Slashdot Mirror

← Back to Stories (view on slashdot.org)

Oracle/Sun Enforces Pay-For-Security-Updates Plan

Posted by CmdrTaco on from the you-get-what-you-pay-for dept.

An anonymous reader writes "Recently, the Oracle/Sun conglomerate has denied public download access to all service packs for Solaris unless you have a support contract. Now, paying a premium for gold-class service is nothing new in the industry, but withholding critical security updates smacks of extortion. While this pay-for-play model may be de rigueur for enterprise database systems, it is certainly not the norm for OS manufactures. What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications."

15 of 238 comments (clear)

  1. Just like Redhat by shafty023 · · Score: 3, Informative

    This isn't any different from what Redhat does. They charge for security updates and no one has gone crying about it. Can't all jump on Oracle for wanting to be paid for the development time put in for security updates ppl

    1. Re:Just like Redhat by Anonymous Coward · · Score: 5, Informative

      o rly?

      http://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/

  2. Just another step... by ak_hepcat · · Score: 2, Informative

    ...and another 'I' dotted in Oracle's plan to kill off Solaris, and force Linux as their high-end product.

    I only have one Solaris server left, and I'm rapidly losing any real need to keep using it.
    In fact, I will probably end up migrating off of Solaris this year, just to be done with it.

    Linux works just fine on my Sparc hardware, even my Ultra Enterprise 2, which hasn't seen
    upgrades or replacement parts in over 10 years. (and why it's still up and running, I don't know...)

    --
    Support FSF: Stop thinking with your wallet, and think with your imagination. (cc/non-commercial)
    1. Re:Just another step... by pedestrian+crossing · · Score: 2, Informative

      This policy was in place -long- before the Oracle deal. It has been over 3 years since you needed a support contract to get patches...

      --
      A house divided against itself cannot stand.
    2. Re:Just another step... by Anonymous Coward · · Score: 5, Informative

      There's a big difference - it used to be you needed a contract to use their patch update manager (and one contract covered all machines), but not just download individual patches or patch clusters (which, BTW, are integrated into the latest full OS downloads, and in fact at least one Sun person I've seen has recommended just grabbing the latest full OS download and using that to apply updates!). Now, not only do you need a contract, but you need one for each machine and OS version separately, and you can't actually buy the contracts from Oracle anyway. There's NO way to purchase them online (in fact the one link that's been posted multiple times as "I've verified this works" by Sun/Oracle people takes you to the Oracle 404 page), and when you leave your name with the pre-sales people to have sales call you, you don't get called back (since there's no way to actually talk to a sales person directly).

      I suspect that Oracle is doing everything they can to passively kill Solaris without admitting it, that way they can say it wasn't their fault (or plan all along) when the regulators and shareholders come asking questions... If I had my choice, I'd be off Solaris completely, but at least for right now I don't. What's really interesting is what this is going to do to all those proprietary software vendors who require Solaris as the server OS for software used in regulatory compliance-audited environments. Since no patching = non-compliance, the ripple-effect is gonna be HUGE...

    3. Re:Just another step... by Anonymous Coward · · Score: 1, Informative

      This policy was in place -long- before the Oracle deal. It has been over 3 years since you needed a support contract to get patches...

      But not security patches.

    4. Re:Just another step... by Paul+Jakma · · Score: 2, Informative

      I think you've missed the point. Sun still made security patches generally available, Oracle have made those $$-only as well now.

      --
      I use Friend/Foe + mod-point modifiers as a karma/reputation system.
  3. Re:Sidestep? by hellraizer · · Score: 2, Informative

    it may be so ... but .... Quoting Oracle's web page ... "Licensing Information By accessing the software on this Web site, you agree that (1)(a)you have already obtained a license from Sun, or a Sun partner, for your current use of the software; and (b) that your Sun License Agreement, Sun Partner Agreement, or other license agreement with Sun or a Sun partner, together with the applicable Entitlement or order document with Sun or a Sun partner, governs your use of the software, or (2) if you have not already obtained a license from Sun or a Sun Partner for your use of the software, the Sun Microsystems License Agreement on this Web site governs your use of the software for the time specified in such agreement. Note: Programs downloaded for trial use or downloaded as replacement media may not be used to update any unsupported programs " The word LICENCE comes up very often .... am i wrong about this ???

  4. Re:Was to be exepected by Capt+James+McCarthy · · Score: 4, Informative

    I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business. For me the Oracle web site is so convoluted that it stinks of 'we designed this so that you to pay use to find it'. Everything feels designed to nickle and dime everything you try doing with them. This is based on experience of having get specific updates to fix certain known issues. If you don't agree with my perspective, I would gladly appreciate hearing about your experience.

    I am a Java developer and I hope that they don't extend this to Java or any other Sun technologies with a more 'open' culture.

    I agree. I cringe every time I venture into the quagmire of oracle.com to obtain a CPU or look up information/patches for an older version of oracle. Sun's site was much easier to navigate through for patch clusters or specific patches themselves. Now that sun's site is folded into oracle's site, finding hardware information has become a pain. I did find that going to sunsolve still is the way to go though.

    --
    There are no loopholes. It's either legal or it's not.
  5. "de rigueur for enterprise"? Not for DB2 by Kenneth+Stephen · · Score: 2, Informative

    I can't think of any IBM product on the "distributed platforms" (i.e not mainframe or i5OS) where the fixpacks are not available for free.

    --

    There is no such thing as luck. Luck is nothing but an absence of bad luck.

  6. Mistake by Anonymous Coward · · Score: 1, Informative

    The linked thread already points out that this was a mistake, not intentional, and provides a link to the Sun site with details.

  7. Re:Sidestep? by spamcop · · Score: 3, Informative

    Solaris is free to download and install and to use for ONLY 90 DAYS! They changed this licence only few days ago. http://www.sun.com/software/solaris/popup.jsp?info=17 Quote: Solaris 10 Download Customers bla bla bla... Please remember, your right to use Solaris acquired as a download is limited to a trial of 90 days, unless you acquire a service contract for the downloaded Software.

  8. Re:As a industry best practice... by ma3382 · · Score: 2, Informative

    During the time frogs are submerged under water or buried in soil they breathe through their skin.

  9. Re:As a industry best practice... by RivieraKid · · Score: 2, Informative

    Unless they've been stung by a Scorpion, in which case the venom will kill or paralyse them, thus preventing them from breathing.

    --
    "Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves
  10. Title of Article Is Incorrect by turkeyfish · · Score: 3, Informative

    The title of this article is incorrect. It should read Oracle announces its products will become less secure over time. This will be true because they will permit malware to infect a percentage of their installations, which in turn will corrupt others by providing an internal platform for hackers to penetrate otherwise secure systems. Either a product is secure or it is not. Oracle is merely announcing that their products will not be secure.