Voice of the DBA

Category: Editorial

  • PostgreSQL 19 Is Late

    “All software contains bugs.”

    That’s a quote from Robert Haas’s “Postgres 19 is late” post. He goes on to say that PostgreSQL has lots of bugs in it. It’s the way it’s been for a codebase that’s over 40 years old. He goes on to note that it’s easier to find bugs with LLMs, and easier to fix them. It’s not, however, as easy to do the latter as the former.

    The impact on PostgreSQL 19 is that they’ve had to revert a number of features much later in the process because the humans were reviewing and fixing bugs found by LLMs. This effort delayed other work and has affected the release.

    As someone who primarily works with SQL Server, I’m not that worried about delays in PostgreSQL or other platforms. I think it’s a fine choice, but I’m focused on SQL Server, which I think is more of a joy to work with.

    However, there are a few interesting things in here. First, I think SQL Server has had a lot of bugs found lately (likely by AI LLMs). I recently wrote about the frequency of patches, which is higher in 2026. This is probably due to LLM code review, and that’s good. It also means we likely will have more patches coming, not just in SQL Server or PostgreSQL but also in our other systems. What’s the likelihood that someone will run an AI review and find bugs in other COTS software, internal apps, or even those no-code/lo-code systems people have been deployed? That’s not even mentioning the vibe-coded prototypes that are suddenly important enough to put into production.

    The other interesting thing was that Robert accepts that LLMs are likely to find more bugs in the future. How will they find time to work on them? After all, from the article, fixes “still need to be reviewed and committed by humans.”

    Maybe the best part of the last paragraph. He says LLMs are going to require every developer to raise their game. Every feature is going to be scrutinized by AI. That’s a challenge and an opportunity, but the key is that developers need to get better. AI can help you and write code at amazing speeds, but it doesn’t think.

    We need sharp developers that think in order to cope with AI.

    Steve Jones

  • A Heavy Heart

    Hugo, I have many memories of moments we spent together, discussing data, career, life, and family. Three stand out, though not more or less important than any others.

    I can remember asking you a question years ago at a SQL Saturday about the way an execution plan was formed, and you patiently explaining to me something I didn’t understand. I’m sure I asked some poor questions, but you tried your best to help me understand some aspect of why the plan was shaped a certain way. Your patience and exuberance still stand out in my mind today. You trying help me understand something that I’m not sure I understand to this day.

    We caught up at one of the MVP Summits at night, at a time when our children were approaching the end of secondary school education. We had a common thread in theater, brought to us by our (not-so) young ones, and I recollect the pride with which you talked about your kid performing, me feeling the same way about mine.

    At the PASS Summit, I gave a career talk a long time ago, and you came up to me at the end. You told me I hadn’t said anything you didn’t know, which made me feel a little as if I’d failed. You then told me I’d presented it in a way that made you think and inspired you to think about doing something differently. I was amazed that I’d touched someone like you, who I felt had already succeeded.

    Hugo Kornelis has been one of the SQL Server experts who have helped, shared, inspired, and taught many of us over the last few decades. He runs SQLServerFast.com, where he provides a wealth of training, both free and paid (support him, buy a course). He’s also been battling leukemia for a few years, and recently posted Game over, as his fight has taken a turn for the worse. Hugo has faced this challenge by fighting with grace and honor in a way I’m not sure I would, or many have. I kept hoping he would keep improving and I’d have many more opportunities to see him. Grant and I have agreed to take over hosting his site, with support from Redgate, and I’m not happy about it. I wish I didn’t have this opportunity.

    I’d much rather have more conversations with Hugo.

    Just typing that line brings tears to my eyes. Hugo has been a friend, a mentor, a teacher, a joy to chat with, and an easily spotted man in a crowd with his trademark blond streak. I was thrilled to come over to Belgium right after the pandemic and spot that blond streak above a mask, knowing I’d have another chance to spend time with him.

    Life is short, and I’m acutely aware of that as I age. I will cherish the words and moments I’ve shared with Hugo and hope I get the opportunity for more. Fingers crossed his fight continues for the foreseeable future.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • AI Is Improving Security

    I was updating the SQL Server build lists the other day. I typically get a notification from Microsoft when new builds are released. This is something that happens every month as a new CU appears. For SQL Server 2022, we get a CU every other month since it’s still in mainstream support. Older versions just get these security patches. Since SQL Server 2025 is new, we’re getting a CU a month, which will slow down next year. However, I’ve also seen this for most versions:

    • Oct 2026 – GDR
    • Sep 2026 – GDR
    • Jul 2026 – GDR
    • May 2026 – GDR
    • Apr 2026 – GDR
    • Mar 2026 – GDR

    That’s a lot of out-of-band patches. In the last decade of SQL Server, there have been relatively few GDRs. Often the main CU comes a day or two later (or a month later for older versions). If you react and start to plan patching, you might find yourself trying to decide if you apply CU9+GDR or wait for CU10, or do both.

    There have been few GDRs in the last , but before that, relatively few: three in 2025, two in 2024, and two in 2023. I suspect that AI is being used to discover bugs in existing software, and this is forcing Microsoft to perform remediation work. Brent posted a similar thing, noticing a large number of security fixes and speculating that AI is finding issues.

    That’s good, right?

    Or is it? If Microsoft can find security issues, can’t malicious actors? Including nation-state-sponsored hackers? I’m not even sure that Microsoft is finding most of these, as there are lots of CVE issues, which can be discovered by anyone and sent to Microsoft. This might be to obtain a bug bounty payment, as Microsoft and other vendors will pay security researchers.

    Or it could be that a hacker finds an issue and exploits it. A customer then notices an issue and reports a problem to support. Microsoft realizes there is a vulnerability, works on a fix and reports the issue to the CVE database.

    AI is great for security, as it can scan software and look for known issues. We have decades of security bugs that have to be included in the frontier LLM training, so using AI to scan your code is a good idea. I am sure code scanning tools are adding AI review to their systems. I’m also sure those vendors are worried you’ll use AI on your own to scan code and find your own issues.

    You can do that, but ensuring your AI does a good job scanning isn’t necessarily easy. Or fast. Deterministic systems, like SonarQube and Flyway can find code issues quickly, in a deterministic fashion, and likely with less cost than AI. That’s not to say AI doesn’t have a place, but it’s likely an out-of-pipeline review that takes place less often than every CI build.

    Security is a constant battle, and it’s hard. The age of AI makes it easier and harder (and more expensive) to manage security, but I think that’s a good thing. We’re seeing lots of vulnerabilities, but also more patches. Perhaps the better outcome is that there is more awareness and focus on security from vendors who now know if they don’t scan their code carefully, someone else will. Perhaps someone they don’t want finding issues.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • Making an Impression

    It’s a weird time in the job market. Companies are hiring, and I see friends and colleagues starting new positions. At the same time, I have had many more friends reach out, saying they are struggling to find employment, and job searches are dragging on for months. I sympathize, and it certainly seems that lots of people are trying to hold onto their existing positions.

    Whether you’re looking for a new position or trying to create security in your existing role, it pays to be aware of the impression you leave in the world. Is it a positive one? Do others want to work with you? Or maybe you find people gravitate towards others. Are they impressed with your output? Satisfied? Left wanting?

    Maybe a better question is: if you were running your team, would you hire you again?

    I think it’s a very human tendency to overestimate our abilities and underestimate our weaknesses. That’s why 90+% of people rate themselves as above-average drivers. In my travels, I find plenty of people who aren’t very self-aware of the impression they make, good or bad. Lots of people aren’t very observant, which is another human tendency.

    Recently, a friend was hiring for a position and noted that they received a large number of resumes and cover letters with spelling and grammar mistakes. They deleted those and then started to review the rest. They also mentioned that while checking LinkedIn, they were turned off by people who hadn’t added their picture. I’m not sure if those candidates were discarded.

    Whether you think those are valid reasons to judge others, the reality of the world is that humans judge each other. We have our own prejudices, attractions, turn-offs, and more that influence our decisions. It’s easy to say that you’ll pick the best candidate, but that’s much harder in practice. Many of us fall into buckets with lots of others who are applying. How do we stand out?

    It can be hard, especially when different people form different impressions from the same experience. Not enough experience is a challenge, and these days too much experience can also be a challenge. There are plenty of hiring managers who might not consider a candidate if their impression of a candidate is “too old”, “too expensive”, or “too set in their ways.”

    It’s a tough world these days, and AI doesn’t help. What I can say is that you should be aware of the impression you make and work to regularly improve it. It’s unlikely you’re clearly above or below others who have similar experiences and skills, but building a preponderance of evidence that you are a good hire might make a difference.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.