'We had to educate Oracle about our contract,' CIO says after Big Red audit

https://www.theregister.com/2024/03/06/oracle_audits/

by interesse • 2 years ago

134 146 2 years ago

soperj2• 2 years ago

Oracle's favourite phrase seems to be "You're out of compliance", and their only solution is for you to pay more.

And if they can’t say that (ie when it’s not true), they will intimate that you might be out of compliance, and hope you’re worried enough to just pay more anyway.

itronitron• 2 years ago

But have they got a 27B-6?

soperj2• 2 years ago

They seem to say it regardless of whether it's true or not.

used2workthere2• 2 years ago

Used to work there due to acquihire (throwaway acct since regular can out me).

Engineers were walked through how to interact with clients; don’t say this or that because of laws and treaties. But also to listen for customer language that suggests a customer is cheating Oracle; let Oracle know and they will send the lawyers.

It was a very paranoia driven environment.

Zigurd• 2 years ago

Many many years ago I was working on making a phone OS (no not that one, this was for VoIP handsets, no not Cisco's) where we built an app suite on a Java VM. We wanted to use a Sun VM, I forget the acronym, that was bigger than J2ME but smaller than SE for which Sun, as far as we could tell, had no actual customers. You'd think they would be happy to have customer interest, but we got a total horseshit runaround on pricing. We could not base a product on something for which we had no idea of pricing. We used an open source Java which turned out to be adequate, but only just - no JIT, for example.

BenoitP• 2 years ago

Earlier last year, it made changes to the Oracle Java SE subscription model, basing it on a per-employee metric many said would increase costs for users.

Would running Java under Corretto 21 change this?

kevinherron2• 2 years ago

Yes, all of this Oracle Java licensing drama only applies if you're using the Oracle JDK.

The vast majority of people can just use a JDK from any of the other vendors and tell Oracle to pound sand.

Even if you do need paid support, you should pay Azul instead of Oracle, just out of principle.

kragen13• 2 years ago

also they can use the openjdk from oracle

matrix87• 2 years ago

Even if you do need paid support

By paid support, you mean free steak dinners for middle management?

After dealing with Azul people, give me Oracle. Instead of seeing Azul people shuffling a bunch of charts around and making up shit on the fly to make it sound like their garbage product performs better than OpenJDK (it didn't for us. we benchmarked it. but shame on us, because I guess the steak dinners kept rolling in).

Look at this website, do you think it belongs to a legitimate company? https://www.azul.com/

jabroni_salad• 2 years ago

I recently helped a factory change their timecard system because of this. They wanted a license for every employee and contractor who is capable of using any computer. Not just for the timepunch devices. Not just for the employees who use the timepunch devices.

I wasn't involved in the decision but it's my understanding that they did not even try to engage their vendor. They got legal threats from Oracle and put in a different solution on the same day. If you develop for java make sure your install process doesnt have something like "step 1: install java" cuz guess what they're going to download.

krylon2• 2 years ago

"a specialist advisory company helping clients deal with Oracle licenses"

I would (naively, I know) imagine that if you need to hire a third party to help you sort out your licenses with a vendor, you would do whatever it takes to get rid of that vendor. It's almost as if Oracle wants their customers to ditch them the first chance they get.

icedchai5• 2 years ago

Once you're using an Oracle database, you are probably using proprietary Oracle features, SQL syntax, client libraries, etc. The first chance you get might be a while. I once worked on a project porting an app from Oracle to another commercial DB. When Oracle is deeply embedded in your applications, it's easier said than done.

__loam3• 2 years ago

It's a good thing there aren't numerous open source alternative databases that can be hosted by numerous other services then.

walrus014• 2 years ago

I would think that the way to do this would be to set up realtime replication from the origin oracle DB to a db with the same schema running on something much more 'normal' such as mariadb, and then set up client applications and libraries and queries to the newly replicated db in a read only mode. And then setting up test client application/libraries for write mode to a copy of the replicated db and verify everything is also working normally.

After confirming everything is working okay, at some point in time, have a "rip off the band aid" moment of cutting off the oracle db and declaring the replicated one as the new primary.

RobotToaster2• 2 years ago

I'm surprised there aren't entire businesses based around selling compatibility layers or something.

Shorel3• 2 years ago

It's not that complicated.

All our business logic was into PL/SQL stored procedures, I migrated them to MySQL stored procedures.

The MySQL language is a bit retarded, and some extra work was needed, but everything was doable.

krylon2• 2 years ago

That's why I wrote "naively". I know it's more complicated than I made it sound. It's the same with companies using mainframes, after a while you are so deeply invested (both financially and technically) that migrating might be more expensive than just feeding the corporate machine.

Still, depending on a vendor that treats their customers as rudely as Oracle does must be really annoying.

kragen13• 2 years ago

oracle products aren't really products you can ditch in most cases. generally what it takes to get rid of them is to go out of business and be replaced by a business that isn't an oracle customer. i had a very interesting thread about that dynamic on here with pamar three weeks ago, which will be very interesting reading for anyone who is wondering why people don't ditch oracle https://news.ycombinator.com/item?id=39397513

pantulis2• 2 years ago

Thanks for pointing that thread out!

konschubert3• 2 years ago

That’s why it’s so important that competition is possible in a market. Such that legacy players with inefficient legacy technologies can be driven out of the market.

burningChrome• 2 years ago

A smaller company I worked for a few years ago was migrating its old ERP legacy system and brought in some people from Oracle, SAP and Epicor. They decided to go with SAP, but I remember my boss in several lunch meetings saying that they didn't get a sales pitch from the other vendors as much as a litany of horror stories about why they shouldn't go with Oracle.

It worked since my manager said he asked around and did his own research and wondered how they're even still in business since everybody he talked to said the same thing - whatever you do, do not go with Oracle.

toomuchtodo• 2 years ago

Even Amazon had a hard time migrating.

https://aws.amazon.com/solutions/case-studies/amazon-databas...

https://aws.amazon.com/blogs/aws/migration-complete-amazons-... https://news.ycombinator.com/item?id=21258127 (Edit: 2019)

falcor84• 2 years ago

Do you happen to know when that took place? I can't seem to find any dates on that page

DANmode3• 2 years ago

They want any customers capable of avoiding their sand traps to self-select out, yes.

They want the biggest, juiciest hits, not to have to fight with savvy buyers for what they believe they deserve.

mayoff• 2 years ago

A few years ago, my then-employer (a smallish company, < 150 employees) had to deal with an Oracle compliance audit. I was shocked at the time to learn that there are companies (like Palisade Compliance mentioned in this article) that specialize in Oracle license compliance. We made it through just fine (in fact I believe we managed to get a small refund!), but having been through that (though not in any way directly involved), my take is that no one should ever do business with Oracle if they can possibly avoid it.

politelemon• 2 years ago

that specialize in Oracle license compliance

Oh but it gets better. Many of them are ex oracle employees. It's a huge racket that exists for itself.

winrid• 2 years ago

the revolving door of oracle consultants? :)

walrus014• 2 years ago

I have mentally trained myself that every time I read the word "Oracle", I replace it with "Larry Ellison needs a bigger yacht". Thus far, this has worked great for me in staying away from paying that organization even one dollar.

CobrastanJorji• 2 years ago

These kinds of things are everywhere. To pick one at random, if you want to list a product on amazon.com, there's no shortage of consulting companies that will figure out how to make it happen. And then you can get a consultant for your amazon advertising (the ads that go on amazon.com to advertise other products also on amazon.com) and a consultant to help make your company the default choice when a customer clicks the buy button in the "buy box," and a few more. You can easily spend hundreds of thousands on these consultants.

Honestly, the Amazon hustle is a crazy and fascinating little ecosystem in a bunch of ways.

Johnny555• 2 years ago

About 10 years ago, my then-employer had an Oracle audit and they were found to owe over $500,000 in licensing fees (the initial cost was much higher but they negotiated it down). They were blatantly violating their agreement by owning a single socket license and using Oracle on a half dozen large production servers and a bunch of dev servers. The DBA that ran the licensing script said "You know we're not in compliance right?" and the company execs said "No worries, we'll negotiate a good deal".

When I started, I asked about licensing while setting up a new production server and the CTO admitted they were under licensed and were planning to true up licenses next quarter, but over a year went by and they never did. I suggested that they work on porting to Postgres or MySQL/MariaDB and get off Oracle (or at least consolidate into fewer servers to reduce the socket count), but they never had the time to do that.

The company went out of business shortly after the bill from Oracle came due (not sure if Oracle ever got any money). I'd already left by then since I saw the writing on the wall -- as soon as they stopped providing snacks in the break room and the coffee switched from Peets to Folgers, I knew they were running out of money.

Perepiska• 2 years ago

I once worked for a vendor company that sold a workstation: a computer with Linux and full-fledged Oracle server with the appropriate license and a small application written in PL/SQL.

When I suggested rewriting everything in Python, the CEO explained that on the client side, this solution was bought by MBA graduates who only knew Oracle, and everything else would be suspicious to them.

As a result, clients bought a cheaper solution from competitors - Windows and a small application written in C++.

greazy• 2 years ago

There's a disconnect in my understand of MBAs. How and why do MBAs only know Oracle?

Why are they making wild business decisions. Yeah I'm probably living under a rock so apologies for the ignorant question.

Keyframe• 2 years ago

I know, I know, but hear me (far) out.. didn't Snowflake start out from ex Oracle people?

andrewstuart• 2 years ago

Imagine a business in which you can treat your customers so badly that you can and do pull an audit on them.

pmontra• 2 years ago

"We decided that we had a minimal amount [of Java]. We came up with a non-Oracle based architecture for development and we implemented a policy that pointed towards the other development platform and we evaluated methods to discourage or prevent the download of Java software,"

zaphar9• 2 years ago

Look, if you are already in business with Oracle then you have my condolences. But if you aren't in business with them then there is absolutely no world where you should ever under any circumstances consider getting into business with them.

Nothing their database does can't be done with a different database. Even paying for a proprietary database can be done with a different party than Oracle. Do not, I repeat, do not do business with Oracle under any circumstances.

If you are already an Oracle customer and you have the opportunity to drop them from your stack. Do not hesitate, Do not pause, Immediately take that opportunity. There is no downside only upside in not doing business with Oracle.

codeslave13• 2 years ago

Just dont go SAP about as bad as oracle haveing worked in both shops.

zaphar9• 2 years ago

I have no experience with SAP. But I've heard that you could just substitute SAP for Oracle in the above and it would be just as true.

whiterknight• 2 years ago

How is there such a big disconnect between HN opinion on Oracle and business use?

Is it maybe the least bad of all the bad options? Does it cover some edge cases which the obvious FOSS solutions don’t?

zaphar9• 2 years ago

I honestly don't know. I don't know how they stay in business since every developer I've ever met had a bordering on irrational hatred of them.

The only people I've met who like them were all Oracle consultants of some sort and not what I would call developers. When I've been forced to use an Oracle database it was because the company had a contract with Oracle and didn't want to allow any other database to be used. The decision was always several levels above my paygrade. I no longer accept positions at the kind of place that will do business with Oracle. It tends to signal that leadership of that place has some serious problems and too much money to realize they have those problems.

gadflyinyoureye• 2 years ago

Many large companies want a Batphone to call someone for support. They think that the vendor will magically just make things work. Normally that’s not the case. They might get it to work faster than your people, but probably not much quicker.

FOSS often has a Batphone, but few people pay for it. As a result management doesn’t want their Ops to be the only possible team to correct things.

vetinari2• 2 years ago

Tech people are those, who have to fix everything once SHTF.

Business people are those, who get to go to nice trips and dinners for their "right" decision.

Any other questions?

inemesitaffia• 2 years ago

Nothing

Thier transactions and rollbacks and logging actually work

zaphar9• 2 years ago

They work just fine on Postgres and MS SQL too.

duxup• 2 years ago

Let's say you're going through an Oracle audit.

Short of imagining some long ongoing legal action, is there really any incentive for Oracle to be truthful about anything?

It seems like this entire auditing system is just a wildcard as far as time / money sunk into the auditing process and Oracle can deploy it at will...

bagels• 2 years ago

Why would anyone have chosen Oracle in the last... 10 years (let alone even further back)? It's expensive, and many things I read from customers hints at deep regret.

layer82• 2 years ago

Having to use a software product that requires Oracle. This is the case in some industries.

JTyQZSnP3cQGa8B• 2 years ago

20 years ago for me. I learned about the sleazy business tactics of Oracle when I started to read Slashdot at the university.

hudsonjr• 2 years ago

The "new contract" vs old sounds like internal problems where I work.

We'll have a contract signed and everything is OK for a couple years. Then someone goes ham on inventing an approval matrix and other policy/rules to keep the offshored workers from making mistakes, and we have problems. Vendors getting paid late because of policy.

Even if we provide the contract we'll get arguments that it can't be so because it says something different in their database. It's that way in their DB, because if unknown, they default to whatever is best for our company.

neilv2• 2 years ago

How frequent are these Oracle audits?

My first thought was that you'd want to have ongoing diligence to be compliant. (Just like you don't want to have a delinquent debt with a loan shark who relishes penalties.)

But my second thought was that, if the audits are infrequent, some companies might intentionally violate the licenses. Or not want to know nor have a paper trail if there are inadvertent violations. (Both companies and individuals tend to like to kick problems down the road. Due to short-term thinking by businesses, and individuals who might be gone before chickens come home to roost.)

LanceH• 2 years ago

How frequent are these Oracle audits?

Frequently kicked off by aggrieved ex-employees.

Takennickname• 2 years ago

Got an email from oracle recently that said (paraphrased):

"We saw downloads for virtual box from your IP address but no licenses for your organization. Please let us know when is a suitable time to meet to explain the benefits of being licensed correctly."

exhilaration• 2 years ago

Man that's terrifying. Every business with software engineers needs make sure that the the Oracle, MySQL, Java.com, and Virtual Box domains are blocked on their network.

walrus014• 2 years ago

They have actually been scraping ARIN IP space registration data for this and sending threats to people who hold IP space that has absolutely nothing to do with the actual business end user with a DIA circuit and static /30 that downloaded virtualbox. It's a ridiculous abuse of ARIN WHOIS data.

From the point of view of ISPs receiving such threats it is the most preposterous thing ever.

RobotToaster2• 2 years ago

Out of interest, what happens with this sort of thing if you direct them to the reply given in arkell v pressdram?

bluedino• 2 years ago

The other side of this is having a license for something, but other users at your organization are using it as well, but don't have licenses.

The company will then want to meet and discuss licensing, and if that doesn't happen they'll cut your IP addresses off.

This is typically something that's free for personal use but requires a license for commercial use. We've ran into this with a few things.

alyandon• 2 years ago

Going through this at my employer and it's not VirtualBox they are inquiring about. VirtualBox is open source but the VirtualBox Extensions pack that gives useful features (usb passthrough, pxe booting, VM encryption, etc) isn't open source and Oracle changed the licensing around it sometime around 2018 to require payment.

everfrustrated• 2 years ago

Docker also does this too for their Desktop product.

If any dev downloads and installs it within your org expect an email from them to check up on your licensing.

afandian• 2 years ago

Maybe this is what it takes to put paid to return-to-office?

barryrandall• 2 years ago

Looks like someone at Oracle discovered "customer intent" data.

juliangmp• 2 years ago

Any time I read anything about oracle I wonder why anyone in their right mind would ever chose to do business with them

neilv2• 2 years ago

A user of Oracle since the 1980s,

We all know about Resume-Driven Development and hopping to another company every 18 months, incidentally avoiding the consequences.

But a very different model is when people are entrenched in a shop where not only is there big legacy investment/lock-in that would be hard/prohibitive for the company to shed, but also the personnel's familiarity with the legacy setup gives job security. So there are multiple reasons to pay the Oracle Tax (and/or Microsoft Tax) and not disrupt the status quo.

seniorThrowaway3• 2 years ago

For Oracle DB there are a number of viable, well built and active open source alternatives like Postgres, is there any real alternative to Active Directory? I've long considered AD to be microsoft's true killer app, especially for very large enterprises.

mschuster91• 2 years ago

Depends if you're masochist enough to run Samba. It can deal with the lower stack side pretty well, but the administration UI options available all pale in comparison to native Microsoft.

In any case many are shifting towards not running AD any more and instead use JAMF and similar solutions. Less attack risk (because let's face it, it's really really easy to shoot yourself into the foot with AD), and more buzzwords for the buzzword-happy C suite.

ClueslessTech99• 2 years ago

FreeIPA or OpenLDAP?

tatersolid• 2 years ago

is there any real alternative to Active Directory?

Yes, it’s called Microsoft Entra ID…

bediger4000• 2 years ago

I worked at a phone company circa 2010 that basically had an office of Oracle compliance. They had lots of ongoing disputed. I sat in a cubicle across from the guy who worked to get projects off Weblogic Server after Oracle acquired BEA. The doctrine was that WLS cost more and used 4X the CPU and memory that alternatives did, in addition to avoiding Oracle audits.

lowercased• 2 years ago

Not Oracle related, but ... in the late 90s, I was at a company that was doing web stuff - number of cgi/perl projects, but they'd started doing ASP as well in 98. Had a couple clients really scale up - one client had 80 servers load balanced, all running Windows NT. A friendly MS rep stopped by because the client had been getting so much press for their ecommerce work (which we were doing) and went... "oh wow, you have 150 servers that each should be licensed at $8k/server... let's talk!". The very next day the CEO came to a big dev meeting and started ranting that we needed to optimize the hell out of the sites to get the server count down ASAP. And... we also became an 'official' MS partner, which seemed to put the kibosh (officially or otherwise) on more expansive work in to Java. We were doing a bit of Java, but I think we'd have expanded more in that direction without the MS pressure. Yes, they fed us more work... but it meant... we were doing more hands on work (fixing loads of bugs in their commerce server) while they just collected license revenue. Great business if you can get it, I guess...

FWIW, I have no doubt that story was not isolated at the start of the web boom. I just happened to see inside a company when it was happening. It's also why I tend to take a FOSS-first attitude to tech.

cyberax5• 2 years ago

Windows NT (just like Oracle) simply had a setting in the control panel for the number of connections allowed. You were supposed to buy licenses for all of them, but in practice nobody seriously followed that. Until they got audited by the BSA (Business Software Alliance).

To be fair, though, Microsoft typically was willing to work with companies and negotiate volume discounts. They were not interested in immediate shakedowns (like Oracle), but preferred building long-term relationships.

I guess this is why Microsoft is respected, while Oracle is despised.

dsign• 2 years ago

At my job, we have been merrily replacing Oracle products by open-source ones. You know, the common thing any employee feels morally obligated to do as soon as they realize there is an Oracle product in the stack. But the interesting bit is how those products got there: in some companies, you call it "modern stack" if the tech is less than fifteen years old. Sometimes they will replace a part of it and instead of jumping all the way to the present, they go like "Well, it's 2024 now. So, we need to migrate our stack from 2009 to 2010 this year. What version of Jboss came out in 2010? We need to update to that one. PostgreSQL? No, PostgreSQL 8 doesn't support deferrable unique constraints, which we need. We need to keep paying for OracleDB until June."

nlh• 2 years ago

Having gone through an IRS audit (spoiler alert: I do not recommend.), I can't imagine anyone willingly signing any sort of contract with a private company that allows them to treat you the same way.

cyberax5• 2 years ago

Technically, if you buy anything in volume from Microsoft, they have the right to audit you: https://www.microsoft.com/en-us/licensing/learn-more/complia...

znpy• 2 years ago

As the old saying goes: oracle has no customers, only hostages.

'We had to educate Oracle about our contract,' CIO says after Big Red audit

Related Stories