Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stop reverse engineering our code”

blogs.oracle.com

Post reply on HN
Print view View original

271–280 of 358 posts

Re: “Stop reverse engineering our code”

#271

Post by greggyb »

bunderbunder wrote: post #239
greggyb wrote: post #195

Earlier quoted context omitted.

I believe we are going to be at an impasse here, but the quote you extracted illustrates the point I made, that Standard Oil acted as a competitive firm. We expect to see profit driven to zero in a competitive market, and that is what we saw in Standard Oil's pricing. In cases where there was little competition, that clearly indicates an area where the costs of the trade were such that the market price would be highe…

"We expect to see profit driven to zero in a competitive market, and that is what we saw in Standard Oil's pricing." We don't see that in any of the information you provided. You gave a graph of oil prices, not of Standard Oil's profits.

I was responding specifically to the latter portion of the quote excerpted by the grandparent post, which indicated minimal and zero profits for Standard Oil in areas with competition, in alignment with economic theory which indicates economic profit tends toward zero with increased competition.

Re: “Stop reverse engineering our code”

#272

Post by yellowapple »

myhf wrote: post #119
Agathos wrote: post #107

Earlier quoted context omitted.

You can be authentic and speak your mind without being arrogant, insulting, and condescending If you are by nature arrogant, insulting, and condescending, then no, you can't.

https://en.wikipedia.org/wiki/Fundamental_attribution_error

In my honest and not-so-humble opinion, the tendency to attribute arrogance to Oracle is by no means "undue" (which is required for the parent comment to fall victim to FAE).

Re: “Stop reverse engineering our code”

#273

Post by kjs3 »

HelloNurse wrote: post #211
kjs3 wrote: post #166

Earlier quoted context omitted.

Ah...you've never used one of these tools on a large code base. The problem is that when I run the tool in my QA environment, I identify the false positive and configure my tool to account for the false positive (or I create a compensating control). If you run the same tool, you'll see everything I tuned out, and I then have to go back and trace where the finding was tuned out, why it was tuned out and make sure that…

Silencing false positives when one runs static analysis tools is only enough for the purpose of a single bug-finding campaign, not for a sustainable effort. To deal with false positive reports from customers, Oracle needs to archive what the false positives in each release of their software according to popular tools are. Not the tools they use to find bugs: all tools customers use. It's not like they cannot afford t…

Oracle needs to archive what the false positives in each release of their software according to popular tools are.

Oh, wow! How could we be so stupid. All we have to do is build a false positive database of all tools, everywhere. Don't forget for all versions. Not just all versions of the tools, all versions of your code. And whenever a new tool or version comes out, rerun everything. Because inevitably some guy limping along with Oracle 8 is going to download the latest Parasoft release and he's gonna what a word with you because probably Parasoft doesn't even have an Oracle 8 instance laying around any more. No problem!

Adopting a code style that reduces false positives...

Force coders to change their style because "AppScan v6.00.01 patch 10 throws a falsy on this expression in version 11i patch 200". Sure, why not...fuck those guys. People should be slaves to the tools, not the other way around.

rigorously demanding working test cases

Forcing your 400k some odd customers to come up with test cases for your code before you pay attention to the vulnerability reports they genuinely believe are important. That sure won't alienate customers at all.

Proof once again how easy it is to wave ones hand over a complicated subject one doesn't fully understand, assign simple (and wrong) solutions based on limited information and declare others inadequate.

Re: “Stop reverse engineering our code”

#274

Post by yellowapple »

greggyb wrote: post #171
op00to wrote: post #84

Earlier quoted context omitted.

The blog post is as authentic as a big pile of rubber dog shit. The faux-folksy patina does nothing to hide the utter contempt Oracle has for their customers.

Is this so different than the accusations of contempt often levied at several large personalities in the open source world? I'm honestly curious about this.

Depends on which "several large personalities" you're referring to. Perhaps if you specify, your curiosity will be sated.

Re: “Stop reverse engineering our code”

#275

Post by sklogic »

jaawn wrote: post #260
sklogic wrote: post #213

Earlier quoted context omitted.

It does not really matter how we are interpreting the term "reverse engineering". What matters is how it was used in the OP article, in the EULAs and the national laws. In the article it was clearly applied to a binary analysis part of pen testing efforts by the Oracle customers, so this is what we should be discussing here.

I disagree. The author implies several times that the main issue, and the reason for the ban on reverse engineering in the agreement, is protection of intellectual property (source code). People may do other types of vulnerability testing, but the piece that Oracle is concerned about is trying to discover their source code (for example, by using static analysis tools...which analyze some version of source code).

Many static analysis tools are working on JVM bytecode level, and there are quite a few for even the raw x86.

Re: “Stop reverse engineering our code”

#276

Post by tankenmate »

mikeash wrote: post #244
victorNicollet wrote: post #233

Earlier quoted context omitted.

I'm sorry for the confusion. English is not my first language, and I resorted to https://en.wikipedia.org/wiki/Accuracy_and_precision to pick between "accuracy" and "precision".

To put it another way: "pi is exactly 3" is extremely precise, but not very accurate.

The very next task of mine

is a new value of pi to define.

I think I'll use 3

it's much simpler you see;

than 3.14159

Re: “Stop reverse engineering our code”

#277

Post by moron4hire »

mikeash wrote: post #270
moron4hire wrote: post #269

Earlier quoted context omitted.

On the other hand, if you had said "Pi is 3", you would have been accurate, but not very precise. If you said "Pi is "Pi is 3.14", you would have been so precise that you could have gotten to the moon and back.

Damn, and here I thought I needed to build a gigantic rocket.

My statement was accurate, just lacking in precision on the details :P

Re: “Stop reverse engineering our code”

#279

Post by greggyb »

yellowapple wrote: post #274
greggyb wrote: post #171

Earlier quoted context omitted.

Is this so different than the accusations of contempt often levied at several large personalities in the open source world? I'm honestly curious about this.

Depends on which "several large personalities" you're referring to. Perhaps if you specify, your curiosity will be sated.

I am curious in general, as it is often noted that there is a trend in open source development communities to be hostile to end-users.

If pressed for specifics, Linus Torvalds and Theo de Raadt come to mind as a couple that are often called out for their abusive behavior.

Post reply on HN