Quoting Louis  Guillaume (lguillaume@berklee.edu):
> Steven M. Bellovin wrote:
> >In message <3EB984D9.8090403@berklee.edu>, "Louis Guillaume" writes:
> >>I've been having a great big fight with my network admin over access to 
> >>ftp.netbsd.org (or anoncvs) through our Checkpoint Firewall. It's 
> >>version "NG - patch level 4".
...
> Thanks very much for this fix. The problem I forsee, is that my Network 
> admin will look at this doc from Checkpoint...
> 
> http://www.checkpoint.com/techsupport/alerts/pasvftp.html
> 
> ... and say that it's a security issue, and that we would be de-grading 
> the firewall.
> 
> Does the ftp server actually need to be patched?

Look at the author of your answer.
There's a big book you can smack your admin with.  It's got his
name on it.  If your firewall admin doesn't know the book, then
he should be bludgeoned unconscious and his firewall taken away.