Re: Call for Community Feedback: Retiring IETF FTP Service

"Theodore Y. Ts'o" <tytso@mit.edu> Tue, 17 November 2020 16:04 UTC

Return-Path: <tytso@mit.edu>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 124713A1467 for <ietf@ietfa.amsl.com>; Tue, 17 Nov 2020 08:04:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T3Nu7RFQRLRT for <ietf@ietfa.amsl.com>; Tue, 17 Nov 2020 08:04:53 -0800 (PST)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 060463A17EA for <ietf@ietf.org>; Tue, 17 Nov 2020 08:03:31 -0800 (PST)
Received: from callcc.thunk.org (pool-72-74-133-215.bstnma.fios.verizon.net [72.74.133.215]) (authenticated bits=0) (User authenticated as tytso@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 0AHG3Txm028056 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 17 Nov 2020 11:03:30 -0500
Received: by callcc.thunk.org (Postfix, from userid 15806) id ADF75420107; Tue, 17 Nov 2020 11:03:29 -0500 (EST)
Date: Tue, 17 Nov 2020 11:03:29 -0500
From: "Theodore Y. Ts'o" <tytso@mit.edu>
To: Keith Moore <moore@network-heretics.com>
Cc: Daniel Migault <mglt.ietf@gmail.com>, Adam Roach <adam@nostrum.com>, IETF Discussion <ietf@ietf.org>
Subject: Re: Call for Community Feedback: Retiring IETF FTP Service
Message-ID: <20201117160329.GB445084@mit.edu>
References: <af6ab231024c478bbd28bbec0f9c69c9@cert.org> <0D41F3FD-BA1F-4716-A165-4FE7529431A9@vigilsec.com> <D26DCBB6-3997-4A73-BB46-867B4FD79BD2@eggert.org> <27b80ed2-76fb-aee7-f22d-de56019e9aa9@nostrum.com> <a8bdd67a-13ea-4433-aa38-9cfd48ea28da@network-heretics.com> <0e875497-9986-a0d9-8354-3eac26b7f882@nostrum.com> <CADZyTknX5=68YbmZTxOT6Ye=VeixgPzVM8P7tgjGPyP6WCtCfw@mail.gmail.com> <1dcf0656-501a-6228-e58d-e2543969ebe6@network-heretics.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <1dcf0656-501a-6228-e58d-e2543969ebe6@network-heretics.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/eFuGYTJh66xcKtTKxduGuU9zdD8>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Nov 2020 16:04:55 -0000

On Tue, Nov 17, 2020 at 12:25:07AM -0500, Keith Moore wrote:
> What I'm seeing are a lot of handwaving arguments and very little detail,
> and a lot of arguments of the form "it's quite straightforward for all
> clients to rewrite their code so we don't have to run a single additional
> server".

So I don't really care *all* that much, but to be fair, there have
been some hand-waiving arguments on both sides.

The most common way that *I* would write scripts to download files,
going back at least ten years, using ftp is to use either curl or wget
--- and both of those scriptable, command-line tools support both http
and ftp.  So transitioning such scripts to use http versus ftp is not
hard, and given the problems with NAT boxes, I would have transitioned
over my scripts using wget or curl to use http a long time ago.

And while it is true that the http *protocol* has been evolving, it is
*not* a "user interface"; it is a protocol which supports user
interface programs, and as a protocol there has been quite good
backwards compatibility, since people (especially in government) have
insisted on running Windows 95 long past when it was safe and sane to
do so (speaking as someone whose SF-86 was compromised as a result),
and so web servers will support ancient http clients without any
issues that I'm been made aware of.

So the argument that http is "unstable" and so we should stick with
supporting a file transfer protocol invented in the 197o's because it
is somehow more "stable" is also, in my opinion, full of hand-waving.

Cheers,

						- Ted