Slashdot Mirror
Oracle/Sun Enforces Pay-For-Security-Updates Plan
An anonymous reader writes "Recently, the Oracle/Sun conglomerate has denied public download access to all service packs for Solaris unless you have a support contract. Now, paying a premium for gold-class service is nothing new in the industry, but withholding critical security updates smacks of extortion. While this pay-for-play model may be de rigueur for enterprise database systems, it is certainly not the norm for OS manufactures. What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications."
It would be a shame is something was to happen to it.
Flexible bare-metal recovery for Linux/UNIX
This isn't any different from what Redhat does. They charge for security updates and no one has gone crying about it. Can't all jump on Oracle for wanting to be paid for the development time put in for security updates ppl
What may be more interesting is how Oracle/Sun is able to sidestep GNU licensing requirements since several of the Solaris cluster packs contain patches to GNU utilities and applications
The GPL doesn't prevent you from charging a fee for GNU software. It just stops you from preventing the people you sell it to from distributing it to everyone else. OpenSolaris is free and the source is available. If you are using Solaris (not OpenSolaris) then you are paying for a platform that has undergone some extra testing and comes with support guarantees. If this isn't important to you, then use OpenSolaris for free.
I am TheRaven on Soylent News
... is knocking on the door of the competition.
There are many ways to take news like this. For those invested, it's a blow. For the free market and those looking for marketing opportunities (cough ... I'm talking to the competition) .... this is your opportunity to do something good to us looking for solutions and yourself (in recapturing market share). Make me an offer I can't refuse.
L'esperienza de questa dolce vita (The experience of this sweet life) - Dante Alighieri, The Divine Comedy
They're not sidestepping anything GPL-wise. The OS patches contain some GPL binaries and some proprietary binaries. They are side by side, which means the proprietary binaries are not subject to the GPL. The entire patch package, therefor, can't be redistributed. The GPL bits within the patch can be freely redistributed. As can the source for those bits, which Sun/Oracle is (presumably) making available as they always have to comply with the GPL.
So, they are sidestepping nothing.
Portable versions of Firefox, GIMP, LibreOffice, etc
I don't want to sound negative, but I was always worried about Oracle buying Sun, for how it would impact negatively on Sun's business. For me the Oracle web site is so convoluted that it stinks of 'we designed this so that you to pay use to find it'. Everything feels designed to nickle and dime everything you try doing with them. This is based on experience of having get specific updates to fix certain known issues. If you don't agree with my perspective, I would gladly appreciate hearing about your experience.
I am a Java developer and I hope that they don't extend this to Java or any other Sun technologies with a more 'open' culture.
Jumpstart the tartan drive.
...and another 'I' dotted in Oracle's plan to kill off Solaris, and force Linux as their high-end product.
I only have one Solaris server left, and I'm rapidly losing any real need to keep using it.
In fact, I will probably end up migrating off of Solaris this year, just to be done with it.
Linux works just fine on my Sparc hardware, even my Ultra Enterprise 2, which hasn't seen
upgrades or replacement parts in over 10 years. (and why it's still up and running, I don't know...)
Support FSF: Stop thinking with your wallet, and think with your imagination. (cc/non-commercial)
Presumably if you obtained the GPL binaries/source from SUN, its legal to redistribute those patches. But there is nothing in the GPL requiring SUN to give you those patches, code or binaries.
If they give you the binaries, they need to give you the source. But if they choose not to give you the binaries (i.e. you elect not to pay for a Solaris contract), they are not obligated to give you anything (binaries or source)
Just because they're selling the security updates doesn't mean they're in violation. I think it's highly likely that Sun/Oracle will go right ahead and sell their updates, and make the source code available (via the web?) for the GNU parts. Offering the source for the GNU packages wouldn't cut into their sales much, as most of their customers are probably not inclined to compile this code for themselves anyway (if they were, my thinking is that they probably wouldn't be running Sun). And even if they were, they'd miss out on updates to the proprietary parts of the code.
I'm having trouble seeing what the big deal is here.
I can't think of any IBM product on the "distributed platforms" (i.e not mainframe or i5OS) where the fixpacks are not available for free.
There is no such thing as luck. Luck is nothing but an absence of bad luck.
All security updates should be free as in beer. Patches that include features are for-pay. It's not my fault they released a product with security holes. I love car analogies, and it works pretty good here.
This goes back to the story of the Scorpion and the Frog. A scorpion was travelling across the land when he came to a river. Wanting to get across, he approached a frog to help him get across.
The frog replied "Why should I help you across because you will sting me and we will both drown."
The scorpion said "I promise not to sting you."
They are half-way across the river then the scorpion is startled by a splash of water and stings the frog. The frog cries out as his body begins to paralyze "Fool! You have doomed us both as I predicted."
The scorpion replies "Fool? What did you expect Frog? I am a scorpion."
Oracle is a Scorpion. Anyone who thought otherwise when they purchased SUN is a fool.
Management is doing things right; leadership is doing the right things. - Peter F. Drucker
I just want to congratulate Oracle on doing everything it can to kill off Solaris passively so they don't have to admit what they're doing. I need a Solaris support contract in order to keep a few systems running specialized software in a compiance-audited environment up to date. This is software that is run in many environments where the inability to keep them patched is a showstopper. However, I can't seem to purchase a support contract. The only page that even lists the ability to purchase it is broken (see dpfloyd's comment), and I have not receved a call back from Oracle/Sun sales in nearly a week (and that was after getting bounced through 6 different people to a support person who at least knew to forward my info to a Sun-related salesperson, or so they said). Additionally, if you click the "How to Purchase a Contract" it provides no actual info on how to do that, and the link it has to "Learn More" takes you into an infinite loop of "click here, now click here, now click here - oh, wait, I'm back where I started" when you try to find out about Sun Solaris support.
I hope I'm wrong about what's happening, but I can't say that any of this gives me the warm fuzzies. I'd say that if I had control over the platform I'd migrate those systems off of Solaris to another OS, but I'm guessing that's exactly what Oracle wants...
Can SOMEONE at Oracle/Sun please tell me how to purchase a support contract to download OS patches? If not, can someone from Oracle/Sun officially tell me to bugger off so I can tell my boss that we're never going to be able to update those servers again and we can start planning on how we're going to get around that issues?
Thanks.
Yes, that was certainly the plan a year ago.
It's no longer the plan. You'll soon need to flip it around.
Solaris is now a great tool to help Oracle force people to one and only one vendor (Oracle) for just about everything. That's the new plan. And Linux fits in that plan right now, but probably won't in a few years, if they can get people to trust them as hardware vendors, and they can keep the quality of Solaris testing up.
Oracle sees Sun as a company with a LOT of great stuff, but both weak and incompetent, since it didn't squeeze cash out of people on every single thing it did. Oracle is right now in an orgasmic frenzy to take everything Sun had and monetize it -- some at the start, though that's less important, but EVERYTHING must bring in cash via support and updates. Furthermore, expect to see every piece slowly being changed slightly to push you towards coupling with other Oracle tools.
Which is why open systems, like Linux, don't help Oracle in the long run. Open systems give you flexibility, and flexibility is bad. Oracle is pushing to get the whole enterprise, from soup to nuts. In the words of an IBM rep I was talking to about this: "We tried that 15 years ago, and it almost killed the company."
Oracle started doing Linux not because they like open systems (they don't), but because A. they could control it a little through their own distro and B. they could get the support contracts, instead of the money going to Red Hat. Now they have Solaris. They'll push that like crazy and move people onto it, since they can certainly control it a lot better than they can control Linux, and instead of some of the support dollars going to Oracle, ALL of the support dollars will go to them.
The title of this article is incorrect. It should read Oracle announces its products will become less secure over time. This will be true because they will permit malware to infect a percentage of their installations, which in turn will corrupt others by providing an internal platform for hackers to penetrate otherwise secure systems. Either a product is secure or it is not. Oracle is merely announcing that their products will not be secure.
This is the most absurd piece of news I've come across this year! Why on earth should I pay to have Oracle/Sun fix their own bugs?
Obviously Security flaws are bugs. If any security vulnerabilities are identified, they should be ethically and morally obligated (ie assuming that the legal angle is unenforceable) to fix these and distribute the patches for free.
Isn't there anything called accountability/responsibility left any more?!? We are a huge Sun shop and one of the reasons we loved Sun so much is the fact that it was not a blood-sucker when it came to things like patches, software, etc. Unlike a company like HP, who charged for everything from multipathing software to UNIX resource mgt tools (which should be defacto standard of any mature OS).