My favourite thing around this story is the part where they found that Daniel had simultaneously introduced a Kerberos5 FTP security bug and completely broken it - and that, since that was a year ago and no-one had noticed, the fix was just to delete that feature entirely.