Oracle attempt to hide cybersecurity incident from customers?(doublepulsar.com)
doublepulsar.com
Oracle attempt to hide cybersecurity incident from customers?
https://doublepulsar.com/oracle-attempt-to-hide-serious-cybersecurity-incident-from-customers-in-oracle-saas-service-9231c8daff4a
135 comments
If you are already a customer of Oracle, I can't imagine this matters to you. You did not choose Oracle because it was a good product and they are a good company. You are a customer of Oracle because there was a backroom executive deal with the Devil. No one is surprised or outraged or even has any choices.
I've started seeing ads for Oracle OCI in some podcasts I listen to so I think they are starting to see if they can attract customers outside of their "enterprise sales process".
I'm not sure who those ads are supposed to appeal to besides the podcasts hosts raking in the ad dollars.
I'm not sure who those ads are supposed to appeal to besides the podcasts hosts raking in the ad dollars.
>”enterprise sales process”
I’m sorry, is Oracle known to be some super sleazy sales org that plys enterprise decision makers with strippers and cocktails, and drugs?
I’m sorry, is Oracle known to be some super sleazy sales org that plys enterprise decision makers with strippers and cocktails, and drugs?
I have absolutely no idea if you are being facetious or naive there.
Yes. Oracle is absolutely the tech vendor that's going to be dropped on the engineering team with zero input and no consideration for whether it fits the problems they have, after your CTO spends a a few days on the golf course and high end steak restaurants and, depending on how much money their enterprise sales team thinks they have, either high class escorts or sleazy strip joints. Given how common that story (or one very like it) is, I'm close to 100% certain those trips also include discreet photographers and hotel rooms wired with 4k video recording.
Yes. Oracle is absolutely the tech vendor that's going to be dropped on the engineering team with zero input and no consideration for whether it fits the problems they have, after your CTO spends a a few days on the golf course and high end steak restaurants and, depending on how much money their enterprise sales team thinks they have, either high class escorts or sleazy strip joints. Given how common that story (or one very like it) is, I'm close to 100% certain those trips also include discreet photographers and hotel rooms wired with 4k video recording.
> I have absolutely no idea if you are being facetious or naive there.
Neither, but perhaps worse: I am young.
Are there any compilations of apocryphal stories of the events you described? It sounds too fantastic to be real.
Neither, but perhaps worse: I am young.
Are there any compilations of apocryphal stories of the events you described? It sounds too fantastic to be real.
You sound like Fortune 500 CTO material young man.
OK, but this one is a pretty funny rebuttal:
> In 2000, Oracle attracted attention from the computer industry and the press after hiring private investigators to dig through the trash of organizations [...] When asked how he would feel if others were looking into Oracle's business activities, Ellison said: "We will ship our garbage to Redmond, and they can go through it. We believe in full disclosure."
> In 2000, Oracle attracted attention from the computer industry and the press after hiring private investigators to dig through the trash of organizations [...] When asked how he would feel if others were looking into Oracle's business activities, Ellison said: "We will ship our garbage to Redmond, and they can go through it. We believe in full disclosure."
It would be like people compiling stories of eating a sandwich. No one is doing it because of how unremarkable and common it is.
Many have written about Gavrilo Princip’s trip to the cafe - if the sandwich has sufficient intrigue and scandal around it, people will write (and read) about it.
Yes that sort of stuff happens all the time in the business side of things. There’s a reason it’s a trope.
Not to every company per se but it’s been commonplace well probably for as long as business itself has been.
Just an example - nothing that happened in wolf of wall street was original to them - just the getting famous for being caught part. And that was only a few decades ago.
The defense and finance industries are famous for that sort of thing. I’m sure it’s pervasive elsewhere too.
There’s nothing special about software or tech or clouds that makes schmoozing impossible.
Not to every company per se but it’s been commonplace well probably for as long as business itself has been.
Just an example - nothing that happened in wolf of wall street was original to them - just the getting famous for being caught part. And that was only a few decades ago.
The defense and finance industries are famous for that sort of thing. I’m sure it’s pervasive elsewhere too.
There’s nothing special about software or tech or clouds that makes schmoozing impossible.
This is legitimately the first time I have ever seen it brought up too! I’ve never heard about this side of them.
Universally hated, but the legal aspects alone are hateworthy.
Universally hated, but the legal aspects alone are hateworthy.
> [...] I'm close to 100% certain those trips also include discreet photographers and hotel rooms wired with 4k video recording.
Luckily, AI is about to make that particular tactic ineffective:
When you can deepfake any video evidence, the original becomes useless.
Luckily, AI is about to make that particular tactic ineffective:
When you can deepfake any video evidence, the original becomes useless.
I haven’t seen the ads, but Oracle Cloud is definitely the public cloud provider with the most generous free tier. That’s not to say you should use and trust them, but I can see why many would.
You pay in other ways.
I understand if you have absolutely no money, but even then repeatedly trying to provision a server and getting a error- something like no capacity available - isn't a fun time.
Whatever, I'll pay 7$ a month to not deal with that.
I understand if you have absolutely no money, but even then repeatedly trying to provision a server and getting a error- something like no capacity available - isn't a fun time.
Whatever, I'll pay 7$ a month to not deal with that.
You can automate it using their API and some Python. It's like a puzzle game and I'm personally thankful for the free tier, it's pretty cool if you max it out you have multiple IPv4 addresses, IPv6 prefixes and so on - the machines boot via UEFI, you can run nixos and ZFS on them, you have a serial console via ssh/vnc and at least in Germany they have good connectivity and 10tb Traffic is plenty. Using it for something serious? Probably not. But for tinkering it's pretty cool and interesting if you enjoying some small quests. Running incus and some Kubernetes stuff on an arm box and 24gb memory and 200gb SSD is at least 10-20€ elsewhere.
I had a script calling their apis to setup one of their free arm instances after I deleted the one I had to change the OS (something I had done before).
After running every hour for several months I gave up (always out of capacity and it was impossible to change the region on free tier back then). They either had a bug that still showed my account as using the deleted resources or no capacity, both which seem out of place in a “cloud” infrastructure.
After running every hour for several months I gave up (always out of capacity and it was impossible to change the region on free tier back then). They either had a bug that still showed my account as using the deleted resources or no capacity, both which seem out of place in a “cloud” infrastructure.
My personal multicloud strategy for many years was to make full use of the free tier on as many providers as necessary.
Making a cloud provider that just wraps other providers' free tiers would be a fun challenge.
If the tables were turned, Oracle would be taking advantage of the situation.
Take note.
Take note.
As my buddy from Oracle likes to say, "No one cares what we do as long as the flow of streak, coke, and strippers doesn't stop."
He's a big Zed Shaw fan.
He's a big Zed Shaw fan.
what's "streak"? do you mean steak?
I thought it was some kind of trendy alcohol that I hadn't heard of, that probably comes in a brown bottle
[deleted]
Anytime Oracle is brought up is a great time to repost the famous Lawnmower quote:
> "As you know people, as you learn about things, you realize that these generalizations we have are, virtually to a generalization, false. Well, except for this one, as it turns out. What you think of Oracle, is even truer than you think it is. There has been no entity in human history with less complexity or nuance to it than Oracle. And I gotta say, as someone who has seen that complexity for my entire life, it's very hard to get used to that idea. It's like, 'surely this is more complicated!' but it's like: Wow, this is really simple! This company is very straightforward, in its defense. This company is about one man, his alter-ego, and what he wants to inflict upon humanity -- that's it! ...Ship mediocrity, inflict misery, lie our asses off, screw our customers, and make a whole shitload of money. Yeah... you talk to Oracle, it's like, 'no, we don't fucking make dreams happen -- we make money!' ...You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle." - Bryan Cantril
> "As you know people, as you learn about things, you realize that these generalizations we have are, virtually to a generalization, false. Well, except for this one, as it turns out. What you think of Oracle, is even truer than you think it is. There has been no entity in human history with less complexity or nuance to it than Oracle. And I gotta say, as someone who has seen that complexity for my entire life, it's very hard to get used to that idea. It's like, 'surely this is more complicated!' but it's like: Wow, this is really simple! This company is very straightforward, in its defense. This company is about one man, his alter-ego, and what he wants to inflict upon humanity -- that's it! ...Ship mediocrity, inflict misery, lie our asses off, screw our customers, and make a whole shitload of money. Yeah... you talk to Oracle, it's like, 'no, we don't fucking make dreams happen -- we make money!' ...You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle." - Bryan Cantril
To be fair to Oracle: the lawnmower doesn't hate people... yet. This millennium is still young. And we keep adding connectivity and llms into everything.
You elided the most famous quote from that diatribe. The lawnmower comparison is the expansion on:
"Do not fall into the trap of anthropomorphizing Larry Ellison"
"Do not fall into the trap of anthropomorphizing Larry Ellison"
Indeed it's hard to explain how he can be 80 years old and look like this:
https://en.wikipedia.org/wiki/File:Larry_Ellison_-_American_...
https://en.wikipedia.org/wiki/File:Larry_Ellison_-_American_...
.png){kind=link}
Botox, DHEA, collagen, plastic surgery...
He is starting to look more and more like Donald Trump.
"Everyone Else Must Fail" is a good read.
I’m sorry but I don’t get this Zed Shaw reference, what did I miss?
He's a popular blogger: https://zedshaw.com/
Weapons grade infinte snark, probably.
He seems to have stopped blogging a few years back. I kinda miss his epic rants and Learning $whatever The Hard Way stuff. Part of me hopes them and whoever used to run n-gate moved to Portland and are now running a bespoke hand made piano business together or something.
He seems to have stopped blogging a few years back. I kinda miss his epic rants and Learning $whatever The Hard Way stuff. Part of me hopes them and whoever used to run n-gate moved to Portland and are now running a bespoke hand made piano business together or something.
I suspect that Zed and the n-gate author would not get along, given how ~~insufferable~~ opinionated the former is.
"Oracle, where the Sun don't shine no more."
[deleted]
I imagine Larry Ellison gave this exact speech right after this incident became public.
I was talking to a customer in a construction company that had its entire internal project management platform sold to Oracle. < This was why they couldnt manage their end of a large project.
Oracle futzed it, and after a complete roll of the construction firms board of directors, they were in negotiations to buy their own program back for twice the price.
Oracle futzed it, and after a complete roll of the construction firms board of directors, they were in negotiations to buy their own program back for twice the price.
I use Oracle Cloud for my personal projects because of their generous free tier[1] which includes 4x Ampere A1 cores, 24 GB of RAM, and 10 TB of outbound data transfer per month.
I was ready to jump ship if they changed the terms, but I was not expecting a security incident.
[1]: https://www.oracle.com/cloud/free/
I was ready to jump ship if they changed the terms, but I was not expecting a security incident.
[1]: https://www.oracle.com/cloud/free/
This is honestly wild.
Whether we like it or not security incidents have become such common place in the last several years that if they just admitted to it this entire story would have likely been shrugged off and mostly forgotten about in a couple days but instead it is turning into an entire thing that just seems to be getting deeper and deeper. (Not downplaying the security incident, but that is the unfortunate reality).
Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here?
Are they somehow really confident that this didn't happen, maybe they don't have the logs to confirm it? Trying to think about how this is anything except them just straight up lying.
I can't remember the last time we saw a company this strongly try to deny that something like this happened. Especially when according to Ars Technica:
> On Friday, when I asked Oracle for comment, a spokesperson asked if they could provide a statement that couldn’t be attributed to Oracle in any way. After I declined, the spokesperson said Oracle would have no comment.
Whether we like it or not security incidents have become such common place in the last several years that if they just admitted to it this entire story would have likely been shrugged off and mostly forgotten about in a couple days but instead it is turning into an entire thing that just seems to be getting deeper and deeper. (Not downplaying the security incident, but that is the unfortunate reality).
Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here?
Are they somehow really confident that this didn't happen, maybe they don't have the logs to confirm it? Trying to think about how this is anything except them just straight up lying.
I can't remember the last time we saw a company this strongly try to deny that something like this happened. Especially when according to Ars Technica:
> On Friday, when I asked Oracle for comment, a spokesperson asked if they could provide a statement that couldn’t be attributed to Oracle in any way. After I declined, the spokesperson said Oracle would have no comment.
> Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here?
I think you're coming at this from the wrong point of view. Oracle couldn't care in the slightest about what regular people think of them. Remember, they are the company that sent lawyers after the employers of folks who downloaded non-free but bundled by default extensions to VirtualBox, and the company that declared that you need to license every core their software could _potentially_ run on in your virtualisation estate (so if you have a 8 vCPU VM for some Oracle software, you need licenses for however many physical cores you have on your cluster). They've variously been described as a law firm with an engineering side business, and One Rich Asshole Called Larry Ellisson. Speaking of whom, he multiple times flat out lied on stage to make his shitty "cloud" nobody cares about seem relevant compared to AWS.
Nobody buys Oracle because they like them or their good reputation. You buy them because you have legacy stuff that depends on them and you have no choice (even Amazon took many years to get off Oracle databases, and they wrote a gloating success story one they were done with it because they were that happy to be rid of the leeches), or because your bosses' boss was convinced at a golf course they're getting a good deal. Or because their bandwidth is very cheap and you accept the risk of dealing with the devil incarnate with zero morals. (cf. Zoom).
Oracle is like Broadcom. Everyone hates their guts, everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere.
I think you're coming at this from the wrong point of view. Oracle couldn't care in the slightest about what regular people think of them. Remember, they are the company that sent lawyers after the employers of folks who downloaded non-free but bundled by default extensions to VirtualBox, and the company that declared that you need to license every core their software could _potentially_ run on in your virtualisation estate (so if you have a 8 vCPU VM for some Oracle software, you need licenses for however many physical cores you have on your cluster). They've variously been described as a law firm with an engineering side business, and One Rich Asshole Called Larry Ellisson. Speaking of whom, he multiple times flat out lied on stage to make his shitty "cloud" nobody cares about seem relevant compared to AWS.
Nobody buys Oracle because they like them or their good reputation. You buy them because you have legacy stuff that depends on them and you have no choice (even Amazon took many years to get off Oracle databases, and they wrote a gloating success story one they were done with it because they were that happy to be rid of the leeches), or because your bosses' boss was convinced at a golf course they're getting a good deal. Or because their bandwidth is very cheap and you accept the risk of dealing with the devil incarnate with zero morals. (cf. Zoom).
Oracle is like Broadcom. Everyone hates their guts, everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere.
> everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere.
This is just your opinion. Most people I know who work there feel just fine if not very happy. Pay/benefits are good. Work is about same everywhere. In fact depending on group there maybe good, challenging technical work there.
As far as CV is concerned working there is mostly positive or at best neutral in term of job change.
> Nobody buys Oracle because they like them or their good reputation.
Oracle is quite expensive but they have reputation of solid database for enterprise workloads.
Also their cloud business is doing fine and growing and not irrelevant. One can see that from their quarterly results.
This is just your opinion. Most people I know who work there feel just fine if not very happy. Pay/benefits are good. Work is about same everywhere. In fact depending on group there maybe good, challenging technical work there.
As far as CV is concerned working there is mostly positive or at best neutral in term of job change.
> Nobody buys Oracle because they like them or their good reputation.
Oracle is quite expensive but they have reputation of solid database for enterprise workloads.
Also their cloud business is doing fine and growing and not irrelevant. One can see that from their quarterly results.
> Work is about same everywhere
Well, no. When a customer at my job makes a mistake, we don't send lawyers chasing after them because we're assholes. And when someone proposes something that will hurt those customers, people speak up and voice their disagreement.
Well, no. When a customer at my job makes a mistake, we don't send lawyers chasing after them because we're assholes. And when someone proposes something that will hurt those customers, people speak up and voice their disagreement.
In large companies people don't keep up with what all other departments are up to. And further even if they know they can also see nuance that lawyers are involved because current situation can harm their employer.
> When a customer at my job makes a mistake, we don't send lawyers chasing ...
Maybe you own the company or are in its executive ranks and can take decision on such scenarios. But in large companies most rank and file employees do not particularly feel good or bad about their employers.
> When a customer at my job makes a mistake, we don't send lawyers chasing ...
Maybe you own the company or are in its executive ranks and can take decision on such scenarios. But in large companies most rank and file employees do not particularly feel good or bad about their employers.
I wonder if the senior engineering talent OCI poached from AWS (including the guy who introduced formal methods to AWS) is still there?
For sure they'd have. I have heard they hired tons of people in Seattle area, presumably from Amazon. Also Amazon hired lots of people from Oracle. Starting from many deeply technical Java/JVM experts to tons of B-grade solution architects types.
To me this assumption that rank and file employees would find their employer evil but keep working there nonetheless is unrealistic.
To me this assumption that rank and file employees would find their employer evil but keep working there nonetheless is unrealistic.
My wife is a hospital pharmacist. Cerner is a poular EMR system, is ~#2 in the market (behind Epic). These systems are ridiculously difficult to change between (everyone from your front-check-in desk to every surgeon who has privileges needs to be trained on how the new system works in addition to the technical problems with ETL'ing all your data over, and each hospital has an enormous amount of customization done to their workflows that has to be ported over to the new system)- she's done that twice at two different places and it was a huge, process, 18 months minimum. So these EMR's have an enormous amount of lock-in.
The punchline is, in 2022 Oracle purchased Cerner, renamed it Oracle Health, and started accelerating the process of enshittifying it. I have to tip my hat to them, it's like their BizDev team found a market segment that had as much lock-in as SQL databases do, and are now trying to replicate all the evil tricks they learned from that in another market segment. Because what are hospitals but giant bags of money to be drained so Larry Ellison can buy another yacht?
The punchline is, in 2022 Oracle purchased Cerner, renamed it Oracle Health, and started accelerating the process of enshittifying it. I have to tip my hat to them, it's like their BizDev team found a market segment that had as much lock-in as SQL databases do, and are now trying to replicate all the evil tricks they learned from that in another market segment. Because what are hospitals but giant bags of money to be drained so Larry Ellison can buy another yacht?
True, but with one exception that I saw (Memorial Sloan Kettering), every EMR that isn’t Epic is a steaming pile. And I think MSK is switching.
Epic is my wife's favorite, for sure. Both of the switch-overs she was involved in were to Epic. They also cost more than the others.
One thing I have learned in my two decades of SWE'ing is how vitally important active competition is. One of the major competitors voluntarily taking themselves out of the competition so it can be sucked dry of value always seems to be good news for the market share, dominance, and profitability of the #1 in the market, and bad news for everyone's customers.
One thing I have learned in my two decades of SWE'ing is how vitally important active competition is. One of the major competitors voluntarily taking themselves out of the competition so it can be sucked dry of value always seems to be good news for the market share, dominance, and profitability of the #1 in the market, and bad news for everyone's customers.
As a health consumer, Epic is so dang slow that I wonder what it's like for medical professionals.
> everyone who worked there has a black mark on their CV
I hope this is hyperbole. Rank and file employees are not responsible for corporate policy or direction, especially in places like Oracle.
I hope this is hyperbole. Rank and file employees are not responsible for corporate policy or direction, especially in places like Oracle.
It really isn't. Oracle has had a terrible reputation since forever, and every ex-Sun engineer I've met has taken great pains to explain they did not join Oracle voluntarily.
It's kind of like working for a tobacco company or arms manufacturer in payroll or something: you're not directly responsible for killing millions of people, but by choosing to work there you're still kind of condoning it.
It's kind of like working for a tobacco company or arms manufacturer in payroll or something: you're not directly responsible for killing millions of people, but by choosing to work there you're still kind of condoning it.
I'm curious, does it end only at Oracle?
What about Google, Facebook & Microsoft. They do some things that are disliked by many. Should we consider that the engineers who work there are indirectly condoning the no-privacy, ad-infested dystopia that HN hates, and should they be penalized. I bet many of these companies and a lot of others use Oracle products and there by support them directly with money. If you know that your favorite website/product is built on top of Oracle database/products, will you stop using it?
If Oracle (or any other unpopular company) employees are really shunned, then that's only because rejecting them is a no-risk, no-cost, easy thing to do.
What about Google, Facebook & Microsoft. They do some things that are disliked by many. Should we consider that the engineers who work there are indirectly condoning the no-privacy, ad-infested dystopia that HN hates, and should they be penalized. I bet many of these companies and a lot of others use Oracle products and there by support them directly with money. If you know that your favorite website/product is built on top of Oracle database/products, will you stop using it?
If Oracle (or any other unpopular company) employees are really shunned, then that's only because rejecting them is a no-risk, no-cost, easy thing to do.
> Should we consider that the engineers who work there are indirectly condoning the no-privacy, ad-infested dystopia that HN hates, and should they be penalized.
> [..] then that's only because rejecting them is a no-risk, no-cost, easy thing to do.
Exactly as you say. It's less about enforcing ethical behaviour than getting safe revenge on what is perceived as an easy target. For example considering the rise of LLMs, people affiliated with google search are probably about to feel the full force of 10+ years of increasing frustration with declining quality, rather than being legendary high value hires. Unhirables that are completely ostracized? Of course not. But a black mark? Yes, probably.
Exactly as you say. It's less about enforcing ethical behaviour than getting safe revenge on what is perceived as an easy target. For example considering the rise of LLMs, people affiliated with google search are probably about to feel the full force of 10+ years of increasing frustration with declining quality, rather than being legendary high value hires. Unhirables that are completely ostracized? Of course not. But a black mark? Yes, probably.
Some people absolutely do judge people who work at those companies, especially Facebook. Google used to have a halo but that's pretty tarnished now, while Microsoft under Satya seems to have pulled off the unlikely trick of redeeming its reputation.
> arms manufacturer in payroll or something: you're not directly responsible for killing millions of people, but by choosing to work there you're still kind of condoning it.
It morbidly amuses me that this kind of argument can still be made given what's going on in Ukraine. Governments have militaries for a reason, and there's a reason Europe is now scrambling to re-arm itself.
It morbidly amuses me that this kind of argument can still be made given what's going on in Ukraine. Governments have militaries for a reason, and there's a reason Europe is now scrambling to re-arm itself.
Governments have militaries for many reasons. If you work at a US arms manufacturer, some of your output may indeed being going to defend Ukraine, but some of it is also going to the Israeli military in Gaza, the Saudi Arabian military in Yemen, and a long, long list of countries listed here:
https://en.wikipedia.org/wiki/United_States_military_aid
https://en.wikipedia.org/wiki/United_States_military_aid
See how the goalposts now move from "arms manufacturer in general" to "I don't agree with US foreign policy."
And even assuming that's true for the sake of argument, what? Lockheed Martin, Raytheon, et al. are just supposed to shut down for good the moment one politician makes a morally questionable decision? Life is not that black and white.
And even assuming that's true for the sake of argument, what? Lockheed Martin, Raytheon, et al. are just supposed to shut down for good the moment one politician makes a morally questionable decision? Life is not that black and white.
You're inventing your own goal posts here, since I didn't say anything of the sort.
To repeat: if you work for an arms manufacturer, you condone killing people. Hopefully it's because you think the weapons are killing enough Nazis/terrorists/bad guys to outweigh the occasional innocent civilian, but their blood is still on your hands.
To repeat: if you work for an arms manufacturer, you condone killing people. Hopefully it's because you think the weapons are killing enough Nazis/terrorists/bad guys to outweigh the occasional innocent civilian, but their blood is still on your hands.
You're also contributing to weapons that can be used to fight violent dictators like Putin when he invades yet another country (or the same one again).
I'll never understand the West's public aversion to military R&D and manufacturing. How do you people think WW2 was won? Nice words, trade deals and hookers? At some point diplomacy fails and you need to be able to do something about it.
I'll never understand the West's public aversion to military R&D and manufacturing. How do you people think WW2 was won? Nice words, trade deals and hookers? At some point diplomacy fails and you need to be able to do something about it.
Coincidentally, I posted an Ask HN on that same question (actually prompted by a post on a different company today), but it hasn't gotten upvoted yet:
Ask HN: Do you penalize hiring candidates from companies that do shady things? | 1 point by neilv 1 hour ago| 3 comments | https://news.ycombinator.com/item?id=43538530
Ask HN: Do you penalize hiring candidates from companies that do shady things? | 1 point by neilv 1 hour ago| 3 comments | https://news.ycombinator.com/item?id=43538530
They're not responsible for the policy, but typically when you're thinking of a job at Oracle, you likely can have other options. At least if we're taking about software engineers and similar people. I was being recommended for a position by friends who moved there and I refused, because it's a shit company. The money is not worth it. It's the whole "contractors on Death Star" thing from Clerks.
I'm guessing nobody chooses to work with Oracle anymore for reasons or in situations that we would consider reasonable. It's probably either governments contracts, with or without corruption, companies already locked in, contracts made by executives that don't really understand technology, that sort of thing.
Actually, it is mostly companies who are too reluctant to change. If it works, keep it as is, even if better technologies are the norm nowadays. Maybe this will help them move away from this obsolete Larry Ellison crapshot
If it works, keep it as is
That's a good principle though. It doesn't make the initial choice good today or even back then. But change is always a risk that may not be worth it, cause you have to make sure that the inevitable semi-chaos coming with it is at all times lower than what you have. And analyzing that may be hard.
Maybe this will help them move away from this obsolete Larry Ellison crapshot
This creates positive incentives, so yes.
Iow, everything probably goes as it should, really.
That's a good principle though. It doesn't make the initial choice good today or even back then. But change is always a risk that may not be worth it, cause you have to make sure that the inevitable semi-chaos coming with it is at all times lower than what you have. And analyzing that may be hard.
Maybe this will help them move away from this obsolete Larry Ellison crapshot
This creates positive incentives, so yes.
Iow, everything probably goes as it should, really.
I somewhat agree. I think for tangible things (cars), you don't need to reinvent the wheel. But, tech moves fast. If a superior tech (for instance, more secure) is available but requires some discomfort (moving things around), then it is worth it to avoid this type of crap
Seemingly, most companies have a terrible ability to judge if a technology is superior, hell most of the time they lack the ability to judge if a technology is massively inferior. Companies may understand what they do but they commonly have no understanding of what they do in relation to the abstraction layers between them and said technology.
Often this technology has been in place for some time and the original creators are long gone for one reason or another. To migrate away from this system the business will need to spend a significant amount on contractors/consultants to understand both the system they have well enough, and the system they are moving to. It can be a huge expense and companies are very willing to push that off into the future.
Often this technology has been in place for some time and the original creators are long gone for one reason or another. To migrate away from this system the business will need to spend a significant amount on contractors/consultants to understand both the system they have well enough, and the system they are moving to. It can be a huge expense and companies are very willing to push that off into the future.
I worked as a contractor for the Wisconsin state government and they had hundreds of Oracle databases that they were consolidating on the Oracle EXADATA11 servers. Insane having hardware that can only run Oracle but the Oracle DBA said that the Exadata was dozens of times faster than Oracle on VMware VMs.
Lies. Fucking lies. We were a three environment shop until we moved to Exa and the compute/$ ratio is so bad that we had to cut it down to two.
But we're talking about Oracle here so that's par for the course.
But we're talking about Oracle here so that's par for the course.
I didn't make any claims about performance per $, just relative performance compared to VMs. I hate Oracle as much as anyone but the EXADATA is impressive hardware. It has lots of RAM and Infiniband networking. It can push query predicates to the storage controllers to reduce the data that had to be transferred.
It is impressive. But for the same cost you can get vastly better performance with Postgres and bigger hardware.
It does come with internal redundancy, but do you need that? Also the cluster nature of it can come with some surprises as compared to a single database.
It does come with internal redundancy, but do you need that? Also the cluster nature of it can come with some surprises as compared to a single database.
Yes. DB2 on IBM z/OS is also very expensive.
Security incidents have become so common place that the fact that they happen is not the newsworthy event; rather, its how a company responds to them that is the newsworthy event. And Oracle flunked this test
Note that it was an almost 4 year old already disclosed CVE which was used. Oracle messed up, big time. That's why they're trying to get rid of all incriminating evidence for potential lawsuits.
https://nvd.nist.gov/vuln/detail/cve-2021-35587
https://nvd.nist.gov/vuln/detail/cve-2021-35587
My guess is that admitting a security incident triggers lots of contractual clauses.
They have probably decided it's cheaper to simply deny the event (therefore not triggering those clauses).
If it gets to court, Oracle will find some expert who says there was no incident, and the other side will present clear evidence there was an incident, but the non-technical judge will probably still not be sure.
They have probably decided it's cheaper to simply deny the event (therefore not triggering those clauses).
If it gets to court, Oracle will find some expert who says there was no incident, and the other side will present clear evidence there was an incident, but the non-technical judge will probably still not be sure.
That's why in Europe there are strict laws regarding lax security of customer data and companies can be fined with a percentage of their turnover - which in the case of Oracle could hurt a bit.
There are various state laws that require companies to notify their customers of security breaches, but they lack enforcement/teeth so they're routinely ignored. It'll never happen in our current environment but we really need a federal law that causes violators enough pain that companies will actually bother to follow the law.
While that's true, many enterprise customers are going to have MSAs with notification requirements that have contractual punishments for failure to notify of material security incidents. Those are probably what Oracle is trying to avoid.
I believe enterprise customers are not going to care much unless it helps with lowering existing costs.
OTOH, Oracle as part of BSA can demand an audit so they will inflict / make up reason to also punish (i.e. licensing or pull support). The business could invoke an MSA punishment clause and win temporarily but it will cause a headache going forward (further demands from Oracle, higher costs etc.)
Either way, Oracle gets what they want.
OTOH, Oracle as part of BSA can demand an audit so they will inflict / make up reason to also punish (i.e. licensing or pull support). The business could invoke an MSA punishment clause and win temporarily but it will cause a headache going forward (further demands from Oracle, higher costs etc.)
Either way, Oracle gets what they want.
Unless the customer already wants to ditch Oracle.
Very few companies want to business with Oracle (or IBM). Most are either stuck with either and costs of switching are too high for executive to greenlight.
I don't get your argument.
Wouldn't adding teeth to the state laws be the right thing to do?
Wouldn't adding teeth to the state laws be the right thing to do?
It would help, but it'd be better for everyone if there was just one law to worry about which covered everyone (or at least set a minimum standard) rather than having 50 different versions of the same law all over the country each with their own definitions, thresholds, penalties, etc. It'd make things a lot less complicated for both companies and consumers, especially given how often a single company's data being exposed impacts people all over the nation.
You don't like federalism much, do you?
Btw, states already coordinate voluntarily on things like traffic signs, without there being a central authority. (That's both true for states in the US, and for different countries around the world. A stop sign looks pretty much nearly the same around the world, without any central authority enforcing that.)
Btw, states already coordinate voluntarily on things like traffic signs, without there being a central authority. (That's both true for states in the US, and for different countries around the world. A stop sign looks pretty much nearly the same around the world, without any central authority enforcing that.)
We're primarily an AWS shop but some Oracle BDR assigned to cover us recently reached out on LinkedIn.
I asked for an incident report and received this terse response:
> There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.
I asked for an incident report and received this terse response:
> There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.
Per article, Oracle has hastily rebranded the breached service as "Oracle Classic", for the sole purpose of being able to claim with a straight face that "Oracle Cloud" was not impacted.
FWIW, that doesn't appear to be a "hasty rebrand" - Oracle has had this distinction for a long time.
https://docs.oracle.com/en/cloud/saas/enterprise-performance...
https://docs.oracle.com/en/cloud/saas/enterprise-performance...
The hacker has demonstrated that they have/had write access to URLs under login.us2.oraclecloud.com. It's incredibly disingenuous on Oracle's part to claim that this is not "Oracle Cloud".
> NetSuite will indemnify Customer up to an amount equal to five (5) times the equivalent of 12 months of license fees applicable at the time of the event, from and against any Losses incurred by Customer
https://www.sec.gov/Archives/edgar/data/1428669/000119312508...
https://www.sec.gov/Archives/edgar/data/1428669/000119312508...
Ah, another notch in the belt for Larry Elison's Oracle data security scandals.
Matches Larry's other political and societal scandals.
Matches Larry's other political and societal scandals.
Tangential, but there’s an old interview with Ellison where he said that Amazon would never be able to get off of Oracle DB because it’s too critical a piece of software. This was in response to Amazon announcing it was something they had planned.
Amazon got it done ahead of schedule and there’s a video of them popping champagne to celebrate when they shut the last server down.
I’m not a big Amazon fan, but the enemy of my enemy is my friend.
Amazon got it done ahead of schedule and there’s a video of them popping champagne to celebrate when they shut the last server down.
I’m not a big Amazon fan, but the enemy of my enemy is my friend.
Larry Ellison hasn't been CEO for over a decade.
This is a deliberate attempt to cover up their incompetence. It should be criminal to deceive the public and your _paying_ customers.
Executives need to go to jail. People need to be fired.
This won’t happen though, definitely not under this current administration.
Executives need to go to jail. People need to be fired.
This won’t happen though, definitely not under this current administration.
Post-truth era is wild. But this seems like standard Oracle behavior for a while now.
Pretty on par for what I expect from Oracle. I'm surprised there's no corporate contracts involved yet.
The hacker is following a number of corporations. Is it an empty threat or a hint?
https://imgur.com/a/IsksRrZ
https://imgur.com/a/IsksRrZ
Neither. I would not read anything into a random hacker's twitter follow list.
Create a 'Wicki-hacks.com', like Wikipedia, where incidents are listed in detail - anonymously and indexed akin to Wikipedia with editors that create and verify an incident is such a way that Horacle etc can not deny or get it taken down
Oracle is notoriously stingy. They'd rather lose the data, pay a fine and deny it happened (settle), than own up for it.
[deleted]
The troubling aspect is (besides the denials of course) is the absence of controls that should have sniffed this out ASAP. Apparently:
- no passive network monitors showing an unknown IP/Mac/Location
- no SOAR to kill off the attempts to gain a foothold/move laterally
- no alerts on above or anything else in the SOC
Its times like this Oracle needs to lean on its good reputation and ask for forgiveness from the customers they've been loyal to for so long.
The scary thing is that Oracle is able to take down items from Archive.org.
how is that not securities fraud?
they are under legal obligation to tell investors about this sort of shit.
they are under legal obligation to tell investors about this sort of shit.
If no one enforces the law, it's not illegal.
Not to mention all of the data breach notification laws.
Welcome to the (most recent) era of deregulation. Get ready for all Fortune 500s to deny, deny, deny, and bribe.
Crypto is a prime asset for bribing. Not for nothing the president has his own shit coin.
Not related to this story at all.
Sometimes comments are made in relation to upstream comments. In this case
"Welcome to the (most recent) era of deregulation. Get ready for all Fortune 500s to deny, deny, deny, and bribe."
"Welcome to the (most recent) era of deregulation. Get ready for all Fortune 500s to deny, deny, deny, and bribe."
Presumably the requirements for public companies to disclose stuff and generally follow all kinds of rules were somehow for the health of the markets or something like that. I wonder how the markets will fare with the rules neutered.
To be fair, they're trending down at the moment, so maybe there was something there. But truly only time will tell.
To be fair, they're trending down at the moment, so maybe there was something there. But truly only time will tell.
[deleted]
they likely aren't under an obligation to tell investors about it immediately and simply putting something in their quarterly report about it will probably be fine.
That being said if they put something in some communication that said "we take security seriously" or something that would probably be grounds to sue as this obviously shows they aren't serious or something. The barriers to shareholder lawsuits for securities fraud are pretty low.
That being said if they put something in some communication that said "we take security seriously" or something that would probably be grounds to sue as this obviously shows they aren't serious or something. The barriers to shareholder lawsuits for securities fraud are pretty low.
The SEC says they have 4 business days
"An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material. The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing." (from https://www.sec.gov/newsroom/press-releases/2023-139)
"An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material. The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing." (from https://www.sec.gov/newsroom/press-releases/2023-139)
They are indeed under a legal obligation to disclose "material" cybersecurity incidents. For people who want to see the details, here's the SEC release https://www.sec.gov/newsroom/press-releases/2023-139
Now will the SEC enforce against oracle? In this environment I highly doubt anyone at the SEC would have the appetite but I could be wrong.
So will any investors with standing choose to bring a civil action? Could well do it. There are for sure investors (eg Elliot) who in general would fight anyone at all if they thought they had a case. I don't know if there's anyone like that who had a position in Oracle specifically, but it wouldn't suprise me.
Now will the SEC enforce against oracle? In this environment I highly doubt anyone at the SEC would have the appetite but I could be wrong.
So will any investors with standing choose to bring a civil action? Could well do it. There are for sure investors (eg Elliot) who in general would fight anyone at all if they thought they had a case. I don't know if there's anyone like that who had a position in Oracle specifically, but it wouldn't suprise me.
The SEC no longer exists. The billionaires like Elison completely own the US government right now.
Annnnd this is why Google bought Wiz huh.