Re: Might be getting 1-day admin privileges to PC; what to install besides iSphere?

Except there are specific security criteria now a days.

If your shop deals with PCI, HIPPA, or others you better have security
standards pertaining to in house code. You'd also better have some code
reviews that ensure those standards are followed.

At my last PCI compliant shop, secure code reviews were standard practice
for all languages; including RPG. Granted IMO, the RPG reveiws were easier
as there were fewer things applicable to RPG.

As far as open source, if your shop has certain security standards then you
should be running the open source through the same set of reviews.

From a security standpoint, open source is better because you can review

it. With non-open source, you have to take the third party's word for it.
That hasn't worked out so well for Lenovo ;)

Charles

On Wed, Mar 11, 2015 at 11:59 AM, Buck Calabro <kc2hiz@xxxxxxxxx> wrote:

My answer back then: 'We do not have a certification process for any
software, including our in-house RPG. We do not - and perhaps can not -
certify our RPG to meet specific security and supportability criteria,
not the least because there ARE NO security and supportability criteria
to be met.'