IETF Logo Mail Archive

Re: Call for Community Feedback: Retiring IETF FTP Service

Adam Roach <adam@nostrum.com> Tue, 17 November 2020 14:55 UTC

Return-Path: <adam@nostrum.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 024E53A13E2 for <ietf@ietfa.amsl.com>; Tue, 17 Nov 2020 06:55:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.079
X-Spam-Level:
X-Spam-Status: No, score=-2.079 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4NDazvmVXYlW for <ietf@ietfa.amsl.com>; Tue, 17 Nov 2020 06:55:18 -0800 (PST)
Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0EBF3A13E1 for <ietf@ietf.org>; Tue, 17 Nov 2020 06:55:18 -0800 (PST)
Received: from [172.17.122.52] (76-218-40-253.lightspeed.dllstx.sbcglobal.net [76.218.40.253]) (authenticated bits=0) by nostrum.com (8.16.1/8.16.1) with ESMTPSA id 0AHEtF2r090956 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Tue, 17 Nov 2020 08:55:16 -0600 (CST) (envelope-from adam@nostrum.com)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1605624917; bh=0NcCQf7yhX9rqRGooKwIqlncYB9naDKiL5vvhgcUbcQ=; h=From:Subject:Date:References:Cc:In-Reply-To:To; b=Aoalu2pwd/WPIEUyHzg8s6r/p8xi8k1NPTLk5++PwXECnNGQcUVKoKTZenN8uZqIp mwgrl9QP+zzR5sqchjAKd8yi/3H9U+UpKA4BpLndpuq3+nh9c+jMlTeXg2uUqIiej2 Ws2qCU3yQ+RLkbmQ9fF7HRPJEK9t43u9U8aA85sU=
X-Authentication-Warning: raven.nostrum.com: Host 76-218-40-253.lightspeed.dllstx.sbcglobal.net [76.218.40.253] claimed to be [172.17.122.52]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Adam Roach <adam@nostrum.com>
Mime-Version: 1.0 (1.0)
Subject: Re: Call for Community Feedback: Retiring IETF FTP Service
Date: Tue, 17 Nov 2020 08:55:09 -0600
Message-Id: <45DA9D81-E5FF-4440-BAAC-E271150D23C9@nostrum.com>
References: <01RS3W7DNPHA005PTU@mauve.mrochek.com>
Cc: ietf@ietf.org, Keith Moore <moore@network-heretics.com>
In-Reply-To: <01RS3W7DNPHA005PTU@mauve.mrochek.com>
To: ned+ietf@mauve.mrochek.com
X-Mailer: iPhone Mail (18B92)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/UaQ-E0UOV1qWtIn3ST4PvrJxHBQ>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Nov 2020 14:55:20 -0000

Yep. WebDAV is generally a configuration option on an existing HTTP server rather than a whole new server. There’s a chance that WebDAV-specific codepaths could enable some attacks that wouldn’t otherwise be possible, but the fact that the vast majority of its code is shared with the rest of the HTTP server’s functionality makes the chance of that happening minuscule compared to running a whole separate codebase.

/a

> On Nov 17, 2020, at 08:16, ned+ietf@mauve.mrochek.com wrote:
> 
> (3) There is concern over the attack surface of an FTP server, but in
>    practically the same breath (message) people are considering getting
>    back some functionality by deploying WebDAV.

v2.23.0 | Report a Bug | By Email