Back door in ProFTPD FTP server (The H)

Posted Dec 6, 2010 3:27 UTC (Mon) by cmccabe (guest, #60281)
In reply to: Back door in ProFTPD FTP server (The H) by HenrikH
Parent article: Back door in ProFTPD FTP server (The H)

FTP doesn't even *have* a standard for directory listing. The closest thing it has is the LIST command, which returns a bunch of totally free-form text. Want to display that to the user in a graphical form, or use it in some kind of scripting context? Good luck-- you'll have to write N different parsers for your favorite N different ftp servers.

Back door in ProFTPD FTP server (The H)

Posted Dec 6, 2010 17:46 UTC (Mon) by zlynx (guest, #2285) [Link]

I had to do that one time. It was only three parsers for me because that covered most options.

I believe it was Windows IIS, Linux (all the FTP daemons seemed to just use ls format) and I think BSD had one just a little different.

Back door in ProFTPD FTP server (The H)

Posted Dec 6, 2010 21:13 UTC (Mon) by marcH (subscriber, #57642) [Link] (2 responses)

> FTP doesn't even *have* a standard for directory listing. The closest thing it has is the LIST command, which returns a bunch of totally free-form text.

At least it has the command.

> Good luck-- you'll have to write N different parsers for your favorite N different ftp servers.

It is probably not very hard considering I never met nor even heard about this problem before now.

Back door in ProFTPD FTP server (The H)

Posted Dec 7, 2010 13:30 UTC (Tue) by jond (subscriber, #37669) [Link] (1 responses)

With all due respect, it's clearly a massive whole in the FTP spec, and another key example of how not to design a protocol, up there with the default (non-passive) control channel stuff. You personally not having experienced the problem doesn't really change that.

Back door in ProFTPD FTP server (The H)

Posted Dec 7, 2010 14:30 UTC (Tue) by marcH (subscriber, #57642) [Link]

> You personally not having experienced the problem doesn't really change that.

Uh, "personally"?

Will all due respect, users do not care a bit about how is badly designed the protocol or whatever other obscure internal implementation detail. They just want features and FTP has sadly still an edge in a number of use cases. Sad but true.