Re: lftp-3.0.4 always tries to issue CPSV command when doing secure FXP with SSCN-enabled server

On Thu, Jun 03, 2004 at 09:22:20AM +0400, Alexander V. Lukyanov wrote:
> On Wed, Jun 02, 2004 at 02:55:10PM -0700, Roboco Sanchez wrote:
> > >    1. FEAT should be allowed before login as it
> > > contains information about
> > >    AUTH command, which is used before login. I don't
> > > remember if it is in
> > >    some standard or draft, but it is common sense.
> > >    2. The code 500 should not be used to indicate
> > > impropriate use of command
> > >    before login. Instead, 530 should be used.
> > 
> > Seems they won't do it. They said it's for security
> > reason. I'm inclined to agree with them.
> > 
> > https://forum.raidenftpd.com/showflat.php?Cat=&Board=UBB13&Number=42795
> 
> This won't make much of security anyway. At lest they should change the error
> code to mimic some other ftp server, as the code 500 is only used by Raiden
> and it can be used to determine the server type ;-)

In exchange for a little fake security-by-obscurity, they make TLS hard
to support.  That's one piece of software to avoid, I think ... :)

-- 
Glenn Maynard