Voice of the DBA

Author: way0utwest

  • The Secret Password

    As I work with more server systems that help developers run Continuous Integration and automated releases, one of the things I see used often are variables. These are values you can set for a particular process and reference inside of that process. Great for setting server names, paths, etc. In releases, these are great for specifying specific values that change for each environment, such as the instance name or IP address.

    As with many developer based systems, security is not always set tightly on these systems and any developer can access the build server to kick off builds, reconfigure a process, etc. That makes sense in a CI process, but not so much in a release system. This is one reason I do recommend a separate release server from the CI server. You can use Jenkins or TeamCity to perform releases, but is it a good idea? Have you thought through the security?

    In the release servers, one thing that most systems allow the admin to do is use a variable for a password and mark it secret, so the value cannot be recovered. In this way, if some developer is working on the release process, they can’t get the password to the production server. They can only click the buttons that deploy to that server.

    However.

    They can deploy to that server, and they don’t need the password. If I were to execute a script in the release system that executes the “CREATE USER” and a “ALTER ROLE ” commands to give me access to data, does it matter if I know the deployment password is “G4da%$2h#5f” or $(ProdPwd)? It doesn’t. The actual value isn’t relevant; I just need to be able to use it.

    I think release systems are great pieces of software for reducing the risk of your deployments, but I do think the security models need to be carefully designed and easy to configure, especially when it comes to allowing arbitrary code to be submitted and executed by one person. Be sure that developers can’t necessarily deploy code directly to production servers, whether the password is hidden or not. If there is a way to use the value, someone will find it.

    Steve Jones

     

  • How Can I Get Accepted to Speak at the PASS Summit?

    There has been some discussion and concern over the changes to the speaker selection process for the PASS Summit. I’ve written some thoughts, as have others (Joey, Andy), but I was struck a bit by Eugene Meidiner’s post. In it, he asks, how can I speak? What do I need to do beyond presenting at user groups or SQL Saturdays? How do you get to the Summit?

    I’ve got a few thoughts, but keep in mind this is a complex topic. I’d like to see some people write about their experiences, preferably those that have spoken only once or twice.

    The Path

    First, there is no one path. Unlike martial arts, or some other program, there isn’t a series of things you need to do in order to get selected. What works for one person might not work for another.

    It’s like getting recognized by Microsoft as an MVP. There isn’t a set of things to do, but some guidance that may help.

    Compete

    The next thing to understand is that this is a competition. Imagine that you want to run in the Olympics as a sprinter. You can do everything possible to increase your speed. You might be the best sprinter in your college, or region. You might run the 100m (mens) race in 9.90 in college. When you get to the trials, you run a 10.0.

    That’s not good enough if the top three go to the Olympics that year. The best three times at the trials were 9.8, 9.84, 9.98.

    Does that mean you’re not an amazing sprinter? No. You just weren’t one of the those selected that day.

    The PASS Summit speaker selection is way more complex. We divvy up the abstracts into various piles, mostly based on the topic area. If you look at last year’s schedule, there were five main areas. Your session is in one of those areas, competing with many others. If we pick (roughly) 60 sessions in an area, you have to be top 60 to make it. Doesn’t mean you’re not a great speaker, or don’t have a great session. It means you didn’t compete well enough at this time, for this event.

    Get Help and Get Better

    The way into the Summit is to get better at your craft. That’s better at your speaking craft, better at your abstract writing, certainly better branding yourself as a SQL Server expert. It’s not that you need to be smarter, better at the Microsoft Data Platform, but people have to think you are worth going to see.

    Adam Machanic has a great post on session abstracts. Louis Davidson has thoughts, and Brent Ozar has hints. There’s no magic formula. You have to build something that catches the eye of your peers, who are those reviewing the abstracts, and you have to impress them with the talk.

    Most of these people are volunteers that have attended lots of talks at events. They’ve seen lots of speakers. Certainly there can be bias towards those people whose sessions they’ve seen, or who they think has submitted an abstract, but mostly they’re looking for great content. Something they’d consider attending, or think others would.

    That’s subjective and unlikely to get much better. At some point someone has to make decisions, and so you need to ensure you impress people.

    Use the advice that’s out there. Have friends, or even more experienced speakers review your abstract. Try to find a good place to submit. If you want to talk T-SQL tricks, you’re going to compete with Mr. Ben-Gan, Mr. Betrand, Mr. Kline, and plenty of experienced speakers. Be careful of that. Find a place where you solve a problem, do it well, and it’s interesting to others. You won’t know if that’s true in a vacuum. Get feedback and advice from others.

    Gain Experience

    Part of the process is getting experience. This means presenting often, and learning to do it well. You need to ensure the audience likes watching your presentations.

    • Are you invited back?
    • Do multiple people tell you afterwards you had a great talk?
    • Do multiple places accept your abstract?

    You should be answering yes to all of these.

    My suggestions:

    • Present multiple talks for one group –  Learn to express yourself, communicate well, and handle different demos. You should get positive feedback from your local group, your virtual chapter, something.
    • Present the same talk to multiple groups – One of the things that helps me get better is to deliver the same talk more than once. I learn how to build better flows, how to correct previous issues, and explain myself better.
    • Enjoy Yourself – If you don’t really enjoy teaching people something, or impressing them with your knowledge, why do you want to speak at the Summit? Is it resume bullet? A bucket list item? Those are fine, but passion and enjoyment shine through.

    Cross Your Fingers

    This is a hard competition. Lots of people want to speak, and if you have submitted 4 times and never been picked, that doesn’t mean PASS is out to get you. Or that you suck. It means you didn’t make it over the bar those four times. Whether you did the same thing or four different things, the results could be the same.

    This year, I’d suggest that you try a multi-pronged approach. Refine something you submitted last year, with feedback from others. Add something new, but make sure you get feedback on this as well.

    Don’t give up, but don’t get too frustrated. At least this year if you’re a first time speaker, things are slightly easier. Invites mean that you aren’t competing against someone like Itzik Ben-Gan or Brent Ozar, who likely get invites. Therefore your abstract isn’t weighed against theirs. A focus on getting some level of new speakers mean you should get a little weight added to your submission as well.

    Enjoy the challenge, do your best, meaning put effort in, and let the chips fall.

    At least you won’t compete against me this year. I won’t submit, so there’s one or two slots that will be open.

  • More Open Data

    Steve Ballmer retired from Microsoft almost three years ago. It seems like a small eternity, and since his purchase of the NBA Los Angeles Clippers, I haven’t heard much about any ventures with which he’s been involved. Apparently, he’s spent some of his time, and quite a bit of money to build a site that discloses data about revenue and expenditures for the US Government. There’s a piece in the NYT about this project, as well as a shorter Engadget summary of the site, which provide a short look at the project.

    USAFacts.org is the site, and it’s a treasure of data sets. I look at this as a really interesting way to examine data sets that might be more difficult to gather than you’d expect. The Data Act deadline takes effect in May of 2017, which should also provide another way for anyone to look at public data and perform an analysis. I am disappointed the downloads aren’t working yet, but I hope that this will come soon, along with some sourcing information about where the data comes from and how it was gathered.

    Having data sets to analyze is important for any organization. Certainly within our organizations we spend a lot of time producing reports and queries that help various people analyze data. In fact, finding, collating, cleaning, and organizing information can be a taxing proposition in any size organization. Our data sets and sources are so diverse and often inconsistently producing data that it’s amazing at times that our organizations run well. It seems on a regular basis someone wants to rebuild the methodology used to gather and organize information. I am not surprised that I constantly find incorrect calculations in software because the basis we use changes too often.

    The big issue for me is that so many of us are amateurs when it comes to analyzing information. There aren’t many organized classes or a good structure for most data professionals to learn how to analyze data. We learn on the job, we make guesses and assumptions, and overall do a good job. However, data analysis is highly inconsistent from person to person. I’d like to see that change, and as I see more and more people blogging and talking about how they look at a particular data set, I hope more people are thinking about how to analyze information and how the choices we make for calculations, visualizations, and even ordering can affect how the results are interpreted.

    I’m glad Mr. Ballmer has started this project, and I look forward to seeing how people might use this data and other data sets to provide some analysis of the world.

    Steve Jones

  • GroupBy–Bringing DevOps to the Database

    Today was my presentation in the April GroupBy conference lineup. I presented on DevOps and changing your database development to include more agile, DevOps, flexible development practices.

    If you want to get the deck, the slides are here: BringingDevOpstotheDatabase.pptx.

    The video is also up on the GroupBy Youtube channel