Hacker News Reader

Comment by metafunctor | Hacker News Reader

This [1] gives a little more background. The same security researcher found another vulnerability in VirtualBox earlier this year, and didn't have a great experience with Oracle:

“We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or mentioning of the vulnerability report.”

[1] https://blogs.securiteam.com/index.php/archives/3736

View on HN

Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

Relevant discussion in another Oracle related post[0].

[0]: https://news.ycombinator.com/item?id=18389481

I do like that post because it summarizes how I feel about Oracle rather succinctly. For your typical FAANG company, the money is the means to the end. But for Oracle, the money is the end to the means.

Oracle has a track record of being The Worst about anything.

This sounds interesting, would you mind going into detail about this? Maybe a quick list?

They seem to have a knack for selling their product to C-levels who don't fully understand the business they represent.

But that's about it.

CIOs at my last 3 companies have each had a "get rid of Oracle" as a top 5 strategic goal for the year.

Let's all meet back at this comment next year and see if IBM took the title from them.

There are plenty of other big companies behaving similarly. HP comes to my mind also, but I cannot find the statistics which quantified worst maintainance practices.

Other companies may be behaving similarly, but Oracle is the perceived worst, and it says something.

Because, they plainly don't hide it and try to be nice, at least.

I also think that they're the worst in the industry.

One of my uncles moved to another state and was telling me all about how Oracle pays a lot there and I should move there. I told him I absolutely never would. He just wouldn't understand it, and kept nudging so I told him my wife would not want me to move to another state, thankfully that settled that.

I said there was a study which did quantify worst maintainance practices: time to fix bugs, time to reply and several other support metrics and interestingly Oracle was not the worst, HP was.

My personal bias would also tell me Oracle is because of their business practices, but we were arguing about support practices.

Sorry, I missed the statistics part. I've never came across the one you mentioned either. I'd love to read that.

My perceived worst definition was not about only business practices BTW. I meant in every category.

Nonetheless, supporting the products you sold are also a business. :)

"You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."

https://www.youtube.com/watch?v=-zRN7XLCRhc

Entertaining talk.

The part that grandparent is quoting starts at about 38 minutes in.

It's even better when he slips and say: "Don't anthropomorphize Larry Ellison"

That wasn't a slip

Oracle are actively hostile to the security researcher community, with their CISO having told customers and researchers off for attempting to find issues in their products

https://arstechnica.com/information-technology/2015/08/oracl...

This kind of attitude goes all the way back to 2002 https://www.theregister.co.uk/2002/01/16/oracle_security_cla...

From GP's link:

> While the crashing bug was reported to the VirtualBox tracker (https://www.virtualbox.org/ticket/16444), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved.

They might not be The Worst, but at 15 months, they're not great.

The text of the bug doesn't have any suggestion of it being a vulnerability and as the closing comment indicates, not enough information to reproduce

“Unreproducible” can also be read as “Wasn’t worth the effort to reproduce”.

Very, very rarely will a Sev1 crash in production software be instantly reproducible. When it is, it’s an utter embarrassment. More often the full set of conditions which lead to the crash are unknown, rare, and hard to fully quantify all at once.

And yet, we know with certainty that the crash did happen and by definition it is a valid bug in any sane world where “don’t crash” is an absolute requirement.

Any crashing bug in a hypervisor must be assumed to be security critical until proven otherwise. Even after “proving” a crash can’t possibly be exploited, you should still assume that a clever attacker will figure out a way. The Venn diagram of “crashing bugs” and “security exploits” is vanishingly disjoint.

"don't crash" can't be an absolute requirement, because operating systems. I've had programs crash when running out of RAM, I think sometimes there's no way for the OS to recover without killing some programs.

If you absolutely can't crash, you need to build an OS that caters to that - modern OSes explicitly prioritize other goals, like performance

The usual definition of "crash" does not include "getting killed by the OS while behaving normally".

If you're in a scenario where a crash can mean a critical security vulnerability, then being killed by the OS can also be, because some parts might continue running with an unexpected state

By that time that researcher had already been paid by the company running the SecuriTeam program. Admittedly Oracle did release the patch too early, but this was clearly by accident, since they usually never release security patches outside a Critical Patch Update. Also I believe they did assign CVE-2018-3294 and give credit in the following October CPU.

Reply on news.ycombinator.com