Wholesale: Products & Services

Archived System CR SCR041703-04EX Detail

functionality which exists in release 12.0.

Qwest has determined that the following disclaimer language is required for the implementation of this request:

WARNING: Enabling System Clipboard access may have adverse effects on the user’s system, and could allow malfeasant code to share potentially sensitive or confidential clipboard information with external sources. Qwest advises against enabling System Clipboard access, and disclaims responsibility for any resulting adverse effects. User acknowledges that by enabling this access, it is doing so at its own risk.

Status History

Project Meetings

11/20/03 CMP Systems Meeting Connie Winston/Qwest stated that this CR would be implemented with the IMA 14.0 Release on December 8, 2003.

September 19, 2003 IMA 14.0 High-Level Walk-thru Meeting Minutes Excerpt:

Functionality Description: This enhancement will allow IMA GUI users to expand their copy & paste capabilities. By modifying their java.policy file with an "accessClipboard" permission, GUI users will add the ability to copy from and to applications external to the GUI. The external applications used for copy and paste functions must also have system clipboard access. If GUI users choose not to modify their java.policy file, they will still have the internal copy and paste functionality deployed with IMA Release 12.0.

1. If the user decides to change the java.policy file, we will recommend (in the instructions) that a backup of this file be done prior to applying the change. This will protect the user if the java.policy file gets corrupted and provides them the ability to restore to the original java.policy

2. From the Sun Java web site: "Risks of Allowing this Permission: This would allow malfeasant code to share potentially sensitive or confidential information."

3. If the "accessClipboard" permission is turned on, then the GUI applet or any other applet running on the user’s computer, could access information that the user has in the system clipboard. A worst-case example: If the user copied their SSN or credit card number into the system clipboard, then went to a web site, which had a malicious applet, the applet could read this information from the clipboard and send it back to the computer from which the applet originated.

4. Each user would have to change their own java.policy file in order to gain system clipboard access. Depending on the computer literacy of the user, this could take some time. We are estimating it would take the average user 30 - 60 minutes to make the change to their java.policy if they had not done this before.

5. The user support staff may receive numerous calls regarding how to change their java.policy file if they have trouble completing it themselves.

6. If the user does not have "admin" access to their PC, they would have to rely on their local system support person to make the policy file change.

7. If IMA GUI upgrades to a newer version of the Java Plug-in in the future, the users may have to change their java.policy file again, because a new policy file is delivered or created with the new plug-in.

Questions & Answers:

There were no questions submitted for this CR. Connie Winston - Qwest asked if there were any questions or comments. There were no comments, questions, or clarification requested.

5/22/03 CMP Systems Meeting Ann Thomas/Qwest reviewed the description of the CR. She noted that this CR would add the ability to copy from applications external to our JAVA GUI. Ann alsostated that there are some limitations that Qwest wanted to make the CLECs aware of, associated with how Java delivers their applications. IMA will make the code change and anyone who wants to use the external cut and paste functionality will have to make configuration changes on their desktop. You have to go into the Java policy file, add a line to the file that will add the external clipboard permission. Ann also stated that we have no idea how each desktop is configured. It would be something that each user would have to be aware of and do at their own risk .You also need to know that when you open this up, it will open up your clipboard to every Java applet. If you are on the network, and you go to another site that has an applet, anyone may be able to access your clipboard. Ann also stated that with a new release of Java you would have to make the changes to your desktop. Ann referred to the warning included in this CR that states ‘Enabling System Clipboard access affects on the user's system, and could allow malfeasant code to share potentially sensitive or confidential clipboard information with external sources.’ Ann also stated that Qwest advises against enabling System Clipboard access but can do so at your own risk. Ann also stated that this is an option only and if the users do not want to modify their Java policy, they will still have the internal copy and paste functionality that exists in release 12.0

Bonnie Johnson/Eschelon asked since they had this functionality before was the risk always there.

Ann Thomas/Qwest said that when we talked to sun Java they said they do not support this functionality and that it was a bug. This only happened to work in the pre-order screens because of the way it was designed.

Connie Winston/Qwest stated that the before 12.0, when the CLECs were cutting & pasting, they were at risk because of this same issue.

Ann Thomas/Qwest said that there was some risk, but without having the policy file change the risk was not as great.

Liz Balvin/MCI said that we all talked about this and everyone voiced that this has impacted them severely. Liz also stated that she submitted a CR requesting that this request be implemented sooner that 14.0.

Connie Winston/Qwest said that Ann was here to discuss the technical part and since there were no other technical questions, we should conduct the vote for the late adder.

Jim Maher/Qwest stated that we should move forward with the late adder and prioritization and then work the exception CR under the normal guidelines.

Kit Thomte/Qwest said that they could be worked simultaneously.

Bonnie Johnson/Eschelon thanked Qwest for articulating the risks. She also said that she would like to take this back to her IT folks to make sure we are ok with exposing ourselves to this. Bonnie said that her understanding is that you will have the option to do this or not.

Ann Thomas/Qwest said that is true. If you do decide to take this option, Qwest will provide instructions and additional information.

Donna Osborne-Miller/AT&T asked if we are only talking GUI.

Ann Thomas/Qwest said yes.

Lynn Stecklein/Qwest stated that Qwest sent out a notification stating that Qwest would like to process this CR as a late adder for 14.0. She reviewed the vote of ‘yes’ that will indicate a preference to consider the late added CRs for the addition to the initial prioritization list and reprioritization of IMA 14.0 and a vote a ‘no’ will indicate a preference that the CRs are not considered for IMA 14.0 prioritization. She noted that quorum was achieved (more than six were present). She asked everyone to fill out his or her ballots in the room or submit an email ballot. The results of the vote will be reviewed at the end of the meeting.

4/17/03 Systems CMP Meeting Bonnie Johnson/Eschelon stated that she would like to keep the SCR060402-01 Ability to copy & paste within fields in IMA open. Lynne Powers/Tel West reviewed the email (dated 4/16/03) response from Lynn Stecklein/Qwest. (E-mail dated 4/16/03 - This is in response to your e-mail dated April 10, 2003 regarding the functionality question that occurred in the 12.0 IMA Release. SCR060402-01 (Ability to copy and paste within certain fields in IMA) was clarified and discussed in several CMP meetings and was implemented as specified in the request. The copy and paste ability was not supported functionality in the IMA GUI. For this functionality to become available, a CMP Change Request would be required) Lynn Notarianni/Qwest said that copy & paste was not something we ever implemented and designed. We were not aware that you had the functionality. The functionality was actually part of JAVA which is software we don’t even own. Sue Stott/Qwest stated that copy and paste has never been a supported or documented feature for IMA. It was a feature that may have been active based on browser behavior. Lynn Notarianni/Qwest said that this functionality is an external clipboard. Sue Stott/Qwest stated that when this request came in, it required IMA to take control of the copy and paste capabilities for IMA. On the clarification call, it was specified to be copy/paste functionality within IMA only. Lynne Powers/Tel West stated that the individual at Tel West (who originated this) said he does believe that he clarified that he wanted both. Functionality was taken away and the CLECs were never told. Lynn Notarianni/Qwest stated that Jeff Thompson (Qwest) addressed a question from AT&T in a monthly CMP meeting last summer, and the notes reflect what we are saying here that Thompson indicated it was IMA only. Kim Isaacs/Eschelon said that she was told at training that she could go to an outside application and copy & paste. Lynne Powers/Tel West stated that there was no notification that the functionality was removed Lynn Notarianni/Qwest said that again, on the technical side, it was never a supported functionality and that team didn’t know it was being done. We will validate with the trainers regarding whether they knew about the copy and paste functionality and try to improve that process. Lynne Powers/Tel West said that training is a side issue. The real issue is that there was a CR which took away functionality that existed. Lynn Notarianni/Qwest stated that we disagree that this was supported functionality and said that she was not sure we could resolve that issue. To put in a capability to allow you to handle both external and internal functionality is doable and it would require a systems change. Lynn also stated that it would require each of the CLECs to do some work on their side and to update their JAVA scripts. Lynne Powers/Tel West asked if there a list of unsupported functionalities. Lynn Notarianni/Qwest said that would be like asking us for a list of things we do not know. Lynne Powers/Tel West said that this is functionality that was removed Liz Balvin/MCI asked if this process was documented. Lynn Notarianni/Qwest stated that it was never supported functionality and so it was never documented. The functionality to Qwest was not a part of IMA Liz Balvin/MCI said that she was struggling with this concept. How is it that we do not have the functionality now? Sue Stott/Qwest stated that this was not advertised functionality and was not documented anywhere. When the request came in Qwest added functionality to control what could be copied and pasted. It was developed and tested according to the submitted Change Request. Lynne Powers/Tel West said that there was not full disclosure of what was going to happen when this was implemented. Lynn Notarianni/Qwest said that she thought we were at a point where Qwest can’t give you a sufficient answer on how do we know about what we don’t know. She also stated that these types of things do not happen often. Kim Isaacs/Eschelon said that what you are saying is that you did not know what you had. When we called the Wholesale Systems Help Desk, they agreed with us and said they used to be able to copy & paste our email into IMA as well. She also said that when you tell me you did not know, that is not truthful. You knew, you just did not communicate with each other. Judy Schultz/Qwest stated that she did not think that was an accurate statement. She said that what Lynn Notarianni/Qwest is trying to state is that it was never anything developed in IMA. She also stated that the bottom line is that a CR needs to be issued and noted that Qwest would be happy to issue the CR. Lynn Notarianni/Qwest stated that the CLECs have more users than we do internally at Qwest. Lynn requested that for the things that the CLECs do outside of IMA, to please identify what those things are as this would be helpful information. Lynne Powers/Tel West stated that you are asking the CLECs identify functionality outside of IMA that may be taken away. Lynne Powers/Tel West asked if there is a possibility if the GUI users feel that this is not advantageous at all, is there a way to back it out. Sue Stott/Qwest said that we would have to look at it. The frustrating part is that in good faith my team, asked the questions on the clarification call and would have LOE’d to do both. This request will require an LOE to either back out the feature or add the external copy/paste in. It will likely require coding. Lynne Powers/Tel West asked if there was a way not to have to wait a year and a half. Sue Stott/Qwest said that it could be possibly be as a late adder to 14.0. Lynn Notarianni/Qwest stated that Qwest would open a CR and process it as a late adder if that is what the CLECs want. Lynne Powers/Tel West said that is what they want. Bonnie Johnson/Eschelon stated that they feel that Sue Stott’s team are the IT experts. She also stated that they feel that when you knew that you were going to take control of the clipboard functions, we think that you should have come to us to advise that we would be impacted. Lynn Notarianni/Qwest stated that during the clarification calls we can make sure to ask if there is anything being done outside of IMA. Liz Balvin/MCI added that we could ask how the functionality is today. Lynn Notarianni/Qwest said yes, that is a good way to put it. Sue Stott/Qwest stated that it might be important to ask for additional clarification when utility functions are impacted. She will take the feedback to her team. Judy Schultz/Qwest stated that we would issue a CR and bring it forward as a late adder.

CenturyLink Response

Qwest has reviewed the information submitted as part of Change Request SCR041703-04 Based upon the scope of this CR as agreed to in the Clarification Meeting (held April 28, 2003) Qwest is able to provide an estimated Level of Effort (LOE) of 200 to 325 hours for this IMA Change Request with no SATE impacts.

At the May Systems CMP Meeting, CMP participants will be given the opportunity to comment on this Change Request and provide additional clarifications. Any clarifications and/or modifications identified at that time will be incorporated into Qwest’s further evaluation of this Change Request.

Qwest is requesting this CR be processed as an IMA 14.0 Late Adder.

Sincerely, Qwest