News for hackers. Stuff that matters.
Re:Oracle customers confirm data stolen in alleged cloud bre... by 2thumbsup on Wednesday March 26, 2025 @05:25PM (#43487487)
Alone the fact that Oracle was hosting their login gateway on a product with a known vulnerability from 2021 with a CVSS score of 9.8 is quite disturbing.
Re:Oracle customers confirm data stolen in alleged cloud bre... by fock on Wednesday March 26, 2025 @06:19PM (#43488106)
we pay millions to Oracle. We hit a bug and it took 6months for them to reproduce and acknowledge there is a bug. they now seem to be on the lookout for someone being able to produce a fix: sales and indian after-sales can't do that... curious!

Oracle seems just a moneygrabbing shell company at this point and I suppose the whole hyperscaler-cloud is developing towards that point with the leaders of those corporations repeating exactly the same talking points...

Re:Oracle customers confirm data stolen in alleged cloud bre... by toomuchtodo on Wednesday March 26, 2025 @07:15PM (#43488593)
Why are you still on Oracle? (genuine question, no snark)
Re:Oracle customers confirm data stolen in alleged cloud bre... by ie21 on Wednesday March 26, 2025 @08:48PM (#43489243)
They make a great database?
Re:Oracle customers confirm data stolen in alleged cloud bre... by toomuchtodo on Wednesday March 26, 2025 @08:53PM (#43489291)
Another curious question: what use case can only be served by an Oracle DB?
Re:Oracle customers confirm data stolen in alleged cloud bre... by internet101010 on Wednesday March 26, 2025 @09:48PM (#43489619)
The Oracle products built on top of them, such as EPM.
Re:Oracle customers confirm data stolen in alleged cloud bre... by YetAnotherNick on Wednesday March 26, 2025 @11:23PM (#43490100)
Then the obvious follow up is which area is EPM significantly better than competition?
Re:Oracle customers confirm data stolen in alleged cloud bre... by toyg on Thursday March 27, 2025 @03:45AM (#43491258)
EPM products were originally built on SQLServer (or on nothing, like Essbase), and then adapted to run on Oracle. So it's more like "the products commercially forced to run on Oracle, like EPM".

Not that it matters that much - there are better EPM/CPM products now available, like OneStream ;)

Re:Oracle customers confirm data stolen in alleged cloud bre... by tbrownaw on Thursday March 27, 2025 @12:27AM (#43490388)
Anything that was previously built on Oracle and would be too much of a pain to try to migrate to something else.
Re:Oracle customers confirm data stolen in alleged cloud bre... by eitland on Thursday March 27, 2025 @05:33AM (#43491758)
Many moons ago when I was green and my skin was a lot smoother I pointed out to my then boss that we could relatively easily (a few weeks of work) move our product from Oracle to Postgres and save n x $1000 for each installation we shipped to a customer.

My personal goal was to avoid becoming an Oracle expert. (Why? Because even as someone who passed advanced Oracle training easily it was still extremely painful. One mistake towards the end of an installation could easily result in 2 days extra work to clear it out.)

Stupid as I was I said nothing about all the work we went through and only mention all the money we could save.

The response was something I learned a lot from.

It was mild and friendly and something along the lines of "here's what you don't get young lad: the customer pays for the Oracle license on top of our original price and we get a 10% cut. Changing to Postgres will effectively cost us money. Also for <this industry> when we say it is based on Oracle they feel safe."

I'm back at Oracle today after a decade of less painful options and Oracle is still painful but these days I'm not the DBA thankfully and only have to deal with connectionstrings that makes every other database look easy, different SQL syntax etc.

Re:Oracle customers confirm data stolen in alleged cloud bre... by fulafel on Friday March 28, 2025 @12:58AM (#43501684)
Going on Oracle sales rep sponsored ski trips.
Re:Oracle customers confirm data stolen in alleged cloud bre... by fulafel on Thursday March 27, 2025 @01:51AM (#43490705)
It's possible it has redeeming features but seems more common to be just legacy. Multiple apps accessing the same DB leading to a gridlock from migration POV. (Plus career oracle DBAs etc in the org).

As Oracle is so expensive it skews the architecture decisions towards multiple apps accessing the same DB.

Re:Oracle customers confirm data stolen in alleged cloud bre... by cess11 on Thursday March 27, 2025 @04:54AM (#43491574)
If you handle large amounts of geographical data you'll need to invest quite a bit to move to Postgres. It's possible but you're going to need to touch a lot of existing code and figure out new performance characteristics and so on. A lot of it will be hard for an average organisation, not because it's very sophisticated and complex but because it will be large amounts of boring rote work that many developers don't see how they could do programmatically.

Rumour has it the same holds for some other types of data as well but I lack immediate experience in other areas.

With Oracle you also have a rather robust, exhaustive documentation of error messages and even obscure stuff is likely to be figured out in some forum thread by someone and an indian guy. Postgres isn't exactly bad in this area but you can run into things where you need to go deep in debugging yourself and figure out minutiae of your specific version.

Containers also remove most of the issues with running several instances in development and CI environments.

I still don't recommend anyone to pick Oracle for greenfield stuff, instead you should work around shortcomings in other database engines, but for a large organisation with certain demands that already has buyin it makes sense.

Re:Oracle customers confirm data stolen in alleged cloud bre... by markandrewj on Thursday March 27, 2025 @11:08AM (#43494454)
Postgres is commonly used in GIS, via PostGIS (https://postgis.net). That said it is Oracles model to try to lock customers in.
Re:Oracle customers confirm data stolen in alleged cloud bre... by fulafel on Friday March 28, 2025 @12:56AM (#43501677)
PostGIS seems leaps better to me (like the PG DX in other aspects). Eg in Oracle you don't have 2d points. Adding a geo index can fail in the middle and leave the table in a unusable state that requires DBA magic to untangle. Etc.

This is just on top of the general technical inferiority (eg there are no transactional schema changes, so you don't get the safe go/no-go in those when applying those as part of app deploys with a migration tool)

Re:Oracle customers confirm data stolen in alleged cloud bre... by cess11 on Friday March 28, 2025 @03:29AM (#43502529)
SDO_POINT(x, y, 0) or SDO_POINT(x, y, NULL) ought to do what you want. Index corruption can be a nasty problem on Postgres too.

You need to decide if and how to perform a rollback, similar to how you would define a down() procedure in migration files. A schema change might imply changes to data, and in that case you might turn off client writes, copy the table, change it, validate, do rename dance, turn on client writes again. If it doesn't it might be much cheaper to operate on a single copy. How does Postgres decide on such strategies automatically?

Re:Oracle customers confirm data stolen in alleged cloud bre... by thyristan on Thursday March 27, 2025 @04:55AM (#43491575)
Even worse. It skews the architecture decisions towards few large physical database servers instead of many small VMs, because licensing cost is per core in the whole VM cluster, so totally unaffordable. So you get reduced availability, higher risk, reduced separation, reduced security, higher datacenter cost, and they bill you an arm and a leg on top...
Re:Oracle customers confirm data stolen in alleged cloud bre... by inetknght on Thursday March 27, 2025 @07:36AM (#43492529)
This isn't always a bad thing because microservice architecture isn't always the best solution.
Re:Oracle customers confirm data stolen in alleged cloud bre... by evanelias on Thursday March 27, 2025 @10:43AM (#43494186)
This often isn't related to a monolith vs microservice comparison. Large enterprises and institutions tend to run a lot of completely separate applications, which then end up sharing database infrastructure unnecessarily. Think of universities, for example.
Re:Oracle customers confirm data stolen in alleged cloud bre... by overfeed on Thursday March 27, 2025 @12:35PM (#43495327)
Oracle extends the problem to the opposite end of microservices, by encouraging monolith DB consolidation, with unrelated monolith applications on the same db cluster for purely budgetary reasons.
Re:Oracle customers confirm data stolen in alleged cloud bre... by inetknght on Thursday March 27, 2025 @06:45PM (#43499095)
> unrelated monolith applications on the same db cluster

If your "db cluster" is split into containers on one VM as you would do in any other cloud (because VMs are expensive), then you would have the same problem.

> encouraging monolith DB consolidation

Does it? I don't think so. I've worked with Oracle's stuff and the only real difference between Oracle Cloud and other clouds is that Oracle cloud is more expensive overall. There's nothing stopping you from running virtual machines and kubernetes in the same way you'd run it in any other cloud.

Re:Oracle customers confirm data stolen in alleged cloud bre... by fulafel on Friday March 28, 2025 @12:48AM (#43501645)
Yep. And then when the DBs are already on the same servers, when there's a need to connect previously unrelated apps to some master data, a shortcut presents itself. The DBA thinks: After all, why not? Why shouldn't I take it?
Re:Oracle customers confirm data stolen in alleged cloud bre... by jeltz on Thursday March 27, 2025 @02:27AM (#43490885)
From my anecdotal experience: no. It is arcane, user hostile and buggy. And performance for many workloads is roughly in line with open source databases.

Some of the tooling around it is nice and it has some nice features but I would not recommend it even if it was free.

Edit: unless the great database is MySQL, they are actually decent stewards of it and while I still strongly prefer PostgreSQL MySQL is pretty good these days.

Re:Oracle customers confirm data stolen in alleged cloud bre... by plantain on Thursday March 27, 2025 @03:04AM (#43491071)
Because Oracle gives their manager premium baseball tickets on the regular.
Re:Oracle customers confirm data stolen in alleged cloud bre... by comprev on Thursday March 27, 2025 @01:51PM (#43496070)
Because of architectural decisions made a very long time ago (finance industry) and the potential risk of migrating to another platform.
Re:Oracle customers confirm data stolen in alleged cloud bre... by tartoran on Thursday March 27, 2025 @02:40PM (#43496672)
It seems like an even bigger risk to not migrate.
Re:Oracle customers confirm data stolen in alleged cloud bre... by fock on Thursday March 27, 2025 @05:13PM (#43498254)
as others have mentioned

- institutional inertia - some weird consultant style people in key roles (this happens around cloudy stuff too) - the DBA-team - "we can't move everything!" - "we just migrated off solaris!"

however every new project with sane leadership seems to decide against oracle.

Re:Oracle customers confirm data stolen in alleged cloud bre... by 2OEH8eoCRo0 on Wednesday March 26, 2025 @08:04PM (#43488979)
Check out Oracle's market cap or Ellison's net worth ;)
Re:Oracle customers confirm data stolen in alleged cloud bre... by pram on Wednesday March 26, 2025 @05:40PM (#43487678)
Fun fact: Oracle has like 6+ LDAP/directory products, OAM is just one. Theres ODS, OIM, OID, OUD, OVD, NIS leftovers from Sun, and probably more honestly
Re:Oracle customers confirm data stolen in alleged cloud bre... by forinti on Wednesday March 26, 2025 @05:59PM (#43487890)
And you can't just use your AD, you have to install OID and have it synchronized.

It just makes me mad.

Re:Oracle customers confirm data stolen in alleged cloud bre... by skissane on Wednesday March 26, 2025 @10:27PM (#43489823)
OAM and OIM aren’t “LDAP/directory products” per se.

OAM is an access management product, used to implement stuff like SSO (single sign-on). So, for example, it comes with a module you can install in Apache which will intercept HTTP requests and redirect them to OAM’s login page - which may potentially talk to an LDAP to authenticate you. Or you can do stuff like define some URL patterns in an app as sensitive so they require a more secure authentication mechanism (such as 2FA or smart card), other URL patterns as less sensitive so password-only login is sufficient

OIM is basically about provisioning accounts from a source system into target systems. Those systems could be LDAPs from various vendors, but can also be HR systems (Oracle’s various offerings and SAP too), IBM mainframes (RACF, TopSecret, ACF2), Unix/Linux hosts, database tables, custom apps… also lets you do things like setup workflows to approve system access requests, you can configure it to require reapproval of high risk access requests by management every X months or else they get revoked (used for Sarbanes-Oxley compliance), etc

Source: I used to work for Oracle Engineering, in a team which handled escalations for these products-especially OIM, but I stuck my fingers in most of them. When I left (back in 2017, so a while ago now) they were putting a lot of effort into their cloud offering (IDCS, more recently replaced by OCI IAM), but I’m sure the on-premise offerings are going to stick around for a long time, especially because they have some customers (e.g. in the national security space) for which cloud is unlikely to be a viable solution any time soon

Re:Oracle customers confirm data stolen in alleged cloud bre... by greenchair on Wednesday March 26, 2025 @05:33PM (#43487599)
hey at least they use their own product!
Re:Oracle customers confirm data stolen in alleged cloud bre... by sidewndr46 on Wednesday March 26, 2025 @05:37PM (#43487640)
It appears they took dogfooding a little too literally
Re:Oracle customers confirm data stolen in alleged cloud bre... by cluckindan on Wednesday March 26, 2025 @05:47PM (#43487767)
Ironically, they didn’t see this coming.
Re:Oracle customers confirm data stolen in alleged cloud bre... by Aeolun on Wednesday March 26, 2025 @06:06PM (#43487977)
To be fair, the vulnerability is only 4 years old. There is no way they could have noticed it, let alone resolved it that quickly.

This is Oracle.