Re: [IBMiOSS] Ports and routes needed to replace very large numbers of green screens.

There's nothing to miss. No one but the owner has authority to a new program.

Like I said, do your risk assessment.


:)



-----Original Message-----
From: Richard Schoen [mailto:Richard.Schoen@xxxxxxxxxxxxxxx]
Sent: Monday, June 04, 2018 1:59 PM
To: opensource@xxxxxxxxxxxx
Subject: Re: [IBMiOSS] Ports and routes needed to replace very large numbers of green screens.

Because all it takes is one object authority miss to expose it.

Better to NOT allow someone to try and access a particular object path via URL path even if they can't spell CGI and you THINK it's secured.

I was once sitting at an airport waiting for a flight and out of curiosity googled to see if anyone had a copy of one of our commercial apps on the web.

I found one customer who did and I was able to access the customers version of our software. Fortunately they had removed the default admin user info.

I didn't try hitting a URL vector, but the point is all it takes is one person to recognize what's up to cause problems.

After that I adopted a policy of tighter is better when it comes to exposing IBMi objects via wildcard URLs.

I stand by NOT unnecessarily opening up a wildcard URL pattern as a common practice even with what you think is tight security.

No matter how comfortable you may feel it's one more thing that can bite you.

Do what you will, but don't argue that wildcarding is foolproof 😊

Regards,
Richard Schoen
Director of Document Management
e. richard.schoen@xxxxxxxxxxxxxxx
p. 952.486.6802
w. helpsystems.com