This is a great interview with David Litchfield. I was recently in a review with Bob Muglia, Senior VP for the Server and Tools business, where the SQL team presented there had yet to be a security GDR for SQL2K5. Bob asked if it was because the product is secure or if people just aren't looking for security issue. The team proudly answered: people are looking and they're not finding anything. I just don't understand why anyone still runs Oracle (behind a firewall or not).