“Stop reverse engineering our code” • Hacker News Board

Re: “Stop reverse engineering our code”

#61

Post by zamalek » Tue, Aug 11, 2015, 10:41 AM UTC

dagw wrote: post #48

reacweb wrote: post #33

Reverse engineering is legal in France for research and computer security ( http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTE... ).

Sure, but this is a contract matter between two private entities. Oracle can still revoke your license for doing it.

AFAIK portions of EULAs can be nullified by local law. For example, imagine if I made some incredibly useful piece of software and placed assassination requests in the EULA.

Source: by logical extension of: the "no refund" portion of game EULAs is nullified in EU. I'm no lawyer, though.

It doesn't matter though. Even if Oracle can legally stop customers and researchers from reverse-engineering their software world-wide, they can't stop malicious elements because the malicious elements never disclose that they have done it: Oracle only find out after they have been pwnd. I would say "serves them right," but the sad truth is that their customers are going to get hurt the most.

Edit to add: I don't think this[1] warrants an entirely new post.

> Oracle has told people to stop using @Veracode to test their AppSec. They already got AppSec covered [picture of JS injection attack in the blog post]

[1]: https://twitter.com/thegrugq/status/631056841670135808

Re: “Stop reverse engineering our code”

#62

Post by jjoos » Tue, Aug 11, 2015, 10:49 AM UTC

> I am not dissing bug bounties, just noting that on a strictly economic basis, why would I throw a lot of money at 3% of the problem

Aren't the issues not found by Oracle the problem? I'm amazed that stil 23% of the externally found security issues are reported by researchers, the incentive to responsibly disclose security issues to Oracle isn't really big. It sounds like a cumbersome process with potential legal consequences.

There also are researchers(, maybe after a first bad experience about an EULA,) that sell security issues to the grey/black market. Is there any data on how many Java zero days are exploited in the wild before being fixed?

Changing your stance and being grateful for responsible disclosures and only using your EULA to threaten and sue the bad people can potentially save everyone with java installed from a few zero days at zero cost.

Re: “Stop reverse engineering our code”

#63

Post by binarymax » Tue, Aug 11, 2015, 10:50 AM UTC

kriro wrote: post #35

This is a marketing layup for any FLOSS ERP company (or the PostgreSQLs of the world). Basically "by all means check our code for any issue you may find. We'll gladly accept any suggestions for code improvements you may have." This post is an absolute nightmare/facepalm. Basically my takeaway is "I guess I don't want to buy Oracle software". It's really mind blowing that this is the position of a major software compa…

> (this clause has to be illegal in some countries, too)

Pedantic: not illegal, but invalid.

Re: “Stop reverse engineering our code”

#64

Post by jnbiche » Tue, Aug 11, 2015, 10:54 AM UTC

agounaris wrote: post #54

I don't understand why everybody is mad about this post, oracle has proprietary software that is bound with a license. In that sense I don't see why people do not moan about having to pay a rent because your tenancy contract that you signed says so... Long story short, its a right of a SOFTWARE mostly company to protect its software, open source is not always the solution and reverse engineering something, consumes w…

> open source is not always the solution and reverse engineering something, consumes way more energy for the problems it actually solves.

You think customers are reverse engineering Oracle products for fun? They're doing it because there's a problem somewhere, they've filed a bug report and not got a satisfactory result, and so they have to go pay an expensive consultant to try and track down the problem for them with no source code.

Even if none of the other arguments for open source were persuasive, this situation with Oracle alone would be enough to convince many people of the wisdom of choosing an open source vendor.

Re: “Stop reverse engineering our code”

#65

Post by smoyer » Tue, Aug 11, 2015, 10:55 AM UTC

azinman2 wrote: post #22

There are too many points to discuss... it's really quite insane especially on the backs of Java exploit after Java exploit. But what I really don't get is this bug bounty hateathon. If it's only 3% of bugs (currently WITHOUT incentives like a bug bounty), then that's really not that much money... and in return you get more cred, something you might use for recruitment, and the off chance that you might increase that…

The repeated Java exploits You're referring to are exposed when using Applets in a browser ... This was conventionally recognized as a bed idea in about 2006. You simply shouldn't allow Applets to run - no matter what. I think you'll find the rest of the Java platform more secure than most, especially since the OpenJDK foundation was formed. I'm not here to defend Oracle in any other way but they've done a reasonable job of advancing the Java platform since it was acquired.

Re: “Stop reverse engineering our code”

#66

Post by golemotron » Tue, Aug 11, 2015, 10:56 AM UTC

> A. The customer signed the Oracle license agreement, and the consultant hired by the customer is thus bound by the customer’s signed license agreement. Otherwise everyone would hire a consultant to say (legal terms follow) “Nanny, nanny boo boo, big bad consultant can do X even if the customer can’t!”

Really? What if no money changes hands?

Re: “Stop reverse engineering our code”

#67

Post by dferlemann » Tue, Aug 11, 2015, 11:00 AM UTC

This is exactly the problem with legality of RE and penetration testing. "You broke the law by wasting our time, violating your license agreement." I understand author's points. Not very good points, disappointingly.

No matter how interpersonal she puts it. It makes me not ever want my system to rely on a company that threatens and belittle customers for protecting themselves.

If I bought a fridge for my house, I found a listening device and a pinhole camera in the fridge. Just because the company has a clause I am not allowed to open up the fridge, it doesn't mean I shouldn't.

Well, the company might have found the devices. Indeed maybe nothing customers can do until the company fixes it. Keep telling customers they are not allow to look for flaws it just ridiculous. Yes, it's your product, but this is my home!

Re: “Stop reverse engineering our code”

#68

Post by jackweirdy » Tue, Aug 11, 2015, 11:01 AM UTC

jjoos wrote: post #62

> I am not dissing bug bounties, just noting that on a strictly economic basis, why would I throw a lot of money at 3% of the problem Aren't the issues not found by Oracle the problem? I'm amazed that stil 23% of the externally found security issues are reported by researchers, the incentive to responsibly disclose security issues to Oracle isn't really big. It sounds like a cumbersome process with potential legal co…

I agree with that point, and think it hits at something bigger. Having a bug bounty doesn't just say 'we give out money for bugs'. It also says 'we have a thought-out programme for handling serious user-reported problems, and we won't reprimand or dismiss you for sharing them'.

Re: “Stop reverse engineering our code”

#69

Post by db48x » Tue, Aug 11, 2015, 11:02 AM UTC

lawnchair_larry wrote: post #18

idlewords wrote: post #9

Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?

She has no idea what she is talking about. Nobody is running static analysis on source code and sending her results. She's mixed up a lot of concepts here and is just plain wrong.

You can statically analyze a binary as well. "Static analysis" is just a technique for deducing the properties of a system without running it.

Re: “Stop reverse engineering our code”

#70

Post by charltones » Tue, Aug 11, 2015, 11:06 AM UTC

There is just no upside to this kind of response. Surely for any tech company that has reached a certain size, the only workable approach is to recruit an appropriately sized security team and politely welcome and respond to each and every security report received, triage them as quickly as possible and fix the ones that are found to be real vulnerabilities. Even if you aren't happy with the motives or the methods they employ, they are potentially finding flaws in your products for you.