Oracle Has More Flaws Than SQL Server

jcatcw writes, "Next Generation Security Software Ltd. of Surrey, England, compared bugs in Oracle and SQL Server that were reported and fixed between December 2000 and November 2006. The tally: Oracle had 233; MS SQL had 59. The products compared were Oracle 8, 9, and 10g; SQL Server 7, 2000 and 2005. From the article: '[The head of the survey said,] "The results show that the reputation that Microsoft SQL Server had back in 2002 for relatively poor security is no longer deserved."' Oracle's response: 'Measuring security is a very complex process, and customers must take a number of factors into consideration — including use-case scenarios, default configurations, as well as vulnerability remediation and disclosure policies and practices.'"

Comments

translation

[User 956]

Oracle's response: 'Measuring security is a very complex process, and customers must take a number of factors into consideration -- including use-case scenarios, default configurations, as well as vulnerability remediation and disclosure policies and practices.'

Oracle's response in english: Clearly you have no idea what you're doing, because your results showed us in a poor light. Perhaps you'd like to try again. We have a bag of money for you.

Re:translation

[Anonymous Coward]

Lets face it, its just another crappy security company looking for some limelight.

The method is crap, the analysis is flawed and the conclusion a load of junk

Re:translation

[HairyCanary]

I tend to agree. But Oracle does have a point. Trying to distill a security argument down to number of bugs is oversimplifying. The severity of the bugs, how easy they are to exploit, etc are all important to consider. Even more important in my opinion is how quick the vendor is at fixing them. If Oracle's average time to fix was 24 hours compared to six months for Microsoft, the 4:1 bug ratio is not such a big deal.

Re:translation

[Anonymous Coward]

more bugs fixed is not the same as more bugs

if anything my bet is less outstanding bugs

Re:translation

[jedidiah]

Oracle's response in English: We don't force bundle our product onto servers where it really shouldn't be in the first place.

Insist on driving through the 'hood at midnight and you probably better be armed and armoured. Take the sensible approach and avoid doing this and you can likely skip the ablative armour and the AK-47. Microsoft likes to look for trouble. Most of their security problems stem from this.

Re:translation

[SatanicPuppy]

It's typical MS fud. They LOVE to harp on how many bugs their competition has, but there is a hell of a lot more to it than quantity. Slammer anyone?

Oracle is a huge robust database with lots of extremely security conscious clients. A high number of reported bugs and fixes shows that they're executing due diligence, and working to keep their system as secure as possible. MSSQL's low number of bugs suggests that Microsoft isn't digging hard into their code, but only waiting for big public flaws.

They used the same argument in claiming that IE was less buggy than Firefox (see this crappy article) and it's just as untrue in this case.

Re:translation

[Anonymous Coward]

I'm not an oracle person, but from my understanding oracle allows you to have finer grained security on data, stored procedures and so on than sql server. Perhaps the complexity of oracle compared to sql server is part of the reason there are more bugs.

Lets face it, a bug report can be anything from a misspelled error message to a gaping sa/root/admin (whatever oracle calls it) compromise.

Severity is important. For instance, most popular linux distros (minus gentoo) have quite a few security holes do to third party package inclusion. Often the holes are not severe, but they do make linux look artificially insecure compared to some other operating systems. If redhat pushed 90 updates a month at you and Microsoft only 35... well who looks less secure? How many were feature enhancements? How many did each vendor NOT include a fix for?

Disclaimer: My above reference to linux distros only includes bloated packages like redhat, suse, etc. Most people using these distros tend to do a "full install". I'm a mysql or sql server user whenever possible.

Often one could argue that smaller companies get less attention so a large number of vulnerabilities would indicate a very insecure product. Oracle is obviously smaller than microsoft as a whole. In this case, oracle gets a lot of attention as its used for large scale deployments as well as their *lovely* business practices.

Re:translation

[ZachPruckowski]

You're right. This survey is pretty messed up. I mean, we're comparing *bugs fixed*. Not bugs still open, or any measure of severity, or what got exploited, or any measure of turn-around time.

This is like saying that Fire Department A put out less fires than Fire Department B. That's nice, but what I really want to know is how long it took for the trucks to arrive, the size of the fires, and also if there are any houses that burned down before the Fire Department got there.

Re:translation

[drzhivago]

I didn't know that SQL Server 2005 was standard with Windows 2003 Server. When did they start bundling it?

Re:translation

[arivanov]

Oracle is also the database with the longest time to fix security bugs. I will simply quote the message from BUGTRAQ which is most relevant to this thread. It about says it all:
Thor (Hammer of God) wrote:
David Litchfield is one of the most predominant security researchers in the field, particularly in the area of database security. He and NGS have discovered more combined security vulnerabilities in leading DBMS products than anyone else in the world.
Given this fact, I think that not only is it appropriate for David to give whatever opinions he chooses in his research, but that it is his opinions that actually give the research real, tangible, applicable value. With his indisputable status as an authority on database security and his unwavering integrity, I have no problem whatsoever in considering Dave's opinions to be "fact."
Actually the whole discussion on BUGTRAQ is definitely worth reading. By the way the vulnerability behind Slammer was discovered by guess who - David Litchfield.

Re:translation

[Anonymous Coward]

Slammer anyone?The slammer worm was released in 2003, and affected a vulnerability that had been patched eight months prior. The last discovered vulnerability for SQL 2000 was in January 2004. A high number of reported bugs and fixes shows that they're executing due diligence, and working to keep their system as secure as possible.heh. You used Oracle and Due Diligence in the same sentence. MSSQL's low number of bugs suggests that Microsoft isn't digging hard into their code, but only waiting for big public flaws.Possibly. There is another possible reason for the low number of discovered flaws, but I don't think you want to hear that one.

Re:translation

[Anonymous Coward]

wow, defending Oracle with nothing, not a very convincing argument. I don't know how the hell you pulled out that last sentence, "If Oracle's average time to fix was 24 hours compared to six months for Microsoft, the 4:1 bug ratio is not such a big deal.", yeah , I see that's IF, but it doesn't really contribute to the discussion of this particular summary now, does it? STAY ON TOPIC.

Re:translation

[drinkypoo]

MSSQL came from Sybase 10, which was a quite excellent database with a much better reputation than Oracle at the time. It didn't scale as well, but it was quite a bit faster on mid-size data sets. If this is the one division in Microsoft that's employing people who actually fix bugs, I'd say this is an entirely credible report. Given what a PITA Oracle is in general, it's not even unlikely.

Re:translation

[drinkypoo]

Oracle's response in English: We don't force bundle our product onto servers where it really shouldn't be in the first place.

Arguably every OS should come with an RDBMS and applications should make more use of it instead of depending on a broad assortment of different mini-databases like sqlite and such. There's nothing wrong with them on their own but with ten programs that each use them, I've effectively got ten copies of sqlite (tiny - not a big deal) which each may be of a different version (which is a big deal since some or all of them may have holes) instead of just having one database that gets updated, along with its client libraries, every time a hole is found.

Insist on driving through the 'hood at midnight and you probably better be armed and armoured. Take the sensible approach and avoid doing this and you can likely skip the ablative armour and the AK-47. Microsoft likes to look for trouble. Most of their security problems stem from this.

My data might be in the hood, and I might have to go there to get it. In which case it's necessary for my RDBMS to be able to get there. Microsoft has many flaws, especially in the realms of security and freedom, but they do have quite a bit of versatility in terms of what you can run on, what you can run with, and what programs you can run. I can play DOS games, which originally used direct video memory access, on Windows XP in most cases - in fact, in many cases where Windows 9x games don't work because DirectX is less back-compatible than the OS :) As always there are both flaws and benefits to taking the Microsoft approach. I personally do feel that the drawbacks outweigh the benefits but that's a separate discussion.

In the really real world, Oracle is much more complex than MSSQL, which was originally based on Sybase 10, right before Sybase 11 came out. Even when that happened, sybase was more reliable than oracle in many ways, and faster on all but the largest data sets. I see no reason to believe that since those days, the quality of the Oracle code has improved more or been degraded less than the quality of the MSSQL code.

Re:translation

[tbannist]

Remember as long as Microsoft doesn't acklowedge the bug exists, it doesn't count!

Re:translation

[jedidiah]

>> Arguably every OS should come with an RDBMS...

There's no good reason that such a facility would be open to remote exploitation or even have a facility that could be set up in a remotely exploitable fashion.

Although this isn't about what your mother stores all of her recipes on. This is about what your bank stores your net worth on.

Re:translation

[drinkypoo]

If you look around, peek your head around and such, lots of banks aren't even running any Microsoft anything. Wells Fargo for example uses a Unix-based system with X Terminals at the teller windows. I sincerely doubt any bank worth mentioning is storing my data in MSSQL. (with all that said, my current bank uses windows PCs as terminals, because they are stupid.)

Re:translation

[A_Non_Moose]

Lets face it, a bug report can be anything from a misspelled error message to a gaping sa/root/admin (whatever oracle calls it) compromise.

If that is the case, oracle's mgmt tools heavy reliance not only on java, but *specific* version of java
w/o updates I'm aware of, would explain a lot.

off the top of my head:
Input fields that don't register the first key press, menu item that don't redraw for some reason, refreshes and connection errors that require exit/relaunch.

Other frustrations like that, that aren't oracle's "fault" per se, but don't help the spec/check sheet for bugs.

Didn't RTFA (yet), but are those counted as bugs? I'd like to know.

Re:translation

[thsths]

> Arguably every OS should come with an RDBMS and applications should make more use of it instead of depending on a broad assortment of different mini-databases like sqlite and such. There's nothing wrong with them on their own but with ten programs that each use them, I've effectively got ten copies of sqlite

Try ubuntu. It comes with one version of sqlite (3.0), and every piece of software can use only this version. So from amarok to xine, they all use the *same* sqlite library. And you get security updates just hours after the discovery of a new problem.

Otherwise, I completely agree. The way Windows handles dependencies (in words: not) is just ridiculous.

Re:translation

[The_Wilschon]

You might also want to know how many houses in the area are built like tinderboxes.

The bottom line is of course "Am I more likely to have a security problem while using Database A or while using Database B?" Perhaps some studies ought to be done to determine the relationship between measurable things like number of bugs, time to patch, etc, and various user's perception (or perhaps security pros' perception) of how many security problems were actually had. Then we'd be able to actually assign some semblance of meaning to these currently utterly meaningless studies of "number of bugs". I don't think that even knowing time to patch or severity of potential exploit or such things would really tell anyone much about the bottom line as I have described it, at least not unless some real investigation of the relationship is done first.

And of course this doesn't just apply to databases, but to any sort of software which has any security consequences at all (which winds up being essentially all software).

Re:translation

[Lonewolf666]

Arguably every OS should come with an RDBMS and applications should make more use of it instead of depending on a broad assortment of different mini-databases like sqlite and such. There's nothing wrong with them on their own but with ten programs that each use them, I've effectively got ten copies of sqlite (tiny - not a big deal) which each may be of a different version (which is a big deal since some or all of them may have holes) instead of just having one database that gets updated, along with its client libraries, every time a hole is found.

The One Big Version has its own problems, especially versioning. Sometimes, an upgrade will break compatibility and suddenly some of your applications are fuxxored. I've seen it happen with the RichEdit DLL in Windows. Somewhat offtopic, but it still illustrates the point.

The assortment of different mini-databases is less susceptible to this, especially when they get updated through new versions of the applications. That guarantees that app version and database version match.

Re:translation

[drinkypoo]

Well, I do use ubuntu on my personal laptop, but at work I am forced to use windows so it doesn't help me. (I'm also forced to use OSX, sigh. I'd rather windows.) And, if I download a binary (they're a lot rarer these days but they're still around) it won't help me.

Re:translation

[sbrown123]

Nahhh. You're making too much sense. To find an easier explanation, I just used the common excuse for defending the security holes and bugs in two popular Microsoft products: Internet Explorer and Windows. What you have to say is "more people use Oracle, so that is why there are more security holes and bugs".

Re:translation

[Allador]

This is exactly how the Jet system works on Windows machines. There's only one version in the system, and its ubiquitous, and available to anything and everything that can consume ODBC or OLEDB. No dependency issues there.

And if you choose to install the completely free SQL Express (known as MSDE in prior versions), you still have one version for the entire system, patched centrally. You can opt to use multiple instances, but its all using the same set of binaries.

Re:translation

[abradsn]

I agree, counting bugs is an oversimplification...

My biggest surprise here is that they only found/or reviewed less than a couple hundred bugs each. Strange, because I am sure that I can find more bugs than that in 4 days work on each product. This research can't be all that deep. I must be missing something???

Any normal QA person would be able to find that many bugs in 10 or 20 days.

Re:translation

[Psiren]

Well, it's not a bank per se, but the London Stock Exchange recently converted to SQL Server. As far as I know, there have been no major problems. No doubt they had a team of Microsoft guys on site for months before they threw the switch, but then with a job that big you'd need to.

I'm going to assume a great deal of the bitterness towards SQL Server on here is just because it's Microsoft. However, it has its roots in Sybase, which when I used it several years back I found to be very good. We've not had any problems with SQL Server at my current workplace either. My experience of Oracle is one I'm happy to forget, but I recognise its great versatility. Just a shame you have to pay through the nose for it.

Re:translation

[drinkypoo]

Actually I don't have much problem with SQL Server except that it has Microsoft's name on it and thus Can Not Be Trusted(tm). Anything that furthers the Microsoft attempt to dominate the world is Bad in my book. Ultimately my biggest complaint is that IMO nothing mission-critical should ever run on windows, and that's the only place you CAN run MSSQL.

Re:translation

[Anonymous Coward]

So let's see here: you don't have any reasons why, but you sure have a strong opinion that MS SQL Server is a Bad Thing (TM).

Re:translation

[aztracker1]

SQL Server comes with Windows Server SBE (Small business Edition)... Honestly, SBE is a pretty decent value, if it fits your needs as a company. I think of MS's server line, Web Edition is the best value... but hey, I actually like IIS. And yeah, I know about apache... My personal preference is IIS + PostgreSQL ...

I know that oracle is king on enterprise db's.. but honestly, if you can't afford a full time oracle dba, odds are you don't need oracle.

Re:translation

[HomelessInLaJolla]

> Arguably every OS should come with an RDBMS and applications should make more use of it instead of depending on a broad assortment of different mini-databases like sqlite and such

From a standpoint which values security I completely disagree. When I say security I mean multiple facets: security of user data, security of userspace code, security of kernel code, security of development, securing the system from one outside group of contributors gaining too much control over the core system, securing the system from business interest which may or may not give a rat's backside about the individual developers, etc.

I can see the need for a database in multiple places in the system: the kernel, the window manager, the desktop environment, in productivity applications, in integration between theoretical code and real-world tasks, etc. Giving all of the facets of security (examples above) the top priority, though, I would much rather see individual codebases all implement their own database system which is tailored specifically for the needs of their code. If multiple development teams, across multiple projects, feel the need to strongly integrate various aspects of their databases then they should feel free to make connections, manage their interoperability, and adapt to each other.

Putting one catchall database on a system weakens too many aspects of security. Again, this is not just from a point of view that considers just the code being crunched by the processor in memory. This is from a long-term point of view that keeps in mind the fact that development teams have member turnover, that competing codebases are often in a footrace that should be encouraged to change hands (eg. Xorg vs. Xfree, uwm vs. metacity, Enlightenment vs. KDE, BerkelyDB vs. MySQL, LILO vs. GRUB, ESP-GS vs. AFPL-GS, CUPS vs. LPR/ng, Mozilla vs. Opera, etc. etc. etc.). Even if the user is given the choice of having this db or that db, I would rather see the option of "No centralized DB--make the individual projects write their own". It will be more effective for future innovation, diversification, and overall system improvement.

Take an example from nature: once past the level of basic DNA/RNA nature will try any and every possible combination and strive to allow all possible combinations to exist simultaneously. I sincerely doubt that userspace code will ever reach the level of significance in computers that DNA/RNA has in the function of the cell. Humans seem to be the only force who insist on standardizing everything. It would be possible to devote an entire college of study groups to analyzing the psychology, sociology, and politics of why humans are so dense--but I'll leave that to the reader to consider over their own cup of coffee.

Re:translation

[Bo'Bob'O]

My database program is far smaller, faster, cheaper, has ZERO bugs, and will never corrupt your data.. so long as your data is "Hello" and "World".

Re:translation

[Anonymous Coward]

Slammer? That worm was devastating, but it hit in January of 2003. MS patched that vulnerability on July 24, 2002 -- a full six months earlier! The problem was that MS had a DB engine so cheap that anybody could get it, and many users (myself included) left unpatched servers open to the Internet. Unfortunately, once a vulnerability is patched, anybody can reverse engineer an exploit. In fact, it's quite possible that the only thing MS could have done to prevent it is to have waited to release a patch until there were a number of other fixes, that particular problem may have gone unnoticed and thus unexploited.

Oracle is lucky in that it is so damn expensive that the only people who could afford it could also afford a separate machine, a firewall, and a DBA. Meanwhile, Oracle has the balls to advertise their system as "unbreakable", and everybody is out to show that it clearly isn't. Is it any wonder that more flaws are found for Oracle? Fortunately there are way fewer Oracle systems out there on the Internet, so exploits can't easily propogate. That hardly makes Oracle more secure.

dom

Re:translation

[gungh0]

Oracle & Microsoft have different ways of counting bugs. Microsoft don't count a bug until they have verified & reproduced it (if ever), Oracle count it when its reported.

Re:translation

[Anonymous Coward]

What about zero advisories after one year from the initial release? http://secunia.com/product/6782

Re:translation

[Zarluk]

according to NGSS, which has worked for Microsoft in the past to make its software products more secure.

LOL

This sentence says all one needs to know about that "study" ;-)

Unbreakable?

[Anonymous Coward]

Unbreakable?

?

Does this suprise anyome?

[zimm0who0net]

Oracle has a million more configuration options than SQL Server. It only makes sense that there will therefore be many more bugs.

Re:Does this suprise anyome?

[Anonymous Coward]

Oracle has a million more configuration options than SQL Server.

Oracle is also an ancient code base, with origins far older than contemporary use cases (extranet, n-tiers, etc.) There is cruft in Oracle that dates back to the mid '80s and it's showing.

Oracle needs a through refactoring. They'll either do it under their own steam or the market will do it for them. In the mean time they'll continue this sisyphean bug fixing of latent vulnerabilities, while smart DBAs mitigate the problem according to their own means.

I'm also concerned about Oracle's development practices. Quality is continues to be poor for the first few releases of any new feature. Witness 10g EM; there are .nohup files lurking in (*nix) log directories. I find that astonishing. ASM won't be suitable for widespread use for two or three releases, 11xR2 or something. That should have been right on try #1 six or seven years ago.

Re:Does this suprise anyome?

[IdleTime]

There is cruft in Oracle that dates back to the mid '80s and it's showing.

Oracle needs a through refactoring. They'll either do it under their own steam or the market will do it for them.Well, no not really. There is old code in there, but it is not cruft, but well functioning code. I'm also concerned about Oracle's development practices.What? Can you explain what you mean because I have no idea what you are talking about. Quality is continues to be poor for the first few releases of any new feature. Witness 10g EM; there are .nohup files lurking in (*nix) log directories. I find that astonishing.Huh? What exactly war you talking about? Oracle does not store any files in standard *NIX log directories. ASM won't be suitable for widespread use for two or three releases, 11xR2 or something. That should have been right on try #1 six or seven years ago.

Completly wrong. Thousands of customers are using ASM today and with great success. Please explain what the heck you are talking about.

Re:Does this suprise anyome?

[pestilence669]

While Oracle has more flaws it certainly is a much more complex product, so it stands to reason. Besides, Oracle vs. SQL Server is not a fair comparison at all. SQL Server is quite bare.

The "flaws" I've experienced with SQL Server either made my server crash or corrupted my databases to all hell. I've never had an Oracle server (or any other vendor's product) corrupt my tables, thank you very much. I think MS brought this "feature" over from their Jet / Access engine.

If you compare the severity of these flaws, not their category, I think you'll find that SQL Server has many more *unrecoverable* flaws. That's been my experience with every version since 7.0.

Re:Does this suprise anyome?

[Anonymous Coward]

And how many configuratios does it take to store data? I did think this was supposed to be a database not a configuration server. Oracle and even MS, like a lot of products, have overwhelmed the user with a bunch of default configurations that most do not use or want.

Re:Does this suprise anyome?

[Anonymous Coward]

The article was way too vauge so lets count the number of vulnerabilities that an unauthenticated attacker can perform which causes them to inject code/take control of the system simply by having network connectivity to the target RDBMS.

The slammer worm sucked but AFAIK that was the end of it for MSSQL server. There were *several* for Oracle.

Security advisories for the RDBMS platforms contain all kinds of bugs not related to the core server, web platforms, tools..etc. They add to the count but I rarely find any that I'd care about. I've often read through some vulnerability listings for Oracle that contained dozens of them and didn't find a single one that made me flinch. We generally just use the core server.

As far as ACL complexity and related problems I don't really buy into that. Most systems that don't control all RDBMS interaction use views and stored procedure to enforce 'fine-grained' security. There really is not much of a feature or complexity difference in this area between these two platforms.

Re:Does this suprise anyome?

[Anonymous Coward]

Well, no not really. There is old code in there, but it is not cruft, but well functioning code.

Reliance on System V shared memory and semaphores is only one of many examples of cruft. This API originated on Unix back when it was used to operate embedded systems like (very old) phone switches and has been obsolete for years on Unix, replaced by mmap and forgotten in the dust bin of history. Oracle is the only existing horizontal platform I am aware of that still uses it, and probably the only reason any modern Unix still supports it. In case you don't know, this old API is the reason you must explicitly configure kernel parameters (shmmax, semops, etc.) on Unix to support Oracle. The API is so old it lacks any provision for the memory capacity that has been commonplace for the past 15 years. I can understand this still going on in, say, 1995... but in 2006?

Huh? What exactly war you talking about? Oracle does not store any files in standard *NIX log directories.

Oracle doesn't store any database files in standard Unix log directories. I wasn't referring to database files. I was referring to Enterprise Manager log files.

The *nix thing indicates that this is the behavior on Unix et al, as opposed to Windows. I don't know what Oracle does on Windows; Windows doesn't provide nohup, so I doubt .nohup files are littered around the file system.

$ORACLE_HOME contains a log directory where, on Unix, you will find 'log' files that have the extension '.nohup'. They have that extension because a standard Unix command called nohup was used to invoke a process.

The nohup program shields the process from certain signals (specifically TERM) which allows the process to continue running even after the login shell that started it ends. It is frequently used by administrators that need to insure a process continues running in case a terminal connection (via remote ssh, for example) is severed.

One also, occasionally, will see nohup used by shoddily packaged commercial software to prop up programs that weren't designed to operate as daemons. There are accepted techniques that are supposed to be used to make a process run as a daemon on Unix and nohup isn't among them. nohup is used to daemon-ize commercial software by those who lack the knowledge to do the job properly or are indifferent to the quality of their product. Amateurs or sluggards; take your pick. There are developers at Oracle that know better. They obviously had nothing to do with this work, thus my questioning Oracle's development practices. Exactly who is responsible for this crap and why is it being allowed to ship like this?

Beyond that the EM log files, such as they are, are an unconscionable mess. It looks like something fresh out of development, not yet ready for even early QA. Some of us actually care about this. Megabytes of opaque debug statements do not promote vigilant monitoring of services. It's half-baked script kiddy work, plain and simple. I pay for this stuff, not apologize for it.

Completly wrong. Thousands of customers are using ASM today and with great success. Please explain what the heck you are talking about.

Thousands amounts to a small fraction of one percent. ASM is how Oracle should have been handling storage by default for at least half a decade by now. I guess I have high expectations of the premier RDBMS vendor and the second largest software developer on Earth. Yet, one only needs to read the Metalink support requests and recent patch notes to see that you need real Oracle expertise to approach ASM. It is not ready for general consumption and is being ignored by typical Oracle operators. That is a real shame. My annual Oracle support costs are too high to forgive it.

There are contractual reasons I chose to post this as AC. If you should care to respond I will see it. If it isn't clear, I do know 'what the heck' I'm talking about. I've made the effort to courteously respond to your questions, and I'd appreciate like treatment.

Re:Does this suprise anyome?

[fimbulvetr]

Ahaha! That AC pwned you! I for one, am glad someone could point out specific examples. I am deeply unimpressed with Oracle. It follows few, if any, unixy practices, and turns admins into complete idiots while promoting itself as unbreakable.

The only thing that's unbreakable with oracle is the contracts and ndas.

Summary title is vague

[ArcherB]

MSSQL is a SQL Server. MySQL is a SQL Server. Oracle is a SQL Server. Please be more specific and explain which SQL Server you are talking about.

Granted, the summary does explain that the article does indeed refer to MSSQL Server, but please stop calling it just SQL Server. MSSQL Server != SQL Server

(OK, I feel better. What is the moderation for RANT?)

Re:Summary title is vague

[jimstapleton]

Actually, Microsoft's SQL Servier is the only one of the three that actually has "SQL Server" in it's name, or even as it's name.

Re:Summary title is vague

[linuxmop]

No, not really. MySQL [Community Server] is a database server that supports SQL. Oracle [Database] is a database server that supports SQL. MSSQL [Microsoft SQL Server] is a database server that supports SQL. The latter is often known simply as SQL Server.

Re:Summary title is vague

[hey]

Yes, please don't let Microsoft own the name "SQL Server". It so wrong to say just "SQL Server"!

Re:Summary title is vague

[stuktongue]

Butters, goddammit!

Re:Summary title is vague

[Anonymous Coward]

...but please stop calling it just SQL Server

YES! I'm tired of ceding parts of the English language to Microsoft. How did Microsoft end up owning the word Windows, forcing Lindows and wxWindows to be renamed, when X-Windows has been around so long? If Microsoft can't be bothered with coming up with unique names for its products, don't let them take over common words by dropping the "Microsoft" from the name.

Re:Summary title is vague

[Anonymous Coward]

I am sooooo happy that I'm not the only one who is hurt about the "SQL Server" thing...

Thanks!

Re:Summary title is vague

[hobo sapiens]

Microsoft just so happens to be so uncreative that they gave their DB server application a name that is merely a description. Calling it SQL Server is appropriate, since that is, after all, what it calls itself and as far as I know, is the de facto name for the software. Yes, it's a bit like calling a Web Browser WebBrowser. Blame MS for picking a nondescript name.

Re:Summary title is vague

[Jamu]

Same thing with "%*$^ing piece of $^%* database". How can you tell if they are talking about MSSQL or Oracle?

Re:Summary title is vague

[M. Baranczak]

Microsoft just so happens to be so uncreative that they gave their DB server application a name that is merely a description.Could have been worse...

Re:Summary title is vague

[hobo sapiens]

could have been worse still...it could have been called iMail or something equally repulsive.

Re:Summary title is vague

[hclyff]

Mozilla Firefox is shortened to just Firefox, Microsoft Windows to Windows and so on - it's just a product called "SQL Server" from a company called "Microsoft".

Also it's known as SQL Server to everyone who ever worked with it.

Re:Summary title is vague

[ferretworks]

Have to agree with the masses. Calling it SQL Server seems to only piss off the people who don't work with it. I don't call the Office suite Microsoft Office. It is just Office. Microsoft was clever in their naming schemes. If I am talking about a SQL server that is Oracle, I wouldn't refer to it as "Oracles SQL Server", nor would MySQL be "MySQL SQL Server".

That would just be silly.

So, your anger is Microsoft's gain. And every time you get angry at Microsoft, they kill a kitten.

Re:Summary title is vague

[Billly Gates]

Microsoft's marketing department uses active and positive verbs and nouns in naming their products so they appear to be better than the competition as well as the human brain memorizes mnuemics easily. Examples are, explorer, Word,Excel, access, active directory, and MS SQL Server. Microsoft's core customers are pretty clueless when it comes to technology and use their stuff to get work done. Using positive and active simple names that represent what they do does make a difference. If your thinking "SQL" subconsciously when your wondering whether to purchase a database your brain will be more likely to remember "SQL" server first. Its great marketing

THe name is no different than the MS Word processor. Yes that is the name of the product but other word processors exist as well. So Microsoft calls it Microsoft SQL Server to show its theirs and what the product does.

Re:Summary title is vague

[osee]

[Slightly OT]
Yeah, and please don't let Red Hat own the name Linux.
I am sick of people posting about Linux 6.0 or whatever.

We can expect people to talk in precise terms, but it's not going to happen in the foreseeable future :-P
[/Slightly OT]

Re:Summary title is vague

[drinkypoo]

Actually, the name of the product is "Microsoft SQL Server". Still a stupid name but it's not just "SQL Server". Lazy techies are responsible for not using the full name, not that I blame them. What I want to know is how Microsoft managed to convince a court that the name of another product of theirs was actually "Windows" and not "Microsoft Windows" (look at the box sometime!) which forced all those other people to change their product names.

Re:Summary title is vague

[espressojim]

Or, you just call Oracle SQL Server "Oracle".

As in: Why is &#@*& Oracle ignoring my indexes and forcing a hash join on two 1M+ row tables AGAIN? GAAAAH!

People will know what you mean.

Re:Summary title is vague

[hobo sapiens]

Actually, the name of the product is "Microsoft SQL Server"

true, but I guess that's why I said SQL Server is the de facto name. Technically not correct, yet people know exactly what you are talking about when you say SQL Server.

Hey look, everybody! An article about cybernetic entomology spawned posts about cybernetic entymology! Only on /.!

Re:Summary title is vague

[catalyst]

Saying that "a SQL Server" is a generic term for an RDBMS is no more appropriate than saying that Linux is a "PERL Server". The fact that a derivative version of SQL happens to be one way (and it is far from the only way on any modern RDBMS) to interact with the database does not in any way mean that the database *is* the language. No DBA (and I am one) would perceive any ambiguity in saying "SQL Server" to mean M$'s product specifically.

Re:Summary title is vague

[jZnat]

I'm pretty sure the nesting in the trademarks is ((Microsoft)® Windows)® (at least in the US).

Re:Summary title is vague

[Anonymous Coward]

Since the name of Microsoft's SQL Server is, you guessed it, SQL Server, I think most people that should read this article understood the product name in title. Besides, as you said, the summary clearly mentioned Microsoft, which makes your rant even more pointless.

If the title had said "Oracle Has More Flaws Than A SQL Server," then I could understand the dilemma. Fortunately, that mistake was avoided and the product title was clearly denoted.

By the way, it's more accurate to say MS SQL Server than MSSQL Server.

Re:Summary title is vague

[Anonymous Coward]

It's not a matter of them being uncreative. It's a clear and easy to understand marketing strategy, as another commentor so aptly pointed out. What do you think of when you think of a Word processor? I'm guessing OO.org Writer, but until you beat it out of your head, I'm sure it was MS Office Word and it probably at least gets a thought or two by accident.

Re:Summary title is vague

[entrylevel]

Or... *shudder*... eMail!

Re:Summary title is vague

[John Hasler]

> What I want to know is how Microsoft managed to convince a court that the name
> of another product of theirs was actually "Windows" and not "Microsoft
> Windows"

They didn't. They were about to lose their suit against Lindows and with it the WINDOWS trademark when they ponied up enough cash to buy an out of court settlement.

Re:Summary title is vague

[hobo sapiens]

What do you think of when you think of a Word processor?

Word. Ok fair enough. But notice it's not called "Word Processor Application" or "Document Authoring Application". That would be more in keeping with the naming scheme we are discussing.

Re:Summary title is vague

[hobo sapiens]

heh heh...I just noticed you said "look at the box"

You must be new here, they don't have boxes on warez sites, silly!

Re:Summary title is vague

[ArcherB]

No, not really. MySQL [Community Server] is a database server that supports SQL. Oracle [Database] is a database server that supports SQL. MSSQL [Microsoft SQL Server] is a database server that supports SQL. The latter is often known simply as SQL Server.

I understand where it comes from, but SQL and SERVER are both industry terms, link ANSI, ASCII or C. When someone says a program is written in C, do we assume that it was written with Borland C? I just don't like the way MS trademarks generic names to try to become THE industry standard. Windows, Word, Publisher, and Media Player are just a couple of examples.

Re:Summary title is vague

[Anonymous Coward]

I just don't like the way MS trademarks generic names to try to become THE industry standard

Actually, they generally don't trademark them because they can't, they are generic names. They ALWAYS refer to them as "Microsoft Word" or "Microsoft Windows"; its a gutsy move because there's nothing stopping Borland from creating "Borland Word", etc.

Re:Summary title is vague

[A Life in Hell]

It can get away with it because the name is not officially "X-Windows" :). From the manpage:

The X.Org Foundation requests that the following names be used when referring to this software:
X
X Window System
X Version 11
X Window System, Version 11
X11
X Window System is a trademark of The Open Group.

Re:Summary title is vague

[ArcherB]

Tell that to Lindows...er Linspire.

Re:Summary title is vague

[Surye]

Oh?

Re:Summary title is vague

[Blakey Rat]

(OK, I feel better. What is the moderation for RANT?)

-1, You know what he meant you pedantic ass

Re:Summary title is vague

[mythz]

No they are all RDBMS's. SQL Server is the marketing term MS used to call their RDBMS.

Re:Summary title is vague

[ferretworks]

My point exactly. We have a mix at our location here. Everyone refers to the Oracle server as Oracle, and everyone refers to the Micosoft SQL Server as SQL Server.

Thats the way it was before, now and forever. Amen.

Re:Summary title is vague

[Tim C]

Blame MS for picking a nondescript name.

It's not a nondescript name - it is in fact about the most descriptive name you could possibly give a database! It is an SQL server. You can't even talk about SQL servers without making at least a subconscious connection to MS SQL Server (and almost everyone I know calls it just "SQL Server").

Rant about MS subverting yet another generic term for one of its product names, but as a marketing tool, it's a stroke of genius. Cute names are funny and appeal to techies, but "does what it says on the tin" names make a good, strong association with the product type.

(Note that I'm not commenting on the fitness of MS SQL Server, just its name)

Re:Summary title is vague

[GWBasic]

Shhhh... You just hit on Microsoft's naming secret: Trademark the generic term!

A couple of years ago, (before I started working with MS SQL), I had the generic term "SQL" on my resume. I remember when an idiot recruiter called me and couldn't understand that SQL wasn't an exclusive Microsoft product.

Lesson learned: If you make a product that competes head-on with a Microsoft product, include the generic in your name. For example, Oracle should call their "DB Oracle SQL." OpenOffice should call their word processor "Open Word."

Re:Summary title is vague

[Anonymous Coward]

Microsoft just so happens to be so uncreative that they gave their DB server application a name that is merely a description.

"SQL Server" comes from Sybase, not from Microsoft. I wonder why do everyone has to be so "creative" in the IT field and talk about everything even when they have no clue.

Re:Summary title is vague

[Anonymous Coward]

yay, someone did five minutes of reading about SQL Server and Sybase. Congratulations. Now read an article on grammar and write us all back when you learn to construct a proper sentence, mmmkay?.

Oh, and I slept with your mother.

And why

[El Lobo]

And why did you expect it to be the other way? Because the two letters prefix? Biased.

Oracle is more complex

[sitturat]

Anyone that has tried to read (or even tried to lift up) one of the oracle manuals knows that this is seriously feature-rich and complicated stuff. It would be more interesting to see how many bugs per line of code the two contenders have.

Re:Oracle is more complex

[Nerdfest]

Bugs per line of code is no more useful than plain old number of bugs ... which is basically what Oracle is saying. Number of bugs does not take severity, risk, etc into account. The article also only refers to the number of bugs _fixed_, not remaining.

Re:Oracle is more complex

[MrScience]

SQL Server's documentation has gotten so large that they only ship it on-disc. 6.5 had 10lbs of books.

Re:Oracle is more complex

[l0b0]

Off-topic, but the manuals are totally utter bug-f###. Trivial examples, no examples, arcane structure (The web is not a friggin' book), and very few links to related information. They would do good to change the manuals when they are seriously lacking, but I guess that goes against the "buy lotsa books" mantra of old dinosaur companies.

</rant>

but ...

[kylie69]

what about IBM DB2?

Oracle is right

[Josh Lindenmuth]

While the # of vulnerabilities is unacceptable, Oracle is right ... just comparing the # of bugs is not really valid. Now if Oracle has had more Severe security violations that Microsoft, it would be a different (and far more interesting) story. Oracle is still a more robust database, so one would expect there to be more bugs than another app with fewer modules and lines of code.

Re:Oracle is right

[Anonymous Coward]

Oracle is still a more robust database, so one would expect there to be more bugs than another app with fewer modules and lines of code.

Your definition of "robust" must be wildly different than mine. I tend to use Webster's definition, where "robust" means "capable of performing without failure under a wide range of conditions". Obviously, you seem to think that the more robust the software, the higher the bug count!

Re:Oracle is right

[gregmac]

Comparisons of number of bugs are NEVER fair. The situation is even worse in a closed-source environment, because we may never actually see all the bugs that get fixed. Even in open source, we sometimes fix bugs in the code with filing a report. Sometimes bugs are filed for a misspelling in the user interface. Sometimes 4 or 5 bugs are reported based on behaviour alone, and upon inspection, there's really one root problem (maybe even something simple) that's causing all of those bugs, so one fix goes in and 5 bugs get closed. Does that count as 1 bug or 5? Do these studies of # of bugs take that into consideration?

Even calling something "severe" or not is a judgement call. I've seen many times a bug filed as severe only to have a developer look at it and refile it as trivial.

On top of all of this, it's not hard to "game" this system to make your company/project look better. Just raise your standards for what can be classified as a major vs minor bug (eg, file everything a bit lower than it normally would be). This standard is going to be set differently by different management teams and companies, so it's already skewed to try to compare. Someone trying to look like they have fewer bugs may also ask their team to refrain from filing bugs if they can (kind of like factories do with workplace accidents - they have incentive systems for employees/supervisors, part of that "We've gone X days without an accident" thing.. what really happens, is employees won't report accidents if they can get away with it because then they lose their incentives). At another company, they may have a policy to file bugs for EVERYTHING, so every change to the code requires a bug/feature ticket. What happens when you compare the # of "bugs" in these two companies?

Re:Oracle is right

[itlurksbeneath]

Agree. The RDBMS itself is a small part of the actuall delivered stack of code that delivers a wide range of functionality.

Plus.. Number of times MSSQL Server (a.k.a Sybase fork) has brought my larg organizations IT infrastructure to it's knees - 1. Number of times Oracle has done the same - 0. And we've been running Oracle a LOT longer (mid 80's, I think) than we have MSSQL Server.

Re:Oracle is right

[Anonymous Coward]

Why is this modded troll? It's spot-on. "Robust" was the wrong choice of word for the parent. "Complex", maybe, or "feature-packed" if you're in marketing.

Re:Oracle is right

[Anonymous Coward]

SQL server 2000 was a complete re-write. There is no SyBase code left in MS SQL Server. Speaking as the maintainer of a mission critical medical database for several years, running MS SQL Server I can only say taht those who have experience sever problems are not doing something right. I have no idea what, but they are obviously not doing something right. Subtracting a hardware failure (raid controller) that was serious enough to bring the box down until it could be replaced, and the 10 minutes per month to apply patches (bare minimum installs, and only security patches applied as needed, reboots are fast when needed) There was no downtime.

Re:Oracle is right

[Anonymous Coward]

I agree. I am an IT manager for a medium size hospital that uses Oracle, MSSQL, Sybase, and DB2. MSSQL always runs with no issues. The others DBMS require daily tweaking and have constant problems. The DBA's are far more expensive as well. We will continue to push for more MSSQL just because of the TCO.

Re:Oracle is right

[itlurksbeneath]

Speaking as an Oracle dba of 9 years, if your DBA's have to tweak the database daily, you need to fire them and hire some new ones that know what they are doing. I've got Oracle databases that run for years with little or no tweaking (aside from the mandatory critical patch bundles from Oracle)

Even if they are dealing with crappy vendor supplied SQL in a canned application, that should only take a few months to line out after each new version of the canned app. After that, it should just run.

Re:Oracle is right

[Doctor Memory]

those who have experience sever [sic] problems are not doing something right

Like creating large tables with multiple indexes? SQL Server is infamous for corrupting data and indexes when things get too big for it to handle (tables over 500GB w/ 10+ indexes). There's a reason why big shops like to run DBCC CHECKDB once a week or so...

Features?

[eluusive]

Did they also mention that Oracle has 300 times as many useful analytical features as SQL Server? I use SQL Server 2005 at work and it's pathetic. Postgres is more useful!

Re:Features?

[ergo98]

I use SQL Server 2005 at work and it's pathetic.

My spidey senses tell me that you've never actually used SQL Server at all.

Re:Features?

[molarmass192]

... not to mention that it's virtually impossible to lose data in an Oracle database. You can literally take a mish-mash of old backups from an Oracle db and have a solid chance of recovering your data if you run in archive log mode. I can't imagine anybody keeping data they give a damn about in MS-SQL, especially considering that it only runs on one of the most insecure OSes known to man. Yeah, Oracle is way too expensive and complex, but if you need your data available 99.999%, it's really does offer the best guarantee of meeting that availability.

Re:Features?

[Control Group]

How did this get modded "informative?" There's no actual information in the post, aside from a claim about "300 times as many useful analytical features," while providing no definition for "useful," much less anything like even a glimpse of what those "usefule analytical features" are.

Really, this post parses to: Product A is WAY better than brand X! Even product C is better than brand X!

I see claims like that in TV ads all the time; I'm not tempted to call them "informative."

Re:Features?

[LordEd]

How did this get modded "informative?"

To get moderated on Slashdot, take your formula:

Product A is WAY better than brand X! Even product C is better than brand X!

Next, assign appropriate products to your variables, where X is a microsoft product, A is a popular open source product, and C is a different competing product.

You can get additional mod points by combining the word "Microsoft" with one of these words ("DRM", "Security", "BotNet", "Genuine Advantage"), and add a negative spin to the sentences in relation to product X.

Re:Features?

[necrogram]

A database engine is only as good as the way it was depolyed. just because a product is from Vendor B instead of Vendor A, doesnt mean that product is going to be instantly better and gaurentee 5 nines. Oracle on a crappy box, no real backups, and a smack-tard of a dba thinking he can be a system/network as well? Well, thats a crap shoot. MS-SQL on a cluster with HA boxes with a steller Fibre Channel and Ethernet/IP backend, killer DBA's and network/sysadmins, strong backup policy and methods? I think those databases will stand a lot better chance of hitting 5 nines. I'm not being a Oracle hater or a MS-SQL fanboy, but data availablity is not just about the RDBMS alone. Its also about the environment the RDBMS is depolyed in.
 
Oh btw, I've MS-SQL running mission critical databases for years, and I've never had to say "We lost data". It aint luck that keeps me from saying that.

Re:Features?

[Anonymous Coward]

Same here, mission critical SQL Servers running for years. I've had half my SAN drives disappear due to work the (big name) vendor was doing ... no lost data. Got a written apology from the vendor, and we never let them do "routine" work during office hours again. Started the server back up half an hour later when they had recovered the disks ... no lost data.

It all comes down to the sysadmins. If they know what they are doing, then Windows and SQL Server will run fine.

Re:Features?

[SageMusings]

I think he meant "MS Access".

Seriously, I wish people could come up with cogent arguments instead of "sux, half-assed implementation, or crashes all the time"

My organization uses SQL SERVER 2005 and we have had nothing but great success. I especially love the XML data type with schema binding. In my recollection, the only failures we have had was either hardware-based or DBA-error.

Cheers!

Re:Features?

[eluusive]

Okay, I'll give you one real example: SQL Server didn't even have ANY windowing functions until 2005, and they're still seriously crippled compared to Oracles -- even postgres as better analytical capabilities. Try doing a moving average WITHOUT a cross join -- Good luck. SQL Server is actually pretty decent -- until you start comparing it to things like Oracle and Postgres.

Re:Features?

[eluusive]

At least somebody around here isn't a hater :) Seriously, I'd rather use postgres than this shit -- and it's free. Recovering your server after an OS failure if the drive names change is annoying to say the least. I've had nothing but trouble with all of it. On top of that it's statistical and analytical features are pathetic. The best part is the new Enterprise Manager replacement. Microsoft SQL Server Management Studio (say that three times fast) has a tendency to rewrite queries for saved views using their tools instead of raw SQL statements. I wrote up some _valid_ sql in the view editor and saved it and it rewrote it into a bunch of garbage that didn't work right. (This happens quite alot, aside from it changing my indentation and screwing it up so you can't read it)

Stop counting flaws!

[91degrees]

The number of flaws doesn't matter. a slice of cheese has one flaw as a database. It isn't a database. This doesn't make it a better product.

Re:Stop counting flaws!

[Anonymous Coward]

Reminds me of a totally offtopic thing one of my profs said. Something along the lines of:

"Be very skeptical of any tool that claims to be able to automatically fix bugs. Let's say I have a word processor. I will dictate the code to you in its entirety: int main, return 0. Give that to your tool, and tell it to fix any bug that causes it to deviate from the behavior of a word processor."

Re:Stop counting flaws!

[TLouden]

Well, I'd think the cheese is much less prone to security failures. Only physical access is going to have any affect and even then, nothing of value will come of it.

Re:Stop counting flaws!

[gludington]

The number of flaws doesn't matter. a slice of cheese has one flaw as a database. It isn't a database. This doesn't make it a better product.

You are vastly oversimplifying, and clearly have not funded a study of the market. Cottage cheese passes an ACID test, and I hear that Swiss Cheese is full of holes.

Check the data and the criteria before deciding

[Graabein]

and customers must take a number of factors into consideration

Not least the criteria for selecting and enumerating flaws, and any differences between those criteria for the two products. Not saying that there is a problem, just that any prospective customer needs to take this into consideration and check his facts.

This whole study reminds me of a couple of years ago, when someone decided to make a comparative list of security flaws between Windows and Linux. For the former, they only included official Microsoft security fixes. For the latter, they included just about every bug in every open source project known to man. Big surprise, Windows was found to have less flaws.

When it comes to security, trust no one. Especially not research firms, security "specialists" and people mouthing off about security on Slashdot.

Hey, waitaminute....

Reported AND fixed

[nels_tomlinson]

From the summary: ... compared bugs in Oracle and SQL Server that were reported and fixed between December 2000 and November 2006.

Reported and fixed means that the company which doesn't fix bugs looks more secure. Not that I'm implying that MS is worse than Oracle on this, mind you. I just wanted to point out that this metric has loads of potential flaws.

Re:Reported AND fixed

[nigelo]

>> I just wanted to point out that this metric has loads of potential flaws.

Stop counting flaws!

What, specifically, are those "bugs"?

[khasim]

Between December 2000 and November 2006, external researchers discovered 233 vulnerabilities in Oracle's products compared with 59 in Microsoft's SQL Server technology, according to NGSS. The study looked at vulnerabilities that were reported and fixed in SQL Server 7, 2000 and 2005 and Oracle's database Versions 8, 9 and 10g.

Let's see that again.

The study looked at vulnerabilities that were reported and fixed...

So, if it wasn't fixed, was it counted?

The results show that Microsoft's software development life-cycle processes appear to be working, he said.

Huh? Security is not about "software development life-cycle".

That's why you have almost daily updates of anti-virus software for Microsoft products.

In an e-mailed comment, an Oracle spokeswoman said the number of reported vulnerabilities in a product alone is not a measure of the overall security of that software.

Big time. One remote root vulnerability is worth 10,000 local app crash vulnerabilities.

"Measuring security is a very complex process, and customers must take a number of factors into consideration -- including use-case scenarios, default configurations as well as vulnerability remediation and disclosure policies and practices."

Yep. Because Ubuntu has, by default, no open ports. So it is, by default, 100% resistant to worms.

Remember, you can never count on a user applying a patch. Your system has to be as secure as possible in the default, unpatched, configuration.

Basing a product's security just on the number of vulnerabilities discovered and fixed may not be the best approach, said Pete Lindstrom, an analyst at Midvale, Utah-based Burton Group.

Not only is it not "the best approach", it is a fucking idiotic approach only used by morons who have no understanding of what "security" is.

It's not the number of bugs. It's what access can be gained by that bug and how easily it is to invoke that bug in the various "standard" configurations.

Re:What, specifically, are those "bugs"?

[Rich0]

While I agree with 95% of what you said, I'd take issue with this:

Ubuntu has, by default, no open ports. So it is, by default, 100% resistant to worms.

Not all worms require open ports to spread - a worm might target a low-level kernel flaw in the network stack (remember the ping-of-death?).

Re:What, specifically, are those "bugs"?

[Anonymous Coward]

So, if it wasn't fixed, was it counted?My understanding is that they counted both the number of bugs and the number of bugs that were fixed.
  Huh? Security is not about "software development life-cycle".Yes, yes it is in part. A well developed system which had accommodation for security from the get go is inherently more secure than a system with security 'hacks'.
  Big time. One remote root vulnerability is worth 10,000 local app crash vulnerabilities. Remember, you can never count on a user applying a patch. Your system has to be as secure as possible in the default, unpatched, configuration. It's not the number of bugs. It's what access can be gained by that bug and how easily it is to invoke that bug in the various "standard" configurations.They are a security firm; surely we can assume that they did more than just count the number of bugs without taking anything else into consideration? In any case, I trust their opinion more than I do some random slashdotter's.

Re:What, specifically, are those "bugs"?

[d3fault]

Yep. Because Ubuntu has, by default, no open ports. So it is, by default, 100% resistant to worms.I wouldn't say 100% resistant to worms. There could still be points of entry if all ports are closed. Doesn't mean it's vulnerable but still.

Re:What, specifically, are those "bugs"?

[d3fault]

Damn, you beat me to it. I blame CNBC for distracting me momentarily.

Re:What, specifically, are those "bugs"?

[odourpreventer]

That's why you have almost daily updates of anti-virus software for Microsoft products.

And? AVG has almost daily updates too. It's a Good Thing.

Re:What, specifically, are those "bugs"?

[Allador]

"Huh? Security is not about "software development life-cycle"."

Absolutely a software development life-cycle has alot to do with security. With this lifecycle you do things like threat assessments, determine attack vectors, plan to minimize surface area, do code reviews, use your static analysis software to find bugs that lead to security holes, train your developers in secure coding techniques and practices, etc. The SDLC in this case is 'the plan' to minimize the risk of vulnerabilities being found, and to mitigate their damage when they are found.

"That's why you have almost daily updates of anti-virus software for Microsoft products."

What do daily updates of AV products have to do with MS software development practices? AV software is signature based. So if a new piece of malware is written, even if it doesnt use a single vulnerability in any product, it just relies on social engineering and stupid users to infect, it still requires a signature update. Has nothing to do with MS' software development practices.

"Remember, you can never count on a user applying a patch. Your system has to be as secure as possible in the default, unpatched, configuration."

Correct, and that led to the design and the installer and the default configuration of SQL Server 2005 in its various flavors. For example, SQL Server 2005 Express, when it installs, it defaults to not listening on the network at all (only uses shared memory access, which is basically an IPC), and defaults to not using standard sql security (so you cant have blank passwords, no sa account, etc).

Re:What, specifically, are those "bugs"?

[Anonymous Coward]

All, and I do mean ALL, research is doomed to succeed. Security firm or not, they do not get publicity without a "profound discovery." By all means, look into their research methods before completely discounting their study if you desire. But it is perhaps equally foolish to blindly credit a research firm as it is to blindly discredit a "random slashdotter."

Re:What, specifically, are those "bugs"?

[Calinous]

I probably am wrong, but, hell, this is the place to be wrong :D I know in order to respond to ping, one need to accept it. As ping is working on a certain port - ICMP 20. If one has the ICMP 20 port closed, would he be vulnerable to ping vulnerabilities?

Re:What, specifically, are those "bugs"?

[plumby]

And as far as I can tell, AVG is anti-virus software for Microsoft products.

It's not a Good Thing that this is necessary (which, I'm guessing, was GP's point - Microsoft, and its software development lifecycle, produces OSes that are so insecure that they require anti-virus tools to be updated daily).

Re:What, specifically, are those "bugs"?

[Rich0]

Depends. If you have a hardware firewall running on a non-linux box the ping-of-death would not have worked (assuming the hardware firewall was immune). If you're using iptables I'm not sure if linux was vulnerable. I forget the details but the problem was essentially a buffer-overflow in the TCP/IP stack, so even if the port was closed the kernel would still have to process the packet just to figure out what port it was destined for, and that could potentially trigger a bug.

Put it this way - if a piece of data gets to a computer, then at some level some piece of software/firmware has to figure out what to do with it. If there is a bug in that code, then there might be a possible exploit. The risk is probably proportional to the size and complexity of the code that gets run, so a closed port is far less of a risk than an open one. However, any code could contain a bug - and that includes the TCP stack, the firmware on the NIC, the $20 router on the DSL line, etc.

It doesn't mean that the sky is falling - only that potentially any piece of code (whether in software or hardware) can contain a security vulnerability, and consequently that all vendors need to support their products with updates when necessary.

Hold on there!

[RemovableBait]

To quote from the summary:

"compared bugs in Oracle and SQL Server that were reported and fixed between December 2000 and November 2006."

(emphasis mine)

Now, I'll admit I haven't yet RTFA, but I think we've pretty much been through this before.

Just because there were more bugs reported and fixed in one product than another does not mean that product is more secure . There could have been hundreds of reported but as-yet-unfixed bugs in one of the products that isn't included. One company could have a greater emphasis on patching, squashing more bugs than its competitor. There could be thousands of unreported, unfixed and unknown bugs in both products. Perhaps not all of these bugs are security flaws. One product may have less bugs, but all of them are security related and none of the competitor's are. Need I go on?

The point is that these comparisons are sensationalism. The same happens in the whole 'Number of Linux patches VS Number of Windows patches' and 'Firefox flaws VS IE flaws' arguments -- and we all know the real story with those.

Re:Hold on there!

[DragonWriter]

Just because there were more bugs reported and fixed in one product than another does not mean that product is more secure .

Actually, the argument here is because a product has less bugs reported and fixed, it is therefore more secure than one with less bugs reported and fixed.

That this metric is clearly bogus is, well, pretty obvious, since with two initially identical products, with the same bugs reported, the product which has the fewest bugs fixed will be rated "more secure".

Re:Hold on there!

[jimicus]

There are also a couple of minor issues which aren't mentioned:

1. If you're buying software rather than developing it yourself, the first question isn't "is the database secure?", it's "does this software solve my problem?".
2. If you are developing software yourself and you're concerned about security, you should be putting a firewall between the database server and the app server, and setting various standards in your development processes which say things like "all data will be checked before being passed to the database"; furthermore you would test for such things as part of your standard test routine.

If MS SQL Server only had one vulnerability

[thewils]

...and it was Slammer, you'd have to admit it was kind of a biggie.

Re:If MS SQL Server only had one vulnerability

[Anonymous Coward]

..and it was Slammer, you'd have to admit it was kind of a biggie.

No, I wouldn't have to admit that. Oracle has [had] many remote vulnerabilities. The fact that so many SQL Server/MSDE instances were exposed on public gateways without firewalls had far more to do with Slammer's effects than anything else.

Oracle is generally not splattered about on DMZ hosts and random desktops. It's usually a tier or two behind an actual firewall. The behavior of MSSQL Server users made Slammer's effect on the Internet possible. If Oracle users had TNS listeners sprinkled willy-nilly on every second machine, the same thing would become inevitable.

More bugs fixed == less secure? Since when?

[Red Flayer]

... of Surrey, England, compared bugs in Oracle and SQL Server that were reported and fixed between December 2000 and November 2006. The tally: Oracle had 233; MS SQL had 59.

Maybe it's just me, but wouldn't it be more important from a security standpoint to determine which had more bugs that were reported and not fixed? Or even which has more bugs that weren't reported (which is, of course, undefined, and therefore invalidates this ridiculous study)?

Or perhaps weight the severity of the bugs?

I'm bitter today, but this mock-study is a joke, as are most security studies.

More FUD

[coastwalker]

All code has bugs. How many of the bugs are important to the users?

Who cares?

Re:More FUD

[hobo sapiens]

I have been programming MSSQL and Oracle for about six years now, day in day out. I have never encountered a "bug" with MSSQL. I have encountered one bug with Oracle. Big deal. Work around it. One bug in six years is not a huge thing.

I suspect that these bugs pose more problems for DBAs/sysadmins than programmers/users. As far as I am concerned, neither one is buggy from the perspective of someone writing software that uses these databases as a back end.

Even if Oracle has more bugs, Oracle is faster and pl-sql is more powerful than T-SQL. That is what matters. A fast DB means a fast application. Oracle spanks MSSQL in terms of getting lots of data quickly. A good query on a well indexed Oracle table beats a good query on a well indexed MSSQL table in every instance that I have ever seen. No hard numbers, but that's according to years of hands on experience.

Re:More FUD

[Anonymous Coward]

Have you seen the latest Ubuntu build? It's worlds better than Windows 95 - believe me I've tried both.

They both sound like risky propositions

[tcopeland]

I think we'll stick with PostgreSQL for our little database.

Who does mos of the meaninful transactions on-line

[Anonymous Coward]

You tell me who does most of the meaningful transactions on-line, and I will tell you who's code is scrutinized harder. I don't know of many banks that use MS-SQL server as there back-end for transactions, and for that matter, how many large e-commerce sites use MS-SQL for there back-end? Very little I surmise.

David Litchfied

[Cally]

It should be pointed out that this is not just A.N. Random UK Software Co trying to flog product. This is David Litchfield, one of that small number of security researchers whose names and work any self-respecting infosec analyst should be familar. He's done a lot of really superb security work, including trashing several versions of SQL Server; so he knows whereof he speaks.

NGS have of course done work on SQL Server for Microsoft; I refer you to the brief and rather one-sided flamewar on Bugtraq/FD that erupted when this was pointed out... actually see for yourself... (and here's the Bugtraq thread). I predict this will deal with 75% of the "but this is nonsense, because..." posts ;)

He's got a lot of credibility. This is the point I'm trying to make :)

Re:David Litchfied

[geoffspear]

That's nice, but argument from authority doesn't work when the methodology used is clearly bogus. If Larry Ellison announced that MSSQL is more secure than Oracle and based that assertion on the number of bugs fixed in a given time period, I wouldn't trust him either.

Re:David Litchfied

[jedidiah]

If anything, the given thread demonstrates what any sensible person would expect: He's not a database expert. He managed to make a number of obvious errors and mischaracterized a number of non-RDBMS bugs and bugs from entirely other products as Oracle bugs.

Re:David Litchfied

[Bryansix]

The only thing informative about this post is that David Litchfied just went on my shitlist of people to ignore.

Re:David Litchfied

[Bigmilt8]

Actually, David Litchfied is very familiar with both products. Do you remember that "Oracle is unbreakable" campaign. He was able to dispel that and Oracle sued him for it because he posted his findings on the net and didn't take it to them first. He had a valid case and the "unbreakable" myth got dropped fast.

I dunno about that

[palladiate]

Have you ever USED MS-SQL? At least the cheese doesn't take 45 minutes to report what flavor it is under normal load conditions...

Re:I dunno about that

[SScorpio]

You might want to consider redesigning your indexes if it's taking that long to run queries, or move it off the webserver/fileserver/mailserver/dbserver.

Re:I dunno about that

[Dragonslicer]

or move it off the... dbserver

Yeah, every competent DBA knows that you can't have your database on the database server.

Re:I dunno about that

[SScorpio]

No, you'd have a database server but not one that's also your file server, mail server, and web server.

Firefox Has More Flaws Than Web Browser?

[GodWasAnAlien]

NFS has More Flaws Than File Server?

yes, what exactly is the title talking about?

Re:Firefox Has More Flaws Than Web Browser?

[ImaLamer]

Since the GP started this, I'll bite.

They are called context clues. "SQL Server" is used above as a proper noun, look at the usage: "than SQL Server".

It's not "than an SQL server", not "than other SQL Servers", just "than SQL Server".

If you don't know that they are talking about Microsoft's product, then you are not in the DB business, and the story wasn't intended for you. (Not to say you can't read it, in fact if you RTFA you will learn that SQL Server is a PROPER NOUN).

No Sh*t

[Anonymous Coward]

should be from the "No Sh*t Sherlock" department

Re:Features? -- defend your answer!

[LordEd]

I use SQL Server 2005 at work and it's pathetic. Postgres is more useful!

How about defending your answer? What don't you like about SQL server 2005, and what do you like about Postgres that SQL Server 2005 does not provide for you.

So for from what i've seen in SQL Server 2005, it doesn't seem that bad. At work, we're experimenting with the new mirroring feature on some test servers.

59 bugs reported and fixed...

[Ant P.]

x bugs reported and ignored, y bugs not reported at all and not fixed.

Re:59 bugs reported and fixed...

[element-o.p.]

And don't forget the z bugs reported but silently swept under the carpet in the hope that no one would discover them.

My experience

[truthsearch]

I worked extensively with Oracle and SQL Server for 10 years at 2 companies. I ran into bugs with both systems. There was a vast difference between how each company responded to our bug reports.

We never contacted Microsoft with anything but the most severe bugs, and only those not documented on their web site. Even having the highest contract possible with Microsoft, they charged us for each phone call. Never once did the first 3 people we talked to have a clue. After going through 3 or 4 people we got to speak to a developer. For every bug except one, we were told to wait for the next official patch or Service Pack to fix our issue. One time we were fortunate enough to have a DLL updated by a developer and sent to us directly. Response by developers was very quick, but the other staff responded slow.

At the same time, Oracle was paying out $10,000 for each bug found. I thought I found the golden ticket. Turns out someone else had reported this extremely obscure bug I found earlier, but it wasn't yet published online anywhere. Every time we contacted Oracle we got to speak to a developer very quickly. On at least one occassion they sent a developer to our office to help investigate a bug. Every bug we reported got a patch very quickly.

The support from Oracle was far far superior to Microsoft. The bugs I ran into with Oracle were also far more obscure than those I found in Microsoft's SQL Server. I couldn't believe some of the things Microsoft left broken for months. Even if Oracle has a larger number of reported bugs I'd pick them over Microsoft any day.

Re:My experience

[ergo98]

Even having the highest contract possible with Microsoft, they charged us for each phone call.

Not only do even the basement support plans include free support calls, you are never charged if it's a bug in their product. So either you're a very poor communicator, a liar, or what you were calling about wasn't a bug at all.

Re:My experience

[aquatone282]

If you're not using your Super-secret Oracle Instant Support passkey, can I have it?

Please?

Re:My experience

[anto]

Have you tried to call MS & log a 'support' call - more than once we have had to hand over the credit card no before the call will be forwarded on. Of course with the promise that if there was an issue they wouldn't charge it.

Oracle on the other hand request your support contract no (which they will actually look up for you) once you get past that really minor issue you never hear anything about money again. If you are unlucky enough to have a real bug that gets escalated you have the fun experience of hearing from someone from oracle every few hours - the calls seem to come from all over the world (based on accents etc)

More than once I have had a custom patch created for what to oracle must have seemed like a really minor bug.

Re:My experience

[stinkbomb]

Uh huh. And how much were the respective licenses for each product? Yeah. I thought so.

Re:My experience

[dedazo]

What was your "high" contract with Microsoft? What level? Was it a regionally-supported contract (through your TAM) or was it direct with PSS? Was it part of an MSDN subscription? If so, what MSDN level, and whom did you purchase it from?

How many "bugs" did you find that Microsoft had to "charge" you for them? On a product that has existed for seven years, you or someone on your organization managed to find actual, undocumented "bugs" and then Microsoft actually went ahead and charged you for reporting them, even though you had this "high" contract with them. Correct?

I find it hard to believe that obvious disingenious FUD like this gets modded up to +5 - even considering the link to "msversus.org" on your user profile.

Re:My experience

[OriginalArlen]

Every bug we reported got a patch very quickly.Wait, this is the same Oracle that silently fixes bugs three years after they've been reported?!

This study doesn't make SQL Server look good. It's security record is pretty average over the last couple of years, since the SDL stuff Litchfield mentions. (A comparison of MSSS with MySQL and PostgreSQL... now, that would be interesting.) Oracle are without doubt the worst so-called "Enterprise Software" vendor going today; their attitude is notorious. The fact that they make MS SQL server look good by comparison is, I suspect, intended to tell you something about just how shit Oracle is, rather than how great MSSS is.

Re:My experience

[truthsearch]

I realize you're trolling, but I'll respond anyway. At both companies the finance and legal departments managed the contracts, with the DBAs kept in the loop, so I don't know the details. I was told we had the highest level contract outside of government agencies.

I have personally stumbled across at least a dozen undocumented bugs in MS SQL Server and VB. Most of the VB ones (which I didn't report) turned up in the "Knowledge Base" eventually. Every initial call to Microsoft support required the submission of a credit card number along with a contract number. The credit card was always charged and no reimbursements were ever made, even after confirmation of bug discovery.

I'm reporting personal experience. By definition it's not FUD. And msversus.org is my own site. It's not FUD either, because it's documentation of my own experiences and analysis.

Re:My experience

[swilver]

Oracle leaves stuff broken and calls it a feature, like treating the empty string as NULL. Or not providing standard 32-bit/64-bit numerical types which is incredibly annoying and short sighted as it means we now have to make sure that no numbers overflow somehow (either on our side or on Oracle's side, depending on how data is being updated) and cannot be stored safely into an 32 bit integer. Or imposing stupid limits that no other database imposes, like for example doing 200 INSERTs in a table which has a foreign key constraint, results in Oracle creating 200 "hidden" cursors to check these key constraints, and then has the nerve to complain to my program (that is only doing INSERTs) that I have too many cursors open. Using the highest transaction isolation level (serializable in Java) is completely broken. It would just barf on more than 500 INSERTs in a single transaction. And I'm not even touching the numerous other problems with for example the JDBC driver that cannot grasp the concept that we might actually want to treat CLOBs as Strings, and that we donot care that such a string may be 4GB in size. All-in-all, SQL Server, PostgreSQL and MySQL were 10 times easier to support and write programs for.

Re:My experience

[dedazo]

I realize you're trolling

Really? Why? Because I dared question what you said?

I don't know the details. I was told we had the highest level contract outside of government agencies.

I find it hard to believe that as a DBA having to support a database server within your organization you were not told what support level you had access to from the vendor. Normally you're given a fixed point of contact (for regional contracts this can be your TAM) and documentation as to what you can and cannot count on when you pick up the phone. You realize this sounds suspicious, correct? Or do you think I'm "trolling" here?

I have personally stumbled across at least a dozen undocumented bugs in MS SQL Server and VB

Well now, it gets interesting. Please, off the top of your head cite one undocumented bug in VB that you found that then went on to be part of a KB article. Please be specific. I'm sure if you found "a dozen" you must remember at least one, right? For example, a compiler problem? An issue with COM+? One of the common control libraries?

I'm reporting personal experience. By definition it's not FUD.

And since my personal experience differs greately from yours, and my knowledge of how PSS works within Microsoft negates your claims, I must be "trolling".

And msversus.org is my own site. It's not FUD either, because it's documentation of my own experiences and analysis.

Fair enough. I'm going to add a link to Microsoft on my Slashdot sig and see what effect it has on my "trolling".

Re:My experience

[Shados]

Either that was a long time ago and policies changed ( I wasn't working with SQL Server 10 years ago), or you were being lied to about the support contract. A simple MSDN subscription or microsoft partnership gives you at least SOME free calls. I'd be guessing "the highest possible contract" would give quite a bit more...

Sounds more to me like it was the "highest possible contract" they could find on the web site, and that was a decade ago, or something along that line. I'd feel gipped if I was you :)

Re:My experience

[dedazo]

ROFLMAO, that's rich. Well, here's another chance to mod me down as a "troll". Knock yourselves out.

Re:My experience

[Allador]

If this is true then you (or your company) was doing something wrong, because thats just not how the process works.

My guess is that your company bought a support contract, but you were still contacting the public PSS system. You should have had a 1-800 number plus a PIN or a dedicated TAM to work with.

I'm not sure who's fault this is, but I've seen this alot. The company pays through the nose for a support contract, and then the people in the field (for various reasons, mostly miscommunication or ignorance) use the public PSS contact numbers, and jump through this rigamarole with credit cards and the 1st level tech support.

Re:My experience

[Duhavid]

Actually, it's "you are not charged, if Microsoft, in their judgment, decide that it was a bug in their product."

But you have to hand over the credit card *first*, as the other poster said.

Re:My experience

[Chacham]

ike treating the empty string as NULL.

You do realize that's a setting that can be changed, don't you?

Re:My experience

[ergo98]

Actually, it's "you are not charged, if Microsoft, in their judgment, decide that it was a bug in their product."

With a real support plan, even the bottom of the basement MSDN program, you don't hand over a credit card. And presuming that the OP was just confused, and they didn't indicate their plan number right and did have to provide a CC on a general support line, again you are not charged (having given them your card or not).

And they are, from my experience, very liberal in what they define as a bug. Even where their documentation is iffy they'll waive the fee, because the fee isn't meant to be a profit centre, but rather is just intended to prevent people who don't want to both RTFMing.

Re:My experience

[ciggieposeur]

When did they change that?

Re:My experience

[Chacham]

OK, i feel like an idiot now. The setting is a Sybase setting: ANSINULL.

Thanx for the heads up.

Re:My experience

[dedazo]

I see you didn't reply to my post. It's very convenient to hide behind the "you're trolling" ad hominem instead of owning up to the fact that you're a liar and a karma whore.

Next time, avoid making claims that someone might question. You'll look a lot less stupid.

Re:My experience

[truthsearch]

The problem isn't your questions. It's your tone. You can politely ask, "What contract did you have? I'm curious because your story sounds very odd to me." But you chose to be a jackass. Hence your negative moderation.

I'm not hiding behind anything. I wasn't the DBA. Frankly I don't care if you believe my story. I'm sharing it and it's your choice to believe it. If you'd like more details I'd be happy to share what I remember. But since your attitude is so bluntly negative and accusatorial I won't bother.

You may also want to consider the fact that any one person's experiences may not be typical. That means my story may not be a lie and your positive experience may not be the same as anyone else's.

Re:My experience

[dedazo]

Hence your negative moderation.

Since you moderated squat in this thread, that's a nice theory but a theory nonetheless. Of course it always helps when you accuse people of "trolling" when their questions make you uncomfortable.

You've received enough responses here that question your honesty (or competence) in the matter that I pretty much could care less if you think I'm being a "jackass". Your "microsoft suxxorz and oracle roxxorz" and "I've found lots of bugs and I had to pay for reporting them" crap is exactly that - crap that was begging to be called out. And your "personal experiences" are of course accentuated by the obvious objectivity of your excellent website.

Have a great life.

Re:My experience

[Tim C]

Response by developers was very quick, but the other staff responded slow.

That's my experience from the other side - I'm a developer (although not for MS or Oracle), and on those occasions when I have to deal with a production support issue I try to clear it as quickly as possible. That's partly because I take pride in my work, and don't like to think of a user having an issue with something I've written for them, and partly because generally speaking bug fixing (especially live code) sucks so I want to get it over with. That said, it's an essential task, and I certainly don't rush it (if nothing else that would be foolish, as I'd only end up with more bugs to fix and a further dented pride), but neither do I take my time savouring it.

Chances are your developer experiences stem from the same desire to get the bug out of the way and get back to the "real" work of new development. Also, the original developers know the code much better than a support team would, especially if that team is supporting a range of products/apps, as is likely.

On a more controversial note, my admittedly limited experience of most (by no means all) dedicated first/second line support staff is that they're just not that good. Anyone who is any good quickly moves further up the chain, or over into development. The rest, well... there's most probably a reason the response was slow.

Re:My experience

[Duhavid]

My experience does not match yours. I recall having to get my bosses
CC for a call. It is possible that they did not have an MSDN
subscription, but we did buy the compiler. They might not charge
the card, I dont like the fact that they get to decide the issue.
I understand their stand on that, by the way, I am sure a goodly
number of people would refuse to concur with a legitimate issue
that should be charged.

And at another place, a coworker found a bug in RPC. It was like
pulling teeth to get them to acknowledge it.

I havent found them to be very good at finding answers, excepting in
one case. I called them once about using the objec model exposed
for the VC5x IDE ( automating builds ). The "we will be back in two
days with an answer" turned into "we dont know, sorry". I know this
is all anecdotal, dont take it as "Microsoft support sucks". But
so far, it has been more productive to beat my head against the wall
than to call.

Re:My experience

[Anonymous Coward]

> Uh huh. And how much were the respective licenses for each product? Yeah. I thought so.

You get what you pay for. Oracle support is world class. I've only been in the business for about 10 years but I haven't seen anything close to Oracle's response time to a TAR, bug in their software, or my own lack of skills.

I wish Oracle would power metalink with google's search engine, but other than that... I'm happy with where they are going, and how they are treating me in the process of getting there.

As for cost? Meh. .. again, you get what you pay for.

In Oracle's (Pseudo) Defence...

[Randolpho]

... they are rather quick to quash and fix a discovered security bug. Yes, there's a reason why I used both words. Check out the aftermath of this example at The Daily WTF.

You can thank Sybase

[MrDingDong]

First of all, the product was originally Sybase SQL Server. Sybase named it SQL Server, not Microsoft. Microsoft and Sybase were working together on it, then Microsoft gave Sybase the boot as they usually do.

Sybase's current product is very solid, very reliable, and easy to use. It is a dream to work on compared to Oracle and I've worked on all three products.

Microsoft has added some features to SQL Server, but all in all, it is probably still very much a Sybase product at its core.

Re:You can thank Sybase

[Sezzler]

Well, that was true in the early days, but MS recruited some pretty illustrious names prior to shipping version 7.0 - this was considered very much a rewrite. See Euan Garden's blog for the detail.

Re:You can thank Sybase

[dedazo]

Microsoft and Sybase were working together on it, then Microsoft gave Sybase the boot as they usually do.

Microsoft and Sybase were not "working together" on anything. Microsoft bought the source code for the Sybase RDBMS engine core and a royalty-free license to do anything they wanted with it, including competing with Sybase.

Microsoft has added some features to SQL Server, but all in all, it is probably still very much a Sybase product at its core.

Yes, it hasn't changed at all since version 6.5. Just like Vista is really not different than Windows 95.

Any other anecdotes?

Agreed!

[FatSean]

SQL server has always been a second-rater in the big DB wars. DB2 and Oracle being the best. They should have stuck DB2 in there too...

Re:Agreed!

[TweakMe]

Which DB2? All three?

Re:Agreed!

[Anonymous Coward]

Having worked in both an Oracle shop and a DB2 (UDB) shop, I can say this with certanty (even if I can't spell it): DB2 (UDB) SUCKS!!!! It is about 2 major versions behind Oracle in terms of features. It is also much more buggy then Oracle (from my experience). Now DB2 for Mainframes is another story. Though I have never used it, the DBAs that I know that have say that it is suppose to be quite good and very feature rich.

--AC

Re:Agreed!

[Anonymous Coward]

Having worked in both an Oracle shop and a DB2 (UDB) shop, I can say this with certanty (even if I can't spell it): DB2 (UDB) SUCKS!!!! It is about 2 major versions behind Oracle in terms of features.

Uh-huh. Sounds like you worked in a shop filled with people who grokked Oracle and only marginally knew DB2. Here's my short list of features I'd like Oracle to adopt someday that DB2 has had for at least 9 years:

1. Support for empty strings ("").

2. Support for date formats with millisecond resolution.

3. Support for ALL of the transaction isolation levels.

4. "db2 backup db dbname". 'Nuff said.

5. "db2 get db cfg for dbname". 'Nuff said.

6. Proper support for java.sql.Blob.

7. SMS tablespaces.

8. Proper support within a Unix scripting environment:
        $ db2 connect dbname user username using password
        $ db2 select * from table1 | awk '(... do stuff ...)' > file
        $ db2 load from file into table2
        $ db2 disconnect dbname

9. Having a unique primary key without having to explicitly create a sequence.

It is also much more buggy then Oracle (from my experience).

I haven't managed to bring down an Oracle or a DB2 database yet, but I have had the misfortune to program for both of them. Oracle is a PAIN. Limited subset of ANSI data types, no support for empty strings (which BLOWS when you've got a web frontend and need to store empty text fields), no decent integration with the Unix command line, lots of custom oracle.sql.* classes required rather than standard java.sql.* classes, and crappy documentation that they must have paid some high schooler to write.

DB2 OTOH had its faults but they were very few and far between, but its documentation is loads better than Oracle's AND it was freely available with the product. You get an SQL0192E, look it up, and it describes the problem, likely causes, and recommended actions. Only twice did I have to Google search for help beyond the DB2 manual. Oracle OTOH required multiple Google windows open at all times because their docs sucked so much.

Re:Agreed!

[Anonymous Coward]

> Having worked in both an Oracle shop and a DB2 (UDB) shop, I can say this with certanty (even if I can't spell it): DB2 (UDB) SUCKS!!!!
having spent decades working with both databases, responsible for everything from administration to programming to architecture, I can say this with certainty: nah, you're wrong. See Below.

> It is about 2 major versions behind Oracle in terms of features.
No, this was probably true around version 7 (~2001), but version 8 completely caught up and version 9 is a very cool product with improvements over oracle like:
      - multiple forms of partitioning that can be used in combination - some of which are free
      - native xml support (not xml shredding or pushing it into a blob)
I'm not saying that it is ahead of oracle on a feature list, but generally speaking it is neck & neck, sometimes a little ahead sometimes a little behind.

> It is also much more buggy then Oracle (from my experience).
Hmm, it depends on which versions and which feature sets you're looking at. I remember oracle 8.04 - that was a complete disaster. The db2 engine is very solid but some of the fringe products and features are a little disappointing. Not much different than oracle here.

Now, a few additional points:

1. db2 is about 50% of the cost of oracle - and some high-end oracle features like partitioning can come in at $10k/cpu but are free on db2. In fact, it is entirely possible to run a multi-terabyte data warehouse on a four-way server with a *free* version of db2 that would be completely competitive with a $240k (list price) version of oracle enterprise, and would beat the pants off mysql and postgresql. You'd be limited to 4gbytes of memory, and that's harsh, but you could live with that.

2. db2 is much simpler to learn than oracle - it is entirely possible to learn to become a db2 development & production dba on the job without classes over a few months. That just doesn't happen in the oracle world.

3. db2 is much simpler to adminster than oracle - oracle has always gone overboard with configurable details. This is sometimes a good thing, but usually it isn't. DB2 has fewer configuration parameters to worry about - often managing things better for you. For example, lets say that you have a very large table or tablespace spanning four raid arrays. You've done this to get great query parallelism on those big reporting queries. Anyhow, db2 will ensure that all data is inserted round-robin between them. Then it will also allow you to pull a container out of that set or add another one - very easily. And when you do that it automatically re-distributes the data to keep it balanced. This are trivial commands and it handles the details for you. Just one example.

4. DB2 scales higher than oracle. Look at most benchmarks - if you need to go really crazy, db2 can spread your data across a thousand servers, each with as many cpus and memory and disk as you want. Then you can partition another two different ways on each of those servers. This is speed way beyond anything that oracle can provide.

5. None of your licensing fees support Larry Ellison. That guy is an asshole and his insanity should not be fed with additional licensing revenue.

Ok, so db2 kicks a lot of ass on oracle. But I don't want to give the impression that I think it always wins, actually even IBM admits that when it comes to the largest transactional databases Oracle has the edge. But - having spent a vast amount of time on each, I now prefer db2. And none of my money goes to Larry. :-)

But which one has had more patent infringements?

[Anonymous Coward]

Seems like I remember MS having been sued a few years ago by a small company regarding some technology in MS SQL Server... Any such suits against Oracle?

Perhaps a key part of the wording...

[jamieswith]

"Reported AND FIXED"

Doesnt that mean that SQL server could have had 1000 bugs reported during that period, but only 50 or so got fixed?

It might be just poorly worded, but if this really was the metric... it doesnt really mean anything about security, in-fact one could argue that the higher number is better (since more were fixed!)

nail - head - smack!

[Anonymous Coward]

remind me again - how many times has Oracle software been used to DOS the ENTIRE freaking internet?

A few issues with the report...

[Anonymous Coward]

As a security practitioner, there are a few things that are wrong with this report:

The number of published vulnerabilities does not indicate how 'secure' a product of software is. In fact, CERT no longer allows its research numbers to be used in this way, as it is considered misleading.

Oracle has a different approach to security vulnerability reporting than MS does. Oracle follows the CVSS (Common Vulnerability Scoring System) to allow customers to determine the level of risk in _their_ environment, with _their_ configuration. MS does not follow CVSS.

Just for historical purposes, i looked to the NVD stats page (http://nvd.nist.gov/statistics.cfm) listed in the article. If you search for Oracle DB server 10gR2 in 2006, you only see 3 vulnerabilities listed. I can't see how the numbers can be accurate...

Also, let's not forget that MS has recently confirmed that they do 'silent fixing' by attempting to patch/fix multiple issues in patches, and they perform undocumented changes. Last I checked, all changes were available in the Critical Patch Updates from Oracle.

I do not pretend to stand for Oracle or MS either way, but, I do stand for a level evaluation - particuarly when it comes to security.

Re:A few issues with the report...

[blowdart]

Just for historical purposes, i looked to the NVD stats page (http://nvd.nist.gov/statistics.cfm) listed in the article. If you search for Oracle DB server 10gR2 in 2006, you only see 3 vulnerabilities listed. I can't see how the numbers can be accurate...

If you were going to compare you should have also looked up Microsoft SQL server for 2006 when there were 0. You should note that MS SQL Server isn't broken down by versions either.

In other news . . .

[SSalvatore]

both databases were reported to have more bugs than the Windows notepad.

Further studies also showed that the windows notepad was to be more difficult to use than pen & paper and that oranges have more juice than apples :)

ORLY?

[patrick0brien]

Well gee, even if it were true, I'd still be forced to run SQL Server on frickin' Windows!

As much as I dislike Microsoft products

[Billly Gates]

MS SQL is a great product. Its their only product that has had years of uptime that I have only seen on Unix boxes and its easy to use and powerful. This also was back in the NT4 days which was quite impressive.

I think this study might not be as much fud as some are making it to be. Oracle is the kitchen sink and has many components such as development tools an d apis that come with their product. Microsoft has them as well but bundles them with MSDN and VS.net. So if you compare the development tools that come with the database agaisnt just SQL Server and not their ADO.net and other .net tools then yes its an unfair comparison. I guess I need more details on the test to know what they tested.

If you offer a ton of additional features...

[emil]

...then it stands to reason that you will have a ton of additional bugs.

This argument in no way excuses Oracle for their timely patch cycle (or lack thereof), but may explain the higher number of patches.

I haven't looked at the Sybase/SQL Server family for awhile, but I assume that it still doesn't offer anything like Flashback, LogMiner, richer indexing, direct LGWR connection to DataGuard, resumable transactions, or even basic multiversioning.

Re:If you offer a ton of additional features...

[RevMike]

If you offer a ton of additional features...then it stands to reason that you will have a ton of additional bugs.

This argument in no way excuses Oracle for their timely patch cycle (or lack thereof), but may explain the higher number of patches.

It is also important that Oracle supports virtually any server platform in current use, while SQL Server only supports a small number of similar platforms. Back in 2001 I was still getting support for Oracle 7.0 on VAX/VMS! One get Oracle on Linux, AIX, Solaris, HP-UX, zOS, OS400, Windows, a variety of Alpha platforms, Itanium platforms, etc. And this isn't shallow level support. Oracle can utilize their own file systems, so they are going at the bare hardware on all these systems. Care to guess what that does to the QA cycle?

Oracle is the shiznit when it comes to high performance general database work. It will scale far beyond almost everything else, with DB2 a close #2. Niche players like TeraData have their place too, but only Oracle can scale across the entire enterprise.

Re:If you offer a ton of additional features...

[Doctor Memory]

Not to mention the fact that Oracle has optimized just about every function far beyond what can reasonably be maintained. The amount of special-case code scattered throughout the system means that fixing a bug requires that you test lots of odd-wad configurations and test loads. If the special case in the data loader that lets (say) Exxon-Mobil load a couple terabytes of data in three hours instead of a weekend introduces a new bug, do you think they'll honk off a major account or patch around it?

Plus consider all the strange stuff that Oracle supports that doesn't exactly follow standard relational practices (like nested tables) or even relational theory (like arrays). Sometimes it's a wonder their stuff works at all, let alone as well as it does...

Re:If you offer a ton of additional features...

[kpharmer]

> Oracle is the shiznit when it comes to high performance general database work. It will scale far beyond almost everything else,
> with DB2 a close #2. Niche players like TeraData have their place too, but only Oracle can scale across the entire enterprise.

Sure, if you're talking transactional systems (like airline reservations). But if you're talking about data warehousing, very large scale analytics - then db2 and teradata have the upper hand. Oracle's clustering is for failover, db2's clustering is for performance.

Re:If you offer a ton of additional features...

[fimbulvetr]

This is what I've been trying to say for a long time, and you did summed it up very succinctly in 1 paragraph. Good work. This is why we'll never see an end to the fixes/patches/bugs, and also why oracle will never attempt a rewrite. Had they been smart, they would have seen this coming 15 years ago.

The first rule of finding yourself in a hole is to stop digging. Oracle never realized they were in a hole.

Re:If you offer a ton of additional features...

[Anonymous Coward]

doesn't exactly follow standard relational practices (like nested tables)

There's nothing wrong with a relation with an attribute that is a relation. The fact is just that the industry doesn't even bother to read all the good work done by Date and Darwen in the Third Manifesto.

Re:MS Labs Has No Equal

[Nocturnal Deviant]

XP quite good now? apparently "Patch Tuesday" isn't in your monthly things to do list.... or checking windows update every day.... and as to the google comment... if Microsoft wasn't worried about google(shocking realization i know) then why is microsoft finally changing their browsers, and msn search since google and firefox came around..? google: Latest Windows XP bugs http://www.google.com/search?hl=en&q=Latest+Window s+XP+bugs&btnG=Google+Search ...OMGZ 51,500,000 results hey everyone just ordered my Kubuntu CD's I'm heading for the virtual hill's...in truth though I prefer Slackware. Back on topic though, I use MySQL, catching me using Oracle OR MSSQL, is a joke, with open source I don't have to scream and cry and throw chairs(reference http://www.theregister.co.uk/2005/09/05/chair_chuc king/) I can code my own fix 99% of the time before an official one is released.

Re:But which one has had more patent infringements

[blowdart]

One over CRM, One over the Peoplesoft take over (oh and Oracle sued the Justice Dept over that one and ended up asking Microsoft for help in the anti-trust stuff). Don't forget paying off a whistle blower, sex discrimination and the patent lawsuit of the customisation on its web suite.

Oh, and I assume you're talking about the TimeLine law suit? Actually that came about because TimeLine cancelled Microsoft's licensing agreement, which gave MS license to the patents. Unless you mean another law suit then please, stop trying to paint SQL Server as containing some sort of patent theft and Oracle as squeaky clean.

But when it goes "urk"....

[Snarfiorix]

I be most interested in, when I'm up shit creeck with a cluster that just went "whoopy" on me, is the response/fix time by the products support.

Don't say it won't ever happen...

Check out Oracle's wrongdoing!

[Anonymous Coward]

It's here: http://malfy.org/

Re:More bugs fixed == less secure? Since when?

[Anonymous Coward]

"but wouldn't it be more important from a security standpoint to determine which had more bugs that were reported and not fixed? "

Actually yes and if you RTFA you will see that this is what ORacle get slammed the biggest for, not only do they have lots of holes, they have lots of known unpatched holes and hence the upcoming week of zero day exploits being released.

huh?

[Anonymous Coward]

you don't have to admit that the biggest DOS attack in the history of the internet was big? that makes a lot of sense...

if one agrees that "the behavior of MSSQL Server users made Slammer's effect on the Internet possible" (I do) then can one not make inferences from the fact that windoze/MSSQL is the platform of choice for the clueless?

You find what you look for

[catalyst]

I have no doubt that freelance security researchers (the source for TFA) do indeed find more vulnerabilities in Oracle. But this is at least as much a statement about security researchers as it is about Oracle. Oracle is what everybody spends their time on because of the way it's perceived: it's the market leader, with a high-power image, and a CEO prone to wild bouts of very un-FOSS like narcissism. That makes a much higher-prestige target.

Besides, almost all of the Oracle vulnerabilities I've seen come down to configuration issues. Most of them seem to start with "ok, get a login with DBA privs", for crissakes. Perhaps if you think of "a database" as that MySQL instance running on your desktop this seems like something that is likely to happen, but you know, this is what DBAs get paid to do all day...

Re:Features? -- defend your answer!

[Anonymous Coward]

Unmaintanable views, doing reindexing or running a heavy takes over the server(heard of priority??) and half-assed inplementations of everything.
It starts sucking when you've used it a year or two, don't worry.
For me, it took 2 weeks to realize that the difference from 2000 is that it's *more*, not *better*. Not even *fixed*, really.
Why can't they put some serious work into the database itself, and not be so totally into charming the less knowledgeable?

BTW. Did i say i just loove postgres? *Cuddle*.

Or at least i haven't started hating i yet.

Yes it is complex to count flaws

[plopez]

Disregarding that what we have is *known or announced* flaws, Oracle may or may not be 'better' than SQL Server as:
1) Locking down SQL Server is much harder. It is easier to run Oracle as a restricted user than SQL Server, reducing vulnerability. SQL Server, if you want to use SQL Agent, replication or other high end functions requires you to elevate the privileges under which you must run it.

2) SQL Server is *much* more reliant on the underlying OS. Which means you may want to count at least some of the OS bugs as SQL Server security bugs as well. This is especially important due to item 1 above.

3) Up to SQL Server 2005, you could run 'xp_cmdshell' and fire off commands to the server or network (xp_cmdshell' now ships disabled and it should be left as such). Combined with 1 and 2, a user with Sysadmin could be compromised, then via SQL Server Net commands could be issued as if from a command line. If the SQL Server had access to network resources or if someone was silly enough to put SQL Server on a domain controller you could end up having a very bad week.

So counts alone are no measure of quality. You really have to look at the overall picture. I don't think Oracle is a great DB when it comes to security btw, definitely not as good as Oracle would have you believe, but I also think SQL Server is deeply flawed in some ways.

Re:Yes it is complex to count flaws

[Anonymous Coward]

Regarding point 1: Correct, about a six year old product (SQL 2000). SQL 2005 will run fine with limited permissions.

Regarding point 2: All applications are dependent on the underlying OS. Irrelevant.

Regarding point 3: Wrong. In pre-2005 you needed sa privileges to run xp_cmdshell, so no ... you can't "just fire off commands to the server or network".

More Flaws

[trongey]

I have more flaws than Oracle and SQL Server combined.

hmmm

[Anonymous Coward]

all the bullshit i see is anti microsoft oriented because you simply hate microsoft.
if you were actual programmers or administrators like you claim to be then you would just accept the fact that SQL server is A BETTER option.And if we look at SQL server 2005...we can see that Oracle simply screwed up and should really step up.
SOON.
Hate microsoft as much as you won't but for fucks sake be fair.
Their SQL server is a stable reliable and top class software out there.
Post...and mysql are children...oracle is the competition but this year they lost.

Re:Features? -- easy to defend your answer!

[Anonymous Coward]

An obvious area is geospatial features.
Oracle has Oracle Spatial. PostgreSQL has PostGIS.

With SQL Server, you need to buy an expensive third party package (like ESRI ArcSDE or MapInfo Spatial) that does not work as well as PostGIS because ESRI doesn't have the hooks they need deep enough into the database to add spatial index types.

The PostgreSQL/PostGIS GIST index types are very well suited to geospatial data. The R-trees that I believe Oracle uses are good as well. Does SQL Server have R-tree indexes?

You can say the same about extension languages - SQL Server's fine if you want to extend it in their dialect of SQL (I hear their C# stored procedures exist but are recommended against) - while with Oracle you have their (very powerful) dialect of SQL and Java - but with PostgreSQL you have Java, Perl, C#, R (a SPSS clone), Ruby, etc.

Other pretty basic SQL Server features end up being hidden in their $40000/CPU versions of their product; so you won't see them in even moderately high volume products like Cisco's switches like postgresql is - or really large databases like GlobeXplorer's (http://postgis.refractions.net/documentation/case studies/globexplorer/) - yes, I know about Terraserver but note that Micrsosoft doesn't have to pay for their own licenses.

So basically, yes, it's not hard to defend the claim that even the most expensive SQL Servers with the most expensive third-party-ad-ons are pretty limited compared to PostgreSQL.

This just in

[mattwarden]

My left arm has more dead skin cells than my right index finger.

Different Uses - why compare?

[slightcrazed]

Why would one even want to compare SQL server and Oracle. Are the 2 really in the same league? I have installed both at many sites and there has always been very clear criteria which dictates which gets installed at what site: Amount of users and knowledge of sysadmin. If I know I'm working with a guy with 10 users who thinks that AIX is a type of sportbike, then he gets SQL server and my direct phone #. If I'm at a site with 1500 users with top notch sysadmins then they typically get a high end unix/linux machine with either an Oracle or Informix DB. I have flat out refused to install SQL server at some sites based on the above criteria. I just don't understand the comparison. As soon as SQL server can run on something other than an intel box (and hopefully something other than Windows) and can handle the kind of workload that I expect without grinding to a halt then I might think about installing it at some of the bigger sites I work with.

Re:Different Uses - why compare?

[Anonymous Coward]

You are a perfect example of "nobody gets fired for selecting Oracle" which is an unfortunate (but expensive) truth. I suggest that you look into SQL Server 2005 and its capabilities. You might be surprised at what you find. Oracle and Microsoft are in the same league.

While I don't agree with the article regarding counts of bugs and security, SQL Server is a quality product.

SQL Server

[nurb432]

That is the one product that microsoft 'got it right' with. Thou i dont agree with the new pricing structure of 05, when they hit the 2000 version it was actually a good product.

Not that im a MS fan, but i do give them credit when its due.

Re:MS Labs Has No Equal

[pfdietz]

There was some work at Microsoft's research labs that came out in 2001 that's directly applicable to this thread: Don Slutz's work on massive stochastic testing of SQL systems. Basically, he generated random SQL queries and threw them at several database systems, looking for discrepancies and crashes. This kind of testing is disturbingly effective at finding weird bugs.

I would not be at all surprised if Microsoft has banks of servers do nothing but continuous randomized testing of their database product.

Re:Features? -- easy to defend your answer!

[Anonymous Coward]

Funny, people complain about MS products being bloatware, and here you are complaining that SQL Server doesn't have an built-in GIS solution. Its an RDBMS, not a geospatial package. How much does that Oracle Spatial cost anyway?

$40000/CPU? Which type of dollars? Or do you mean lire? More like 12000 Euro/CPU for the fully-featured Enterprise Edition. This really is the most expensive license, there are many cheaper alternatives. Note that this is per chip, irregardless of the number of cores per chip. SQL Server is cheap.

The reason people advise against using the CLR in SQL Server is because the languages it supports (the Java, C#, Perl you speak of with Postgres) are not declarative set based languages. You shouldn't be running junk like that on the database server. They are database servers, use the languages that they were built for. Only developers would want to run procedural languages on an RDBMS :-(

Where's the rest of the picture...

[urlgrey]

What about our friends from IBM with DB2 and our friends at MySQL and PostgreSQL?

I realize they're only comparing the two, but why?

That's a bit like only comparing BMW and Lincoln when comparing car brands for safety. Sure, it's useful to see one relative to the other, but removed from the overall marketplace, it's not a particularly useful comparison.

try running it on a real server

[wardk]

oracle beats down sql server.

period

oh, and try running sql server on a real server. (sybase doesn't count)

Oracle Flaws

[bachzart]

The article states "...233 vulnerabilities in Oracle's products compared with 59 in Microsoft's SQL Server technology". It compares Oracle producs to SQL server. I get the Oracle bug lists and more often than not they are not database vulnerabilities but rather vulnerabilities in their tools like SQL*Plus, iAS application server etc. I wonder if anyone has a true count of database-only vulnerabilities? One might also be tempted to turn M$ lovers' own logic back on them: "Oracle has more vulnerabilities because more people use it than SQL Server"

SQL Server 2005 has zero published security bugs.

[Anonymous Coward]

Yes, because it's hard to compare against Microsoft SQL Server 2005's ZERO PUBLISHED SECURITY BUGS. That's right folks, Secunia have listed no security vunerablities in Microsoft SQL Server 2005 at all.

(For comparison, Oracle 10g's entry, with six hits from 2006, one of which they list as unpatched and another as partially patched. 13 advisories overall.)

Is it a valid comparison?

[fishbowl]

In other irrelevant comparisons, drag race VW's go through more transmissions in a hundred miles than a stock bugs will in a hundred thousand highway miles. Does that mean drag race trannies are inferior, or does it mean stock trannies are better? Or did we omit something important from our comparison?

As someone who knows both very well

[floydman]

The fact that thre are actually ppl who are comparing Oracle RDBMS with MSSQL is hilarious.
I did not read TFA..and I think its a waste of time to do so.

I mean you can compare Oracle with DB2 (and that wouldn't be fair yet...but at least i will start listening)

BUT MSSQL is barely comapred to MS Access...

enough said.

Re:More bugs fixed == less secure? Since when?

[Anonymous Coward]

The problem with that is disclosure. Vendors typically dont disclose the bug until after the patch is out, and many security companies like NGS have a policy to not disclose until either the vendor has okayed it or a sufficient time to patch has passed. And even then, the vendor sometimes hides security patches in other updates.

So in other words, we dont know how many vulnerabilities exist until they are patched.

SQL Server & Oracle

[Bhavesh]

So at least Microsoft is improving its security issues. But I reckon Oracle is working hard to fix bugs.

Re:Features? -- defend your answer!

[timjdot]

I really like Postgresql too. It is just easy and works right. And, of course, is the oldest. I'm not sure of how Postgres compares to Mysql. Seen any good comparisons?

Having worked with all of them from the programmer's viewpoint I can definitely say none stands out as steller adn all offer the same feature set. I always hear people state Oracle has high performance but NEVER saw that to be true. What I saw alot of was having to hand-tune the indexes. Oracle's query optimizer must not work. Even in join queries unused fields have to be selected due to Oracle's non-working query optimizer. That said, it probably still performs better than SQL Server. Just about the same as db2 or postgres in my testing. Actually, for some things like inserts Oracle sucks. Of course Teradata could be much faster for complex queries but nwo one is largely talking about hardware - and that's the jist of it. Most of the ideas really are comparing Oracle on a quad server with 12GB RAM to something else on a PC. With today's PC's going toward Dual Core and 4 GB of RAM (that's what Serviza presently sells as a Linux desktop - http://www.serviza.com/ the argument is sorta becoming more clear.

Also, the failure of Oracle to provide even decent programmer tools is disgusting. In the Open Source world I have an arsenal of tools to work with Postgres and Mysql. Really, there is not legitimate reason to pay money for an RDBMS system. Set theory has been well-understood for decades and the major commercial RDBMS vendors are not innovating. In 15 years of software projects I've yet to see one that could not have been done with today's Mysql or Postgresql. But I've seens millions handed to Oracle over and over and tens of thousands handed to Microsoft. To me, Oracle is the premier example of selling the same thing as everyone else but charging 10 times as much. It's like buying a hotdog at the game - you're paying $5 for something that costs 50 cents. "The Million Dollar Pizza" book addresses this waste on a personal level but on a corporate level the exc.s are too busy scamming the company to worry about its long term health. Anyone buying Microsoft SQL Server or Oracle in 2007 ought to have their head examined and probably the investment docked from their paycheck. Of course momentum and other arguments apply and that's why companies still spend millions on Mainframes to do what a PDA of today could do.

My $.02,
TimJowers

Re:Features? -- easy to defend your answer!

[Anonymous Coward]

Seriously, how many people need a GIS solution integrated into their RDBMS? No doubt some do, but that is a niche feature that is probably infrequently used and a very weak argument.

Regarding the language support, you imply that using Microsoft specific SQL extensions as being bad and in the same breath tout Oracle specific SQL extensions as being a good thing. Make up your mind. Are vendor specific extensions good or bad? Similar issue with support for other languages as you discount .NET as being flawed, but champion Java support. That is a 100% religious argument and does nothing but show your personal bias.

Re:Features? -- defend your answer!

[eluusive]

That mirroring features is a pain in the ass to get working for smaller shops that don't use domains. It only works on a single database at a time. Guess what.. users stored in that database are mapped to logins using SIDs, those logins don't get mirrored though..... You have to fix everything with the logins if you want to go swap over to the secondary server. It's a particular issue I'm dealing with right now. The main thing I was griping about though was the lack of analytical features compared to postgres, or even oracle. Try doing a running average without a cross join. -- Good luck.