Forgot your password?
typodupeerror
GNU is Not Unix Oracle Security Sun Microsystems

Oracle/Sun Enforces Pay-For-Security-Updates Plan 238

Posted by CmdrTaco
from the you-get-what-you-pay-for dept.
An anonymous reader writes "Recently, the Oracle/Sun conglomerate has denied public download access to all service packs for Solaris unless you have a support contract. Now, paying a premium for gold-class service is nothing new in the industry, but withholding critical security updates smacks of extortion. While this pay-for-play model may be de rigueur for enterprise database systems, it is certainly not the norm for OS manufactures. What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications."
This discussion has been archived. No new comments can be posted.

Oracle/Sun Enforces Pay-For-Security-Updates Plan

Comments Filter:
  • by bigredradio (631970) on Tuesday March 23, 2010 @11:36AM (#31584420) Homepage Journal
    It would be a shame is something was to happen to it.
    • Re: (Score:3, Funny)

      by Em Emalb (452530)

      That's a nice joke you have there. It'd be a shame if someone were to moderate it. ;)

    • by ircmaxell (1117387) on Tuesday March 23, 2010 @12:01PM (#31584762) Homepage
      Actually, that brings up a point. Since this is about security flaws in their distribution, wouldn't this make them liable if something happened to your sever? "They gave me faulty software which THEY KNEW WAS FAULTY because they wanted to charge me $xx to get the fix"...? This isn't about feature updates (which they could justify charging for), it's about flaws in what they gave out... Now sure, you could say that the flaws were outside of their control because they came from upstream. But if that was the case, how in the world could they justify charging for those updates as not being extortion?...
      • You mean except for the fact that they disclaim all warranties and liabilities in the license? Exactly what basis would you bring up this lawsuit when you agreed to their licensing terms?

        • by Zerth (26112) on Tuesday March 23, 2010 @12:08PM (#31584880)

          The part that says(slightly paraphrased for clarity) "this disclaimer may not be valid in some states and does not prevent you from exercising your rights, but hopefully confuses you enough that you don't realize you have any"

          • by sopssa (1498795)

            But it's open source. Doesn't that mean people can fix it since they have the code? So what's the problem really? That's how FOSS works, for both of its advantage and disadvantage.

            • But this is not necessarily open source. Sure parts of it are, but they also include binary proprietary code in their distribution. So sure, you could fix the open source parts yourself, but how could you fix flaws in their proprietary code?
              • So sure, you could fix the open source parts yourself, but how could you fix flaws in their proprietary code?

                Patching the binary file. Duh. There are numerous patches that people have created to proprietary software to fix bugs and security flaws without even a single line of the original source code. Do you somehow think that game crackers have the game's source code when cracking the games or creating key gens? Are you really that ignorant?

                • So then you're saying that because there's an illegal fix to get around an extortion is an excuse for the extortion itself? Or am I missing something there?
                  • Great dodge, man! Secondly, you keep claiming this is extortion with absolutely zero legal basis to back it up.

            • That poses another problem. In general, vendor support contracts for a given piece of software usually become inapplicable if you modified the code in question. At least, this is how RedHat operates (See: Modified RPMs [redhat.com]) so it's reasonable to expect that other vendors have similar policies.

              IMHO, this is a reasonable policy, because the complexity in supporting the software distribution increases quite a bit if you can't guarantee the code\behavior is vanilla. So while you're still free to integrate upstream

          • And I'm sure you have relevant case law to cite that shows that the universal disclaimer of warranty with regards to software (both proprietary and open source software) is not valid in some states or countries? Yeah, I'm not holding my breath.

            • by HopeOS (74340)
              There's no need. Disclaimers cannot trump the law.
              • And what specific law(s) are these disclaimers of warranty violating? If such warranty disclaimers are invalid it would be quite interesting that the lawyers for the FSF and UC Berkeley were unaware of them when drafting their licenses.

                • by jimicus (737525)

                  Most countries have laws which state pretty clearly that goods and services must be fit for the purpose for which they are sold. In the UK you'd have the Sale of Goods Act, not sure what you'd have elsewhere.

                  This has been used on occasion by people who want a refund for a piece of software which didn't live up to the hype - though AFAIK the company selling the software has caved before it's reached court. My guess is that while they don't really want to refund, they're even more averse to the idea of esta

                  • Most countries have laws which state pretty clearly that goods and services must be fit for the purpose for which they are sold. In the UK you'd have the Sale of Goods Act, not sure what you'd have elsewhere.

                    Apparently you haven't actually read such act. In fact the act has specific terms on which you can disclaim warranty to a product.

              • by cgenman (325138)

                There's no need. Disclaimers cannot trump the law.

                They can during binding arbitration. Which, of course, everyone agrees to when they install software, use a service, or drink a soda in this damned country.

        • by ircmaxell (1117387) on Tuesday March 23, 2010 @12:14PM (#31584966) Homepage
          A contract to perform an illegal act is not a valid contract... Considering here the threat is that you can be attacked through the vulnerabilities that were provided in the original software package, I think the argument could be made that this is extortion. And if it is extortion, then they would become responsible for any damages occurring because of the extortion. So even though they disclaimed liability, they could still be held liable (If it is found to be extortion). The disclaimer of liability can been thrown out in cases of criminal negligence (If they installed a back door on your server and then exploited it, they would be liable for the damages regardless of what was in the license)... So it really doesn't matter in this particular case if you agreed to their terms or not so long as a court would agree that this is extortion...
          • Re: (Score:2, Insightful)

            So it really doesn't matter in this particular case if you agreed to their terms or not so long as a court would agree that this is extortion...

            Which is highly unlikely and I doubt you have a shred of case law to back up any claim to the contrary.

          • by sopssa (1498795)

            This is no way extortion. You bought the current version of Solaris. That's what they're legally obligated to give you. Then you made sure you also have future support for the product.. you did that, right? And it's in your contract, right? right?

            • Exactly, I feel so long as they keep the charges fair and
              the Open Solaris Version (Beta) updates Free(Even this could be Debatable),I have no problem with this.
              Also Agree that it is your job as an Admin to look at the contract that you sign and or contact the vendor,
              When you have questions, ANY QUESTION!, even legalese questions.

              +1 off topic.
              • by Perl-Pusher (555592) on Tuesday March 23, 2010 @01:51PM (#31586566)
                By that measure then no need for Toyota to recall anything. You paid for the current version of the vehicle so they can just charge to fix your death trap. As long as its reasonable, labor, parts of course! I'm waiting for someone to set a legal precedent here. The day a software company becomes liable for negligence will forever change IT. I can see it happening at a hospital where access to vital information was lost and someone dies.
                • By that measure then no need for Toyota to recall anything. You paid for the current version of the vehicle so they can just charge to fix your death trap. As long as its reasonable, labor, parts of course! I'm waiting for someone to set a legal precedent here. The day a software company becomes liable for negligence will forever change IT. I can see it happening at a hospital where access to vital information was lost and someone dies.

                  Except the motor industry (probably more specifically *safety* in the motor industry) is regulated, the software industry is not. So Toyota are legally required to ensure their car designs/manufacturing processes result in their cars meeting certain minimum safety standards, Oracle/Sun is not legally required to ensure their software does anything.

          • by wytcld (179112)

            "It would be a shame if your nice [online] storefront got broken into and wrecked. Yeah, we sold you that front door and lock. Well, you should know there's a little problem we've discovered with it. We could fix it for you, for a price. Or you might expect to find a couple of guys have opened that lock at night and run through your place with wrecking bars, one of these mornings."

            Classic protection racket. My Italian relatives would totally approve.

      • by LWATCDR (28044)

        Not really.
        Nothing is perfect including security. If you bought a lock and three years later someone found a way to pick it would you expect the company to give you a new lock?
        I am not a FOSS zealot but if you buy a closed source OS that comes with a support system then you are silly if you expect updates for free for anything.
        Even if the company you bought from does provide free security patches eventually the OS will be EOL and those will stop.
        It takes money to patch security issues and issue updates that

        • Re: (Score:3, Insightful)

          by ircmaxell (1117387)

          If you bought a lock and three years later someone found a way to pick it would you expect the company to give you a new lock?

          No. But if I bought a lock that claimed to be secure, and a few months down the line someone figured out that you could unlock it by simply putting a paperclip in the end, I would expect them to give me a new lock. I expect a reasonable level of security, and I expect a reasonable length of support for that security. If they told me 1 month after purchase that they weren't going t

          • by LWATCDR (28044)

            The thing is that none of the exploits are as simple as putting a paperclip in the lock.
            So no it is a lot more complex of an issue than you are supposing. And a zero day exploit just means a bad guy found it first.
            As I said if you don't like just pick a different company or go with a FOSS solution. It is as simple as that.

    • The title of this article is incorrect. It should read Oracle announces its products will become less secure over time. This will be true because they will permit malware to infect a percentage of their installations, which in turn will corrupt others by providing an internal platform for hackers to penetrate otherwise secure systems. Either a product is secure or it is not. Oracle is merely announcing that their products will not be secure.

  • Just like Redhat (Score:3, Informative)

    by shafty023 (993689) on Tuesday March 23, 2010 @11:40AM (#31584476)
    This isn't any different from what Redhat does. They charge for security updates and no one has gone crying about it. Can't all jump on Oracle for wanting to be paid for the development time put in for security updates ppl
    • Re:Just like Redhat (Score:5, Informative)

      by Anonymous Coward on Tuesday March 23, 2010 @11:44AM (#31584530)

      o rly?

      http://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/

    • The problem here is not that they are doing this, but that they are doing this NOW.

      RHEL was pay-to-update from day one. Everyone considering RHEL knew this and could decide whether that was what they wanted to go with.

      The difference here is that users who have been using Solaris for years and making do with critical updates are now unable to keep their systems secure.

      Oracle is changing the rules of the game in mid-stream. That is where the problem is.

      Were they to come out with Solaris 11 and proclaim THEN

      • by sopssa (1498795)

        If the two options are either to stop the Solaris project because it's generating so big losses, or continue it with paid updates, which one is better? Sure suddenly starting to pay for updates might suck a bit, but it's better than not getting those updates at all.

      • by Znork (31774)

        Oracle is changing the rules of the game in mid-stream.

        Well, to be fair, it's not exactly Oracle that's changing the rules, it's Sun's stockholders who decided to sell to Oracle. That Oracle was going to do exactly what they're doing was pretty obvious to most who've followed these companies... the reason customers were dropping Sun during the pre-merger period was hardly the regulatory dragging, but rather the high power suction device snaking towards their wallet.

        Sooner or later, you pay for what you get.

  • Sidestep? (Score:5, Insightful)

    by TheRaven64 (641858) on Tuesday March 23, 2010 @11:41AM (#31584506) Journal

    What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications

    The GPL doesn't prevent you from charging a fee for GNU software. It just stops you from preventing the people you sell it to from distributing it to everyone else. OpenSolaris is free and the source is available. If you are using Solaris (not OpenSolaris) then you are paying for a platform that has undergone some extra testing and comes with support guarantees. If this isn't important to you, then use OpenSolaris for free.

    • Re: (Score:3, Insightful)

      by flaptrap (1038180)

      ...and I quote (from gnu.org gpl-faq

      The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

      But if you release the modified version to the public in some way, the GP

  • ... is knocking on the door of the competition.

    There are many ways to take news like this. For those invested, it's a blow. For the free market and those looking for marketing opportunities (cough ... I'm talking to the competition) .... this is your opportunity to do something good to us looking for solutions and yourself (in recapturing market share). Make me an offer I can't refuse.

  • by CritterNYC (190163) on Tuesday March 23, 2010 @11:45AM (#31584542) Homepage

    They're not sidestepping anything GPL-wise. The OS patches contain some GPL binaries and some proprietary binaries. They are side by side, which means the proprietary binaries are not subject to the GPL. The entire patch package, therefor, can't be redistributed. The GPL bits within the patch can be freely redistributed. As can the source for those bits, which Sun/Oracle is (presumably) making available as they always have to comply with the GPL.

    So, they are sidestepping nothing.

    • by mounthood (993037)

      They're not sidestepping anything GPL-wise. The OS patches contain some GPL binaries and some proprietary binaries. They are side by side, which means the proprietary binaries are not subject to the GPL. The entire patch package, therefor, can't be redistributed. The GPL bits within the patch can be freely redistributed.

      They're not side-stepping the GPL because the GPL is not viral. The idea that Oracle is doing something wrong really only makes sense if you think of the GPL as viral. (flame on!)

  • by Midnight Thunder (17205) on Tuesday March 23, 2010 @11:49AM (#31584606) Homepage Journal

    I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business. For me the Oracle web site is so convoluted that it stinks of 'we designed this so that you to pay use to find it'. Everything feels designed to nickle and dime everything you try doing with them. This is based on experience of having get specific updates to fix certain known issues. If you don't agree with my perspective, I would gladly appreciate hearing about your experience.

    I am a Java developer and I hope that they don't extend this to Java or any other Sun technologies with a more 'open' culture.

    • by Capt James McCarthy (860294) on Tuesday March 23, 2010 @12:01PM (#31584764) Journal

      I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business. For me the Oracle web site is so convoluted that it stinks of 'we designed this so that you to pay use to find it'. Everything feels designed to nickle and dime everything you try doing with them. This is based on experience of having get specific updates to fix certain known issues. If you don't agree with my perspective, I would gladly appreciate hearing about your experience.

      I am a Java developer and I hope that they don't extend this to Java or any other Sun technologies with a more 'open' culture.

      I agree. I cringe every time I venture into the quagmire of oracle.com to obtain a CPU or look up information/patches for an older version of oracle. Sun's site was much easier to navigate through for patch clusters or specific patches themselves. Now that sun's site is folded into oracle's site, finding hardware information has become a pain. I did find that going to sunsolve still is the way to go though.

    • I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business.

      The Sun's business is keeping me warm during the day, providing a free energy source, and an excuse for me to wear sun glasses.

      So long as it does that, I couldn't care less what any Oracle does with it.

    • by hoggoth (414195) on Tuesday March 23, 2010 @12:26PM (#31585184) Journal

      I wanted to play with a particular technology from a company that was acquired by a company that was acquired by Oracle. I called Oracle and got passed from department to department. Nobody had ever even heard of this technology or the company they had acquired years ago. One rep was willing to sell me a license to use the technology for many thousands of dollars even though he himself couldn't find any mention of it inside Oracle, with the caveat that I would have to FIND IT myself because he didn't have any idea where it might be. After being transferred back to the same person the fourth or fifth time I gave up with the phone and started googling for the technology. I found a web page deep inside Oracle's website that had the entire thing, source code and all, available. There were no disclaimers, there was no license, just instructions on how to download it, compile it, install it, and use it.

      So I did.

      I suspect Oracle is run by the Department of Motor Vehicles.

    • by brit74 (831798)

      I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business.

      Sun's business was already in the negative. At this point, I can't blame them for trying something new to turn-around Sun's profit/loss statement:

      For the quarter that ended March 29 [2009], Sun posted a net loss of $201 million, or 27 cents a share. That’s a sharp downturn from the loss of $34 million, or 4 cents a share, it reported the same period last year.
      http://www.nytimes.com/2009/04/29/technology/companies/29sun.html [nytimes.com]

  • Just another step... (Score:3, Informative)

    by ak_hepcat (468765) <leif@NospAM.denali.net> on Tuesday March 23, 2010 @11:51AM (#31584630) Homepage Journal

    ...and another 'I' dotted in Oracle's plan to kill off Solaris, and force Linux as their high-end product.

    I only have one Solaris server left, and I'm rapidly losing any real need to keep using it.
    In fact, I will probably end up migrating off of Solaris this year, just to be done with it.

    Linux works just fine on my Sparc hardware, even my Ultra Enterprise 2, which hasn't seen
    upgrades or replacement parts in over 10 years. (and why it's still up and running, I don't know...)

    • Re: (Score:3, Informative)

      This policy was in place -long- before the Oracle deal. It has been over 3 years since you needed a support contract to get patches...
      • by Anonymous Coward on Tuesday March 23, 2010 @12:24PM (#31585156)

        There's a big difference - it used to be you needed a contract to use their patch update manager (and one contract covered all machines), but not just download individual patches or patch clusters (which, BTW, are integrated into the latest full OS downloads, and in fact at least one Sun person I've seen has recommended just grabbing the latest full OS download and using that to apply updates!). Now, not only do you need a contract, but you need one for each machine and OS version separately, and you can't actually buy the contracts from Oracle anyway. There's NO way to purchase them online (in fact the one link that's been posted multiple times as "I've verified this works" by Sun/Oracle people takes you to the Oracle 404 page), and when you leave your name with the pre-sales people to have sales call you, you don't get called back (since there's no way to actually talk to a sales person directly).

        I suspect that Oracle is doing everything they can to passively kill Solaris without admitting it, that way they can say it wasn't their fault (or plan all along) when the regulators and shareholders come asking questions... If I had my choice, I'd be off Solaris completely, but at least for right now I don't. What's really interesting is what this is going to do to all those proprietary software vendors who require Solaris as the server OS for software used in regulatory compliance-audited environments. Since no patching = non-compliance, the ripple-effect is gonna be HUGE...

      • Re: (Score:3, Informative)

        by Paul Jakma (2677)

        I think you've missed the point. Sun still made security patches generally available, Oracle have made those $$-only as well now.

    • ...and another 'I' dotted in Oracle's plan to kill off Solaris, and force Linux as their high-end product.

      Oracle isn't stupid about making money. They're probably seeing if Solaris can be made profitable on its own. If not, it gets the whack. But not giving it the full chance would be a foolish disposition of an asset.

    • Stop stepping. (Score:3, Insightful)

      by wonkavader (605434)

      Yes, that was certainly the plan a year ago.

      It's no longer the plan. You'll soon need to flip it around.

      Solaris is now a great tool to help Oracle force people to one and only one vendor (Oracle) for just about everything. That's the new plan. And Linux fits in that plan right now, but probably won't in a few years, if they can get people to trust them as hardware vendors, and they can keep the quality of Solaris testing up.

      Oracle sees Sun as a company with a LOT of great stuff, but both weak and incompe

  • The fact that they're shipping GNU utilities is irrelevant here. The GPL compels you to distribute source and rights when you distribute a binary. There is no requirement to keep it up to date, and Sun/Oracle can do whatever they want with their Solaris cluster packs. What they can't do is distribute updates to paying customer and prevent those customers from passing the updates on to others (for the GPL-licensed parts, that is).
  • Interestingly, we had support contracts for several SPARC machines until recently, but when the time
    for renewal came around SUN didn't send any notice, and we let it go. I think of this as
    "passive/aggressive" behavior on their part and seems typical of our experience with the administrative
    side of SUN, although past adventures (such as wrong addresses on shipments) have been worse. .

  • by jonwil (467024) on Tuesday March 23, 2010 @11:57AM (#31584718)

    Presumably if you obtained the GPL binaries/source from SUN, its legal to redistribute those patches. But there is nothing in the GPL requiring SUN to give you those patches, code or binaries.

    If they give you the binaries, they need to give you the source. But if they choose not to give you the binaries (i.e. you elect not to pay for a Solaris contract), they are not obligated to give you anything (binaries or source)

    • If they give you the binaries, they need to give you the source. But if they choose not to give you the binaries (i.e. you elect not to pay for a Solaris contract), they are not obligated to give you anything (binaries or source)

      Correct, but as soon as they distribute the binaries to a single person or organisation, the GPL is also implicitly transferred, and so is Sun's (or Oracles) obligation to provide the source code to any third party who obtains the binary under the GPL from that person or organisation. So they are not obligated to provide you with the binaries, but they are obligated to provide you with the source if you got those binaries from another route. Though, this is time-limited. a quick scan of the GPLv2 shows that

  • getting fdisked and Debian GNU/Linux is getting installed on them as we speak.
    • You are right. One of them is in my server room, and a new box that is showing up next week is now NOT getting Solaris on it, but will be getting Debian instead.
      • I hate to reply to myself, but those are both Intel boxes.
        At the present time I am not even considering Sparc based servers.
  • by Kenneth Stephen (1950) on Tuesday March 23, 2010 @12:15PM (#31584984) Journal

    I can't think of any IBM product on the "distributed platforms" (i.e not mainframe or i5OS) where the fixpacks are not available for free.

  • by discojohnson (930368) on Tuesday March 23, 2010 @12:25PM (#31585170)
    All security updates should be free as in beer. Patches that include features are for-pay. It's not my fault they released a product with security holes. I love car analogies, and it works pretty good here.
    • Re: (Score:3, Insightful)

      by RivieraKid (994682)

      Industry-wide needs to pro-consumer policy

      Only problem with that is Sun/Oracle aren't selling to consumers.

  • by Mr.Fork (633378) <edward.j.reddy@gma[ ]com ['il.' in gap]> on Tuesday March 23, 2010 @12:28PM (#31585224) Journal
    This goes back to the story of the Scorpion and the Frog. A scorpion was travelling across the land when he came to a river. Wanting to get across, he approached a frog to help him get across.
    The frog replied "Why should I help you across because you will sting me and we will both drown."

    The scorpion said "I promise not to sting you."

    They are half-way across the river then the scorpion is startled by a splash of water and stings the frog. The frog cries out as his body begins to paralyze "Fool! You have doomed us both as I predicted."

    The scorpion replies "Fool? What did you expect Frog? I am a scorpion."

    Oracle is a Scorpion. Anyone who thought otherwise when they purchased SUN is a fool.
    • Re: (Score:2, Offtopic)

      by FreeUser (11483)

      That is an old tale, but not told the way you wrote it. A (somewhat) corrected version:

      A scorpion was travelling across the land when he came to a river. Wanting to get across, he approached a frog to help him get across.

      The frog replied "Why should I help you across because you will sting me and we will both drown."

      The scorpion said "I promise not to sting you."

      They are half-way across the river then the scorpion is startled by a splash of water and stings the frog. The frog cries out as his body begins t

    • by jim_v2000 (818799)
      Uh...I thought that this was how Sun had things set up.
    • Re: (Score:3, Insightful)

      This is why the day the deal was announced we started migrating everything we could to PostgreSQL and FreeBSD (ZFS & DTrace Support). I had decent respect for Sun and have had some damn good products and service over the past 15 years or so. Oracle is a company that I absolutely had dealing with as a vender. We *have* to support Oracle because that is what some of our clients deploy on. Doesn't mean we have to like it. Honestly, for what we do, we've only had one client that had a HA requirement an

    • Re: (Score:2, Informative)

      by ma3382 (1095011)
      During the time frogs are submerged under water or buried in soil they breathe through their skin.
      • Re: (Score:3, Informative)

        by RivieraKid (994682)

        Unless they've been stung by a Scorpion, in which case the venom will kill or paralyse them, thus preventing them from breathing.

  • by Anonymous Coward
    I just want to congratulate Oracle on doing everything it can to kill off Solaris passively [sun.com] so they don't have to admit what they're doing. I need a Solaris support contract in order to keep a few systems running specialized software in a compiance-audited environment up to date. This is software that is run in many environments where the inability to keep them patched is a showstopper. However, I can't seem to purchase a support contract. The only page that even lists the ability to purchase it is broken (
  • Does this mean that CIA, DoD, et al will be dropping Sun requirements since this is now a foreign company that likes to change the rules (although I'm sure they all have support contracts, so technically nothing changes for them)? I was told by a CIA headhunter once that Sun was the only *nix they used due to some Congressional mandate of some sort (although that was almost a decade ago).
  • Funny, I was just reading this blog post last night.

    Danese Cooper is a long time open source advocate who formerly worked at Sun, among others, and is recently the new CTO at the Wikimedia Foundation after the recent departure of Brion Vibber for a micro-blogging upstart.

    New DivaBlog: Assimilation begins...Oracle Censors Blogs.Sun.Com [blogs.com]

    Remaining Snoracle employees have until May to migrate their personal blogs to a non-Oracle-owned hosting service...but if even after such migration, anyone who mentions work on a personal blog forfeits their editorial self-determination, as Oracle believes the blog then becomes Oracle property subject to their draconian rules.

    That sounds a mite drama-queeny until you factor in that she helped to create Blogs.Sun.Com and probably cared a lot about the culture of her former employer.

    What you don't se

  • by headkase (533448)
    Oracle has a profit motive to release buggy products?
  • GPL does not mean they have to give their product away for free to anyone who asks.

    It means that whatever pieces of code they use that are under the GPL, they cannot block re-distribution of; and they must provide "access to code to customers who ask". *NOT* to "anyone". And they are free to distribute said code however they want. They can do it by insisting that the customer pay $9.95 shipping to receive just the GPL code on a CD-ROM, AND insist that only paid customers can even place this order.

    But, on

    • GPL does not mean they have to give their product away for free to anyone who asks.

      It means that whatever pieces of code they use that are under the GPL, they cannot block re-distribution of; and they must provide "access to code to customers who ask". *NOT* to "anyone".

      Actually, not quite. In GPLv2 section 3, which you're referring to here,

      b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange

      They *DO* have to provide source code to any third party who has a copy of the binary

  • Absurd! (Score:2, Insightful)

    by tinker_taylor (618697)

    This is the most absurd piece of news I've come across this year! Why on earth should I pay to have Oracle/Sun fix their own bugs?
    Obviously Security flaws are bugs. If any security vulnerabilities are identified, they should be ethically and morally obligated (ie assuming that the legal angle is unenforceable) to fix these and distribute the patches for free.

    Isn't there anything called accountability/responsibility left any more?!? We are a huge Sun shop and one of the reasons we loved Sun so much is the fa

Your computer account is overdrawn. Please see Big Brother.

Working...