🚀 go-pugleaf

In article <1992Aug14.195017.7009@decuac.dec.com> mjr@hussar.dco.dec.com (Marcus J. Ranum) writes:
> 	You can't count on RFC931 type stuff for "authentication". You
> can count on it for "information"; possibly useful, and possibly
> correct, but you really have no way of being sure.

Forget this concept of ``my RFC 931 server is there to provide
information/authentication/whatever to the other guy''.

Any administrator of a multi-user machine: If you run an RFC 931 server
then it helps *you*. *You* can find out---when the cops come calling---
which of your users was responsible for a connection. *You* get the
benefit if one of your users abuses a popular FTP server---and instead
of chopping off service to your entire host, the FTP administrator chops
off service to just that one user.

If you don't support the protocol then all your users remain anonymous
on the network. If someone receives a ``bad'' connection from your host,
the only person he can blame is you; you won't be able to ``point the
finger'' at the user who was responsible. It's your choice.

> 	A good metric to use to determine if you have "authentication"
> is to ask yourself if a bank would let you make withdrawals based on
> it.

[snicker] I guess Kerberos isn't authentication, then.

The protocol actually used on port 113 is now called ``TAP'' (that's an
indecomposable acronym, like TELNET); it's a somewhat simplified variant
of the ``Authentication Server'' defined by RFC 931. So there's no more
``authentication'' in the name. Hasn't been for months, in fact.

---Dan