Feed aggregator
Man of Steel
I’ve just got back from watching Man of Steel at the cinema.
I went into this film with extremely low expectations. For people of my age, this is the third time round for this story, so I expected to be pretty bored from a plot perspective.
I’m going to split the film into three parts.
- The first part of the story concerned the birth of Kal-El and him getting sent to earth. I expected this to be really dull and a bit annoying because of Russell Crowe’s presence. Actually is turned out to be completely brilliant. If the whole film had been similar to this first section it would probably have been the greatest Sci-Fi movie I had ever seen. If all you do is go in, watch this first sequence then leave, you will have had your money’s worth, especially since it was only £3 to get in on Tuesday night.
- The second part involved Kal-El growing up and becoming Superman. I also expected this to be a little dull, but actually is was really neat. They approached this part of the story in a different way to the previous films. It worked really well and I actually felt myself starting to care about the lead character.
- The third part of the film was just disaster porn. I found it really dull and generic. In parts it felt like a rip-off of the last fight scene in The Matrix Revolutions, mixed in with anything Michael Bay has ever done. I found myself hoping everyone would just hurry up and die so I could go home. Sometimes I find this stuff mildly amusing, but most of the time I just zone out and wonder what I am going to get to eat on the way home…
On my way out I was listening to a few conversations. One woman said, “The acting was terrible and I am so bored with seeing buildings get blown up!” I heard a group of guys talking in the car park and their conversation distilled down to, “He just didn’t do anything for the last half of the film!”
As it stands, I enjoyed it a lot more than I expected, but after a fantastic start it degenerated into mediocrity.
Cheers
Tim…
Man of Steel was first posted on June 19, 2013 at 12:04 am.©2012 "The ORACLE-BASE Blog". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement.
Oracle Siebel CRM 8.1.1.10 Software Download : Install Siebel CRM / OCH Part I
This is a content summary only. Visit my website http://onlineAppsDBA.com for full links, other content, and more!
June 2013 Critical Patch Update for Java SE Released
Hello, this is Eric Maurice again.
Oracle today released the June 2013 Critical Patch Update for Java SE. This Critical Patch Update provides 40 new security fixes. 37 of these vulnerabilities are remotely exploitable without authentication.
34 of the fixes brought with this Critical Patch Update address vulnerabilities that only affect client deployments. The highest CVSS Base Score for these client-only fixes is 10.0.
4 of the vulnerabilities fixed in this Critical Patch Update can affect client and server deployments. The most severe of these vulnerabilities has received a CVSS Base Score of 7.5.
One of the vulnerabilities fixed in this Critical patch Update affects the Java installer and can only be exploited locally.
Finally, one of the fixes included in this Critical Patch Update affects the Javadoc tool and the documents it creates. Some HTML pages that were created by any 1.5 or later versions of the Javadoc tool are vulnerable to frame injection. This means that this vulnerability (CVE-2013-1571, also known as CERT/CC VU#225657) can only be exploited through Javadoc-generated HTML files hosted on a web server. If exploited, this vulnerability can result in granting a malicious attacker the ability to inject frames into a vulnerable web page, thus allowing the attacker to direct unsuspecting users to malicious web pages through their web browsers. This vulnerability has received a CVSS Base Score of 4.3. With the release of this Critical Patch Update, Oracle has fixed the Javadoc tool so that it doesn’t produce vulnerable pages anymore, and additionally produced a utility, the “Java API Documentation Updater Tool,” to fix previously produced (and vulnerable) HTML files. More information about this vulnerability is available on the CERT/CC web site at http://www.kb.cert.org/vuls/id/225657.
Oracle recommends that this Critical Patch Update be applied as soon as possible because it includes fixes for a number of severe vulnerabilities. Note that the vulnerabilities fixed in this Critical Patch Update affect various components and, as a result, may not affect the security posture of all Java users in the same way.
Desktop users can leverage the Java Autoupdate or visit Java.com to ensure that they are running the most recent version. As a reminder, security fixes delivered through the Critical Patch Update for Java SE are cumulative: in other words, running the most recent version of Java provides users with the protection resulting from all previously-released security fixes.
<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
For More Information:
The Advisory for the June 2013 Critical Patch Update for Java is located at http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
More information about the Javadoc tool is available at http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.htmlFine Grained Access Control with DBMS_RLS using UPDATE_CHECK=>true
Fine Grained Access Control aka Virtual Private Database (VPD) has been there since Oracle 8 and got enhanced in each subsequent version. One minor New Feature of 11.2 was the addition of the parameter UPDATE_CHECK to the DBMS_RLS.ADD_POLICY procedure. During the OCM Preparation Workshop that I deliver presently, one of the attendees asked me what this parameter is actually doing – the doc is not so clear about it – which is why I came up with this simplified example. Hope you find it useful also
SQL> grant dba to adam identified by adam;
Grant succeeded.
SQL> connect adam/adam
Connected.
SQL> create table emp (ename varchar2(5),salary number);
Table created.
SQL> insert into emp values ('SCOTT',3000);
1 row created.
SQL> insert into emp values ('KING',9000);
1 row created.
SQL> commit;
Commit complete.
SQL> grant create session to scott identified by tiger;
Grant succeeded.
SQL> grant select,update on adam.emp to scott;
Grant succeeded.
The user SCOTT is not supposed to see the salary of the other employees and VPD is an elegant way to achieve that. The following technique will silently attach a WHERE-condition to statements hitting the table emp:
SQL> connect adam/adam
Connected.
SQL> create or replace function whoisit(schema varchar2, tab varchar2) return varchar2
as
begin
return '''' || sys_context('userenv','session_user') || ''' = ename ';
end;
/
Function created.
SQL> begin
dbms_rls.add_policy
(object_schema=>'ADAM',
object_name=>'EMP',
policy_name=>'EMP_POLICY',
function_schema=>'ADAM',
policy_function=>'WHOISIT',
update_check=>true);
end;
/
PL/SQL procedure successfully completed.
SQL> connect scott/tiger
Connected.
SQL> select * from adam.emp;
ENAME SALARY
----- ----------
SCOTT 3000
Although there are two rows in the table, SCOTT sees only his own salary! So far, this has been the same in earlier versions already. Now to the effect of update_check:
SQL> update adam.emp set ename='KING';
update adam.emp set ename='KING'
*
ERROR at line 1:
ORA-28115: policy with check option violation
Without that parameter setting, the update would succeed – and the row would vanish for the user SCOTT as if the update would have deleted the row. Imagine the confusion of the user about that weird behavior
Talking about weird, by the way:
SQL> connect adam/adam Connected. SQL> select * from adam.emp; no rows selected SQL> connect / as sysdba Connected. SQL> select * from adam.emp; ENAME SALARY ----- ---------- SCOTT 3000 KING 9000 SQL> grant exempt access policy to adam; Grant succeeded. SQL> connect adam/adam Connected. SQL> select * from adam.emp; ENAME SALARY ----- ---------- SCOTT 3000 KING 9000
That was funny, wasn’t it?
Conclusion: The new parameter UPDATE_CHECK in the DBMS_RLS.ADD_POLICY procedure restricts updates that would else lead to the updated rows to fall out of the allowed visibility for that user. Check out the old behavior by just omitting that parameter. Because: Don’t believe it, test it
Tagged: 11g New Features, DBMS_RLS, fine grained access control, security, vpd
Explaining configuration files in Fedlet…. contd…
This is a content summary only. Visit my website http://onlineAppsDBA.com for full links, other content, and more!
Oracle ODBC hello world with powershell
Demo :
cmd /c "odbcconf.exe /a {configdsn ""Oracle in OraClient11g_home1"" ""DSN=helloworld|SERVER=DB01""}"
Create a helloworld data source connecting to your DB01 tns alias in your OraClient11g_home1 Oracle Home.
It is easy to get the Oracle Home key with
Get-itemproperty HKLM:\SOFTWARE\ORACLE\*| Select-Object ORACLE_HOME,ORACLE_HOME_KEY
ORACLE_HOME ORACLE_HOME_KEY
----------- ---------------
C:\oracle\product\11.1.0\client_1 SOFTWARE\ORACLE\KEY_OraClient11g_home1
C:\oracle\product\11.2.0\client_1 SOFTWARE\ORACLE\KEY_OraClient11g_home2
Then we create the connection (as we did in ADO or ODP) :
$conn = New-Object Data.Odbc.OdbcConnection
$conn.ConnectionString= "dsn=helloworld;uid=scott;pwd=tiger;"
$conn.open()
(new-Object Data.Odbc.OdbcCommand("select 'Hello World' from dual",$conn)).ExecuteScalar()
$conn.close()
Delphix
If you’ve been keeping an eye on my Public Appearances page you’ll know that I am scheduled to go on line with Kyle Hailey for a second (more technical) discussion about Delphix and virtual databases on 19th June (tomorrow). If you haven’t registered, there’s still time to do so. It’s scheduled for 5:00 pm (BST), which makes it 9:00 am in San Francisco.
For an idea of the points we’ll cover, here’s a link with a draft agenda that Kyle Hailey has posted.
Update 1: Delphix have got 10 copies of Oracle Core to give away and they’ve decide to give one to every 10th registrant (until stocks run out) for the webinar.
Update 2: Over the last few days Kyle Hailey has been writing a short series comparing the commonest technologies currently available for Virtual Databases (or “Thin cloning”):
- Part I: Database Thin Cloning, clonedb (oracle)
- Part II : Database Thin Cloning: Copy on Write (EMC)
- Part III: Database Thin Cloning: WAFL (Netapp)
- Part IV: Database Thin Cloning: Allocate on Write (ZFS)
- Part V: Database Thin Cloning: Summary
Support may help cloud offices thrive
Cloud computing technologies stand to have a major impact on organizations in every industry. With the help of these solutions, companies may be able to slash costs while boosting efficiency, and for this reason, it's no wonder that IT experts have positioned the cloud as the next big thing for offices everywhere. However, some new research shows that many businesses still haven't transitioned. With the help of remote database experts, taking full advantage of these emerging systems is possible.
A slow ascent
According to technology research firm Gartner, there are approximately 50 million enterprise users of cloud office systems today, and while this may seem like a significant number, it represents a mere 8 percent of the overall market for these tools. Tom Austin, vice president and Gartner Fellow, explained that even though there has already been a large amount of hype surrounding the cloud, the real revolution is yet to occur. In his estimation, more companies will begin to adopt cloud office systems by the end of 2013 and by 2020, 60 percent of business people will be using such technologies.
"Although it is still early in the overall evolution of this cloud-based segment, there are many cases where businesses – particularly smaller ones and those in the retail, hospitality and manufacturing industries – should move at least some users to cloud office systems during the next two years," said Austin. "However, readiness varies by service provider, and caution is warranted."
While there are certain security concerns businesses must take into account, one major benefit of well-implemented cloud computing systems is cost savings. Webroot noted that these solutions help cut costs in several ways, including reducing companies' power bills. Because the cloud uses less electricity than legacy technologies, vendors are able to charge less money to keep them up and running. Additionally, firms that take advantage of offsite cloud tools have lower requirements for in-house IT staff.
Even though organizations do not necessarily need to keep a large number of IT employees on-site to support cloud office systems, they still need expert support. With the help of remote database services, enterprises can make a smooth transition to the cloud, leveraging all the advantages inherent to these emerging technologies.
RDX offers a full suite of cloud migration and administrative services that can be tailored to meet any customer's needs. To learn more our full suite of cloud migration and support services, please visit our Cloud DBA Service page or contact us.
Ruby Tuesday
@a_matsuda convinced us to dive into Ruby 2.0 at RedDotRubyConf, so I guess this must be the perfect day of the week for it!
Ruby 2.0.0 is currently at p195, and we heard at the conference how stable and compatible it is.
One change we learned that may catch us if we do much multilingual work that's not already unicode is the change that Ruby now assumes UTF-8 encoding for source files. So the special "encoding: utf-8" marker becomes redundant, but if we don't include it the behaviour in 2.0.0 can differ from earlier versions:
$ cat encoding_binary.rb
s = "\xE3\x81\x82"
p str: s, size: s.size
$ ruby -v encoding_binary.rb
ruby 2.0.0p195 (2013-05-14 revision 40734) [x86_64-darwin11.4.2]
{:str=>"あ", :size=>1}
$ ruby -v encoding_binary.rb
ruby 1.9.3p429 (2013-05-15 revision 40747) [x86_64-darwin11.4.2]
{:str=>"\xE3\x81\x82", :size=>3}
Quickstart on MacOSX with RVMI use rvm to help manage various Ruby installs on my Mac, and trying out new releases is exactly the time you want it's assistance to prevent screwing up your machine. There were only two main things I needed to take care of to get Ruby 2 installed and running smoothly:
- Update rvm so it knows about the latest Ruby releases
- Update my OpenSSL installation (it seems 1.0.1e is required although I haven't found that specifically documented anywhere)
$ rvm get stable # => updated ok $ rvm install ruby-2.0.0 Searching for binary rubies, this might take some time. No binary rubies available for: osx/10.7/x86_64/ruby-2.0.0-p195. Continuing with compilation. Please read 'rvm mount' to get more information on binary rubies. Installing requirements for osx, might require sudo password. -bash: /usr/local/Cellar/openssl/1.0.1e/bin/openssl: No such file or directory Updating certificates in ''. mkdir: : No such file or directory Password: mkdir: : No such file or directory Can not create directory '' for certificates.Not good!!! What's all that about? Turns out to be just a very clumsy way of telling me I don't have OpenSSL 1.0.1e installed.
I already have OpenSSL 1.0.1c installed using brew (so it doesn't mess with the MacOSX system-installed OpenSSL), so updating is simply:
$ brew upgrade openssl ==> Summary /usr/local/Cellar/openssl/1.0.1e: 429 files, 15M, built in 5.0 minutesSo then I can try the Ruby 2 install again, starting with the "rvm requirements" command to first make sure all pre-requisites are installed:
$ rvm requirements Installing requirements for osx, might require sudo password. [...] Tapped 41 formula Installing required packages: apple-gcc42................. Updating certificates in '/usr/local/etc/openssl/cert.pem'. $ rvm install ruby-2.0.0 Searching for binary rubies, this might take some time. No binary rubies available for: osx/10.7/x86_64/ruby-2.0.0-p195. Continuing with compilation. Please read 'rvm mount' to get more information on binary rubies. Installing requirements for osx, might require sudo password. Certificates in '/usr/local/etc/openssl/cert.pem' already are up to date. Installing Ruby from source to: /Users/paulgallagher/.rvm/rubies/ruby-2.0.0-p195, this may take a while depending on your cpu(s) [...] $OK, this time it installed cleanly as I can quickly verify:
$ rvm use ruby-2.0.0 $ ruby -v ruby 2.0.0p195 (2013-05-14 revision 40734) [x86_64-darwin11.4.2] $ irb -r openssl 2.0.0p195 :001 > OpenSSL::VERSION => "1.1.0" 2.0.0p195 :002 > OpenSSL::OPENSSL_VERSION => "OpenSSL 1.0.1e 11 Feb 2013"
Oracle Security Posts And Conferences
The latter part of the title of this blog post first!. I submitted a couple of entries for the up-coming UKOUG Oracle conference this year; I hope that they will be accepted. The Judging process is on going now. The....[Read More]
Posted by Pete On 14/06/13 At 09:57 AM
Oracle Security WebSite Woes!
For the last week some of you may have noticed issues with our website PeteFinnigan.com as at times it failed completely or was giving 403 errors even where there was no protected regions of the site and at some other....[Read More]
Posted by Pete On 12/06/13 At 01:15 PM
Oracle Security Class and software for Oracle security
I have just agreed a public class dates of my very popular " How to perform a security audit of an Oracle database " with Oracle University to be held on September 24th and 25th in Rome, Italy. The registration....[Read More]
Posted by Pete On 30/05/13 At 05:54 PM
Secure Coding PL/SQL
I wrote a new presentation last year on secure coding with PL/SQL and presented it twice; once at a SIG in London and once in Oracles office in Edinburgh. This is a really interesting subject for me as i have....[Read More]
Posted by Pete On 14/01/13 At 07:43 PM
Oracle Security Search Is Annoying and protecting PL/SQL code
This post if not specifically about Oracle Security but I got here because of Oracle security so i am going to talk about Oracle security first...:-) I am working this morning on a proof of concept code for a security....[Read More]
Posted by Pete On 06/09/12 At 11:38 AM
Oracles Java Patch
OK, its not Oracle database security but its big news and it is from Oracle. Oracle have recently released an out of band Java security patch which supposedly fixed serious security flaws; then a few days ago the guys at....[Read More]
Posted by Pete On 05/09/12 At 12:11 PM
New Oracle Security Talks
I am going to be doing three sessions at the UKOUG conference this December in Birmingham. I am going to be chairing the Oracle Security Round table on the 4th December. I am also writing three new presentations; two for....[Read More]
Posted by Pete On 04/09/12 At 02:44 PM
New Oracle Security Presentation - Identity In The Database
The paper " Identifying Yourself in the Oracle Database " is available as a pdf to download from my Oracle security white papers page . This is new paper in terms of it has not been posted to my site....[Read More]
Posted by Pete On 03/09/12 At 08:11 PM
Whitepaper List as at June 2013
The following Oracle Utilities Application Framework technical whitepapers are available from My Oracle Support at the Doc Id's mentioned below. Some have been updated in the last few months to reflect new advice and new features.
Unless otherwise marked the technical whitepapers in the table below are applicable for the following products (with versions):
- Oracle Utilities Customer Care And Billing (V2 and above)
- Oracle Utilities Meter Data Management (V2 and above)
- Oracle Utilities Mobile Workforce Management (V2 and above)
- Oracle Utilities Smart Grid Gateway (V2 and above) – All Adapters
- Oracle Utilities Business Intelligence (all versions) - Not Oracle Business Intelligence for Utilities
- Oracle Enterprise Taxation Management (all versions)
- Oracle Utilities Operational Device Management (V2 and above)
- Oracle Enterprise Taxation and Policy Management (all versions)
- Oracle Revenue Management and Billing (all versions)
This whitepaper currently only applies to the following products:
- Oracle Utilities Customer Care And Billing
- Oracle Enterprise Taxation Management
- Oracle Enterprise Taxation and Policy Management
- Oracle Revenue Management and Billing
- Concepts - General Concepts and Performance Troublehooting processes
- Client Troubleshooting - General troubleshooting of the browser client with common issues and resolutions.
- Network Troubleshooting - General troubleshooting of the network with common issues and resolutions.
- Web Application Server Troubleshooting - General troubleshooting of the Web Application Server with common issues and resolutions.
- Server Troubleshooting - General troubleshooting of the Operating system with common issues and resolutions.
- Database Troubleshooting - General troubleshooting of the database with common issues and resolutions.
- Batch Troubleshooting - General troubleshooting of the background processing component of the product with common issues and resolutions.
Updated! A set of whitepapers on how to manage customization (code and data) using the tools provided with the framework. The individual whitepapers are as follows:
- Concepts - General concepts and introduction.
- Environment Management - Principles and techniques for creating and managing environments.
- Version Management - Integration of Version control and version management of configuration items.
- Release Management - Packaging configuration items into a release.
- Distribution - Distribution and installation of releases across environments
- Change Management - Generic change management processes for product implementations.
- Status Accounting - Status reporting techniques using product facilities.
- Defect Management - Generic defect management processes for product implementations.
- Implementing Single Fixes - Discussion on the single fix architecture and how to use it in an implementation.
- Implementing Service Packs - Discussion on the service packs and how to use them in an implementation.
- Implementing Upgrades - Discussion on the the upgrade process and common techniques for minimizing the impact of upgrades.
This whitepaper currently only applies to the following products:
- Oracle Utilities Customer Care And Billing
- Oracle Enterprise Taxation Management
- Oracle Enterprise Taxation and Policy Management
- Oracle Revenue Management and Billing
This whitepaper describes direct integration with Oracle Service Bus including the new Oracle Service Bus protocol adapters available. Customers using the MPL should read this whitepaper as the Oracle Service Bus replaces MPL in the future and this whitepaper outlines how to manually migrate your MPL configuration into Oracle Service Bus.
Note: In Oracle Utilities Application Framework V4.2.0.1.0, Oracle Service Bus Adapters for Outbound Messages and Notification/Workflow are available.
1561930.1 Using Oracle Text for Fuzzy Searching New This whitepaper describes how to use the Name Matching and fuzzy operator facilities in Oracle Text to implemement fuzzy searching using the @fuzzy helper fucntion available in Oracle Utilities Application Framework V4.2.0.0.0

