Stopping FTP support in Firefox 90

I don&#x27;t understand all the negativity around this. People complained when Firefox added Pocket, in part because they took a browser extension and made it a feature that was ostensibly unrelated to web browsing. Now they&#x27;re taking an old feature that&#x27;s <i>definitely</i> not related to web browsing and removing it, and people are still complaining?<p>Firefox can&#x27;t be everything. It should focus on being a great browser and not a great browser and also great FTP client, or a great browser and also a great feed reader, or a great browser and also a great mail client. People using FTP can use a dedicated client, of which there are plenty on every platform, and people who don&#x27;t use FTP (i.e. the vast, vast majority of web browser users) won&#x27;t even notice.<p>A modern web browser is probably some of the most complex software humanity has invented yet, besides a full-scale OS. Taking a maintenance burden that&#x27;s unrelated to the core browser product of a struggling NFP should be welcomed with a sigh of relief.

&gt;If you are a Firefox user, you don’t have to do anything to benefit from this security advancement.<p>The epitome of corporate speak: &quot;we&#x27;re taking away a feature of this software. You&#x27;re welcome.&quot;<p>I expect that kind of talk from Google; hearing it from Mozilla makes me a little sad.

Lots of places like US federal institutions or universities use FTP to this day to distribute their open datasetes.<p>Show me an example of actual FTP MITM hack in the wild.<p>Sure loading FTP resources from HTTP(S) context is not a good idea (as would be downloading executables over FTP), but did they actually make any effort to inform the public and owners of FTP servers? I do not think so, I haven&#x27;t seen it.<p>Mozilla these days has very weird priorities. Their decisions should not feel so unilateral or &quot;because Chrome does it&quot;. There should be more emphasis on widely understood infrastructure even at the cost of &quot;soft&quot; projects&#x2F;campaigns [1] - these could be served by the EFF after all. I can&#x27;t understand why shedding MDN was a good idea in their heads.<p>[1] Like this one: <a href="https:&#x2F;&#x2F;foundation.mozilla.org&#x2F;pl&#x2F;blog&#x2F;mozilla-investigation-youtube-algorithm-recommends-videos-that-violate-the-platforms-very-own-policies&#x2F;" rel="nofollow">https:&#x2F;&#x2F;foundation.mozilla.org&#x2F;pl&#x2F;blog&#x2F;mozilla-investigation...</a>

Reminds me of Apple removing the headphone jack and being so proud of themselves for &quot;being brave&quot;.<p>Just yesterday I found a link to FTP while researching something. Was pretty annoying to go get another FTP client up and running to get it.<p>Anyway, the movement away from unencrypted protocols to TLS-only is moving us closer to a fully censored internet. Sure, an unencrypted internet did not have any integrity guarantees, and thus was easy to censor (and worse) by totalitarian nation states.<p>However, a TLS-only internet is very easily censorable by our new global central planners (FAANG). This way, they&#x27;ll have much more control than was available to the common MITMing nation state.

Let&#x27;s look at this from the other end of the horse.<p>FTP is a horrible kludge that needs to be depreciated. SFTP is better. The number of ports needed, holes punched in firewalls, everything sent in plain-text, inability to traverse NAT without more kludge and hacky work-arounds. We only tolerate it because it was the only thing that worked.<p>There are better&#x2F;newer methods that should be embraced.<p>We don&#x27;t bemoan the death of Gopher, or Finger do we? Hell no. FTP does have it&#x27;s uses, but I&#x27;d dare wager that every-single-instance could be upgraded to SFTP and the world would move on.<p>Legacy, ancient apps that haven&#x27;t been touched in 40 years; will break. Let them.

It&#x27;s unfortunate that this had to happen, but the landscape around FTP is increasingly unexamined and part of a dead era. The effort required to build in robust SFTP support as well as convert existing FTP users to it is non-trivial, and not within the charter of a modern web browser.<p>It&#x27;s sad, but not surprising.

&gt;&gt; To date, many malware distribution campaigns launch their attacks by compromising FTP servers<p>Yes.. well, they can do the same by compromising servers that offer the payload via HTTP(S). At least when the payload is ftp, it stands out and you can catch it in your gateway&#x2F;firewall devices.<p>With https you now need https inspection at the border in order to be able to do that. These MITM devices do tend to cause a lot of trouble.

psa: windows explorer.exe, macos finder, and gnome nautilus &#x2F; kde dolphin all support connecting to an FTP server.<p>explorer: right click &quot;my computer&quot; -&gt; map network drive. (or just ctrl+L and type an FTP url.)<p>finder: go -&gt; connect to server<p>nautilus&#x2F;dolphin: network -&gt; connect to server (or just ctrl+L and type an FTP url.)

This is frustrating. FTP is really handy for distributing some files and there are lots of servers in place that now Firefox users can’t access.<p>One can argue that servers should upgrade, and that’s valid. But they don’t and they likely won’t do this just harms Firefox’s user base and is one more reason I no longer recommend Firefox. They just don’t seem user friendly as they once were.<p>I would expect Mozilla to advocate for more FTP as a cheap way of distributing files.

This makes a little sad, but only a little. I honestly do not remember when I last accessed an FTP server from a browser.<p>I do use FTP every now and then, but I do so from the command line or file manager like mc (or far manager when I am on Windows). Even there, it has been declining steadily, though, because ssh&#x2F;sftp works pretty well as a drop-in replacement, unless one of the endpoints is <i>so</i> low-end the encryption becomes a throughput bottleneck. But it&#x27;s been many years since I&#x27;ve had that problem.

I think this is a bad idea - many URLs are encoded as ftp still, e.g. when downloading tarballs, zips and such - does this mean clicking on an FTP URL now will require launching an external ftp app instead of downloading the file? I&#x27;m ok if FTP browsing is suspended through the browser, but abandoning FTP altogether in the browser is a bad idea. It&#x27;s an old protocol and still very useful, albeit not in its unencrypted state maybe, but it does do a good job of what it&#x27;s supposed to - namely, transfer files.

Mozilla is the last organization keeping us from the complete takeover of the web by Google&#x2F;Webkit and they seem to be held to an impossibly high standard by users. There&#x27;s no FTP support in Chrome, there&#x27;s terrible support for Adblock, there&#x27;s telemetry, etc, but somehow Mozilla has to be 100% perfect.<p>This is why we can&#x27;t have nice things and why the internet is going to become Chrome-first.

I expect this to have very little impact on anything.

FTP might be dying in other sectors, but at least in biomed research, I would use FTP anyday when the alternative protocol needs a client app and a bunch of configurations. It&#x27;s also handy when sharing data.<p>Browser support is important here because those files are often not explored from command line etc, but rather the FTP links are placed on individual pages as a quick download. At least for me, it&#x27;s much more convinient to click and wget, than reading a page then switch window to query from API&#x2F;client...

I am a head of team of 20+ brilliant software engineers, who doing great things on a daily basis. When I being asked &quot;What kind of code do the best of your team are writing?&quot;, here&#x27;s a canned response: &quot;The best engineers are deleting code, not writing it&quot;.<p>For software project with size and age of Firefox, deleting obsolete or redundant code is universally good. It is hard but necessary task. I am okay with completely stop using FTP for that cause. Or eventually fire up Chrome FWIW.

I remember way back in the day with ftp.cdrom.com [1] this was an important browser feature. Nowadays this is totally pointless and mind-boggling that anyone still uses FTP at all (SFTP should be used now). And more-so http is resilient for resumable file downloads with range header requests. Also people can develop an extension.<p>1 <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Walnut_Creek_CDROM" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Walnut_Creek_CDROM</a>

Didnt Chrome remove ftp first. Is Firefox just following suit. Need to check.<p>Mozilla&#x27;s explanation&#x2F;justification here for removing ftp is quite flimsy. It presumes there could never, ever be any possible situation in which a user wants to use a browser for ftp. Whether now or in the future. It just does not add up. There are no specific references to ftp-based exploits, or other examples of how ftp is harmful. Who uses ftp for transfers of unencrypted files containing sensitive data over the open internet. ftp can be useful for stuff that is not sensitive and for transfers over the local network between devices (no internet connection required).<p>It makes sense to remove ftp if the web is just for advertising and sales. Why would any &quot;consumer&quot; need ftp.<p>Fortunately the text-only browser I use is probably not going to remove ftp. But any decline in ftp use that results from the decisions of these advertising-dependent organisations is concerning.

I’d be interested if anyone here uses this feature, and if so what the use case is?<p>This decision seems like a no-brainer, but I’ve found I’m always surprised how much use legacy features like this can have.

A friend asked me to help him to setup a FTP server for his b2b product a few weeks ago: Client just wanted that lolz.<p>Luckily I could convince him to use ProFTPD with sftp <a href="http:&#x2F;&#x2F;proftpd.org&#x2F;docs&#x2F;contrib&#x2F;mod_sftp.html" rel="nofollow">http:&#x2F;&#x2F;proftpd.org&#x2F;docs&#x2F;contrib&#x2F;mod_sftp.html</a> . This is very neat as the service runs on their own ssh-alike port.

I know there is lots of negativity about this - but I&#x27;m glad Mozilla has taken a principled stand. FTP is dangerous. Kill it with fire.

Firefox 90 has terrible usability with the new &quot;Photon&quot; interface. Has no one read <i>The Design of Everyday Things</i>? I just don&#x27;t understand what they&#x27;re trying to do - they need to keep and increase their userbase, not push away the few users they have left.

I&#x27;m fine with this. Now if Chrome and Firefox would just add native RSS reading...

With the way Mozilla’s management has been going, they might as well stop HTTP support as well :^)

https beat up usenet and now ftp.

Mozilla leadership really wants to kill Firefox.

FTP is dead. ycombinator killed it. Thanks, dropbox.<p>the sheer lack of awareness here sometimes, I swear.