[Xitami] FTP problems

[Ewen McNeill]

In message <7DF4D412-FB6E-11D5-949F-0003933D8C18@mac.com>, Bruce Axtens writes:
>On Friday, December 28, 2001, at 04:04  PM, Ewen McNeill wrote:
>> Don't use FTP.  Use HTTP.  It's much cleaner.)
>
>Pardon my newbie-ness but, like, how?

HTTP uses a single connection from client->server for all transfers
(originally one per file transfered, but HTTP/1.1 allows more than one
file transfer per connection).  It can be easily proxied/cached, and easily
allowed specifically through a firewall.  All meta information is passed
in a clean, extendable, set of headers on the request and the response.

FTP uses two connections, a control connection and a data connection
(well, one data connection per file transferred).  The control
connection is used to set up the data connections, and no much else.
FTP has two modes: active FTP (the original) where the data connection
goes from sender to receiver (so if the server sends you a file, it
opens a connection back to you), and passive FTP (a later work around)
where the data connection goes from client to server (always).  

FTP picks the port numbers for the data port "at random" (some FTP
clients/servers can be told to be more specific, but in general you
can't assume what the port numbers will be).

So FTP is very hard to firewall.  A firewall at the client end will
generally break active FTP (won't allow the data connection to come
in), unless the firewall specifically knows about FTP and takes special
precautions.  A firewall at the server end will often break active FTP (if
the server isn't allowed to connect back out again), and will generally
break passive FTP as well (since it'll only allow incoming connections
to ports it knows about, and the data connections are chosen "at random").

FTP is also difficult to proxy (at least in the sense of a FTP proxy
that looks like a FTP server on one side and a FTP client on the other), 
since the proxy has to implement pretty much all of the FTP server
behaviour (cf a HTTP proxy which just passes the connections through
with some extra headers).

FTP has no reliable way to return date/time meta information about
files; each FTP client "guesses" this information from directory
listings, after having guessed what the directory listing format is.
HTTP specifically includes this information in its answer.  HTTP has a
"get if modified" request; the equivilent in FTP involves getting a
directory listing, guessing the format, guessing the details of the
file, comparing it with what you have, and hoping for the best.

There's plenty more.  But basically FTP was designed by a bunch of grad
students 20-something years ago making it up as they went along to solve
a much more general problem than was really required, in an environment
security and firewalls weren't an issue.  HTTP was designed more
recently (about 10 years ago), and is much more firewall friendly.

For single file transfers HTTP is more efficient (only one connection
setup); for multiple file transfers FTP doesn't look quite so bad, but
HTTP/1.1 keep-alive connections can give HTTP an edge even there.

Use HTTP.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com