Re: Call for Community Feedback: Retiring IETF FTP Service

Keith Moore <moore@network-heretics.com> Tue, 17 November 2020 05:25 UTC

Return-Path: <moore@network-heretics.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1913E3A0DF3 for <ietf@ietfa.amsl.com>; Mon, 16 Nov 2020 21:25:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=messagingengine.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j_Ogj05griD0 for <ietf@ietfa.amsl.com>; Mon, 16 Nov 2020 21:25:12 -0800 (PST)
Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9C663A0DEE for <ietf@ietf.org>; Mon, 16 Nov 2020 21:25:11 -0800 (PST)
Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id D58055C0220; Tue, 17 Nov 2020 00:25:10 -0500 (EST)
Received: from mailfrontend1 ([10.202.2.162]) by compute3.internal (MEProxy); Tue, 17 Nov 2020 00:25:10 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm1; bh=jlKs3JE42Pgg/WuKKd32c7Jev+1+3DPnoDfcEhtsW 9U=; b=l9KX50gQirGPMy23Dbk/47W6DzZPNusvYOBedPnhYvP3iuB+DzB1tuKc4 HGtHleAsXlBI86caZ7QTv6ABEbmzHzulntrMfbNG7k3zKrDvhWe2JKtrzg/6hnSg Yd27RIDsMzt0JbDSZjphS0+YMZyjHvT/9oQ998k8rDpJeTdpjuvK/9hTca/HTyXa iwwstILjKN56bDRC4soA5vDWiRxpQgxBDJC5JAk2Cz6tDDrTfq9GWCW5zYCnuVkv vOXBmxzeNwIcLateOBBEfQJA1KWZsDsqHXK322HI78LYaqQZ/f/VWHq2w5djifYp SoV9paKLu8rfNsQE00P1P7WE0vGhg==
X-ME-Sender: <xms:tl6zXxCHjGgCbxE8Esbn0qeIg86qiWhyxFJCMHbsxFbyLmmFJFJnCg> <xme:tl6zX_j942_djrmUhbM36A8i1hk7iMnuA95sCCvbrGXZWZgOAd3JXPmXtKz00ZrvJ 8-0QQ8VDA04fA>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedujedrudefvddgjedvucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepuffvfhfhkffffgggjggtgfesthekredttdefjeenucfhrhhomhepmfgvihht hhcuofhoohhrvgcuoehmohhorhgvsehnvghtfihorhhkqdhhvghrvghtihgtshdrtghomh eqnecuggftrfgrthhtvghrnhephefhuedtheefgfefgffhkeehgfeugfeiudeugeejkeef leelueeiffetfeeuudeunecukfhppedutdekrddvvddurddukedtrdduheenucevlhhush htvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmohhorhgvsehnvght fihorhhkqdhhvghrvghtihgtshdrtghomh
X-ME-Proxy: <xmx:tl6zX8lKQKKZjFKXY98H3f-kNqYyUcRfoT_YdS_DD6VZ7xPPgVP-8w> <xmx:tl6zX7zZv1wcbJVZgRZ9IT_K7yfuK9-AUkHVVdWbrzQejC32L4aqRA> <xmx:tl6zX2Rh4tgusqYsF2vC_AAMg75FoKCiMwnTQ-ZUu29mxY_5V_FGbg> <xmx:tl6zX9P3vDMuKtTAGfMQS3qjHExWJMiaMcDUG_zjMbWyWo3EKZp5sA>
Received: from [192.168.1.85] (108-221-180-15.lightspeed.knvltn.sbcglobal.net [108.221.180.15]) by mail.messagingengine.com (Postfix) with ESMTPA id 0F65E3280068; Tue, 17 Nov 2020 00:25:09 -0500 (EST)
Subject: Re: Call for Community Feedback: Retiring IETF FTP Service
To: Daniel Migault <mglt.ietf@gmail.com>, Adam Roach <adam@nostrum.com>
Cc: IETF Discussion <ietf@ietf.org>
References: <af6ab231024c478bbd28bbec0f9c69c9@cert.org> <0D41F3FD-BA1F-4716-A165-4FE7529431A9@vigilsec.com> <D26DCBB6-3997-4A73-BB46-867B4FD79BD2@eggert.org> <27b80ed2-76fb-aee7-f22d-de56019e9aa9@nostrum.com> <a8bdd67a-13ea-4433-aa38-9cfd48ea28da@network-heretics.com> <0e875497-9986-a0d9-8354-3eac26b7f882@nostrum.com> <CADZyTknX5=68YbmZTxOT6Ye=VeixgPzVM8P7tgjGPyP6WCtCfw@mail.gmail.com>
From: Keith Moore <moore@network-heretics.com>
Message-ID: <1dcf0656-501a-6228-e58d-e2543969ebe6@network-heretics.com>
Date: Tue, 17 Nov 2020 00:25:07 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <CADZyTknX5=68YbmZTxOT6Ye=VeixgPzVM8P7tgjGPyP6WCtCfw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/pt7c3rQsOrw2tv_fs_CaPRGwdXg>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Nov 2020 05:25:13 -0000

On 11/17/20 12:03 AM, Daniel Migault wrote:

> Putting opex aside, it seems to me that modern communications need to 
> be at least authenticated so ftp cannot stay as it is. I might be 
> missing something, but switching ftp to https seems to me quite 
> straight forward and at least much easier than switching to sftp or 
> ftps. Given the support of https versus ftp, I also believe reducing 
> the surface of attacks and relying on probably better maintained code 
> is probably a good switch. I believe that switching to https is a good 
> move

What I'm seeing are a lot of handwaving arguments and very little 
detail, and a lot of arguments of the form "it's quite straightforward 
for all clients to rewrite their code so we don't have to run a single 
additional server".

Sure, it's possible to use webdav instead of FTP, but I am not convinced 
that results in lower opex and it definitely requires significant 
changes on the part of clients.

By "authenticated" you're only talking about authenticating servers to 
clients.   That's not useless but I'm not aware of significant efforts 
or likely efforts to substitute bogus RFC content for genuine RFC content.

Keith