Comment by jondubois | Hacker News Reader

Comment by jondubois | Hacker News Reader

Parent Full thread

Over the past 15 years as a software engineer I haven't used any Oracle product... Except maybe Java and MySQL; but that was mostly before they were bought by Oracle.

Oracle is a company whose survival is based almost entirely on its legacy software and deep ties to government. It's surprising that their stock price has been going up over the past 10 years.

The government would definitely function better if it started using open source software.

For a long time, big companies like Microsoft and Oracle would spread lies about open source; claiming that it is inherently inferior to commercial software - Yet if you look at the vast majority of tech unicorns these days, practically all of them use open source software at their core. The proof that open source is superior is not hard to find and yet it seems that companies like Oracle are still playing the same old game of trying to fudge the facts.

I'm worried that the next wave of propaganda will be around cloud services. Big companies like Amazon will get their hooks into government and start spreading lies about how cloud services are better than open source containerized/orchestrated solutions... Then after 20 years this will again be proven to have been a lie... And the cycle of deceptive lobbying will repeat.

Not to worry, the aging executives in big corps/government are already well entrenched in the belief that "all of AWS is insecure ... because remember company xyz got breached on AWS..." referring of course to someone putting user data in public, unsecured S3 buckets. Will be a while yet before they start eating the lunch that cloud providers are peddling.

Actually, AWS offers a government-targeted region specifically to address data escape concerns [0]. Not classified-secure, but fine for ITAR stuff. Definitely not something I expected to exist.

[0] http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/what...

Their offerings are certainly impressive when you (or your leadership) are willing to look. Most of their flagship offerings are also HIPAA certified (or can be upgraded to such).

HIPAA certification isn't legally meaningful (once the government actually publishes it's certification requirement and standards, certification to those standards will be legally meaningful, and one hopes also substantive; right now it's just throw some money at some firm whose entire business model is issuing legally-meaningless certifications that the buyer can use in promotion.)

The legally-meaningful thing is that they are willing to sign a HIPAA BAA and accept responsibility, not certification.

I think what matters is not that AWS isn't any more insecure than "bare metal," but that older old guys in position of power also hold those beliefs. So if you get hauled to congress and you have to explain to a bunch of gray-haired senators why your data was on a "public cloud" all the senators are really going to hear is the "public" part and people are going to think your company was incompetent for putting private data on a public cloud.

to me, the rising stock price is also difficult to fathom. I suppose it is easy to underestimate just how many legacy systems there are. 40 year old, nation-state scale projects that are used by bureaucrats and built by badly aligned contractors who get their specs/requirements from non-technical committees. Switching costs are prohibitive and the more complex is a system is, the more hours can be billed.

A friend of mine works in IT in one of the largest banks in the world and he half-jokingly says that they only have two requirements for buying software: 1. it must be expensive 2. it shouldn't really work

The success of Oracle and others is built on "90% of software engineering is maintenance"

With a paradigm shift from on-premise, Desktop to mobile-cloud the old oligopoly is finally under attack.

Well, they are better in some ways and worse in others. Public cloud providers let you offload a lot of lower level operational work off to them and provide you with higher level, and perhaps most importantly integrated, abstractions around things like security. They also provide a straightforward maintenance cost baked into their price that goes down or stays flat with volume.

But you're also heavily dependent on the roadmap of that provider, and they do get their margin. If it turns out you can staff, develop, operate, and maintain everything you need in-house sustainably then go do that.

I would also argue against open source being objectively superior unless your metric is "how accessible is the source code of the software". There are plenty of cases where closed or open source is the superior solution for a given need.

As for my opinion, I think the government needs to work with commodity providers like aws, azure, gcp, etc to get commodity infrastructure services that are certified and usable by any government agency and invest in strong ownership of the development of government-specific software.

Reply on news.ycombinator.com