Re: Opinion: Complete failure of Oracle security response and utter

[Rainer Duffner]

David Litchfield wrote:

[snip sad Oracle track "record" on security]


I must assume most of their code is written by some poor guys in a
sweatshop in Bangalore or Shanghai today.
And only those people can "fix" it, so if somebody finds a flaw, a
"request to fix" is sent to Bangalore and fulfilled in typical fashion...
You get the picure...

The Oracle-BMW America's Cup Team has a budget of 100 000 000 €, whereof
30 000 000 € are attributed to BMW.
That means 70 000 000 € spend by Larry for the silly Yacht - you, David,
could charge 100 000 per day and still deliver more value.
It's really a shame - but they'll only wake up when it's too late and
MSFT, PostgreSQL and MySQL have eaten their lunch.

Note: I don't care if it's Larry's personal money or Oracle's money -
for me, this is a purely fiscal separation. In the end, the money has
one source: Oracle.



cheers,
Rainer

[Rainer Duffner]

David Litchfield wrote:

> Hey,
> I know you this wasn't your intent when you wrote it, but:
>
>> That means 70 000 000 € spend by Larry for the silly Yacht - you,
>> David, could charge 100 000 per day and still deliver more value.
>
>
> I just want to make it clear that all I'm looking for from Oracle is,
> not a job to review their code, but to treat security properly and
> give their customers the respect they paid for.
> Cheers,
> David
>


I'm sorry if it sounded that way - I'm also not jealous of Mr. Ellison's
riches (I've not directly contributed to them, mind you).
I just wanted to make the proportions visible ;-)
From my view, there is no doubt that you alone have done a great deal
of work to secure Oracle products - I assume with little financial
reward from Oracle itself.
This enforces the popular view that (most) big corporations don't
"value" something until it costs money - and if it costs a lot of money,
it must be of big value...
Sounds like a Dilbert-esque PHB'ism, but that's the impression I get.

Unless a whistleblower (image of Larry keelhauling him comes up...)
comes forward, only Ms. Davidson can shade some light on how exactly the
QA- and patch-creation process works and why it can take literally years
to put out a security-update (that turns out to be little less than a
placebo) to a currently shipped product.





cheers,
Rainer

[Gadi Evron]

Not that I disagree with your sentiment or what you are saying, we all
know about the lacking security practices, secure development practices
and decent security response by *many* vendors.

Some of these vendors critical to the infrastructure far more than Oracle.

With all due respect to your wishes and intent, a research on different
vendors, showing what vendor responds to threats, after how long and how
effectively plus how many security issues appear with each would have
made sense to me. Showing the Good and thus flushing the Bad without
dissing anyone. Pure facts.
Attacking one vendor may make sense in some cases.. yes, again,
attacking one vendor in public in *this* *fashion* may be long over-due,
but it also seems to me to be rather.. in poor taste? Especially coming
out of the blue with no past public statements.

I sympathize with your concerns and I am known to be FAR from a person
who doesn't voice his opinions - and loudly, but it only makes me wonder
why now, why them and why here.

Now, I am not an Oracle advocate - far from it, but your subject line
says it all, and makes me look-down on your post automatically, which is
a shame:
"Complete failure of Oracle security response and utter neglect of their
responsibility to their customers"

Complete? Failure? Utter neglect? You better have some liability
coverage. Adding "opinion" there might not be good enough, right or wrong.

Thanks for your time,

Gadi Evron.

--
My blog: http://blogs.securiteam.com/?author=6

"The third principle of sentient life is the capacity for self-sacrifice
--- the conscious ability to override evolution and self-preservation
for a cause, a friend, a loved one."
-- Draal, "A Voice in the Wilderness", Babylon 5.

[Gadi Evron]

> Having worked closely with the security teams of most large commercial
> vendors (IBM, Oracle, Microsoft, Apple, HP, Adobe, Real) I can quite
> honestly say that, of all of them, Oracle is the only company to still
> treat security in this way. Most other organizations "got it" years ago
> and while there could be improvements made in various areas the most
> improvement could be made at Oracle.

Not many of them "got it". Some are simply worse.

> Firstly, it's due to the facts that I posted as I did. It is fact that
> the patch for Alert 68 fails to properly fix a large number of holes it
> was touted to fix. It is fact that a large number of companies that
> spent a great deal of money installing the patch have wasted their time.
> It is fact that Oracle database servers are still vulnerable to security
> holes that were reported to Oracle years ago.

Amazing statistics. Where are statistics on others?

> Oh, this wasn't out of the blue; and there have been a great number of
> public statements about Oracle's failings. Not just from myself, I'll
> add, but others as well.

I'll Google. Thanks.

>> I sympathize with your concerns and I am known to be FAR from a person
>> who doesn't voice his opinions - and loudly, but it only makes me
>> wonder why now,
>
>
> Because enough is enough.

For security people maybe.. using Oracle for most business is a Business
concern.

>> why them
>
>
> Because they seem to be the only ones that don't get it.

This is the place where you lost me, I am sorry. The only ones?

> Yes. Based upon the facts the Oracle security response has been a
> failure. How else can you describe it?
>
> If you gave me a patch and said it fixed a security flaw and it turns
> out it didn't I'd call that a failure. Multiply that by a factor of tens
> and you've got yourself a complete failure. If I did this to my
> customers I'd sack myself for neglect. Really, I would.

That is your choice.. although I personally believe you are being very
extreme in your take on how alone Oracle is.

It's not that I disagree with their behavior being questionable, I
honestly believe a survey of how all vendors do where the s**t floats to
the top without singling out the Bad but rather the Good, would work better.

This kind of attack may be "called for" but definitely will make Oracle
less than willing to ever work with *you* or trust the community, plus
it will immediately become a PR issue where they may chose to go on
lawyer-PR strategies rather than "how do we make sure this never happens
again by getting off that list".
It simply looks like a rant, which is a shame.

Regardless, like I said, you better have a good plan on protecting
yourself from liability. Right now, right or wrong, it appears like a
personal attack from you. So, even if the entire community is behind
you, most of the community won't help foot the legal bill.

Good luck,

Gadi. /not advocating for Oracle but against public *personal* flogging

--
My blog: http://blogs.securiteam.com/?author=6

"The third principle of sentient life is the capacity for self-sacrifice
--- the conscious ability to override evolution and self-preservation
for a cause, a friend, a loved one."
-- Draal, "A Voice in the Wilderness", Babylon 5.