RE: WHAT was IBM THINKING?!?!?, Re: QSYGETPH API

Memo to user is available on Info Center.  Software houses should be
reading when new releases come out.  There are two API's documented in
there that are available on previous releases that perform the same
function.  Developers should start changing their code to use those
BEFORE one of there customers upgrade to V5R3 and their system stops
working.  This is from an end user company that had a major third party
C/S package blow up AFTER we contacted all of our software vendors to
see if their software would run under V5R3.  THEN 6 MONTHS later the PTF
expired and the software blew up again.  I shall leave them nameless at
this time. 8.>( This boils down to customer support, or lack their of.


Chris Bipes
Information Services Director
CrossCheck, Inc.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of James H H Lampert
Sent: Thursday, September 15, 2005 9:48 AM
To: Midrange Systems Technical Discussion
Subject: Re: WHAT was IBM THINKING?!?!?, Re: QSYGETPH API

"Shannon O'Donnell" <sodonnell@xxxxxxxxxxxxxxxxx> wrote:
> Take one step back on the holier than thou attitude 
>there Doug.  Not all of us have gone to V5R3 yet and have 
>therefore had any need to read the memo to users for that 
>release yet.

And indeed, for commercial development, it's usually to 
one's advantage to stay *several* releases back from 
current, so that customers aren't forced to upgrade. Up 
until this week, we didn't even have a V5 box in the 
building, and the one we now have does not have 
development tools on it.

Most of the time, unless you use undocumented hacks (and 
that is NOT the reason why we use MI in all our products, 
and use tens of thousands of lines of it in QuestView), 
doing your development a few releases back has no 
downside.

I wonder if it's possible to subscribe to the 
memo-to-users series?

And as to what happens when you don't deal with the API 
change, and use real passwords, it boils down to one of 
two things, depending on how your application is coded:

1. Starting with V5R3, it will keep everybody out, whether 
they have the right password or not.

2. Starting with V5R3, it will let everybody in whether 
they have the right password or not.

The former is an inconvenience; the latter is a security 
breach at least as bad as the one IBM was apparently 
trying to close up.

The logical way to make a QSYGETPH call work universally 
is to try it first the old way, and monitor for the error 
code V5R3 returns if the extra parameters are missing, and 
if that error code is returned, then try it the V5R3 way.