A WARNING ABOUT GMT VS LOCALTIME
	to people using ftpd-BSD-0.3.0 to serve anonymous FTP
		who consider moving to ftpd-BSD-0.3.1

		David A. Madore <david.madore@ens.fr>


(This warning should be included in the ftpd-BSD-0.3.1 distribution,
but I discovered this after packaging, and I did not want to
repackage, resign the tarball, rebuild the RPMs and resign them.  So
it will stay as a separate file.)

The FTP protocol is a bit old and does not specify in what format the
file listings returned by the LIST and STAT commands are to be given.
Traditionally, the Unix ``ls'' program is run, so it has become the
*de facto* standard for the commands' output format; many programs
expect this and parse accordingly.

One thing is certainly not specified, and that is whether the time of
last modification returned for the files listed is given in local time
(the time in the server's time zone) or universal time (UT, aka
Greenwich Mean Time or GMT).

Under Linux, the time format returned by the ctime() function in the
(GNU) libc is determined by the contents of the /etc/localtime file
which can be overridden by the TZ environment variable if it exists;
if nothing is specified (e.g. if the /etc/localtime file does not
exist), universal time is used (as is the case if TZ=GMT).

Version 0.3.0 of ftpd-BSD used an external ls program.  In the case of
anonymous ftp, this ls runs in a chroot()ed environment, and it
frequently does not have an /etc/localtime file on which to rely, so
it returns the time in GMT.  Version 0.3.1, on the other hand, uses an
internal ls function, so its time zone is initialized when the ftpd
program is run, before the chroot() call is made, and the time zone
used is typically the computer's local time.  This means that simply
moving from ftpd-BSD-0.3.0 to ftpd-BSD-0.3.1 without further
precaution will offset all the last modification times returned by the
LIST and STAT commands.  If you live east of Greenwich, this could
result in mirror sites needlessly downloading all files, thinking they
have changed; if you live west of Greenwich, this could result in
mirror sites not downloading files which they should have.

This may very well turn out to be a non-issue.  I am not sure exactly
how mirroring programs work.  If you do not have any mirror sites, or
if you use only non-anonymous FTP, the issue is moot.

One workaround is to start ftpd with TZ=GMT set.  This generally means
starting inetd with TZ=GMT.  Beware, though, that environments tend to
be inherited quite far, and even telnetd will have TZ=GMT and if you
telnet into your machine you might have universal time instead of
local time as you expect (but you can always unset TZ or position it
as you like, e.g. TZ=US/Eastern).  Another solution is not to use the
internal ls command (in which case you might as well stick to version
0.3.0).  Finally, you can decide to stick to local time, but I do not
recommend this as the clients have no way of knowing the server's time
zone (personally I think local time is good only when talking to
humans, and everything else should always use universal time: this is
the strategy taken by the HTTP protocol for example).

I would appreciate it if FTP experts could tell me more about this
problem.  I have read about Bernstein's easily parsed LIST format (see
http://cr.yp.to/ftp/list/eplf.html for a description), and I wonder
whether it is worth implementing (in particular, whether some clients
understand it): I might try contacting the OpenBSD people about this.

-- 
     David A. Madore
    (david.madore@ens.fr,
     http://www.eleves.ens.fr:8080/home/madore/ )