Forgot your password?
typodupeerror
GNU is Not Unix Oracle Security Sun Microsystems

Oracle/Sun Enforces Pay-For-Security-Updates Plan 238

Posted by CmdrTaco
from the you-get-what-you-pay-for dept.
An anonymous reader writes "Recently, the Oracle/Sun conglomerate has denied public download access to all service packs for Solaris unless you have a support contract. Now, paying a premium for gold-class service is nothing new in the industry, but withholding critical security updates smacks of extortion. While this pay-for-play model may be de rigueur for enterprise database systems, it is certainly not the norm for OS manufactures. What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications."
This discussion has been archived. No new comments can be posted.

Oracle/Sun Enforces Pay-For-Security-Updates Plan

Comments Filter:
  • Sidestep? (Score:5, Insightful)

    by TheRaven64 (641858) on Tuesday March 23, 2010 @11:41AM (#31584506) Journal

    What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications

    The GPL doesn't prevent you from charging a fee for GNU software. It just stops you from preventing the people you sell it to from distributing it to everyone else. OpenSolaris is free and the source is available. If you are using Solaris (not OpenSolaris) then you are paying for a platform that has undergone some extra testing and comes with support guarantees. If this isn't important to you, then use OpenSolaris for free.

  • by CritterNYC (190163) on Tuesday March 23, 2010 @11:45AM (#31584542) Homepage

    They're not sidestepping anything GPL-wise. The OS patches contain some GPL binaries and some proprietary binaries. They are side by side, which means the proprietary binaries are not subject to the GPL. The entire patch package, therefor, can't be redistributed. The GPL bits within the patch can be freely redistributed. As can the source for those bits, which Sun/Oracle is (presumably) making available as they always have to comply with the GPL.

    So, they are sidestepping nothing.

  • by Anonymous Coward on Tuesday March 23, 2010 @11:48AM (#31584580)

    It's just a bunch of crying over nothing. Boo hoo I'm entitled and want everything MY way and if you don't give me my way then I'll use big words like EXTORTION.
    If people don't like it then they don't have to use Solaris, plain and simple.

  • Re:Sidestep? (Score:3, Insightful)

    by flaptrap (1038180) on Tuesday March 23, 2010 @11:48AM (#31584594)

    ...and I quote (from gnu.org gpl-faq

            The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

            But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program's users, under the GPL.

            Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you. ...and...

    If you commercially distribute binaries not accompanied with source code, the GPL says you must provide a written offer to distribute the source code later. When users non-commercially redistribute the binaries they received from you, they must pass along a copy of this written offer. This means that people who did not get the binaries directly from you can still receive copies of the source code, along with the written offer.

    The reason we require the offer to be valid for any third party is so that people who receive the binaries indirectly in that way can order the source code from you.

  • by Midnight Thunder (17205) on Tuesday March 23, 2010 @11:49AM (#31584606) Homepage Journal

    I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business. For me the Oracle web site is so convoluted that it stinks of 'we designed this so that you to pay use to find it'. Everything feels designed to nickle and dime everything you try doing with them. This is based on experience of having get specific updates to fix certain known issues. If you don't agree with my perspective, I would gladly appreciate hearing about your experience.

    I am a Java developer and I hope that they don't extend this to Java or any other Sun technologies with a more 'open' culture.

  • by jedidiah (1196) on Tuesday March 23, 2010 @11:51AM (#31584638) Homepage

    Oracle is redistributing the works of others... just as if they were passing around copies of msoffice.

    Now of course something like that comes with legal complications.

    Merely claiming that this is another case of "entitlement mentality" is dishonest and *ssinine.

  • by jonwil (467024) on Tuesday March 23, 2010 @11:57AM (#31584718)

    Presumably if you obtained the GPL binaries/source from SUN, its legal to redistribute those patches. But there is nothing in the GPL requiring SUN to give you those patches, code or binaries.

    If they give you the binaries, they need to give you the source. But if they choose not to give you the binaries (i.e. you elect not to pay for a Solaris contract), they are not obligated to give you anything (binaries or source)

  • by ircmaxell (1117387) on Tuesday March 23, 2010 @12:01PM (#31584762) Homepage
    Actually, that brings up a point. Since this is about security flaws in their distribution, wouldn't this make them liable if something happened to your sever? "They gave me faulty software which THEY KNEW WAS FAULTY because they wanted to charge me $xx to get the fix"...? This isn't about feature updates (which they could justify charging for), it's about flaws in what they gave out... Now sure, you could say that the flaws were outside of their control because they came from upstream. But if that was the case, how in the world could they justify charging for those updates as not being extortion?...
  • by Zerth (26112) on Tuesday March 23, 2010 @12:08PM (#31584880)

    The part that says(slightly paraphrased for clarity) "this disclaimer may not be valid in some states and does not prevent you from exercising your rights, but hopefully confuses you enough that you don't realize you have any"

  • by ircmaxell (1117387) on Tuesday March 23, 2010 @12:14PM (#31584966) Homepage
    A contract to perform an illegal act is not a valid contract... Considering here the threat is that you can be attacked through the vulnerabilities that were provided in the original software package, I think the argument could be made that this is extortion. And if it is extortion, then they would become responsible for any damages occurring because of the extortion. So even though they disclaimed liability, they could still be held liable (If it is found to be extortion). The disclaimer of liability can been thrown out in cases of criminal negligence (If they installed a back door on your server and then exploited it, they would be liable for the damages regardless of what was in the license)... So it really doesn't matter in this particular case if you agreed to their terms or not so long as a court would agree that this is extortion...
  • by Lunix Nutcase (1092239) on Tuesday March 23, 2010 @12:23PM (#31585126)

    So it really doesn't matter in this particular case if you agreed to their terms or not so long as a court would agree that this is extortion...

    Which is highly unlikely and I doubt you have a shred of case law to back up any claim to the contrary.

  • by discojohnson (930368) on Tuesday March 23, 2010 @12:25PM (#31585170)
    All security updates should be free as in beer. Patches that include features are for-pay. It's not my fault they released a product with security holes. I love car analogies, and it works pretty good here.
  • by Mr.Fork (633378) <edward,j,reddy&gmail,com> on Tuesday March 23, 2010 @12:28PM (#31585224) Journal
    This goes back to the story of the Scorpion and the Frog. A scorpion was travelling across the land when he came to a river. Wanting to get across, he approached a frog to help him get across.
    The frog replied "Why should I help you across because you will sting me and we will both drown."

    The scorpion said "I promise not to sting you."

    They are half-way across the river then the scorpion is startled by a splash of water and stings the frog. The frog cries out as his body begins to paralyze "Fool! You have doomed us both as I predicted."

    The scorpion replies "Fool? What did you expect Frog? I am a scorpion."

    Oracle is a Scorpion. Anyone who thought otherwise when they purchased SUN is a fool.
  • by bill_mcgonigle (4333) * on Tuesday March 23, 2010 @12:32PM (#31585296) Homepage Journal

    I'm having trouble seeing what the big deal is here.

    Oracle is building a successful business around open source software in the full spirit of the GPL. They must be destroyed at all costs .. oh, wait.

  • by Lunix Nutcase (1092239) on Tuesday March 23, 2010 @12:52PM (#31585664)

    So that's a no on having any relevant statutory or case law to back up the claim that they could be successfully sued for extortion? Yeah, I thought so.

  • Stop stepping. (Score:3, Insightful)

    by wonkavader (605434) on Tuesday March 23, 2010 @12:53PM (#31585672)

    Yes, that was certainly the plan a year ago.

    It's no longer the plan. You'll soon need to flip it around.

    Solaris is now a great tool to help Oracle force people to one and only one vendor (Oracle) for just about everything. That's the new plan. And Linux fits in that plan right now, but probably won't in a few years, if they can get people to trust them as hardware vendors, and they can keep the quality of Solaris testing up.

    Oracle sees Sun as a company with a LOT of great stuff, but both weak and incompetent, since it didn't squeeze cash out of people on every single thing it did. Oracle is right now in an orgasmic frenzy to take everything Sun had and monetize it -- some at the start, though that's less important, but EVERYTHING must bring in cash via support and updates. Furthermore, expect to see every piece slowly being changed slightly to push you towards coupling with other Oracle tools.

    Which is why open systems, like Linux, don't help Oracle in the long run. Open systems give you flexibility, and flexibility is bad. Oracle is pushing to get the whole enterprise, from soup to nuts. In the words of an IBM rep I was talking to about this: "We tried that 15 years ago, and it almost killed the company."

    Oracle started doing Linux not because they like open systems (they don't), but because A. they could control it a little through their own distro and B. they could get the support contracts, instead of the money going to Red Hat. Now they have Solaris. They'll push that like crazy and move people onto it, since they can certainly control it a lot better than they can control Linux, and instead of some of the support dollars going to Oracle, ALL of the support dollars will go to them.

  • by ircmaxell (1117387) on Tuesday March 23, 2010 @01:30PM (#31586264) Homepage

    If you bought a lock and three years later someone found a way to pick it would you expect the company to give you a new lock?

    No. But if I bought a lock that claimed to be secure, and a few months down the line someone figured out that you could unlock it by simply putting a paperclip in the end, I would expect them to give me a new lock. I expect a reasonable level of security, and I expect a reasonable length of support for that security. If they told me 1 month after purchase that they weren't going to fix security issues, I'd be flabbergasted. If there was a critical zero day vulnerability found, I expect it fixed yesterday (In understand that in reality it takes time, but I expect the fix in a reasonable amount of time, not years). And since it was a fundamental flaw in the original design, I either way the fix for free, or a free upgrade to software that doesn't contain the fundamental flaw. Just because they get away with it doesn't make it right...

    It takes money to patch security issues and issue updates that money has to come from somewhere.

    When I purchase a product, I expect that product to work. When I pay for support, I pay so that I have someone to call if something goes wrong. I don't pay support so that the company can offset its costs from the purchase price. So the money they spend on security should come from the purchase price (after all, security is a subset of development rather than a subset of support), not the service contract.

    Now if could just kill software patents because they are as dumb as patenting a story, song, movie, or equation.

    I agree 110%...

  • by ducomputergeek (595742) on Tuesday March 23, 2010 @01:33PM (#31586302)

    This is why the day the deal was announced we started migrating everything we could to PostgreSQL and FreeBSD (ZFS & DTrace Support). I had decent respect for Sun and have had some damn good products and service over the past 15 years or so. Oracle is a company that I absolutely had dealing with as a vender. We *have* to support Oracle because that is what some of our clients deploy on. Doesn't mean we have to like it. Honestly, for what we do, we've only had one client that had a HA requirement and they were already running Oracle. For all our other clients PostgreSQL has been able to handle everything we can throw at it and with the new cluster/replication/HA hot standby support in PostgreSQL 9, it looks like it will fill in those gaps that we currently use DB2 or Oracle for.

  • by RivieraKid (994682) on Tuesday March 23, 2010 @01:50PM (#31586554)

    Industry-wide needs to pro-consumer policy

    Only problem with that is Sun/Oracle aren't selling to consumers.

  • Absurd! (Score:2, Insightful)

    by tinker_taylor (618697) on Tuesday March 23, 2010 @02:20PM (#31587122) Homepage

    This is the most absurd piece of news I've come across this year! Why on earth should I pay to have Oracle/Sun fix their own bugs?
    Obviously Security flaws are bugs. If any security vulnerabilities are identified, they should be ethically and morally obligated (ie assuming that the legal angle is unenforceable) to fix these and distribute the patches for free.

    Isn't there anything called accountability/responsibility left any more?!? We are a huge Sun shop and one of the reasons we loved Sun so much is the fact that it was not a blood-sucker when it came to things like patches, software, etc. Unlike a company like HP, who charged for everything from multipathing software to UNIX resource mgt tools (which should be defacto standard of any mature OS).

  • by Anonymous Coward on Tuesday March 23, 2010 @04:33PM (#31588868)

    Oracle/Sun -

    If you're reading this, this is a monumentally stupid idea from a brand management perspective.
    Do you really want to be the vendor known for cracked boxes?

    When the incident reports go up and "OS: Solaris" is moving to the top, I know what most execs would say.
    It won't be "we should pay more for support", it'll be "switch operating systems".

This login session: $13.76, but for you $11.88.

Working...