http://fogbeam.blogspot.com/2015/08/oracle-explain-exactly-why-you-should.html
Unless you have been living under a rock for the past few days, you are probably aware of the (in)famous "No, You Really Can't" blog post from Oracle. The post sparked a firestorm of controversy with its ranting about the reasons Oracle customers can't probe Oracle products for security vulnerabilities. The original post has been deleted, but a copy of the post can still be found at the Internet Archive.
In the post, the author makes the following interesting comment:
Unless you have been living under a rock for the past few days, you are probably aware of the (in)famous "No, You Really Can't" blog post from Oracle. The post sparked a firestorm of controversy with its ranting about the reasons Oracle customers can't probe Oracle products for security vulnerabilities. The original post has been deleted, but a copy of the post can still be found at the Internet Archive.
In the post, the author makes the following interesting comment:
Even if you want to have reasonable certainty that suppliers take reasonable care in how they build their products – and there is so much more to assurance than running a scanning tool - there are a lot of things a customer can do like, gosh, actually talking to suppliers about their assurance programs or checking certifications for products for which there are Good Housekeeping seals for (or “good code” seals) like Common Criteria certifications or FIPS-140 certifications. Most vendors – at least, most of the large-ish ones I know – have fairly robust assurance programs now (we know this because we all compare notes at conferences). That’s all well and good, is appropriate customer due diligence and stops well short of “hey, I think I will do the vendor’s job for him/her/it and look for problems in source code myself,” even though:
- A customer can’t analyze the code to see whether there is a control that prevents the attack the scanning tool is screaming about (which is most likely a false positive)
- A customer can’t produce a patch for the problem – only the vendor can do that
- A customer is almost certainly violating the license agreement by using a tool that does static analysis (which operates against source code)
Comments
Post a Comment