In case you missed it, Oracle has put the world on notice to "turn security rhetoric into action". That was the theme of Evelyn Sell's (Senior Program Manager with Oracle) presentation last week at SECURECon; basically she took the stage to tell all of us security practitioners and developers that there is no excuse for security rhetoric that isn't backed up by action. Wow. Do I even need to say it? Does "unbreakable" ring a bell? Or when Larry Ellison said "we haven't had a vulnerability in twenty years"? Clearly they aren't and clearly they have. Once again, I am flabbergasted by the hubris and hypocrisy coming out of that firm.
Now I thought I was about as irritated at Oracle's as I was going to get - but clearly I was wrong. For anybody who hasn't been paying attention, Oracle is not a the standard for software security - despite what their marketing department might tell you. I remember studying Attic Greek at one point in the distant past, and there are a few things I remember about Hubris: first, I remember that the quality of hubris (‛′Υβρις) is the principal downfall of characters in the tragedies. I also remember that it was one of the worst personality characteristics that the Greeks could imagine a person having. Almost any time that a character demonstrated the trait in tragedy, they were struck down (usually by the gods). To illustrate how much the Greeks hated this quality, the word can mean either "insolence" (akin to the sense we use it in today) or "violent crime" and was punishable by death under Athenian law. The Greeks loved to see those people on a "high horse" get their lumps.
I think the Greeks were on to something; I think the security community is starting to react to Oracle's bull. Gartner has said they are no longer a "bastion of security", researchers are working overtime to poke holes in their products, and they're spending increasing amounts of money to bolster their image. The stage is set, and I think we're there's some major divine wrath on the horizon.
Posted by Ed at February 24, 2006 08:46 AM