Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stop reverse engineering our code”

blogs.oracle.com

Post reply on HN
Print view View original

171–180 of 358 posts

Re: “Stop reverse engineering our code”

#171

Post by greggyb »

op00to wrote: post #84
duncan_bayne wrote: post #23

So, I disagree with the poster on a bunch of things here (no surprise, really). But: this is authentic. This is what we (i.e. hackers) are always claiming we want. Someone speaking her mind, shooting from the hip, etc. Not an anodyne blob of corporate-speak: this is an opinion, stated pretty clearly, and backed up with fighting words. You'd expect: "Our legal team has advised us to remind consultants that they are bo…

The blog post is as authentic as a big pile of rubber dog shit. The faux-folksy patina does nothing to hide the utter contempt Oracle has for their customers.

Is this so different than the accusations of contempt often levied at several large personalities in the open source world?

I'm honestly curious about this.

Re: “Stop reverse engineering our code”

#172

Post by pluma »

kuschku wrote: post #74
dagw wrote: post #48

Earlier quoted context omitted.

Sure, but this is a contract matter between two private entities. Oracle can still revoke your license for doing it.

In German law, clauses that forbid reverse engineering are invalid, the contract itself still stays valid, though. UhrG Paragraph 95 and 69

Don't some types of contract require a CYA clause along the lines of "if any part of this contract is invalid, the contract only covers those parts that are valid", though?

I'm not sure whether this is just voodoo or whether those contracts would otherwise be nullified as soon as you point out any single clause is actually invalid.

Re: “Stop reverse engineering our code”

#173

Post by copsarebastards »

bmir-alum-007 wrote: post #87
kabdib wrote: post #80

Wow. Really? This single blog post is strong evidence for why you should never, ever buy an Oracle product, and if you are running anything written by them, why you should plan to migrate away. Now, the culture of consultants in the Oracle sphere of influence is pretty toxic and money-grubbing. I can imagine companies being badgered into paying security weasels big bucks to analyze software with tools that cough up a…

Stanford was taken to the cleaners to the tune of $1.5 x 10^8 USD in the deployment of Oracle Financials and related products via endless "consultant implementation" charges that didn't really deliver much value, were rarely on schedule or on budget. Oracle's enterprise calendaring program was totally inadequate and had UX that made most point-of-sale systems look effortless by contrast. Also, the assets managing app…

I worked for a large company which will remain unnamed, who a few years after purchasing a 12-year unlimited support contract, switched to using Postgres. Read: they were already locked in to paying for Oracle's most expensive contract for 12 years, regardless of what services they used. In short, they concluded that due to the cost of developing for Oracle, it was cheaper to migrate to Postgres than to continue using Oracle even when Oracle was free.

Re: “Stop reverse engineering our code”

#174

Post by pluma »

lorenzhs wrote: post #76
dagw wrote: post #48

Earlier quoted context omitted.

Sure, but this is a contract matter between two private entities. Oracle can still revoke your license for doing it.

I'm pretty certain that national law takes precedence over what someone put in a contract. Example: It works like this for tenancy agreements in Germany. Your landlord can say that you're not allowed to change the locks all they want, and even if it's in the tenancy and you signed it, it's still null and void.

Another example for tenancy is that your landlord can not prohibit you from keeping small pets[0] (including cats) even if you sign it.

Another example is that EULAs are prohibited by law from containing any clauses that a customer could not reasonable be expected to assume to be in them. This hit WhatsApp when it tried to ban users who used unofficial clients (which would not violate the EULA of most other messaging services and can therefore not be prohibited simply by adding a clause to the EULA).

[0]: within reason, obviously. The landlord would have to prove that the pets present an unreasonable nuisance to your neighbours or cause unreasonable amounts of damage to the landlord's property.

Re: “Stop reverse engineering our code”

#175

Post by twoodfin »

Flenser wrote: post #109
waihtis wrote: post #94

Earlier quoted context omitted.

I've recently read "The Difference Between God and Larry Ellison *God Doesn't Think He's Larry Ellison" and while it was published over 10 years ago, this sounds exactly like a lot of things that happened in the book. The Oracle corporate culture seems to basically be reflection of Larry Ellison's megalomania. Their will to rack sales is just insatiable.

You might enjoy this talk by Bryan Cantrill, where he describes the Oracle acquisition of Sun: https://www.youtube.com/watch?v=-zRN7XLCRhc&t=34m7s > "what you think of Oracle is even truer than you think it is. There has been no entity in human history with less complexity or nuance to it than Oracle" > "this company is about one man and his alter ego and what he wants to inflict upon humanity" Edit: And how could I…

Hadn't seen the second talk, which is (no surprise) technically interesting as well as highly entertaining. Thanks!

Re: “Stop reverse engineering our code”

#176

Post by jaawn »

sklogic wrote: post #170
jaawn wrote: post #162

Earlier quoted context omitted.

I think there may be a language barrier here. So, this should clear it up: The only definition of "reverse engineering software" that I use is this -- "Using tools and deep binary analysis to take a compiled binary, and convert it back to source code as close to the original as possible". It is a very specific definition. I do not mean general "analysis" or vulnerability testing or input manipulation, etc... only att…

> The only definition of "reverse engineering software" that I use Uhm, no, that's far too narrow. Reverse engineering is any kind of introspection into a device in question, designed for obtaining any degree of understanding of its inner functioning. What you're talking about is called "decompilation", and it's not even among the most useful reverse engineering techniques.

People have different understandings of words, so I'm not claiming there is one, universal meaning of "software reverse engineering." However, here is the definition some researchers came up with: "Reverse engineering is the process of analyzing a subject system to create representations of the system at a higher level of abstraction. It can also be seen as "going backwards through the development cycle." (from https://en.wikipedia.org/wiki/Reverse_engineering#Reverse_en... , original publication: http://win.ua.ac.be/~lore/Research/Chikofsky1990-Taxonomy.pd... )

edit: I just wanted to explain to you which definition I was using earlier, so that you could understand what I meant better.

Re: “Stop reverse engineering our code”

#177

Post by hughw »

opless wrote: post #108
anglebracket wrote: post #95

Earlier quoted context omitted.

https://web.archive.org/web/20150811052336/https://blogs.ora...

Just in case a robot.txt kills that http://pastebin.com/rcPSyRnR

Would archive.org typically honor a robots.txt for a resource it already retrieved? I never understood the intent of a robots.txt to be retroactive.

Re: “Stop reverse engineering our code”

#178

Post by jtreminio »

bmir-alum-007 wrote: post #87
kabdib wrote: post #80

Wow. Really? This single blog post is strong evidence for why you should never, ever buy an Oracle product, and if you are running anything written by them, why you should plan to migrate away. Now, the culture of consultants in the Oracle sphere of influence is pretty toxic and money-grubbing. I can imagine companies being badgered into paying security weasels big bucks to analyze software with tools that cough up a…

Stanford was taken to the cleaners to the tune of $1.5 x 10^8 USD in the deployment of Oracle Financials and related products via endless "consultant implementation" charges that didn't really deliver much value, were rarely on schedule or on budget. Oracle's enterprise calendaring program was totally inadequate and had UX that made most point-of-sale systems look effortless by contrast. Also, the assets managing app…

> to the tune of $1.5 x 10^8 USD

Was it really necessary to type it like that?

Re: “Stop reverse engineering our code”

#179

Post by JoachimS »

quesera wrote: post #10

Wow. Someone's been hitting the Kool-Aid pretty hard. I've seen this institutional hubris first-hand. The unshakable belief (typically by nontechnical management) that all of the smartest people in the world are employed here , working for me . It always ends badly.

Remember the classic Can't Break It, Can't Break In campaign several years ago. It yielded a bunch of new bunch and exploits in Oracle SW in a few days. They seem not to have learned.

Re: “Stop reverse engineering our code”

#180

Post by markc »

db48x wrote: post #69
lawnchair_larry wrote: post #18

Earlier quoted context omitted.

She has no idea what she is talking about. Nobody is running static analysis on source code and sending her results. She's mixed up a lot of concepts here and is just plain wrong.

You can statically analyze a binary as well. "Static analysis" is just a technique for deducing the properties of a system without running it.

You and lawnchair are exactly right!

Somehow this CSO is unaware of binary static analysis, ala Veracode. You can still get plenty of false positives from binary SAST, but it's NOT de-compilation.

My question would be whether binary SAST falls under the prohibition against reverse engineering. I wouldn't think so, but that's one for the lawyers unfortunately.

Post reply on HN