Firefox 90 will remove the code that provides support for FTP

Mozilla has decided to remove the built-in implementation of the FTP protocol from Firefox. The Firefox 88 release scheduled for April 19 will disable FTP support by default (including setting browserSettings.ftpProtocolEnabled to read-only), and the Firefox 90 release scheduled for June 29 will remove code related to FTP. When trying to open links with the protocol identifier "ftp://", the browser will call the external application in the same way as the "irc://" and "tg://" handlers are called.

The reason for the termination of FTP support is the insecurity of this protocol from modification and interception of transit traffic during MITM attacks. According to the developers of Firefox, in today's environment there is no reason to use FTP instead of HTTPS to download resources. In addition, Firefox's FTP support code is very old, creates maintenance problems, and has a history of finding a large number of vulnerabilities in the past.

Recall that earlier in Firefox 61 it was already prohibited to download resources via FTP from pages opened via HTTP / HTTPS, and in Firefox 70 rendering of the contents of files downloaded via ftp was stopped (for example, images, README and html files, and the dialog for loading the file to disk immediately began to appear). Chrome dropped support for FTP in the January release of Chrome 88. Google estimates that FTP is almost non-existent, with about 0.1% of FTP users.

Source: opennet.ru

Add a comment