I’m hoping I’m only out for a day. As I write this, I’ll be recovering from my ACL surgery, though hopefully only slightly limited in work.
We’ll see. I’ve learned to hope for the best, but plan for the worst, and as a result, I decided to take Monday off from work as well, just in case. I never know how these things might go, and while it should be simple, I may want to take it easy for another day.
Would you post your password on a wall in your office? Of course not, because other employees, the cleaning crew, even guests walking around your office would be able to access your system with your account. When I read Brian Kelly’s post on passwords in files, that’s what I thought of. Sticking credentials in a file, where they’re subject to any kind of search, is a bad idea.
However this happens all the time. Combine this with a few other “common practices” like using sa to connect to a database and building dynamic SQL, and you might as well just set blank passwords and invite someone to have fun with your database. It’s sad that we continue to see these types of software development practices in 2014, and especially poor to see them from companies that sell software.
There is so much information out there on building software that is of higher quality and is much more secure. However all too often I find developers just aren’t implementing these practices. There are probably a myriad of reasons why, and I wish we had more ways to better train people, disseminate the information, and enforce it’s use.
Ultimately we can only do what we can. However I’d encourage those of you that see poor practices taking place to have a word with the developer (internally), or send a note to the vendor. If it’s more important to make a few more dollars than implement better practices, I’d encourage you to publicly call some attention to the matter. Maybe a little exposure to the dark side of software development will pressure managers to require more secure work over time.
Steve Jones
Listen to the MP3 Audio ( 2.0MB) podcast or subscribe to the feed at iTunes and LibSyn. 
The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.
It’s over. There’s no more MCM program or certification from Microsoft. The last MCM test was given last year and no upgrades are planned for SQL Server 2012 or SQL Server 2014. That’s a little sad, though there are quite a few of our SQL Server professionals that can still proudly wear the MCM title for the rest of their careers.
The MCM tests were designed differently than all the other MCP type tests, requiring more thought and deduction, as well as practical skills. The lab in particular was daunting to many of the MCMs, most of whom would tell you about the difficulties in getting through the scenarios in the limited time alloted. All of the people I’ve talked to found the challenge refreshing and also informative, enabling them to learn a few things about their knowledge, even from the problems they didn’t complete.
Since that chapter in Microsoft Learning is complete, and the tasks likely out of date, I’d ask that Microsoft Learning release the questions and scenarios to the world as an open source project. Unlike the other certifications and exams, these questions aren’t going to be re-used anytime soon and the knowledge could help many people learn to build better solutions.
This would be a great move, allowing many DBAs to challenge themselves with the questions and scenarios in practice labs. The types of scenarios could be used in interviews for new employees, either as they are written or modified for a particular environment. Professionals using the SQL Server platform would get an idea of not only the broad level of knowledge that MCMs have, but they’d also have a way to test themselves and direct their own learning to become better rounded SQL Server developers and administrators.
I doubt it would happen, but I’d think Microsoft could help the community, generate some goodwill, and help improve the overall quality of people working on their platform.
Update: I have opened a Connect item for this. Please vote
Podcast: http://traffic.libsyn.com/voiceofthedba/mcmoss_58_v1063.mp3
I’ve fallen down on my challenge over the last month. It’s been a content time, with me working more towards presentations and writing most of Mar and April to meet deadlines and commitments. I also let my calendar reminder die in Feb and didn’t renew it.
As a result, here I am, 6 months in and only done with 19 chapters. That’s a good way in, but it’s not complete. With some downtime coming, I’m looking to get back into this and using it a bit more.
