Bye bye Kerberos FTP

Domain: daniel.haxx.se Shared: | Tags: programming

Daniel Stenberg, author curl, has decided to remove support for Kerberos5 FTP in curl 8.17.0, for the simple reason that it (a) contains a security bug, and (b) since this bug was introduced in May 2024 the feature itself didn't work, and no one complained.

With this accidental/clever user check, we have then decided to instead of fixing the code we rip the entire thing out. Clearly we should not support this code since A) it isn’t used and B) it isn’t tested in the test suite. Perhaps also C) it is weird code.

I guess it makes perfect sense, less code to maintain, less tests to write, and one less security vulnerability to worry about. Semi note to self, if you use an esoteric feature, or encounter an bug in one, let the maintainer know. Can't guarnatee support, of course, but at least it'll pass the user check.

Read from link