Re: Off-List -- Re: How Secure is Windows, Really?

Joe Pluta wrote:

From: Tom Liotta

Unfortunately, that isn't actually required. There are a couple ways
to get programs into an AS/400 (iSeries, System i) that don't
involve savefiles. (Hmmm... in fact, I just reminded myself of
another way.)

Unless I completely miss the point, the only way to create a program (other
than restoring it) is to compile it.  This is another reason why many
production machines don't even have compilers on them!  But in any event, if
you give unauthorized users the ability to upload a file and execute it
(especially to create programs!), then you have a huge hole in your system.

Before Save files (introduced in CPF 6.0 IIRC), there were the
Materialize and Encapsulate APIs (QSCMATPG and QSCCRTPG).  They only
work on observable OPM programs.

QSCMATPG reads the program and outputs data to an 80 byte record file.
QSCCRTPG creates a program from this 80 byte record data.  The data
format is basically the observable program template (binary MI).

Keith