Firefox drops support for FTP URLs (And Chrome already did)

Frank da Cruz
27 April 2021
Last update: Thu Jul 29 08:23:50 2021

The last week or two I noticed some strange behavior in Firefox when I clicked on an FTP URL. Then Tuesday, 27 April 2021, FTP URLs didn't work at all. Apparently this has been true for Chrome also for quite some time but I wouldn't know because Chrome hasn't worked at all on my PC for over a year, it just says "Aw, Snap!", no matter how many times I uninstall, download a new copy, and reinstall it*. Anyway, the Kermit websites (both this one and the original one at Columbia U) are full of FTP URLs, about 10,000 at each site, so this is kind of a disaster, especially since the Columbia site is "frozen" and can't be changed. I looked in Google and found these two blog pages at Mozilla on the subject:

• What to expect for the upcoming deprecation of FTP in Firefox (13 April 2020)
• Built-in FTP implementation to be removed in Firefox 90 (15 April 2021)

The first post is closed to comments. The second one was open, so I posted the comment shown in the grey box below. Mozilla said "[Your comment is awaiting moderation.]"  As of the "Last update" above, It's still awaiting, so apparently they're not interested.

The entire Kermit Project website will likely have to be redone (along with every other website in the world that has FTP links) but that will take time. Meanwhile, Mozilla (maker of Firefox) recommends that users who want to follow FTP links find an "FTP helper app" for Firefox (next section).

*	Although FTP is disabled as of Chrome 88 of 19 January 2021, it can be re-enabled by each user; search Google for instructions. Also see "Deprecate FTP Support" at chromestatus.com for their rationale, which is basically the same as Firefox, but Firefox offers no way for users to re-enable FTP.

Update 29 April 2021 - FTP helper apps for Firefox on Windows

I was hoping there would be a way to not only make FTP downloads work again, but also to get the kind of file lists that an FTP server sends when you give it a path to a directory full of files, rather than directly to a single file. I was already skeptical because I tried this with wget on Linux and it created an HTML file on my computer that contains FTP links to each file. Whereas the browser's built-in FTP client printed the list on the screen, with each filename being a link that can be clicked on to download.

FileZilla

First I tried installing FileZilla on Windows 10. It has three choices, the free FTP-only version, the FTP-only version with manual ($4.99), and the premium version. I tried the FTP with manual, but the PayPal button didn't do anything. So then I tried the free version. The installer downloaded but when I started it, it didn't know where to install itself (the default "folder" was "https://filezilla-project.org/", which is a URL, not a folder). So basically, each step of the download and install process had problems. I gave up.

Wget

Then I tried Wget for Windows, which installed itself as:

C:\Program Files (x86)\GnuWin32\bin\wget.exe

No icons or shortcuts were to be found anywhere. I created a shortcut and dragged it to my desktop. Clicking on it didn't do anything. In a Powershell window, if I type "wget --help" (which produces the expected help message on Linux), it says:

wget : The remote name could not be resolved: '--help' At line:1 char:1 + wget --help + ~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt pWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe ll.Commands.InvokeWebRequestCommand

Back in Firefox, I tried clicking on an FTP link in one of the Kermit pages. Firefox told me to choose an FTP Helper program and I put wget.exe; it seemed to "take" and then a black CMD window popped up for about one second, but the file was not downloaded. Repeated attemps allowed me to read what the window said, which was about what you might expect from an FTP client:

Connecting to kermit.columbia.edu[128.59.44.55]:21...

but then it disappeared immediately with no error message, no download, nothing. No result appears in Firefox's download menu and the file was nowhere to be found anywhere on the computer. Each attempt failed in the same way.

So I'm sorry, I don't see a way to install an FTP helper for Firefox. If anybody out there succeeds in doing it, please let me know and I'll document the procedure here. Meanwhile I'll see what I can do about converting the 10237 FTP URLs at kermitproject.org to HTTPS. But of course many of them are to directories, not single files, and there is no HTTP equivalent for that. Life in the 21st Century.

Blog.mozilla.org posting of 27 April 2021

I don't follow the Mozilla discussions and groups, I just use Firefox all day every day to do my work. Suddenly, today FTP links are broken. A Google search reveals the discussions about this on blog.mozilla.org.

I'm the founder of the Kermit Project, which has been going for forty years now. It has a huge archive of software and related documentation and other materials accessed by FTP. The idea that FTP should be "deprecated" because it's "insecure" or "old" and "nobody uses it any more" could not be more wrong.

Here is the Columbia University Kermit Project website:

http://columbia.edu/kermit/

When I was laid off in 2011 my access to it terminated; the Columbia Kermit website and software archive are "frozen" forever by terms of the separation agreement. This website has 9542 ftp links. In 2011, I opened a new Kermit Project website here:

https://www.kermitproject.org/

Here is the software archive page:

https://www.kermitproject.org/archive.html

94.5% of the links are back to the archive at Columbia (I can't move the whole archive to the new site for reasons that are not relevant to this discussion). The new Kermit project serves about 500 FTP requests per week, and the Columbia Kermit site probably many more because 99% of the archive links go back there (Columbia won't show me the web stats).

The new Kermit website presently has 10237 ftp links. I could spend a month changing them, but why should I have to? Especially since FTP has well-known capabilities that HTTP lacks:

1. If an FTP link resolves to a directory name, the browser shows a list of the files in the directory so the user can click on individual files to download. I make extensive use of this feature in the archive page (in the last column of each row: "file list").
2. FTP URLs can include wildcards, so people can download a group of files in a single operation, like *.txt or *.[ch]. HTTP can only do one file at a time, forcing websites to put files into Zip or Tar.gz archives for no good reason.

In any case, the old Columbia website still gets about the same amount of visitors as the new one, because people have been using it for 30 years, and potentially millions of Web pages all over the planet link to it.

As to security, all the Kermit Project links are anonymous FTP GETs; no sensitive information such as user IDs or passwords is transmitted. If you want to ban non-secure ftp authentication, fine, but anonymous non-authenticated ftp downloads are a fundamental feature of the Internet and, before it, the ARPANET. How many millions of websites have you broken by removing FTP support?

And finally, how is a Firefox user supposed to retrieve a file by clicking an FTP URL? Firefox pops up a new dialog saying "Choose an application to open the FTP link". In Windows 10, the only choice is the Windows FTP client. I tried this; Firefox starts Windows FTP using the FTP URL as the command-line argument, e.g.

ftp ftp://ftp.kermit.columbia.edu/kermit/test/bin/msk316.zip

Well, the ftp app doesn't understand URLs, it wants an IP hostname or address on the command line. So your Windows-based users are totally locked out. Surely you don't expect them to start ftp in a Command window and type in lots of commands they don't know? (Granted, the situation is probably better in Linux and MacOS, where they can use wget, and I suppose EACH AND EVERY Windows user could download and install wget if they knew about it, but they don't).

So in short, there is absolutely no benefit in removing FTP URL support from Firefox, only a world of trouble; you are literally breaking billions of links in the pages you show to your users.

Frank da Cruz
The Kermit Project, NYC
fdc@columbia.edu
27 April 2021

---