firstinitiallastname

A while back I wrote a post on the subtle homogenization of privacy. The point was   that social networking isn’t eroding privacy, but homogenizing it. And here’s an example of how this can become problematic. This police officer drew a mental analogy of facebook status to locker room talk.

“You have your Internet persona, and you have what you actually do on the street,” Officer Ettienne said on Tuesday. “What you say on the Internet is all bravado talk, like what you say in a locker room.”

This is a very normal thing for human beings to do. In fact, culturally, we’re all about analysis by analogy. When you don’t understand a situation, you look for analogous situations from which you can glean rules of behavior. The problem is that social networking sites like Facebook and MySpace don’t fit. The lines between public and private are hard, and not always dependent on your perception (if you post a staus on Facebook and no one reads it, is it public?). Let’s all pay attention to Officer Ettienne and learn the lesson. Unless you’re very sure, better treat the forum as public information.

Survey: Most Oracle Shops Don’t Mandate Security Patches

Heads up criminals with technical skills: Oracle products are wide open in most places! While 32% of these survey respondents are doing their cost-benefit analysis on patching their Oracle DBs, you could be stealing their data. A full 11% haven’t ever installed an Oracle patch. So get on the ball and get cracking…oh, you already have.

” ‘I think the feeling in those organizations is that since databases are a little more isolated than the desktop, there’s less of a [security] concern,’ said [Ian] Abramson, director of the enterprise data group at Thoughtcorp, an IT services firm in Toronto.”

No, Ian Abramson, it’s actually not the enterprises’ fault for mis-calculating the risk. They may have done so, but that’s not why these patches aren’t applied. Your aptly named cohort at the IOUG has it right:

“Patching databases in particular is a complex task that can require months of lab or and significant system downtime.” said Ian Abramson, the Independent Oracle Users Group’s president.

To recap, patches aren’t applied because it’s really hard to do so. Who makes it hard to apply the patches? The vendor does. Best thing Oracle could do for security would be to make applying patches easy…really easy.