1707882 - suddenly, firefox will not open FTP sites, presents dialog to specify application to open ftp sites

Status: RESOLVED INVALID

(Core :: Networking, defect)

Description

[Ron Flory]

Attachment: Screenshot_20210427_073611.png

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0

Steps to reproduce:

specify URL to any open, anonymous-enabled FTP site.

Actual results:

Both Linux and Windows present a dialog "Choose an application to open the ftp link", with default choice being "Firefox". When I click on the "Open Link" button:

Linux: the same dialog is displayed again, forever. The FTP site is never accessed, opened, or displayed.

Windows: the display area goes blank white, the FTP site is never accessed, opened, or displayed.

** This is a serious bug, software developers often (must) use FTP for internal development, file repos etc. FTP is the most efficient protocol for large binary images, except for perhaps raw TCP sockets. This is failing for local servers on a closed, protected network.

Expected results:

As it has always done for years, the FTP site should be accessed, and a directory listing of the sites root FTP sandbox should be displayed.

As it has always done for years, when a FTP file link is clicked, the "Save File" dialog should be presented, to allow the user to download and save the file locally.

Comment 1

[Ron Flory]

(In reply to Ron Flory from comment #0)

Created attachment 9218635 [details]
Screenshot_20210427_073611.png

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0

Steps to reproduce:

specify URL to any open, anonymous-enabled FTP site.

Actual results:

Both Linux and Windows NOW present a dialog "Choose an application to open the ftp link", with default choice being "Firefox". When I click on the "Open Link" button:

Linux: the same dialog is displayed again, forever. The FTP site is never accessed, opened, or displayed.

Windows: the display area goes blank white, the FTP site is never accessed, opened, or displayed.

** This is a serious bug, software developers often (must) use FTP for internal development, file repos etc. FTP is the most efficient protocol for large binary images, except for perhaps raw TCP sockets. This is failing for local servers on a closed, protected network.

Expected results:

As it has always done for years, the FTP site should be accessed, and a directory listing of the sites root FTP sandbox should be displayed.

As it has always done for years, when a FTP file link is clicked, the "Save File" dialog should be presented, to allow the user to download and save the file locally.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[Francesco Lodolo [:flod]]

See the release notes for Firefox 88
https://www.mozilla.org/en-US/firefox/88.0/releasenotes/

Or
https://blog.mozilla.org/addons/2021/04/15/built-in-ftp-implementation-to-be-removed-in-firefox-90/

FTP support has been disabled, and its full removal is planned for an upcoming release.
Addressing this security risk reduces the likelihood of an attack while also removing support
for a non-encrypted protocol.

Comment 4

[Ron Flory]

wow, being soft-spoken as I can, that is a draconian over-reaction. It is one thing to present a warning "security advisory" dialog the first time such a site is accessed (just like Firefox does for a cert mismatch or expiry), but quite another to nuke a very useful, and often used protocol where I can't imagine the security risk to the client browser. remember, the credentials are simply "anonymous" and some bogus (not actual) email-address-appearing string. The risk is on the server side- which is an entirely different issue for public vs private engineering/development/home networks.

Comment 6

[Stefan Matthäus]

It's not resolved. Even big companies like HEWLETT PACKARD still offer important update files through FTP, see on ftp.hp.com.

Comment 7

[Ron Flory]

The decision for remove FTP client support must have been made in a vacuum. At first I thought this was a really sick April-Fools joke- it ain't funny any more...

Was a similar decision made to abandon support for plain "http://" on port 80 as well? Countless commercial/engineering/open-source support/development websites for firmware/software/data/etc. use (and will continue to use for many years) FTP as their primary/sole transfer protocol, and this neutering will make things so ugly for loyal users. I see no risk with an integrated FTP client (which is already implemented, and has been (still is) in use by thousands of users since before the old Netscape days)- seriously, what are the -actual- concerns?

I didn't complain when FTP-upload support was removed from Mozilla (a minor inconvenience), but this is just going too far...

ron

Comment 9

[Ron Flory]

This is becoming a real major pain. Now I can't use Firefox to access UEFI updates from AMI ... Also, firmware and SDKs updates from multiple chip-makers are now inaccessible through firefox...

Why do we feel it has become necessary to drive our development-users to use a different web-browser?