Kerberos/AD is another example of this kind of mess. It has both LDAP and LDAPS not to mention the zoo of encryption types available for keytabs and credential

Kerberos/AD is another example of this kind of mess. It has both LDAP and LDAPS not to mention the zoo of encryption types available for keytabs and credential caches. You can still use unsalted encryption types and DES! While on one hand insecure LDAP is convenient for testing, I do think it should really just be removed and require LDAPS.