On 2012-02-04, Subcommandante XDelta <
v...@star.enet.dec.com> wrote:
> On Sat, 4 Feb 2012 23:37:13 +0000 (UTC), Simon Clubley
><clubley@remove_me.eisner.decus.org-Earth.UFP> wrote:
>
>>It's a pity they were not assigned to producing the VMS patch kits after
>>responsibility for said patch kits was moved to India.
>>
>>PS: In case my point is too subtle: I don't subscribe to JF style
>>theories, but instead believe in taking a evidence based approach when
>>possible and there's now plenty of evidence with which the quality of
>>the VMS India team can be compared to the old Nashua VMS team.
>
> Such as? - which is not intended to be a contest of your assertion,
> but out of genuine curiousity - such as?
>
Clearly, you have not been reading this newsgroup over the last
couple of years. :-)
If you have a account on Eisner, you can also find a dedicated thread
(note 3629.*) discussing the patch issues in the VMS Notes area.
You should also check out the issues around the release of V8.4 discussed
in other threads on Eisner (as well as here in comp.os.vms).
If you don't have a Eisner account and don't want to create one, use
Google to search comp.os.vms for patch problem and similar searches
as the issues were also discussed here.
I've included a sampling of the messages from Eisner below.
Here's something I wrote to HP back in December 2009:
| <<< EISNER::DRA1:[NOTES$LIBRARY]VMS.NOTE;1 >>>
| -< VMS and bundled utilities >-
|================================================================================
|Note 3629.13 quality control issues with Alpha VMS 8.3 patches 13 of 79
|EISNER::CLUBLEY "Simon Clubley" 52 lines 16-DEC-2009 06:05
|--------------------------------------------------------------------------------
|
|From: EISNER::CLUBLEY "Simon Clubley" 16-DEC-2009 06:00:19.69
|To:
OPENVMS....@HP.COM
|CC: CLUBLEY
|Subj: Major concerns about current VMS patch quality
|
|Hello,
|
|Over the last few months, since VMS engineering in the US was disbanded
|and it's functions moved elsewhere, there has been a disturbing series
|of incidents with the patches which have come out since then which seem
|to show a basic lack of understanding of VMS on the part of the people
|now entrusted with maintaining VMS.
|
|For example, in one patch, a delete command in the patch's installation
|routine wasn't properly specified showing a lack of basic understanding
|of DCL on the part of the engineers creating the patch as well as showing
|that the patch had not been properly tested prior to release.
|
|In the current patch been discussed on comp.os.vms, it appears that the
|engineers fixing the problems with the current patch did so by removing
|some modules from the patch kit before releasing it back under the exact
|name even though it had been modified.
|
|There are two problems with this: First that a modified patch kit was
|released under the exact same name as the previous version instead of
|been given a new version number, and second, presumably those modules
|were in the patch kit in the first place because they fixed other
|unrelated problems.
|
|These and other incidents, which have been discussed in places like
|Eisner and on comp.os.vms, are causing me (and apparently other people
|as well) major concerns about the quality of VMS in the future.
|
|As a final note, one bit of advice which was issued by HP recently
|in relation to one specific patch stated that even though the patch kit
|recommended terminating installation due to an error been encountered,
|the advice from HP was to continue with the installation anyway.
|
|VMS system managers are not used to been told to continue a procedure
|in the face of a recommendation to abort installation. While I understand
|that in this specific case, continuing was acceptable, I hope that it's
|not considered acceptable practice now to allow installation procedures
|to throw an error on the basis that the system manager is expected to
|ignore them and to continue anyway.
|
|What are your thoughts on this ?
|
|Thank you,
|
|Simon Clubley
|
BTW, the delete command problem was due to a version specification been
missed off the command. The kit made it all the way through "testing" and
out into the wild before the error was discovered.
If something that basic doesn't get caught during testing, then how can
you have confidence in the kit as a whole ?
I got a generic "we're sorry" answer, and a promise to investigate.
I never did get a proper answer.
Here's another one:
| <<< EISNER::DRA1:[NOTES$LIBRARY]VMS.NOTE;1 >>>
| -< VMS and bundled utilities >-
|================================================================================
|Note 3629.15 quality control issues with Alpha VMS 8.3 patches 15 of 79
|--------------------------------------------------------------------------------
|VMS update February 2010
|
http://www.openvms.org/stories.php?story=10/02/09/5563218
|
|Includes a link to the following:
|
http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02001423
|
|SUPPORT COMMUNICATION - SECURITY BULLETIN
|Document ID: c02001423
|Version: 1
|HPSBOV02505 SSRT100023 rev.1 - HP OpenVMS RMS, Local Escalation of Privilege
|NOTICE: The information in this Security Bulletin should be acted upon as soon
|as possible.
|Release Date: 2010-02-02
|Last Updated: 2010-02-02
|Potential Security Impact: Local escalation of privilege
|Source: Hewlett-Packard Company, HP Software Security Response Team
|
|VULNERABILITY SUMMARY
|A potential security vulnerability has been identified with certain RMS (Record
|Management Services) patch kits for HP OpenVMS running on ALPHA platforms. The
|vulnerability could be locally exploited resulting in an escalation of
|privilege.
|
|References: CVE-2010-0443
|SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
|RMS patch kit VMS83A_RMS-V1000 dated September 2009 and update kit
|VMS83A_UPDATE-V1100 dated November 2009.
[snip]
Here's another one:
| <<< EISNER::DRA1:[NOTES$LIBRARY]VMS.NOTE;1 >>>
| -< VMS and bundled utilities >-
|================================================================================
|Note 3629.70 quality control issues with Alpha VMS 8.3 patches 70 of 79
|--------------------------------------------------------------------------------
|
|OpenVMS Alpha V8.4 VMS84A_UPDATE V4.0...
|
|<
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02720117>
|
|VMS84A_UPDATE-V0400 replaces APB.EXE, and doesn't WRITEBOOT, which means
|the new APB.EXE won't be used, though the old APB will usually continue
|to work until it gets overwritten or gets erased.
|
|The customer note above also includes text that implies APB.EXE might
|not be created contiguously, and recommends a COPY /CONTIGUOUS to
|resolve that.
|
|Remember to WRITEBOOT early, in other words.
|
I really got annoyed about this one.
This is exactly the kind of issue which will pass your post patch testing
but months/years later, when you have to reboot for a unrelated problem,
you find that your system won't boot anymore. Even worse, because
significant time has probably elapsed since installation, you waste time
looking at what you just did that caused you to take the system down
instead of looking at the faulty patch you installed in the past.
You could have significant downtime with this type of problem before you
realised what the real problem was.
And yes, I am aware that this also happened in the distant past when Nashua
was around, but the point is that Nashua learnt from this and made sure
it didn't happen again.
This is just a sampling of the problems.
The problem is not any one patch (even Nashua issued bad patches every once
in a while), but rather it establishes a pattern of a steady stream of
patches with problems, including basic ones, which should have never
occured or should have been caught during testing before release.
Simon.