Komputilo

🦊 Firefox: FTP removido ∵ 🔓 inseguro

Firefox Release Notes: 90.0, July 13, 2021.

FTP support has been removed

Caitlin Neiman on Mozilla Addons Blog. What to expect for the upcoming deprecation of FTP in Firefox, Apr 13, 2020.

FTP [...] predates the Web and was not designed with security in mind. Now, we have decided to remove it because it is an infrequently used and insecure protocol. After FTP is disabled in Firefox, people can still use it to download resources if they really want to, but the protocol will be handled by whatever external application is supported on their platform.

Google Group mozilla.dev.platform. Thread Intent to unship: FTP protocol implementation, Mar 18, 2020.

We're doing this for security reasons. FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources. Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past.

We added the telemetry probes in bug 1579507 [1] to see how many users still use FTP. The usage was pretty low as you can see in bug 1570155 [2].

It's not right to waste smart network engineering time on decades old legacy code and it's likely even harder to justify a rewrite.

Christoph Kerschbaumer on Mozilla Security Blog. Blocking FTP subresource loads within non-FTP documents in Firefox 61, May 7, 2018.

The File Transfer Protocol (FTP) [is] one of the oldest protocols in use today and has a number of security issues. The fundamental underlying problem with FTP is that any data transferred will be unencrypted and hence sent across networks in plain text, allowing attackers to steal, spoof and even modify the data transmitted. To date, many malware distribution campaigns rely on compromising FTP servers, downloading malware on an end users device using the FTP protocol. Further, FTP makes HSTS protection somewhat useless, because the automated upgrading from an unencrypted to an encrypted connection that HSTS promises does not apply to FTP.

blog