27 ms·

This [1] gives a little more background. The same security researcher found another vulnerability in VirtualBox earlier this year, and didn't have a great expe

This [1] gives a little more background. The same security researcher found another vulnerability in VirtualBox earlier this year, and didn't have a great experience with Oracle: “We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or mentioning of the vulnerability report.” [1] https://blogs.securiteam.com/index.php/archives/3736 https://blogs.securiteam.com/index.php/archives/3736

SOLAR_FIELDS 8y ago
Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?
- bayindirh 8y ago
  Relevant discussion in another Oracle related post[0]. [0]: https://news.ycombinator.com/item?id=18389481 https://news.ycombinator.com/item?id=18389481
  - SOLAR_FIELDS 8y ago
    I do like that post because it summarizes how I feel about Oracle rather succinctly. For your typical FAANG company, the money is the means to the end. But for Oracle, the money is the end to the means.
- Uberphallus 8y ago
  Oracle has a track record of being The Worst about anything.
  - haloux 8y ago
    This sounds interesting, would you mind going into detail about this? Maybe a quick list?
  - vlan0 8y ago
    They seem to have a knack for selling their product to C-levels who don't fully understand the business they represent. But that's about it.
    - davio 8y ago
      CIOs at my last 3 companies have each had a "get rid of Oracle" as a top 5 strategic goal for the year.
  - PascLeRasc 8y ago
    Let's all meet back at this comment next year and see if IBM took the title from them.
- rurban 8y ago
  There are plenty of other big companies behaving similarly. HP comes to my mind also, but I cannot find the statistics which quantified worst maintainance practices.
  - bayindirh 8y ago
    Other companies may be behaving similarly, but Oracle is the perceived worst, and it says something. Because, they plainly don't hide it and try to be nice, at least. I also think that they're the worst in the industry.
    - giancarlostoro 8y ago
      One of my uncles moved to another state and was telling me all about how Oracle pays a lot there and I should move there. I told him I absolutely never would. He just wouldn't understand it, and kept nudging so I told him my wife would not want me to move to another state, thankfully that settled that.
    - rurban 8y ago
      I said there was a study which did quantify worst maintainance practices: time to fix bugs, time to reply and several other support metrics and interestingly Oracle was not the worst, HP was. My personal bias would also tell me Oracle is because of their business practices, but we were arguing about support practices.
      - bayindirh 8y ago
        Sorry, I missed the statistics part. I've never came across the one you mentioned either. I'd love to read that. My perceived worst definition was not about only business practices BTW. I meant in every category. Nonetheless, supporting the products you sold are also a business. :)
- skocznymroczny 8y ago
  "You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."
  - AlexanderDhoore 8y ago
    https://www.youtube.com/watch?v=-zRN7XLCRhc https://www.youtube.com/watch?v=-zRN7XLCRhc
    - SOLAR_FIELDS 8y ago
      Entertaining talk. The part that grandparent is quoting starts at about 38 minutes in.
  - deleted 8y ago
    [deleted]
  - zkomp 8y ago
    It's even better when he slips and say: "Don't anthropomorphize Larry Ellison"
    - epicalex 8y ago
      That wasn't a slip
- raesene9 8y ago
  Oracle are actively hostile to the security researcher community, with their CISO having told customers and researchers off for attempting to find issues in their products https://arstechnica.com/information-technology/2015/08/oracle-security-chief-to-customers-stop-checking-our-code-for-vulnerabilities/ https://arstechnica.com/information-technology/2015/08/oracl... This kind of attitude goes all the way back to 2002 https://www.theregister.co.uk/2002/01/16/oracle_security_claim/ https://www.theregister.co.uk/2002/01/16/oracle_security_cla...
- oarsinsync 8y ago
  From GP's link: > While the crashing bug was reported to the VirtualBox tracker (https://www.virtualbox.org/ticket/16444 https://www.virtualbox.org/ticket/16444), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved. They might not be The Worst, but at 15 months, they're not great.
  - ikeboy 8y ago
    The text of the bug doesn't have any suggestion of it being a vulnerability and as the closing comment indicates, not enough information to reproduce
    - newaccoutnas 8y ago
      Agreed, as far as bug reports got that's pretty lousy.
    - zaroth 8y ago
      “Unreproducible” can also be read as “Wasn’t worth the effort to reproduce”. Very, very rarely will a Sev1 crash in production software be instantly reproducible. When it is, it’s an utter embarrassment. More often the full set of conditions which lead to the crash are unknown, rare, and hard to fully quantify all at once. And yet, we know with certainty that the crash did happen and by definition it is a valid bug in any sane world where “don’t crash” is an absolute requirement. Any crashing bug in a hypervisor must be assumed to be security critical until proven otherwise. Even after “proving” a crash can’t possibly be exploited, you should still assume that a clever attacker will figure out a way. The Venn diagram of “crashing bugs” and “security exploits” is vanishingly disjoint.
      - ikeboy 8y ago
        "don't crash" can't be an absolute requirement, because operating systems. I've had programs crash when running out of RAM, I think sometimes there's no way for the OS to recover without killing some programs. If you absolutely can't crash, you need to build an OS that caters to that - modern OSes explicitly prioritize other goals, like performance
niklasb 8y ago
By that time that researcher had already been paid by the company running the SecuriTeam program. Admittedly Oracle did release the patch too early, but this was clearly by accident, since they usually never release security patches outside a Critical Patch Update. Also I believe they did assign CVE-2018-3294 and give credit in the following October CPU.

SOLAR_FIELDS 8y ago

Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

bayindirh 8y ago
Relevant discussion in another Oracle related post[0]. [0]: https://news.ycombinator.com/item?id=18389481 https://news.ycombinator.com/item?id=18389481
- SOLAR_FIELDS 8y ago
  I do like that post because it summarizes how I feel about Oracle rather succinctly. For your typical FAANG company, the money is the means to the end. But for Oracle, the money is the end to the means.
Uberphallus 8y ago
Oracle has a track record of being The Worst about anything.
- haloux 8y ago
  This sounds interesting, would you mind going into detail about this? Maybe a quick list?
- vlan0 8y ago
  They seem to have a knack for selling their product to C-levels who don't fully understand the business they represent. But that's about it.
  - davio 8y ago
    CIOs at my last 3 companies have each had a "get rid of Oracle" as a top 5 strategic goal for the year.
- PascLeRasc 8y ago
  Let's all meet back at this comment next year and see if IBM took the title from them.
rurban 8y ago
There are plenty of other big companies behaving similarly. HP comes to my mind also, but I cannot find the statistics which quantified worst maintainance practices.
- bayindirh 8y ago
  Other companies may be behaving similarly, but Oracle is the perceived worst, and it says something. Because, they plainly don't hide it and try to be nice, at least. I also think that they're the worst in the industry.
  - giancarlostoro 8y ago
    One of my uncles moved to another state and was telling me all about how Oracle pays a lot there and I should move there. I told him I absolutely never would. He just wouldn't understand it, and kept nudging so I told him my wife would not want me to move to another state, thankfully that settled that.
  - rurban 8y ago
    I said there was a study which did quantify worst maintainance practices: time to fix bugs, time to reply and several other support metrics and interestingly Oracle was not the worst, HP was. My personal bias would also tell me Oracle is because of their business practices, but we were arguing about support practices.
    - bayindirh 8y ago
      Sorry, I missed the statistics part. I've never came across the one you mentioned either. I'd love to read that. My perceived worst definition was not about only business practices BTW. I meant in every category. Nonetheless, supporting the products you sold are also a business. :)
skocznymroczny 8y ago
"You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."
- AlexanderDhoore 8y ago
  https://www.youtube.com/watch?v=-zRN7XLCRhc https://www.youtube.com/watch?v=-zRN7XLCRhc
  - SOLAR_FIELDS 8y ago
    Entertaining talk. The part that grandparent is quoting starts at about 38 minutes in.
- deleted 8y ago
  [deleted]
- zkomp 8y ago
  It's even better when he slips and say: "Don't anthropomorphize Larry Ellison"
  - epicalex 8y ago
    That wasn't a slip
raesene9 8y ago
Oracle are actively hostile to the security researcher community, with their CISO having told customers and researchers off for attempting to find issues in their products https://arstechnica.com/information-technology/2015/08/oracle-security-chief-to-customers-stop-checking-our-code-for-vulnerabilities/ https://arstechnica.com/information-technology/2015/08/oracl... This kind of attitude goes all the way back to 2002 https://www.theregister.co.uk/2002/01/16/oracle_security_claim/ https://www.theregister.co.uk/2002/01/16/oracle_security_cla...
oarsinsync 8y ago
From GP's link: > While the crashing bug was reported to the VirtualBox tracker (https://www.virtualbox.org/ticket/16444 https://www.virtualbox.org/ticket/16444), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved. They might not be The Worst, but at 15 months, they're not great.
- ikeboy 8y ago
  The text of the bug doesn't have any suggestion of it being a vulnerability and as the closing comment indicates, not enough information to reproduce
  - newaccoutnas 8y ago
    Agreed, as far as bug reports got that's pretty lousy.
  - zaroth 8y ago
    “Unreproducible” can also be read as “Wasn’t worth the effort to reproduce”. Very, very rarely will a Sev1 crash in production software be instantly reproducible. When it is, it’s an utter embarrassment. More often the full set of conditions which lead to the crash are unknown, rare, and hard to fully quantify all at once. And yet, we know with certainty that the crash did happen and by definition it is a valid bug in any sane world where “don’t crash” is an absolute requirement. Any crashing bug in a hypervisor must be assumed to be security critical until proven otherwise. Even after “proving” a crash can’t possibly be exploited, you should still assume that a clever attacker will figure out a way. The Venn diagram of “crashing bugs” and “security exploits” is vanishingly disjoint.
    - ikeboy 8y ago
      "don't crash" can't be an absolute requirement, because operating systems. I've had programs crash when running out of RAM, I think sometimes there's no way for the OS to recover without killing some programs. If you absolutely can't crash, you need to build an OS that caters to that - modern OSes explicitly prioritize other goals, like performance

niklasb 8y ago

By that time that researcher had already been paid by the company running the SecuriTeam program. Admittedly Oracle did release the patch too early, but this was clearly by accident, since they usually never release security patches outside a Critical Patch Update. Also I believe they did assign CVE-2018-3294 and give credit in the following October CPU.