NetNews Usenet Archive 1992 #18/NN_1992_18.iso/spool/comp/unix/sysv386/13326

Text File | 1992-08-18 | 3.7 KB | 78 lines

Newsgroups: comp.unix.sysv386
Path: sparky!uunet!wupost!gumby!destroyer!mudos!mju
From: [e-mail] (Marc Unangst)
Subject: Questions about MAS90 from SOA
Message-ID: <[e-mail]>
Date: Wed, 19 Aug 1992 05:05:25 GMT
Organization: The Programmer's Pit Stop, Ann Arbor MI
Lines: 68

The company I work for (who shall go unnamed) is very seriously
considering switching over to the MAS90 accounting system from State
of the Art Software running under SCO Unix 3.2v4.0.  Currently we are
using a system written in FoxBase under DOS by an in-house programmer;
however, that system is buggy, and the person who wrote it no longer
has time to support it.

I've gotten an evaluation copy of MAS90 from SOA, and have installed
it on our system.  Having done so, however, I've started to have MAJOR
qualms about both MAS90 and about SOA in general.  Why?  Well...

1. All of the MAS90 files and directories are installed with 777
permissions.

2. The BBx interpreter, which is used to run MAS90, is installed owned
by root and with the SUID bit set.

3. MAS90, as installed, allows the user to run /bin/sh through an
undocumented shell command.  Because of point (2) above, this means
that any MAS90 user can get a root shell.

4. MAS90 has a somewhat alarming tendency to drop the user to the
BBx BASIC prompt if it encounters a specific error condition (mostly
with a printer that is not hooked up).

5. MAS90 is written with the assumption that a user will always be
logging in from the same port.  This assumption does not hold if you
are running it in an environment like ours, with users accessing the
Unix system over a TCP/IP network with telnet.

6. MAS90 pretends to use the standard Unix termcap format, but has
made several proprietary and incompatible extensions to it that force
you to use a separate termcap file.  (For example, it uses MA and MB
to turn on and off high-intensity mode.  What was wrong with so and
se?)

7. MAS90 is run by logging in as "mas90", and then giving MAS90 your
MAS90 usercode and password.  This is very inconvenient, since all of
our other applications are run by logging in as a normal user.  In
addition, all of our users have their own login-id; if they are all
logged in as MAS90, it becomes impossible to find out who's logged in.

Although it is possible to fix most of these problems (I haven't yet
found a fix for (4) above, but have gotten the rest of them mostly
solved), I'm still left with a very bad feeling about MAS90.  It
honestly looks like the BBx and SOA folks just took their DOS product
and recompiled it under Unix, without any thoughts to the differences
in paradigm between DOS and Unix.

Unfortunately, I'm having some trouble convincing the powers-that-be
that MAS90 is a bad idea.  So, I'm turning to the net: Does anyone
have experiences, either positive or negative, with MAS90 in an SCO
Unix environment?  Does anybody have any tips or tricks that could
make working with MAS90 more enjoyable/bearable?  Basically, I'm
looking for convincing arguments on why we shouldn't go with
MAS90, as well as ways of making MAS90 more Unix-like if we end up
going with it anyway.  And while we're at it, are there any other
programs for Unix with similar functionality but more orthodox design?
(By similar functionality, I mean software that handles a client
database, inventory management, purchase orders, invoices, and so
forth.  Your basic core-business type stuff.  We are a computer
reseller, so if there's anything geared to the needs of that sort of
company, that would be best.)

--
Marc Unangst                | Real men don't make backups.  Real men never
[e-mail]   | accidentally delete files that they're going
                            | to need later.