NonStop Looting: How to Steal from the Mainframe You’ve (likely) Never Heard Of - JBoorman

Hello. Um, I expected like three people to show up for this, so there's a little bit more. Uh, but we'll just jump right into it. Quick agenda then. Um, so that we all know what we're going to talk about. I'm obviously going to bore you with some details about me. Um, we're then going to do a little bit of an introduction to non-stop itself because yeah, we kind of need to frame the conversation and we'll talk a little bit about how security non-stop works. We'll then talk go through an attack path in non-stop um that's you know very redacted and uh what's the word it's real but you know I'm not going to tell you where it's from and then we'll talk

a little bit about how you should actually go about looking at it if you end up in a position where you want to look at it and a quick summary and there should be some time for questions at the end so let's just jump right into it so my name is James um I'm a security consultant at Reverse I'm also a global mainframe service lead. So this means I do a lot of mainframe and mainframe related things. Um so I typically focus on mainframe and mainframe related assessments. I do a lot of IBM ZOS which is actual mainframe. And yes I'm going to get to the fact that non-stop is not technically mainframe. Don't worry. I do

a lot of non-stop as well. And then I also do a lot of adjacent stuff that kind of interacts with it like uh DKMS is a key management solution for IBM that kind of sits off the main frame but talks to it a lot. I only started working with mainframe about 4ish years ago. Um, so it's not something at least I don't think that I look like I'm sort of in my 50s or 60s and I've been doing it for 30 40 years. Um, so I'm not going to pretend like I know every single thing there is to know about it, but I like to think that I know maybe one or two things and maybe on a good day that

can be pushed up to three. So, as an introduction, uh, we could go over the history of non-stop and, you know, how it was built and blah blah blah, but that's really boring and we don't really care about it. And you can generate the exact same text that I would with Copilot, which is exactly what you've just seen. So, let's just talk about the things that you actually need to care about, right? So, it's technically mid-range. It's not actually a mainframe. The reason why I refer to it as mainframe is because fundamentally the way that it's architected and makes security decisions and has different subsystems is significantly closer to something like ZOS, a true main frame,

than it is to something like Windows or Linux. Any uh actual mainframe don't kill me, but yeah, I'm calling it mainframe. It's just a big computer. Um, it's got a lot of CPUs. It's got a lot of RAM fundamentally. It's just a big box. It's typically used for mission critical applications. So we're talking about things that require 100% continuous uptime because you know it's important. Zero data loss because it's handling things like transactions and um people trying to take money out and stuff like that and large volume transaction processing. So we're talking about crunching through a lot of stuff quickly. And you might be thinking to yourself, okay, why do I bother with this when I can do the same thing in the

cloud? And that's cuz this existed way before the cloud. So yeah, you've also probably interacted with one, not directly but without realizing it. So for example, ATMs, um, online transactions, point of sale devices. When you go to an ATM and you take out money, it's not guaranteed, but realistically, it's obuscated away behind a few different layers. It is going to a non-stop system, and that's going to sort of make some of the decisions and also talk to other systems to then come back and say, "Yes, you can have some money or no, you can't have the money. You're poor like me. It's also used in other areas. I typically see it a lot in the financial

sector, but you also do find them in places like telecommunications and manufacturing and logistics. So, I'm going to apologize for the introduction because I'm going to throw a lot of terms at you. They mean something to me. They don't mean anything to you. We're going to go through some of them. Uh I don't expect you to remember all of them, but I'm going to try my best. So, sorry. And also, just as a little teaser, this is what we're going to go over step by step. the full sort of attack path that I mentioned where we go from basically nothing to doing things like stealing actual data uh compromising the software that's being used to sort of communicate

and control the ATMs and then full control over a non-stop system. So first things first though we need to talk about a little bit about how non-stop actually works. So we'll go over how files sort of exist within non-stop. We'll go over identity and sort of users and groups and we'll talk a little bit about the attack surface that actually exists within this platform. So files in non-stop are referred to as disk files. Um it's technically a hierarchal file system which is a little bit better than zos cuz zos pretends or at least it looks at first glance like it's hierarchal but actually it's not. this all flat because I don't know Zos Hu but it's only got three layers right

so files are written in the form of volume sub volume disc file where the volume is the literal logical name of the disk the sub volume is just a petition of that volume so a sub volume and then the dis file is a literal file on disk which you know it took me ages to figure out that's why it's called that is really tricky disc files then don't have like file extensions because you know it's non-stop they just have different file codes so you have stuff like uh different executables, text files, etc. We're not going to go over all of that because no one cares and I mean I don't really care either. So the actual security model, we'll get

into the two specific security sort of subsystems it has. So guardian and safeguard, but first we need to talk about how users and groups are represented within non-stop. So within non-stop, all users are implicitly part of what's referred to as administrative group. And when I say implicitly part of it, I mean it's literally part of their username. You can only be part of one of these. For example, you could have the user ops.james or you could have super.james or you could have super.super where the first part before the dot is the group and then you know the bit afterwards is sort of your name that is your identity. So ops.james is fundamentally part of ops. You can have other groups that you

can be part of but this is you can only be part of one administrative group. Also just to be weird they also have numerical representations as well as textual ones that correspond to it. So 220210 could be ops.james. 255210 would be super.js and 255255 would be super do. Super super. It's really confusing when you're looking at uh a lot of sort of like users and groups in non-stop and they've not turned on the textual representations and you have no idea what any of the numbers mean cuz I don't know the numerical representations then only limited to 0 and 255. So you can only have things from 0 0 all the way to 255 255. If you want more users than

that then I don't know unlucky I suppose. And then 255 users are special in relation to the group themselves. So they have administrative permissions over the group. So for example 255 is the built-in group super and therefore the 255 user of that group. So 255 255 is super. And that is the most powerful user you can be within non-stop. If you get super.sup super it's the equivalent of being root on Linux. you pretty much win. You can do whatever you want. So, obviously that's our goal. Let's talk quickly about Guardian then. One of the uh security subsystems that you'll see in non-stop. Um Guardian sucks. Uh it's kind of like the first security system they came up with

for non-stop. There's probably again a history and a reason for it, but yeah, it sucks. It can only secure disc files. So, if you wanted to secure like a sub volume or a volume or a device or something like that, can't do it. And it's really limited in its granularity. It makes you question whether you're actually in 2026 or whether you're back in the 90s or something. Specifically, all you get is a four character string for read, write, execute, purge in Guardian. That's it. And the character in each position is then dictating your uh in each position is dictating your permissions. But the issue is that it's relative to the owner of the file. For

example, you can either have super super is the only one that's got access. Everybody has access. The members of the group of the owners group have access or just the owner. That's it. That's the granularity you get. You get nothing else which kind of sucks a little bit. So they decided to introduce safeguard which is a lot better actually. Did I go over that? I mean you can kind of see in the example I've got here. So you've [snorts] got the volume sub volume and then you've got the disc files and in the column for red execute purge you've got um ng nng. So now I have to think from memory. So N is everyone and then G

should just be like members of the group pretty much. But that's all you can do. Let's talk about safeguard then cuz that's the one that you would see most often um because it's just better. So this was built on top of Guardian. Um it introduced a bunch of extra things that make it sort of a bit nicer. So you can protect volumes, sub volumes, devices, etc. You can also have a create permission. So you might be able to make a file a disk file in subv volume but not be able to edit it afterwards. You've got things like password quality and enforcing password rules in a general global configuration. You can deny people access specifically like in

this example you've got a safeguard record that's protecting the hacks disk file within test.est volume and you've got the ops.james user has got full permissions. Super.super is explicitly denied any permissions on it. And then you've got the opt group is only given, read, and execute. So if you were just in guardian, you wouldn't be able to use that kind of granularity, but this is kind of a little bit more what we're used to, I suppose, in terms of being able to give people access. You also then have some security groups which can be interesting. So these are different from administrative groups. Um these are basically things where membership lets you do specific things. They give you specific permissions like

security auditor will let you interact and safeguard and review records from a read only perspective cuz auditor so you can't mess something up. It's closer to a more modern security system. Um it's got its own quirks obviously but it's kind of a bit closer to what you're used to. It does kind of use the it builds on the readr execute purge. Um but it doesn't use the guardian sort of everyone or groups and stuff. It it's just a little bit better. And you can also do stuff like if you look at the bottom of the example I've got here, you can do uh disc file patterns as well where you can have one record that's

protecting a lot of different disc files that match the same pattern in given volumes or volumes etc. So it's pretty decent. So let's talk about attack surface then. Um this is true for non-stop but also true for pretty much every main frame. There's three core groupings of an attack surface that you get for a main frame, right? network, the applications, and then the platform itself. Now, the network, it's really very rare in my experience to find just random exposed services you can exploit to get yourself in it. It just doesn't really happen that much. It can, but it's just a lot more rare. And when I say applications, I'm talking about things like green screen applications.

Now, these are interesting sometimes in their own right because they can be very old, I think. Yeah, there was an assessment I was on once where I looked at the source code and the first change entry was from 1974. So double my age, which is always cool. But a lot of the time there's no point having application specific controls that are controlled by the application because you can just offload it to the underlying security subsystem and it's built better than what you're going to re-implement anyway. So we're going to focus today on just more of the platform things. um typically with the non-stop all roads lead to safeguard guardian because why would you not defer all

decisions to something that's built to make those kind of decisions and let you secure things. Now I've been informed that locking the doors and forcing you all to listen to me for an entire day is technically kidnapping and is generally frowned upon. So I I don't have enough time to cover everything. We're going to cover some of the interesting and funny ones specifically that relate to that attack path. Um, as a general warning, this is true for non-stop, but also for any mainframe. Don't actually try to exploit any of these if you don't know what you're doing. These systems are running incredibly critical applications. If you think you know what you're doing or you throw like AI at some production

non-stop instance, suddenly it's such a good idea that the news wants to hear about it and [clears throat] I'll come and visit you in prison because you've made it so that 100,000 people can't access that money anymore. I'm not kidding. That's not that's not over exaggeration. Cool. So, story time. So, I'm on a routine assessment, right? Um looking at a non-stop deployment. I've managed to somehow do a good job and convince uh my contact that they should give me access to production, which is rare because of the of the risks. Now, the issue here is that a lot of mainframemes will believe that their systems are secure. So when I'm speaking to my contact, they're not sure sort of what I'm going

to do because it's secure and it's non-stop and they've had it for decades and everything should be fine. So I shouldn't be able to do anything. Now, if there's one thing you're going to learn about me today is that if when if someone says something secure to me, I will make it my mission to prove that that's not the case. I will let it consume me. I don't care. I believe I truly believe that through spite all things are possible. So, we start off we start off in the network, right? We have a little scan around. Um, also, as a side note, don't just randomly scan main frames. You think that it'll be fine, but they'll

fall over and go to prison again. Um, we don't really see anything that interesting. There's some application services that are exposed. There's some SSH is kind of boring and we're thinking, okay, we'll just have to go from the perspective of like an insider threat and just get a foothold. And then I go through my logs and like look at the output and I go, oh, what's this? It's FTP. Surely in, you know, 2026, I can't just log into FTP with anonymous like an anonymous user. You'd be wrong. Um, but that's how we get in, right? So, fine, that's fairly normal. So, where do we go from here? What where do we actually end up in non-stop and where do

we move from there? So, to understand that, we need to talk about we need to talk about open system services within non-stop. So, like pretty much every other main frame in existence, HP decided that they really wanted a Linux subsystem within their main frame. I don't know why. Again, there's probably a valid reason for it that makes it good, but it's basically just a Linux subsystem with a non-stop. It works effectively like a Linux regular Linux box, but it's not its own thing, if that kind of makes sense. It's not like a VM running Linux. It's part of it. Um but yeah, it's got your normal hierarchal file system. You can also access the non-stop file system from OSS

and vice versa. So you can access guardian files and you can access OSS files etc. And it's got like the normal Linux permissions like you know readr execute etc. It's basically fairly fairly boring. So you can try a lot of the regular attacks if you want to like overwriting B binaries or searching files for credentials, modifying configurations, accessing by anonymous FTP cuz that would never happen. [snorts] But one of the more interesting ones that happens more than it should is SSH. And when I say SSH, I mean specifically being able to drop keys into people's authorized keys shouldn't happen. Um but I don't know, it does. So that's where we went next. We had no

permissions to overwrite any binaries. We couldn't really do a lot of anything. And then we found a like home folder for a user that we could just drop a key into for authorized users. So cool, another step in the chain. And obviously we need to add another bit to the diagram because technically you can do that from any user on the system instead of just going through the anonymous FTP first. Cool. Great. Now what? There's a bunch of different subsystems in non-stop. Where do we actually go from there? So, next thing we did, um, we're going to have to talk about batch. Some of you may be familiar with batch, some of you may not. Batch is fundamentally just

executing something as someone at a given time, right? Within non-stop, it's typically used more for housekeeping. Within proper mainframe systems like ZOS, you can have entire applications that are built around batch. Um, so they're usually used for stuff like generating reports or cleaning up data or deleting old files etc. Now the issue is that unless every single disc file that's being executed by this like if you were doing chron jobs on Linux is adequately secured it's quite literally free privilege escalation because in my example here you can see three example batch job configurations right so a batch job fundamentally just has a user ID which is who it's going to run as it has when

it's going to run what the executor program is i.e. in this case is tackle which is basically batch batch yeah which is basically bash sorry for non-stop and then you've got the input and the output. Now this is obviously a far example but it's not uncommon to then see things where like in this example the output file for batch job one is the input file for batch job 2 and then the output file for batch job 2 is the input file for batch job 3 and there is literally nothing to stop you from just going and hopping your way through those. there's not really a lot you can do about it. So that's what we did. We found uh a

batch job that we could affect the input of and then we've got another link in our chain. So currently we can go from nothing on the network and then get our way through to just a user within the system. Great. Cool. Next step, what do we do now? So let's talk about Zygate. So Zygate is a company that provides additional security software for non-stop. So some of their software is really cool. You can do stuff like um auditing users actions and you can do stuff like having um what's the word? Cyber arc connected up to rotate your users passwords on non-stop stuff like that. But the one I want to talk about is um XAC. XAC is a very interesting

piece of software because it's basically letting you have pseudo on non-stop like the same functionality. So you're allowing people to run commands as other people in a slightly restricted way. But the interesting thing for this is that there's a verify user parameter that can be added to them. And when this isn't there or it's not affecting you, it means that you don't have to enter the executing users password when you execute that command. So you know it's kind of similar to um you know pseudo without password, right? And again, there's nothing really to stop you from then chaining these commands together. So in this example, which to be fair, I don't know how well you can see. These

are generally what XST commands look like in terms of their configuration. We've got one command called impersonate James, which everybody's allowed to run and it lets you become me. It's got the verify user set to all. So if you execute it, you have to enter, you have to use your own password to validate that it's you that's running that command. We then have a second command which James is allowed to run. But because that's got verify user all on it as well, it means that you can't run that command as James unless you know James' password, which at that point there's no point. You already know my password, right? However, if you have a command like at the bottom where there

is no verify all, this is what I said before. So you could very easily use this faster call configuration to privilege escalate to me and then chain that command into the bottom command and then at that point you're 25420 without needing to have a password which is cool. Very fun. So again that's what we did. So just as a side note here I think it's worth mentioning vulnerabilities in non-stop and to be fair the wider the main frame as well. They're not typically like showstopping. I did a buffer overflow and managed to go from like unauthenticated to controlling the entire server. They do exist, but a lot of the time it's just a lot of smaller

things misconfigured or forgotten about that you can then chain together to get to the things that you really want to do. Cool. Next up then, so if we I mean I only showed it to you briefly, but we had like three kind of objectives we got to. So we're going to go to the top objective. So let's talk about SQL. So databases and non-stop they you can use something called inscribe files which is like their record-oriented sort of database system that you can use if you really want to you don't have to you can also use SQL specifically in MX and MP form the exact difference between those doesn't really matter from our specs uh

from our perspective but these are basically just structured disk files for SQL right so they contain some data you can run some SQL and then you can interact with them like an SQL database. Now obviously because these are dis files this means that we can protect them with safeguard which is great cuz you know safeguard is what we want. This is true but not true at the same [clears throat] time. So databases within non-stop are typically accessed using the SQL CLI utility. Right now you can have very good safeguard records protecting the disc files themselves. You can't just access the data directly by reading a dis file. But the way that the actual SQL CLI works is

it uses guardian strings to decide whether you get access, which is really dumb. I don't know why, but you can have a situation like in this example, right, where you've got a test super secret sub volume that's got a safeguard record that says only members of the secret group are allowed to read it. But then if you've got access to SQL CLI and you go in and you look at the tables with security vectors of NNN, which is everybody's allowed to access them, the safeguard records don't matter. I don't know why this is the way it is, but here we are. So you can have the best safeguard records in the world, but it's going to use the underlying guardian

strings to decide when you get access through the actual utility, which is really weird. So what could we do with that then? Um, so we found out that that user that we got to had SQL CLI access cuz they were sort of like a database developer kind of person. We then found out that the actual database like the tables in there were just using the guardian strings event. And then that meant that we could just go and take some payment data and this is in production, right? So when I say payment data, I mean card details, transactions, those kind of things. And just as a side note, I'm not going to pretend that this happens every single

time in non-stop, right? Usually things are fairly well secured, but it is really weird. It's like a weird feeling getting access to something like car details because for like split milliseconds, you're like, "Oh, the SWAT team are going to come in and like arrest me cuz I shouldn't be looking at stuff." And then you realize that you're an adult and you're a security professional, so you're fine. So, like a funny story I had was on sort of this engagement. I was poking around some disc files um and poking around some stuff and I saw some data and a lot of the time I don't know what this data means. Right? It's just numbers, could be car details, could be something else.

But I thought, okay, these look a little bit like ATM um like ATM records, right? Now, I had two choices. I could either ask the contact and get them to validate what it is, or I could take the funnier choice, which is go and take some money out and then see if I show up in the records. I did, by the way, cool. There we go. So, other path then, where else can we go? Cuz accessing just car details isn't isn't enough. You have to keep going. Let's talk about tackle. We spoke about it briefly. Now tackle is basically just the shell in non-stop and like other shells it has shell customization for users. So you have something called

tackle local which is like a global customization file and then you have tackle cstm which is a per user customer file. This functions similar to like bash rc in Linux um which obviously means that if you can get to tackle lock you can impact everybody in the same way that if everyone was using a single bash rc then you can impact everyone and tackle csdm will typically exist in I say typically they will exist in every single user's uh default sub volume which really annoyingly as you can see in the example is actually referred to as the guardian default volume even though it's a sub volume but whatever this is the case for every single user

Right. So again, it's very unlikely that there are going to protect be protection records for everything, which means that you can very likely just find your way to one that you can overwrite or a sub volume that you have access to that doesn't already have a tackle cstm CSTM in there. And at that point, you just add some tackle. Obviously, it's more complicated than that, but you just add some tackle that executes when they log on and then bam, you're that user. So again, this is where we went. So we found some tackle CSTM files, one specifically for this user. So we've now gone from nothing all the way over to yet another user chain. Very cool. We

then also had another XAC chain step. So that user was able to execute another XAC command. So we can chain that together. Now let's talk about pathway. So pathway in non-stop is basically how you deploy applications, right? I would say it's kind of like kicks, but that wouldn't technically be true in ZOS. It's basically just a collection of different objects that do different things within non-stop. Well, within the pathway itself and obviously as it's so important, this means that it's going to be controlled by like safeguard records, right? Cuz as we've seen from the pattern, everything important is properly secured and connected by safeguard. Wrong. Again, this still relies on the same guardian style permissions. So, you can do some pretty

interesting things like you can complete if you've got access like you see in the example here where the actual pathway itself has a security string of N, you can do whatever you want. You've got full control over the pathway. For other objects, it's not as straightforward like server objects. Your ability granted by N is more that you can access them and interact with them as opposed to modify them. But the same kind of things apply where if they're loading stuff like in the guardian lib or the program that it's loading, you have access to those disc files, they're going to execute and you've got another program of distillation. So this user had access to pathway

because it was basically running the applications which is great. And because it's got access to pathway and it's non-stop, this meant that we could compromise the pathways themselves and we could interfere with the ATM communications and sort of the control that's coming through. This does not mean that you in theory could um you know get every single ATM to print out money because it's a lot more complicated than that and there's a lot of fraud controls involved. And also you know when I asked if I was allowed to try and keep going and see if I could get an ATM to print out money they said no. Um but I have done it before just

sample. Um so yeah pathway cool. Um but we're still not there. We still don't have full control so we need to keep going right now. Keeping going is actually not that interesting here because it was relatively I say relatively straightforward. It was relatively straightforward. There was just another XAC chain for us to get to and then that user hadn't had access to a batch job that was being executed as super super. So then obviously we get super super and we've got full control. So yeah, I had fun. Um, as I said before, it's nothing like majorly flashy like, oh, I custom coded a a buffer overflow that exploited some floor in non-stop. It's just a lot of

little things that go wrong that have some fairly scary impact because if I, for example, was a malicious actor in this scenario, probably would be on the news if I turned off all the non-stop servers and suddenly ATMs couldn't connect and people have complaining that they can't get money out and then I wouldn't be doing this vlog cuz I'd be in prison. So, I'm glad I didn't. Okay, let's talk a little bit about assessment. Right. I said that I'm not going to be able to tell you everything because I can't. But let's talk generally about how you can approach it because there's a lot of things that sort of exist within the non-stop and it

feels like you've been bombarded with a lot of stuff. And at least when I started it was like, okay, what do I even look at? How do I even approach this? And it's going to sound really obvious and stupid, but fundamentally this is just a big box of Lego, right? You've got the platform, you've got the applications, and you've got the network. And inside those boxes, you've got other little boxes of Lego for you to approach. So from the platform, you're going to want to look at safeguard and guardian because those are the most important things obviously, but you've got like oss, which we spoke about, pathway, batch, the databases, they're all just individual components

for you to look at. Once you understand safeguard and guardian and how it's making the decisions that it's making, everything else kind of just falls into place. It's just syntax more than anything. And then that's the same for apps on the network. You've just got a bunch of different stuff that's probably speaking to safeguard and guardian and you just approach it that way. So it's not that tricky. I say having done this for like 4 years. [snorts] I think I'm going a little bit fast but that's fine. So summary then. I think non-stop's fun. Um I decided to do this talk because I wanted some other people to get involved in non-stop. non-stop is not really

looked at that much um or talked about that much I think and there's a lot of very interesting things that you can do with it. It's still very heavily used throughout a lot of organizations and it runs a lot more critical systems than you think and it's also not really tested as much as other systems. So there's a lot of scope here for doing some fairly interesting things because they've not been tested for 40 years. It seems complicated. Um, but as I said before, all roads lead to safeguard and guardian. Once you understand those, it's not really that complicated. It's pretty much just a box of Lego. Um, you just approach it block by block and then

it falls into place. You can find some very interesting vulnerabilities. So, I like to do a lot of work with mainframe stuff because granted like compromising, I don't know, AD or compromising an organization's website is still important and it's still impactful. is still a cool feeling. But I think main frames and non-stop are interesting because you have that real, I guess, fear, but also excitement that you're finding something that actually matters, right? Like if you mess up, then suddenly a lot of people are very angry at you. But then that also means that when you find something cool, it kind of just makes you feel cool. Again, if you make a mistake, you'll knock something over. you're going to be

in big trouble. Don't take anything that I've said uh as you can just do it. If I find out that any of you have just run like I don't know thrown my offset non-stop then I will visit you in jail. I think I speed ran that a little bit too quickly. Um any questions? No. [laughter] >> Yes. Generally with the batch jobs is it just executables that published to any kind of binary or is it main restricted to language specific? >> Depends. Okay. >> So I get a lot of uh I get a lot of flack from my colleagues whenever they ask me how stuff works because my answer is always depends when it comes to

mainframe. If it was like a batch job that was executing something in OSS, then it's going to be whatever languages OSS support, but it's basically a load subsystem. So you're probably going to have stuff like Java or whatever. If it's something that's within um like the guardian space, it's probably going to be tackle or it might be weird specific architectures and formats that only runs of course. It's the same for pretty much every main frame. I guess it it really just depends on what it's doing. Yes. >> So you say it's it's really difficult to find an environment to practice this kind of stuff on. Do you have like a a recommendation? Is there an environment

where it's safe to practice [clears throat] rather than just >> Yeah. So I mean to be fair if you got into a position where you were you convinced someone to let you do an assessment for this, they probably wouldn't let you touch production anyway. Um, it's not like ZOS where IBM, although I'm pretty sure they've maybe cancelled that, but IBM have been very nice for quite a while where they've let you, it's still expensive, but you can still play around. I asked non-stop for uh the cheapest version I could have, and the koi I still got back was like over 10k. So, and they don't they don't give you anything for free even though fundamentally it's virtualized and it's

a it's basically just a VM. So unfortunately sorry >> I was just going to say no question but this guy over here um since this year 2026 there's a guy doing talk ones >> there are things that >> my question is going to be and I fantasize ization system from the open source community where you've been playing against aware of >> not that I found but I'm also not going to claim that I've looked very very hard right um because for my purposes I usually have enough access and I kind of went through the pain and suffering way of reading a bunch of PDFs to figure this out could be the case um if you

find them give them a try but obviously you know downloading dodgy software from the internet your mileage may vary uh it's not my fault if you Yeah. [snorts] >> When you were learning, um, did you use any documentation that was easy to access, easy to understand, or was it just a matter of bringing it [laughter] playing around until you worked out? [clears throat] >> Again, it kind of sounds like I'm an IBM fan, but I HP's documentation is something. Um, assuming that it's not locked behind a payw wall, they do have a lot of the documentation of how stuff works. However, it's not easy to digest because a lot of the time it's like safeguard

administrator's manual and you're sort of reading through it and going, I don't know what matters to me. Like I I don't know how. Um yeah, I'm probably at some point maybe going to put something out that's like a concise version of these are the things that you need to know to make it easier for people cuz so that they don't have to suffer through three years of PDFs. Um but yeah, unfortunately the answer is no. If it's Z OS, yes, they've got lots of very nice documentation. HP don't feature. Any other questions? >> Yes. >> The key takeway, sorry if I'm wrong, is that it's basically fundamentally >> guardian. Yes. But I can't don't quote

me on the exact history, but that was probably implemented in like the 60s or 70s or something, right? fundamentally and again it's the same for most other main frames it's not really inherent flaws within the security architecture for it so for ZOS for example rackf is very good I have a hate relationship with top secrets we're not going to talk about that but rackf is fundamentally very good it comes down to the people configuring it in the same way that um I know I am policies in theory are very good um and it's the same for non-stop it's just people configuring them in weird ways. And then unfortunately because they've been around for decades at this point, you

get a lot of build up like tech debt where people don't know the way things work or they think it works a certain way cuz that's what they were told when they joined 20 years ago and now the person who actually knows how it works doesn't live there. Well, doesn't work there anymore, right? Um so yeah. >> Yes. >> Just thinking back stuff. Um although you've been looking at nontops when they're fully booted and operational. >> Mhm. >> Have you ever had a chance to play around what they're like in a security state I should probably >> No, they don't trust me unfortunately. Um no, I would like to in a similar way like I've maybe once or twice looked to

um Z from that perspective, right? Because that's sort of more interesting. But I've yet to manage to get to non-stop and I unfortunately can't convince my manager to give me like 15 grand to to let me play around with my own. >> There might be some horror stories during time. >> Yeah, probably. [laughter] >> Any other questions? Yes. >> Yeah. In terms of non-stop, is it a like a sort of increasing industry? And I just wonder how you got into it as well. So, how I got into it, my colleague who did it, what's the correct word for this? Very politely convinced me that it would be interesting. And then here I am. Um, >> yeah, I kind of just fell into it and

then I found it interesting. And like I said before, it's it's fun to do stuff where you sort of know that if you mess up, then you're not going to have a good time. >> Um, what's the first part question I forgot? >> Uh, like is it an increasing >> Oh, an increasing industry. Everyone I know that works for main frame looking at the barrel of retirement like my my Yeah. >> Yeah. So that so that's a current issue with the industry um for like main frames in that a lot of the people who worked with it have worked for like 50 60 years even at this point. A lot of them are retiring or quite quite frankly

permanently retiring. >> Um >> whether it's like an increasing industry it really just kind of depends. So, there's a lot of contacts that I have that talk about wanting to move um I don't know, let's say move some of their Zenos stuff or their non-stop stuff to cloud, right? Or using like cube or containerization cuz mainframes were originally created for high volume processing and extreme resilience, right? So, we're talking about up times measured in decades. Um, and if an L path falls over on ZOS, then it doesn't really I mean it does matter, but it doesn't really matter cuz you've got like six others. You can kind of achieve the same thing right now with

containerization, but it's not easy to sort of unhook yourself from that because these applications and systems have been built up for decades and decades. And if you ever look at like an architectural diagram of how like a financial system is actually working behind the scenes, it's it's insane. There's so many different systems and all of the regulatory pressure. I think this is my own opinion for it is that it's not as simple as making something and then going yes, I think that works and then switching it over and switching it off. You cannot afford to miss a transaction or to even go down for 10 minutes because then you've lost hundreds of thousands of pounds. So,

realistically, we'll see. It could be the case that they stay where they are. It could be the case that a lot of places move over to the cloud because it's easier to do, but I don't think it's something that we'll probably get an answer to for another 5 10 years. The amount of applications on main frame I've had a look at where my contacts been like, oh yeah, this is being sunsets. We don't need to test it and then I'm back in four years testing the same thing because it's not that easy. So yeah, again depends. >> Yeah. >> Yes. >> Just on that one. Um lots of large companies that use main frames of

nontops been looking to try and modernize and do microservices >> and get cobalt and other languages. Mhm. >> As you said, cobalt specialists now are sort of dying off and retiring [laughter] and not being promised with Java changing from this and that >> and not really delivering another 10 15 years of main technology. >> But in the meantime, there's some interesting stuff that's going on like like more with like ZOS. There's a lot of um with that modernization effort, you get a lot of stuff like um exposing underlying mainframe functionalities, APIs through uh ZOS connect on ZOS, which is cool, but then it introduces you've got like your mainframe regular mainframe security risks and then you're

just adding a new layer of regular risks which then let you get into the main frame. So, it's fun and interesting for me. Um it's just going to get more complicated as time goes by until people have fully shifted or not. One final question. We have time. >> I think I got like 30 seconds. Yes. >> So, is there uh is there people increasing the more open trying more modern virtualization or continuity

or complete disaster? I mean, that's a hard question because, and I could be wrong on this, but I'm pretty sure mainframes probably technically invented virtualization. So, like um for example, on uh like when we're talking about non-stop, when I'm saying it's a big computer, it's not just one system running on that computer. You'll have a bunch of different nodes, which are basically individual instances of the operating system, but still running on the same hardware. And then in Z OS you take that a step further and you have like a cislex which can be a bunch of different lars. It doesn't really matter whether they're on a physical system here or a physical system in a different data

center. They're fundamentally the same. ZOS can do stuff like run actual virtual machines. So yeah, um it's it's a lot more about like resilience and sharing um like an architecting hardware sharing, right? Cuz you've got terabytes of RAM and many different CPUs. So the answer I guess the short answer is I genuinely don't know. Like it's it's hard. Anything with mainframe is really hard to predict. The answer is always it depends. >> Cool. quickly while they're not looking. Anyone got one more question? Yes. >> Um, this is a weird one. >> That's good. I like weird stuff. [laughter] I do main frame. I'm weird. >> That's fair enough. So with more neo banks like do you know they are they just

arite only using microservices and second sorry do you think in the next I guess 10 years we will see more legacy like move from their main to >> it depends Um, no. So, in my general opinion, I wouldn't be surprised if the newer banks, yes, are probably just cloud native, right? Because there's there's not really that big of a of a draw, I think, for having a mainframe um versus having something like cloud. Whether or not organizations that have been locked into them for a very long time will shift in like 5 to 10 years. I think they would like to and they've probably got plans to do that in 5 to 10 years. The realistic thing is probably

going to be like 20 years if you were trying to get fully off mainframe. Maybe even 20 30 years. It's it's really hard. >> I can add to that. The answer is no. Uh services from >> Oh yeah. Yeah. What we find is signing looked main and rebuild it in Linux. But yeah, a lot of new just buy main services from the big. >> One of the things I look out for the Monza store is they do a very good technical one. There was a talk with the model architects going to such as core process drop any payments the way they ared their service to their own devices if they're not I think classic step west

all those sort of Yeah, they're going to be using main frames for a good 10 years. >> Yeah, I would say if you're interacting with a bank, then it's much more likely that they're running main frames than then they're not at this point in time. Cool. We done? Good. Thank you. [applause]