RE: OS/400 Vulnerability to CERT Advisories

For what it's worth, even I had to go through the registration process for
a user ID and password to see this site :-)  We use a different mechanism
to compose the responses, but I have to go through the exact same stuff all
of our customers do in order to view this site.  Since I did this about a
year ago, I'm having a hard time recalling the exact process.  I believe,
to get a user ID, all you have to is go through the registration process.
No personal information other than an e-mail address is requested. I do not
believe an IBM customer number is required. You are asked for an e-mail
address and a "preferred ID" to use with the site. IBM then sends you an
initial password.

Why did we do this? A couple of reasons:
1. Some of the eServer brands DO require a support contract to get the
information. iSeries does not.
2. There was a legal concern with being able to prove that someone had read
the disclaimer information and asking folks to register was a way to legal
ensure the disclaimer had been read.
3. We are CONSIDERING (not planning, just considering for the future) a
"push" service where we might send the information out to folks that have
registered.

Patrick Botz
Senior Technical Staff Member
eServer Security Architect
email: botz@xxxxxxxxxx



                                                                                
                                                        
                      Pete Hall <pbhall@xxxxxxxxxxxxx>                          
                                                        
                      Sent by:                                    To:       
Midrange Systems Technical Discussion                       
                      midrange-l-bounces+botz=us.ibm.com@x         
<midrange-l@xxxxxxxxxxxx>                                            
                      idrange.com                                 cc:           
                                                        
                                                                  Subject:  RE: 
OS/400 Vulnerability to CERT Advisories                 
                                                                                
                                                        
                      07/28/2003 07:26 PM                                       
                                                        
                      Please respond to Midrange Systems                        
                                                        
                      Technical Discussion                                      
                                                        
                                                                                
                                                        
                                                                                
                                                        




Yeah. I shudder every time I need to come up with an IBM customer number.
There always seems to be about a dozen of them, some of which work. I can
never keep it straight. This information should be available to the public.

A login ID is OK, as long as it's free, but why the customer ID and the
double approval process? Next we'll need to provide a urine sample...

At 17:45 07/28/2003, Doug Hart wrote:
>This would be great if only I didn't need to be Houdini to get logged in.
>What's so secret that I need to login for this information?

Pete Hall
pbhall@xxxxxxxxxxxxx
http://www.pbhall.us/

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.