←back to thread

634 points 2bluesc | 1 comments | | HN request time: 0.237s | source
Show context
nerdjon ◴[] No.43536732[source]

This is honestly wild.

Whether we like it or not security incidents have become such common place in the last several years that if they just admitted to it this entire story would have likely been shrugged off and mostly forgotten about in a couple days but instead it is turning into an entire thing that just seems to be getting deeper and deeper. (Not downplaying the security incident, but that is the unfortunate reality).

Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here?

Are they somehow really confident that this didn't happen, maybe they don't have the logs to confirm it? Trying to think about how this is anything except them just straight up lying.

I can't remember the last time we saw a company this strongly try to deny that something like this happened. Especially when according to Ars Technica:

> On Friday, when I asked Oracle for comment, a spokesperson asked if they could provide a statement that couldn’t be attributed to Oracle in any way. After I declined, the spokesperson said Oracle would have no comment.

replies(4): >>43537096 #>>43537117 #>>43537883 #>>43538790 #
sylens ◴[] No.43537883[source]

Security incidents have become so common place that the fact that they happen is not the newsworthy event; rather, its how a company responds to them that is the newsworthy event. And Oracle flunked this test

replies(2): >>43542001 #>>43542338 #
1. cookiengineer ◴[] No.43542338[source]

Note that it was an almost 4 year old already disclosed CVE which was used. Oracle messed up, big time. That's why they're trying to get rid of all incriminating evidence for potential lawsuits.

https://nvd.nist.gov/vuln/detail/cve-2021-35587