ftp, pf, passive ftp and fetch

[Dave]

Hi,
    I'm trying to get ftp working from behind a pf firewall. I'm using pftpx 
on FreeBSD 6.2 for this. I believe i have passive working, one of my windows 
boxes goes passive and dies on active. I've got three questions. First, 
portupgrade uses fetch for retrieval correct, if so i want it to use the -p 
(passive option) by default whenever it tries an ftp url. Second, ncftp i'd 
like to specify that it should use passive mode connections by default as 
well. Last, is active or passive ftp better in terms of security strictly 
from a firewall perspective, i know the protocol isn't secure? If active ftp 
is better than passive does anyone have a ruleset with it? I'm using a block 
by default ruleset.
Thanks.
Dave.