Re: CD Burning software?

["Brad Jensen" <brad@xxxxxxxxxxx>]

----- Original Message -----
From: "jt" <jt@ee.net>
To: <midrange-l@midrange.com>
Sent: Saturday, December 08, 2001 12:04 PM
Subject: RE: CD Burning software?


> Chuck,
>
> Thanks.  Uh.. guess it doesn't need to adopt authority to do
damage.
>
> But, as you noted, not likely to be a practical consideration.
(I wouldn't
> try LODRUN on a CD I got from some neighborhood kid though...
LOL...!)
> What I'm having a hard time seeing is why Brad's coders would
think the
> vendor of the /drive/, rather than the /vendor of the CD/, would
see some
> downside if this functionality was provided.  Maybe they just
didn't want to
> mess with it...

My guy has worked with some large shops that are pretty strict on
security issues.

These are people who would not trust the vendor until the vendor's
lodrun cratered their system. They just won't open that hole in
the first place.

The impression I received from him at the time (this was three
years ago, so it is a rather vague impression) was that third
party software houses that used lodrun were identifying themselves
as either unsophisticated or not-security conscious. (Please don't
heap abuse on my head, I'm reporting a shadowy impression of a
long-ago event.)

I guess the point is that most people are highly security
conscious on their AS/400, and they want to restore with the
permission levels they choose, not give over the machine to some
software from a third party.

My other software runs on hundreds and hundreds of AS/400
customer's machines. I've been turned away from sites when I told
them we needed THEM to use QSEOCFR authority to create a certain
user profile for our software (no the profile does not have
QSECOFR authority). . Even now my installers who go on site are
not permitted (by us, I mean) to use a user profile with QSECOFR
authority. The customer has to do that part. No exceptions.

It's too easy for the customer to blame the next thing that goes
wrong on their machine, on the last software vendor that had
access to it. I want the customer to be confident in their use of
our software.

And yes, we can modify our CD-burning software to create CDs with
LODRUN, I suppose.

It's interesting to me the CA didn't mention this, I have to come
to the conclusion that they aren't using LODRUN either, at least
not on the CDs they make with our AS/400 CD burner.

By the way, I am not trying to suggest that those of you who use
LODRUN are wrong, I'm just trying to explain our point of view on
it, as well as I know it.

Brad Jensen