PINC's "COTS Database" is finally accessible. I received an email (with no typos or grammar errors!) announcing its availability, and apologies for the inconvenience that was apparently caused by a server problem. I was able to use my original registration number to access it.
A brief glance indicates that the database was initially populated by automatically "harvesting" data from "IBM's Year 2000 Ready database". See: www2.software.ibm.com
The vast majority of the product entries have comments referring to the source of the information. In most cases, that was IBM. I don't know whether that presents a problem with regards to "ownership" of the information, but it's a concern.
Since the IBM site is being continually updated with new and more current information, I would expect that the PINC database is becoming gradually out of date. There might be an automated synchronization process that periodically levels the PINC database with the IBM database, but I doubt it.
It appears that manual updates to the PINC database have been made since the initial population to add products and vendors that were not present on the IBM site. The newly added entries have no comment regarding the information source.
The following comments are associated with various vendor/website/compliance situations:
Please note: a homepage was not found at the time of this files creation. The link provided is to the information supplied in the IBM Year 2000 Ready database.
Information was obtained from the IBM Year 2000 Ready database. Vendor's homepage link provided as vendor statement could not be found on this site when this file was created.
The link provided is to the information supplied in the IBM Year 2000 Ready database. A link was provided for the vendor's homepage; but was not accessable at the time of this file's creation.
Information was obtained from the IBM Year 2000 Ready database. The link provided is to compliance information provided by the vendor.
Please note: the link provided will produce a web page which contains a selector which you will need to use to select the product listed.
The information is presented in a more concise format on the PINC site than on the IBM site, but there's no significant advantage in either presentation.
The real meat of the issue is: how do I take the list of files produced by PINC and correlate them to PINC's COTS database?
Answer: Heck if I know!
Access to the information on COTS is by vendor name and product name. The information on the files list is by file name. There is no correlation.
It would take a manual effort to go through the list one file at a time, determine which product a given file belongs to, and then access COTS to see if there is a listing for that particular product.
The problem is that "Joe TypicalUser" can't tell from a file name which product it belongs to. Sometimes you can tell by the directory name (like C:\PROGRA~1\REAL\PLAYER\RVPLAYER.EXE), but there are many times when the name doesn't give a clue about what program it belongs to (like C:\PROGRA~1\MEDIAM~1\DVDEXP~1\DVD\CDVDPLAY.EXE).
Doing the above manual process for 14 pages of a Word document would become very aggravating after a while. Particularly when many of the products aren't in the database. Neither of the above products are in it. Products from popular vendors like Microsoft are represented in the database, as well as some vendors I've never heard of. It's a big world out there.
Note that the date/time stamp on the files list is not needed with regard to the COTS database, because the database only has the product name and version. There is no module level information available. You'd have to get into each individual product and determine what level of product you're executing. Typically, that information is available in the "Help - About" panel. Not always, though.
The COTS database only has value if you know which version of which product you're trying to determine compliancy status for. It provides sufficient information to make that determination, or to determine that the vendor has not yet determined the compliance status of a given product. If the product isn't in the database, you're right back where you started. Not knowing whether it's compliant or not.
Correlating the files list to the COTS database is a nightmarish operation at best. So, if there is no correlation between file names and product names, then why do we need the files list? It would be more useful if the files list was a "products installed" list. I know that would be a difficult thing to produce, but the current situation isn't very useful.
There's gotta' be a better way.
Regards,
TED |
