Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stop reverse engineering our code”

blogs.oracle.com

Post reply on HN
Print view View original

311–320 of 358 posts

Re: “Stop reverse engineering our code”

#311

Post by jaawn »

sklogic wrote: post #275
jaawn wrote: post #260

Earlier quoted context omitted.

I disagree. The author implies several times that the main issue, and the reason for the ban on reverse engineering in the agreement, is protection of intellectual property (source code). People may do other types of vulnerability testing, but the piece that Oracle is concerned about is trying to discover their source code (for example, by using static analysis tools...which analyze some version of source code).

Many static analysis tools are working on JVM bytecode level, and there are quite a few for even the raw x86.

I would consider that "some version of the source code".

However, this is one of the reasons I disagree with Oracle on the matter. There are tools which actually can and do find issues at this low level (even if there are false positives), and running those tools can be part of many reasonable verification efforts. I think static analysis at the bytecode or assembly code level still counts as analyzing the source code, but I think it makes sense to do that in many scenarios.

Re: “Stop reverse engineering our code”

#312

Post by tptacek »

notacoward wrote: post #310
tptacek wrote: post #261

Earlier quoted context omitted.

This is diametrically the opposite of my experience with source code scanners. I think the impedance mismatch here might be that you're a software developer, and we're talking about security teams. I don't know that anyone is arguing that static analysis is useless for developers. If you're intimately familiar with the code you're working on, there are probably a lot of ways to make static analysis results both valua…

If somebody's paying a consultant hundreds of dollars an hour to run a static analysis tool and forward the output, without applying a developer's skills in between, they've been defrauded. Static analyzers are coding tools, much like compilers. Their input is code. Their output is pointers to code. True adversarial analysis, or any other endeavor involving static analysis, requires something extremely close to a cod…

Now you see where she's coming from.

Re: “Stop reverse engineering our code”

#313

Post by kuschku »

jaawn wrote: post #263
kuschku wrote: post #224

Earlier quoted context omitted.

Under EU law it is illegal to forbid someone to convert a binary back into source code. Even further, if I buy a software, and it does not run on my system, I can turn it back into source, modify it, recompile it, and use it as much as I want. If the original company tries to prevent me from doing this, they commit a crime that can be punished with multiple months of jail for their CEO or 10% of their profit as long…

This isn't entirely accurate. There are restrictions on the legality of decompilation in Europe. The main one being that "...decompilation must be necessary to achieve interoperability with the target program or other programs. Interoperability information should therefore not be readily available, such as through manuals or API documentation." So, decompilation in order to check for security vulnerabilities or to mo…

> if I buy a software, and it does not run on my system,

This would be one example case. As I posted in my comment.

Integration can also just mean for future possible integration – for example, if someone writes a tool that can read a file format, I may decompile it to implement a tool to read the same file format.

Re: “Stop reverse engineering our code”

#314

Post by dredmorbius »

cheald wrote: post #309
dredmorbius wrote: post #306

Earlier quoted context omitted.

World War I, increased demand, and a period in the 1920s during which there was genuine concern that all the oil that could be found had been. That fear disappeared with the East Texas oilfield discovery in 1930. Which so increased the supply of oil relative to demand that prices fell to 13 cents per barrel. This created a number of problems, including the prospect of damaging oilfields to the point that future extra…

I should have been more specific - I was more remarking on the period between 1911 and 1914, which saw crude prices rise; that seemed rather interesting, since I'd expect an antitrust ruling to have the opposite effect if Standard had been keeping prices high through elimination of potential competition. The effect of WWI is quite obvious, naturally. The rest of the history, though, is quite interesting. I've added t…

It rocked my world. We don't live in the Atomic Age, or Computer Age, or the Age of Democracy.

We live in the oil age.

And the rapidity with which it arrived following Colonel Drake's well is staggering.

Re: “Stop reverse engineering our code”

#315

Post by gaius »

platinum1 wrote: post #27
duncan_bayne wrote: post #23

So, I disagree with the poster on a bunch of things here (no surprise, really). But: this is authentic. This is what we (i.e. hackers) are always claiming we want. Someone speaking her mind, shooting from the hip, etc. Not an anodyne blob of corporate-speak: this is an opinion, stated pretty clearly, and backed up with fighting words. You'd expect: "Our legal team has advised us to remind consultants that they are bo…

You can be authentic and speak your mind without being arrogant, insulting, and condescending. In terms of tone, I wouldn't hold this up as a good example - it distracts from any legitimate argument the writer may or may not have.

Tell that to Pottering or de Raadt or Torvalds.

Re: “Stop reverse engineering our code”

#316

Post by yellowapple »

greggyb wrote: post #279
yellowapple wrote: post #274

Earlier quoted context omitted.

Depends on which "several large personalities" you're referring to. Perhaps if you specify, your curiosity will be sated.

I am curious in general, as it is often noted that there is a trend in open source development communities to be hostile to end-users. If pressed for specifics, Linus Torvalds and Theo de Raadt come to mind as a couple that are often called out for their abusive behavior.

In those cases, the difference is that the end result of the projects they command - Linux and OpenBSD, respectively - are free software, and therefore ultimately respect the user by providing said user with the various essential freedoms. This is in stark contrast with Oracle's software products, which are not only proprietary, but repressively so.

The hostility is also usually confined to those on the development mailing lists of those respective projects (which are implied to be meant for developers, not end-users). It's also with full understanding that - if someone doesn't like how Torvalds or de Raadt run their respective projects - they're welcome to fork (even if said forking rarely happens in practice).

The reason why I pressed for specifics is because there are some personalities in the FOSS world who - while still not in Oracle realm of dickery - probably would come close if given the ability to. Mark Shuttleworth comes to mind, being outright hostile to user feedback on things like Unity, Mir, the Amazon Shopping Lens, etc. (as opposed to the interdeveloper harshness characteristic of Torvalds and de Raadt).

Re: “Stop reverse engineering our code”

#317

Post by username3 »

Natsu wrote: post #243
kabdib wrote: post #80

Wow. Really? This single blog post is strong evidence for why you should never, ever buy an Oracle product, and if you are running anything written by them, why you should plan to migrate away. Now, the culture of consultants in the Oracle sphere of influence is pretty toxic and money-grubbing. I can imagine companies being badgered into paying security weasels big bucks to analyze software with tools that cough up a…

This is hardly a first. Oracle stuffs a bad, misspelled little poem in their DB protocols, not for any technical reason, but purely to attempt to extend copyright protection by forcing people to violate their copyrights to be compatible with Oracle. You can find a copy of it here: http://dacut.blogspot.com/2008/03/oracle-poetry.html Note the copyright statement on the mispelled, 3-line poem with no literary merit wha…

Isn't the blogpost violating copyright by posting the whole poem?

Re: “Stop reverse engineering our code”

#318

Post by syncsynchalt »

dantiberian wrote: post #3
pkkp wrote: post #2

Is it just me, or is the childish, mocking tone in the OP simultaneously baffling and totally befitting of the point they're trying to make? I understand that they're frustrated by the repeated submission of automated security vulnerability reports, but blanketing it entirely as "reverse engineering" and responding to it like this is... a strange approach. Did someone at Oracle actually think that this was the best w…

The previous post on the blog has a similar tone too https://blogs.oracle.com/maryanndavidson/entry/is_your_shell...

The formatting in that post is... interesting.

I'd blame the CMS before the author on that point though.

Re: “Stop reverse engineering our code”

#320

Post by DonHopkins »

vetrom wrote: post #259
OJFord wrote: post #127

Earlier quoted context omitted.

I'm more surprised it was posted! (at least in ~current~ as-it-was form)

I am not at all surprised that oracle would memory hole something that escapes PR control.

"Stop reverse engineering our blogs!"
Post reply on HN