Voice of the DBA

Author: way0utwest

  • Sharing Code

    This editorial was originally published on Jan 25, 2011. It is being re-run as Steve is on vacation.

    It seems that almost every week I encounter some form of plagiarism it the SQL Server community. Whether its from SQLServerCentral or it’s someone else, it seems that I’m either alerting someone or sending my own takedown notice.  It’s a little sad that I have to even explain the morality of re-publishing someone’s else’s content without giving them credit to anyone over 8 years old, but apparently I do. However this isn’t a piece about plagiarism.

    I have seen people take various additional steps to protect their content, and that’s fine. It’s their right, and I understand that some people derive a level of income from their work. Whether it’s direct or indirect, it doesn’t matter. If someone wants to protect their work and they don’t want you to reuse it, then respect their wishes. If not for legal reasons, for moral ones.

    As we publish information on the web, however, I would think most of us hope our code and ideas are adapted and re-used. Not used in another publishing piece (blog, article, etc.), but used in a piece of production code that makes a system run better. I know when I’ve published code that helps someone track backups or monitor their servers, I was quite honored to hear that someone used my code in their system.

    Sometimes I wonder if  other authors out there feel the same way. Do writers assume their code will be rewritten by someone before it is used. Digital rights and intellectual property are immature fields, and I’m not sure how we ought to best handle the re-use of code. Authors have the right to decide how they want their works to be shared, and should publish their decision. I would hope that others out there would respect that.

    Steve Jones

  • Why Use the Principle of Least Privilege?

    This editorial was originally published on April 12, 2011. It is being re-run as Steve is away on vacation.

    SQL Injection is not the fault of the SQL Server. Brian Kelley pointed that out, and reminded me that SQL Injection isn’t an case of malformed SQL. It’s legitimate code, including SQL commands that we might use from any query connection, especially an administrative one. We regularly issue update and delete commands from our applications, and SQL Injection takes advantage of this to issue an update the we might not be expecting.

    Would you expect this input handwritten injection from an application? Or this table guessing attempt? You wouldn’t, but they can come through data entry in your application if the input isn’t well sanitized. Someone setting all your prices to $0.01 or all of your customers to “W3 0wnz U!” isn’t what you want to happen. You can’t necessarily prevent all of these patterns  or check for every permutation, but you can prevent things like ‘shutdown’ or ‘drop table’ from being run by your application. Even adding a new user to the database system isn’t something I would want to allow.

    Education is the key here. As Andy Leonard (blog | @AndyLeonard) would say, design patterns are important. When developers have an understanding of the issue, many of these things will be avoided. Having standard ways to begin building an application, checking for bad input, and setting up database users and permissions easily, should make this easy for anyone that wants to code against a database. We still have work to do here to build better frameworks, and ORM tools that require elevated permissions to the database are not the answer. They might become the answer, but they aren’t a better solution right now.

    Grant Fritchey wrote a nice piece about developers and DBAS, noting the need that we both have the same goals, but need to learn to communicate better.  This is one area where we ought to make an effort to communicate better, pass along education about security issues, and work to make life easier for developers to work with a database.

    That also means teaching them to work with the minimum privileges needed in order to make an application work, just in case someone plans on submitting some input you didn’t expect.

    Steve Jones

  • An Impressive SQL Server

    This editorial was originally published on May 6, 2011. It is being re-run for the Christmas holiday.

    Merry Christmas and Happy Holidays!

    Recently I heard about one SQL Server with 1TB of RAM and another one that was handling over 10,000 transactions a second. I read a note about a 1.1PB database, built on SQL Server to hold data from telescopes. That particular data warehouse is producing 1.4TB a day. I know it’s mostly binary data, but that’s a lot of 1s and 0s being stored in SQL Server.

    Over the years I’ve heard regular complaints and concerns from executives about SQL Server scalability. Those complaints have dwindled, but I think there are people in the relational database world that still question SQL Server’s ability to handle high volumes or data sets.

    This Friday, I wanted to see what might change their mind, or maybe what might make you view SQL Server differently. While I suspect most of you are SQL Server fans, that doesn’t mean that you don’t have concerns at times about how far you can push SQL Server. The question this week is:

    What company would impress you if SQL Server backed their main systems?

    This isn’t scientific, and I’m not defining which systems impress you. It could be their web site, their supply chain management, their largest data warehouse, or anything else. What company talking about using SQL Server in one of their systems would impress you? And which system would you like to see backed by SQL Server?

    When I think about a lot of data, high volumes and rates, I think of a few things. The stock market, sports, and Amazon. If Amazon switched their website and ordering systems to SQL Server, I’d be impressed. If Major League Baseball, or the National Football League were to run all their statistical systems on SQL Server, I’d be impressed. With all the fantasy sports fans out there, the gathering and processing live data for real time calculations of performance, would be impressive.

    I’ve left out other companies. Wal-Mart using SQL Server for supply chain management would be impressive. UPS managing packages on SQL Server would be something. I’m sure have your own ideas, and let us know this week.

    Steve Jones

  • Closing Down for the Year

    Today is my last day of work for 2015. I’m actually proud that I’ve managed to take almost all my vacation (3 days left), and will be enjoying myself next week with my family, taking our holiday vacation in the mountains.

    It’s been quite a year for me. Lots of travel in short spans, some long trips, but also some good breaks. I’ve spent some time learning, and improvind my skills, and at the same time I turned down lots of work that might have overloaded me.

    I think 2015 was a good year for me, and I’m looking forward to continuing some momentum and making 2016 even better.