Quantcast
Channel: More Than Code
Viewing all 58 articles
Browse latest View live

How Clever are Oracle Intelligent Bots?

$
0
0

Today, I’ve started on a three-week Massive Open Online Course (MOOC) on Developing Chatbots with Oracle Intelligent Bots. With 1171 people signed up, the course is full!

Oracle chatbot MOOC

I’m curious to see what Oracle can offer to distinguish themselves in the crowded chatbot space. I’ve investigated 14 of the best chatbot building platforms for developers, Top 10 Platforms To Build A Chatbot For Your Business, A Comprehensive List of 25 most amazing chatbot platforms that will rule in 2018 and beyond, and the remaining 10 top hits from Google for “chatbot platform” from the last six months. They disagree strongly on which tool is currently the best, but they agree on one thing: Oracle Intelligent Bots service is mentioned nowhere. One reason could be that it is part of Oracle Mobile Cloud Enterprise, and another could be that Oracle is once again entering a crowded marketplace late.

If you are a loyal “red stack” Oracle customer, it probably makes sense for you to buy your chatbot platform from Oracle, especially if you have a need for some of the other features of Oracle Mobile Cloud Enterprise. The most intriguing question is whether Oracle can leverage some of their other cloud services, for example getting customer or order information from an Oracle SaaS service. That would make Oracle Intelligent Bots a killer addition to the Oracle cloud for these customers.

I’ll be back with more information as I learn what the Oracle chatbots can do. If you are using chatbots (proof-of-concept or in production), I’d love to hear what platform you have chosen.

 

This post originally appeared in the Oracle Tool Watch newsletter. Sign up to receive a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud.”


237 security vulnerabilities in Oracle – do you patch?

$
0
0

At a recent conference presentation I attended, the presenter asked how many in the audience worked in an organization where all Oracle security patches were evaluated and installed as relevant. Less than 20% raised their hands. The remainder were evenly distributed among “we often install” and “we sometimes install”. That’s not good enough.

The end of January is one of those scary times of the year when Oracle announces the quarterly Critical Patch Update. This time, there are 237 vulnerabilities fixed, many of them of the worrying type that can be exploited remotely without authorization. These are the security holes that can be used by any hacker with access to your system. Pretty much the whole range of Oracle software contains vulnerabilities, including database, WebLogic, Identity Manager, WebCenter and almost all of the applications (E-Business Suite, PeopleSoft, J.D. Edwards). As always, there are also a number of Java vulnerabilities.

On a positive note, Oracle has published patches for the Spectre and Meltdown CPU bugs for Oracle Linux 6 and 7, both for the Unbreakable Enterprise Kernel and Red Hat Compatible Kernel. See Oracle support doc 2348448.1 for detail (Oracle support account required). 

Does your organization have a process in place to evaluate and install Oracle CPUs? You should have. Your organization might lose money and reputation if you don’t. And somebody might lose their job.

 

This post originally appeared in the Oracle Tool Watch newsletter. Sign up to receive a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud“. 

 

Oracle (and other) Chatbots

$
0
0

I’ve completed the Oracle Intelligent Bots online course and must compliment Oracle on their Massive Open Online Courses (MOOCs). With videos, hands-on exercises and quizzes, this is a great way of learning their technology. I encourage you to check out the list of Oracle MOOCs.

Since chatbots require a cloud subscription, participants got access to a number of pre-built service instances. Afterwards, of course, you’ll have to buy Oracle Cloud. The intelligence in the bots lies in the way it translates the actual phrases the user enters into intents. You then program how to handle each intent. The flow syntax is not trivial and very picky (you get an error for indenting a line by one space too much). For back-end logic, we accessed a pre-built REST service. Send me an e-mail if you are interested in details on the technology.

Should you learn Oracle Intelligent Bots? Well, I agree with techemergence: “chatbots are still bumbling their way through the business landscape, trying to find applications that can consistently drive real ROI for businesses.” If your company believes they have found one of the rare real use cases, it makes sense to try out Oracle’s offering if you are a loyal “red stack” customer, especially if you already have an Oracle Mobile Cloud Enterprise license.

If you are personally interested in chatbots, it makes more sense to go with one of the big four (Facebook, Microsoft, Amazon, or Google). All of them have free offerings and/or better trials than Oracle, and they do have the advantage that their AI will have much more language data to learn from than Oracle will ever gather.

 

This post originally appeared in the Oracle Tool Watch newsletter. Sign up for more Oracle news and to receive a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud“. 

Why Oracle Changes Slowly

$
0
0

Oracle has always been slow to adopt new technologies, and the image of a supertanker trying to change course is used a lot. Why is Oracle one of the slowest supertankers to turn? Partially because Oracle employees are simply older than employees of other tech companies.

The median age of an Oracle employee is 39 years old, i.e. every second employee is older than 39. Only venerable Hewlett-Packard is older, while Facebook, LinkedIn and Salesforce all have a median age below 30 years.

Median age of tech company employees

On the negative side, this means that Oracle is unlikely to become very successful as a cloud vendor. Their senior management grew up with the on-premise enterprise business, and from Larry Ellison down they simply don’t understand the cloud. I recently discussed cloud trials and the lack of a free tier with the Oracle Senior Vice President of Cloud. He was completely happy with their trials. Not many other people are.

On the positive side, this means you can count on Oracle to continue to produce a rock-solid enterprise database product. They have managed to offer it as a cloud service and continue to innovate and offer new database capabilities (JavaScript Stored Procedures in the database? Yes, it’s called Oracle Database Multilingual Engine).

What does that mean for you?

  • For Oracle database (PL/SQL) developers, the decline in work is going to be gradual. You can switch now or wait it out and hope others will leave the profession first
  • Developers using Oracle tools (Forms, ADF, APEX) can continue. Oracle is financially secure, and the specific Oracle tools will continue each in their well-defined niche
  • Database administration work is going to decline more steeply as Oracle customers move to database cloud services. If you are not sure you are a very skilled DBA, you should probably look to add to your skillset

 

This post originally appeared in the Oracle Tool Watch newsletter. Sign up to receive a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud.” 

Is Oracle a Niche Player?

$
0
0

The lastest Gartner “Magic Quadrant” for Analytics and Business Intelligence Platforms is out, and it’s sobering reading for Oracle customers. Oracle customers are not used to seing Oracle languishing in the “Niche players” quadrant, but that is where Gartner considers Oracle’s BI offering to belong.

Oracle have felt it necessary to publish a rebuttal on the Analytics cloud blog where they point to other analysts that like their offering better.

If you look at what Gartner is actually saying (Microsoft will happily share a copy of the Gartner report), it becomes clear that the “niche” Gartner sees Oracle in is the rather large niche of existing Oracle customers. They say:

… (Oracle’s) sales and marketing strategy has not yet translated these improvements into material market awareness beyond its Oracle customer base.

Oracle has the highest percentage .. of its reference customers (at 43%, more than double the next-highest vendor) having standardized on Oracle enterprise applications.

… 78% of its customers have standardized on Oracle as their primary enterprise data repository for analytics — almost triple the next-highest vendor.

What does this mean? It means that Oracle BI is used by existing Oracle customers. That is Oracle’s strength and Oracle’s weakness.

  • It’s a strength because the large Oracle customer base means Oracle is going to remain in business for decades, offering pretty much every technology you’d want.
  • It’s a weakness because the growth happens outside the Oracle bubble and the best and brightest entering the IT profession won’t be choosing Oracle.

This is no time to be a lukewarm Oracle user. Either go all-in with Oracle or fold.

 

For more analysis and commentary on Oracle, sign up for the Oracle Tool Watch newsletter. You’ll also get a copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud”

Managers are not allowed to write requirements

$
0
0

The first item on my Technology That Fits manifesto is Managers are not allowed to write requirements, only users are. The users we want to be involved in the requirements writing are typical end users, not the expert users who know every nuance of the work process.

Of course, I can hear you say. It would be stupid not to involve actual end-users in the design of the application they are going to use. However, reality shows that bad systems are built time and again because end users are not sufficiently involved.

If you are running a waterfall development process with a written spec, possibly implemented by an external vendor, you are seriously at risk of this. Your requirements document is going contain a laundry list of hundreds of features, many of them implementing marginal functionality that only a few expert users are even aware of. To produce better requirement documents in a waterfall environment, describe the day-to-day functionality for the typical user in a separate, short section and have a group of actual users sign off on this section. Also include a requirement for a workshop with actual users as part of screen design.

If you are using an agile process, you don’t have these problems, right? After all, this is exactly what agile should solve. Unfortunately, in real life, system design decisions are made by the “product owner.” Is that a real user? Rarely. Instead, most agile teams have as product owner an analyst or even worse, a developer, who has taken a two-day “product owner” course. If you can’t get a real user for your product owner role, at least make sure to involve typical real end users in the demo at the end of each sprint.

In order to build technology that is fit for purpose, you need to involve the actual end users. Reflect on whether you are doing that today. You probably aren’t.

 

This post originally appeared in the Technology That Fits newsletter. Don’t miss the next one, sign up.

Don’t pigeonhole yourself

$
0
0

I used to consider myself an “Oracle developer,” which is someone who works with tools and servers from Oracle corporation. But I’ve stopped doing that, and if you are working with Oracle, you should, too.

We might very well have reached “peak Oracle” as Oracle quarterly revenue numbers show:

Oracle quarterly revenue

For the last five years, I have never met an Oracle customer who was planning to buy more from Oracle, but many who were planning to buy less.

So what should you do?

  • If you are a PL/SQL developer, start calling yourself “database developer.” Investigate how stored procedures work in other databases. If you want to continue with PL/SQL, the open source PostgresSQL has PL/pgSQL, which is very similar. The documentation even has a chapter on Porting from Oracle PL/SQL. And read up on the Thick Database paradigm (start with Bryn Llewellyn’s white paper) so you can argue why PL/SQL is still needed
  • If you are a Forms developer, you will need an new gig. You are supporting legacy applications and every new manager coming into IT will want to replace it. Investigate AuraPlayer, which allows you to publish your Forms business logic as web services – that might keep the vultures away from your Forms application for another few years.
  • If you are an APEX developer, you’re probably good for now. You have a powerful tool that can deliver good-looking monolithic PL/SQL-based applications with good speed. Just be aware that you are one architect decision away from obsolescence. To prepare for the day after APEX, learn JavaScript, for example Oracle JET. Better JavaScript skills will also be useful for your APEX applications.

If you want some help deciding on your future as an Oracle developer, I’ll be happy to help you. I do personalized learning plans and developer mentoring – send me an e-mail so we can discuss how to work together on your future.

 

This post originally appeared in the Oracle Tool Watch newsletter. Don’t miss the next one, sign up to receive a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud“. 

Half the value of an application accrues in the first three months

$
0
0

The average age of an enterprise application is between seven and ten years, with many much older than that. How does that square with the Technology That Fits manifesto that says half the value of an application accrues in the first three months?

The point is that only systems that differentiate you from your competitors are adding significant value, and most of your systems don’t. You do need to keep track of money, materials and customers, but it doesn’t make one iota of difference whether you run SAP, Oracle or Microsoft ERP.

You need to be able to quickly roll out new applications that your competitors don’t have yet. If you can do this, you have three to six months until your competitors catch up. By that time, you should have the next thing ready.

Your programmers can do it. They know agile methods and productive frameworks and could create new systems rapidly if you were to let them. Unfortunately, most organizations are full of people who prefer the status quo, so IT never gets the chance to live up to its promise. That’s why disruptive startups run rings around existing organizations, and old organizations have to create “skunk works” away from HQ if they want anything new and interesting done.

The person who says something is impossible should not interrupt the person who is doing it.

Chinese Proverb

If you can roll out new systems quickly, you can gain competitive advantage. If you can’t, IT will remain an unavoidable cost resented by the business. Which do you choose?

 

This post originally appeared in the Technology That Fits newsletter. Don’t miss the next one, sign up here.


With 18.1, APEX finally joins the REST

$
0
0

Among Oracle tools, APEX has been the old-school, monolithic holdout, together with Oracle Forms. Much modern application architecture is based on REST web services, and other Oracle tools like JET, VBCS and ADF have long had the ability to consume and/or produce REST web services.

Fortunately, APEX 18.1 is starting to join the REST party. You can define Web Source Modules as shared components and then use these as data  sources for Classic and Interactive Reports. Cleverly, APEX can also run post-processing SQL to join the response from the REST service with local tables. It will still take quite a bit of hand-coding to actually do an insert, update and delete to a REST service, but I confidently expect the APEX team to eventually produce full REST integration.

APEX 18.1 contains a long list of other improvements. Personally, I’m most looking forward to getting a documented JavaScript interface to work with Interactive Grid, and also appreciate that we get updated JET and jQuery libraries.

If you are an APEX or PL/SQL developer, I encourage you to start playing around with APEX 18.1. You can request a workspace for the Early Adopter 2 release at https://apexea.oracle.com/.

 

This post originally appeared in the Oracle Tool Watch newsletter. Sign up to receive a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud

The Data Guardian: Converting GDPR Compliance from a Cost into a Benefit

$
0
0

 

This post originally appeared in the Technology That Fits newsletter. Don’t miss the next one, sign up.

Why Monolithic Tools are Bad for the Enterprise

$
0
0

I’m don’t like monolithic architectures in an enterprise setting. Some tools are inherently monolithic, and I consequently advocate that these tools are used only in tactical applications. Monoliths are faster to build, so they have a place for applications that will not need to communicate with other applications or outside systems. But monolithic architecture is bad for strategic applications that have to serve the entire enterprise and live for a long time.

A monolithic application communicates only with the database and the user and not with any other system. That means the data is stuck inside the monolith.

To get around this limitations, proponents of inherently monolithic tools recommend a database-centric architecture where the database can communicate with the outside world.

Some databases have very powerful communication capabilities with built-in support for queues, REST services etc. This gives data a way out, but it also means that all applications have to communicate via the database. Unless you run your database in a problematic low isolation level, data must be committed to the database before it can be seen by anybody else.

Large, strategic applications in your enterprise will need to communicate with other systems. Probably already from their initiation, but definitely over their decade-long lifespan. That is why you need to build strategic enterprise applications with tools that allow communication with other application and external systems.

You might decide to also allow the database to communicate with external systems, but that is not critical for an enterprise architecture where the applications can communicate. For simplicity, the drawing shows arrows directly between systems to indicate the sender and receiver of communication. This does not imply that an enterprise architecture should be a bowl of point-to-point spaghetti interfaces. An enterprise architecture will have many interfaces, and will need to be managed properly.

 

This post is a preview of this weeks Technology That Fits newsletter. Don’t miss any, sign up.

 

Why your applications become un-maintainable

$
0
0

The worst horror of a CIO is an essential system that cannot be modified. Horror movies have a standard story arc involving bad decisions (going alone into a dark basement in a strange house). IT horror stories are similar.

The journey to a horrible, un-maintainable system follows this narrative:

  1. You build a small system to solve a specific task. Because it is just a temporary, tactical solution, no architect is involved.
  2. Because the system works well, it accumulates additional features over time.
  3. At some point, it has become so complex that your average developer can’t understand the whole system anymore. But that is not a problem, because the lead developer can still fit every moving part into his or her brain at the same time and solve the tricky problems.
  4. Later, your lead developer quits or retires. There is now nobody who can understand the whole system. You have entered the complexity death zone where small changes in one place leads the application to break in three other places.

The complexity death zone

You can prevent ending up in the complexity death zone by not allowing your best developers to keep working on the same application. In your task management system, prevent anybody from assigning them tasks related to the old system. In that way, your complexity graph will level out around the capability of an average developer. If more features are necessary, you will have to retrofit a proper architecture onto the application. That has a cost, but ending up paralyzed is more expensive. If you’re already in the complexity death zone, send me a mail and let’s discuss how I can help you get out of it.

 

This post originally appeared in the Technology That Fits newsletter. Don’t miss the next one, sign up.

APEX 18.1 released

$
0
0

The wait is over and APEX 18.1 is now available both on apex.oracle.com and for download.

It contains a host of new features. Mysteriously, the APEX Features page doesn’t list the most important: The ability to consume REST web services. With this feature, APEX starts to break out of its Oracle shell and become a better member of a complex, heterogeneous environment. Fortunately, Joel Kallman highlights this feature and others in his post on the APEX blog.

With the ability to consume REST services from Oracle Cloud Applications and authenticate with Oracle Identity Cloud Service, it also seems that APEX will be a great tool for customers running Oracle SaaS.

The release notes contain a long list of changed behavior, deprecated and desupported features. The change to 18.1 is a major one, and you should thoroughly test any APEX application you migrate. It is likely that a few things don’t work the way they used to, but it is for good reasons – various hacks and old libraries have been replaced with better and more robust functionality.

APEX 18.1 continues to improve its capabilities and value in the Oracle ecosystem. If your organization is running the Oracle database, you definitely need to have at least an internal APEX instance to allow you to quickly build tactical applications based on the data in your Oracle database and/or Oracle Cloud Applications.

 

This post originally appeared in the Oracle Tool Watch newsletter. Don’t miss the next one, sign up. You’ll also receive a copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud”. 

Zombie software costs money. Kill it.

$
0
0

You have two kinds of zombie software running in your organization: Whole applications and modules within systems.

  • Zombie applications made sense when you built, installed or purchased them, but there is no longer any business need for them. Or they have been replaced by better functionality in other software.
  • Zombie modules appear in large software systems. Your ERP system will contain many zombie modules that you decided to install (after all, they are part of the package you paid for), but never used. In home-built systems, an average of 25% of modules are never executed in a 12-month period.

Zombie software is not harmless. It is of course bad that it wastes money (in computing resources and unnecessary licenses), but the worst problem is that it takes up administrator and IT management time. Time is your scarcest resource, and you need to economize it.

To determine how much zombie software you are running, ask your administrator team for an up-to-date list of all the systems you are running, together with usage statistics. If you have large systems (home-built or commercial ERP), ask for the statistics by module. Remember to ask them to include all cloud-based systems they are aware of. If they can’t give you this data (few teams can), ask them to figure out a way to provide it. Once you have usage statistics, you will know your zombie systems and modules and can start euthanizing them.

 

This post originally appeared in the Technology That Fits newsletter. Don’t miss the next one, sign up.

Do you want to stay with PL/SQL?

$
0
0

I regularly give my presentation “The Seven Ways of Building Oracle Applications” at conferences around the world, and a few weeks ago I gave it in Bulgaria for the Bulgarian Oracle User Group. In that presentation, I have a slide I always update to show the latest TIOBE index of the top 20 programming languages. PL/SQL has always been hovering somewhere at the bottom of this list, but last month, it had fallen out of the top 20.

Google Trends shows PL/SQL continuing a slow decline, down by about 50% over the last five years.

Google trend PL/SQL 5 years

There are good arguments for using the Thick Database paradigm as set out by Bryn Llewellyn in his white paper, but brilliant architecture doesn’t always win in the marketplace.

This situation gives you two options as a PL/SQL developer:

  • Learn something else
  • Double down on your PL/SQL skills

Since Oracle is losing database market share, there will be less PL/SQL work in the future. Organizations change faster than people, so the drop in Oracle installations is not going to be matched by a similar drop in Oracle database developers. If you want to hang on to one of the declining number of PL/SQL programming jobs, you need to make sure you are a really good PL/SQL developer. Fortunately, Oracle provides an excellent resource for you to keep your PL/SQL skills in top shape: The Dev Gym. If you decide you want to stay with PL/SQL, make sure you work out regularly with the PL/SQL Challenge at the Dev Gym.

If you want to do something else, or add to your skills, I provide developer mentoring. You’re welcome to send me an e-mail so we can discuss how we might work together.

 

This post originally appeared in the Oracle Tool Watch newsletter. Don’t miss the next one, sign up and get an independent opinion on Oracle development in your inbox every two weeks. You also get a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud“. 


Don’t move existing systems to the cloud

$
0
0

The scarcest resource in IT is not hardware, software, budget or qualified employees – it’s management attention.

That’s why you should spend your precious time where it makes the biggest impact. Moving an existing system to the cloud might save you some money; people who have done it typically realize a saving of 10-20%. That is not to be sniffed at, but these projects do take enormous effort. Every interface has to be considered and there are security and network considerations. Additionally, both internal IT and the business is likely to question and argue against the decision.

You should therefore be spending your time making sure new systems are built in the cloud. They will be cheaper and faster to get off the ground with modern cloud tools, and you can quickly demonstrate running code to the business. The return on the invested management time is vastly better for new systems. And for many of your legacy applications, it will be easiest to build a new system that provides 80% of the benefit of the old system before you start the discussion about decommissioning your legacy applications.

Calculate the value of new systems and you will see where the return on invested time is greatest. It will not be in projects to migrate legacy to the cloud.

I’d be happy to help you calculate the value of both new and existing systems so you can spend your time where it matters most.

 

This post originally appeared in the Technology That Fits newsletter. Don’t miss the next one, sign up.

Best JavaScript tool for an Oracle developer

$
0
0

JavaScript development is hot. It is also difficult, which is why there is an ever-increasing number of JavaScript frameworks available to help you. Unfortunately, as Ian Allen described on the stackoverflow blog, JavaScript frameworks don’t live very long.

So what is a JavaScript developer to do? If you don’t want to learn a new framework every few years, you can go with Oracle’s JavaScript offering: Oracle JET.

Oracle JET is an toolkit from Oracle that combines a number of open source libraries with open source code provided by Oracle. Version 5.1.0 was released last month and Oracle continues to improve on Oracle JET. However, the focus is on long-term stability and maintainability, which is why Oracle JET uses a few carefully selected open source frameworks. If you want to work with this month’s hottest JavaScript framework, Oracle JET is not for you.

Hard-core JavaScript developers will want to write a lot of code and not appreciate the help Oracle JET provides. But if you have a bit of JavaScript skills, you can learn Oracle JET in Oracle’s free, three-week course.

Like every other development tool Oracle has ever provided, Oracle JET is not going to be big outside existing Oracle customers. But if your organization is a loyal “red stack” Oracle customer, it makes sense to build your JavaScript applications with Oracle JET.

Let me know if you have questions or need help choosing the right tool for your applications.

 

This post originally appeared in the Oracle Tool Watch newsletter. Don’t miss the next one, sign up and get an independent opinion on Oracle development in your inbox every two weeks. You also get a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud“. 

Using cloud services is a new risk – are you managing it?

$
0
0

Running any system in the cloud means that you are relinquishing control. That adds a risk to your IT landscape that you need to consciously manage.

Recently, I read a post on Medium called “Why you should not use Google Cloud.The author claims his services were shut down without warning and tells a spine-chilling tale. It seems that this exact story cannot be corroborated, but the internet is full of horror stories of people having their cloud-based systems terminated by a machine with no recourse to a human being.

I was running a small system on Oracle’s cloud, and it died. I opened a priority 1 service request with Oracle support, expecting the high-quality 24×7 support effort Oracle is known for from their database products. However, it seems priority 1 on cloud services means something else, and it took them 7 days to find the cause and offer a fix.

You are facing at least two new risks when moving to the cloud:

  • That you can’t get through to a human
  • That you don’t get the timely response you need

To address the first risk, at least make sure you are running important systems on an enterprise account with a support SLA. Don’t let your system be at the mercy of one person’s expiring credit card.

To address the second risk, at least make sure you have an alternative solution in place. It has to be something you can activate yourself, even if your cloud provider has disappeared from the face of the earth, or the FBI has seized their computers.

These are just two risks and possible mitigations – there are many others. Let me know if you need help creating a risk management plan for your cloud systems.

 

This post originally appeared in the Technology That Fits newsletter.
Don’t miss the next one, sign up.

Running Oracle WebLogic? Patch now!

$
0
0

If your organization is running Oracle WebLogic, you want to ask your operations people if they have applied the July 2018 Oracle Critical Patch Update.

The most scary vulnerability is CVE-2018-2894, which has a severity score of 9.8 on the CVSS scale that maxes out at 10. From the bug description:

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

As usual, this quarterly patch update sets another record for vulnerabilities fixed – 334 this time. In all fairness, this high number is largely caused by vulnerabilities in open source products Oracle use:

Since these tools are widely used in Oracle applications software, almost all of Oracle’s application products suffer from one or more severity 9.8 bug (remotely exploitable without authentication). If you are running any Oracle application product (E-Business Suite, other Oracle ERP or Oracle industry solutions), you need to update.

The database is not badly hit this time, but CVE-2018-2939 allows an attacker with Local Logon to compromise the database, so you need to patch the DB, too.

If you are running customer-managed Oracle Cloud instances, you will get a notification and a link to apply the patch from the service console, so it is easy to patch. If you are running one of the “Autonomous” or Oracle-managed services, the patch is installed for you, and you don’t need to worry.

There are interesting new risks and trade-offs when running in the cloud, but easier or automatic patching is one of the benefits 😉

 

This post originally appeared in the Oracle Tool Watch newsletter. Don’t miss the next one, sign up and get an independent opinion on Oracle development in your inbox every two weeks. You also get a free copy of my whitepaper “What Oracle is Doing Wrong (and Right) in the Cloud“. 

How to beat Murphy’s Law

$
0
0

As I was splitting wood at my summer cottage, I was reminded of Murphy’s Law.

After playing lumberjack with a heavy axe all morning, I was looking for an alternative approach. I had noticed a strange-looking apparatus in a shed, left to me by the previous owner, and decided to investigate. As I suspected, it turned out to be an electric log splitter. As I started working with it, I was struck by how safety was enforced. Notice that the machine has two handles. It won’t move until you press down both of them, thus making it impossible for you to accidentally cut off a few fingers trying to adjust the wood while the splitter is moving.

When you’re splitting wood with an axe, all the safety up to you – a wide-legged stance, making sure nobody is in front of the chopping arc, etc.

Murphy’s law is actually not a simplistic statement of pessimism. What it really says is “if there is a wrong way to something, it will eventually be done in that way.” Chopping wood with an axe will eventually go wrong. The electric wood splitter has eliminated the possibility of doing it wrong.

The same applies to your IT environment. If you have multi-step manual processes to provision a new environment or deploy applications, Murphy’s law says that somebody will do it wrong sooner or later. It doesn’t matter how smart or well-trained your infrastructure people are, it will happen. If you automate your infrastructure processes so there is one command or one button to press, you have eliminated a significant risk. Spend the resources now to automate your processes.

 

This post originally appeared in the Technology That Fits newsletter. Don’t miss the next one, sign up.

Viewing all 58 articles
Browse latest View live




Latest Images