Re: Call for Community Feedback: Retiring IETF FTP Service

[Keith Moore <[e-mail]>]

On 11/17/20 9:53 AM, Livingood, Jason wrote:

> Personal views - no hats.
>
> Time to retire the FTP service, just as other legacy protocols have been retired in the past. The IETF does not shy away from recommending that others encrypt everything, so we should take our own advice. As well, data clearly show there remains essentially no demand for FTP - users have adopted the HTTPS alternative.
I cannot say this often enough:   Traffic volume is not an indicator of 
importance.
>
> More detailed rationale:
> - Clearly the market has moved on. It does not cross the cost/benefit threshold to continue maintaining a service for so few connections (that all appear to be scripted machine-to-machine).
There is not one "market".   FTP is a different service than the web, 
with distinct advantages over the web.   And traffic volume is not an 
indicator of importance.
> - FTP support has been removed from browser clients. As Mozilla wrote, "FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources."
I personally find that unfortunate, but support in browser clients is 
not an indicator of FTP's utility either.   One reason to use FTP is 
that browser clients are really poor tools for some kinds of file 
transfer, especially if you want to transfer multiple files with minimum 
human interaction.
> - It is not encrypted. The IETF & IAB have been aggressive in pushing for pervasive encryption [1] so it is illogical that we would not make such a change on our own information resources. Per the IAB, "The IAB now believes it is important for protocol designers, developers, and operators to make encryption the norm for Internet traffic."

"the norm" != "required".   I'd be happy to see a version of FTP that 
supports encrypted transmission as an option, as long as it were 
optional.   (Are those web browsers that are deprecating FTP also 
deprecating HTTP without TLS?)

And as Ned pointed out, there are still reasons to use unencrypted 
transmission on occasion.

Also, perhaps the IETF and IAB should be a bit less dogmatic, in light 
of experience.  I keep seeing situations in which deprecation of old TLS 
versions is breaking systems for which there is no browser that supports 
the new TLS versions.  IMO this does significant harm.   I realize some 
people believe in planned obsolescence, but I don't think they have a 
good case.

Keith