Deprecate FTP support (deprecated)

https://www.chromestatus.com/feature/6246151319715840

by tannhaeuser • 6 years ago

53 93 6 years ago

metalliqaz• 6 years ago

"The current FTP implementation in Google Chrome has no support for encrypted connections (FTPS), nor proxies. Usage of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client. In addition more capable FTP clients are available on all affected platforms."

Says it all right there

tannhaeuser2• 6 years ago

Usage of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client

Investing into much more complex browser extensions such as eg QUIC has necessarily even lower usage. Basically, this rationale for removing FTP support is made up/self-delusional when the reality is that Chrome devs want to drop "legacy" features to focus on others.

perardi3• 6 years ago

That’s a powerful set of scare quotes around “legacy”. FTP, by any reasonable definition, is legacy, and if you need FTP, you have FileZilla, or the terminal.

matthewmacleod• 6 years ago

I guarantee more people use QUIC daily than use FTP.

pmarin• 6 years ago

tl;dr they can not put AdSense in a FTP server.

missblit• 6 years ago

In case it wasn't clear: deprecating FTP in Chrome was temporarily deprecated for awhile, but then that deprecation was deprecated. In the end leaving FTP in Chrome as deprecated.

pram• 6 years ago

depreception!

remote_phone• 6 years ago

“Deprecate” is the most misused technical word I’ve seen in the last 10 years. A whole generation of engineers seem to believe deprecate means to “remove support” or to remove entirely. Like “I just deprecated that function and deleted 100 lines of code.“

It actually means to “discourage use”. It’s the first step for a feature to be removed. You deprecate something and let the users know that they shouldn’t use it if possible and in the future it will be removed.

If you used a deprecated API, it means the API is no longer encouraged to be used, but it doesn’t mean the API is removed or that support is withdrawn.

jayflux• 6 years ago

You’re not wrong, but the definition seems to have stuck at this point (and it’s been used this way for a lot longer than 10 years, more like double that).

I think historically it comes from the fact that when someone “deprecates” their API, they usually abandon it at the same time (because it’s replaced) making the 2 actions synonymous with each other in the tech industry.

8note• 6 years ago

Descriptivist linguistics sucks though. If people are using it to say "withdraw support" or "removed" that's what it means

DaiPlusPlus2• 6 years ago

Good.

I think FTP is being kept-alive only by legacy fintech (doesn’t the US ACH depend on banks exchanging CSV or TSV files over FTP?) and low-end shared webhosting services that are too afraid to offer SSH to their customers.

But I don’t understand why FTP didn’t receive much love from the IETF+etc in the early 2000s to keep it relevant. I know many saw WebDAV as the future, but that was too idealistic imo. Why didn’t any of the FTP server vendors get-together to fix their collective shit instead of letting it die? (No, PASV-mode doesn’t count).

jjoonathan• 6 years ago

Why reinvent SFTP?

zrm• 6 years ago

The main reason is FTP is often used with untrusted external third parties and configured by enterprise IT staff who only half know what they're doing, and SFTP is really SSH. That makes it really easy to misconfigure it in such a way that the SFTP users can get a shell, which is a giant footgun.

Meanwhile the biggest problem with FTPS is just that people misconfigure their own firewalls to prohibit outgoing connections to arbitrary ports for no good reason. (Spoiler alert: All the bad outgoing stuff these days is on TCP/443). Which fails by getting your users to complain to you to fix it, instead of failing by silently giving attackers instant RCE.

hobs• 6 years ago

Also every enterprise business that I have heard of - FTP isnt going away anytime soon.

kstrauser• 6 years ago

I'm not sure what could have been done to make a new FTP that was better than SFTP. FTP had a couple of edge cases that were very nifty (like connect to server 1; connect to server 2; tell server 2 to listen; tell server 1 to send to server 2's port; voila, transfer from server1 to server 2 without ever transferring the data to your own host!) but I don't know that anyone ever actually used them.

SFTP came along as basically a working, feature-complete replacement. Once it became production-ready, I don't think there was anywhere for FTP to go.

wazoox• 6 years ago

Cross-sending is called FXP in video and is(was?) used extensively by all broadcasters, TV channels, etc. So much that it's a must-have functionality for any storage system in this domain.

yjftsjthsd-h• 6 years ago

I'm not sure what could have been done to make a new FTP that was better than SFTP.

Or HTTPS, IMO; it supports file download/upload, user/pass access control, and encryption. It's a little annoying to have HTTP subsume yet another thing, but it's actually pretty decent at this one.

skissane3• 6 years ago

SFTP came along as basically a working, feature-complete replacement

The FTP standard has a number of features that SFTP doesn't include, such as record-oriented file transfer (STRU R, MODE B), store-unique (STOU – you upload the file, the server picks the name instead of the client). Many of these features are rarely used, and many clients/servers don't even implement them, but SFTP is not a feature-complete replacement for FTP. But there are some environments (e.g. mainframe environments) where these features are used, and these feature gaps make it difficult or impossible to replace FTP with SFTP

tannhaeuser2• 6 years ago

I think the use case for WebDAV as an opt-in HTTP extension for managing files on a web server is different from FTP-in-browsers which I understand to be mainly FTP downloads rather than asset uploads.

kube-system• 6 years ago

It's definitely not just fintech. FTP is commonly used in any industry that complies with EDI standards... which is most of them. Back when EDI formats were first implemented, FTP was the gold standard for sending files across a network, and so that's what basically every large company implemented. Now, many years later, the network effect keeps those systems in place.

smitty1110• 6 years ago

I was using FTP in AdTech in Q2 of last year. We always had a bit of a chuckle when the onboarding client was so strict about security and obfuscation, but the platform they wanted the data deployed at didn't have any security for uploads. I've moved to a new industry, so I don;t know if this is still the case, but when I left the platform in question had no intention of changing.

skissane3• 6 years ago

I think FTP is being kept-alive only by legacy fintech (doesn’t the US ACH depend on banks exchanging CSV or TSV files over FTP?) and low-end shared webhosting services that are too afraid to offer SSH to their customers.

FTPS is still used in mainframe and minicomputer systems as well. This is because FTP has native support for transferring record-oriented files – STRU R and MODE B/C. Those features are generally not implemented by FTP clients or servers on Linux/macOS/Unix/Windows/etc. Unlike FTP, SFTP does not have native support for record-oriented file transfer.

I understand that GridFTP is still used in high-performance computing applications. GridFTP extends FTP with features such as parallel data transfers targeted at transferring massive data sets (terabytes, even petabytes in size) over very high bandwidth links. (Aspera performs better but is proprietary; GridFTP is an open standard with open source implementations.)

xab31• 6 years ago

It's still used quite heavily in research also (medical is what I'm familiar with). NCBI puts a lot of critical data on FTP, as do individual researchers.

In the case of NCBI, the actual transfer protocol usually used is Aspera, but you use the FTP server to find what files you are going to download using Aspera (which is CLI only AFAIK). Thus in this workflow, browser support for FTP is actually important.

I would say that the reason it hasn't changed is that it does its job fine. It serves files. It's one of the simplest ways to do so, and I lament that in my sphere the biggest apparent replacement is Dropbox. I agree with one comment above that "legacy" code for FAANG is apparently "features which we can't monetize".

diggernet• 6 years ago

...and centralize.

superkuh• 6 years ago

Browsers are slowly shifting away from being browsers and becoming exclusively locked down engines controlled by your feudal lord to run javascript applications.

bastawhiz2• 6 years ago

When was "being an FTP client" really ever criteria for being a web browser? Use the right tool for the job.

icedchai• 6 years ago

Early on, through the early 2000's, I'd say yes. ftp:// links were often posted on web sites. There was some expectation that clicking those links worked and would download a file. These days? Why bother...

lmilcin• 6 years ago

When was having support for JavaScript really ever criteria for being a web browser?

Long time ago there was no JavaScript and later it was still possible to browse Internet with JS disabled.

JavaScript is something that clients and content producers wanted, but is only necessary to realistically use web because content producers decide their content should not be accessible without JavaScript running in the browser.

I, personally, still use browser to access FTP resources because I only use them read only and because it is convenient to browse them the same way as similar resources but using HTTP.

tenebrisalietum• 6 years ago

I know there was at least one browser in the 90's that purported to be your one-stop shop for all things Internet - HTTP, email, and FTP client. When background Internet connectivity wasn't a thing that probably made more sense.

That being said as long as Chrome will launch an FTP client upon encountering ftp:// links, it's not a problem.

supertrope• 6 years ago

The general population doesn’t easily install software. They’ll just lose access to FTP. PDF viewers got integrated into browsers because some users don’t have standalone PDF viewers installed, or they were broken, or they couldn’t find the PDF they just downloaded.

Average people use what comes preinstalled. They might not be allowed to install software. Users get stranded on old versions that have to be supported. Install base, “it just works,” and lowest common denominator is crucial if you are working with anyone outside your household or organization. Internet downloads made software distribution much cheaper. App stores fixed the “first Google result is malware” problem. But people will still install an app at much lower rates than clicking something that loads in the browser.

FTP as a whole should be replaced but the average person doesn’t have an easy SFTP client installed.

marcosdumay• 6 years ago

Yet they all are.

There have been a long time since I saw any FTP link in a page that random people are expected to visit. I'm not sure anybody will miss this functionality.

About people that can't install software, those are probably behind a firewall that prohibits FTP too.

But anyway, browsers are paranoid about never breaking anything, so this is surprising.

pkulak• 6 years ago

You're not wrong, just totally off topic. :D

oscargrouch2• 6 years ago

IDK, we should think if we would think its reasonable to add SMTP or IMAP protocol support in browsers, or if this move would be perceived as misguided, by bloating even more with things that should otherwise be optionally implemented in other layers.

For me it just look like the right thing to do. I think we should be more suspicious when the parent company have some interest in deprecate some technology giving they interests clash with the technology being available or promoted.

FTP is becoming obsolete? yes

Google might have a clash of interest with some product over FTP? no

oxinabox2• 6 years ago

Does Windows Explorer still have a built in FTP mode? I think I first used it in Windows 98. And it was still there in Windows 7.

It could even do upload which I've never seen a browser offer.

AnIdiotOnTheNet• 6 years ago

Still there in 10.

anonymousiam3• 6 years ago

The security problems with FTP extend beyond plain-text authentication.

Back when MITM attacks were first becoming popular, FTP was a favorite target. Any executable or installer could be compromised to gain a foothold on the target system.

tambourine_man2• 6 years ago

The only Windows feature I’m jealous of.

oxinabox2• 6 years ago

I am sure I have done similar in one of the Linux file managers. Maybe Nautilus? Probably many.

Never tried in Mac/Finder

nashashmi2• 6 years ago

I am irate at this news. I know ftp is not secure. Not even by a small margin. It is just like http, back when you could still trust network engineers like you could telephone companies. But it is MAD useful.

Before file sharing went mainstream, before corporate networks allowed users to upload files to random websites, before file limits went away, before storage space became infinite, ftp was open and available to all people.

I actually had a client tell me that our corporate ftp server was blocked by their firewall. It turned out that they were just too lazy to type in the password. So I crafted a link with the password built in! That was how flexible ftp was!!!

And if I ever wanted someone to share files with me, I would send them the same ftp link with username and password built in, and tell them to paste it into windows explorer. And they could share files with me.

If the client wanted to send link to someone else for download, $he could!!!

That was how amazing ftp was. Everyone supported (except iOS). It was tried and proven.

I just don’t understand this idea behind letting it go.

ludamad• 6 years ago

Somehow I don't think crafting a link with a password in it is the best example for arguing for its place in the future :) What sort of migration effort does this cause you?

nashashmi2• 6 years ago

Migration? You mean what other services I can use? If I have a 4 gb file, few services allow me to transfer such a heavy file. And when they do, it’s possible my client has that service blocked from their corporate system. Plus very few services allow me to send my clients a link where they can upload to. Again, if they do, it is blocked.

Ftp is never blocked.

skissane3• 6 years ago

I know ftp is not secure

FTP isn't inherently insecure. The protocol supports TLS, Kerberos, GSSAPI. It is just that quite a few clients (including major web browsers) and servers don't implement those extensions, or even when they are implemented people don't know about them and don't use them. A lot of people are under the false impression that the only way to secure FTP is to move to SFTP.

userbinator2• 6 years ago

I still find useful things with Google searches that are hosted on FTP, so this seems very odd and unfortunate. I'd say the "file-based web" is still very much alive. A lot of those files I've come across (usually old software and docs) are unlikely to be found anywhere else, as I'm not even sure if archive.org archives FTP sites. IMHO this is a significant part of the Internet that must be kept alive, because it holds invaluable amounts of irreplaceable data.

causality0• 6 years ago

Not to mention all the cool stuff you could find by navigating up the directory listing.

surround2• 6 years ago

The Internet Archive is able to save FTP sites. I don’t know if they actively crawl for them, though.

dancemethis• 6 years ago

Please deprecate the term 'deprecate' in favor of the non-bullshit, sincere and direct "depreciate".

surround2• 6 years ago

I don’t think anyone here has mentioned that Firefox is also deprecating FTP.

arantius• 6 years ago

https://blog.mozilla.org/addons/2020/04/13/what-to-expect-fo...

vosper• 6 years ago

For the many people in this thread who seem to think somehow Google is single-handedly killing FTP everywhere for everyone, please refer to the first paragraph in the linked site. Here it is, for the lazy (emphasis mine)

Usage of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client. In addition more capable FTP clients are available on all affected platforms.

So chill, you'll still be able to get your stuff via FTP. They're not taking it out of search results or anything, and yes, maybe in 40 years people will still be using FTP for stuff. It's fine, you just won't be using Chrome for it.

johnklos• 6 years ago

Chrome is dumb. I feel bad for all you Chrome users who will end up assuming that Google's idea of the Internet is normal.

lgats• 6 years ago

Last I checked, chrome canary on Mac would prompt Finder to open any FTP links, completely removing any FTP action from chrome.

Deprecate FTP support (deprecated)

Related Stories