Hacker News new | ask | show | jobs
by chrisper 3082 days ago
What would be the reason behind disabling all those protocols?
1 comments

Probably to reduce exposure to security issues. The more code you ship, the more code you're responsible for keeping secure.

Looking briefly at the list at https://curl.haxx.se/docs/security.html I see issues for FTP (x2), IMAP, and TFTP in 2017 alone. These protocols which are outside of curl's core competency of http are likely to have less scrutiny and more bugs. While FTP shouldn't be removed from curl I don't think a protocol like TFTP or gopher is crucial, and I wouldn't mind too much if it got the axe in a distribution I used

HTTP is NOT curl's core competency, "transferring data with URLs" is. HTTP just happens to be the most often used in the world, and thus in curl.