8 ms·
Oracle’s license agreement as it pertains to reverse engineering
- uptown 11y agoThis is a deleted blog post by ORACLE's Chief Security Officer. edit: corrected my error
- pekko 11y agoOracle's, not Cisco's.
- smcl 11y agoSo the original popped up earlier on HN - was it resubmitted because Oracle have decided to delete it?
- rincebrain 11y agoI believe it was resubmitted because Oracle deleted it, and because it was so mustache-twirlingly out of touch that it could have been from the Hacker News Onion.
- justthistime_ 11y ago[...] it was so mustache-twirlingly out of touch that it could have been from the Hacker News. FTFY :-P
- jfmercer 11y agoUnless I am mistaken, that is exactly the case.
- syntheticnature 11y agoOriginal, pre-deletion discussion: https://news.ycombinator.com/item?id=10039202 https://news.ycombinator.com/item?id=10039202
- legutierr 11y agoUntil I clicked this link, it didn't occur to me that this blog post was only posted and then deleted in the last couple of hours. My original thought was: "What an interesting artifact! So much has changed in recent years since open source databases have become a viable alternative to Oracle."
- myth_buster 11y agoThis is quite relevant in other spheres as well (racism, inequality, genocide). It's natural to create a bubble around us to keep the negativity at bay. But reality sometimes pops that bubble. It's always surprising how many have to interact with them for one reason or another.
- deleted 11y ago[deleted]
- jezclaremurugan 11y agoPerhaps an apology/clarification would have been better than sheepishly deleting the entry. They seem to be only digging the hole deeper.
- rcarmo 11y agoLet's wait and see if the Streisand Effect takes hold.
- kephra 11y agolets wait, if Oracle does a DCMA on Archive.org I guess some more people did screenshots, or pdf prints of that page, just for the case Oracle wants a Streisand Effect.
- charonn0 11y agoThere's already an Ars Technica article. [1]: http://arstechnica.com/information-technology/2015/08/oracle-security-chief-to-customers-stop-checking-our-code-for-vulnerabilities/ http://arstechnica.com/information-technology/2015/08/oracle...
- tux 11y agoLove how fast HN'rs mirror articles ^_^
- fs111 11y agoThat is the web archive. It has nothing to do with HN.
- asgard1024 11y agoActually it would be quite interesting to read about how the Web Archive accomplishes things like this.. Do they regularly scan news sites for new articles?
- chbrown 11y agoYou can also request that the Web Archive fetch a URL from their homepage: https://archive.org/web/ https://archive.org/web/ ("Save Page Now" in the bottom right). I triggered the 7:09 copy this way; whether or not the other four fetches yesterday were also manual, I don't know.
- csixty4 11y agoI know if there's a controversial post that gets a lot of visibility, the IA staff takes a snapshot. They're useful in times like this where content is edited or deleted.
- sanbor 11y agoI know they check more frequently news websites. Maybe in this case they just used RSS.
- juliendorra 11y agoThere is a self-archive tool on archive.org that allows anyone to immediately archive a specific page of interest. Journalists and watchdogs use it on pages they feel might disappear. It can be considered more legitimate that a screen capture, as archive.org is a third-party. Someone might have used that here.
- fortytw2 11y agoNot that I agree with the sentiments in the article, but am I the only one who thought this article was reasonably well thought out? It may have been a bit abrasive, but the points were well made, at least from the perspective of a closed source, enterprise software vendor
- panfist 11y ago>customers Should Not and Must Not reverse engineer our code. However, if there is an actual security vulnerability, we will fix it. We may not like how it was found but we aren’t going to ignore a real problem...We will also not provide credit in any advisories we might issue. You can’t really expect us to say “thank you for breaking the license agreement.” Until I read this, I didn't think it was possible for me to hate Oracle more, because I'm forced to work with their software and that makes me already hate them quite a bit.
- outworlder 11y agoThe software is the good part of Oracle. You figure out the rest.
- jaawn 11y agoIf you're forced to use their software, and you disagree with their strong closed-source stance, you should share your views with whoever is doing the "forcing" (your employer?). If they don't listen, it's on them. Oracle has a very specific, clear opinion on the matter and it is valid to have that opinion. I don't agree with them, but I respect that we're allowed to disagree. Instead of hating them, I just don't use any of their stuff if I can help it (except Java). There's no need to be filled with hate over it. Change what you can change and don't worry about the rest.
- niklasni1 11y agoIt's not that simple I don't think. How much of my private information, as kept by government or private organizations, are stored in Oracle databases that are less secure because of their boneheaded stance on this? People have all sorts of reasons for choosing Oracle solutions. I am not in a position to influence all those people, even when their choices affect me directly.
- dimman 11y agoAfternoon laughter, thanks :D
- gambiting 11y ago" We will also not provide credit in any advisories we might issue. You can’t really expect us to say “thank you for breaking the license agreement.”" This is so pretentious I am completely baffled. Are people at Oracle so full of themselves?
- hahainternet 11y agoOracle vs Oregon. Go check it out to see levels of arrogance that you would assume must be chemically driven.
- selimthegrim 11y agoGiven that Oracle was literally hiring fresh out of liberal arts college humanities majors with no tech (or management) experience ever and paying them six figures as project managers on Cover Oregon, as late as the integration stage the January before they scrubbed it, I wouldn't be surprised.
- noja 11y agoOracle is unbreakable, silly.
- deleted 11y ago[deleted]
- gwbas1c 11y agoThe crux of the article is that Oracle is getting so many unsolicited false positive security threat vulnerabilities that it's a distraction to their core business. They don't want "I found a hole in Oracle" to be an achievement like "I have my name on a patent." Investigating security vulnerabilities takes a lot of time; and it's very easy to quickly get overwhelmed by false positives. I've seen quite a few analyses of code that I write; and most of them are warnings with no context or exploitability. If every customer expected an engineer to respond to these, my team would spend all of its time in a "PR role," and wouldn't spend any time improving our products.
- 11y ago
- werber 11y agoI'm pretty surprised Oracle deleted the post, it feels like a great representation of the company and their values.
- rcarmo 11y agoThis is why I sometimes wish HN had an ::irony:: tag. :)
- kabdib 11y agoDon't worry, there are other blog posts there by the same person, many of which provide the same sense of mission and customer focus. (popcorn)
- kordless 11y ago> developing a lot of fun new ideas for dispatching people They probably felt it got off on the wrong foot with personal anecdotes. Better to keep it all business, IMHO.
- wereHamster 11y ago> Oh, and we require customers/consultants to destroy the results of such reverse engineering and confirm they have done so. Are they being serious? "Uhm, yeah, sure, Mr. CSO, I deleted the file. Here, I'll show you a screenshot of a terminal where I ran the 'rm' command to delete the results. As you can clearly see, the 'ls' command does not see the files anymore."
- sp332 11y agoIf it's a legal requirement, they can just sue you for breach of contract whenever they eventually find out that you didn't delete it.
- btown 11y agoMany large organizations log shell commands for audits. Those logs can be stored offsite by a third party to prevent alteration. See, for instance, the Goldman Sachs programmer arrested for stealing code. If the consulting group is professional, it will take these things seriously.
- taejo 11y agoNot "prove". "Confirm". If you ask somebody to do something, they might do it, or they might not, whether out of passive malice or carelessness. Saying you have done something which you haven't done requires active malice, which is much less common.
- TheOtherHobbes 11y agoThat's pretty much the level of advice in the blog. Astounding the author considers themselves a security professional. Nice rant about Keynes at the end as well. I always find ranting about Keynes is an excellent way to keep hackers out. I wonder how many customers Oracle is going to lose because of that piece?
- parasubvert 11y agoThe bit about loathing Keynes at the end makes for comedy gold.
- kagamine 11y agoWhy put a tonn of whitespace between paragraphs if the text is so small and line spacing so narrow as to make my eyes force-evolve mouths just to let out a scream?
- frou_dh 11y agohttps://news.ycombinator.com/item?id=9238739 https://news.ycombinator.com/item?id=9238739
- kagamine 11y agoGreat, but before people submit they should consider whether or not the page they are submitting is legible. If I handed you a printed manuscript that was hard to read would you persevere or hand it back to me?
- zamalek 11y agoDisclaimer: cross-posted from the original post, but the irony is absolutely beautiful and is a stern lesson to everyone who might think the same way as Oracle. [1]> Oracle has told people to stop using @Veracode to test their AppSec. They already got AppSec covered [picture of JS injection attack in the blog post] [1]: https://twitter.com/thegrugq/status/631056841670135808 https://twitter.com/thegrugq/status/631056841670135808
- usaphp 11y agoAs Mary Ann said: "Nanny, nanny boo boo..."
- deleted 11y ago[deleted]
- someguy342432 11y agoWe sold you the car but don't you dare look under the hood, 97% of problems that these cars come with may one day be solved by us. Someone else may be trying to build the same car you already purchased from us! Why didn't we obfuscate access to the engine? Well that would have required some of the same effort it would have taken to write more secure software err make better cars in the first place! What do you take us for, competent!
- vonmoltke 11y agoI'm just waiting for the day some physical product manufacturer has the chutzpah to try to apply the "licensed, not sold" paradigm to a tangible product.
- emodendroket 11y agoJohn Deere is already doing this and nobody really cares.
- vonmoltke 11y agoYou mean nobody outside of farming. From what I have read, the smaller farmers who have to deal with that shit certainly care.
- emodendroket 11y agoWell, no, not really. I mean, I'm sure some small farmers do care, but they're a vocal minority in the same way people posting on Hacker News about various computer-related ills most people are unconcerned about are a vocal minority.
- qbrass 11y agoThat's what leasing is for.
- bestest 11y agoWell. It's kind of happening already. Some "tangible" product manufacturers create products that fail at a specific time in the future, usually after the warranty is void: great examples may be seen in the automotive industry, for example (won't get in to details -- don't want to sound like a conspiracist). We'll never know, of course, if that is intentional, but it is happening quite widely.
- deleted 11y ago[deleted]
- knodi123 11y agoTechnically, you're wrong. breaking and entering. v., n. entering a residence or other enclosed property through the slightest amount of force (even pushing open a door), without authorization. If there is intent to commit a crime, this is burglary.
- Shivetya 11y agoNo, breaking refers to the act of crossing the threshold. Some states may not even have breaking and entering on their books. Trespassing is where you violate signage or warning; verbal or written.
- jebblue 11y agoThis site agrees with you: http://www.expertlaw.com/forums/showthread.php?t=106435 http://www.expertlaw.com/forums/showthread.php?t=106435 "People often confuse "breaking" with some overt act used to gain entry, like kicking in or prying open a door or window. But as Tiger noted, "breaking" refers to the violation of the "plane" which constitutes the natural boundary of things like walls, doorways, or window openings - so even reaching THROUGH a threshold or imaginary "plane", such as an open window where the natural continuation of the wall (or even car door) would constitute the plane broken by the reaching."
- ceejayoz 11y agoPlus, Oracle's approach is like renting from a landlord who won't let you check that the locks work.
- PaulHoule 11y agoIt sounds like Oracle doesn't want to have any customers.
- bkeroack 11y agoOracle appears to be Microsoft circa ~1999/2000. Some of us remember when all the big software companies had this type of attitude.
- pgaddict 11y agoI'm really confused why everyone's so upset by the blog post, for a number of reasons. Firstly, it's perfectly aligned with the world of proprietary software. Oracle is probably more protective than the other vendors, because the restricted access to the source code is at the heart of their business model. But none of the vendors I'm aware of is very keen on reverse engineering. Secondly, the reverse engineering is prohibited for ages - it's not that it was added to the license agreement yesterday. And there are other restrictions (e.g. on publishing benchmark results), so rather that "Oracle is bad" I'd say "people who sign accept license agreements without reading them are morons." And thirdly, the article is spot-on about usefulness of the reports generated from a reverse-engineered binary. I've seen shitloads of such reports, usually generated by some clueless consultant with the sole competence to run an automated tool and print the result. So it's probably (at least partially) a protection against a flooding the support with bullshit reports. And it's also true that many of the companies don't have proper security rules (like encryption, identity or password management, network security) yet pay some consultant for reverse engineering one of the components. Because it's easier to spend a large amount of money than evaluating and rebuilding their infrastructure. So while I dislike Oracle, you can't blame them for everything - the customers are the ones choosing the vendor. If you happily accept their license agreement, you can't later complain "but we want to do reverse-engineering" no matter how many MBA titles you have. If you want such freedoms, ditch Oracle and proprietary vendors in general. That's what open-source is for.
- weland 11y agoEvery programmer (myself included) who has had to discard bullshit reports about vulnerabilities agrees with the main idea -- that these things should be treated carefully, many of them are false positives and they may be borderline illegal, too. The correct way to treat these reports is to review them (after all, who knows...) and try to educate those customers who send you bogus reports: explain why they're bogus, why reverse engineering doesn't usually provide good leads, explain them what easier steps they can take for additional security, and maybe remind them about that EULA. This can be done on an individual basis, politely, and Oracle, who seems to employ half the salespeople in this world, certainly has the resources to do so. If they can call me every two months to remind me about their great offers, they can write the standard answer that almost every such report warrants. But no, instead they chose to dump a load of shit in the form of this blogpost: 1. It's written in the kind of condescending tone that makes you want to punch your interlocutor in the face. Such as: " That said, you would think that before gearing up to run that extra mile, customers would already have ensured they’ve identified their critical systems, encrypted sensitive data, applied all relevant patches, be on a supported product release, use tools to ensure configurations are locked down – in short, the usual security hygiene – before they attempt to find zero day vulnerabilities in the products they are using.". Surprise, surprise: a lot of people who start reverse-engineering binaries are either a) extremely security-conscious people, who, yes, already do those things, or b) extremely good programmers who work for people who -- again -- already do those things! There are exceptions, of course, but assuming that everyone who submits such a report is one of those imbeciles who dreams of Matrix hackers but runs a company where no computer has an antivirus installed is naive. Or: "there are a lot of things a customer can do like, gosh, actually talking to suppliers about their assurance programs etc.". This sort of crap belongs on a cocky teenager's blog, not on a serious company's website. 2. It's all the more insulting to whine about it when the subtle message you're trying to convey is that zero-day threats aren't that a big deal: "And in fact, there are a lot of data breaches that would be prevented by doing all that stuff, as unsexy as it is, instead of hyperventilating that the Big Bad Advanced Persistent Threat using a zero-day is out to get me!". Yes, it's no problem to state this when you're some random blogger. It is a problem to state this when you're CSO of the company famous for producing the one plugin that's recommended to be disabled by default. 3. Because the argument about the license agreement is childish. After explaining in detail how, even if you were right, you're getting a threatening letter about the license agreement, a requirement to destroy all proof of reverse engineering and so on, she goes on to throw this gem: "The main reason is that, when I see a spike in X, I try to get ahead of it. I don’t want more rounds of “you broke the license agreement,” “no, we didn’t,” yes, you did,” “no, we didn’t.” I’d rather spend my time, and my team’s time, working on helping development improve our code than argue with people about where the license agreement lines are. " Well how about skipping that debate and fixing your fucking code, eh? To put it in the same line as her argument, there are a lot of things Oracle can do in order to reduce the amount of false positives they get, such as fixing their disastrous security track record, improving their communication with the security community (no, blog posts like these don't count as communication for the same reason why hanging out a "fuck you" banner outside your office doesn't exactly count as better communicating with your colleagues, either) and so on. If people had better reasons to trust Oracle, there would be a lot less effort of this kind, too. 4. The analogies being used are demeaning to anyone who doesn't work in sales. Like this: > Q. But one of the issues I found was an actual security vulnerability so that justifies reverse engineering, right? > A. Sigh. At the risk of being repetitive, no, it doesn’t, just like you can’t break into a house because someone left a window or door unlocked. Someone missed their first tech evangelism class, where they use that analogy for exploting, not reporting vulnerabilities. Is it also wrong to call someone and tell them they left their door unlocked because their dog ran into it and it opened? The whole things reads like "you guys are like the worst customers ever. We're smarter than you, we have lawyers and we knowz securitiez. Now shut the fuck up."
- SCHiM 11y agoI work at a security company and sometimes reverse engineer systems and/or code to see if it is vulnerable to a plethora of attacks. Presumably the only reason a closed source vendor would be against someone reversing their source is because they're afraid someone will steal their ideas and/or redistribute their code for free. That not being my goal I really couldn't care less. I'll just go ahead and reverse whatever I want whenever I want. I value my security, and that of clients, over some legal piece of toilet-paper. Everyone who doesn't agree, should reconsider. Do you truly believe that people should not be allowed to look at code that is running on their systems for their security's sake? I will not redistribute what I learnt, but I will analyse it to see if it is safe. If you didn't want me looking, you should not have put it out in the open.
- wtallis 11y agoI'm pretty sure there are a lot of enterprise software vendors who want their products to be inscrutable so that after you buy it you need to hire their consultants to tune it to perform acceptably for you. If you understand how it works, you might be able to stop being a part of those extra revenue streams.
- danielweber 11y ago> against someone reversing their source is because they're afraid someone will steal their ideas I was once at a startup and another company in Texas released a product with identical typos as found in our object code. Selling that software was how I got money to pay rent and buy food to put into my food-hole, so I'm going to feel a little more sympathy for people who want to stop others from reverse-engineering their stuff.
- pritambaral 11y agoReverse-engineering for personal inspection, and selling software with stolen code are two different things. The company in Texas you talk about was doing the latter.
- dolfje 11y agoDisclaimer: cross-posted from the original HN Post, but still relevant. Apart from the legal stuff and a lot off egocentric 'we can do it better', she has one point. There are many companies giving a lot of money for security, manually scrubbing all exploits that come out, create their own patches. While some lack the basic security guidelines. I think this money can be better spend upstream, to create tools so they can test patches for exploits better and create a faster security update release pipeline, so that all downstream and customers can rely on the security releases and that it can be released quicker to everyone. (Controversial: Maybe even adding automatic security updates to the package itself, like wordpress did, so that customer cannot be on a release with exploits) Though saying to your client that they cannot reverse engineer to look for security problems, is totally not done! What is next? "Exploits will not be fixed, because the users has signed an agreement that they will not hack?"
- scyllax 11y agoIt's funny and scary how it's the opposite of what Free Software stands for.
- jongraehl 11y agoWe've just been Oraclesplained.
- marcosdumay 11y agoLife would be a lot better if it wasn't for those annoying clients. Oracle should just refuse to deliver software to anybody, that'd fix it all. Anyway, I've never read a better article supporting the use of free software.
- zzleeper 11y ago> I was busting my buttons today when I found out that a well-known security researcher in a particular area of technology reported a bunch of alleged security issues to us except – we had already found all of them and we were already working on or had fixes. Woo hoo! That's like what 5yrs old kids say when they mom ask them something.. "Mooom I was already thinking about it! Hush!"
- sre_ops 11y agoOra who?
- kazinator 11y agoSelling machine language code and asking people not to understand it is like selling books and asking people not to read them. "This cookbook is to be read by your personal chef only; if you read it and understand it yourself, you're breaking the book's license agreement." If you pay for some string of bits, you have a right to look at them. Period.
- tsmarsh 11y agoIts more like selling someone a meal in a restaurant, and refusing to let them see the kitchen. You can, if you are skilled, infer how the ingredients became your meal, but you won't ever know if it was done in a clean an safe way unless you can look at the environment where it was created. You could hire an investigator to figure this out, but there is a good chance that they know that there is more money in bad news than good. So they take photos of the dirtiest 'chef' who turns out to be the dishwasher, and show you the pictures of deliveries from Walmart, but choose not to show you the pictures of the chef getting up at 4am after finishing at 1am to drive to the fish market to hand pick the best of the catch. I understand the risks of eating in places with closed kitchens, but ultimately they make better food than I can, that requires less of my time. It may be more expensive for unjustifiable reasons, and maybe I don't want to know how the black pudding is made, I just want to focus on what is important to me: making my wife happy. Do I prefer to eat in restaurants with open kitchens, where the ingredient list and their source is available on demand? Sure. Am I a zealot about it..? It depends how hungry I am.
- kazinator 11y ago> Its more like selling someone a meal in a restaurant, and refusing to let them see the kitchen. I don't see it that way. The kitchen is like a development area. By looking at just the program code (not source or anything), I'm not stepping into Oracle's engineering labs or "cubicle land"---their kitchen, so to speak. I'm rather doing the equivalent of cutting into the meat pie on my plate and guessing the ingredients. If I figure out what is in it and how it was prepared, I'm free to make that at home, or even serve it to the public in my own restaurant. "Do not reverse engineer" is like "eat this meat loaf with your eyes closed, and do not share any hypotheses about what is in it or how it was made with anyone else". > open kitchens, where the ingredient list and their source is available on demand? That sounds like an analogy to open source, which is a different topic from license agreements in proprietary software against reverse engineering. I'm saying that if you sell me some writing, I have a right to read it. Just because that writing was written for an ARM CPU doesn't mean I'm doing anything wrong by reading it anyway. If you don't want people to know how a piece of language is interpreted to evoke its meaning, then don't sell it. Use it in-house or run it on a server and have clients to connect to it.
- sctb 11y agoThe original post discussed here: https://news.ycombinator.com/item?id=10039202 https://news.ycombinator.com/item?id=10039202
- facetube 11y agoHonest question: So I'm hired as a consultant. Someone gives me a database login to an Oracle machine. I haven't been presented with a license agreement for the Oracle database system, nor have I signed anything indicating I agreed to give reverse engineering rights away. How am I bound by the Oracle end user license agreement?
- ajuc 11y agoIMHO you are not. People from your company that weren't making you read EULA and promise to comply with it (in writing) will be responsible for your behaviour that breaks the EULA.
- mangeletti 11y agoWhat in the world is going on? Why did this article just disappear off of the front page after receiving 318 up-votes in 2 hours? How does post to drop from position #1 to somewhere below #150 in less than 1 minute, unless it was deleted by HN moderators, and if that's the case, why did it happen?
- parasubvert 11y agoIt means that an HN moderator squashed its appearance on the top list. Why? They felt it wasn't constructive perhaps, considering the other thread against the original article is still live.
- mangeletti 11y agoWhy not squash the other thread, since the link was dead and this one isn't? This appears to be blatant censoring of something that the majority of HN participants wanted to read and comment on.
- jacknews 11y agoWas the post a joke? She kind of resembles The Joker on her bio page: http://www.oracle.com/us/corporate/press/executives/016331.htm http://www.oracle.com/us/corporate/press/executives/016331.h...
- 0xdeadbeefbabe 11y agoDo they light sparklers and throw rice when you enter into an Oracle license agreement? For all Mary's entertaining points, I think likening the license agreement to marriage is a civil offense.