Package Vendor that changes IBM command Defaults.

Hello,

<<MODE(*RANT)>>
I have a customer where a vendor (name withheld to protect the GUILTY) for one
of their packages, during a version upgrade, changed all the program create
commands to USRPRF(*OWNER) AUT(*ALL) and all the file create commands to
USRPRF(*OWNER) LVLCHK(*NO) AUT(*ALL). To top it off they compiled as a member of
QSECOFR. I plan to explain to the vendor Wednesday morning how disastrous this
can be, especially on a system where theirs is one of many packages plus
multiple in-house development. Also, this is the WRONG way to make changes (to
the QSYS library objects) even if they were justified. I doubt if they realize
that anyone could Trojan horse one of their called programs to gain complete
system access. Even if theirs was the only package on the box they have a
payroll module which all this leaves wide open!

<<MODE(*REQUESTER)>>

What I would like, without creating a total flame war, is a FEW items from this
esteemed group to show them as a backup to my lesson on how to play nicely as a
software package vendor. I can accept the USRPRF(*OWNER) _IF_ the owner is a
special package owner and properly managed but definitely not QSECOFR!

<<MODE(*HUMBLE)>>
Thanks In Advance.

Roger Vicker, CCP

--
*** Vicker Programming and Service *** Have bits will byte *** www.vicker.com
***
We weld anything but the crack of dawn.



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---