OCM: I wish to remain uninformed

It was a sunny day in October 2009 . . .

I was sort of bothered by a mysterious, reappearing log entry in the application.log for Oracle Portal, and I logged a Service Request to get to the bottom of it. After some investigation, it turned out to be caused by bug 4581855 in Enterprise Manager, and patch 3731593 was the correct medicine (version 10.1.0.6 if you're running Application Server 10.1.2.3). However, since my installation had already undergone the necessary patching requirements, which includes upgrading OPatch, a component called Oracle Configuration Manager was waiting in the dungeons, waiting for an opportunity to cause trouble. Oracle Support gave me good advice, described in Note 843239.1, and I used it to realize that patch 3731593 forces you to disable SSL for the Infrastructure OHS if you're on a Windows platform. What the note did not tell me (at that time), was that I had to edit ocm_apache.conf and sso_apache.conf to get the Infrastructure OHS back up again.

But this was not my first encounter with OCM . . .

In September 2009, I was going to upgrade OC4J from 10.1.3.4 to 10.1.3.5 to get rid of a bug that paralyzed the very basic ability of the product, which is to create a new container. The upgrade was proceding as expected, until I was presented with a form asking me for my MetaLink account and password. I thought that it wouldn't hurt, but it did, since I was on the wrong side of a firewall: I ended up in all sorts of trouble, getting messages about "Missing OCM Response File" and whatnot. Luckily, with the help of Note 795348.1, I got solid ground under my feet once more, and the installation seemed to be successfully upgraded.

The funny part is how OCM presents itself when you encounter it the first time and the dialogue that follows if the configuration fails, maybe because of a firewall:

Provide your email address to be informed of security issues,
install and initiate Oracle Configuration Manager. Easier for
you if you use your My Oracle Support Email address/User Name.
Visit http://www.oracle.com/support/policies.html for details.
Email address/User Name: me@mycompany.com
Password (optional):
Unable to establish a network connection to Oracle. If your
systems require a proxy server for outbound Internet connections,
enter the proxy server details in this format:
[@][:]
If you want to remain uninformed of critical security issues in
your configuration, enter NONE
Proxy specification: NONE

My question is, do we really need Oracle Configuration Manager? Maybe it should be distributed as an addon, instead of an integrated part of the central patching mechanism OPach? Maybe it should have been tested by Oracle on a server with no Internet connection? Maybe it should have been tested on all platforms?