Hacker News Reader

Comment by tyingq | Hacker News Reader

It's old, but "ftp://" is a valid uri scheme that has established use, and lots of valid links on existing, live web pages.

Browsers removing support are breaking part of the web that was working fine.

View on HN

No, they're breaking with accessing a part of the internet that web browsers used to support, an no one does anymore. They are most certainly not break the web itself. These are different things: if you need FTP (and let's be real: you don't), then as a user you still have TONS of options available to you, and as a host even legacy systems using ancient versions of Apache can already serve file listings as standard web pages. Just turn that on.

Your web browser doesn't need to support FTP. It just needs to support the web. Everything else is a bonus, unless it's a security liability. Then it has no business being in there.

>> Your web browser doesn't need to support FTP.

Your browser doesn't NEED to natively support .pdf but it does and you've probably used that feature. I mean you could have it launch an external .pdf viewer, which is a FAR more complex piece of software than the little FTP protocol code they're disabling here.

Your browser doesn't NEED to support TABs. Your OS is already equipped with the ability to run multiple instances.

Your browser doesn't NEED to sandbox anything, you could just run each instance in it's own VM.

Your browser doesn't NEED to play video, it could launch an external viewer.

While you are completely right in your statements, I could argue that http and ftp are a means of transport and not part of UI or UX.

Q: What do your NEED scenarios have in common?

A: Popularity.

Touche. But what Firefox needs is popularity too, and being the last browser to drop a feature used by some niche isnt helping them. I'd argue not to add ftp if it wasn't already there, but why drop it?

It's probably the largest in-use uri scheme they have dropped. At the very least, there should be better error handling. For me on Chrome/Windows, ftp:// uris just don't do anything[1]. No error, they are just inoperable links. Yes, I could fix that, but for average users, that part of whatever you want to call it could just disappear silently.

[1] Because the default handler for ftp:// was originally Chrome on my system, which is pretty common. Chrome dropping it didn't change that mapping.

I certainly was not viewing Gopher pages at the time they dropped gopher support. I was rather perplexed after updating when FTP didn't work. Turns out some downloads are still on FTP.

Proper solution is to direct the user of unknown protocol scheme to the vetted app store or a catalog.

But wait, Windows does that since Vista, except like everything it's faulty.

> (and let's be real: you don't)

OMG! Look, everyone: a telepath! ESP IS REAL!

There are lots of URI schemes in use. Firefox removing support for FTP doesn't mean that you can no longer open FTP links from Firefox, it just means that they'll need to open in another client. I don't see how this breaks the web.

I think it effectively means that for many. Unless there's a really easy-to-follow error page.

I tried chrome on an ftp:// uri, and it just does nothing. I suspect because it was the Windows default app for ftp uri's, then they dropped support, but that didn't change the mapping in Windows.

Which FTP client will most people see? i.e the one that's installed by default on most people's computers?

Agreed. There are old drivers from established vendors that only send drivers over FTP links.

It's an edge case these days though as more are moving to https:// links so I can understand the browser vendors wanting to make the code base smaller. They have enough to do. Especially for Mozilla given what they charge for us to use their product.

Maybe nice if they (Mozilla and/or Google) would make a site somewhat like https://webftp.dreamhost.com/ that would accept url parameters to sort of proxy ftp requests.

Wouldn't help for internal network ftp servers, but would ease the publicly accessible part.

(Note that the dreamhost site has a little link icon in the lower left that will generate a link/landing page with all the important bits filled out.)

Wouldn't make that security worse? Then any FTP connection would have to be proxied through a third-party, which has all opportunity to monitor or MITM the files. This in particular as FTP is often used to transfer non-public files.

Alternatively, Firefox could allow standalone clients to register for the ftp:// uri scheme (I think that's already possible) and, if no client is registered, redirect to some info page that explains the situation and offers links to standalone clients.

Perhaps if it only supported anonymous ftp. That's most of the links that will get broken. For that, there is no real security consideration. What exists is plain text all around with deliberately exposed passwords.

That is not what Mozilla is claiming:

> The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted.

I don't know how realistic that type of attack is and compromised authentication is likely worse, but both are cases that Mozilla cannot fix since they are inherent to the protocol itself.

I guess, but they aren't deprecating http downloads, which have the same problem as anonymous ftp.

For the majority of people, the lack of FTP support would go unnoticed so it is easy to depreciate and remove. I wouldn't be surprised if the same happens to HTTP (in general) once a certain threshold has been reached for HTTPS. I also wouldn't be surprised if they start adding warnings about insecure transfer methods for particular file types at a much earlier date.

>I can understand the browser vendors wanting to make the code base smaller.

That's an excellent point...

...So they'll be removing their builtin pdf viewer first then, right? That's a much much bigger chunk of code than an ftp client. Or are they both scheduled to be removed at the same time? I suppose that would be reasonable.

Mozilla did great decision for security: develop PDF viewer as pdf.js. It works same as other webapps so no longer considered to attack surface, not like integrated PDF viewer, IIUC.

You can configure Firefox to open "ftp://" links with the client of your choice. This is a non-issue.

>> You can configure Firefox to open "ftp://" links with the client of your choice.

My choice has always been Firefox.

Reply on news.ycombinator.com