I can’t get this out of my head so hopefully posting it here will free my brain to enjoy the rest of my post-conf vacation in Vegas. Most databases are not in the DMZ. They perhaps can call out locally, but not to the Internet. This is not a “crazy” or rare setup, especially for companies with stringent security and auditing requirements. So – why didn’t Oracle anticipate this? Why not create an application level proxy server (free, hopefully) that could sit in a less-secure place on a company’s network and ferry phone-home traffic from EM to Oracle’s site. Or at least provide enough openness for companies to do this themselves — don’t require online phone-home (it’s not real-time anyway), allow flat-file dumps that a company can move around as they wish before transmitting them, allow them to be analyzed and customized to exclude inappropriate data, etc.
Could be that some of this is available, and I just don’t know about it.