There was confusion recently with a poster that was moving permissions around and asked why I said they should revoke permissions and not deny them. I decided this was worth a post to explain.
If I GRANT SELECT (or UPDATE/INSERT/DELETE) permissions to a user, then they can use those permissions to view data in a table. If I REVOKE the permissions, it’s the same as if the user never had them. They would need to be GRANTed permissions again to see the data.
However, if I DENY them the ability to see data, then that’s different. They can’t see the data, but a subsequent GRANT will not allow them to see the data because the DENY will still be in effect.
It’s a more permanent change, and should be used when you need to be sure that someone cannot see data, not when you are looking to remove permissions. To undo a GRANT, use REVOKE.
I know there was a great uproar over the interview piece at the beginning of this week and I received lots of opinions on various parts of the article, good and bad to go over. But one comment came yesterday that was very interesting to me. Paraphrasing because I cannot seem to find the email in the deluge that is my desktop, it was questions the line “And you want them to think you’re one of them”
I read that a few times before I received the comment, not thinking much of it. After all, when you are interviewing, you want to get along with people and have them like you and hopefully hire you. When I got this comment, however, it struck me what the advice was and what I read were two different things.
You see I think teamwork is very important, much more important than the technical skills. Not that skills aren’t important, they’re just behind you fitting into a team environment. So where’s the problem with that line? You see it?
“think”
When I interview you, or when I interview a company, I am searching and trying to find out if I AM one of them. I want to fit in, but it has to be something that happens naturally. I try to present an honest face and I try to relax candidates to get an honest sense of how they really are. I want to know if they really fit in, or if I do. Not if I can act the part and fool someone into thinking that I’m some other candidate.
I know it’s hard. You apply for a job, maybe need one, and you want desperately to get hired. And you want to make the impression needed to get hired. And if you are really desperate, then perhaps there’s some justification. But most of the time that’s not the case. I see many DBAs and developers wanting a new job, more money, etc. and they are interviewing while they already have a job somewhere else. There’s nothing wrong with that, but if you are looking to move, do it the right way.
Be honest and give an honest impression of yourself. And at the same time interview the company and try to ensure they are giving you an honest impression of what it will be like working there.
After all, companies lie in interviews almost as much as candidates.
Does the certificate matter for TDE? Apparently not as I found a number of people discussing the fact that the expiration date for certificates is not checked for TDE restores. So if your certificate expires, you can still restore the TDE backup.
However the documentation doesn’t mention this, and I think it ought to be clarified, so I submitted this Connect item. Feel free to vote if you agree:
Voice of the DBA 