Tag Archives: oracle

Java users beware: Exploit circulating for just-patched critical flaw

Tech, , , , , ,

If you haven’t installed last week’s patch from Oracle that plugs dozens of critical holes in its Java software framework, now would be a good time. As in immediately. As in, really, right now.

In the past few days, attack code targeting one of the many remote-code-execution vulnerabilities fixed in Java 7 Update 21 was folded into either the folded into the RedKit or CrimeBoss exploit kit. By Sunday, that attack code was being actively unleashed on unsuspecting end users, according to a short blog post published by a researcher from antivirus provider F-Secure.

The post doesn’t say where the attacks were being hosted or precisely how attackers are using them. Still, Oracle describes the vulnerability as allowing remote code execution without authentication. And that means you should install the patch before you do anything else today. The track record of malware purveyors of abusing advertising networks, compromised Apache servers, and other legitimate enterprises means readers could encounter attacks even when they’re browsing a site they know and trust.

Read 3 remaining paragraphs | Comments

Opinion: Antitrust complaint against Android is an attack on open source

Tech, , , , , ,
Aurich Lawson

On Tuesday, we reported on a new complaint filed by “Fairsearch,” an anti-Google group that counts Microsoft, Oracle, Nokia, and about a dozen other Google competitors as members. In recent years, European regulators have become more aggressive at policing anticompetitive behavior in the tech sector than their American counterparts. Microsoft and its allies hope that officials will conclude that Google’s mobile OS strategy violates the EU’s competition laws.

“Android phone makers who want to include must-have Google apps such as Maps, YouTube or Play are required to pre-load an entire suite of Google mobile services and to give them prominent default placement on the phone,” Fairsearch argued in a blog post announcing the complaint. Here, the group is echoing charges Microsoft itself faced more than a decade ago after it bundled Internet Explorer with Windows.

But Fairsearch also makes an additional argument that should alarm anyone who benefits from free software—which is to say everyone who uses the Internet. Google’s competitors complain about the search giant’s “predatory distribution of Android at below cost.” Apparently, Fairsearch believes that it’s “predatory” for a company to gain market share by giving its software away for free.

Read 5 remaining paragraphs | Comments

Developer Freedom At Stake As Oracle Clings To Java API Copyrights In Google Fight

Tech, Technology, , , ,

Java_logo

Editor’s note: Sacha Labourey is CEO of CloudBees was formerly CTO at JBoss. Follow him on Twitter @SachaLabourey. Steven G. Harris is senior vice president of products for CloudBees and was formerly SVP of Java Server Development at Oracle. Follow him on Twitter @stevengharris.

You could hear a collective sigh of relief from the software developer world when Judge William Alsup issued his ruling in the Oracle-Google lawsuit. Oracle lost on pretty much every point, but the thing that must have stuck most firmly in Oracle’s throat was this:

So long as the specific code used to implement a method is different, anyone is free under the Copyright Act to write his or her own code to carry out exactly the same function or specification of any methods used in the Java API. It does not matter that the declaration or method header lines are identical. Under the rules of Java, they must be identical to declare a method specifying the same functionality — even when the implementation is different. When there is only one way to express an idea or function, then everyone is free to do so and no one can monopolize that expression. And, while the Android method and class names could have been different from the names of their counterparts in Java and still have worked, copyright protection never extends to names or short phrases as a matter of law.

As the friends-of-the-court submissions supporting Oracle show, this ruling has a lot of entrenched corporate heavyweights up in arms, too. It’s not every day you find Oracle in bed with rivals Microsoft and IBM (via the Business Software Alliance), and you can bet that the common denominator is about defending the aging Empire from the startup Foundation. Add a former head of the U.S. Copyright Office. To sweeten the stew, why not sprinkle in support from various industry players in the arts. Former Sun execs Scott McNealy and Brian Sutphin have also piped in.

This lineup of amicus curiae briefs should be alarming to software developers in general and to the future of our industry. Why? Their collective argument is that Judge Alsup’s ruling is bad for business. It may in fact be bad for the old guard’s business that is increasingly threatened by changes driven by open source and cloud-based services. But make no mistake: if Judge Alsup’s ruling is overturned on appeal, it’s not going to be in your interest as a software professional.

You make some bets when you create an API, but they’re not about monetizing the API.

APIs exist for a reason: They act as the communication channel, the lingua franca, the boundary, between the provider of the implementation and users of that implementation — developers. Of course they require an investment to create. Deep expertise — and even taste — is required to create effective APIs. But, companies and individuals make those investments because they want developers to use an implementation that is exposed through the API. That implementation might give people an incentive to buy your hardware, software or services. Who knows, maybe it gives you a more effective way to sell ads.

You make some bets when you create an API, but they’re not about monetizing the API. They’re about monetizing the things the API unlocks access to. You’ll find APIs documented and used in many books, blogs and open-source projects. Adoption is probably the key measure of success of an API. But then if you encourage developers to use your APIs, why can you prevent them from implementing “the other side” of them? When Captain Picard orders a “Tea, Earl Grey, Hot,” at the Oracle replicator, he’s using a kind of API: “Object. [Qualifiers...]”. Google or anyone else should be able to create their own replicator without Oracle insisting they use some other syntax.

Oracle lost in their attempt to protect their position using patents. They lost in their attempt to claim Google copied anything but a few lines of code. If they succeed in claiming you need their permission to use the Java APIs that they pushed as a community standard, software developers and innovation will be the losers. Learning the Java language is relatively simple, but mastering its APIs is a major investment you make as a Java developer. What Android did for Java developers is to allow them to make use of their individual career and professional investment to engage in a mobile marketplace that Sun failed to properly engage in.

What about compatibility and fragmentation? We’re big believers in Java compatibility and the value of branding and compliance testing. We sit on the Java Community Process Executive Committee. There is no doubt that Android is a messy world of compatibility issues compared to Java, and that Google’s compatibility regime has been less than a blazing success. (Java ME is no panacea of compatibility, though, either.) By creating a new non-Java virtual machine (Dalvik) underneath Android’s Java API-based libraries, Google sidestepped the strict specification license restrictions of required compatibility and no subsetting, supersetting or namespace pollution. Not many of us can afford to do that!

Now is the time to decide who should hold the knife by the handle.

Regardless, thanks to Android using Java APIs, Java developers feel right at home with Android, even if it doesn’t come with a coffee cup logo on it. The economic reality for Java developers is that they’ve gained much more in opportunity from Android than they lost in compatibility assurances due to Android’s subsetting the standard Java platform APIs. We are working with others inside the JCP to advance the current rules to be more in sync with the fork-friendly open source and cloud world. We believe that Oracle’s quest for a legal stranglehold on the Java API, which itself has been advanced through the Java Community Process, has nothing to do with compatibility and everything to do with cashing in on Java at the expense of the community.

With the IT industry shifting from packaged software to a cloud-based service model, this debate becomes even more important. As companies increasingly invest in SaaS, PaaS and IaaS solutions, their operations will depend on third-party APIs. Formal standards are only just emerging and adding FUD over the legal standing of API usage in the meantime is going to place a drag on the industry.

Now is the time to decide who should hold the knife by the handle: Will our economy thrive and be more competitive because companies can easily switch from one service provider to the other by leveraging identical APIs? Or will our economy be throttled by allowing vendors to inhibit competition through API lock-in? And should this happen only because a handful of legacy software vendors wanted to protect their franchises for a few more years?

This decision will impact us for decades to come and will apply to a new IT model – the cloud; yet, this decision is being made now amid heavy lobbying by legacy vendors who are struggling to survive in this whirlwind of change. Developers, your long-term livelihood, the richness of technology choices, and the competitiveness of our industry are at stake.

Thanks, Oracle: New Java malware protection undone by old-school attack

Tech, , , , ,

Researchers have found a shortcoming in key security protection recently introduced in the browser plugin for Oracle’s Java software framework, a flaw that makes it easier for attackers to sneak malware onto end-user computers.

By default, the widely used plugin doesn’t check the status of digital certificates used to sign Java apps hosted on websites, Ars Technica has confirmed. As a result, Java presents certificates as trustworthy even when they’ve been reported as stolen and added to publicly available revocation databases. The failure of Java to check certificate revocation lists came to light on Tuesday when a legitimate site was found hosting a malicious app. Java presented an accompanying certificate as a trusted credential belonging to Texas-based Clearesult Consulting Inc. even though the firm had issuer GoDaddy revoke the certificate in December.

“Java thinks the stolen certificate used is 100% valid and should be trusted,” Jindrich Kubec, director of threat intelligence at antivirus provider Avast, wrote in an e-mail. Referring to certificate revocation lists and an alternate method for invalidating credentials known as the online certificate status protocol, he added: “With CRL/OCSP it would make it untrusted and probably present completely different dialogues or even won’t allow running the applet at all—unfortunately, the situation is a bit complicated with testing this behaviour, so I can’t tell for sure which of the above would be true.”

Read 4 remaining paragraphs | Comments

Oracle releases new Java patch to address this week’s McRat problem

Tech, , , , , ,

Oracle has released an emergency Java patch addressing the latest in-the-wild exploit targeting the software. The company suggests users apply this update “as soon as possible” due to “the severity of these vulnerabilities.” The full patch description and download is available through Oracle’s Technology Network (you can also get the patch through the software’s auto-update).

This particular vulnerability is being exploited to install a remote-access trojan dubbed McRat. The attacks targeted Java versions 1.6 Update 41 and 1.7 Update 15, which are the latest available releases of the widely used software. Security Editor Dan Goodin reported on the issue just three days ago, as attacks were being triggered when people with a vulnerable Java version visited a booby-trapped website.

It almost goes without saying—Java security has left something to be desired lately. High profile companies such as Facebook, Apple, and Twitter all fell at the hands of Java recently. These businesses disclosed that their computers were compromised by exploits later linked to a developer website hacked into a platform for Java exploits. Here at Ars, you can peruse nine separate stories involving Java exploits within the last month alone.

Read on Ars Technica | Comments

Oracle summons “Ann Droid” in appeal of Java verdict

Tech, , , , ,

Attempting to rescue itself from last year’s thorough courtroom smackdown, Oracle has filed a 77-page appeal brief [PDF] arguing that Java APIs are indeed copyrightable, contrary to a federal judge’s ruling.

Google didn’t copy the code from actual Java functions, but it did use what Oracle calls “declaring code” from declarations, headers, signatures, and names of functions. Oracle claimed this amounted to copying the “structure, sequence, and organization” of Java.

But Judge William Alsup, who oversaw the case, disagreed. The code Google used was ”a utilitarian and functional set of symbols, each to carry out a pre-assigned function.” Declarations and headers “must be identical” to carry out the function, and “duplication of the command structure is necessary for interoperability.”

Read 7 remaining paragraphs | Comments

Oracle patches widespread Java zero-day bug in three days (Updated)

Tech, , ,

Earlier this week, a security hole in the latest version of Java was being “massively exploited in the wild.” Hackers were turning compromised websites into platforms for installing silent keyloggers or other malicious software. And at the time news broke, even fully patched Java installations were at risk.

Today however, KrebsOnSecurity reporter Brian Krebs is reporting Oracle finally shipped its critical security update. Java 7 Update 11 fixes this sticky situation and it’s available both via Oracle’s website and through the Java Control Panel in an active program.

Krebs reports this update changes the way Java handles Web applications. From the company’s advisory:

Read 2 remaining paragraphs | Comments

Marc Benioff Has Swagger But What About That Salesforce.com Balance Sheet?

Topnews, , , ,

barbossa

Salesforce.com CEO Marc Benioff is a charismatic guy for someone who leads a company that serves the stodgy world of the enterprise. He’s so well-recognized that he was put on stage this past week in Las Vegas to give a keynote at CES, the world’s largest consumer electronics show. Let me say that again: an enterprise guy gave a keynote address at the world’s largest consumer gizmo show. That has to be a first.

But there is something nagging at me abut Benioff. For all his boasting and vision of the future, Salesforce.com’s balance sheet continues to show red. And so while I consider Salesforce.com an innovator, I get hung up on what the numbers say. In part for my own benefit, I took a look at the company’s financial data and what others are saying about Benioff. I did this because I sense a certain amount of risk Salesforce.com is taking by building up its debt. Of course, the swashbucklers will say: “But matey, this is the land of pirates and scalawags — risk is just part of the sword fight. Here, have a whiskey.”

The worst thoughts I have are of Benioff’s castle crashing down if the tide does not turn and investors sense trouble. “Walk down the plank of my billion-dollar sailboat, you foolish ninny, Larry is back to buy you up. Or do you want to face the sharks? They can smell you from here. How about a dime for what’s worth a dollar?”

Creative license is not just for wise-ass journalists, it’s also a game the powerful love to play. It’s not an entirely far-fetched scenario for a company’s stock to take a beating. That’s clear. Salesforce.com, though, has lots of supporters, including Motley Fool, which is bullish on Salesforce.com. It may look ugly but all is not what it appears to be:

SalesForce.com is a battleground stock with lots of hype and even more haters. But even the haters cannot deny that SalesForce.com has provided its investors with tremendous returns over the past few years. Investors often look at the company’s earnings and wonder how the heck this stock price keeps climbing. The answer is simple: they continue to grow cash flows from operations. On the income statement, much of their revenue gets deferred over the life of the contract, while they still incur marketing and overhead costs immediately. All of that (plus their extremely high spending on Marketing), makes for an ugly income statement. But their cash flow and rapidly growing market share are beautiful.

Yes, its revenues show the success of the SaaS model, Benioff’s drive and a cohesive corporate culture. Revenues continue to climb from about $1 billion in 2009 to $2.25 billion in 2012. But in turn, Salesforce.com net income has dropped from $80 million in January 2010 to a negative of $220 million as of October 31, 2012.

Here’s a breakout from Seeking Alpha:

Salesforce.com does not expect to have profits for the foreseeable future, sccording to a 10-Q filed in the Fall as pointed out in a Forbes post by Jeff Bailey, editor of YCharts:

We have incurred net losses in each fiscal quarter since July 31, 2011. In addition, we expect our costs to increase as a result of decisions made for our long-term benefit, such as equity awards and business combinations. If our revenue does not grow to offset these expected increased costs, we will not be able to return to profitability and we may continue to incur net losses, on a U.S. GAAP basis.

Revenues do continue to increase but you also have to consider what it is costing the company to do that. Marketing costs now represent more than 50 percent of revenues. And the company keeps hiring. As of January 31, 2012, Salesforce.com had 7,785 staff up from 5,306 a year earlier. In its investor call at the end of November, Salesforce.com said it added more than 550 new employees in the third quarter, including about 250 people from its acquisition of Buddy Media. That puts its total headcount to more than 9,300, up 34 percent from the third quarter last year.

CRM data by YCharts

In the meantime, Benioff boasted on CNBC on Wednesday that the company has made $1 billion in acquisitions. Still, it now faces an even tougher battle with Oracle, which last month acquired Eloqua, a marketing automation company. Salesforce.com now has to be on the hunt for an acquisition of its own. The problem? Salesforce.com doesn’t have the cash reserves that Oracle has. Granted, Oracle is a much more established company, with $45 billion in major acquisitions over the past several years.

Salesforce.com painted a much different picture in its third-quarter earnings call. It pointed to its growth and the historical strength of its fourth quarter. The company expects revenue in the range of $825 million to $830 million for year-over-year growth of approximately 31 percent.  For the full year, Salesforce.com is in the range of $3.04 billion to $3.05 billion. Preliminary estimates for fiscal 2014 is for revenue in the range of $3.8 billion to $3.85 billion.

So What’s Wrong Here If Anything?

Las Vegas is built on the illusion that is America. It comes of the belief that the future is paved with gold. Benioff sells that dream every day. He has a command of the language about “social” and the “cloud” that resonates  with business. He talks about connecting businesses with Facebook and Twitter. How social technologies will change every business. But its CRM business is still its bread and butter, and CRM is now considered a pretty mature category. Social CRM is the new play for Salesforce.com. It sounds great but the cost of selling it is proving considerable.

I know a lot of smart people at Salesforce.com. I love its platform play and how it is building  a developer community. But as well, Benioff does not have all the answers and should be viewed with skepticism even if he is an enterprise guy who can wow a consumer electronics crowd.