Re: Off-List -- Re: How Secure is Windows, Really?

[Keith Carpenter <carpcon@xxxxxxx>]

Joe Pluta wrote:
> > From: Tom Liotta
> >
> > Unfortunately, that isn't actually required. There are a couple ways
> > to get programs into an AS/400 (iSeries, System i) that don't
> > involve savefiles. (Hmmm... in fact, I just reminded myself of
> > another way.)
>
> Unless I completely miss the point, the only way to create a program (other
> than restoring it) is to compile it.  This is another reason why many
> production machines don't even have compilers on them!  But in any event, if
> you give unauthorized users the ability to upload a file and execute it
> (especially to create programs!), then you have a huge hole in your system.

Before Save files (introduced in CPF 6.0 IIRC), there were the
Materialize and Encapsulate APIs (QSCMATPG and QSCCRTPG).  They only
work on observable OPM programs.

QSCMATPG reads the program and outputs data to an 80 byte record file.
QSCCRTPG creates a program from this 80 byte record data.  The data
format is basically the observable program template (binary MI).

Keith