Re: TESTAUTH LISTPSW not displaying CC for TAR

2013-11-03 Thread Micheal Butz
My mistake I have to break on the instruction that Sets the CC Sent from my iPhone On Nov 2, 2013, at 11:58 PM, Tony Harminc t...@harminc.net wrote: On 2 November 2013 21:47, MichealButz michealb...@optonline.net wrote: [cleaned up messy, space-wasting quoting] I am running a program

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Ed Jaffe
On 11/2/2013 7:34 PM, Peter Relson wrote: SRBs are the same level of security exposure that APF-authorized tasks are. So if an application is already APF-authorized, switching to enclave SRBs is not intrinsically more of a security exposure than already existed. It is true that SRBs are more

Re: Interested in up to date open source software or low cost utilities?

2013-11-03 Thread Rob Schramm
Anyone used it on z/OS? On Oct 30, 2013 5:38 PM, Mike Schwab mike.a.sch...@gmail.com wrote: On Wed, Oct 30, 2013 at 8:38 AM, Shmuel Metz (Seymour J.) shmuel+ibm-m...@patriot.net wrote: deleted Also, isn't gcc available for z/OS? http://gccmvs.sourceforge.net/ -- Mike A Schwab,

Re: FACILITY Class profile BPX.DEFAULT.USER in zOS 2.1

2013-11-03 Thread Rob Schramm
Amen. On Oct 30, 2013 12:00 PM, John McKown john.archie.mck...@gmail.com wrote: IMO, use of UID(0) for a non-BCP component by a vendor or by IBM is simply an indication that the software designer is too damn lazy to determine what access they really need and simply refuse to spend the effort

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Jon Perryman
I suspect we need an SRB that is non-authorized and can never get into an authorized state. I hate giving auditors information with which they can abuse us but this probably needs to be discussed. By making zIIP so cheap, IBM and customers are strongly encouraging us to offload as much work as

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread John Gilmore
I could almost wish that Mr. Perryman's conjectures were correct. They would greatly widen the market for strong assembly-language programming skills, which is much shrunken from what it once was; and that would be good for the platform. Alas, however, . . . John Gilmore, Ashland, MA 01721 - USA

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Itschak Mugzach
SRB mode is only needed if you use IBM's supplied API to zIIP. WLM is the part of z/os that schedules the TCB/SRB to the a proccessor and there is a know-how to do this, and indead requires deep knowledge of mvs interfaces and assembler coding. THe SRBs scheduled on the zIIP (using IBM's supplied

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Jon Perryman
Do vendor's have access to the WLM implementation that allows TCB's to run on a zIIP? Since JAVA was implemented starting with z/OS 1.11, I suspect they may use SRB's otherwise they could have easily retrofitted it to earlier versions.  As for the risk, an SRB can use cross memory facilities.

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread John Gilmore
I will not comment on Mr. Perryman's suspicions, which are not arguments. I will limit myself to noting that 1) an SRB cannot attach a subtask and 2) a [different] SRB that it scheduled into another address space would also disabled for I/O. Peter Relson's point is the important one here. The

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread John Gilmore
On 11/3/13, John Gilmore jwgli...@gmail.com wrote: I will not comment on Mr. Perryman's suspicions, which are not arguments. I will limit myself to noting that 1) an SRB cannot attach a subtask and 2) a [different] SRB that it scheduled into another address space would also disabled for I/O.

Re: BBC News - Russia: Hidden chips 'launch spam attacks from irons'

2013-11-03 Thread Itschak Mugzach
We have dome something similar in USB port. customers are usually protect from USB devices, but allow keyboard/mouse. We programmed a small cheap (bought off-shelve) packed into a usb stick that identifies it as a keyboard. We then was ables program the cheap to create a small bat file to get into

Re: Interested in up to date open source software or low cost utilities?

2013-11-03 Thread Shmuel Metz (Seymour J.)
In 4236639181988702.wa.paulgboulderaim@listserv.ua.edu, on 10/30/2013 at 10:16 AM, Paul Gilmartin paulgboul...@aim.com said: So the programmer codes in a regex /[abc]/, where '[' and ']' are radically locale-sensitive. Must PCRE query the locale to suss out what '[' means, That would be

Re: AW: [slightly] off topic: SPFPRO on Win 8.1

2013-11-03 Thread Shmuel Metz (Seymour J.)
In vmime.52711cc5.4ed2.933c6b6363ae3...@dms02.intranet.set-software.de, on 10/30/2013 at 03:50 PM, Michael Knigge michael.kni...@set-software.de said: Do not even think about trying THE (http://hessling-editor.sourceforge.net/). Okay, it supports Rexx, but it does not really feel like the

Re: ISPF statistics

2013-11-03 Thread Shmuel Metz (Seymour J.)
In 2827497057068213.wa.paulgboulderaim@listserv.ua.edu, on 10/30/2013 at 03:34 PM, Paul Gilmartin paulgboul...@aim.com said: rarely+1. Now that I think of it, there are two uses of RECFM=U for non-load-module data that didn't qualify as rare; Wylbur compressed data and old SAS libraries;

Re: Interesting? How _compilers_ are compromising application security

2013-11-03 Thread Shmuel Metz (Seymour J.)
In 263145282.5266498.1383166791977.javamail.r...@comcast.net, on 10/30/2013 at 08:59 PM, DASDBILL2 dasdbi...@comcast.net said: PITA, yes, but not life-threateningly so.  Consider the following: X = 0 IF X=1 THEN    DC  C'THIS IS A CONSTANT THAT IS NOW REACHABLE SO THE COMPILER WILL NOT

Re: ISPF statistics

2013-11-03 Thread Barry Merrill
There's a third and significant use of RECFM=U. Several IBM ESP programs provide SMF data for vendors in RECFM=U format, so those vendors who process those data on ASCII can directly read those files, since they contain the BDW and RDW and can be ftp'd as binary. If, instead, you attempt to ftp a

Re: ISPF statistics

2013-11-03 Thread Shmuel Metz (Seymour J.)
In 20131031070844.6a4efbce75142c7b59b59...@gmx.net, on 10/31/2013 at 07:08 AM, nitz-...@gmx.net nitz-...@gmx.net said: No. For fixed and variable length records in a PO data set the user field of the directory entry IHAPDS points to the ISPF statistics, which can be 30 or 40 byte long. ISPF

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Ed Jaffe
On 11/3/2013 10:25 AM, Itschak Mugzach wrote: THe SRBs scheduled on the zIIP (using IBM's supplied interfaces) are running in the same address space, so it minimize the risk. Not always. SRB mode is also disabled for IO, so you can't infect other libraries / files like a virus. Not sure

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Jon Perryman
No one was asking for details on how to attach a task but since Mr. Gilmore requires a full explanation, the SRB schedules an IRB that does the attach. My point was that you can do anything with an SRB. Some of the hacks on Windows and Unix are far more complicated than this but someone always

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Shane Ginnane
On Sun, 3 Nov 2013 14:42:18 -0500, John Gilmore wrote: The use of these facilities by the unwashed certainly has great potential for bringing down z/OS. Your implied faith in your coterie transcends mine I'm afraid - the pool of talent seems to be diminishing. Shane ...

Re: Interested in up to date open source software or low cost utilities?

2013-11-03 Thread Mike Schwab
I know a couple of load modules were compiled and tested on z/OS then the binary downloaded and run on MVS 3.8 too. On Sun, Nov 3, 2013 at 10:53 AM, Rob Schramm rob.schr...@gmail.com wrote: Anyone used it on z/OS? On Oct 30, 2013 5:38 PM, Mike Schwab mike.a.sch...@gmail.com wrote: On Wed, Oct

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread John Gilmore
I agree that the pool of talent is being diminished by deaths, low recruitment because of poor perceived economic prospects, out migration for the same reason, and---among the young---a perception that the excitement is elsewhere. This issue is, however, separable from that of competence to work

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Jon Perryman
I think Itschak is saying that SRB's can't do I/O, therefore they can't write files to embed a virus or read confidential data. I think he's under the impression that SRB's can't get access to everything they desire. Jon Perryman.    From: Ed Jaffe

Re: ObamaCare Web Site Problems

2013-11-03 Thread Clark Morris
On 3 Nov 2013 13:01:35 -0800, in bit.listserv.ibm-main you wrote: In 833950007-1383144348-cardhu_decombobulator_blackberry.rim.net-2146530692-@b25.c4.bise6.blackberry, on 10/30/2013 at 02:45 PM, Mike Liberatore vze2q...@verizon.net said: The thing find interesting is if the Affordable Care

Re: Is there currently a way to access MongoDB from z/OS LE languages?

2013-11-03 Thread Ze'ev Atlas
Hi all While I may change my mind in the future, I've pretty much decided to abandon the project for now, for these reasons: 1. Mongo DB data is UTF-8 and not even ASCII. An EBCDIC version is thus irrelevant and not needed. This is different then the situation with the PCRE library where

Re: Interesting? How _compilers_ are compromising application security

2013-11-03 Thread Robert A. Rosenberg
At 21:16 + on 10/30/2013, DASDBILL2 wrote about Re: Interesting? How _compilers_ are compromising applicati: At first, aggressive drivers drove faster than the posted speed limit. Then the police equipped themselves with radar guns to digitize the speed of cars. Interestingly, there

Re: Serialization without Enque

2013-11-03 Thread Jon Perryman
I sure missed that one with the locks.  PLO CDS does exactly what is wanted.  It does 2 CS's within the locked instruction.  PLO CSDST on the other hand only does a single CS followed by 2 ST's. Since 3 separate load instructions (not under PLO control) are required when not in contiguous

aggressive drivers was: Interesting? How _compilers_ are compromising application security

2013-11-03 Thread Jon Perryman
Germany has solved this by sending you a photo with you in the driver seat and shows the license plate / time date  / your speed. The photo was really good night time photo for the distance. Officer's just set the radar gun at the side of the autobahn and just leave. Here, someone would

numeric RACF ID and TSO

2013-11-03 Thread Tom Rusnak
Hi Folks - I saw this discussion around 2008, but never saw any definitive resolution or prohibition so I just thought I'd check to see if anyone using RACF has managed to use TSO with an all numeric userid. I've played around a bit first with a couple of the TSO exits and managed to add an

Re: Security exposure of zXXP was Re: zIIP simulation

2013-11-03 Thread Itschak Mugzach
That's true. You can't infect files/load modulesqetc. ITschak On Mon, Nov 4, 2013 at 2:15 AM, Jon Perryman jperr...@pacbell.net wrote: I think Itschak is saying that SRB's can't do I/O, therefore they can't write files to embed a virus or read confidential data. I think he's under the

Re: numeric RACF ID and TSO

2013-11-03 Thread Elardus Engelbrecht
Tom Rusnak wrote: I saw this discussion around 2008, but never saw any definitive resolution or prohibition so I just thought I'd check to see if anyone using RACF has managed to use TSO with an all numeric userid. This is WAD. Limits for TSO ids: A letter in first position as well as name

Re: aggressive drivers was: Interesting? How _compilers_ are compromising application security

2013-11-03 Thread Elardus Engelbrecht
Jon Perryman wrote: Germany has solved this by sending you a photo with you in the driver seat and shows the license plate / time date / your speed. The photo was really good night time photo for the distance. Officer's just set the radar gun at the side of the autobahn and just leave. Here,