Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stop reverse engineering our code”

blogs.oracle.com

Post reply on HN
Print view View original

251–260 of 358 posts

Re: “Stop reverse engineering our code”

#251

Post by notacoward »

dasil003 wrote: post #217
notacoward wrote: post #98

Earlier quoted context omitted.

Indeed, it does tend to end badly, and the best example is a company that ended up being bought by Oracle. The arrogant tone of this post reminds me very much of the flurry of blog posts that came out when ZFS and DTrace were first introduced. Remember "The Last Word in File Systems"? That kind of arrogance, complacency, and impatience with interlocutors is mildly annoying to developers elsewhere. It's more than anno…

I don't think the particular kind of arrogance that Oracle has goes away except by being killed. Heck even once the former sales guys are homeless under a bridge I doubt they would see the connection, they'd still be spinning yarns about when they worked for the greatest tech company ever.

Ditto for the engineers. The kind of engineer who contributes to a culture like that in the first place will also be constitutionally incapable of accepting that their own behavior contributed in any way to the demise.

Re: “Stop reverse engineering our code”

#252

Post by mikeash »

dagw wrote: post #48
reacweb wrote: post #33

Reverse engineering is legal in France for research and computer security ( http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTE... ).

Sure, but this is a contract matter between two private entities. Oracle can still revoke your license for doing it.

They could refuse to do any business with you in the future, but I'm pretty sure they can't revoke your existing license for breaking an unenforceable clause.

Re: “Stop reverse engineering our code”

#253

Post by joshstrange »

kabdib wrote: post #80

Wow. Really? This single blog post is strong evidence for why you should never, ever buy an Oracle product, and if you are running anything written by them, why you should plan to migrate away. Now, the culture of consultants in the Oracle sphere of influence is pretty toxic and money-grubbing. I can imagine companies being badgered into paying security weasels big bucks to analyze software with tools that cough up a…

My company is still dealing with a (thankfully) failed move to oracle. Some hotshot (who is long gone now) sold them on the idea and our DB tables/columns names are still all over the place b/c of oracles limits on name lengths. All new (and really old) tables are full length but around when we thought we were going to move all the table/column names are nearly unreadable... We also have a couple hundred thousand dollar boat anchors (read: oracle servers) because apparently they aren't worth shit if you don't run oracle on then and stripping them for parts is almost a zero-sum game. Also Oracle told us they will try to sell them for us (because they won't just buy them bacl) but they have ZERO incentive to do so when they can swindle some other corporation out of more money by selling new servers. We are now in the middle of switching over to MariaDB and I can't wait to leave Oracle behind.

Re: “Stop reverse engineering our code”

#254

Post by Retric »

greggyb wrote: post #208
Retric wrote: post #204

Earlier quoted context omitted.

profit driven to zero in a competitive market No, if profit is close to zero then there would be no point in being in a market. Markets drive profits to the 'standard' risk adjusted ROI for the economy they operate in. In other words if you could run a gas station, a book store, a flower shop, or whatever, then you do whichever one gives the most profits.

If we're going to get into definitions, we can do that. Since we are discussing economics, I do not feel the need to preface every use of jargon with disclaimers, though I can. The relevant portion of Wikipedia's entry on (economics jargon) profit: https://en.wikipedia.org/wiki/Profit_%28economics%29#In_comp... You can confirm this concept in any economics text. (economics jargon) Profit is driven to zero in a (econo…

Economic profit is not the same thing as profit. In a pure economic debate you can drop it, but when talking about specific firms in a general context such as HN you really should clarify.

For everyone else: https://en.wikipedia.org/wiki/Profit_(economics) "Economic profit is similar to accounting profit but smaller because it subtracts off the total opportunity costs (not just the explicit costs, but also the implicit costs) of a venture to an investor.[1] Normal profit refers to zero economic profit.[2] A concept related to economic profit, and sometimes considered synonymous, is that of economic rent."

You can think of Economic profit as the 'standard' ROI you get in a given economy. Hypothetically Economic profit is also being driven to zero in a static economy, but that's a separate and long term thing.

PS: I am just being this clear because general HN readers are likely to miss the distinction.

Re: “Stop reverse engineering our code”

#255

Post by tptacek »

idlewords wrote: post #9

Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?

Static analysis probably does generate basically 100% false positives.

Organizations that manage to operationalize code scanners usually spend many months with full-time staff configuring them and tuning their output --- most of which is nonsensical, for instance randomly assuming dynamic memory is leaking, or that a local variable enables a race condition. There is a whole cottage industry of consultants that does nothing but this.

When all that work is done, the team still needs a Rosetta Stone for the issues they actually do investigate, one that is highly context sensitive and dependent on the different components of their application. For instance, a Fortify or Coverity issue might be bogus in 90% of cases, but actually relevant to one particular library.

There is from what I can tell no source code scanner on the market that will take a product sight unseen and produce a report from which real vulnerabilities can be extracted with a reasonable amount of effort.

There are, on the other hand, many consultancies that will do "point assessments" --- ie, not the long-term shepherding and building of a static analysis practice, but just looking at one release of one product for flaws --- that consist mostly of running a "static" tool like Fortify and a "dynamic" tool like WebInspect, and then handing off the report.

Davidson's take on licensing and security inspection is embarrassing, but she is not at all wrong about consultants and security tools.

Re: “Stop reverse engineering our code”

#257

Post by mikeash »

lsd5you wrote: post #135
smoyer wrote: post #65

Earlier quoted context omitted.

The repeated Java exploits You're referring to are exposed when using Applets in a browser ... This was conventionally recognized as a bed idea in about 2006. You simply shouldn't allow Applets to run - no matter what. I think you'll find the rest of the Java platform more secure than most, especially since the OpenJDK foundation was formed. I'm not here to defend Oracle in any other way but they've done a reasonable…

There is nothing wrong with signed java applets. There is no difference between that and downloading and running (a signed) application.

That's only true if Java's signature validation isn't vulnerable (or at least is no more vulnerable than the signature verification for a normal OS).

Searching around, it looks like there was at least one vulnerability like this, in which Java failed to check certificates for revocation, and at least one exploit was found in the wild signed with a stolen, revoked certificate that Java still accepted.

This is especially fun because Java at least tries to sandbox unsigned applets, but signed applets get a lot more privileges.

Re: “Stop reverse engineering our code”

#258

Post by konradb »

Spooky23 wrote: post #128
bmir-alum-007 wrote: post #110

Earlier quoted context omitted.

The dept I used to work at was mostly ex-B4 people and I later did enterprise consulting later: What happens is that sales people talk to people high enough up on the food chain that they get the run of the place, and so it's nearly impossible to kick them out or refuse their requests without a substantial political cost/justification. It's called "building a beachhead" and involves the engagement team worming their…

I was in a situation where they were selling something to a business leader that my side of the org wasn't in favor of buying (5x cost difference). I drew the short straw and got to meet with them and the business leadership people. In the meeting, I literally had this dude and his presales guys in $5000 suits sitting across the table from me, berating our position and demanding (quote was "You have no fucking busine…

Wow that's wildly aggressive. I know people say 'push for the sale' but that seems counterproductive. It seems like they would have got further if they listened more.

Re: “Stop reverse engineering our code”

#259

Post by vetrom »

OJFord wrote: post #127
bradleyankrom wrote: post #101

Earlier quoted context omitted.

Glorious. Somewhat surprised it was taken down, though.

I'm more surprised it was posted! (at least in ~current~ as-it-was form)

I am not at all surprised that oracle would memory hole something that escapes PR control.

Re: “Stop reverse engineering our code”

#260

Post by jaawn »

sklogic wrote: post #213
jaawn wrote: post #176

Earlier quoted context omitted.

People have different understandings of words, so I'm not claiming there is one, universal meaning of "software reverse engineering." However, here is the definition some researchers came up with: "Reverse engineering is the process of analyzing a subject system to create representations of the system at a higher level of abstraction. It can also be seen as "going backwards through the development cycle." (from https…

It does not really matter how we are interpreting the term "reverse engineering". What matters is how it was used in the OP article, in the EULAs and the national laws. In the article it was clearly applied to a binary analysis part of pen testing efforts by the Oracle customers, so this is what we should be discussing here.

I disagree. The author implies several times that the main issue, and the reason for the ban on reverse engineering in the agreement, is protection of intellectual property (source code). People may do other types of vulnerability testing, but the piece that Oracle is concerned about is trying to discover their source code (for example, by using static analysis tools...which analyze some version of source code).
Post reply on HN