Mastodawn

Gibran Khan May 30

daniel:// stenberg://

Circa five years ago the browsers dropped FTP support.

#curl still supports it. In 2024, 23% of curl users said they used FTP within the past two years.

My post from April 2020:

https://daniel.haxx.se/blog/2020/04/15/curl-is-not-removing-ftp/

curl is not removing FTP

FTP is going out of style. The Chrome team has previously announced that they are deprecating and removing support for FTP. Mozilla also announced their plan for the deprecation of FTP in Firefox. Both browsers have paused or conditioned their efforts to not take the final steps during the Covid-19 outbreak, but they will continue … Continue reading curl is not removing FTP →

daniel.haxx.se

daniel:// stenberg://May 29

FTP is quite unique in the #curl collection of protocols due to its (weird) mandatory use of a separate TCP connection for the data transfer (and the fact that it can be setup in either direction, client to server or server to client) . It is complicated for users, for sysadmins and it is a complication in source code and internal curl TCP management as well.

So yeah, it also keeps causing us headaches to this day.

@bagder thanks for not removing FTP support!

@bagder I remember linux firewall fun with ftp back in the 2000s ... ipchains ...

@bagder you’re a true soldier 🫡

Räucherkäse May 29

@bagder Add TLS session reuse across the two TCP connections to the mix (to reduce the hijacking risk of FTPS data connections) and it gets even more complicated.
Does curl support this? This old mailing list post suggests it doesn't: https://curl.se/mail/lib-2017-05/0048.html

Curl: Re: TLS session re-use for FTPS data connection?

El Pamplina 🇺🇦 🇵🇸

@bagder I remember me using it in the 90s, and it was a mess with firewalled clients, setting up "passive" mode, and so on.

Thibault May 29

@bagder So, if I'm reading this right I can send a FTP request, in which case the server might do the TCP setup for me... or not ? Is it a random choice or is there a flowchart for which party starts talking first ?

daniel:// stenberg://May 29

@thibault the client decides by sending the correct command, PASV or PORT (or EPSV/EPRT in more modern FTP)

gabriele renzi May 30

@thibault @bagder
It's client controlled, in the '00s abusing this was a way to get P2P working from inside firewalled/NAT'ed networks (universities, some ISPs).

Chris O'Brien May 30

@bagder As someone who is implementing ftp support using libcurl *right now*, THANK YOU!

@bagder It's also older than TCP/IP, which shows when looking at rules like that.

@bagder thank you 🤝

@bagder I usually just use ftp 😅

Frank Gevaerts May 29

@bagder If you removed FTP I'd have to switch to gopher!

katch wreck May 29

@bagder nice... i still use it! :)

Sponge Of Density🏳️‍🌈May 29

@bagder Wow, I still use FTP pretty much every day

Phil Eichinger May 29

@bagder still one of the preferred ways to upload data to 3DS.

Joel Wirāmu, Pauling May 29

@bagder
What is super unfortunate is that the majority of help/guides still use FTP in them , when actually they mean SFTP and it confuses the crap out of people, and frustrates us who maintain projects that those guides are written for when users drop in to complain something isn't working. FTP IS NOT SFTP

Adam Katz May 30

@bagder while I'm not as much an expert on FTP as I am on SMTP and HTTP, I figure the browsers dropped support for five reasons:

FTP UI design was hard and highly un-weblike

Considerable codebase cruft could be removed

FTPS/SFTP is a mess and had migrated to SSH

Critical mass: this pushed admins to better tech

Google is driving and FTP can't have ads

None of these apply to curl (though I'm not sure about #2 & #3)

Kristof Provost May 30

@bagder Ceterum censeo FTP esse delendam.

@kp @bagder Invitus nemo rem cogitur defendere.

Jason Tubnor 🇦🇺May 30

@kp @bagder FTP needs to die. Can we just let it die? If we can’t, can #IPv4 die instead? FTP over CGNAT (or any NAT for that matter) is a complete shit show.

Kristof Provost May 30

@Tubsta @bagder I have too many horror stories of dealing with broken FTP servers or broken ALGs to disagree with you.
Buy me a beer at BSDCan and I'll tell you about the time uClibc broke curlftpfs for me. (It's a fun story, especially because this time it arguably wasn't uClibc's fault.)

Jason Tubnor 🇦🇺May 30

@kp @bagder I’d buy you a slab but I won’t be at Can this year unfortunately. It is always great to catch up with war stories.

Kristof Provost May 30

@Tubsta @bagder I have great war stories from that customer.
Well, two, really, but the other one ends with "So it turns out the CPU was broken".

Ben Zanin May 30

@bagder if curl ever dropped FTP support I can predict with certainty that three of Canada's five major banks would instantly have cataclysmic issues performing wire transfers.

Rob Russell May 30

@gnomon @bagder here to confirm it's actually five of six

Ben Zanin May 30

@oration @bagder are we counting the National Bank of Canada now?? At only 25 billion? Sure OK I guess

Rob Russell May 31

@gnomon @bagder I go by capitalization, they're at 75% the valuation of the next largest, but an order of magnitude larger than the next smaller.

And they're also really really really good at what they do good, even though that's different from what the others do good

Stewart Russell May 30

@gnomon this is disturbing, yet somehow slightly comforting.

It's a bit like discovering that every power station in Ontario relied on a comms board and failsafe protocol so old that the kit had "Northern Telecom" stamped on it

Ben Zanin May 30

@scruss @oration wait until you hear about the mainframe that holds the database containing like 60% of the mortgages in Canada

The one specific solitary mainframe machine

Stewart Russell May 30

@gnomon @oration insert "but with replication, right?" meme

Andreas Scherbaum May 30

@bagder What's your take, if curl ever removes FTP support how long until the protocol is basically dead in the water?