RE: Green-screen versus browser

["Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>]

>I stand corrected.  This means that 5250 apps *are* indeed more safe
>than browser apps because hackers cannot exploit hidden fields and
such. 

I can't remember the name of it, but there's a appliance out there that
looks at the outbound HTML and ensures that the inbound responses make
"sense" with regard to the out bound requests. That is, of you send a
form with three text fields with a max len of 50, and a drop down with a
"Red" and "Green" choice, the appliance will stop any requests for the
"purple" color before it hits the web server. Effectively providing some
of the same protections.

Also keep in mind, the abacus on my desk is more secure than 5250, you
have to actually come into my office to use it, but no one is suggesting
that we throw out JDE and use abaci.

-Walden


------------
Walden H Leverich III
Tech Software
(516) 627-3800 x11
WaldenL@xxxxxxxxxxxxxxx
http://www.TechSoftInc.com

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)
  


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rich Duzenbury
Sent: Tuesday, 26 April, 2005 16:19
To: Midrange Systems Technical Discussion
Subject: RE: Green-screen versus browser

On Tue, 2005-04-26 at 14:09 -0600, James Rich wrote:
> On Tue, 26 Apr 2005, Walden H. Leverich wrote:
> 
> >> It is true that a 5250 client could be modified to send back any
key at
> >> all.
> >
> > Wouldn't display management stop that? I would think (hope?) that
the
> > workstation manager would see a F8, but it would "know" that F8
wasn't
> > valid and stop the request. Is that not the case?
> 
> Good question.  To test I ran tn5250 using the trace option (which
logs 
> everything sent between the client and host) and pressed an invalid
key. 
> tn5250 sends the key as entered (so you don't actually have to modify 
> anything).  The iSeries responds that the function key is invalid.  So
the 
> validation is done by the host, not the client.  Client hacks won't
get 
> you anywhere.

I stand corrected.  This means that 5250 apps *are* indeed more safe
than browser apps because hackers cannot exploit hidden fields and such.

Excellent.


--
Regards,
Rich

Current Conditions in Des Moines, IA
Overcast
Temp 50F
Winds out of the North at 21, gusting to 29mph


-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.