Who Was That Masked Man? Or That Masked Value?

In a recent post, we voiced our concerns about the potential for application error when taking advantage of the masking support related to RCAC in V7.2 of DB2 for i.

One of our concerns was about the potential loss of data when updating a row (aka record) that contained a masked column (aka field) value. For example, a credit card number might be masked like XXXX-XXX-XXX-1057 when retrieved in an RPG program. When that row is updated by the program, it’s quite possible that the actual value of the credit card number might be lost (i.e., overwritten by the masked value as seen by the RPG program).

Our friend, Kent Milligan, commented on the blog that there was support added to DB2 for i to allow the database itself to prevent data loss in that situation. Since we don’t yet have a 7.2 system to “play with” ourselves, we haven’t been able to pursue that and/or other potential solutions for that particular issue. We did, however, recently see an article Kent wrote on the subject.

The basic idea is that DB2 for i has implemented an enhanced capability for check constraints. Typically, if an “ordinary” check constraint were in place, an update to the row would be prevented if the check constraint were violated. That basic support could be used to prevent accidental loss of data by preventing updates if, for example, the first 12 characters of the credit card number were ‘XXXX-XXX-XXX’ (i.e., the mask value). But the problem is that we wouldn’t be able to update any other values in the row either if we had a masked credit card value in our program.

So the new support has added syntax on the check constraint “On Update Violation Preserve <column-name>.” This enhanced support means that if DB2 detects the specified value (i.e., the mask value), then updates will be allowed for other columns in the row but the original unmasked value for the credit card number will be retained. Whew!

Note that it will be necessary to set up this new check constraint option in addition to setting up the RCAC support to mask the column value. Also it doesn’t actually detect that it’s a mask put in by DB2; it only checks for a specific value. So potentially there could be other uses for this support beyond dealing with the RCAC-masked columns—although we can’t think of any.

We encourage you to learn more about this from Kent’s article. This new support doesn’t do away with all our concerns about masked values but at least, if implemented correctly, it would appear to avoid the worst of the potential nightmare scenarios! It may not be the solution we’d have preferred but it should help to prevent many of the mistakes we feared.

 

 

Hear Ye, Hear Ye! It's Announcement Time!

We had an unexpected week off last week due to some issues related to a DDoS attack on the blogging platform's server. Did you miss us? We know a few people did because they wrote to us, which was nice, but we're back now and just in time for the 7.2 announcement, which took place yesterday (Monday, April 28).

In all honesty, the first thing we should point out is that there is very little new RPG content in this release. And most of what is there will probably not immediately impact the majority of you as it relates to CCSID conversions. As Barbara Morris pointed out to us when we discussed this topic in Toronto last week, "You had your presents early, you can't expect to still get another great big gift now." Of course the "present" that she was referring to was the introduction of completely free-form RPG that debuted back with TR7 at the end of 2013. The best part of getting our present "early" was that more of us can get our hands on it now, as the support made it into V7.1. Much better than having to wait until the shop installs 7.2. We'll be experimenting with some of the new 7.2 options as soon as we can get our hands on an upgraded system to see how many of the issues relating to UTF-8 fields 7.2 helps resolve. You can read Barbara's take on the enhancements here.

In fact the only non-CCSID enhancements relate to the ability to control the length of the year portion returned by a %SUBDT. In addition you can also specify the number of fractional seconds in a timestamp. However, this enhancement is really only for external compatibility. RPG will still only populate the same amount of data--we just get more zeroes!

For RSE users, RDi V9.1 was also announced yesterday. The biggest item in the new release is a code coverage tool for testing. You can test your programs and the tool will tell you which lines of code were executed--or perhaps more importantly, which were not executed! Initially it will work only for testing programs in batch but we're hoping it will offer more options in the future.

Also in the new release is yet more proof of how important it is to let IBM know what features you want to see in the future. Several popular Requests for Enhancement (RFEs) were answered with this release. Two of them related to one of our all-time favorite features--the Outline view. The RFEs asked for searching or filtering on items such as field names in the outline, so in 9.1 there's a search box at the top of the outline similar to the one in the Preferences dialog.

The RDi F1 help key will now recognize BIFs and keywords (hurray!) and the wizards for procedures, D specs and Java method calls now have the option to generate code using the new all-free format syntax introduced a few months ago.

So what else is there in 7.2 that is likely to be of interest to developers? Well for one thing the IBM i Integrated Application Server is now powered by Liberty 8.5, the latest app server from the Websphere folks. IBM feels that this will be a good replacement for Tomcat. It is also upward compatible to full Websphere, which means that your experimental use today will not have to be rethought if and when you need to "move up." Although 7.2 marks the public debut of Liberty on IBM i, it has actually been in use under the covers by a number of IBM tools since 2013 so any rough edges should have been worn off by now. Also of interest to the Java aficionados among you, 7.2 introduces a new version of the JT400 Open Lite toolkit aimed firmly at the mobile market.

Those of you that develop Web applications will be pleased to see an update in the Apache server, which takes it to version 2.4 with improved performance and support for Server Name Indication (SNI) and
Online Certificate Status Protocol (OCSP). We know many folks have been waiting for those to appear.

There are too many DB2 enhancements to cover here so we will simply refer you to Mike Cain's blog for more information on those. We also that know many of you make extensive use of the browser based Navigator, Tim Rowe's blog covers the new features in detail.

As and when we get to play with 7.2 we'll be back with more. In the meantime try to be grateful for the presents you've already had.