Introducing RACFu

A few months ago a really cool open source project was announced by a talented group of IBMers. It solves real world problems and delivered tangible benefit to businesses looking to create automation and new user interfaces to manage their RACF setups, this new "RACFu" interface provides an API for Python and was designed to be extendable to other languages or use cases in the future (such as a series of Unix shell commands for RACF). For a while me and another mainframer were collaborating with these IBM employees to improve the API and build more functionality, both in terms of giving advise but even contributing code. It was honestly refreshing to see such an open design process from IBM, something we normally only get from their competitors. Often products are just dumped on us and aren't quite what people actually want out of modern software projects, this let us customers collaborate as it was being built.

Example of what it looks like to create a group with RACFu:

The bump in the road

Today I was upset to hear IBM no longer wants to invest in modernizing RACF and has killed the RACFu project. Projects like RACFu are needed to bridge the gap between old and new, as well as to make the platform easy to use. It goes completely counter to IBM's vision of making z/OS easy to work with and making it open. The project was released under the MIT license so it will be migrated over to a system I have access to and community members like myself will carry the project on until completion. The project is already quite usable but still lacks some features that could be useful.

Why this is a horrible signal to send by IBM

Let me just list the reasons why this is bad for the ecosystem:

• It sends the signal that IBM isn't committed enough to security if they are willing to kill the only project to deliver a modern RACF API
• It sends the signal that IBM doesn't want an open platform people can easily work with and extend
• It sends the signal that IBM wants to tightly control any API development on the platform that they're involved in
• It sends the signal that IBM isn't committed to modernizing the platform and addressing pain points customers have
• It sends the signal that IBM isn't aligned internally with whether it wants to maintain the status quo or modernize the platform

I am actually working on utilities in the bank I work for, a major mainframe customer in Scandinavia, that utilizes this new RACF API. We had a lot of use cases that would benefit from this API. I will continue to use this API since it is open source, but this can potentially slow things down for us, as RACFu were still missing some important features we need for some of the use cases we were looking at.

I am a mainframe enthusiast through and through, I browse LinkedIn for mainframe posts multiple times a day, am an active moderator in System Z Enthusiasts, and easily spend 50+ hours each month writing open source software on a z/OS system but when I see IBM doing things like this a little bit of passion inside of me dies honestly.