[cricalix]

"FTP is dead" - shared web hosting would like a word. Quite a few web hosts still talk about using FTP to upload websites to the hosting server. Yes, these days you can upload SSH keys and possibly use SFTP, but the docs still talk about tools like FileZilla and basic FTP.

Exhibit A: https://help.ovhcloud.com/csm/en-ie-web-hosting-ftp-storage-...

[SoftTalker]

I haven't used old school FTP in probably 15 years. Surely we're not talking about using that unencrypted protocol in 2025?

From that link:

    2. SSH connection

    You will need advanced knowledge and an OVHcloud web hosting plan Pro or Performance to use this access type.

Well, maybe we are. I'd cross that provider off my list right there.

[sltkr]

They mention that the "FTP" service includes SFTP, which is file transfer over SSH (not actually related to classic FTP), which is perfectly secure and supported by most FTP clients like Filezilla.

The premium "SSH connection" you mentioned seems to refer to shell access via SSH, which is a separate thing.

[cricalix]

They also support FTP without the SSH transport, and it's not FTPS either. Various IP cameras still support FTP as a way to write files out periodically; I use this to provide a "stream" from a camera (8 seconds per frame because reasons) to the world. Actual streaming via RTSP is also available, but I could never get a stable stream to a video host (like YT or Twitch) from the camera (partially because of a poor quality network connection that can't be upgraded easily). So, FTP + credentials -> walled off directory that's not under the web root -> PHP script in web root -> web browser.

[carlosjobim]

FTP still works great and encryption is a non-priority for 100% of users.

[SXX]

It should be priority for hosting companies though since leaked credentials and websites hosting malware is a problem.

[Nextgrid]

Shared hosting companies are still exposing cPanel/WHMCS to the outside world. You don't need FTP passwords to pwn this kind of crap.

[creatonez]

Transport encryption should be a huge priority for everyone. It's completely unacceptable to continue using unencrypted protocols over the public internet.

Especially for the use case of transferring files to and from the backend of a web host. Not using it in that scenario is freely handing over control over your backend to everything in between you and the host, putting everyone at risk in the process.

[carlosjobim]

I've used FTP for static sites for decades by this point. Credentials have never been leaked, transfers have never been interfered with.

[ndsipa_pomu]

How would you know if the transfers were interfered with? Do you take checksums of the files you upload and then check that the files apparently uploaded are the same?

Also, how do you know that there isn't someone performing a MITM (man in the middle) attack? FTP has no mechanism that I know of to verify that you're connecting to the server that you think you are.

It may well be that you're not a sizeable target and that no-one is interested in hacking your site, but that's just luck and not an endorsement of unencrypted FTP.

[carlosjobim]

How would you know that your neighbours aren't secretly spying together on you and interfering with your life in ways you don't notice?

We have to put a limit to paranoia. If things work correctly for decades and there are no signs of foul play after endless real world usage, it's safe to say nobody is hacking our FTP.

It's different if you're a bank or the KGB or the CIA.

> It may well be that you're not a sizeable target and that no-one is interested in hacking your site, but that's just luck and not an endorsement of unencrypted FTP.

Do you drive an armored car?

[otabdeveloper4]

Not true. Your hosting provider already has physical access to the computer you're connecting to.

Whether or not the connection you're using is encrypted doesn't really matter because the ISP and hosting provider are legally obligated to prevent unauthorized access.

(It's different if you're the NSA or some other state-level actor, but you're not.)

[creatonez]

ISPs very frequently do not give a shit about the law. There are so many instances of major ISPs intercepting and modifying traffic, injecting ads, redirecting people to gambling websites, etc. It's not some freak incident involving the NSA targeting you, it happens all the time. All it takes is one bribe.

And what happens if your ISP is compromised without their knowledge? What happens when it's a consumer device such as a router? Don't forget that nearly every TP-Link router has an active malware infection.

It's not just one ISP that you have to trust, it's every single intermediate piece of equipment.

Intercepting traffic is a trivial & common form of compromise, and the problem multiplies by how many different parties you are handing your data to. It is wildly irresponsible to not attempt to protect against this.

[otabdeveloper4]

Nuance is needed here.

"You <-> ISP <-> Bank webpage" is an entirely different security threat model than "You <-> Server you rent from an ISP".

Also, unsanctioned wiretapping is an entirely different criminal offense than stealing leaked credentials.

You can't make blanket statements like that without understanding ISP peering agreements and how data is stored and where.

Let's not pretend like slapping cryptography over L3 is the entirety of being secure. Often (most of the time?) cryptography doesn't even matter much for security.

P.S. Security (prevent stealing sensitive data) and verification (making sure nothing extra is added during transfer) are different problems.

[bigstrat2003]

> It's completely unacceptable to continue using unencrypted protocols over the public internet.

That is nonsense. The reality is that most data simply is not sensitive, and there is no valid reason to encrypt it. I wouldn't use insecure FTP because credentials, but there's no good reason to encrypt your blog or something.

[immibis]

Didn't we already go through this 10 years ago and then Firesheep got created and thoroughly debunked it?

[homarp]

firesheep was built to demonstrate how Easy HTTP session hijacking was (was a Firefox extension)

on HN https://news.ycombinator.com/item?id=1827928

[ndsipa_pomu]

You're missing the opposite issue - people might not care about your data, but you might well care if their data (e.g. porn sites) was uploaded to your blog.

It's not so much about the data, but protecting your credentials for the server.

[lavela]

I'd argue that most people like knowing that what they receive is what the original server sent(and vice versa) but maybe you enjoy ads enough to prefer having your ISP put more of it on the websites you use?

Jokes aside https is as much about privacy as is is about reducing the chance you receive data that has been tampered. You shouldn't only not use FTP because credentials but also because embedded malware you didn't put there yourself.

[rixed]

I, for one, would like to see an ISP dedicated enough and tecnically able to inject ads in my FTP stream. :)

[SoftTalker]

Agree but also wonder if ISPs bother with this anymore, now that almost all websites are https.

[creatonez]

This is the usual horseshit people say about this topic when they don't understand it. It's not just about encryption, but authentication (tamper-resistance). Your blog might not contain sensitive information, but if the entire website is intercepted and becomes malware, you're in trouble.

The bad news with FTP in particular is that only one request has to be intercepted and recorded to have persistent compromise, because the credentials are just a username and password transmitted in clear.

[jasongill]

Shared hosting is dying, but not yet dead; FTP is dying with it - it's really the last big use case for FTP now that software distribution and academia have moved away from FTP. As shared hosting continues to decline in popularity, FTP is going along with it.

Like you, I will miss the glory days of FTP :'(

[theshackleford]

Shared hosting is in decline in much the same way as it was in 2015. Aka everyone involved is still making money hand over fist despite continued reports of its death right around the corner.

[tredre3]

The number of shared hosting providers has drastically declined since the 2000s. I would posit that things like squarespace/hosted wordpress took the lion share, with the advent of $5-10 VPS filling the remaining niches.

The remaining hosting companies certainly still make a lot of money, a shared hosting business is basically on autopilot once set up (I used to own one, hence why I still track the market) and they can be overcommitted like crazy.

[theshackleford]

> The number of shared hosting providers has drastically declined since the 2000s

Yeah, there’s definitely been some wild consolidation. I’ve actually been involved in quite a few acquisitions myself over the last decade in one form or another.

> (I used to own one, hence why I still track the market)

I’m still in the industry, though in a very different segment now. I do still keep a small handful of legacy customers, folks I’ve known for years, on shared setups, but it’s more of a “you scratch my back, I’ll scratch yours” kind of thing now. It’s not really a profit play, more a mix of nostalgia and habit.

[immibis]

Source on the number of providers declining?

[nativeit]

Probably worth noting also that declining number of providers does not equal a declining number of customers. I know every company I engaged with ~15-years ago has been acquired at least once.

[immibis]

And there are new ones all the time.

[jasongill]

No, not at all the case. There has been continued consolidation of the shared hosting space, plus consumer interest in "a website" has declined sharply now that small businesses just feel that they need an instagram to get started. Combine that with site builders eating at shared hosting's market share, and it's not looking good for the future of the "old school" shared hosting industry that you are thinking of.

[SoftTalker]

Seems short sighted, a lot of older people and privacy conscious people of all ages avoid social media. But I guess if they are sustaining a business on only Instagram, good for them.

[theshackleford]

> There has been continued consolidation of the shared hosting space

That’s been happening, at least from my own memory, since at least the mid-2000s.

> plus consumer interest in "a website" has declined sharply now that small businesses just feel that they need an instagram to get started.

Ah yes, the 2020s version of “just start a Facebook page.” The more things change, the more they stay the same I suppose.

> Combine that with site builders eating at shared hosting's market share

I remember hearing that for the first time in I wanna say...2006? It sure did cause a panic for at least a little while.

> and it's not looking good for the future of the "old school" shared hosting industry that you are thinking of.

Yes, I've heard this one more times than I can count too.

The funny thing is, I’ve been hearing this same “shared hosting is dying” narrative for nearly two decades now. Yet, in that time, I’ve seen multiple companies launch, thrive, and sell for multi-million dollar exits.

But sure, this time it’s definitely the death knell. Meanwhile, I assure you, the bigger players in the space are still making money hand over fist.

https://www.mordorintelligence.com/industry-reports/web-host...

> By hosting type, shared hosting led with 37.5% of the web hosting market share in 2024

[jasongill]

I was in the space from the late 90's, acquired ~30 brands and was the largest private consolidator of shared hosting, and sold to a Fortune 500 in 2015. Sounds like you had a similar experience as mine. There's no way you can deny that the glory days of shared hosting are over - while there is still a little money to be made by setting up a VPS with cPanel, and money to be made if you are WebPros or Newfold, the market is contracting and has been for years due to the factors I listed. The Cheval list used to be the hottest marketplace on the planet and now is just a shell of it's former self, unfortunately.

[valiant55]

I think everyone is underestimating how much B2B file exchange happens over SFTP/FTPS. I'm in healthcare and my system moves thousands of files up and down from over 100 unique hosts daily.

[bawolff]

I think the true death of ftp was amazon s3 deciding to use their own protocol instead of ftp, as s3 is basically the same niche.

[HumanOstrich]

FTP does not even come close to supporting the use cases of S3, especially now.

[bawolff]

Yeah, but the average s3 user doesnt care about most of those most of the time.

Just like how there are usecases ftp supports that s3 doesn't.

[waste_monk]

Also worth noting that FTPS (FTP over TLS) exists and obviates the fuss around SSH TOFU and key management etc. Especially given we're in the era of free certificates via Let's Encrypt, this is a great option.

The main downside is people will sometimes assume you mean SFTP (not having heard of FTPS or realising they are different), and then get upset when it doesn't work as they expect. However good tooling will support both e.g. Filezilla.