Mozilla to remove built-in FTP implementation in Firefox 90

Last year, Mozilla announced plans to disable and remove the built-in FTP (File Transfer Protocol) implementation from the Firefox browser for security reasons. Now the company is disabling the implementation with the release of Firefox 88 on April 19, 2021, and then remove it in Firefox 90.

Once it is disabled, the browser will delegate ftp:// links to external supported applications. Mozilla has currently disabled the FTP implementation in the Firefox Nightly and Beta pre-release channels.

"To help offset this removal, ftp has been added to the list of supported protocol_handlers for browser extensions. This means that extensions will be able to prompt users to launch an FTP application to handle certain links," Caitlin Neiman, Add-ons Community Manager at Mozilla, wrote in a blog post on Thursday.

Announcing the plans to depreciate FTP in Firefox, Mozilla, last year, said that the protocol predates the Web and was not designed with security in mind.

"We're doing this for security reasons. FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources. Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past. After disabling FTP in our code, the protocol will be handled by an external application, so people can still use it to download resources if they really want to. However, it won't be possible to view and browse directory listings," the company then said.