Category Archives: Smackdown!

I am so mad right now I could just spit. Key Bank has been slow-rolling me at every turn as I attempt to get them to pay off on one of Dad’s insurance policies. The latest: I asked them to fax a piece of information to the insurance company. After multiple requests, they finally sent in the necessary form… and left most of it blank. Naturally, the insurance company was not amused, and now I’m essentially back to square 2.

My immediate urge is to write a paint-scorching letter to several of these folks. However, I’m going to give them another two business days to get all their socks in the same basket. If they haven’t squared things away by then, it’s hammer time.

Update 8/25: a supervisor at Key was able to get the documentation problems solved, although it took longer than it should have. I’m debating whether to drop a dime on the incompetent, slow, and generally unfriendly person I had to deal with. On one hand, everyone has periods where they’re less effective than usual, so maybe she was just having a bad day. On the other hand, it’s amazing how a crisp letter can help snap people out of those kind of bad days.

I like to think that I can write a decent smackdown letter, but Michael Rakusin, director of Australia’s Tower Books, puts me to shame with his response to a bookseller’s demand that Tower pay extra fees to help the bookseller be profitable. Mr. Rakusin, my hat is off to you.

Wow. This is hard to believe: someone stole personal data on 26.5 million US military veterans from the home of a Veterans Affairs employee. What the devil was the employee doing with that data at home? “Working on a department project,” according to the NYT. This FAQ from the VA says, basically, nothing: veterans should monitor their financial accounts for unusual activity (hey, great idea), and employees are getting training so that this doesn’t happen again (training? how about some public floggings pour encourager les autres?) Thanks a lot, guys.

David Litchfield delivers some very strong medicine to Oracle in his open letter, “Complete failure of Oracle security response and utter neglect of their responsibility to their customers“. I wrote about Oracle’s bad attitude a few months ago, and it doesn’t seem to be getting better. His conclusion:

What is apparent is that Oracle has no decent bug discovery/fix/response process; no QA, no understanding of the threats; no proactive program of finding and fixing flaws. Is anyone in control over at Oracle HQ?

A good CSO needs to more than just a mouthpiece. They need to be able to deliver and execute an effective security strategy that actually deals with problems rather than sweeping them under the carpet or waste time by blaming others for their own failings. Oracle’s CSO has had five years to make improvements to the security of their products and their security response but in this time I have seen none. It is my belief that the CSO has categorically failed. Oracle security has stagnated under her leadership and it’s time for change.

I urge Oracle customers to get on the phone, send a email, demand a better security response; demand to see an improvement in quality. It’s important that Oracle get it right. Our national security depends on it; our companies depend on it; and we all, as individuals depend on it.

Wow. This essay is a stinging, and entirely accurate, assessment of the current state of the Shuttle and ISS programs. Too bad NASA won’t do anything about it. Excerpt:

In the thirty years since the last Moon flight, we have succeeded in creating a perfectly self-contained manned space program, in which the Shuttle goes up to save the Space Station (undermanned, incomplete, breaking down, filled with garbage, and dropping at a hundred meters per day), and the Space Station offers the Shuttle a mission and a destination. The Columbia accident has added a beautiful finishing symmetry – the Shuttle is now required to fly to the ISS, which will serve as an inspection station for the fragile thermal tiles, and a lifeboat in case something goes seriously wrong.

This closed cycle is so perfect that the last NASA administrator even cancelled the only mission in which there was a compelling need for a manned space flight – the Hubble telescope repair and upgrade – on the grounds that it would be too dangerous to fly the Shuttle away from the ISS, thereby detaching the program from its last connection to reason and leaving it free to float off into its current absurdist theater of backflips, gap fillers, Canadarms and heroic expeditions to the bottom of the spacecraft.

Boy, this is worth a read: Oracle’s chief security officer, Mary Ann Davidson, has an op-ed piece on CNet in which she attempts to blast some security researchers (in particular, she links to this story on Alexander Kornbrust, so I assume he’s target #1). I don’t think I would have taken her approach, for two reasons. One is that it’s going to inflame the BlackHat crowd, and will undoubtedly result in Oracle’s vulns getting much more press than they would otherwise– remember, the tech press loves controversy.

The other reason is that, given Oracle’s recent security troubles, she would have been better off to talk about how Oracle is addressing the legitimate concerns its customers have. She’s right that fixes to even simple vulns still have to go through a full test and release cycle, but she’s being disingenouous in claiming that Oracle has been responding in a timely manner to the notifications they’ve received. They haven’t (and this is not new behavior).

Fearless prediction: Oracle will get publicly spanked by Kornbrust, Litchfield, and probably some others during BlackHat. Davidson will be unrepentant.