RE: IBM's benevolent hacking

["Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>]

> From: rob@xxxxxxxxx
> 
> Jeepers Joe, you get pretty defensive about OS/400, don't you?  I
can't
> blame you, just don't let it blind you.

We've had these discussions in private and public, Rob.  You tend to
fling a lot of mud in the direction of OS/400 security, but I've yet to
see anything actually appear in the way of concrete security breaches.
I thought this might be an actual example of some issues, but then I
read the post and realized that there was no real detail.  As John
pointed out, there are a lot of reasons why that might be, and thus my
request for the name of the testing services so that others might be
able to take advantage of your experience.

Also, I just wanted to be clear as to whether these were actual OS/400
security holes, or simply deployment issues.  These days a lot of people
can't seem to distinguish between the concept of incorrectly setting a
security value and a buffer overrun that allows someone to take over a
machine regardless of their protection.  That sort of fuzzy logic is
what allows people to actually promote moving a stable application from
OS/400 to Windows and make it appear to be a sound business decision,
when in fact it is almost impossible to justify such a move from nearly
any business standpoint.

Joe