be a problem. There's nothing fundamentally wrong with having a browser that's highly optimized for nontechnical users. However, because Chrome has such control, pushing technical users out of Chrome has the effect of pushing technical users out of the web entirely. By putting itself into a dominant market position, Chrome has put itself in the (unenviable) position of needing to be everything for everyone.

In other words, if Chrome doesn't support power users, and if Firefox doesn't have the guts to refuse to make the changes they advocate for, then power users have no where to go. This is why monopolies and duopolies are bad even if the companies behind them are good. Its completely unrealistic for a single product to be everything for everyone, so single products by their very nature exclude certain users.

----

So who cares if power users abandon the web?

This is a problem because historically, power users have been incredibly important for the web's development. They've been important not just in the sense that they've pushed the web forward technically, but also because the web was designed to be a democratizing medium. The web is designed to be a publishing platform where people can build weird things without asking anyone's permission.

Even non-technical users benefit from this -- it's in their best interest to have lots of providers providing lots of solutions for publishing because (repeating what I said above) no one platform can be everything for everyone. A non-technical web that is optimized for ordinary people to the exclusion of power users is going to be less creative, less interesting, and less useful even for ordinary people.

Whether or not FTP in particular is critical to that -- I don't know. I don't know enough about FTP to make a strong argument on that. I will say I have used FTP a lot as a consumer, especially when downloading packages, and I have used FTP on internal networks. I'm not an expert, but the arguments package maintainers make about why SSL is unimportant to FTP ring true to me. My understanding is that package signing prevents modification attacks, and that looking at request sizes is enough to identify resources even with SSL.

As a policy, deprecating URL types that don't support encryption seems at first glance to be a really dumb move, and I'm not sure the security arguments justify it. But I'm not an expert.

----

I'm on Firefox, and I'm hopeful that Firefox is going to see a resurgence of usage pretty soon, particularly among power users. If Firefox refuses to deprecate FTP, I'm not so worried, since honestly I think it's probably in everyone's best interest for Chrome to do a few dumb things that make more power-users jump ship to Firefox. A lot of power users aren't willing to make the switch on ideological grounds; Chrome as a browser needs to get much, much worse to encourage them to use competitors.

Thankfully, it appears that (especially recently) the Chrome dev team has been thinking the same thing.

I think the term "power users" is not appropriate. I believe we're encountering some kind of "curse of multidimensionality" problem here: every time Google adds a feature, they add one dimension to the space of utility of their product. And every time they remove a feature, they reduce the relative volume of people who still find the product useful. So it's not "power users" in general, but "power users of feature X". There are not the power users who use all the advanced features on one side, and the regular users who use none on the other. The more features you add or cut, the more each of those categories tend to zero. Actual users are somewhere in between, and if you optimize against "power users" you in fact optimize against your users in general.

I wanted to but I'm AFK for most of today. I'll try to comment some more later today, and I'll likely blog on this in the future.

EDIT: 'danShumway and 'ajnin together essentially summarized my thinking here.

Web is built and maintained by technically proficient people so it needs them to be comfortable. There is no unified group of "power users"; everyone doing something regularly becomes a "power user" in that context to the extent they are able to. If you remove their ability to grow, you're condemning them to wasting their time and reducing utility of the web for them.

Its a strange thing how co-incident "optimizing for the majority" is with "killing open standards" and "Google specific features"

A real strange thing...

Not to worry though, I'm sure Google is just doing it for everyone's best interests, like the charitable organization for humanity that they are.

This is silly.

FTP is an awful protocol and there are other perfectly fungible open standard replacements for it, like HTTP/HTTPS. FTP dates from the era before NAT and firewalls and makes a bunch of problematic design choices, like having the server establish a separate port connection to the client (or vice versa, for passive mode) to transfer the file. It's super chatty, requiring multiple waits for response, and therefore slow. There's no length check, so if your socket gets closed you silently save a half-finished file.

FTP should just die off.

> Google is optimizing its browser for the majority, chrome is not a power-user browser.

Yet they are positioning it as the only browser

This'll happen when the major ideology held by most people is competition.

One wouldn't expect Google to say "We recommend you use our browser, Google Chrome, but there's also these others that work fine to."

It's probably the case that back when the number of internet users was smaller the place had a more community oriented vibe, whereas now there is huge sums of money and power at stake.

I wouldn’t expect Google to say ‘here’s our web app, it doesn’t work properly in any browser expect Chrome’. But they do.

> Maybe they'll add an option to enable ftp or something.

I guess not. More likely there'll be plugin to add this functionality back.

Chrome addons are not capable of doing FTP.

Really? Given there are a chrome apps capable of doing ssh[0], I'd be very surprised if FTP is not implementable.

[0]: https://chrome.google.com/webstore/detail/iodihamcpbpeioajje...

That uses NaCl, so while what I said is not accurate, NaCl appears to have no future.

https://blog.chromium.org/2017/05/goodbye-pnacl-hello-webass...

It uses NaCl but that's not necessary; it just needs the chrome.socket API, which allows arbitrary TCP and UDP services to be built. There is no reason one couldn't implement FTP or SSH with it in JS.

https://developer.chrome.com/apps/socket

> Google is optimizing its browser for the majority, chrome is not a power-user browser.

Well, I think there is enough people like us, where a proper 'power-user' browser is worth maintaining. Any takers?

Indeed; by the same "security" logic, why not get rid of HTTP too then? (Or SMTP, for that matter?)

The point of "organize the world's information and make it universally accessible and useful" is to do precisely that: to organize the world's information and make it universally accessible and useful -- long tails included. But I guess for them it's not...

(Also, I can't believe the Chrome team is so strapped it can't afford to support or harden the feature, as some in the bug tracker suggest [1]. This is Google we are talking about, not some tiny open source project!)

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=333943

They don't have resources to fix cross-origin network request debugging either. It's quite sad.

If I imagine I'm in a position as a developer / project manager / whatever working for Google trying to advocate Google committing resources to the FTP protocol in Google Chrome, I'm struggling to think of a way of promoting it that shows it will have a return on investment.

How do you display ads while someone is accessing an FTP server?

ftp://example.com/directory/file.extension can be a link in a website, where the website displays ads.

I'm just imagining some people having a conversation that goes something like this:

"The funding for this feature has been removed because we can't serve ads on a page like this https://imgur.com/20ooI9f "

Edit: grammar

Chrome, being a browser made by an advertising company, could show ads on ftp directory listings.

In that sense, it's somewhat strange that Chrome isn't already presenting us with ads in the tab-/addressbar and the menu. Perhaps some pop-ups from the bottom and sides as well while they are at it? The original free/shareware version of Opera had that too, and it wasn't that intrusive.

I thought you were joking for a minute and then sadly realized you weren’t.

Mozilla certainly would like that new influx of users. I think user retention is one of Googles most immediate issues.

> Indeed; by the same "security" logic, why not get rid of HTTP too then? (Or SMTP, for that matter?)

I believe those will happen, in the long run.

The next HTTP spec includes mandatory SSL, and Google had a hand in designing QUIC, and Google has been deprecating traditional SMTP authorisation.

I would say that the reason is not FTP insecurity or anything else technical. They see no monetization in it as they cant put their ads in it, they cant track you (well this is wrong, they track you with chrome) and nobody is buying adwords for FTP. Why keeping it?

On the contrary. It’s a data only with maybe a motd. plenty of space to put ads. Especially if you’re looking for a driver

This is an amusing thread.

FTP in the browser typically looks something like this https://imgur.com/20ooI9f

Plenty of space for ads.

HTTP is basically FTP with ads.

Funny thought. Imagine if, to this day, the internet consisted of pretty much that.

You go to ftp://nytimes.com and it just has a directory structure that consists of yyyy/mm/dd and the file names where things like statement-from-chinese-ambassador-to-australia.txt

And maybe a directory named breaking-news

Imagine if Twitter was a list of text files named yyyy-mm-dd-hh-mm-ss-username.txt

Ha.

Imagine if you had to upload a text file like this

  ---

  Please place an x between the brackets as desired

  [ ] Whopper Meal
  [ ] Super sized Whopper Meal 
  [ ] Coke
  [ ] Sprite
  [ ] Eat-in
  [ ] Takeaway
  etc

  Name on card:
  Card number:
  Expiry:
  Card Security Code:

  Sponsored by Nike and the Ford Motor Company

  ----

Edit: changes 'threat' to 'thread' in first line, typo could have been confusing. Second edit: made list verbatim.

Yes but if one of those files was ADSENSE-one-wierd-trick.jpg

Nobody would actually bother to download it would they!

> Funny thought. Imagine if, to this day, the internet consisted of pretty much that.

That's pretty much Gopher. Another protocol that Chrome no longer supports.

You could write native apps on top of your proposed directory layouts, and it would be better than whatever people do today.

> Imagine if you had to upload a text file like this

I would love this. This has better UX than the food ordering sites we have to deal with in the real world.

You’ve just described e-commerce circa 1990!

On Usenet newsgroups and BBS conferences, sellers would post forms that looked exactly like that, except for the ads of course. Buyers would then send in their completed order form via either email/netmail or, preferably, via fax for added security.

I remember always choosing to fax in my orders; even way back then, sharing credit card details via email seemed like a very bad idea.

>Imagine if you had to upload a text file like this

Sounds like a total improvement over websites I have suffered... not to mention allows all kinds of third parties to create their own fancier ordering systems on top!

FTP support is still a big attack surface for the client that has to be managed, regardless of wire security.

But my gut reaction to reading this concern is actually: why do you think this is “bullying” and not “opening the door for a niche competitor”?

What big attack surface? The client? FTP is an ugly/stupid protocol, but it's not really complex (I suspect it's far simpler than HTTP).

I'm surprised the article claims there are still bugs, because one would think (hope) that a protocol over 30 years old with an implementation over a decade old should've received its last bugfix long ago and become truly stable by now.

Can you give an example of a piece of software of reasonable complexity (network/file handling, etc) that has solidified like this?

TeX

qmail

Sqlite

The other ones I might give a pass to as I can't find where the update history lives, but this is untrue - https://www.sqlite.org/changes.html

Everything in the openbsd base image.

What? Like OpenSSL:

https://en.wikipedia.org/wiki/Heartbleed

(I mean, I'm not overjoyed at the deprecation of FTP support because I used it just yesterday, but let's at least be honest here. The protocol might be decades old but the implementations aren't necessarily, and if they're being actively maintained there's always the possibility of introducing new bugs.)

It was introduced into the software in 2012

That's not the "stable protocol that's been around for decades" situation that FTP is in.

> That's not the "stable protocol that's been around for decades" situation that FTP is in.

That is literally the point I was making when I said, "if they're being actively maintained there's always the possibility of introducing new bugs."

Moreover, just because a library had its last fix a decade (or whatever) ago is no guarantee that unfixed bugs do not lie undiscovered in it.

Are you referring to this bit:

and there are other bugs in the implementation which further demotivates the FTP support.

To me that reads as there are bugs in Chrome's implementation of FTP.

Did you take that to mean the author intended to convey the message that the FTP protocol has bugs?

The protocol is buggy AF. All that crap about sending data over a separate TCP connection, the weird way you have to deal with state and authentication; ftp is an utter shitshow. Just because a protocol is old doesn't mean it's matured to perfection. Telnet is old, so is RCS, and UUCP.

Many protocols evolve not by being replaced by incrementally better point releases, but rather by being supplanted entirely by a better designed alternative.

FTP effectively evolved into HTTP for this use case, and scp/sftp for the authenticated file transfer use case.

FTP has some pretty serious quirks. Active-mode FTP is probably the craziest one by modern standards -- the client opens a port and asks the server to connect to it to send a file. Needless to say, this is effectively unusable on the modern Internet. Its replacement, passive-mode FTP, has the server open a port instead; this configuration is merely incompatible with most load balancers.

Active ftp is dead. I wouldn't be surprised if browsers don't support it out at least don't default to it since as you said it would break things for 99% of users. Running a server that's not configured properly for passive transfers is effectively a server that's useless. So if it would make someone sleep better at night I'd be fine with removing active transfer support from browser clients. Switch to filezilla if you're a power user or want to do some 1337 FXP tricks.

It's not much different than old versions of TLS.

Oh, absolutely! I said it was ugly/stupid from personal experience:) But it's a form of stupid that can be condensed into a single state diagram that would fit on half a sheet of paper, so I'm not super concerned about it.

In ftp, the ftp server is designed to act as the load balancer. (Just have the firewall point each port to a different IP.)

Also, this enables linear scale out, since not all ftp data nodes (not sure what the correct term was) need to store all of the data that’s being served, and you can store multiple copies of each file.

Come to think of it, I’m not sure why HDFS exists, given that you can just use a ftp server cluster for the same effect.

Because a 'niche competitor' is not really a competitor and would be invisible to almost everyone. And because sich a competitor would require extra work to use, so it would be unpopular.

FTP can be implemented in such away that it exposes no more potential for attack than html/http.

They can’t serve adsense from a FTP server.

A rogue crazy-totally-legit-not-virus-ad-company.xyz can put movie.wmv.exe in the list.

I’m really unhappy with Chromes roadmap as of late. Particularly their effort to kill the URL. At one point Chrome was the gold standard and I think it’s gotten to their head.

I never considered Chrome the gold standard. They advanced the state of the art with their sandbox model and their performance advantage, but they are losing the advantage in the former and lost it in the latter. It was always painfully obvious (to me) that it's an extremely bad idea to trust an ad megacorporation with building a browser.

> this seems like another move to bully the Internet into what Google wants it to be

Bully them back. Don't use Google search and don't use Chrome.

Easier said than done, especially when most of the population doesn't care either because they're too young or too nontechnical; actually, I already don't use Chrome, but their search (which still shows FTP sites...) is, despite slowly getting worse too, still giving a wider breadth of sites most of the time. Bing and DDG help fill in the gaps.

startpage.com gives me better results than Google itself, because of the missing personalization bubble.

Really? I find that their cache of Google results is very old on average, so new sites don’t appear for a very long time compared to Google. DDG seems to be better than Startpage on that front, but a Google takes the cake in result recency. Even my not-horribly-popular web site is indexed by Google within ten minutes of me publishing anything.

> Easier said than done

It's real easy to do. It is not the case that you are dependent on Google search. You're imposing artificial limits on yourself. Break free of this limiting mindset.

What do you mean? It's very easy to install an FTP client and even in heyday, noone sane ever used a browser for FTP access anyway.

These kind of comments are so strange... why do you want Google to own your FTP client instead of having an independent one?

IE was superseeded by Firefox in the early 00's at scale, and there's no reason to assume Chrome can't equally be replaced by FF or another browser today. FF got a little help from the EU by requiring MS not to bundle IE with Windows back then and list browser choices for download on install; I think the same would work well on Android today (and in general with Google services such as maps/navigation, email, and search).

We'll hit a tipping point soon enough and Google will either die or have to adapt.

I personally hope they continue exhibiting monopolistic behaviour. Same with Cloudflare and other company's who choose business models that are hostile to an open and decentralized Internet.

I switched my default search engine in FF to Qwant a few months back. You have to re-learn to formulate clear search queries (no magic pixie dust^H years of browsing history to help it read your mind) but I find that it mostly works.

Try switching to ddg and append !g every time the results seem to suck. That's how I did it and after about a month it was just fine. In fact over time I felt like I did the !g thing less and less, because you somehow get a feel for when ddg actually sucks or not. Or maybe I unconsciously started formulating queries differently.

But if you really think it would be right to switch away from Google, give yourself a month of pain and then decide if you can live this new life. ;-)

The drive towards "HTTPS everything" has merely caused users to forget what it is and therefore simply trust Google. Needless to say, this is exactly what they would want.

Reply on news.ycombinator.com