Hi JB- I’m good with that. I’ve updated the GH issue with the note that we’ll remove FTP blob support in v6.5.0. The PR I have out there hardens the existing URL parsing, but does not add any new blob support or features. This de-risks the Apache ActiveMQ source from security issues.
I’ll add a second PR to remove FTP blob-related classes for v6.5.0. GH Issue Remove FTP Blob ref: https://github.com/apache/activemq/issues/2805 GH PR tighten up URL parsing ref: https://github.com/apache/activemq/pull/2767 Thanks, Matt Pavlovich > On Nov 6, 2026, at 11:37 PM, Jean-Baptiste Onofré <[email protected]> wrote: > > Hi > > I agree with Chris: let's more blob support completely (at least for ftp). > No need to wait 7.x, I don't think it's heavily used. > > Regards > JB > > On Fri, Nov 6, 2026 at 4:43 PM Christopher Shannon > <[email protected] <mailto:[email protected]>> > wrote: >> My preference is just to remove the BLOB support entirely but at the >> very least I would remove anything insecure like ftp or http. There's >> too many security issues with those. >> >> I don't know that we need to wait for 7.x to delete FTP, I can't >> really imagine many people using it given how insecure it is. >> >> On Fri, Nov 6, 2026 at 10:32 AM Matt Pavlovich via dev >> <[email protected] <mailto:[email protected]>> wrote: >> > >> > Hi @dev: >> > >> > I’m looking at blob support as an area that could be a valuable feature to >> > modernize for ActiveMQ deployments. Currently, the implementations are FTP >> > and HTTP, but it is a compelling feature to address the large data >> > transfer problem — offload large messages to a side-channel and send an >> > event over the broker for any interested consumers. >> > >> > Specifically, this would enable automatic tiering of payload sizes. For >> > applications that have a very small number of large messages, but run IOPS >> > limited volumes the impact can be disruptive (ie 0.5% of distribution can >> > utilize 33% of IOPS). >> > >> > ActiveMQ has all the pieces already in place to negotiate and the ability >> > to automatically route anything larger than the broker’s maxFrameSize over >> > to the blob storage service. Currently, only BlobMessages are routed to >> > Blob URL, but it could be the case an implementation could automatically >> > route other message types and re-assemble on the client-side from the >> > side-channel blob endpoint. >> > >> > ## Modernization - Part 1 >> > >> > a. Harden existing and correct SPI extension points >> > >> > PR ref: https://github.com/apache/activemq/pull/2767 >> > >> > ## Modernization - Part 2 >> > >> > a. Mark FTP as deprecated for removal in 6.x and remove in 7.x >> > >> > Thanks, >> > Matt Pavlovich >> > >> > >> > >> > >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: [email protected] >> <mailto:[email protected]> >> For additional commands, e-mail: [email protected] >> <mailto:[email protected]> >> For further information, visit: https://activemq.apache.org/contact >> >>
