“Stop reverse engineering our code”

Post by HelloNurse » Tue, Aug 11, 2015, 4:00 PM UTC

kjs3 wrote: post #166

HelloNurse wrote: post #124

Earlier quoted context omitted.

Oracle cannot ignore annoying and low-expected-value static analysis tickets, but: 1) the answer should usually be either "fixed in this patch, install it" or "it's a false positive, try developing an actual exploit if you don't believe us". Not expensive, provided Oracle actually runs static analysis tools against their software and addresses the findings before releasing updates. 2) If Oracle actually runs static a…

Ah...you've never used one of these tools on a large code base. The problem is that when I run the tool in my QA environment, I identify the false positive and configure my tool to account for the false positive (or I create a compensating control). If you run the same tool, you'll see everything I tuned out, and I then have to go back and trace where the finding was tuned out, why it was tuned out and make sure that…

Post by sklogic » Tue, Aug 11, 2015, 4:04 PM UTC

jaawn wrote: post #176

sklogic wrote: post #170

Earlier quoted context omitted.

> The only definition of "reverse engineering software" that I use Uhm, no, that's far too narrow. Reverse engineering is any kind of introspection into a device in question, designed for obtaining any degree of understanding of its inner functioning. What you're talking about is called "decompilation", and it's not even among the most useful reverse engineering techniques.

People have different understandings of words, so I'm not claiming there is one, universal meaning of "software reverse engineering." However, here is the definition some researchers came up with: "Reverse engineering is the process of analyzing a subject system to create representations of the system at a higher level of abstraction. It can also be seen as "going backwards through the development cycle." (from https…

Post by pg_is_a_butt » Tue, Aug 11, 2015, 4:08 PM UTC

duncan_bayne wrote: post #23

So, I disagree with the poster on a bunch of things here (no surprise, really). But: this is authentic. This is what we (i.e. hackers) are always claiming we want. Someone speaking her mind, shooting from the hip, etc. Not an anodyne blob of corporate-speak: this is an opinion, stated pretty clearly, and backed up with fighting words. You'd expect: "Our legal team has advised us to remind consultants that they are bo…

Post by dasil003 » Tue, Aug 11, 2015, 4:15 PM UTC

notacoward wrote: post #98

quesera wrote: post #10

Wow. Someone's been hitting the Kool-Aid pretty hard. I've seen this institutional hubris first-hand. The unshakable belief (typically by nontechnical management) that all of the smartest people in the world are employed here , working for me . It always ends badly.

Indeed, it does tend to end badly, and the best example is a company that ended up being bought by Oracle. The arrogant tone of this post reminds me very much of the flurry of blog posts that came out when ZFS and DTrace were first introduced. Remember "The Last Word in File Systems"? That kind of arrogance, complacency, and impatience with interlocutors is mildly annoying to developers elsewhere. It's more than anno…

Post by mrbill » Tue, Aug 11, 2015, 4:18 PM UTC

oddthink wrote: post #120

technion wrote: post #50

Earlier quoted context omitted.

I actually understand how it gets to be this way though. I literally can't touch a Government project without an Oracle license. When I talk to a salesman, the attitude is "I know you can't do this without me", contrary to salesmen for any other product in any other industry. When I talk to a project manager, they don't ask how it will be hosted, or what the platform will be, or anything else obvious. The first quest…

Interesting. In what industries is Oracle so dominant? You say government is one, but where else? In industry, all I've ever seen is Sybase, SQL Server, and MySQL (ok, technically Oracle). (My background is finance and technology.)