Oracle/Sun Enforces Pay-For-Security-Updates Plan 238
An anonymous reader writes "Recently, the Oracle/Sun conglomerate has denied public download access to all service packs for Solaris unless you have a support contract. Now, paying a premium for gold-class service is nothing new in the industry, but withholding critical security updates smacks of extortion. While this pay-for-play model may be de rigueur for enterprise database systems, it is certainly not the norm for OS manufactures. What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications."
Just like Redhat (Score:3, Informative)
Re:Just like Redhat (Score:5, Informative)
o rly?
http://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/
Just another step... (Score:3, Informative)
...and another 'I' dotted in Oracle's plan to kill off Solaris, and force Linux as their high-end product.
I only have one Solaris server left, and I'm rapidly losing any real need to keep using it.
In fact, I will probably end up migrating off of Solaris this year, just to be done with it.
Linux works just fine on my Sparc hardware, even my Ultra Enterprise 2, which hasn't seen
upgrades or replacement parts in over 10 years. (and why it's still up and running, I don't know...)
Re:Sidestep? (Score:2, Informative)
Re:Was to be exepected (Score:5, Informative)
I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business. For me the Oracle web site is so convoluted that it stinks of 'we designed this so that you to pay use to find it'. Everything feels designed to nickle and dime everything you try doing with them. This is based on experience of having get specific updates to fix certain known issues. If you don't agree with my perspective, I would gladly appreciate hearing about your experience.
I am a Java developer and I hope that they don't extend this to Java or any other Sun technologies with a more 'open' culture.
I agree. I cringe every time I venture into the quagmire of oracle.com to obtain a CPU or look up information/patches for an older version of oracle. Sun's site was much easier to navigate through for patch clusters or specific patches themselves. Now that sun's site is folded into oracle's site, finding hardware information has become a pain. I did find that going to sunsolve still is the way to go though.
Re:Just another step... (Score:3, Informative)
"de rigueur for enterprise"? Not for DB2 (Score:3, Informative)
I can't think of any IBM product on the "distributed platforms" (i.e not mainframe or i5OS) where the fixpacks are not available for free.
Mistake (Score:1, Informative)
The linked thread already points out that this was a mistake, not intentional, and provides a link to the Sun site with details.
Re:Just another step... (Score:5, Informative)
There's a big difference - it used to be you needed a contract to use their patch update manager (and one contract covered all machines), but not just download individual patches or patch clusters (which, BTW, are integrated into the latest full OS downloads, and in fact at least one Sun person I've seen has recommended just grabbing the latest full OS download and using that to apply updates!). Now, not only do you need a contract, but you need one for each machine and OS version separately, and you can't actually buy the contracts from Oracle anyway. There's NO way to purchase them online (in fact the one link that's been posted multiple times as "I've verified this works" by Sun/Oracle people takes you to the Oracle 404 page), and when you leave your name with the pre-sales people to have sales call you, you don't get called back (since there's no way to actually talk to a sales person directly).
I suspect that Oracle is doing everything they can to passively kill Solaris without admitting it, that way they can say it wasn't their fault (or plan all along) when the regulators and shareholders come asking questions... If I had my choice, I'd be off Solaris completely, but at least for right now I don't. What's really interesting is what this is going to do to all those proprietary software vendors who require Solaris as the server OS for software used in regulatory compliance-audited environments. Since no patching = non-compliance, the ripple-effect is gonna be HUGE...
Re:Sidestep? (Score:3, Informative)
Re:Just another step... (Score:1, Informative)
This policy was in place -long- before the Oracle deal. It has been over 3 years since you needed a support contract to get patches...
But not security patches.
Re:As a industry best practice... (Score:2, Informative)
Re:As a industry best practice... (Score:3, Informative)
Unless they've been stung by a Scorpion, in which case the venom will kill or paralyse them, thus preventing them from breathing.
Title of Article Is Incorrect (Score:3, Informative)
The title of this article is incorrect. It should read Oracle announces its products will become less secure over time. This will be true because they will permit malware to infect a percentage of their installations, which in turn will corrupt others by providing an internal platform for hackers to penetrate otherwise secure systems. Either a product is secure or it is not. Oracle is merely announcing that their products will not be secure.
Re:Just another step... (Score:3, Informative)
I think you've missed the point. Sun still made security patches generally available, Oracle have made those $$-only as well now.