Voice of the DBA

Author: way0utwest

  • Code of Conduct for Software Maintenance

    I ran across this article about a recent symposium for CIOs where a code of conduct for IT maintenance that was developed as a guideline for how companies want their software vendors to behave.  This is strictly a customer driven initiative, organized by the Gartner Group, to try and ensure that software companies treat their customers fairly.

    I was surprised to hear that the CIO of Lowes say that software maintenance costs are the largest growing line item in his budget. If that continues, then the price of maintaining software could be a real issue for companies. If it is, then will they slow down they software upgrade cycles? What happens to the innovation of software if companies expect versions to be in production use for 5-7 years? Will that impact the 18-24 month cycle of SQL Server?

    It’s hard to say what might happen, but I do think that sometimes the cost of software maintenance is out of line with the true maintenance costs. Is a 20% margin fair? Especially when it seems every software package out there needs regular maintenance in order to work well. Is that because software just needs repair and enhancement once it gets used by the public? Or is it because software vendors are not testing enough and expecting clients to just live with their level of quality?

    The code is a good idea, and if enough large companies agree that adherence is necessary for them to purchase upgrades, I can see software companies starting to abide by its provisions. I have to say that Microsoft already follows some of the guidelines, like regular patches for its products. I think Microsoft has fair licensing practices for test and development machines, though it might be nice to see different support levels for different levels of criticality.

    Steve Jones

  • Do You Need a Mentor?

    When I was young, I never thought I did. I was sure that I knew what was best for my career and that I could figure things out by studying more, reading more, and learning more. Probably I had some trusts “issues” somewhere in my past, but I didn’t want to put my career in anyone else’s hands.

    Over the years I’ve doled out advice to a number of people when they’ve asked, and they’ve come back to thank me. I even was in conversation with a few groups this year and two separate people (different people/places) spoke out in the group, crediting me as a mentor to them.

    That surprised me, but it made me stop and think about what I’d asked them and how it had influenced them, based on what they told me. Apparently I had been a bit of a mentor. When someone recently asked me if I’d be a mentor to them, listening and offering advice, I agreed.

    Mentoring

    Those of us with kids try to mentor them. By definition, mentoring is a more senior person (in experience) providing advice or counsel to a more junior person. This has nothing to do with age, and a mentor in one area might be a mentoree in another.

    Looking back I think my career would have been more successful if I had had someone to help guide me, bounce ideas off, and get advice about the directions to take. I’ve had a good career, but I felt like I’ve stumbled in many ways. Fortunately my wife has helped, and my business partner has taught my a lot in the last 6-8 years.

    If you are looking to grow your career, I would look around and think about someone that you trust and have a good relationship with that is a more senior person. It could be your boss, a colleague, or even a neighbor. Ask them if they would help you, and see what they say.

  • Quick Elevators

    I’m at the Renaissance in Seattle for a couple days, stuck on the 14th floor. That’s higher than I normally like to stay, preferring low floors. However there is something that makes a huge difference here.

    A fast elevator.

    Traveling is often an inconvenience for me. It’s a hassle, it disrupts my schedule, and I feel like I waste a lot of time getting places. Last week I had a 10 minute walk from the convention center to my hotel room, and they were in essentially the same building! But they drag you through the casino, and it’s designed to tempt you on the way, so it ended up being around 1/2 mile. And I had a slow elevator.

    Today I got up to run, and then fitness center is on the 28th floor, top of the building. My trip on the elevator, nonstop, was about 15 sec. That’s doors closing and all. Last week the doors would stay open for 10 sec or so, perhaps in expectation of people enjoying themselves a bit much in Vegas, but it was annoying. Here the doors open and almost immediately start to close if no one is there.

    I noticed it because on the way back up from breakfast we stopped at floors 4, 5, 6, 9, 10, 11, and finally 14. I was starting to get annoyed, but it was almost as quick as my 1 to 4 to 5 trip last week because of the delays in the doors and the slower elevator.

    Little things make a difference, and surprisingly to me, the fast elevator here makes a difference.

  • Should You Write Down Your Passwords?

    Today’s editorial was originally published on June 27, 2005 and is being reprinted today as Steve is out of town.

    According to Jesper Johansson, senior security program manager at Microsoft, the security industry is giving out the wrong advice by forbidding people to write down their passwords. Strong passwords are impossible to remember and lead to people picking easy passwords or using the same password across all the systems that they access.

    And using the same password across all systems us poor security. I tend to agree with that in most cases because if one system is compromised then all of them are. However, for the administrators, it’s problematic if all systems have different passwords. Then the cost (in time) of administering these systems goes up. I admit that in most of my jobs I’ve used the same sa password on all servers and the same administrator password on all systems. The caveat is that we change those passwords often, usually every 30 days and always when an administrator leaves. While a security breach would leave all systems vulnerable, the window of opportunity is fairly small.

    Bruce Schneier says that it’s impossible to remember strong passwords. And now password cracking programs are hip to the 3 for e and 0 for o replacements (and others). Plus with distributed cracking programs and cheap hardware, it takes less and less time to crack passwords for anyone that truly wants to get at your systems.

    It’s quite a quandary for people. To me there are two problems we are trying to solve. One is protecting systems for the administrators. These are more technically competent people and should be required to build stronger passwords. The system that I liked the best over the years was the central storage of all our administrator passwords (Windows Admin, SQL, Exchange, service accounts, etc.) in a central storage file. We used Password Safe for this on a network share accessible to administrators only. We changed the file password periodically and scripted changes of the various passwords every 30 days. Usually we’d solicit some theme and assign an administrator to change the passwords.

    The other problem is how to get users to create and deal with complex passwords. Of all the suggestions that I’ve seen, I think writing them down is a good idea. Make stringent requirements, 12 characters, mixed case, numbers, etc., require changes often, but allow them to write them down. Not on sticky notes, not posted, but maybe a card that they keep in their wallet or purse. Or these days, maybe their cell phone.

    Now if we could just somehow secure your cell phones. Maybe outlaw Bluetooth?

    Steve Jones