WebApp Sec: Convenience or just bad design?

["Saqib Ali" <docbook.xml () gmail com>]

So Altiris.com website allows their customers to upload files to their
servers.  The filenames are based on the email address of the
customer.

The interesting part is that they make this upload directory web
accessible by FTP. So now not only you can access all the uploaded
files, you can also get the email addresses of the Altiris customers.
Some of the file are very interesting. They include actual unreleased
applications.
ftp://wise1:w1s3ftp () 209 104 132 121/wisesol/www/bugs/

Doesn't this go against their privacy policy?
http://www.altiris.com/company/legal/privacy.aspx

When will companies realize the importance of good secure design????

--
Saqib Ali, CISSP, ISSAP
Support http://www.full-disc-encryption.com

-------------------------------------------------------------------------
Sponsored by: Watchfire

Cross-Site Scripting (XSS) is one of the most common application-level 
attacks that hackers use to sneak into web applications today. This 
whitepaper will discuss how traditional CSS attacks are performed, how to 
secure your site against these attacks and check if your site is protected. 
Cross-Site Scripting Explained - Download this whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
--------------------------------------------------------------------------