Hacker News Reader

Comment by kccqzy | Hacker News Reader

No one really uses FTP to transmit anything secret or confidential. Most of the time the password to that FTP server is just "guest" and the same file can also be retrieved by HTTP without authentication.

View on HN

I work at a bank (opinions my own) and nearly everything we do (including modernization, but especially partnership communications) is FTP-based. It's just about the only real standard available when the code is older than most of the devs. We do use modern encryption and mutual TLS to authenticate and encrypt everything, including before password transmission when that's even an option, but FTP is still the backbone of a ton of big older businesses.

I too work at a company/in an industry where FTP (incl. sftp/ftps) is still crucial, for both inbound and outbound transfers. A great many of our partners would find using other protocols more cumbersome. Automating the download/upload of entire directories of arbitrarily named files seems considerably easier/to require less code than any solution over HTTP might (log in, perhaps change directory, `prompt`, then `mget/mput *`). Albeit I've not done much research into alternative means recently, but a dedicated protocol beats a hand rolled solution and anyway inertia is strong - especially as (for us) nothing is transferred in either direction that isn't destined to be made public by one party.

This is tangential to whether support for FTP is still worth keeping in a web browser, mind.

SFTP is different from FTP, though. As far as I know, it's a fine protocol.

Lots of SFTP clients are good at mput.

If we're limiting ourselves to HTTP, WebDAV is pretty nice and has builtin support across Windows, Mac, and most Linux distributions.

You're probably using dedicated FTP clients, right? FTP browsing on a web browser is a hack. Uploading files, downloading multiple files at a time, doing _anything_ is just pure pain.

That is inaccurate, banks heavily use ftp. Probably not a world that many here are exposed to, but it's very normal in the financial space

As is staying on IE6 for ten years longer than decency allows for.

> Most of the time the password to that FTP server is just "guest" and the same file can also be retrieved by HTTP without authentication. reply

So...no reason for FTP in the browser, since it already supports HTTP?

Once every site serving FTP makes their files available on HTTP, sure.

I guess many old website maintenance workflows still rely on ftp'ing HTML and assets to the web server (though not through browsers). I personally have recommended clients to switch over to ssh/scp 15 years ago if they can help it but their hosting package might not support it. The optimal, made-for-purpose protocol for this use case is WebDAV but I'm not sure it's still supported out-of-the-box by all major OSs and/or hosting packages.

You know what is a made for purpose protocol for transferring files? The File Transfer Protocol.

Ok :) but WebDAV has the advantage that it's integrated with .htaccess permissions on Apache shared hosting.

Ugh... WebDAV itself is a nasty can of worms, full of half-assed optional extensions and specification warts.

You would think that no one would, in 2019. I hope that you never have to witness otherwise.

Reply on news.ycombinator.com