Voice of the DBA

Author: way0utwest

  • Bloopers from Dec 2012

    The raw ones from podcasts in late Nov and Dec 2011.

    Dec 2011 Bloopers

  • Coding More Carefully

    TRS-80
    Compiling code on one of these was a chore.

    When I wrote computer code in school, programming as we kids called it, I could literally watch my programs compile on the screen. Working on a Radio Shack TRS-80 in PASCAL, we would see the lines of code scroll by, 3 or 4 a second, as they compiled into executable code. When that is the speed of the computer building your work, you learn very quickly to proofread your code from syntax or logic errors. A simple semicolon on the wrong place can result in quite a bit of lost time.

    At some point we transitioned to Turbo Pascal, which compiled hundreds of lines in a split second, on par with the speed of today’s compilers, which are often working through thousands of lines of code. Is that a good thing, however? Has this speed improvement ended up building poor habits in developers?

    I ran across this post on the times when the author had one compile a day. That’s slower than I had, but we did have time limits on the computer, as well as printer limits, when I was in college. The compile/fix a syntax error/recompile/test cycle  that we have now wasn’t an option. Making too many simple mistakes would result in missed assignments.

    Limiting developers to one compile a day wouldn’t work these days, but I wonder if limiting the number of compiles might result in developers spending a little more time thinking about their code, their logic, and writing applications with a little more care?

    Or would they follow the same process they follow now, only slower?

    Steve Jones

    The Voice of the DBA Podcasts

  • Unlimited Vacation

    Unlimited Vacation sounds good, and maybe it works, but I wonder how much vacation people really take at Red Frog. My guess is that it’s not far off from what most progressive companies give, something like 20 days a year.

    It’s a good perk to have, and I’m sure it doesn’t get abused since the people that abuse it get let go. The people that don’t abuse it might even shortchange themselves. I know it sounds like a company would have people taking 40, 50, maybe 100 days a year off, but the reality is that if someone does that you find yourself in one of two situations:

    • their work isn’t getting done and you fire them
    • their work is getting done and you ignore it.

    There are plenty of managers that might feel they should be getting more work from someone that can take 100 days a year off and still get their work done, but what type of attitude is that? You hire someone, expect them to get xx things done in a year for yyy dollars. If they get xx things done in 2/3 year while the person next to them takes a year, why complain? If others complain, tell them to just get their work done quicker (or learn how to work more efficiently).

    I get over 20 days, plus holidays, and I struggle to take it. I’m essentially in the same boat as the Red Frog employees in that I manage my own schedule, and can take off whenever I want if my work is done. I rarely take sick days, since I can work at home when I’m sick. I have a grinding, daily job that requires regular effort, so I can’t plan on a month project, take off 2 days in the middle and catch up later. I essentially run a newspaper, every day.

    However I could take unlimited vacation. I could potentially get my work done in 3 days every week, keeping enough items scheduled, to take two days a week off. I’m just not sure that it would be vacation since I’d be stressed during those 3 days.

    If you are a professional, I think most places will work with you to get the vacation you need, whether it’s tracked, booked, managed, or not. The key, in my opinion, is to set a schedule that works for you, and a set amount of work that justifies your salary and makes both you and your employer happy.

  • Cloud Safety

    This doesn't look safe.

    One of the big concerns with databases and cloud computing is security. I recently ran across an article that asked the question, “how can you make sure your cloud provider can protect your data?”. There aren’t any guarantees, but there is some information in the article about the certifications that your provider might have earned and be able to prove. There are FIPS 200/SP 800-53, ISO 27001/27002, and SSAE 16, SOC 2 & 3 standards listed. Whether these are applicable to you, or provide the security you need is something you will have to decide. Be careful, and do your homework as some of the certifications mean that the certifying company can give you an opinion on security, which is their own and maybe different from the one another company would give.

    The article did make some good points about evaluating security for your company. You should understand what these certifications means, and in some cases, make sure the provider has multiple designations. For example, both ISO 27001 and ISO 27002 are needed together to ensure a reasonable level of security. The provider should also be able to provide you with copies of their audits, and contract with you to ensure ongoing audits and vulnerability tests. These are reasonable requests, and they are measures you should have in place for any of your facilities.

    Are SQL Azure and Windows Azure secure? Windows Azure does have the ISO 27001: 2005 certification, but I haven’t seen ISO 27002 listed. I also don’t think this covers SQL Azure, but it’s not clear. There is a note that Microsoft has completed the ISO 27001 and the SAS 70 Type I and II certifications, but I haven’t seen PCI listed for Microsoft. It is listed for Amazon Web Services, one of the other large SQL Server cloud hosting providers.

    Security is a process, not a product. It is something you need to create, adapt, alter, and monitor on a regular basis. Some cloud providers are diligent about applying and documenting their security controls and audit results, some are not. If you need secure services, it’s important that you get your requirements in writing from your cloud provider, or find a new vendor. No matter what work your cloud provider does to secure their facilities and network, however, it’s even more important that you develop your application securely. Restrict rights, avoid SQL Injection holes, and implement the best practices for secure development of applications as you write your code. It’s usually easier to attack your application than the hosting provider.

    Steve Jones

    The Voice of the DBA Podcasts