Comment by createdapril24 | Hacker News Reader

Comment by createdapril24 | Hacker News Reader

Parent Full thread

Note the "problems they had" aren't necessarily "they needed a better database technology". Oracle's mission is to have all bits of data in the world processed or stored on an Oracle system (source: I worked for Oracle, this was the internal mission statement).

Oracle collects:

1. Who is staying in which hotels and in which rooms

2. Who is eating at which restaurants and going to which entertainment facilities

3. Who is getting what health services

4. Who is travelling where across travel industry

5. Who is working for which companies in what roles and how much are they paid

This is incredibly powerful intelligence the CIA could not NOT want. Replace "who" in any of the above with a politician in a country of interest, or other person of interest/intelligence target.

<strike> It's sort of like Facebook getting CIA funding. CIA definitely has interest to know intimate details of everyone's lives, who is sharing what information with who, and how social fabric in different countries are organized. They/we would be crazy not to. Taking the converse: The CIA wasn't funding Facebook because they really needed to socialize more with friends and family. </strike> Please see thread below. CIA investment in Facebook has not been established.

That is a pretty far cry from Oracle having the data, especially pre-cloud. I think you are conflating "an Oracle system" with a system that Oracle actually controls rather than and end user that using the software. This is like saying a hard drive manufacturer has all the data that are on their hard drives.

I think 'createdapril24 is referring to Oracle's broader data brokerage/marketplace business rather than strictly their on-premise database system business.

https://techcrunch.com/2022/08/22/oracle-us-privacy-class-ac...

Your data is in a piece of software controlled by Oracle. They can easily create a backdoor designed for NSA use. Whether they "have" your data on their hardware or not doesn't make much of a difference in this case.

Maybe don't connect your database to the internet? Which is the normal way to install it locally?

If you connect it to any network at all. Is it beyond the NSA to string together several obscure vulnerabilities to attack a specific target? [1]

I mean.. I suppose you could air gap your database, but of what utility is it to you now?

[1]: https://en.wikipedia.org/wiki/Stuxnet

There was a time when Oracle sort of worked that way. On-prem Oracle has mostly migrated to an appliance type model where phone-home is standard and almost mandatory. "Exadata".

Are you suggesting the CIA has ways to exfiltrate data from Oracle databases assisted by Oracle but without knowledge or consent of the user? That would be a pretty big deal.

If not, what are you saying?

Have you ever looked at the history of Oracle security flaws, as well as their reluctance to improve it? A public resource for this is David Litchfield.

Not OP. Just saying:

[X] https://en.wikipedia.org/wiki/National_security_letter

Why would you need data to be in a specific brand of database before you can send legal process for it?

You wouldn't. It just simplifies 'things', from a technical and operational POV.

In what way does it simplify 'things'?

No actually, the problems they had are just that the US intelligence community needed relational databases. Keep in mind that this preceded the internet and online hotel bookings.

Do you have a link to details about the CIA funding FB? I heard that as a rumor but thought it was debunked

Honestly I had not fact checked this. A quick internet search found lots of articles making different claims (CBS News says yes, Reddit says yes, IQT website does not list, Quora says no.) Overall there doesn't appear to be a very strong argument and this Quora article (https://www.quora.com/What-is-the-substance-of-the-claim-tha...) makes a compelling case that the connection is too tenuous.

I will remove from parent content.

Reply on news.ycombinator.com