Re: More top-secret BS commits with hidden bug reports

[JTK]

Stuart Ballard wrote:
> 
> Rip Toren wrote:

[snip]

> I have to wonder though if there's a better way to solve this bug than
> just block access to port 25. Isn't it sufficient to refuse to connect
> to an ftp URL if CR or LF appear in the username or password (because
> those characters are part of the protocol and no real ftp server could
> ever accept them)? That way even if someone runs an SMTP server on the
> ftp port, you *still* can't abuse it.
>

Hmmm, now that sounds like a pretty reasonable way to actually fix the
problem once and for all, instead of merely covering it up.  Probably
could even make it a single strcspn() call.

Five'll get you ten they don't do it.
 
> Stuart.