5 ms·

Presumably you would go ask Oracle, and then patch it when they provide a patch.

lazide 5y ago
Hope you’ve got a pretty sweet support contract or you’re going to be waiting awhile. Depending on the product, maybe forever.
- staticassertion 5y ago
  My point is that patching third party binaries is generally not something companies take responsibility for. They wait for vendors to patch the binaries and ship them.
  - jiggawatts 5y ago
    > generally not something companies take responsibility for I have some bad news for you: viruses and hackers don't care about your support contracts and the delays they cause. Actually, I tell a lie: the hackers love them.
    - staticassertion 5y ago
      That's not relevant? The original premise here is "compiled languages will make things worse because they're harder to patch" except: a) It's very rare to patch things manually b) It's very rare to develop patches yourself (for 3rd party software) I'm sure some companies out there with many decades old deployments have to do stupid shit like that, but it's hardly the standard.
      - lazide 5y ago
        Having been on the receiving end of waiting a long time to get a patch for a actively being exploited zero day - the point is, even if you want to fix it yourself (which I desperately did), you can’t. If it’s some important piece of software you also can’t stop or the business stops - well, you and everyone else is just going to take it in the pants. Many enterprises are in exactly this bind. And support contracts only get you so far.
        staticassertion 5y ago
        I'm losing your point. So, you wanted to patch it, and you couldn't, so how is it bad then that a compiled binary would make patching more difficult?
        lazide 5y ago
        It was impossible to fix because it was a compiled binary with no available source. That’s the point.
- jethro_tell 5y ago
  Why would you have oracle without a super sweet support contract? That's the whole point.
  - lazide 5y ago
    People don’t get Oracle because they want to get stuck with a super expensive (and still only ok), or super insanely expensive (and maybe sweet) support contract. They get it because they usually don’t know about these things, are trying to do something and BLAM they get hooked. Many people don’t even realize how long it can take to get a real issue fixed even with a super sweet support contract. For instance, I once was a wet behind the ears Oracle DBA, and when creating a schema i dumbly used a feature in the documentation without checking to see how long it had been released. Unfortunately, it had been released about 6 months before, as I found out later. It took 6 months for them to figure out that it was the cause of our sporadic ORA600 errors (aka core dumps), by which point we’d already migrated to MySQL for many of the workloads because the database was having at best 95% reliability because of it. Once we migrated the table off with the feature, somehow our problems ceased, but that was still well before they told us what was going on.

Hope you’ve got a pretty sweet support contract or you’re going to be waiting awhile. Depending on the product, maybe forever.

staticassertion 5y ago
My point is that patching third party binaries is generally not something companies take responsibility for. They wait for vendors to patch the binaries and ship them.
- jiggawatts 5y ago
  > generally not something companies take responsibility for I have some bad news for you: viruses and hackers don't care about your support contracts and the delays they cause. Actually, I tell a lie: the hackers love them.
  - staticassertion 5y ago
    That's not relevant? The original premise here is "compiled languages will make things worse because they're harder to patch" except: a) It's very rare to patch things manually b) It's very rare to develop patches yourself (for 3rd party software) I'm sure some companies out there with many decades old deployments have to do stupid shit like that, but it's hardly the standard.
    - lazide 5y ago
      Having been on the receiving end of waiting a long time to get a patch for a actively being exploited zero day - the point is, even if you want to fix it yourself (which I desperately did), you can’t. If it’s some important piece of software you also can’t stop or the business stops - well, you and everyone else is just going to take it in the pants. Many enterprises are in exactly this bind. And support contracts only get you so far.
      - staticassertion 5y ago
        I'm losing your point. So, you wanted to patch it, and you couldn't, so how is it bad then that a compiled binary would make patching more difficult?
        lazide 5y ago
        It was impossible to fix because it was a compiled binary with no available source. That’s the point.
jethro_tell 5y ago
Why would you have oracle without a super sweet support contract? That's the whole point.
- lazide 5y ago
  People don’t get Oracle because they want to get stuck with a super expensive (and still only ok), or super insanely expensive (and maybe sweet) support contract. They get it because they usually don’t know about these things, are trying to do something and BLAM they get hooked. Many people don’t even realize how long it can take to get a real issue fixed even with a super sweet support contract. For instance, I once was a wet behind the ears Oracle DBA, and when creating a schema i dumbly used a feature in the documentation without checking to see how long it had been released. Unfortunately, it had been released about 6 months before, as I found out later. It took 6 months for them to figure out that it was the cause of our sporadic ORA600 errors (aka core dumps), by which point we’d already migrated to MySQL for many of the workloads because the database was having at best 95% reliability because of it. Once we migrated the table off with the feature, somehow our problems ceased, but that was still well before they told us what was going on.