Re: Vendors...
Two examples of vendor boneheadedness:
A hospital management system upgrade that was performed by the vendor. I was required to be present in case they ran into a snag. The only interaction I had with them was when they asked which disk was the OS (VMS) on? I answered but wondered "Huh?". After they left I checked the system out and found that their upgrade had blown away all the account password parameters we'd set up for HIPAA compliance. Password lifetimes changed to 9999 days and crap like that. Nothing in the release notes mentioned any changes like that were to be made. While it was a simple fix via some DCL magic, I had a lengthy phone call about the user account changes with the vendor. Seems those changes were requested by another customer. We got 'em by accident I guess.
When we audited a back office application (again, VMS) for a bank trading system, we found that the users had been granted BYPASS (i.e., God) privilege and it was enabled by default. When we tried to remove that, users were unable to log out of the application. Another "feature": the application opened dozens of files during operation. There were logical names created for each file... all pointing to the same disk. You can imagine how that affected performance. (I/O queues were through the roof.) My boss let me change that by determining which files were the "hottest" and tweaking the logical names and distributing them across multiple disks on our test environment. The application ran like a bat outta hell. Faster than the production system despite the test system running on lesser hardware. Proposing the change to the vendor generated a response of "We won't support you if you do that". We came to the conclusion that they'd developed their application on a workstation with a single disk and because they, apparently, didn't understand VMS very well, set themselves with BYPASS privilege to avoid having to deal with the unpleasantness of proper file permissions. We had to get an official statement from the vendor that the BYPASS priv was mandatory in order to satisfy the bank's auditors.