RE: Off-List -- Re: How Secure is Windows, Really?

From: Tom Liotta

Unfortunately, that isn't actually required. There are a couple ways
to get programs into an AS/400 (iSeries, System i) that don't
involve savefiles. (Hmmm... in fact, I just reminded myself of
another way.)

Unless I completely miss the point, the only way to create a program (other
than restoring it) is to compile it.  This is another reason why many
production machines don't even have compilers on them!  But in any event, if
you give unauthorized users the ability to upload a file and execute it
(especially to create programs!), then you have a huge hole in your system.

Heck, even the lowliest FTP servers on the planet don't let anonymous users
upload files and execute them.  If an iSeries administrator isn't smart
enough to lock down FTP, then you need a new iSeries administrator.

At the same time, I agree that too many people allow remote command
execution, but it's pretty easy to stop it.  And in any case, that's all the
more reason to be very careful of unfettered external access, including ODBC
and EDRS!

Joe