6 ms·

This is honestly wild. Whether we like it or not security incidents have become such common place in the last several years that if they just admitted to it th

This is honestly wild. Whether we like it or not security incidents have become such common place in the last several years that if they just admitted to it this entire story would have likely been shrugged off and mostly forgotten about in a couple days but instead it is turning into an entire thing that just seems to be getting deeper and deeper. (Not downplaying the security incident, but that is the unfortunate reality). Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here? Are they somehow really confident that this didn't happen, maybe they don't have the logs to confirm it? Trying to think about how this is anything except them just straight up lying. I can't remember the last time we saw a company this strongly try to deny that something like this happened. Especially when according to Ars Technica: > On Friday, when I asked Oracle for comment, a spokesperson asked if they could provide a statement that couldn’t be attributed to Oracle in any way. After I declined, the spokesperson said Oracle would have no comment.

hdjjhhvvhga 2y ago
That's why in Europe there are strict laws regarding lax security of customer data and companies can be fined with a percentage of their turnover - which in the case of Oracle could hurt a bit.
sofixa 2y ago
> Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here? I think you're coming at this from the wrong point of view. Oracle couldn't care in the slightest about what regular people think of them. Remember, they are the company that sent lawyers after the employers of folks who downloaded non-free but bundled by default extensions to VirtualBox, and the company that declared that you need to license every core their software could _potentially_ run on in your virtualisation estate (so if you have a 8 vCPU VM for some Oracle software, you need licenses for however many physical cores you have on your cluster). They've variously been described as a law firm with an engineering side business, and One Rich Asshole Called Larry Ellisson. Speaking of whom, he multiple times flat out lied on stage to make his shitty "cloud" nobody cares about seem relevant compared to AWS. Nobody buys Oracle because they like them or their good reputation. You buy them because you have legacy stuff that depends on them and you have no choice (even Amazon took many years to get off Oracle databases, and they wrote a gloating success story one they were done with it because they were that happy to be rid of the leeches), or because your bosses' boss was convinced at a golf course they're getting a good deal. Or because their bandwidth is very cheap and you accept the risk of dealing with the devil incarnate with zero morals. (cf. Zoom). Oracle is like Broadcom. Everyone hates their guts, everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere.
- geodel 2y ago
  > everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere. This is just your opinion. Most people I know who work there feel just fine if not very happy. Pay/benefits are good. Work is about same everywhere. In fact depending on group there maybe good, challenging technical work there. As far as CV is concerned working there is mostly positive or at best neutral in term of job change. > Nobody buys Oracle because they like them or their good reputation. Oracle is quite expensive but they have reputation of solid database for enterprise workloads. Also their cloud business is doing fine and growing and not irrelevant. One can see that from their quarterly results.
  - sofixa 2y ago
    > Work is about same everywhere Well, no. When a customer at my job makes a mistake, we don't send lawyers chasing after them because we're assholes. And when someone proposes something that will hurt those customers, people speak up and voice their disagreement.
    - geodel 2y ago
      In large companies people don't keep up with what all other departments are up to. And further even if they know they can also see nuance that lawyers are involved because current situation can harm their employer. > When a customer at my job makes a mistake, we don't send lawyers chasing ... Maybe you own the company or are in its executive ranks and can take decision on such scenarios. But in large companies most rank and file employees do not particularly feel good or bad about their employers.
  - senderista 2y ago
    I wonder if the senior engineering talent OCI poached from AWS (including the guy who introduced formal methods to AWS) is still there?
    - geodel 2y ago
lucianbr 2y ago
I'm guessing nobody chooses to work with Oracle anymore for reasons or in situations that we would consider reasonable. It's probably either governments contracts, with or without corruption, companies already locked in, contracts made by executives that don't really understand technology, that sort of thing.
- UltraSane 2y ago
  I worked as a contractor for the Wisconsin state government and they had hundreds of Oracle databases that they were consolidating on the Oracle EXADATA11 servers. Insane having hardware that can only run Oracle but the Oracle DBA said that the Exadata was dozens of times faster than Oracle on VMware VMs.
  - 3acctforcom 2y ago
    Lies. Fucking lies. We were a three environment shop until we moved to Exa and the compute/$ ratio is so bad that we had to cut it down to two. But we're talking about Oracle here so that's par for the course.
    - UltraSane 2y ago
      I didn't make any claims about performance per $, just relative performance compared to VMs. I hate Oracle as much as anyone but the EXADATA is impressive hardware. It has lots of RAM and Infiniband networking. It can push query predicates to the storage controllers to reduce the data that had to be transferred.
      - emmelaich 2y ago
        It is impressive. But for the same cost you can get vastly better performance with Postgres and bigger hardware. It does come with internal redundancy, but do you need that? Also the cluster nature of it can come with some surprises as compared to a single database.
        2y ago
sylens 2y ago
Security incidents have become so common place that the fact that they happen is not the newsworthy event; rather, its how a company responds to them that is the newsworthy event. And Oracle flunked this test
- londons_explore 2y ago
  My guess is that admitting a security incident triggers lots of contractual clauses. They have probably decided it's cheaper to simply deny the event (therefore not triggering those clauses). If it gets to court, Oracle will find some expert who says there was no incident, and the other side will present clear evidence there was an incident, but the non-technical judge will probably still not be sure.
- cookiengineer 2y ago
  Note that it was an almost 4 year old already disclosed CVE which was used. Oracle messed up, big time. That's why they're trying to get rid of all incriminating evidence for potential lawsuits. https://nvd.nist.gov/vuln/detail/cve-2021-35587 https://nvd.nist.gov/vuln/detail/cve-2021-35587

hdjjhhvvhga 2y ago

That's why in Europe there are strict laws regarding lax security of customer data and companies can be fined with a percentage of their turnover - which in the case of Oracle could hurt a bit.

sofixa 2y ago

> Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here? I think you're coming at this from the wrong point of view. Oracle couldn't care in the slightest about what regular people think of them. Remember, they are the company that sent lawyers after the employers of folks who downloaded non-free but bundled by default extensions to VirtualBox, and the company that declared that you need to license every core their software could _potentially_ run on in your virtualisation estate (so if you have a 8 vCPU VM for some Oracle software, you need licenses for however many physical cores you have on your cluster). They've variously been described as a law firm with an engineering side business, and One Rich Asshole Called Larry Ellisson. Speaking of whom, he multiple times flat out lied on stage to make his shitty "cloud" nobody cares about seem relevant compared to AWS. Nobody buys Oracle because they like them or their good reputation. You buy them because you have legacy stuff that depends on them and you have no choice (even Amazon took many years to get off Oracle databases, and they wrote a gloating success story one they were done with it because they were that happy to be rid of the leeches), or because your bosses' boss was convinced at a golf course they're getting a good deal. Or because their bandwidth is very cheap and you accept the risk of dealing with the devil incarnate with zero morals. (cf. Zoom). Oracle is like Broadcom. Everyone hates their guts, everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere.

geodel 2y ago
> everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere. This is just your opinion. Most people I know who work there feel just fine if not very happy. Pay/benefits are good. Work is about same everywhere. In fact depending on group there maybe good, challenging technical work there. As far as CV is concerned working there is mostly positive or at best neutral in term of job change. > Nobody buys Oracle because they like them or their good reputation. Oracle is quite expensive but they have reputation of solid database for enterprise workloads. Also their cloud business is doing fine and growing and not irrelevant. One can see that from their quarterly results.
- sofixa 2y ago
  > Work is about same everywhere Well, no. When a customer at my job makes a mistake, we don't send lawyers chasing after them because we're assholes. And when someone proposes something that will hurt those customers, people speak up and voice their disagreement.
  - geodel 2y ago
    In large companies people don't keep up with what all other departments are up to. And further even if they know they can also see nuance that lawyers are involved because current situation can harm their employer. > When a customer at my job makes a mistake, we don't send lawyers chasing ... Maybe you own the company or are in its executive ranks and can take decision on such scenarios. But in large companies most rank and file employees do not particularly feel good or bad about their employers.
- senderista 2y ago
  I wonder if the senior engineering talent OCI poached from AWS (including the guy who introduced formal methods to AWS) is still there?
  - geodel 2y ago

lucianbr 2y ago

I'm guessing nobody chooses to work with Oracle anymore for reasons or in situations that we would consider reasonable. It's probably either governments contracts, with or without corruption, companies already locked in, contracts made by executives that don't really understand technology, that sort of thing.

UltraSane 2y ago
I worked as a contractor for the Wisconsin state government and they had hundreds of Oracle databases that they were consolidating on the Oracle EXADATA11 servers. Insane having hardware that can only run Oracle but the Oracle DBA said that the Exadata was dozens of times faster than Oracle on VMware VMs.
- 3acctforcom 2y ago
  Lies. Fucking lies. We were a three environment shop until we moved to Exa and the compute/$ ratio is so bad that we had to cut it down to two. But we're talking about Oracle here so that's par for the course.
  - UltraSane 2y ago
    I didn't make any claims about performance per $, just relative performance compared to VMs. I hate Oracle as much as anyone but the EXADATA is impressive hardware. It has lots of RAM and Infiniband networking. It can push query predicates to the storage controllers to reduce the data that had to be transferred.
    - emmelaich 2y ago
      It is impressive. But for the same cost you can get vastly better performance with Postgres and bigger hardware. It does come with internal redundancy, but do you need that? Also the cluster nature of it can come with some surprises as compared to a single database.
      - 2y ago

sylens 2y ago

Security incidents have become so common place that the fact that they happen is not the newsworthy event; rather, its how a company responds to them that is the newsworthy event. And Oracle flunked this test

londons_explore 2y ago
My guess is that admitting a security incident triggers lots of contractual clauses. They have probably decided it's cheaper to simply deny the event (therefore not triggering those clauses). If it gets to court, Oracle will find some expert who says there was no incident, and the other side will present clear evidence there was an incident, but the non-technical judge will probably still not be sure.
cookiengineer 2y ago
Note that it was an almost 4 year old already disclosed CVE which was used. Oracle messed up, big time. That's why they're trying to get rid of all incriminating evidence for potential lawsuits. https://nvd.nist.gov/vuln/detail/cve-2021-35587 https://nvd.nist.gov/vuln/detail/cve-2021-35587