121–130 of 358 posts
JRE CVEs: http://www.cvedetails.com/vulnerability-list/vendor_id-93/pr...
It's been 5 years since Oracle took over Java, so they can't claim it was left over.
Oracle's security record is terrible by all accounts, so how can their CSO justify anything in this blog post?
ORACLE product list CVEs: http://www.cvedetails.com/product-list/product_type-/firstch...
They took it down. Mirror?
Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?
She has a point here. Static analysis does generate a lot of false positives, and it requires a pretty in-depth understanding of the code to determine whether any given hit is a real issue. Unfortunately, that sort of understanding doesn't usually come from just running a static analysis tool (or fuzzer, OWASP scanner, etc., etc.). The problem comes (and I have personally been on the receiving end of this) when runni…
1) the answer should usually be either "fixed in this patch, install it" or "it's a false positive, try developing an actual exploit if you don't believe us". Not expensive, provided Oracle actually runs static analysis tools against their software and addresses the findings before releasing updates.
2) If Oracle actually runs static analysis tools against their software and addresses the findings before releasing updates, there should be very few tickets of this type to begin with, often from the debut of new tools or from naive user mistakes. Finding something, and worse finding something over and over again, means that Oracle QA is inadequate.
I read the blog, but now it's returning a 404? Did they take it down? If so, then somebody at Oracle realized that post reflected poorly on their organization. Perhaps there is some hope for Oracle yet.
Earlier quoted context omitted.
The place where I work, regret a decision to use Oracle, our application build with Oracle Form Builder, which is awfully hard to use, broken easily. But I must admit, their pre-sales really good at describing their product, my boss really hooked up by them. "Oh, for that problem we have this, it will cost this much, but for now, you can just use it for free" then some wild invoice came to our office.
The dept I used to work at was mostly ex-B4 people and I later did enterprise consulting later: What happens is that sales people talk to people high enough up on the food chain that they get the run of the place, and so it's nearly impossible to kick them out or refuse their requests without a substantial political cost/justification. It's called "building a beachhead" and involves the engagement team worming their…
In the meeting, I literally had this dude and his presales guys in $5000 suits sitting across the table from me, berating our position and demanding (quote was "You have no fucking business saying no until you provide us with so we can do your ROI") all sort of crap from us. Ended up prodding the salesbot and let him run his mouth for awhile until he said something really stupid that ostracized the business folks on our side.
Earlier quoted context omitted.
The scorn for customers in general is palpable. Why is Oracle even allowing this person to be a voice for their brand?
> Why is Oracle even allowing this person to be a voice for their brand? Because her text will probably only infuriate people that will arguably never be Oracle customers?
Except it is if you are really concerned about security or have a backbone Oracle don't want to waste time on trying to sell to you.
Wow. Really? This single blog post is strong evidence for why you should never, ever buy an Oracle product, and if you are running anything written by them, why you should plan to migrate away. Now, the culture of consultants in the Oracle sphere of influence is pretty toxic and money-grubbing. I can imagine companies being badgered into paying security weasels big bucks to analyze software with tools that cough up a…
Someone once told me that Larry Ellison is the biggest asshole in Silicon Valley, and also the richest, so he must be doing something right. The same could be said for John D Rockefeller and Standard Oil. Is the world we have the world we want?