I tried the bugzilla deal but I can\'t figure that mess out to save my life. Basically, new domains have anonymous ftp turned on to ftp.domain.com by deafualt. This is dangerous. It really should not be allowed by default.
