Unbreakable Software Broken By Helpful Security Researcher?

Oracle is now facing a similar situation to the one that Microsoft faced a few weeks ago. After a vulnerability was exposed with Microsoft was slow to fix, an independent security researcher created his own patch to fix it -- which Microsoft reacted negatively to (though, they did speed up the release of their own patch). Oracle is in a similar situation. While they released a security patch recently, it didn't fix a security vulnerability that one researcher felt was particularly critical -- and not that difficult to fix. So he fixed it himself and released the patch. Now, Oracle is quite upset about the independent patch, claiming that just by releasing it, the researcher has alerted those with malicious intent to the flaw, while also claiming that fixing the security hole isn't as easy as the researcher made it out to be. However, here's where Oracle's spokesperson made a poor choice of words. For a while, Oracle had been marketing some of their products as "unbreakable" -- and even though they meant it in a very specific way, it still leaves them open to some amount of ridicule when they're quoted as saying: "We know it will break a number of Oracle products..." in discussing the security patch. If an independent security researcher trying to fix a vulnerability "breaks" your software, it's tough to see how it's "unbreakable."