The epitome of corporate speak: "we're taking away a feature of this software. You're welcome."
I expect that kind of talk from Google; hearing it from Mozilla makes me a little sad.
I remember back when the Spread Firefox campaign was still around - at the time, Firefox and Mozilla in general felt grassroots, fun, and human. Like a club anyone could join and that anyone would want their friends, family, coworkers, and even strangers or people they didn't like to get in on: an all-in-this-together effort for a better internet.
Anymore, Mozilla feels more and more corporate, more like a company - even as Google Chrome (and the many browsers built from Chromium) eats away more and of their market share and they move toward being "the little guy" again - and less and less like a group of people.
I think what I really miss is having a browser that made me care about it beyond just wanting alternatives.
That was long long time ago. I think something like early 00s when Firefox was just launched. Things changed. Mozilla is no longer the same.
But, hey, if you are not yet a FF user, here's where you can download it, in case you're looking for a browser that... lacks FTP support. Something many users are likely to be seeking out.
I do not see the benefit of removing FTP. For security concerns, a big warning as with expired TLS certificates would be an acceptable compromise, IMHO.
But as someone who knows what FTP is and still uses it on occasion, I don't think FF dropping FTP support is going to impact me very much.
I don't think anyone who hasn't heard of FTP is seeking out a browser that specifically does not support it.
However, there is no need to characterizes FTP being dangerous by jumping from FTP is old and is in plaintext, to FTP servers are being exploited and used to distribute malware, to FUD-type statement implying that there are [unspecified] exploits now available to attack Firefox if FTP was enabled.
This is just plain disgusting and it leaves a bad taste in my mouth.
maintaining features is cost
Maintenance-free code is a chimera.
If a large codebase that interacts with any other system/code (either through usage of shared libraries, network connection or a common file format) has not changed, that means there's likely technical debt that hans't been addressed (or needed to address).
Even if the program was never written from Linux, you can often get it to compile and run by fixing up headers and making some other minor changes to the source code. I’ve had plenty of success compiling and running programs that were only ever designed to run on IRIX or Solaris or other Unix systems.
I'm not saying there weren't good reasons to get rid of ftp support, but that doesn't seem like one.
Also, while in theory SFTP can be as secure as FTPS, in practice it's not. How many people really check that the server public key signature it's the correct one? You know that annoying message that appears the first time you connect to a server and you have to say yes and if you don't it will not let you continue?
Not checking that give you the same security as having a HTTPS/FTPS server with a self signed certificate. You trust blindly the identity of the server, but there could be someone doing a man in the middle and stealing all your data. In that situation, FTPS is more secure, mainly because you need a valid TLS certificate that will give you some guarantee about the identity of the server.
Server identity keys can be checked using SSHFP DNS records signed with DNSSEC, but that is not really mainstream unfortunately.
What would happen if they rip it out?
What should be done is push for things like ftps or add big warnings around it.
That wasn't the decision. Maintaining this was.
Edit: not sure why this is being downvoted... if you read the actual link, it says they intend to deprecate HTTP.
Obtaining a public certificate from a well-known registrar requires Internet connectivity for the ACME protocol, and that's at odds with the other best-security-practice of isolating internal systems like NAS devices well away from general Internet connectivity.
The problem is even worse for home routers. They need Internet connectivity to have a chance of obtaining a certificate, but since they provide that connectivity to a network they can't obtain the certificate until they're set up. But setup generally happens via a web browser and captive portal, so we're right in the middle of a bootstrapping problem.
https/TLS everywhere on the public Internet is a great thing, but it's not a reasonable expectation for private networks with private devices.
What, you're using old unsigned DNS and complaining about security? Or software so old that pinned certificates are outdated?
Getting rid of http or insecure-https support completely would render either them, or your browser, useless, and require that one or the other be replaced.