Re: AS400 user password

[Don <dr2@xxxxxxxxxxxx>]

Dan,

I'm glad you took that point of reason.  I know that there are IBM'ers on
the MI400 list and I'm frankly not going to commit them to comment.  I
would not like to see that source code posted here to God and the world.
I think and HOPE (tellme I'm not ignoring history:) that the proper cages
are being shaken with sufficient vigor to let the proper folks realize
that the knowledgeable end user has enough concern for his/her system and
enough warrant to express concern to a recalcitrant IBM and now has the
big enough stick to make them sit up and take notice.  

I've had alot of off list discourse and several phone calls with some of
the priciples bringing up these points.  And before we open the world to
another and bigger problem than we had back in CPF 7/7.1 days, I think
that IBM needs to reply openly and quickly.  Frankly, I'ld be very happy
to see the problems fixed and for both sides to keep the rest of their
armaments in storeage vs. the front line.

If we learned anything from the cold war it was that mutually assured
distruction is not a winning tactic...but then, neither is recalcitrance.

We've seen the head of BOTH monsters.  Frankly, I'm not sure I want to
have the world seeing the rest of them.

Don in DC


On 9 Jun 2000, Dan wrote:

> Just a few days ago, a 17-line RPG-IV program was posted to MI400-L that
> sniffs user IDs and passwords as they sign on to the system.  I tried it, it
> works.

> Even though the code was published on MI-400, I will leave it to the original
> author to republish it here.  I agree that security-by-obscurity is not
> security at all, but don't feel it is my place to throw this hot potato any
> further.

+---
| This is the MI Programmers Mailing List!
| To submit a new message, send your mail to MI400@midrange.com.
| To subscribe to this list send email to MI400-SUB@midrange.com.
| To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: dr2@cssas400.com
+---