Re: Code vulnerability

2018-12-08 Thread zMan
That's actually not crazy, and matches what Tripwire and friends do IIRC. As opposed to a long-ago QA person who would compare each file from each release and demand explanations for each new or changed file. Since this was VM and the products included source code, the conversation would go like

Re: Code vulnerability

2018-12-08 Thread Jeremy Nicoll
On Sat, 8 Dec 2018, at 19:28, Paul Gilmartin wrote: > "ZAP" is a key word. How does one guarantee that any program in any language > hasn't been ZAPped after passing audit? Twenty years or so ago the bank I worked at ran an audit tool which stored a hash or checksum of every loadmodule, and

Re: Code vulnerability

2018-12-08 Thread Walt Farrell
On Sat, 8 Dec 2018 21:09:42 +0200, Binyamin Dissen wrote: >I don't believe this tool would be appropriate for the OP as it detects system >objects (for the lack of a better term) that allow inappropriate privilege >elevation or storage access. Application code would not benefit from this >tool.

Re: IBM sells software portfolio including Notes and Domino to HCL for $1.8b | ZDNet

2018-12-08 Thread zMan
On the bright side, committed IBM shops may be able to move off Lotes to a real email system. On Fri, Dec 7, 2018 at 11:59 AM Dave Jones wrote: > > https://www.zdnet.com/article/ibm-sells-software-portfolio-including-notes-and-domino-to-hcl-for-1-8b/ > > DJ > >

Re: Code vulnerability

2018-12-08 Thread Paul Gilmartin
On Sat, 8 Dec 2018 18:18:04 +, Rugen, Len wrote: >I guess you could write assembler code entirely with > DCX'.' > Don't do that! RLDs? Location independent code? >The use ZAP to maintain it :-) > "ZAP" is a key word. How does one guarantee that any program in any

Re: Code vulnerability

2018-12-08 Thread Binyamin Dissen
I don't believe this tool would be appropriate for the OP as it detects system objects (for the lack of a better term) that allow inappropriate privilege elevation or storage access. Application code would not benefit from this tool. On Sat, 8 Dec 2018 11:13:46 -0600 Steve Beaver wrote: :>I

Re: Code vulnerability

2018-12-08 Thread Rugen, Len
I guess you could write assembler code entirely with DCX'.' The use ZAP to maintain it :-) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the

Re: Code vulnerability

2018-12-08 Thread Steve Beaver
I have known Ray Overby for years. He has a tool that he leases that more looks at the zOS and zOS Program Product level -Original Message- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Richard Way Sent: Friday, December 7, 2018 4:39 PM To:

Re: Code vulnerability

2018-12-08 Thread Timothy Sipples
As another candidate, AppScan Source supports COBOL, but I'm not sure about Assembler. That's quite technically tricky. Timothy Sipples IT Architect Executive, Industry Solutions, IBM Z &