Voice of the DBA

Author: way0utwest

  • Maybe Security is Harder than Rocket Science

    I was giving a talk last year about software development and I made an off-hand remark that most of developers out there shouldn’t be writing authentication schemes for applications. My reasoning was that most people aren’t good at writing these systems and there are plenty of good authentication schemes already written that you can incorporate into a system.

    However there are some bad ones as well. While I hope you don’t pick any of them, I also know that many of you might just build a poorly architected system because your focus isn’t on authentication. Your focus is on some other aspect of your application. I’m sure you know some of the good advice for building systems, as well as the best ways to handle passwords, but do you follow it? Under deadlines? When you have pressure to focus on more important aspects of your system? Or do you implement anti-patterns because it’s easy?

    The European Space Agency (ESA) is full of rocket scientists. Literally, as they send rockets and astronauts into orbit around the earth. However they were hacked recently and the disclosures aren’t pretty. They not only had personal information released, but passwords were stored in plain text. What’s worse, 39% of the passwords were three letters.

    Three.

    I’m sure many of the people working on ESA systems were smart individuals, and they may be great web developers that build beautiful, useful sites. However their security programming is extremely poor, and really, there’s no excuse. Not even the pressure of scientists that want simple, easy logins.

    It’s 2016. No short passwords, no limitations on complexity such as preventing special characters (one site recently didn’t allow a “,” for me), and no storage in a reversible format. There are lots of best practices, but they require some effort to learn, understand, and implement, as well as modification over time to keep up with changing guidelines.

    Or, as I suggested, just stop implementing this yourself. Use some authentication scheme that’s been shown to work well with few vulnerabilities.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.6MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Loading a Text File from T-SQL

    Another post for me that is simple and hopefully serves as an example for people trying to get blogging as #SQLNewBloggers.

    One of the interesting things I’ve had to work on with the Advent of Code puzzles is loading files into SQL Server. Some of the inputs are large strings, but many are files with lines of code that need to be loaded into SQL Server.

    I thought this might be a nice, simple SQLNewBlogger post. Do you know how to load a text file? Certainly the Import/Export wizard can work, but can you quickly load a file from T-SQL itself?

    If you can’t, go work that out. If you get stuck, come back or search for help.

    Loading a Text File

    Obviously you need a place to load the file. I created a table for each puzzle, and here is the table for Day 2.

    create table Day2_WrappingPresents
    ( dimensions varchar(12)
    )
    go

    Now ordering doesn’t matter for this puzzle, so I have a very simple table. If ordering mattered, I’d have to do this differently.

    To load this file, I’ll use the BULK INSERT command. This takes a table as a target, and optionally has a number of parameters.  Since this is a simple load of a simple file with one column of data to a table with one column of data, I can use the defaults.

    bulk insert Day2_WrappingPresents
    from ‘C:\Users\Steve\Documents\GitHub\AdventofCode\Day 2 – Wrapping\input.txt’

    In this case, the insert will load all 1000 rows into the table. A simple query shows this works:

     

    Now I can get on with the rest of my puzzle solution.

    SQLNewBlogger

    This is a great example of a simple thing that we might not need to do often, but we may need to do at times. Knowing how to do this, a simple operation, showcases that you are improving your SQL Server skills. This post took me about 5 minutes to write.

  • What is the True Version of Code?

    As I’ve been working on more development tasks, I regularly hear from developers that a version control system (VCS) is the “true” version of our code. We should always look to a VCS for the actual code that we need to work with. I believe that, and I think it’s true.

    However I heard a DBA say that the true version of the code is always in production. That’s what’s being executed, especially in the database world. There is some truth here as well, but in my mind this speaks to a broken process. This means we have a more chaotic, and less “engineered” way of producing our software. Perhaps more importantly, we don’t have a good source from which development can proceeed.

    Certainly hot fixes need to occur, and there are times that you can’t wait for a set of changes to be made in development, tested, approved, and then deployed to production. I think you can overcome most of this, but there may always be cases where this happens, so I don’t think we should  argue about how fast a software deployment pipeline we can build.

    Instead I’d say that production changes should always be fed back to the VCS. Our code is an ever changing set of files that we can only really keep track of by using a proper VCS. We should be able to track back the view of production at any point in time to a set of versions for our files in a VCS.

    Certainly some of you have gotten by for years, perhaps your entire career, without a VCS. However I’d argue that isn’t a good position for your organization. What habits and skills you have could easily be lost if you leave, and your memory isn’t a point of record. A stable system, a VCS, should note the state of our systems, both in development and production.

    And if you’re worried about the cost of a VCS, there are plenty of free (as in beer) ones. I recommend Git, but there are plenty to choose from. In terms of overhead, certainly you can use tools like SQL Source Control or ReadyRoll, but even without those tools, using a VCS really just requires building some habits. If you aren’t willing to change your workflow slightly, there’s probably no way you will ever ensure your environment is under control in the long run. However, if you do change to a VCS, I think you’ll find it’s well worth the effort.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.2MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Laptop Build Quality

    I’ve been looking around at various laptops, in preparation for getting a new one. I wrote about considering the Surface Book, which is still on the list, but has dropped a bit. The hardware quality is great, but when I was in the UK last week, a few people had them and complained about some driver bugs. In particular, I was messing with one person’s touch keyboard, and they warned me not to pull if off.  If I did, the machine might crash.

    Ugh. At $2k and lots of hype, I wouldn’t expect any issues like that.

    In any case, this post is about build quality, not software.

    I was laying in bed this week, working on some editorials when my daughter came in. She wanted me to look over a piece she was writing for school and handed me her laptop. She has a Macbook Air, and as soon as I put my Toshiba z30 down, I was impressed with the Air’s build. It’s solid, it’s light, but it feels strong. I remember loving my Macbook Air, and holding it as I reviewed her work, I was reminded of that.

    My z30 flexes, to the point that across a year, my touch point is unusable with the twisting of the frame. The trackpad was also far, far superior on the Air. I thought the Macbook Pro was like that, so I swung by a Best Buy to check. I walked in and went to the Apple section, picking up a Macbook and it feel solid. It’s just a better device than my Toshiba.

    However I was curious about others. I did walk over and look at a Surface Book. It’s a solid machine, about the size and weight of the MBP. However it has the touch screen, which is interesting. The trackpad works differently, but it’s a nice machine. Detaching the screen, it’s a tablet, which is nice. I still don’t know how much I’d use the tablet factor, but it’s tempting. However the weight distribution is strange. The screen is heavier than the keyboard, the opposite of most laptops.

    I also walked over to look at a Yoga 900, which I was curious about after reading Tim Mitchell’s review. I’m actually anxious to see how Tim’s machine looks next month in NM, but for now I contened myself with the display model. The hinge is neat, but this is a light laptop. At first glance, it also was solid. The flex I have on my Toshiba was not there. Despite a few reviewers noting this felt plastic and cheap, I didn’t get that feeling. It’s no Macbook, but it’s better than my Toshiba.

    This will be an interesting decision for me, but since I’m going to wait for Apple’s announcement in March and see what they might do. I doubt they’ll go touch screen, but you never know. I have gotten used to touching my screen for some reading, and I think I might miss that with a MBP.