Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stop reverse engineering our code”

blogs.oracle.com

Post reply on HN
Print view View original

341–350 of 358 posts

Re: “Stop reverse engineering our code”

#341

Post by anarazel »

bmir-alum-007 wrote: post #336
copsarebastards wrote: post #173

Earlier quoted context omitted.

I worked for a large company which will remain unnamed, who a few years after purchasing a 12-year unlimited support contract, switched to using Postgres. Read: they were already locked in to paying for Oracle's most expensive contract for 12 years, regardless of what services they used. In short, they concluded that due to the cost of developing for Oracle, it was cheaper to migrate to Postgres than to continue usin…

In case anyone were wondering: Postgres deliberately resembles Oracle. EnterpriseDB is one of the official Postgres commercial flavors which is an even closer "clone" of Oracle DBMS with support options to make migration from ora easier.

> Postgres deliberately resembles Oracle.

I don't think that's really the case. We don't try to do anything different for the sake of it, but that's pretty much that.

> EnterpriseDB is one of the official Postgres commercial flavors

There are no 'official Postgres commercial flavors'. EDB is well known and contributes a fair amount to PG development, but that doesn't make them official.

Re: “Stop reverse engineering our code”

#342

Post by jaawn »

mikeash wrote: post #221
jaawn wrote: post #176

Earlier quoted context omitted.

People have different understandings of words, so I'm not claiming there is one, universal meaning of "software reverse engineering." However, here is the definition some researchers came up with: "Reverse engineering is the process of analyzing a subject system to create representations of the system at a higher level of abstraction. It can also be seen as "going backwards through the development cycle." (from https…

That quote is quite different from the definition you're using. Your definition is not what anyone else uses, from what I've seen. You don't have to use the same definition, of course, but be aware that unless you clarify what you mean, you're going to be creating a ton of confusion.

I don't see how it is different. A "higher level of abstraction" means progressively higher-level versions of source code. Binary->machine/assembly code->C++ code for example. Each step involves reverse engineering. Simply disassembling/decompiling a binary is not really sufficient to be considered "reverse engineered". Someone needs to analyze the output of these tools to create reverse-engineered output which is ready to be modified/extended/investigated.

Re: “Stop reverse engineering our code”

#343

Post by engi_nerd »

bmir-alum-007 wrote: post #335
engi_nerd wrote: post #235

Earlier quoted context omitted.

It is somewhat rare that companies will recognize the fallacy of sunk costs ("We've already spent so much, we need to do this"). I think the world would be a much different place if we could somehow overcome this cognitive error.

I see this repeated all the time and tend to label it "the investment-bias fallacy" but it's also called commitment bias. [0] Go into any casino where people are trying to win back their lost money is one classic cliché. 0. https://en.wikipedia.org/wiki/Escalation_of_commitment

"Sunk cost fallacy" is what my college "Engineering methods" course called it, but we are talking about the same concept.

Re: “Stop reverse engineering our code”

#344

Post by copsarebastards »

bmir-alum-007 wrote: post #336
copsarebastards wrote: post #173

Earlier quoted context omitted.

I worked for a large company which will remain unnamed, who a few years after purchasing a 12-year unlimited support contract, switched to using Postgres. Read: they were already locked in to paying for Oracle's most expensive contract for 12 years, regardless of what services they used. In short, they concluded that due to the cost of developing for Oracle, it was cheaper to migrate to Postgres than to continue usin…

In case anyone were wondering: Postgres deliberately resembles Oracle. EnterpriseDB is one of the official Postgres commercial flavors which is an even closer "clone" of Oracle DBMS with support options to make migration from ora easier.

[citation needed]

I guess one could say they deliberately resemble Oracle in that both DBs roughly implement the SQL standard, but this is by no means a clone, nor was it a smooth transition.

Re: “Stop reverse engineering our code”

#345

Post by the_why_of_y »

notacoward wrote: post #98
quesera wrote: post #10

Wow. Someone's been hitting the Kool-Aid pretty hard. I've seen this institutional hubris first-hand. The unshakable belief (typically by nontechnical management) that all of the smartest people in the world are employed here , working for me . It always ends badly.

Indeed, it does tend to end badly, and the best example is a company that ended up being bought by Oracle. The arrogant tone of this post reminds me very much of the flurry of blog posts that came out when ZFS and DTrace were first introduced. Remember "The Last Word in File Systems"? That kind of arrogance, complacency, and impatience with interlocutors is mildly annoying to developers elsewhere. It's more than anno…

The same file system that the Linux developers have tried (and failed) to clone for almost 10 years now? Yeah, must be totally unremarkable.

Re: “Stop reverse engineering our code”

#346

Post by waihtis »

Flenser wrote: post #109
waihtis wrote: post #94

Earlier quoted context omitted.

I've recently read "The Difference Between God and Larry Ellison *God Doesn't Think He's Larry Ellison" and while it was published over 10 years ago, this sounds exactly like a lot of things that happened in the book. The Oracle corporate culture seems to basically be reflection of Larry Ellison's megalomania. Their will to rack sales is just insatiable.

You might enjoy this talk by Bryan Cantrill, where he describes the Oracle acquisition of Sun: https://www.youtube.com/watch?v=-zRN7XLCRhc&t=34m7s > "what you think of Oracle is even truer than you think it is. There has been no entity in human history with less complexity or nuance to it than Oracle" > "this company is about one man and his alter ego and what he wants to inflict upon humanity" Edit: And how could I…

Hah, awesome. The sentiment he puts into portraying Oracle truely tells something about the company.

Re: “Stop reverse engineering our code”

#347

Post by konradb »

davidgerard wrote: post #38

This is one of the finest pieces of Postgres marketing I can recall seeing in recent times. They've made the case for open source better than anyone in 2015. (We're in the midst of an Oracle->Postgres conversion right now. It's going wonderfully. I strongly advise you to look into it, bet you'll find it way easier than you think.) (One of the nicest things about it: we give every app its own cluster of two PG boxes,…

How do you arrange your PG clusters, are you using streaming replication?

Re: “Stop reverse engineering our code”

#348

Post by davidgerard »

konradb wrote: post #347
davidgerard wrote: post #38

This is one of the finest pieces of Postgres marketing I can recall seeing in recent times. They've made the case for open source better than anyone in 2015. (We're in the midst of an Oracle->Postgres conversion right now. It's going wonderfully. I strongly advise you to look into it, bet you'll find it way easier than you think.) (One of the nicest things about it: we give every app its own cluster of two PG boxes,…

How do you arrange your PG clusters, are you using streaming replication?

Failover pair with a primary and standby. The primary streams write-ahead log records to standby as they're generated. Some script gaffer-tape to watch for primary failure and fail over. I think we haven't ever yet actually had to invoke this though :-)

This was all cobbled together following the docs. There are almost certainly better ways to do everything we've done so far.

The Postgres is just 9.3 out of the Ubuntu 14.04 repo. Oracle was STUPENDOUS overkill for what it was actually being used for, but MySQL wasn't up to the job.

The heavy lifting for the conversion is done using ora2pg http://ora2pg.darold.net/ Then there's a pile of faff and twiddling and unit tests and so forth. See also https://wiki.postgresql.org/wiki/Oracle_to_Postgres_Conversi...

Re: “Stop reverse engineering our code”

#349

Post by markc »

tptacek wrote: post #262
markc wrote: post #180

Earlier quoted context omitted.

You and lawnchair are exactly right! Somehow this CSO is unaware of binary static analysis, ala Veracode. You can still get plenty of false positives from binary SAST, but it's NOT de-compilation. My question would be whether binary SAST falls under the prohibition against reverse engineering. I wouldn't think so, but that's one for the lawyers unfortunately.

This is an embarrassing subthread. I'm sorry to spoil an opportunity for people to feel like they're smarter than an executive that just wrote a lot of dumb things in a blog post, but not only does Mary Ann Davidson know about Veracode, she's semi-famous for hating on them. Meanwhile: a huge portion of everything Oracle ships is Java, and consultants absolutely do run Java security scanners on decompiled jar files fr…

The quote:

"A customer is almost certainly violating the license agreement by using a tool that does static analysis (which operates against source code)"

It's a stretch to interpret this as an admission that it's only a license violation when decompilation to source is involved. I read it as "all static analysis operates against source code".

It's hardly embarrassing to point out that important detail, and I don't think it's fair to assume that the motivation for correcting the error is "to feel smarter than" the one who made it.

Re: “Stop reverse engineering our code”

#350

Post by notacoward »

the_why_of_y wrote: post #345
notacoward wrote: post #98

Earlier quoted context omitted.

Indeed, it does tend to end badly, and the best example is a company that ended up being bought by Oracle. The arrogant tone of this post reminds me very much of the flurry of blog posts that came out when ZFS and DTrace were first introduced. Remember "The Last Word in File Systems"? That kind of arrogance, complacency, and impatience with interlocutors is mildly annoying to developers elsewhere. It's more than anno…

The same file system that the Linux developers have tried (and failed) to clone for almost 10 years now? Yeah, must be totally unremarkable.

I didn't say it was unremarkable, Mr. Strawman. However, it wasn't the "last word" either. If it had been, there wouldn't have been so many generations of major change to it since then. It's possible for people to be good at what they do but still nowhere near as good as they think, and that pretty accurately described a lot of Sun engineers at that time. The answer to all criticism, including that which history has shown to be completely accurate, was never anything but a sneer. It was the most anti-collegial attitude ever, and the industry is worse off for it.
Post reply on HN