>I think in the short-term (i.e. in time for 1.5), we should change
>Heimdal's behavior to match MIT's wrt. krb5_init_context().
>For post-1.5, we should investigate adding the mechanisms to login.conf,
>possibly also supporting dynamically-loaded auth modules a'la PAM.

	while i was chatting with a bsdi (not freebsd) guy, he showed a big
	worry about dynamically-loaded auth module like PAM, for security
	issues.  is it not the case?

itojun