Voice of the DBA

Author: way0utwest

  • The Soft Skill of Respect

    When I started to work more closely with the product development teams at Redgate Software, I found it interesting that we devoted so many resources to user experience, testing, and other non-development tasks. Coming from more focused groups, this was new to me. At times this felt like an indulgence, and at times a lot of overhead that slowed down the coding process. Over time, I’ve grown to appreciate having different skills in our teams.

    Not that we build software in the best way possible, and certainly not the quickest, but we have some well coordinated and knowledgeable teams. We’re still evolving and learning how to put together teams of people and effectively build software, but I think we’re moving in the right directions.

    As soon as I read this piece on hard and soft skills, I thought of Redgate and all the non-coding people that build our products. What struck me was how often I’d devalued non technical skills, but the more I work with our (and other) software, the more I appreciate that those other roles are important. The piece rambles and wanders around the point, but I do see that there are a couple important takeaways I get from this.

    First, we need to respect others that perform different work from us if we are going to build synergy in our teams. The synergy is creating something that none of us could do individually, or even separately. We get more done by working together and that means we must be a team. Teams only come from respect between individuals, and that includes the managers.

    The second thing that I realized, is that it is important to understand a basic level of what other jobs entail. Too often we data professionals have been upset that application developers don’t know more SQL. Many of us learn some of the domain specific knowledge of the data we deal with, in order to talk with customers, produce reports, etc. Following our own advice, we ought to know more about the development platforms, the challenges, their testability, and more, if for no other reason than we can better understand how the entire system works and can talk about it with others

    I certainly know that relationships and people are incredibly important in larger projects, which is another important takeaway from the article. We all do need to improve our hard skills, learning to code more efficiently and securely. We also need to remember the importance of softer skills, and the need for a wider variety of skills in our teams. A little appreciation for the need for more than expert level coders might help us create better teams that function more efficiently and help us produce better software.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.8MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Dealing with Technical Debt

    Stop for a minute and think. How much technical debt do you have in your code? Let’s make this easy, take a break from this, close your eyes, and take thirty seconds or so and think about just your code. How much would you rewrite or redo if you could?

    Now, stop and think for another minute. How do you measure the amount of debt? What’s your metric? Leave a note in the discussion after you finish this and let us know.

    There’s an article from a project manager about technical debt and how his team decided to measure this in their organization. They actually set a series of metrics for things they cared about and assigned an actually dollar, well, pound sterling, value to each. They then totaled these for all projects and came up with a total debt number. They then track this, incurring new debt or paying off older debt over time.

    I think that’s an interesting idea. I don’t know that the debt needs to be money, but I do think money is a little better than some abstract metric like tickets or requests. Money is something many of us are familiar with and we hold debt. Assigning a concrete value does let us measure where we stand in a way that we can better relate.

    Just like financial debt, not all technical debt is bad. Sometimes debt lets us get more things done sooner than we might otherwise be able to do. We do need to take shortcuts at time in development to get a prototype working, or deliver a feature or meet some other goal.

    It is easy to overdo things, and just like with finances, overextend ourselves. Paying down that debt can prove to be a struggle in both cases, perhaps even crippling our ability to tackle any other projects.

    If you think about technical debt now, do you view things differently? Do you have a measurement system? Can you tell if your incurring or paying down debt? It might be valuable to implement something and ensure you don’t keep building up more than you can handle. It might even be something to show your manager and get some time to fix a few bugs.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.6MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Badly Encrypted Databases

    I ran across a blog about encrypted databases linked from Bruce Schneier’s blog. I follow his musings and writings on security ,and he recommended we read it with this sentence: “Even the summary is too much to summarize, so read it.” Good enough for me, so I clicked the link and read about encrypted databases.

    I like the idea of stronger encryption in databases, and I’ve given a few talks on the subject. At times there are attendees that will debate that encryption in the database doesn’t do a lot of good. Often they dismiss the idea of TDE, since administrators can still read the data and break the encryption, and normal users aren’t affected. Many also note that database encryption does nothing for data on the wire, which is true. Most people want to do the encryption and decryption on the client, which has other challenges and is fairly hard to do well.

    I think that security a series of layers, and as noted by the author of the blog, most criminals are lazy. If they can copy a backup file or data file, they’ll just do that and read the data. TDE isn’t perfect, but it does limit these simple attacks. Always Encrypted was developed to try and make it easy to include encryption from the client side, but in SQL Server 2016, it has lots of limitations. In SQL Server 2019, we get secure enclaves, which should help adoption somewhat, but we will see once developers start to experiment with the feature.

    The blog talks about problems with encryption, spending quite a bit of time on approximate database reconstruction, which is essentially guessing data values with some information and by watching queries and results. It’s somewhat fascinating, and also scary, but complex and likely requiring lots of queries. To me, this is an area we ought to focus, and really an area that all our protocol libraries and possibly database firewalls (or built in limits) ought to focus efforts. We shouldn’t be most clients to make large queries of all data in a table. Really at this point, we ought to have build in limitations of queries to ensure that users are exporting all data from a table. I’d like some throttle that might prevent the return of very large result sets to clients.

    At the same time, there ought to be some way to analyze the queries coming in and see if an attacker is “guessing” values. I won’t pretend to know how we might do this, but it would seem that in the same way we detect lots of login attempts, we could have some alert being raised when we had xxx of the same type of query in yyy time. That might alert us to potential problems.

    Or users running lots of searches.

    I don’t know the best way to protect data, but I do know that too many of us aren’t doing a good job of this. We need to get better, both in production and development environments. We need to be better at protecting databases and the data within them.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 5.0MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • The T-SQL Tuesday #112 Cookie

    tsqltuesdayIt’s T-SQL Tuesday again, and I’m writing in response to Shane O’Neil’s invitation about cookies. Read what he asks and this will make more sense.

    As always, if you want to participate, write a post on your blog and follow the rules on the invite.

    If you want to host, ping me on Twitter.

    My Cookie

    I’ve had quite a bit of success in my career. I’ve worked hard, and I was lucky to be born intelligent enough to get things done in this field, but I’ve had a lot of help along the way. I don’t want to discount the things others have done for me, whether that’s a favor, an opportunity, or a lesson. This post is about standing on shoulders, my own and others, in a way that still makes me smile today.

    I had a lot of experience programming in the past. I’m not great at it, but I’m effective. A few years ago someone asked about getting a list of the PASS sessions from the DVD that they’d purchase in a data set. They didn’t want to go through the HTML index on the drive, but wanted a better data set to work with the sessions.

    At the time, I had the USB key sitting on my desk. I was doing some R learning at the time and decided to see if I could do something in R. I remembered a few years earlier when Aaron Nelson had helped me with a PowerShell script to download some videos, and I wanted to see if I could do something in R.

    I ended up building a short script that read in the data, cleaned it up, and exported a short R script that contained the session titles, authors, and the MP4 file. It took my only tens of minutes, and I was quite proud of it.

    Actually, I need to blog that script.

    In any case, when I sometimes face a task that is unfamiliar, I remember how I worked through the process and got things working. When I worry about a new technology, I remember how I accomplished this in R, which was new to me.

    It’s a delicious cookie, even today.