Flaw hunters pick holes in Oracle patches

TalkBack 12 of 12:: « Previous

Thread View
Flat View

Selective data: This article really goes out of it's way to select only certain data points to try to prove it's case.

For example:
" On its Web site, eEye lists flaws in Microsoft, RealNetworks and Macromedia products that it believes should have been put right by now. "But Oracle is definitely worse," Manzuik said. "They have taken over 600 days to release patches. The worst we have seen Microsoft do is in the 300-day range.""

If Microsoft has way more bugs and they are much more critical, then I would EXPECT them to have a much faster turn-around time. Why would they expect a minor inconvenice in a database program to be turned around in the same amount of time as a significant security hole? The Microsoft flaws I hear about always seem much more significant than the Oracle flaws. Even the Oracle flaws specifically linked to in this article are fairly minor in nature compared to the junk Microsoft puts out.

I had to analyze the set of recently reported Oracle "flaws". One of them required a valid username/password account on the database. The other required FTP access directly to the application servers. If a hacker gets hold of a valid username/password, or FTP access DIRECTLY to the application servers, then they can do FAR worse stuff than exploit a few minor security holes in the database. Compare that to Microsoft security flaws that allow people to take control of your PC for doing virtually nothing and you see the difference.

I hear about a significant new virus or security hole in Microsoft almost every single week. I can't remember the last time I actually heard about someone truly hacking Oracle or using Oracle to do damage.; Posted by: joesmoe25 Posted on: 10/27/05 You are currently: a Guest | Members login | Terms of Use