WEBVTT - The Story of Oracle: Part Three 0:00:04.160 --> 0:00:07.160 Get in touch with technology with tech Stuff from how 0:00:07.240 --> 0:00:13.840 stuff works dot com. Hey Lere, and welcome to tech Stuff. 0:00:13.880 --> 0:00:16.760 I'm your host Jonathan Strickland. I'm an executive producer with 0:00:16.880 --> 0:00:20.400 how Stuff Works and I love all things tech. And 0:00:20.520 --> 0:00:22.680 at the end of our last episode, we left off 0:00:22.720 --> 0:00:26.439 with Oracle in the year two thousand, Larry Ellison, a 0:00:26.560 --> 0:00:30.600 co founder of the company, had just decided to consolidate power, 0:00:30.720 --> 0:00:35.319 and according to former Oracle president Raymond Lane, stripped him 0:00:35.320 --> 0:00:38.320 of all authority from the role of president in order 0:00:38.360 --> 0:00:42.160 to convince Lane to resign. So that's what Lane did, 0:00:42.600 --> 0:00:45.440 and Oracle stock took a little bump and reviews. The 0:00:45.440 --> 0:00:48.600 most recent software for Oracle at the time, We're mixed 0:00:48.760 --> 0:00:52.840 at best. Oracle had also failed to capitalize on Larry 0:00:52.840 --> 0:00:57.480 Ellison's grand plan to transform computing by boarding everything over 0:00:57.520 --> 0:01:00.600 to a web based approach. He had hoped to introduced 0:01:00.760 --> 0:01:04.560 network computers, which were essentially stripped down PCs that have 0:01:04.680 --> 0:01:07.120 very few bells and whistles. They didn't even have a 0:01:07.160 --> 0:01:10.319 hard drive, which would have brought the price down to 0:01:10.360 --> 0:01:14.240 about five dollars per unit, so that would be the 0:01:14.280 --> 0:01:17.600 attractive factor there. All the software and storage that you 0:01:17.600 --> 0:01:21.280 would need for your Your computer would actually be accessed 0:01:21.280 --> 0:01:23.240 over the Internet, so all you had to have was 0:01:23.280 --> 0:01:26.360 a persistent Internet connection. Again, this is sort of like 0:01:26.440 --> 0:01:29.080 going back to the old mainframe days where you would 0:01:29.160 --> 0:01:32.319 use a dumb computer terminal to access the power of 0:01:32.319 --> 0:01:35.399 the main frame, except instead of a mainframe, your accessing 0:01:35.680 --> 0:01:38.280 servers on the Internet. He was ahead of the curve 0:01:38.360 --> 0:01:41.919 on that one, and the experience uh that Oracle actually 0:01:42.000 --> 0:01:45.480 delivered ended up falling short of the promises that he 0:01:45.520 --> 0:01:48.400 had been making, something he actually apologized for at the 0:01:48.440 --> 0:01:51.840 press conference in and it took a few years, but 0:01:51.960 --> 0:01:54.720 later on we would actually see computers similar to the 0:01:54.760 --> 0:01:58.280 network computer concept hit the market, with stuff like chromebooks, 0:01:58.360 --> 0:02:01.240 for example. This was also right around the time that 0:02:01.320 --> 0:02:04.960 the dot com bubble was collapsing. Startup companies that seemed 0:02:05.000 --> 0:02:08.639 to be destined for greatness were fizzling out left and right. 0:02:09.040 --> 0:02:13.040 Oracle was better established and wasn't solely reliant upon web 0:02:13.080 --> 0:02:16.360 oriented businesses, and it was able to get through the turmoil, 0:02:16.600 --> 0:02:19.960 as did both net Suite and salesforce dot Com, which 0:02:19.960 --> 0:02:24.200 were two web based ventures that had been launched by 0:02:24.280 --> 0:02:28.000 former Oracle employees. They were also two ventures that Larry 0:02:28.040 --> 0:02:31.400 Ellison had helped fund a couple of years earlier. So 0:02:31.440 --> 0:02:33.359 all three of those managed to get through the dot 0:02:33.400 --> 0:02:36.360 com bubble collapse, but a lot of other companies weren't 0:02:36.400 --> 0:02:39.000 so fortunate. Oh and there was another thing that happened 0:02:39.000 --> 0:02:41.760 in two thousand. There was an event called trash Gate. 0:02:42.040 --> 0:02:44.880 At least later on it was dubbed that. Let me 0:02:45.240 --> 0:02:47.520 set the grounds for this because it's kind of a 0:02:47.639 --> 0:02:51.680 juicy scandal. So Oracle's arch enemy in the market was 0:02:51.720 --> 0:02:56.760 always Microsoft. Microsoft was the number one largest software company 0:02:56.800 --> 0:02:59.480 in the world, and Ellison always wanted Oracle to overtake it, 0:03:00.120 --> 0:03:02.280 and he was always pushing for that to to take 0:03:02.320 --> 0:03:05.519 that spot away from Bill Gates's company. Not at the time, 0:03:05.960 --> 0:03:09.920 Microsoft was in the middle of a massive antitrust lawsuit. 0:03:10.200 --> 0:03:13.000 I'll probably do an episode at some point to really 0:03:13.040 --> 0:03:15.919 dive into that lawsuit in detail and explain what what 0:03:16.000 --> 0:03:18.960 was happening and why it was important. But anyway, the 0:03:19.000 --> 0:03:24.280 important thing was that Microsoft was financially funding several groups 0:03:24.320 --> 0:03:28.280 that were lobbying on the company's behalf, and Oracle wanted 0:03:28.320 --> 0:03:31.679 to do some investigation here and try to kind of 0:03:32.720 --> 0:03:37.840 uh counteract these groups influence on the outcome of this 0:03:37.960 --> 0:03:42.360 antitrust lawsuits, so they hired an investigative firm to look 0:03:42.360 --> 0:03:45.680 into those groups, and the efforts went so far as 0:03:45.720 --> 0:03:48.560 to offer up essentially a reward for handing over the 0:03:48.600 --> 0:03:51.360 contents of waste paper baskets to see if there were 0:03:51.400 --> 0:03:54.000 any evidence there the groups were working to influence the 0:03:54.000 --> 0:03:58.119 outcome of the case, thus the term trash gate. Now 0:03:58.160 --> 0:04:02.720 that didn't reflect well on either Microsoft or Oracle. Oracles 0:04:02.760 --> 0:04:05.400 accusations that Microsoft was using these groups in a way 0:04:05.440 --> 0:04:08.720 to try and get a better outcome for this antitrust lawsuit, 0:04:08.880 --> 0:04:12.280 that's not great. But then Oracle also wallowing in the 0:04:12.320 --> 0:04:15.080 garbage of another company in order to look for evidence, 0:04:15.160 --> 0:04:17.720 some dirt to dig up on them. That didn't look 0:04:17.760 --> 0:04:21.440 great either. Ellison would argue that the actions were entirely legal. 0:04:21.880 --> 0:04:25.200 Maybe not ethical, but they were legal, although you could 0:04:25.279 --> 0:04:29.039 argue that nobody really came out of that looking too great. 0:04:29.400 --> 0:04:33.440 But despite all of these things, despite the controversy, despite 0:04:33.480 --> 0:04:36.560 the bump in the stock price, despite all of that, 0:04:36.760 --> 0:04:39.200 the company was still in a strong position, much better 0:04:39.240 --> 0:04:41.440 than it had been a decade earlier in the early 0:04:41.520 --> 0:04:44.840 nine nineties when things were not so certain. So let's 0:04:44.920 --> 0:04:48.200 learn about what has happened with Oracle since two thousand 0:04:48.320 --> 0:04:50.800 and where it is today. One other thing that I 0:04:50.839 --> 0:04:53.000 have to cover that did happen in two thousand was 0:04:53.040 --> 0:04:57.120 that Oracle partnered with a Texas based company called Entrust 0:04:57.279 --> 0:05:03.040 Technologies Incorporated on a project named Oracle Advanced Security. Now. 0:05:03.080 --> 0:05:06.400 This was meant to combine database technology with strong encryption 0:05:06.440 --> 0:05:10.279 and authentication tools to better protect data from hackers. The 0:05:10.320 --> 0:05:13.480 project would become an add on feature for Oracle Database 0:05:13.640 --> 0:05:16.880 Enterprise Edition. Today's version of this includes the ability for 0:05:16.920 --> 0:05:20.880 administrators to mask specific parts of a database so that 0:05:21.080 --> 0:05:26.039 only authorized users can view those sections. Unauthorized users won't 0:05:26.040 --> 0:05:27.719 be able to see those sections, but they would still 0:05:27.760 --> 0:05:30.280 be able to see other ones, which comes in handy 0:05:30.320 --> 0:05:32.719 if you want people to work with databases that contain 0:05:32.800 --> 0:05:35.480 sense the material that they really shouldn't see. They can 0:05:35.520 --> 0:05:37.760 still do their work in the sections of the database 0:05:37.800 --> 0:05:40.280 they are authorized to use, and the bits they're not 0:05:40.320 --> 0:05:42.560 supposed to see will just remain hidden from view. So 0:05:42.600 --> 0:05:44.640 you can imagine how this would be handy if you 0:05:44.680 --> 0:05:48.359 were working with a database that contained payroll information, for example. 0:05:49.160 --> 0:05:51.880 And at the end of two thousand, despite that drop 0:05:51.880 --> 0:05:54.919 in stock, the company finished the fiscal years strong with 0:05:55.000 --> 0:05:58.560 ten point to billion dollars in revenue and earnings at 0:05:58.600 --> 0:06:01.599 six point three billion dollars. That's the highest in its 0:06:01.680 --> 0:06:05.039 history at that point. Now, according to Larry Ellison, Oracle 0:06:05.120 --> 0:06:08.120 was able to save a billion dollars in costs by 0:06:08.200 --> 0:06:11.800 using the company's own Oracle E business suite. So he 0:06:11.880 --> 0:06:15.279 was taking the opportunity to point at Oracle's earnings and say, 0:06:15.320 --> 0:06:17.560 the reason, or one of the reasons this number is 0:06:17.560 --> 0:06:20.240 so high is because we use our own products, so 0:06:20.360 --> 0:06:25.120 you should too, using the company's performance as a commercial 0:06:25.160 --> 0:06:29.200 for the company's project products. Rather, two thousand one would 0:06:29.240 --> 0:06:32.520 have even more in revenue, though earnings would actually drop 0:06:32.640 --> 0:06:36.680 to two point six billion, Still not a bad chunk 0:06:36.720 --> 0:06:39.760 of change. I would happily take two point six billion 0:06:39.800 --> 0:06:43.200 dollars if someone wants to hand it out. Ellison also 0:06:43.240 --> 0:06:46.320 announced the Oracle nine Eyed database. That was a suite 0:06:46.360 --> 0:06:50.120 that included the Oracle Real Application Clusters or Oracle R 0:06:50.200 --> 0:06:53.960 a C, which is sort of a type of grid computing. Now, 0:06:54.000 --> 0:06:57.120 I mentioned grid computing in some recent episodes, but let 0:06:57.120 --> 0:07:00.239 me give you a quick rundown on what that means 0:07:00.279 --> 0:07:03.240 in case you're not familiar. First, let's start with a 0:07:03.279 --> 0:07:08.040 basic computer, a single computer. It has a single core processor. 0:07:08.839 --> 0:07:12.480 Now that architecture works for basic computer problems, but it 0:07:12.560 --> 0:07:17.240 has limitations. The single core essentially works on problems one 0:07:17.320 --> 0:07:20.080 operation at a time. Now, you can make this type 0:07:20.080 --> 0:07:22.920 of computer really fast by beefing up the clock speed 0:07:22.960 --> 0:07:25.960 on the processor so it can run more operations in 0:07:26.000 --> 0:07:28.880 the same amount of time. It's just running each operation 0:07:28.920 --> 0:07:33.440 more quickly than it was before. But for sufficiently complex problems, 0:07:33.440 --> 0:07:36.640 this will only speed things up a little bit. Now 0:07:36.840 --> 0:07:40.440 you also have multi core processors. This is like having 0:07:40.480 --> 0:07:43.480 a computer that has a couple of different brains, or 0:07:43.520 --> 0:07:46.000 maybe it has a brain that can multitask and solve 0:07:46.040 --> 0:07:48.960 more than one set of problems at a time. Multi 0:07:48.960 --> 0:07:52.720 core processors are great for what we call parallel problems, 0:07:52.760 --> 0:07:57.560 sometimes embarrassingly parallel problems. It's actually a technical term. Now, 0:07:57.560 --> 0:08:00.440 these are a category of computer problems that can be 0:08:00.480 --> 0:08:03.960 divided into parallel tasks that may be solved at the 0:08:04.040 --> 0:08:07.400 same time before you get to your ultimate resolution of 0:08:07.440 --> 0:08:09.240 the problem. So, in other words, it doesn't have to 0:08:09.240 --> 0:08:12.760 be done sequentially. You can split it up into different 0:08:13.120 --> 0:08:16.880 parts of the problem. Not all problems fall into that category. 0:08:16.920 --> 0:08:18.920 By the way, but a lot of them do. And 0:08:18.920 --> 0:08:21.800 a multi core processor may be able to solve certain 0:08:21.840 --> 0:08:26.560 computational problems faster than a single core processor, even if 0:08:26.600 --> 0:08:30.640 the single core processor has a significantly higher clock speed 0:08:30.880 --> 0:08:33.720 than the multi core processor does. And I've used this 0:08:33.800 --> 0:08:36.880 example before, but let's stick with it because I think 0:08:36.920 --> 0:08:41.440 it works pretty well. Imagine that you've got a classroom. 0:08:41.480 --> 0:08:45.400 It's filled with math students, and there are eleven students 0:08:45.440 --> 0:08:49.880 there total. One of those math students is a true genius. 0:08:50.040 --> 0:08:53.000 She can solve any math problem faster than anyone else 0:08:53.000 --> 0:08:56.240 in the class. Now, the other ten are good students, 0:08:56.360 --> 0:08:58.640 but they take a little longer to get the right 0:08:58.679 --> 0:09:01.880 answer for any given problem them. One day, the teacher 0:09:01.920 --> 0:09:05.440 hands out a pop quiz. The genius gets ten math 0:09:05.520 --> 0:09:10.000 problems to solve. The other ten students get one problem each. 0:09:10.200 --> 0:09:13.080 So student one gets problem one, Student two gets problem 0:09:13.160 --> 0:09:17.280 to the question is who will finish first? Chances are 0:09:17.559 --> 0:09:21.480 the ten individual students will finish first because each only 0:09:21.559 --> 0:09:24.720 has to get one answer, while our genius has to 0:09:24.760 --> 0:09:28.160 finish all ten of the questions. So while she may 0:09:28.200 --> 0:09:31.280 be faster on an individual basis, when she tackles a 0:09:31.280 --> 0:09:34.600 problem that can be solved in parallel, the other students 0:09:34.640 --> 0:09:38.480 have an advantage. So that's the same idea with multi 0:09:38.559 --> 0:09:43.280 core processors. Now let's go back to grid computing. Grid 0:09:43.320 --> 0:09:48.360 computing is a lot like multi core processors, except instead 0:09:48.400 --> 0:09:53.400 of cores in a processor, we're talking about individual computers. 0:09:53.840 --> 0:09:56.120 This is a network of computers that can take on 0:09:56.200 --> 0:10:00.160 a computational load. With Oracle software, the idea was that 0:10:00.200 --> 0:10:02.679 a grid of computers could handle the tasks of a 0:10:02.720 --> 0:10:06.319 more powerful machine, so you could use low cost computers 0:10:06.360 --> 0:10:09.000 that would work together to act like it was a 0:10:09.040 --> 0:10:13.400 powerful database server, which would bring operational costs down, and 0:10:13.440 --> 0:10:15.640 it becomes easy to scale up because you just add 0:10:15.679 --> 0:10:19.079 more low cost machines to the grid. This became a 0:10:19.120 --> 0:10:21.960 popular feature, and upon launch, it was the only database 0:10:22.000 --> 0:10:25.040 software that could work in computer clusters running on Unix 0:10:25.160 --> 0:10:28.840 or Windows operating systems. It's a really attractive solution for 0:10:28.880 --> 0:10:31.400 a lot of database managers, and the reason for that 0:10:31.880 --> 0:10:35.000 is that if you have a breakdown, it's pretty cheap 0:10:35.040 --> 0:10:38.439 to fix stuff. Right if you're using low cost computers 0:10:38.440 --> 0:10:42.520 with relatively low cost off the shelf components. If something fails, 0:10:42.760 --> 0:10:46.160 it's easy to get a replacement part. It's easy to 0:10:46.200 --> 0:10:48.520 swap it out, and it doesn't cost a whole lot, 0:10:48.600 --> 0:10:53.760 Whereas if you're using a very expensive proprietary system, it 0:10:53.800 --> 0:10:58.120 could be incredibly costly if something fails and you may 0:10:58.120 --> 0:11:00.520 not have a redundant system to back it up. But 0:11:00.600 --> 0:11:05.440 with low cost solutions, you could actually buy essentially twice 0:11:05.440 --> 0:11:08.000 as many or maybe even three times as many machines 0:11:08.040 --> 0:11:11.640 as you need, have redundancy built in, and still overall 0:11:11.679 --> 0:11:13.880 be operating at a lower cost than you would be 0:11:13.920 --> 0:11:15.720 if you were using one of those super high end 0:11:15.800 --> 0:11:20.040 powerful computers. And so we've seen this model being adopted 0:11:20.080 --> 0:11:23.000 across multiple industries. This is the same sort of model 0:11:23.040 --> 0:11:26.760 that Google uses for its various servers, the idea of 0:11:26.800 --> 0:11:30.120 going with off the shelf components so that you can 0:11:30.400 --> 0:11:34.720 uh streamline your process. And yeah, it's not as fancy 0:11:34.920 --> 0:11:37.680 or as fast as your top of the line computers, 0:11:38.240 --> 0:11:40.920 but when you're looking working at it at a scale, 0:11:41.480 --> 0:11:45.400 it's the most most efficient method. Plus again, if you 0:11:45.440 --> 0:11:49.199 want to increase your system's capacity, you just add more 0:11:49.280 --> 0:11:54.040 computers to it. This works really well for those operations 0:11:54.080 --> 0:11:57.079 that can be worked in in parallel. Now, if you're 0:11:57.120 --> 0:11:59.640 working on something that requires just a really, really fast 0:11:59.679 --> 0:12:03.760 process sessor and it cannot be broken down into parallel tasks. 0:12:04.160 --> 0:12:07.120 This approach would not make any sense. So it really 0:12:07.160 --> 0:12:11.200 depends upon the the applications you have in mind. It 0:12:11.240 --> 0:12:15.840 doesn't work for everything. All right. That sets the ground 0:12:16.200 --> 0:12:20.040 for where we're going. Ellison made another grandiose claim in 0:12:20.080 --> 0:12:23.760 two thousand two and stated that Oracle Database software was 0:12:23.960 --> 0:12:27.360 quote unbreakable. Now, what he meant by that was that 0:12:27.400 --> 0:12:30.640 the security around it was iron clad and that the 0:12:30.679 --> 0:12:35.640 software had passed fifteen different security evaluations. And they launched 0:12:35.640 --> 0:12:40.319 a campaign where they referred to this as unbreakable software. 0:12:40.480 --> 0:12:43.199 But how did that turn out? Well, I'll tell you, 0:12:43.600 --> 0:12:54.400 but first let's take a quick break to thank our sponsor. Well, 0:12:54.480 --> 0:12:56.719 it turns out if you make such a big claim 0:12:56.760 --> 0:13:02.559 that you're security is unbreakable, you tend to inspire people 0:13:02.600 --> 0:13:07.640 to test that claim, such as a Scottish entrepreneur named 0:13:07.840 --> 0:13:12.120 David Litchfield. He's a hacker who wanted to really test 0:13:12.200 --> 0:13:16.040 this out. He had founded a company called ings Software 0:13:16.120 --> 0:13:19.840 shortly before Ellison made this big pronouncement, and he decided, 0:13:19.920 --> 0:13:21.640 you know what, I'm gonna look at this code. I'm 0:13:21.640 --> 0:13:24.559 really gonna explore and see if there are in fact, 0:13:25.080 --> 0:13:28.199 UH no vulnerabilities here if there's no way to exploit 0:13:28.240 --> 0:13:30.840 it and get access to information that I should not 0:13:30.960 --> 0:13:36.680 have access to. And Litchfield has been a a participant 0:13:36.920 --> 0:13:40.080 in the hacker community for years. He has given numerous 0:13:40.120 --> 0:13:46.440 presentations about UH software security at various conferences, including the 0:13:46.480 --> 0:13:51.280 black Hat Conference, and within twenty four hours of deciding 0:13:51.280 --> 0:13:55.560 he was going to challenge oracles claim on Unbreakable, he 0:13:55.760 --> 0:13:59.719 said he discovered thirty five flaws in Oracles code that 0:13:59.720 --> 0:14:04.280 could potential vulnerabilities. According to Lichfield, he contacted Oracle to 0:14:04.320 --> 0:14:07.079 alert them to those flaws, and he only went public 0:14:07.440 --> 0:14:10.840 with his findings after he gave the company a chance 0:14:10.880 --> 0:14:14.720 to send out software patches to fix the vulnerabilities. He said, well, 0:14:14.720 --> 0:14:16.960 that didn't happen, And when it didn't happen, I went 0:14:17.000 --> 0:14:20.200 public because I felt like it forces their hand to 0:14:20.400 --> 0:14:23.320 go and do something about it. Otherwise they might just 0:14:23.360 --> 0:14:25.760 sit on it, and then you have these vulnerabilities out 0:14:25.760 --> 0:14:29.080 in the wild. Litchfield would end up having a long 0:14:30.000 --> 0:14:35.360 adversarial relationship with Oracle. He frequently would test various builds 0:14:35.360 --> 0:14:39.160 of Oracle software and would publish vulnerabilities on a regular basis, 0:14:39.720 --> 0:14:42.760 often to the constern nation of Oracle. But to be fair, 0:14:43.400 --> 0:14:49.040 Lichfield was not necessarily advocating the exploitation of those vulnerabilities. Rather, 0:14:49.600 --> 0:14:52.080 he was calling on Oracle to treat security as a 0:14:52.160 --> 0:14:55.280 foundation for its software, rather than what he referred to 0:14:55.400 --> 0:14:58.920 as a goal keeping strategy, where you would just add 0:14:58.960 --> 0:15:01.600 in a security measure at the end of the development 0:15:01.600 --> 0:15:04.560 phase rather than from the beginning. He said, what they're 0:15:04.560 --> 0:15:07.800 doing is they're trying to paste this security approach on 0:15:08.080 --> 0:15:11.120 after they've developed everything else, and there's not always a 0:15:11.160 --> 0:15:13.760 good fit there and a miss stuff as a result. 0:15:14.280 --> 0:15:17.280 He was saying what they should do is create a 0:15:17.400 --> 0:15:21.000 secure approach from the very beginning of development and test 0:15:21.040 --> 0:15:25.120 it throughout the process to make sure that it remained intact. 0:15:25.880 --> 0:15:29.280 So that was his argument. In two thousand four, oracles 0:15:29.320 --> 0:15:32.880 chief security officer Mary Ann Davidson would write a piece 0:15:32.920 --> 0:15:36.040 for zd net that said hackers like Lichfield where a 0:15:36.040 --> 0:15:40.520 security threat to Oracle customers, and Lichfield's response was that 0:15:40.880 --> 0:15:44.720 she should resign from her position and from Oracle, because 0:15:44.720 --> 0:15:50.440 he said that that was a irresponsible response to what 0:15:50.600 --> 0:15:54.120 he had done. But I read Davidson's piece because I 0:15:54.160 --> 0:15:58.040 wanted to make sure I gave everyone a fair ground. 0:15:58.120 --> 0:16:01.440 While I was researching this to quically, I tend to 0:16:02.080 --> 0:16:05.160 side with hackers because there have been plenty of stories 0:16:05.480 --> 0:16:09.560 of companies that publish software that have critical vulnerabilities in 0:16:09.640 --> 0:16:13.400 them and then are alerted to those vulnerabilities and then 0:16:13.520 --> 0:16:17.280 appear to do very little in response to that. And 0:16:17.320 --> 0:16:21.120 thus the hackers who found the vulnerability say, it's my 0:16:21.200 --> 0:16:24.520 responsibility to make this public because that will put the 0:16:24.560 --> 0:16:27.240 pressure on the companies to actually fix the problem or 0:16:27.240 --> 0:16:30.160 else they're going to lose customers. That's the argument. The 0:16:30.200 --> 0:16:33.240 hackers have the approach of, well, if you don't do 0:16:33.240 --> 0:16:35.640 anything about it, someone's going to take advantage of it. 0:16:35.720 --> 0:16:39.880 People will get hurt in response. So the only thing 0:16:40.000 --> 0:16:43.160 I can do, since I can't fix the problem for you, 0:16:43.480 --> 0:16:45.880 is to let everyone know the problem exists, and then 0:16:45.920 --> 0:16:49.960 you have to fix it. Well, Davidson wrote a piece 0:16:50.080 --> 0:16:51.920 and I read it, and, like I said, she made 0:16:51.920 --> 0:16:55.560 some good points. She mentioned that patching of vulnerability can 0:16:55.600 --> 0:16:57.760 take a lot of time. It can take more time 0:16:57.800 --> 0:17:01.000 than a hacker might assume it takes. She said, it 0:17:01.040 --> 0:17:03.280 may only take twenty minutes to change a couple of 0:17:03.320 --> 0:17:06.560 lines of code and everything's fine. But often it takes 0:17:06.560 --> 0:17:08.840 more than that. It may be a vulnerability that only 0:17:08.880 --> 0:17:12.760 pertains to one build of the software for a particular 0:17:12.800 --> 0:17:16.680 operating system or architecture, and if you offer up software 0:17:16.720 --> 0:17:20.400 for multiple operating systems and architectures, you have to test 0:17:20.440 --> 0:17:22.919 all of them to find out where this vulnerability exists 0:17:22.960 --> 0:17:25.000 and where it may not. So it may mean that 0:17:25.040 --> 0:17:26.840 you have to take a little more extra time for that. 0:17:27.080 --> 0:17:29.760 It could take time to patch it and then time 0:17:29.800 --> 0:17:32.800 to distribute it to your customers. And she argued that 0:17:32.800 --> 0:17:36.879 hackers who published vulnerabilities are not necessarily motivating companies to 0:17:36.920 --> 0:17:40.280 fix problems, but rather jumping ahead of a fix that's 0:17:40.359 --> 0:17:44.360 on the way now. If you're being generous, you could say, well, 0:17:44.400 --> 0:17:47.119 that might be the case, and perhaps Litchfield and others 0:17:47.119 --> 0:17:50.399 of his ilk have unreasonable expectations when it comes to 0:17:50.480 --> 0:17:54.280 sending out fixes. Maybe there needs to be better communication 0:17:54.320 --> 0:17:57.520 between the hackers and the companies to say, the companies 0:17:57.560 --> 0:18:01.200 would respond with, thank you for alerting us to this problem. 0:18:01.240 --> 0:18:04.240 We will work on it. We have an estimated time 0:18:04.280 --> 0:18:06.160 of when we think we can get a patch out, 0:18:06.200 --> 0:18:08.879 and it is at X time. Maybe at that point 0:18:09.359 --> 0:18:11.600 everyone's on the same page and you don't have any 0:18:11.680 --> 0:18:15.679 itchy trigger fingers when it comes to publishing vulnerabilities. But 0:18:16.320 --> 0:18:19.080 I do think that Litchfield made a very good point 0:18:19.200 --> 0:18:22.680 in stating that companies like Oracle have a very high 0:18:22.680 --> 0:18:26.160 bar to meet when it comes to software security due 0:18:26.160 --> 0:18:29.080 to the nature of the code that they sell. If 0:18:29.119 --> 0:18:33.399 your product is meant to hold gigabytes of sensitive information, 0:18:34.040 --> 0:18:36.800 it better be as secure as you can reasonably expect 0:18:36.880 --> 0:18:39.480 it to be before you ship it, because it's a 0:18:39.560 --> 0:18:43.120 guarantee that hackers are going to start poking and prodding 0:18:43.160 --> 0:18:46.240 to find a weak spot. Davidson, by the way, would 0:18:46.240 --> 0:18:49.600 remain the chief security officer of Oracle. She still holds 0:18:49.600 --> 0:18:54.280 that position today, so she did not follow Litchfield's suggestion 0:18:54.359 --> 0:18:57.280 that she's resigned from the company. In two thousand three, 0:18:57.600 --> 0:19:01.200 Oracle launched a new product called Oracle ten G, which 0:19:01.280 --> 0:19:04.399 was a grid computing product. It really built on that 0:19:04.480 --> 0:19:08.080 applications cluster they had worked on previously, and now it 0:19:08.160 --> 0:19:12.600 was more of a distributed database approach. And the company 0:19:12.640 --> 0:19:16.400 also got involved in something else that took overheadlines, which 0:19:16.560 --> 0:19:20.639 was an attempt to scoop up a competitor. The competitor 0:19:20.880 --> 0:19:25.040 was a company called People soft. People Soft provided financial 0:19:25.080 --> 0:19:29.440 management software, some supply chain management products, some enterprise performance 0:19:29.440 --> 0:19:32.679 management software, and stuff like that. Essentially, it was in 0:19:32.720 --> 0:19:37.320 a very similar business as NetSuite, So if you listen 0:19:37.359 --> 0:19:40.359 to my net Suite podcast, you kind of getta have 0:19:40.400 --> 0:19:43.720 a handle for what sort of stuff that company offered clients. 0:19:44.200 --> 0:19:47.679 People Soft was in a similar business. On June second, 0:19:47.760 --> 0:19:51.000 two thousand three, people Soft issue to press release staying 0:19:51.040 --> 0:19:54.720 that the company was seeking to acquire a smaller software 0:19:54.800 --> 0:19:58.040 vendor called j D. Edwards that operated in the same 0:19:58.080 --> 0:20:00.560 space as people Soft, So in other words, they were 0:20:00.600 --> 0:20:03.119 going to buy up a competitor, but it was a 0:20:03.200 --> 0:20:07.960 smaller competitor. On June six of two thousand three, Oracle 0:20:08.280 --> 0:20:10.720 issued its own press release, so this was just four 0:20:10.800 --> 0:20:15.119 days later, and they stated that Oracle intended to acquire 0:20:15.200 --> 0:20:17.920 people Soft and invited the board of people Soft to 0:20:18.040 --> 0:20:22.240 enter into talks with Oracle, which ruffled some feathers over 0:20:22.280 --> 0:20:25.760 at the executive level at people Soft. Oracle prepared to 0:20:25.880 --> 0:20:30.080 hold a hostile takeover of the company. So let's talk 0:20:30.200 --> 0:20:33.120 about what that means. So you've got different ways where 0:20:33.160 --> 0:20:38.080 companies can merge together. There are acquisitions, they're mergers, These 0:20:38.119 --> 0:20:41.119 are two terms that kind of give you a slightly 0:20:41.119 --> 0:20:45.040 different uh feeling, right, Like, an acquisition sounds like a 0:20:45.080 --> 0:20:48.200 larger company buying up a smaller company and then incorporating 0:20:48.200 --> 0:20:51.119 that company into its operations in some way. A merger 0:20:51.200 --> 0:20:56.600 sounds more like two companies of similar size and status 0:20:56.640 --> 0:20:59.520 that merged together to form a new, mega powerful company 0:20:59.720 --> 0:21:03.560 pasably able to turn into Voltron. In a hostile takeover, 0:21:03.920 --> 0:21:08.119 one company goes directly to the shareholders of another company, 0:21:08.200 --> 0:21:11.399 and the whole purpose is an attempt to gain control 0:21:11.600 --> 0:21:14.920 of the second company. So in this case, Oracle would 0:21:14.960 --> 0:21:19.560 essentially go to People's Soft shareholders and say, hey, here's 0:21:19.600 --> 0:21:23.560 the deal. You've got shares in this company called people Soft. 0:21:24.000 --> 0:21:26.959 I would like to buy your shares at a slightly 0:21:27.040 --> 0:21:29.679 higher price than what they're worth on the market. And 0:21:29.720 --> 0:21:32.240 that way I can run this company once I get 0:21:32.240 --> 0:21:36.199 a majority of the shares, because as majority shareholder, I 0:21:36.240 --> 0:21:39.919 can vote to determine what the company does, and that 0:21:40.000 --> 0:21:43.399 way I bypass the leadership of people soften entirely because 0:21:43.400 --> 0:21:45.879 it's a publicly traded company and the company has to 0:21:45.920 --> 0:21:49.440 respond to shareholders. So all I have to do is 0:21:49.480 --> 0:21:52.760 get more than fifty of the shares, and if I 0:21:52.840 --> 0:21:55.919 do that, then I can force votes in people soft 0:21:55.960 --> 0:21:59.960 and it essentially becomes my company. And from there I 0:22:00.040 --> 0:22:02.199 can even move to the point where they agree to 0:22:02.240 --> 0:22:06.520 be acquired. But people soft headed defense for this, they 0:22:06.640 --> 0:22:10.040 used what was called a poison pill. Now, poison pills 0:22:10.040 --> 0:22:12.600 are a category. They're not, It's not just a single thing. 0:22:13.240 --> 0:22:16.639 Poison pills are strategies that got popular after a string 0:22:16.720 --> 0:22:20.440 of hostile takeovers happened in the nineteen eighties was a 0:22:20.480 --> 0:22:24.600 period of pretty cutthroat business practices, and after the nineteen 0:22:24.640 --> 0:22:27.359 eighties you started to see hostile takeovers kind of fade 0:22:27.359 --> 0:22:30.440 away and more mergers and acquisitions happen in the nineties, 0:22:30.880 --> 0:22:33.040 and poison pills were part of the reason for that. 0:22:33.359 --> 0:22:36.080 So typically, a poison pill is a measure that kicks 0:22:36.080 --> 0:22:40.399 in once any single shareholder acquires a particular percentage of 0:22:40.440 --> 0:22:44.959 ownership in a company. So for the purposes of this illustration, 0:22:44.960 --> 0:22:47.120 I'm just going to use the example of thirty percent, 0:22:47.200 --> 0:22:50.760 but that's a purely hypothetical example. There could be different 0:22:50.760 --> 0:22:54.800 percentages for different companies. So once that conditions met, as in, 0:22:55.280 --> 0:22:59.720 once one single shareholder gets hold of thirty percent of 0:23:00.040 --> 0:23:03.960 all the shares of a company the poison pill activates. Now, 0:23:03.960 --> 0:23:06.840 the outcome can take a couple of different forms. One 0:23:06.960 --> 0:23:09.920 common one is that the company will issue new shares 0:23:10.440 --> 0:23:14.600 which anyone apart from the entity that now has thirty 0:23:15.320 --> 0:23:17.800 of the shares can buy at a discount. So, in 0:23:17.840 --> 0:23:20.280 other words, let's say I'm trying to do a hostile 0:23:20.359 --> 0:23:27.400 takeover of Disney because somehow I'm rolling in cash and 0:23:27.560 --> 0:23:32.120 I have started to approach Disney shareholders, and I say, listen, uh, 0:23:32.160 --> 0:23:34.800 I know that stocks are trading at X amount. I'm 0:23:34.840 --> 0:23:40.040 ready to buy your shares at why which is higher 0:23:40.080 --> 0:23:43.040 than X? And so you'll make a profit on your shares. 0:23:43.080 --> 0:23:45.120