Oracle Suspended My Account

Honestly, a student/hobbyist from Turkey who is trying specifically to defend against a local eavesdropping or censorship threat, or to work around restrictive firewall configurations on public WiFi networks, might very well use exactly the same types of VPNs you're describing, for some of the same legitimate purposes as any professional would use their corporate VPN. After all, they don't have a corporate IT department to maintain their own private VPN. These types of companies probably have more friendly pricing for a student/hobbyist from Turkey than the VPN companies whose marketing material focused on corporate use cases instead of circumventing Netflix geo blocks.

You're right that it would not be the ideal type of VPN for database access control, but I can imagine it being an element of viable defense-in-depth strategies where one is in a country where most inbound local traffic other than your own would be malicious. Imagine coupling a restriction on source IP range with TLS + IAM credentials, or something like that. Requiring a presence on the specific chosen VPN company's netblock drastically shrinks the threat model vs allowing connection attempts from 0.0.0.0/0.

> I'm not siding with Oracle, but Oracle owes absolutely nothing to a free tier user suspected of fraud.

I agree that they don't owe anything to such a user, but equally we don't owe it to Oracle to refrain from criticizing these kinds of false positives in their fraud detection with no avenue for redress. Anyone who either experiences or hears about these kinds of outcomes is justified both in criticizing Oracle and in being less likely to recommend or choose Oracle for their or their employer's cloud computing needs.

In turn, Oracle owes it to themselves to at least consider that possible consequence, and to allow at least enough redress to keep the severity of this reputational impact within whatever range they deem acceptable.

That does not work on people who are using your system with malicious intentions (and who face zero personal consequences when they get caught again, and again, and again). They don't get rehabilitated, when you tell them which rule you broke[1], they just adjust their malicious use to work around that rule. Rehabilitation is only possible when both parties are operating in good faith, which is why it is done with threat of prison, fines, revocation of parole, etc. It can't be done when the 'rehabilitated' party can just reneg on the agreement with zero consequences.

The point of anti-abuse rules isn't the letter of the rules, it's the intent behind them. 'There's no rule that says a dog can't play basketball' only works in children's fairy tales.

There's a reason why no large firm or financial institution will tell you the why. It's not because they think you have good intentions, and they hate you. It's because they are afraid you have malicious intentions, and they aren't interested in holding your hand as you defraud them.

Of course, people in category one get burnt by this, and then complain on Twitter/FB/HN.

[1] If you want to live in a world where anti-abuse systems tell you which rule you broke, you'll probably need to also live in a world where there are very serious consequences that are - with high consistency - inflicted on people breaking those rules in bad faith. We don't live in that kind of world, things like the CFAA are at the same time, both overly broad and draconian and largely toothless.

Oracle should absolutely out the guys whom they suspend because they have kiddie porn or did illegal transactions on their site or break terms of services.

Seeing Musk and Trump's success, one bold company will do it and will be enormously successful in deploying an army of cults against the Karens of the world. As they say, you can't bring a knife to a gun's fight