Sure, carefully reviewing all the reports would be ideal, but it also means you'll need many employees to do that. And I don't really see why Oracle should be responsible for educating customers about basic security practices.

Sales people are unusable for educating customers, and they're busy with using Licensing Breach Notices to boost sales of cloud services anyway (http://thestack.com/oracle-breach-notice-cloud-services-1007...).

I do agree with you that the blog post seems written in a bit condescending way (it's difficult for me to judge, as I'm not a native speaker).

And I do agree that some of the arguments are misleading - the fact that many breaches are caused by lack of basic security practices does not make zero-days insignificant. And the "assurance programs" guarantee nothing if you fix the issues poorly (nice example from DEFCON 22: https://defcon.org/html/defcon-22/dc-22-speakers.html#Litchf...).

What I perfonally find the funniest about the whole "reverse engineering prohibited" clause is that the bad guys don't give a shit - they'll reverse engineer it anyway, because no one will find out. So the only "victim" is the customer who accepted the licensing agreement, and it does not matter if the purpose was to lower the number of reports or protect the source code.

But I'm still astonished people are surprised by the stupidity of Oracle licensing terms. Bullshit like that blog post is actually one of the main reasons why I stopped working with Oracle products and went full open-source.