RE: Security level 50

I can't remember the last time I ran across an application that violated
QSECURITY Level > 30.   Does anyone know of any software that still
won't run at that level?   If you do, could you let us (the list) know?
I suspect there are a lot of people that are holding back at QSECURITY
Level 30 for no good cause.

I have heard a lot of people say that this software or that software
will not run at 40 or higher, but it's been years since I have actually
seen a failure.  I do remember one vendor who insisted that they had to
run at 20.  When the customer forced them off of 20, they insisted that
they could run no higher than 30 - but I suspected (and it was
ultimately proved) that these guys weren't smart enough to write
programs that violated system state - they were just asserting that they
wouldn't run at 40 because they had never tried it.

jte



--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl@xxxxxxxxxxxxx
www.powertech.com 
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--

> -----Original Message-----
> From: midrange-l-
> bounces+john.earl=powertech.com@xxxxxxxxxxxx
> [mailto:midrange-l-
> bounces+john.earl=powertech.com@xxxxxxxxxxxx] On Behalf Of
> Ed Fishel
> Sent: Thursday, December 15, 2005 12:23 PM
> To: Midrange Systems Technical Discussion
> Subject: Re: Security level 50
> 
> Jim Franz wrote on 12/15/2005 01:04:09 PM:
> 
> > Ed - any progress at getting IBM Partners to get their
> code compatible
> with
> > 50?
> 
> All I can do is give you my opinion. I think most of them
> are already
> compatible with level 50. After all by working at security
> level 50 they
> have a better chance to sell their products.
> Unfortunately, I believe a few
> have done this by modifying their programs to run in
> system state. (Of
> course if they do this without adding the right type of
> parameter
> validation then they are actually reducing the
> security/integrity of their
> customers systems that would normally be provided at
> security level 40 and
> 50.)
> 
> Each release I see new APIs and exit points that should
> help the remaining
> few applications run completely in user state. I really
> have no idea how
> many applications still need to run in system state.
> 
> Ed Fishel,
> edfishel@xxxxxxxxxx
> 
> --
> This is the Midrange Systems Technical Discussion
> (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/midrange-l.
>