Voice of the DBA

Author: way0utwest

  • No-so-smart Contracts

    Perhaps the best quote I’ve seen in a long time: “These kinds of attacks are common in smart contracts because many developers do not put in the legwork to define security properties for their code…” I’m sure that this would apply to many kinds of software, not just smart contracts.

    This is from an article on a hacker that stole money by altering a smart contract. In this case, tokens used to replace parts of the contract overwrote other tokens, which allowed a smart hacker to change prices and make more money. Or steal it, with a contract change, I don’t know that theft is actually the correct term.

    The wider issue here is poor developer practices, and really, not listening to the results of security audits and making changes in code. Maybe they listened to the audits and hadn’t completed the work. There were some critical issues, and some remediation, but not enough in this case.

    Building security into software is hard. The threat landscape changes and hackers are incredibly creative. It is hard for developers to keep up, but it is important, especially where there are finances involved. There are tools to perform security assessments and automated pen-testing. Everyone ought to use these, and more importantly, management should take security more seriously. If they don’t, they deserve some sort of penalty.

    The problem for many of us is that we can raise issues, but we are powerless to do anything. We can change jobs, but that’s not practical all the time. We can continue to raise awareness, but that can be detrimental to our careers. After all, management will get tired of us repeating ourselves at some point.

    Mostly what we get to do is worry. We worry that the company will get penalized, which can affect our employment. We can worry that management will blame us for an issue they didn’t allow us to fix or give us the tools to detect. We can worry management will blame us for not knowing about an issue as well.

    I believe we ought to have more focus on security, but I’m not sure what that means or how to achieve this in a practical sense. I don’t even know how we’re set up regulations and penalties for such a complex situation.

    Mostly I’m just sad for the state of software security.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Daily Coping 15 Dec 2021

    I started to add a daily coping tip to the SQLServerCentral newsletter and to the Community Circle, which is helping me deal with the issues in the world. I’m adding my responses for each day here. All my coping tips are under this tag.

    Today’s tip is to buy an extra item and donate it to a local food bank.

    I used to volunteer and get items for the Elizabeth food bank. These days I’m mostly in Parker as part of my life, so I’m going to start making regular donations there. I went to the site, got their list of items needed, and will be purchasing some of these to drop off.

    Lots of these are kid related items, and I hate to think about kids struggling, so I’m focusing my efforts there.

  • The Next Event: T-SQL Tuesday #145

    tsqltuesdayIt’s time for T-SQL Tuesday again, and this month the host is Xavier Morera. He’s been part of the push I had to get a host with every letter of the alphabet. Silly, but fun for me. Now I just need I, O, Q, U, Y, and Z.

    The invite this month is about conferences, and specifically what is your favorite event, venue, presenter, and where you want for your next event. A topic near and dear to my heart as a speaker and organizer, so I’m looking forward to what people write.

    Favorites

    I’ve been blessed to go to many events. My Speaking CV shows most, but I’ve been to quite a few others as an attendee. My favorite conference is SQL Bits. They event is always slightly different, the themed party is fun, and they are family friendly. I see people from all over the world, and I’m excited just thinking about going in 2022.

    My favorite venue is harder. Lots of venues are just spaces, just conference centers. That being said, I think that there are a couple that stand out. Bangalore had a beautiful conference center. SQL Saturday #66 in Colorado Springs was in a games/go-kart center. The elementary school at the Jewish Center in Portland. All memorable locations.

    I think my favorite place I’ve been was the Royal Society of Medicine in London. Redgate rented this out for a few events, and it’s nice, lots of comfortable seats, plenty of bathrooms, tables for lunch. It was quite a nice venue.

    My favorite speaker is tough. I’ve seen many, and I’ve enjoyed most. I’ll give a nod to Amir Netz, from Microsoft, who I’ve seen quite a few times over the years. He’s entertaining, funny, and smart. Half the time I don’t quite understand what he’s talking about, but I’m enjoying it just the same.

    The Next Event

    I’m blessed in that I’m actually just returning from my “next event”. I was in Las Vegas last week for the SQL Server and Azure SQL Conference at DevIntersection.  I’ve been lucky that I was able to attend a few live events this year (2021) and am looking forward to more in 2022.

    Costa Rica would be an amazing next event. I have never been there and would love to go. I’d speak, volunteer, and help organize if someone is interested.

    It’s a tough time in the world, and I know that holding a live event might not be possible, or safe, in some locations. I would love to return to New Zealand, I’m looking forward to Jacksonville in the spring, as I’ve never been able to make that SQL Saturday.

    If I had to choose, I’d want to get a SQL event in Tokyo and go there. I have never been to Japan, and it’s on my list of places to go at some point, so I hope I hear 日本へようこそ one day.

  • Daily Coping 14 Dec 2021

    I started to add a daily coping tip to the SQLServerCentral newsletter and to the Community Circle, which is helping me deal with the issues in the world. I’m adding my responses for each day here. All my coping tips are under this tag.

    Today’s tip is to listen wholeheartedly to others without judging them.

    This is similar to a few tips across the last year, and for me, it’s one I’ve been working on. As I find myself hearing someone else complain or cheer or anything, I’m trying to let the words and feelings wash over me and avoid judging or projecting my own feelings onto them.

    I’ve had some success, but I still need to remind myself of this. Without disclosing names, I was listening to someone tell be about their success with finances and work this year. Rather than compare myself, or view them as a bit arrogant, I cheered on their success in my mind. It’s hard to not compare or examine how I feel I’ve done this year against them, but I was working to limit this to a “could I do better” than a I or them was more successful.

    I think I did this well internally. Externally, I just congratulated them and listened to their joy, feeling good for them.

    I had another friend who is having a hard time in life and getting together with others. My initial thought was that some of their complaints are self-created, but I worked to stop myself from judging them and instead just listening and providing the support and sympathy I can. No advice, no suggestions, nothing but “I’m here for you.”