Date:         Mon, 13 Sep 2010 15:20:12 -0700
Reply-To:     "Sprague, Webb (OFM)" <Webb.Sprague@OFM.WA.GOV>
Sender:       "SAS(r) Discussion" <SAS-L@LISTSERV.UGA.EDU>
From:         "Sprague, Webb (OFM)" <Webb.Sprague@OFM.WA.GOV>
Subject:      Re: FW: [SAS-L] Detect if code has been changed in interactive
              mode
In-Reply-To:  A<AANLkTin_aKk7Z6vzJwt7QtEne+1BGiHwAPFRYOF410gW@mail.gmail.com>
Content-Type: text/plain; charset="us-ascii"

I am not sure if it would help, but often I have seen a source code file
(say "source.sas") shipped with an MD5 hash signature in a separate
file.  (http://en.wikipedia.org/wiki/MD5).  If the source code doesn't
match the signature you know it is altered, though you are unable to
determine how exactly.

> -----Original Message-----
> From: SAS(r) Discussion [mailto:SAS-L@LISTSERV.UGA.EDU] On Behalf Of
> Magnus Mengelbier
> Sent: Monday, September 13, 2010 2:22 PM
> To: SAS-L@LISTSERV.UGA.EDU
> Subject: Re: FW: [SAS-L] Detect if code has been changed in
interactive
> mode
>
> Hello Ya
>
> I have been through this discussion more than a few times. The most
> conservative solution is to only allow "official" outputs, e.g. Draft
> for
> review or Final, to be run in batch, which can be determined a few
> different
> ways.
>
> Experience from SAS Drug Development up until version 3.4, it is
> possible to
> determine if the submitted code is partial or full program. It is also
> possible to determine if the code has been modified prior to
execution.
> The
> approach relies on how SDD functions in the background in setting up
> executions and is easy to implement.
>
> As far as I am aware, there is no sure method in other SAS
applications
> that
> I have experienced to avoid someone running code from a parallel
> editor,
> changed code in the program, etc. I suppose it is possible to create
"a
> macro" that does a simple check but this can be circumvented unless
you
> control the entire outputs mechanism (read ODS statement or similar).
>
> I know of a few groups that use/used a "publish" macro that moved
> generated
> output to a "secure" location and thus used that as a gate for
ensuring
> that
> the output was generated by the goverened process and not hacked
> together by
> partial code submits.
>
> Hope this helps
>
>
> Magnus
>
> --
>
_______________________________________________________________________
> Magnus Mengelbier   (mmr@limelogic.com)
> Limelogic Ltd
> www.limelogic.com
>
> On 13 September 2010 23:07, Huang, Ya <Ya.Huang@amylin.com> wrote:
>
> > Hi Richard,
> >
> > Actually, what I'm concerned is that unless a SAS code is run in
> batch,
> > there seems no way
> > to prevent people from running an modified SAS code and generate
> certain
> > report, then
> > claim the report is generated by the official version of the SAS
> code.
> >
> > Think about this, a validate SAS program is opened up in DM, the
> program
> > name can be obtained
> > from dictionary.extfiles and used in footnote to show the report is
> > generated by this
> > program. But actually the code is modified before running, which
> means that
> > the actually
> > code generated the report is not the original version. Once can run
> this
> > way and not to save the
> > modifed the code, yet show the report is generated by the code.
> >
> > If there is a way to detect the change status, we can probably put
> > something is the
> > footnote to warn people, this report may not from the official
source
> code
> > version.
> >
> > Ya
> >
> >
> > -----Original Message-----
> > From: Richard DeVenezia [mailto:rdevenezia@gmail.com]
> > Sent: Monday, September 13, 2010 12:28 PM
> > To: Huang, Ya
> > Subject: Re: [SAS-L] Detect if code has been changed in interactive
> mode
> >
> > On Mon, Sep 13, 2010 at 12:53 PM, Ya Huang <ya.huang@amylin.com>
> wrote:
> > > Hi there,
> > >
> > > PC SAS, DM mode, is there a way we can detect the change status,
> before
> > > the code is saved? For example, we open up a piece of source code,
> change
> > > a few lines of it on enhanced editor, then submit for running.
> > >
> > > Even more tricky part is to detect if the code submiited is the
> whole
> > > code or just some of the lines that highlighted? (the code is not
> > changed)
> >
> > Ya:
> >
> > If you are worried about trashing good code with bad via an
overwrite
> > (been there, done that), consider an operating system solution. Look
> > for automatic versioning, also sometimes called journaling or
> > generations.
> >
> > One quick out is to tag those important source codes as read-only.
> >
> > Richard A. DeVenezia
> > http://www.devenezia.com
> >