Re: Upcoming spring 2021 RPG enhancements announced today

As I said before - this is not a choice for me. I am not _implementing_ a service I am consuming one. If t requires JWTs then I must supply them - simple as that. Right now while there is a library available for RPG use it lacks breadth in handling different encryption standards and that was the initial thrust of this whole thread.

If we were discussing an architecture for implementing my own service it would be a very different discussion.

On Apr 21, 2021, at 4:31 AM, Tim Fathers <tim@xxxxxxxxxxxxx> wrote:

But Zoom is a totally different use case than your average IBM i web app, I get why you'd want to use a stateless token with a massively scaled application like Zoom, what I don't get is why, if you're looking for a token concept that serves for most cases, you'd chose JWT over a stateful token solution.

________________________________
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of Jon Paris <jon.paris@xxxxxxxxxxxxxx>
Sent: 21 April 2021 01:08
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Upcoming spring 2021 RPG enhancements announced today

In the case of Zoom you have to have an expiry time - when I generate them I set it for 2 minutes currently. The chances of a bad actor being able to exploit that are slim. Also they wouldn't have the secret key. I could reduce the time interval but considering that I'm not securing financially sensitive stuff with it I think this is more than adequate. If it was a banking API I'd want something very different!

On Apr 20, 2021, at 4:32 PM, Tim Fathers <tim@xxxxxxxxxxxxx> wrote:

This was kind of my point. They are designed to be stateless, which is often a requirement for systems that have to scale massively. My problem with them is that they cannot be invalidated while remaining stateless. So if you find a malicious actor or a token being abused, I can't see a way you could invalidate it. Sure, you can maintain a list of invalid tokens, but you're back to storing state, in which case you might as well just use a bland token that you generated and stored in a database. IME, in applications like ours, we don't typically scale anywhere near the levels that would require a stateless solution, but we probably do care about security.

Get Outlook for Android<https://aka.ms/AAb9ysg>

________________________________
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of Jon Paris <jon.paris@xxxxxxxxxxxxxx>
Sent: Tuesday, April 20, 2021 4:47:24 PM
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Upcoming spring 2021 RPG enhancements announced today

Try telling Zoom that!

And they are not the only one.

On Apr 20, 2021, at 11:28 AM, Tim Fathers <tim@xxxxxxxxxxxxx> wrote:

I'm curious as to why you'd want to use JWTs (unless you're having to consume them somehow), their use case seems to be fairly limited and not particularly suitable to systems of our scale.

________________________________
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx <mailto:rpg400-l-bounces@xxxxxxxxxxxxxxxxxx>> on behalf of Charles Wilt <charles.wilt@xxxxxxxxx <mailto:charles.wilt@xxxxxxxxx>>
Sent: 19 April 2021 16:29
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx <mailto:rpg400-l@xxxxxxxxxxxxxxxxxx>>
Subject: Re: Upcoming spring 2021 RPG enhancements announced today

One of my co-workers is working on parsing/generating JWT from RPG...

It's been a fun project for him ;) I wish I could have been more involved.

Once successful, I hope I can get the ok to share.

We have certainly benefited from many open-source RPG projects. I'd like
to give back.

Charles

On Mon, Apr 19, 2021 at 9:13 AM Brad Stone <bvstone@xxxxxxxxx <mailto:bvstone@xxxxxxxxx>> wrote:

I bet it wasn't! I have a feeling it may also be a task to make sure
everything is working properly for it. :)

As I said, I am using web services and GETURI to call a node service. It
works, but if SSHD is down it's no good. And if the shop doesn't have
anyone able to diagnose why, then it's just job security I guess. :)

The only reason I use it for right now is parsing JWTs. So if that could
be something done in SQL or RPG that would be great. Scotts done an
amazing job already making JSON building and parsing available.. JWTs
aren't going away anytime soon, and with web services using them more and
more it would be a great addition.



On Mon, Apr 19, 2021 at 9:57 AM Brian May <bmay@xxxxxxxxxxxxxxxxx <mailto:bmay@xxxxxxxxxxxxxxxxx>> wrote:

Well, you would have to have a Node.js process running, or one would have
to be started, so SOMETHING would need to be running. Much like Java,

you

don't want to start and stop a Node.js process for every call.

This is one of the major features in our Profound.js offering, the

ability

to call Node.js directly from RPG using a normal ILE call. It also
provides a mechanism for Node.js to call RPG directly. I can tell you,

it

was not simple to implement.

Brian May
Director
Pre-Sales and Customer Solutions
Profound Logic Software
http://www.profoundlogic.com <http://www.profoundlogic.com/>
937-439-7925 Phone
877-224-7768 Toll Free


UI Modernization… And More!

www.profoundlogic.com<http://www.profoundlogic.com<http://www.profoundlogic.com<http://www.profoundlogic.com>> <http://www.profoundlogic.com/><http://www.profoundlogic.com <http://www.profoundlogic.com/>>


-----Original Message-----
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx <mailto:rpg400-l-bounces@xxxxxxxxxxxxxxxxxx>> On Behalf Of Brad
Stone
Sent: Saturday, April 17, 2021 12:51 PM
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx <mailto:rpg400-l@xxxxxxxxxxxxxxxxxx>>
Subject: Re: Upcoming spring 2021 RPG enhancements announced today

If you haven't written an upper or lower ile function yet, where have you
been? :)

What RPG really needs these days is the ability to parse JWTs, or be able
to call node.js directly (not using a web service, etc... nothing else
needing to be running). If you can already, I'd love to see how. There

is

so much functionality available with OSS (node.js being my favorite)

that I

wish I could call it similar to calling Java or even just calling a CL or
RPG program.

Maybe that would be more suited for SQL (JWT processing that is)?



On Sat, Apr 17, 2021 at 8:10 AM <midrangel@xxxxxxxxxxxxxxxxx <mailto:midrangel@xxxxxxxxxxxxxxxxx>> wrote:

Naïve, hardly, you raise a good point.

As to your first question, I think you answered it yourself. The
compiler merely turns RPG into executable code. I don't believe there
is a classic "runtime" involved, since ultimately it winds up being
some fashion of MI before the executable is created. Therefore the
complier has to come up with a way to build efficient MI code to

execute

the instructions. Hence

only patching the complier. Furthermore if IBM wanted to patch more

than

the compiler in one PTF they certainly can do that. (and sometimes
do...)

Yes, this has been done many, many times in the past going back
several versions if not releases.

-----Original Message-----
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx <mailto:rpg400-l-bounces@xxxxxxxxxxxxxxxxxx>> On Behalf Of John
Yeung
Sent: Friday, April 16, 2021 9:29 PM
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx <mailto:rpg400-l@xxxxxxxxxxxxxxxxxx>>
Subject: Re: Upcoming spring 2021 RPG enhancements announced today

7.3
ILE RPG runtime: SI76098 - you need this PTF on any 7.3 system where
you run a program with %LOWER, %UPPER, or %SPLIT ILE RPG compiler:
SI76100

Interesting. So you need to patch the runtime as well. Is this normal?
I don't recall other language updates mentioning runtime PTFs, only
compiler PTFs.

Notably, the RPG Cafe entry for the FOR-EACH, IN, %LIST, and %RANGE
bundle doesn't mention any runtime PTFs:

https://www.ibm.com/support/pages/node/6342821 <https://www.ibm.com/support/pages/node/6342821>

Those strike me as more substantive changes. If anything, I would have
expected those to require an updated runtime. %LOWER, %UPPER, and
%SPLIT seem like functions that a competent and motivated RPG
programmer could implement themselves, and many *have* implemented

their

own DIY versions.

Granted, the DIY ones are almost always vastly more rudimentary than
these BIFs (for example, a lot of native-English shops wouldn't bother
to handle accented characters). But conceptually, these still seem
very achievable with the preexisting runtime. Is it naive of me to

think

that?

John Y.
--
This is the RPG programming on IBM i (RPG400-L) mailing list To post a
message email: RPG400-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link:
https://amazon.midrange.com <https://amazon.midrange.com/>

--
This is the RPG programming on IBM i (RPG400-L) mailing list To post a
message email: RPG400-L@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L@xxxxxxxxxxxxxxxxxx> To subscribe, unsubscribe,
or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l <https://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives at
https://archive.midrange.com/rpg400-l <https://archive.midrange.com/rpg400-l>.

Please contact support@xxxxxxxxxxxxxxxxxxxx <mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription
related questions.

Help support midrange.com <http://midrange.com/> by shopping at amazon.com <http://amazon.com/> with our affiliate
link: https://amazon.midrange.com <https://amazon.midrange.com/>

--
This is the RPG programming on IBM i (RPG400-L) mailing list To post a
message email: RPG400-L@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L@xxxxxxxxxxxxxxxxxx> To subscribe, unsubscribe, or
change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l <https://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives at
https://archive.midrange.com/rpg400-l <https://archive.midrange.com/rpg400-l>.

Please contact support@xxxxxxxxxxxxxxxxxxxx <mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related
questions.

Help support midrange.com <http://midrange.com/> by shopping at amazon.com <http://amazon.com/> with our affiliate
link: https://amazon.midrange.com <https://amazon.midrange.com/>
--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L@xxxxxxxxxxxxxxxxxx>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l <https://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l <https://archive.midrange.com/rpg400-l>.

Please contact support@xxxxxxxxxxxxxxxxxxxx <mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related
questions.

Help support midrange.com <http://midrange.com/> by shopping at amazon.com <http://amazon.com/> with our affiliate
link: https://amazon.midrange.com <https://amazon.midrange.com/>

--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L@xxxxxxxxxxxxxxxxxx>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l <https://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l <https://archive.midrange.com/rpg400-l>.

Please contact support@xxxxxxxxxxxxxxxxxxxx <mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related
questions.

Help support midrange.com <http://midrange.com/> by shopping at amazon.com <http://amazon.com/> with our affiliate
link: https://amazon.midrange.com <https://amazon.midrange.com/>

--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L@xxxxxxxxxxxxxxxxxx>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l <https://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l <https://archive.midrange.com/rpg400-l>.

Please contact support@xxxxxxxxxxxxxxxxxxxx <mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support midrange.com <http://midrange.com/> by shopping at amazon.com <http://amazon.com/> with our affiliate link: https://amazon.midrange.com <https://amazon.midrange.com/>
--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L@xxxxxxxxxxxxxxxxxx>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l <https://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx <mailto:RPG400-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l <https://archive.midrange.com/rpg400-l>.

Please contact support@xxxxxxxxxxxxxxxxxxxx <mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support midrange.com <http://midrange.com/> by shopping at amazon.com <http://amazon.com/> with our affiliate link: https://amazon.midrange.com <https://amazon.midrange.com/>

--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com
--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com

--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com
--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com