3 ms·

Sure, carefully reviewing all the reports would be ideal, but it also means you'll need many employees to do that. And I don't really see why Oracle should be r

Sure, carefully reviewing all the reports would be ideal, but it also means you'll need many employees to do that. And I don't really see why Oracle should be responsible for educating customers about basic security practices. Sales people are unusable for educating customers, and they're busy with using Licensing Breach Notices to boost sales of cloud services anyway (http://thestack.com/oracle-breach-notice-cloud-services-100715 http://thestack.com/oracle-breach-notice-cloud-services-1007...). I do agree with you that the blog post seems written in a bit condescending way (it's difficult for me to judge, as I'm not a native speaker). And I do agree that some of the arguments are misleading - the fact that many breaches are caused by lack of basic security practices does not make zero-days insignificant. And the "assurance programs" guarantee nothing if you fix the issues poorly (nice example from DEFCON 22: https://defcon.org/html/defcon-22/dc-22-speakers.html#Litchfield https://defcon.org/html/defcon-22/dc-22-speakers.html#Litchf...). What I perfonally find the funniest about the whole "reverse engineering prohibited" clause is that the bad guys don't give a shit - they'll reverse engineer it anyway, because no one will find out. So the only "victim" is the customer who accepted the licensing agreement, and it does not matter if the purpose was to lower the number of reports or protect the source code. But I'm still astonished people are surprised by the stupidity of Oracle licensing terms. Bullshit like that blog post is actually one of the main reasons why I stopped working with Oracle products and went full open-source.

weland 11y ago
> Sure, carefully reviewing all the reports would be ideal, but it also means you'll need many employees to do that. And I don't really see why Oracle should be responsible for educating customers about basic security practices. Because if they don't, stuff like this happens: they get blamed for any trivial data breach that happened through some of their programs -- even if the problem wasn't that it sucked, it was that the password was admin123. It's not glamorous and we can all agree that, as long as we're talking about responsible users, it shouldn't be Oracle's job to do this kind of education. However, exploiting users' ignorance is an integral part of their business model; they're consciously targeting them -- it's up to them to deal with all the consequences that brings.

weland 11y ago

> Sure, carefully reviewing all the reports would be ideal, but it also means you'll need many employees to do that. And I don't really see why Oracle should be responsible for educating customers about basic security practices. Because if they don't, stuff like this happens: they get blamed for any trivial data breach that happened through some of their programs -- even if the problem wasn't that it sucked, it was that the password was admin123. It's not glamorous and we can all agree that, as long as we're talking about responsible users, it shouldn't be Oracle's job to do this kind of education. However, exploiting users' ignorance is an integral part of their business model; they're consciously targeting them -- it's up to them to deal with all the consequences that brings.