Slashdot Mirror
Firefox Follows Chrome and Blocks the Loading of Most FTP Resources (bleepingcomputer.com)
Mozilla says it will follow in the steps of Google Chrome and start blocking the loading of FTP subresources inside HTTP and HTTPS pages. From a report: By FTP subresources, we refer to files loaded via the FTP protocol inside img, script, or iframe tags that have a src="ftp://". FTP links placed inside normal angle bracket links or typed directly in the browser's address bar will continue to work. The reasoning is that FTP is an insecure protocol that doesn't support modern encryption techniques and will inherently break many other built-in browser security and privacy features, such as HSTS, CSP, XSA, or others. Furthermore, many malware distribution campaigns often rely on compromising FTP servers and redirecting or downloading malware on users' computers via FTP subresources. Mozilla engineers say FTP subresource blocking will ship with Firefox 61, currently scheduled for release on June 26.
You know what would help getting your message across? Writing correctly.
How is it any easier or better to compromise an FTP server to serve "subresources" as opposed to a crappy WordPress or Drupal site running HTTPS?
There are still ftp servers. /s
Seriously, why not move to block HTTP traffic? It's not secure, it can serve malicious pages, and spoof real sites...
Google, Facebook, Amazon, Apple, Microsoft, and many others wish to end the hobbyist Internet.
FTP lacks cookies to track views. And FTP is hard for search engines to index with useful metadata for advertisers.
“Common sense is not so common.” — Voltaire
I'm not sure I grasp the logic of treating ftp distinct from http (no s) from a security perspective?
XML is like violence. If it doesn't solve the problem, use more.
Doesn't appear to be blocking <a href= tags, but rather things such as iframes that automatically load content.
There is no XUL, only WebExtensions...
The are not blocking you from links. Read again.
The Chinese, Russians, and Indians are constantly beating on my FTP server. Well, they would be if I hadn't GeoIP blocked them (proftpd module feature). Hopefully, not being able to use FTP sites as a pivot, their interest will wane (but I'm not counting on it). I dislike FTP's mult-port design, but it's got far more full-featured servers versus something like a web server will give you (compare ProFTPd with Apache - no contest for file service, not even at all close). I hope the newschool Internet folks will just stay on their smart phones and fuck off and forget FTP exists. The problem is that when masses of idiots decide something is "the new way" they will try crap on "the old way" despite it still being useful or even required. So, I expect ISPs will think they need to block it or whatever. If it won't load up with lynx/elinks then I'm not interested anyway, HTML stopped serving normal people and started serving corporations and graphic designers after HTML 1.1.
Doesn't appear to be blocking <a href= tags, but rather things such as iframes that automatically load content.
Regardless, Firefox isn't qualified to decide which of those things to load. I have several extensions loaded which handle that, because they are.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
FTP is an old and established protocol. And when is the last time you hard it causing major security problems? Seriously, this is breaking just for the sake of breaking stuff..
What took Google and Mozilla so long?
This makes no sense to me whatsoever. I fear there is a greater quantity of exploited HTTP(S) servers out there than FTP. Is this not akin to removing telnet from Windows? The loss of functionality does not match the gain in security (is there any?). Surely the first step should be to prevent malicious content, not prevent a protocol.
Are Mozilla thinking to block FTPS too? What about sftp (if it were ever to be introduced), would that count too?
If the argument is that the protocol is plaintext, then HTTP should be dropped.
Why UNIX?
Seriously...why do these people think it's their business to control the form of content displayed in their browsers?
Because the use of the protocol is inefficient, a stupid idea from the onset, and breaks compatibility with many security processes introduced in browsers over the past few years.
Even if it wasn't a security issue it shouldn't be allowed because it would be a stupid fucking idea like embedding the remainder of this post within a magnet link or some crap like that.
The browser's job is to display a page as written in conformance with standards. If the standards allow protocols besides http or https for fetching resources, then too fucking bad if the protocols are not to your liking, it's still valid.
browser security and privacy features, such as HSTS, CSP, XSA
I know HSTS and CSP, but what is XSA? Wikipedia says "Cross-Server Attack", but that is not a security feature.
And that is precisely the point. The HTTP standard says nothing about using FTP to fetch content mid page. That entire functionality is the curious quirk that started with a browser becoming an FTP client so that it could download files that were presented as links rather than having to open a separate app. It is not and was never meant to be in any way shape or form a way of delivery content within a page.
The standards don't allow for it.
The standards don't forbid it.
That doesn't mean we should just blindly do it because it makes no fucking sense, breaks attempts at preventing cross-site scripting, data injection and protocol downgrades, and above all it's the most laggy and inefficient way to fetch and display content. It doesn't break a standard, but it prevents standards from being implemented properly.
You don't need to turn anything off. Links to FTP not only will continue to work but they are actively improving FTP functionality within Firefox.
What is being blocked is just somet stupid idea that the occasional web designer who can't spell their own name thought may be a good idea when creating a page. Although really I prefer functionality that instead of blocking this, uses Facebook's data trove to identify them, and then call the men in white coats to put that developer in a room with pillows for walls because quite frankly if serving HTTP content via FTP isn't a sign of a serious mental conditions I don't know what is.