Exactly how vulnerable is Lotus Notes R5.08 to security holes, especially on the AS/400? Are most of these threats just to servers outside the firewall?
Yes, most security threats relate to hackers trying to get into publicly visible servers. So if your server can only be seen by employees, then you are safer. On the other hand, it is always good to use the latest stable point release. And there have been many security fixes since 5.08.

This was first published in March 2003