Pete Finnigan's Oracle Security Weblog

CRN has a good news article about Larry's speach at Oracle Open World. The article is written by Barbara Darrow and is titled "Ellison Speaks On Oracle Partner Challenges, Security". This is a great article that talks about the only question posed to him at OOW that rattled him were about security. One member of the audience asked if Oracle would commit to fixing known security bugs within a quarter of their discovery. Larry's answer was NO. He went on to qualify slightly. He then went on to claim that an Oracle database had not been broken into for 15 years! He then went on to say that if someone had posted a username and password on the net then its not the same as breaking in. He also said nobody could break into an Oracle database except some guys he could name who are on our side!. First of all bugs have been found that do not require authenticated access in the last 15 years and also if some guys who are on our side can get in, does that mean there are backdoors in the software?