Note carefully that Clay's excellent advice is NOT in conflict with
functionality change freezes prior to event windows.
For example in pre-history when using UNIX for business was avant garde,
Burlington Coat had a functionality change freeze from Labor Day until
January 5. During that window only bug repairs were allowed. (And in this
context a security fix IS a bug repair, right?).
Good luck out there. It is great to have references to help your management
understand that it is not possible to stand still unless you're in an air
gapped vault. At Coat we had the rare luxury of a CEO and IT Director who
both understood risk management in their bones. Through users groups that
brought substantial understanding to software vendors about the business
cycles that needed to be respected with regard to functional changes to
applications as opposed to bug and security revisions. (And likewise being
doggone careful that bug patches and security revisions didn't break
things.)
More modern quick turn feature deployment has to an extent lost that
critical notion.
mwf
From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx]
On Behalf Of Clay Jackson (cjackson)
Sent: Friday, January 08, 2021 11:52 AM
To: ORACLE-L
Subject: RE: Upgrading with no patches in the "base"?
This is a great reference - especially the point that "Your application is
already broken". My corollary to that is that "All code is obsolete the
first time it executes". NOT patching, "if it ain't broke don't fix it"
is a folly. The net over time will be an application that "fails" (to
perform as expected) more and more often. . Patching or "upgrading"
is to software what "Preventive Maintenance" is to "hardware" (the physical
universe); if you don't change the oil in your car, eventually (and
unpredictably) it will stop (catastrophically).
I personally experienced this in a "previous life" and had to fight to
develop a "patching cycle"; like law and sausage making, it wasn't pretty,
and it took time; but our "application availability" improved dramatically.
When you're purchasing an application, one of the "due diligence" criteria
should be discovering how often the vendor provides updates, what
dependencies (like "platform" versions) exist and the vendor's track record
on dealing with those.
Clay Jackson
From: oracle-l-bounce@xxxxxxxxxxxxx <oracle-l-bounce@xxxxxxxxxxxxx> On
Behalf Of Rajesh Aialavajjala
Sent: Friday, January 8, 2021 7:37 AM
To: mark@xxxxxxxxx
Cc: Noveljic Nenad <nenad.noveljic@xxxxxxxxxxxx>; mkline1@xxxxxxxxxxx;
ORACLE-L <oracle-l@xxxxxxxxxxxxx>
Subject: Re: Upgrading with no patches in the "base"?
CAUTION: This email originated from outside of the organization. Do not
follow guidance, click links, or open attachments unless you recognize the
sender and know the content is safe.
This (in my humble opinion) excellent post by Tim Hall -
https://oracle-base.com/blog/2020/10/08/upgrades-you-have-to-do-them-when-ar
e-you-going-to-learn-tlsv1-2/
<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Foracle-ba
se.com%2Fblog%2F2020%2F10%2F08%2Fupgrades-you-have-to-do-them-when-are-you-g
oing-to-learn-tlsv1-2%2F&data=04%7C01%7Cclay.jackson%40quest.com%7C994ed2791
2aa4b58d86c08d8b3eb5bcb%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6374571
70719795976%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJB
TiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=eUNHpU9kcoKuzC2j9992yIoPXZOL4NxLRtQn
Pnn0OnE%3D&reserved=0> - summarizes the reasons to NOT try to use an
unpatched home. I agree - I've never heard of this "unpatched $ORACLE_HOME"
strategy.
Patches (RU/RUR/CPU/PSU - a rose by any other name) exist for a reason
(grin) - granted they are not always perfect (grimace) and can lead to one
dealing with vendor support - in this case Oracle Support.
I would add my +1 to Mark's comment and the previous replies (of course you
gentlemen hardly need my endorsement) - this does not make sense...
I don't know if there is a constraint from the application side that
prohibits 19c - I recently had an upgrade project to move databases to
12.1.0.2 and when the "Why not 19c?" question was raised the reply was the
application that uses the DB had a hard stop regarding compatibility at 12.1
- the prior upgrade to 12c (interpreted 12.2) had to be rolled back.
Thanks,
--Rajesh
On Fri, Jan 8, 2021 at 10:28 AM Mark J. Bobak <mark@xxxxxxxxx> wrote:
"They will test this for a while, and if everything is fine, THEN they will
apply the patch."
And what if everything *isn't* fine? Then they *won't* apply the patch?
Doesn't make sense.
-Mark
On Fri, Jan 8, 2021 at 10:19 AM Noveljic Nenad <nenad.noveljic@xxxxxxxxxxxx>
wrote:
Hi Michael,
That sounds like black magic.
If "for a while" implies two different maintenance windows, you end up with
two test cycles and two disruptions instead of just one. If you get the
opportunity to combat these voodoo practitioners in front of the management,
the most persuasive argument would be that the database will be running
without security and other critical patches for a while. Who's going to take
that risk?
Last but not least, why not 19c?
Best regards,
Nenad
From: oracle-l-bounce@xxxxxxxxxxxxx <oracle-l-bounce@xxxxxxxxxxxxx> On
Behalf Of Michael Kline
Sent: Freitag, 8. Januar 2021 15:29
To: 'ORACLE-L' <oracle-l@xxxxxxxxxxxxx>
Subject: Upgrading with no patches in the "base"?
Hearing that an application is going to be upgraded from 12.1 to 12.2.
Vendor is saying they will create a "blank, no patched" 12.2 $ORACLE_HOME,
and then upgrade the database.
They will test this for a while, and if everything is fine, THEN they will
apply the patch.
I've never heard of such a thing and have been working on Oracle databases
since 1983, version 4.0.
Is there logic in this? We try to keep all databases at N-1 on patching.
Michael Kline
____________________________________________________
Please consider the environment before printing this e-mail.
Bitte denken Sie an die Umwelt, bevor Sie dieses E-Mail drucken.
Important Notice
This message is intended only for the individual named. It may contain
confidential or privileged information. If you are not the named addressee
you should in particular not disseminate, distribute, modify or copy this
e-mail. Please notify the sender immediately by e-mail, if you have received
this message by mistake and delete it from your system.
Without prejudice to any contractual agreements between you and us which
shall prevail in any case, we take it as your authorization to correspond
with you by e-mail if you send us messages by e-mail. However, we reserve
the right not to execute orders and instructions transmitted by e-mail at
any time and without further explanation.
E-mail transmission may not be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete. Also
processing of incoming e-mails cannot be guaranteed. All liability of
Vontobel Holding Ltd. and any of its affiliates (hereinafter collectively
referred to as "Vontobel Group") for any damages resulting from e-mail use
is excluded. You are advised that urgent and time sensitive messages should
not be sent by e-mail and if verification is required please request a
printed version. Please note that all e-mail communications to and from the
Vontobel Group are subject to electronic storage and review by Vontobel
Group. Unless stated to the contrary and without prejudice to any
contractual agreements between you and Vontobel Group which shall prevail in
any case, e-mail-communication is for informational purposes only and is not
intended as an offer or solicitation for the purchase or sale of any
financial instrument or as an official confirmation of any transaction.
The legal basis for the processing of your personal data is the legitimate
interest to develop a commercial relationship with you, as well as your
consent to forward you commercial communications. You can exercise, at any
time and under the terms established under current regulation, your rights.
If you prefer not to receive any further communications, please contact your
client relationship manager if you are a client of Vontobel Group or notify
the sender. Please note for an exact reference to the affected group entity
the corporate e-mail signature. For further information about data privacy
at Vontobel Group please consult www.vontobel.com
<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vonto
bel.com%2F&data=04%7C01%7Cclay.jackson%40quest.com%7C994ed27912aa4b58d86c08d
8b3eb5bcb%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637457170719795976%7C
Unknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLC
JXVCI6Mn0%3D%7C2000&sdata=LqnVEtjtph%2FyClmhqDf4InWDA8mlyB5%2BKS36pWM5om8%3D
&reserved=0> .
