From owner-freebsd-current@freebsd.org Thu Sep 17 15:14:56 2020 Return-Path: Delivered-To: freebsd-current@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 896F33E3B5B for ; Thu, 17 Sep 2020 15:14:56 +0000 (UTC) (envelope-from rollingbits@gmail.com) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4BsgW351bpz46tk; Thu, 17 Sep 2020 15:14:55 +0000 (UTC) (envelope-from rollingbits@gmail.com) Received: by mail-qk1-x72f.google.com with SMTP id o5so2524455qke.12; Thu, 17 Sep 2020 08:14:55 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:mime-version:subject :from:in-reply-to:cc:date:message-id:references:to; bh=ExSnr9v1XwIvg2rDvTgv50p8qC4CMEmhix0QJdUJP5s=; b=mjHRLLaXKKUd4D7w6kbbFdyzvbxV/N8LcIRdHJcVNG0Z//pvQgXnC1/eEKNa8nTrwI QgjNME7xRwSiOWBTNOP3bxiAN6jMxecg2E/K3uJuHT5OQ7TIosWEy5Ldl6YT0vueiiN3 eMZcfFQlvFjfAB3wUrUozCk/JfCYNbjt9U6urrHtCbzvVmjMKmOZsFqOoxBamervxSww BW+3I8jyV3Hiqde/PAz7l1tf7DRmi6WrcQXW4ttM21ftC+Wj6ejBogWy8nihgaxK506X qFHPoRa+/dVa7drV0yqCJKgXpqlqO7ZUtrTW7RqRSPX9eem4dBoaDNDeWWcGy6XD1UZX R15A== X-Gm-Message-State: AOAM532ExfCQI3wqUG2G0B8jw8NJYskqBCc8FdZ/tg3qeeikR/MPYVET jzxRPQIH9z/4eB+kZQvH6Ekxpf9Qpmw= X-Google-Smtp-Source: ABdhPJwF6O7X1pEL2u8fwZwZy2z2PA/iC2LKdP5ZwGLeRiHCK+yJRHkXRy1rX9MUJy2ls5u6O+RbDg== X-Received: by 2002:a05:620a:cf6:: with SMTP id c22mr29231150qkj.190.1600355693290; Thu, 17 Sep 2020 08:14:53 -0700 (PDT) Received: from localhost.localdomain ([2804:389:2013:b260:812b:20eb:a949:c51a]) by smtp.gmail.com with ESMTPSA id q7sm22472113qte.95.2020.09.17.08.14.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 17 Sep 2020 08:14:52 -0700 (PDT) Mime-Version: 1.0 (1.0) Subject: Re: Deprecating ftpd in the FreeBSD base system? From: =?utf-8?Q?Lucas_Nali_de_Magalh=C3=A3es?= In-Reply-To: <202009171404.08HE4fZj007939@slippy.cwsent.com> Cc: Ed Maste , FreeBSD Current Date: Thu, 17 Sep 2020 12:14:49 -0300 Message-Id: References: <202009171404.08HE4fZj007939@slippy.cwsent.com> To: Cy Schubert X-Mailer: iPhone Mail (18A373) X-Rspamd-Queue-Id: 4BsgW351bpz46tk X-Spamd-Bar: -- X-Spamd-Result: default: False [-2.68 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; FREEMAIL_FROM(0.00)[gmail.com]; MV_CASE(0.50)[]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; RCVD_COUNT_THREE(0.00)[3]; TO_DN_ALL(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; NEURAL_HAM_SHORT(-1.17)[-1.166]; FROM_EQ_ENVFROM(0.00)[]; SUBJECT_ENDS_QUESTION(1.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; FREEMAIL_ENVFROM(0.00)[gmail.com]; MID_RHS_MATCH_FROM(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; ARC_NA(0.00)[]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20161025]; NEURAL_HAM_MEDIUM(-0.98)[-0.981]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; NEURAL_HAM_LONG(-1.03)[-1.035]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::72f:from]; RCVD_TLS_ALL(0.00)[]; MAILMAN_DEST(0.00)[FreeBSD-current] Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.33 X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2020 15:14:56 -0000 Hi. > On Sep 17, 2020, at 11:05 AM, Cy Schubert wrot= e: > =EF=BB=BFIn message om> > , Ed Maste writes: >> FTP is (becoming?) a legacy protocol, and I think it may be time to >> remove the ftp server from the FreeBSD base system - with the recent >> security advisory for ftpd serving as a reminder. >=20 > We should also deprecate the FTP client. >=20 > I've been advocating removing FTP (and HTTP) from libfetch as well. People= =20 > should be using HTTPS only. (libfetch could support a plugin that might be= =20 > supplied by a port should someone be inclined to write one.) I usually evaluate the possibility to interact with legacy stuff as a featur= e and then this would make FreeBSD shine less. The associated security impro= vement could be done in many different ways and this one is one of the worst= s. Maybe a warning during use or a flag to disable/enable it when desired or= needed? And among all the security measures the project can take to improve= FreeBSD security, this one is on the bottom of my list for sure. FTPD not e= ven comes enabled by default. --=20 rollingbits =E2=80=94 =F0=9F=93=A7 rollingbits@gmail.com =F0=9F=93=A7 rollin= gbits@terra.com.br =F0=9F=93=A7 rollingbits@yahoo.com =F0=9F=93=A7 rollingbi= ts@globo.com =F0=9F=93=A7 rollingbits@icloud.com