Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stop reverse engineering our code”

blogs.oracle.com

Post reply on HN
Print view View original

11–20 of 358 posts

Re: “Stop reverse engineering our code”

#11

Post by nvader »

idlewords wrote: post #8
denwer wrote: post #4

Is that post for real? https://twitter.com/dinodaizovi/status/630972473945817088

If you read her previous posts you'll see it's the exact same tone and writing style. I think the claims of hacking are a way for people to express their incredulity and not meant seriously.

I hope you didn't "reverse engineer" her blog post. She's going to call up a judge and say "Nanny Nanny, Boo boo." (her own words).

But in all seriousness, if the Chief Security Officer of Oracle sounds like the letters to the editor of my University Paper, why doesn't a company that big have someone from PR edit or co-write her posts?

Re: “Stop reverse engineering our code”

#12

Post by kjs3 »

idlewords wrote: post #9

Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?

She has a point here. Static analysis does generate a lot of false positives, and it requires a pretty in-depth understanding of the code to determine whether any given hit is a real issue. Unfortunately, that sort of understanding doesn't usually come from just running a static analysis tool (or fuzzer, OWASP scanner, etc., etc.). The problem comes (and I have personally been on the receiving end of this) when running the tool results in a couple of dozen to a couple of hundred trouble tickets you can't simply ignore that say things like "I found a bug and if you don't respond I'm going to dump Oracle", "I found a bug and if you don't fix it on my schedule I'm going to post to HackerSiteDuJour" or "I found a bug pay me a bounty or I'm gonna make a big stink". And so someone will have to go and look at the report and "prove" that just like 99.999% of the time, it's a false positive, and they will have to do that for every "security" person who cranks up a tool and finds the same "vulnerability".

The problem here is:

1) She might be a writer but boy did she not convey the message I think she wanted to, which is kind of a shame. 2) She doesn't apparently much understand "reverse engineering" with more nuance than "my legal team says you can't do it so there", which is much more of a shame for someone who carries a CSO bag.

Re: “Stop reverse engineering our code”

#13

Post by jacquesm »

hughstephens wrote: post #5
denwer wrote: post #4

Is that post for real? https://twitter.com/dinodaizovi/status/630972473945817088

who knows – in many ways it's even better if it's satire, because it's just believable enough.

If it didn't have a 'most likely' in it I'd think it was satire, but that's the kind of weasel wording that you'd expect in a real release.

There was another post in much the same vein on that blog:

https://blogs.oracle.com/maryanndavidson/entry/those_who_can...

Re: “Stop reverse engineering our code”

#14

Post by quesera »

idlewords wrote: post #9

Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?

It wouldn't surprise me. Oracle certainly runs the same static analysis tools against their own stuff, and fixes anything legitimate.

But notice the other comment about a "well-known security researcher" "alleging" vulnerabilities that yee-haw we're already working on fixes for so we're awesome and he's lame and nanny nanny boo boo etc.

Serious cognitive dissonance there. I used to buy a lot of Oracle product. Their value proposition has grossly weakened over the last decade and a half or so, so I don't any more. But if I did, I'd be embarrassed today.

Re: “Stop reverse engineering our code”

#16

Post by kjs3 »

pkkp wrote: post #2

Is it just me, or is the childish, mocking tone in the OP simultaneously baffling and totally befitting of the point they're trying to make? I understand that they're frustrated by the repeated submission of automated security vulnerability reports, but blanketing it entirely as "reverse engineering" and responding to it like this is... a strange approach. Did someone at Oracle actually think that this was the best w…

Yeah, it's very poorly written. I always cringe when some exec thinks "oh, it's just a blog so I don't have to write with the same professionalism and attention to detail that I would in other corporate communications".

Re: “Stop reverse engineering our code”

#17

Post by idlewords »

nvader wrote: post #11
idlewords wrote: post #8

Earlier quoted context omitted.

If you read her previous posts you'll see it's the exact same tone and writing style. I think the claims of hacking are a way for people to express their incredulity and not meant seriously.

I hope you didn't "reverse engineer" her blog post. She's going to call up a judge and say "Nanny Nanny, Boo boo." (her own words). But in all seriousness, if the Chief Security Officer of Oracle sounds like the letters to the editor of my University Paper, why doesn't a company that big have someone from PR edit or co-write her posts?

One terrifying possibility is that this is the edited, watered-down version of something even worse.

My guess is that she's senior enough to veto attempts to salvage her prose.

Re: “Stop reverse engineering our code”

#18

Post by lawnchair_larry »

idlewords wrote: post #9

Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?

She has no idea what she is talking about. Nobody is running static analysis on source code and sending her results. She's mixed up a lot of concepts here and is just plain wrong.

Re: “Stop reverse engineering our code”

#19

Post by dang »

The submitted title ('Oracle CSO: ~“Only we can do security, trust us and do not reverse engineer”') breaks the HN guidelines: it's editorialized (whatever one thinks of the article), and it's a quote-looking-thing that isn't a quote, so misleading.

Please don't do this. The HN guidelines ask you to use the original title. If that's really not suitable, a subtitle or some representative language from the article is ok. But putting your own spin on it is not ok. HN's goal is to let readers make up their own minds, and for that we need accurate, neutral titles.

We've changed the title to a representative phrase from the article, and can change it again if someone suggests something better.

Post reply on HN