In a message dated 6/19/2005 4:53:02 P.M. Central Daylight Time, edgould@ AMERITECH.NET writes:
>> ... anyone who worked at the same shop for a long time knows how to >> become APF-authorized ... Knowing how to become APF-authorized and being allowed to by the security rules are two different matters. A decent security audit will look for loopholes that let you bypass the normal security rules, such as undocumented local SVCs that return control in authorized states if you put a magic value in GPR1, a Program Interrupt front end that looks for an illegal op code like X'CA' (CA uses this technique) followed by magic values to request various authorized functions, and the like. All these loopholes should be long gone in any system that takes security serious. Bill Fairchild ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
