RE: WHAT was IBM THINKING?!?!?, Re: QSYGETPH API

Didi say it had changed for older os/400 releases? No. I merely voiced a 
frustration that it would impact me at some point.  It would be helpful if some 
list participants would not attempt to extrapolate words and ideas from one 
simple "that sucks" comment and thereby assume they were privy to any unspoken 
sentiments or words I may or may not have been contemplating.
Yeesh!


-----Original Message-----
    From: "michael@xxxxxxxxxxxxxxxxxx"<michael@xxxxxxxxxxxxxxxxxx>
    Sent: 9/15/05 10:34:57 AM
    To: "Midrange Systems Technical Discussion"<midrange-l@xxxxxxxxxxxx>
    Subject: RE: WHAT was IBM THINKING?!?!?, Re: QSYGETPH API
    
    Then the API hasn't changed, has it? Did IBM release a PTF for older
    operating systems to make the API have the same parms as the V5R3
    version?
    
    > -------- Original Message --------
    > Subject: Re: WHAT was IBM THINKING?!?!?, Re: QSYGETPH API
    > From: "Shannon O'Donnell" <sodonnell@xxxxxxxxxxxxxxxxx>
    > Date: Thu, September 15, 2005 10:58 am
    > To: <midrange-l@xxxxxxxxxxxx>
    > 
    > Take one step back on the holier than thou attitude there Doug.  Not all 
of us have gone to V5R3 yet and have therefore had any need to read the memo to 
users for that release yet.
    > 
    > 
    > 
    > -----Original Message-----
    >     From: "Douglas Handy"<dhandy@xxxxxxxxx>
    >     Sent: 9/15/05 9:13:09 AM
    >     To: "Midrange Systems Technical Discussion"<midrange-l@xxxxxxxxxxxx>
    >     Subject: Re: WHAT was IBM THINKING?!?!?, Re: QSYGETPH API
    >     
    >     Shannon, 
    >     
    >     > I did not notice that the length of the passWord is also required 
now. 
    >     > That sucks. 
    >     
    >     
    >     I don't think IBM ever breaks an existing public API lightly (unlike 
another 
    >     OS vendor who shall remain nameless...). But in this case, it appears 
the 
    >     change was very intentional and was specifically changed in order to 
thwart 
    >     a possible exploit described by Scott. IBM takes security very 
seriously 
    >     (again, unlike another OS vendor who shall remain nameless, or at 
least they 
    >     didn't used to...), and faced with a choice of keeping compatibility 
and the 
    >     exploit working, or closing the exploit by requiring relatively minor 
    >     changes to user programs, they chose what seems to me to be the only 
logical 
    >     alternative.
    >     
    >     But they also documented the change in the Memo to Users. Reading 
that is 
    >     part of your release update planning, isn't it? Why do you think they 
bother 
    >     to write the Memo to Users?
    >     
    >     In terms of James' question "What was IBM thinking?!?", the answer 
appears 
    >     to be security. But I also don't fault IBM for being vague and not 
spelling 
    >     out the exact exploit, since this change only closes it for V5R3 
users. 
    >     Given the circumstances, do you really think it would be better to 
leave the 
    >     API the way it worked in the past?
    >     
    >     Doug
    >     -- 
    >     This is the Midrange Systems Technical Discussion (MIDRANGE-L) 
mailing list
    >     To post a message email: MIDRANGE-L@xxxxxxxxxxxx
    >     To subscribe, unsubscribe, or change list options,
    >     visit: http://lists.midrange.com/mailman/listinfo/midrange-l
    >     or email: MIDRANGE-L-request@xxxxxxxxxxxx
    >     Before posting, please take a moment to review the archives
    >     at http://archive.midrange.com/midrange-l.
    >     
    >     
    >     
    > 
    > -- 
    > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
    > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
    > To subscribe, unsubscribe, or change list options,
    > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
    > or email: MIDRANGE-L-request@xxxxxxxxxxxx
    > Before posting, please take a moment to review the archives
    > at http://archive.midrange.com/midrange-l.
    
    -- 
    This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
    To post a message email: MIDRANGE-L@xxxxxxxxxxxx
    To subscribe, unsubscribe, or change list options,
    visit: http://lists.midrange.com/mailman/listinfo/midrange-l
    or email: MIDRANGE-L-request@xxxxxxxxxxxx
    Before posting, please take a moment to review the archives
    at http://archive.midrange.com/midrange-l.