“Stop reverse engineering our code” • Hacker News Board

Re: “Stop reverse engineering our code”

#31

Post by madaxe_again » Tue, Aug 11, 2015, 9:10 AM UTC

sqldba wrote: post #26

It sounds like they've confused a) users submitting results from static analysis that wastes time, b) users submitting demonstrable vulnerabilities, and c) license agreements. a) is bad, and the users should just be turned away. b) is good and far better than selling them on the black market. c) is... who cares it's a license agreement.

She's mostly focussed on (a), it seems, and I can understand the frustration - all too often we get lengthy missives from client consultants along the lines of "Ran scanning tool. Suggests that the version of PHP.net you are using is vulnerable to LSASS and STUXNET vulnerabilities, our client is terrified, pay me off to make the pain go away." We get a genuine vulnerability reported once in a blue moon.

(b) is good, but her point that them spending their time doing static analysis of oracle's software is a monumental waste of time is perfectly valid, if their root password is password and the firewall is just some sheetrock in the basement.

Re: “Stop reverse engineering our code”

#32

Post by PeterisP » Tue, Aug 11, 2015, 9:11 AM UTC

idlewords wrote: post #9

Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?

A major point for a well-maintained product is that you run all the same tools yourselves, fix the real issues, and only the false positives remain.

Re: “Stop reverse engineering our code”

#33

Post by reacweb » Tue, Aug 11, 2015, 9:13 AM UTC

Reverse engineering is legal in France for research and computer security (http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTE...).

Re: “Stop reverse engineering our code”

#34

Post by maze-le » Tue, Aug 11, 2015, 9:22 AM UTC

Udo wrote: post #30

platinum1 wrote: post #27

Earlier quoted context omitted.

You can be authentic and speak your mind without being arrogant, insulting, and condescending. In terms of tone, I wouldn't hold this up as a good example - it distracts from any legitimate argument the writer may or may not have.

I think a lot of blog posts like these get triggered by some acute event which pushed the writer over the edge, and it's expected this will shine through in the text. The rest is probably due to living in an employer-typical bubble. If I was an Oracle customer (which I will never, ever be) I would appreciate the honesty. This honesty enables me to make purchase decisions as well, better than megabytes of legalese wou…

> This honesty enables me to make purchase decisions as well.

Fair point. And a hint to everyone still hanging on to oracle Databases.

One of the best lines is this here:

> Q. What does Oracle do if there is an actual security vulnerability?

> (...) if there is an actual security vulnerability, we will fix it.

Sure, the question is 'when', not so much 'if' customers have payed a hell of a lot money to get this straight.

Re: “Stop reverse engineering our code”

#35

Post by kriro » Tue, Aug 11, 2015, 9:23 AM UTC

This is a marketing layup for any FLOSS ERP company (or the PostgreSQLs of the world). Basically "by all means check our code for any issue you may find. We'll gladly accept any suggestions for code improvements you may have."

This post is an absolute nightmare/facepalm. Basically my takeaway is "I guess I don't want to buy Oracle software". It's really mind blowing that this is the position of a major software company in this day and age. I mean I guess I shouldn't be shocked since it is in the EULA but man I'm kind of speechless (this clause has to be illegal in some countries, too).

Edit: as an aside as a bad guy this would make me very interested in reverse engineering Oracle products. If they disallow it for their customers the reaction times to any security issues will be lower and it will be pretty valuable to find bugs in their products.

Edit2: Seems like the blog was cracked. At least the "About" on the side seems to indicate that.

Re: “Stop reverse engineering our code”

#36

Post by kitsune_ » Tue, Aug 11, 2015, 9:24 AM UTC

reacweb wrote: post #33

Reverse engineering is legal in France for research and computer security ( http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTE... ).

Also in Switzerland:

> Art. 21 Decoding of computer programs

> 1 Any person who has the right to use a computer program may obtain, either personally or through a third party, necessary information on the interfaces by decoding the program code using independently developed programs.

> 2 The interface information obtained by decoding the program code may only be used for the development, maintenance and use of interoperable computer programs insofar as neither the normal exploitation of the program nor the legitimate interests of the owner of the rights are unreasonably prejudiced.

https://www.admin.ch/opc/en/classified-compilation/19920251/...

Re: “Stop reverse engineering our code”

#37

Post by Stratoscope » Tue, Aug 11, 2015, 9:34 AM UTC

> Q. If you don’t let customers reverse engineer code, they won’t buy anything else from you.

> A. I actually heard this from a customer. It was ironic because in order for them to buy more products from us (or use a cloud service offering), they’d have to sign – a license agreement! With the same terms that the customer had already admitted violating. “Honey, if you won’t let me cheat on you again, our marriage is through.” “Ah, er, you already violated the ‘forsaking all others’ part of the marriage vow so I think the marriage is already over.”

What a thoroughly nasty comment. She is comparing her customer with someone who is cheating on their spouse. Disgusting.

Re: “Stop reverse engineering our code”

#38

Post by davidgerard » Tue, Aug 11, 2015, 9:37 AM UTC

This is one of the finest pieces of Postgres marketing I can recall seeing in recent times. They've made the case for open source better than anyone in 2015.

(We're in the midst of an Oracle->Postgres conversion right now. It's going wonderfully. I strongly advise you to look into it, bet you'll find it way easier than you think.)

(One of the nicest things about it: we give every app its own cluster of two PG boxes, because you can just do that instead of running a centralised monster box with an expensive license. It turns out that just everything not having to play nice with others makes stuff stupendously easier to manage.)

Re: “Stop reverse engineering our code”

#39

Post by muhuk » Tue, Aug 11, 2015, 9:52 AM UTC

Noticed that obscure death threat in the beginning? I'm not surprised to see it in a post about licenses.

Re: “Stop reverse engineering our code”

#40

Post by Jare » Tue, Aug 11, 2015, 9:57 AM UTC

reacweb wrote: post #33

Reverse engineering is legal in France for research and computer security ( http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTE... ).

I wonder to what extent "interoperability" (a common exemption for allowing Reverse Engineering in US and EU) might include "security validation" and thus make this generally legal regardless of EULAs.