Voice of the DBA

Category: Editorial

  • Breaking Biometrics

    In the movies, when someone needs to bypass some sort of fingerprint biometric system, they use tape to lift a fingerprint, or in the more gory films, cut off a body part. In any case, there have been a lot of attempts to replicate this in the real world. Sometimes these work, though the consensus is modern hardware isn’t as susceptible as older hardware. I don’t know if that’s true, but I did see an interesting look at the main three sensors used in most laptops.

    All the laptops had their authentication bypassed, though not with any fake biometric device, but rather with attacking the actual communications between the sensor and the OS. There’s a great report from two people who were asked by Microsoft to evaluate the security of the top three sensors. It’s a fascinating look at how the hardware and software of the OS are set up to provide secure authentication and how both can be fooled.

    Some of the problems are users not enabling features and some are that manufacturers aren’t understanding or implementing the secure protocols from Microsoft. I both get how this happens and I feel it’s not acceptable. Certainly someone might read a spec and not completely understand it, even across a team of people. However, for vendors, this can’t be something they don’t have researchers, pen testers, or some security professional examine. Hardware vendors spending money designing these devices ought to include the money for a few people to try and break the security before they are sold.

    At least for security features.

    I like the enhancements made with multi-factor authentication, and I appreciate biometrics as a convenient way to access things. At the same time, I want to be able to trust them. The efforts made by the researchers are pretty high, not something that someone in a coffee shop can do in 5 minutes while you go to the bathroom. At least, apart from the Surface. It appears that one can be quick.

    At the same time, if you lose your laptop, within hours someone can break past the biometrics with a man-in-the-middle attack. Even if you’ve encrypted the disk, your data can be accessed since this attack gets the OS to authenticate them.

    Security is tricky, but I don’t plan on disabling my fingerprint scanner. However, if I were carrying around data that was more important than the work I do now or data worth a lot of money, I don’t know I’d ever enable biometrics.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Focus on Growth in Your Career

    I find there to be a lot of value in actively managing your career. This is part of a series of editorials based on advice I’ve read from Raylene Yung (Facebook and Stripe) on your engineering career.

    I write a lot about growing your career. I think it’s important to find a good career, but also learn to be good at whatever you choose to do for employment. While I do think that learning is a skill and each of us ought to sharpen our saws, I sometimes find people chasing new things all the time. In this interview, I saw a great quote:

    “… while it’s important to be informed about the latest frameworks and best practices, learning this at the cost of developing fundamental skills is a bad tradeoff.”

    That’s something I imagine Jeff Moden saying about all the new technologies that get incorporated into database work. Often I find there are a lot of DBAs and database developers that want to implement PowerShell or MDX or Python because they can and not because it’s a good choice. Or perhaps more often because they aren’t as skilled in SQL as they should be.

    I am a fan of experimenting with different methods and determining if there is a better way to solve a problem. However, I am only a fan of using new techniques when they are better. Either they have to perform better (less resources or a lot less time to run), simplify the situation, or they save a ton of developer time. And not just your time, but for all other developers.

    One of the things noted in the interview above, as well as something I’ve seen, is that many younger people want to constantly try something new, without developing deep skills in any area. They often move in new directions because they can. I also see intermediate or senior engineers getting bored with their work or excited by something they read about and looking to shift everyone to a new platform/language/framework/etc.

    New can be better, but isn’t necessarily better. Instead, I might try to answer these questions from the article:

    • how can I make every code change great?
    • how can I be as good at X as someone on my team – For SQL, can you be as good as Jeff Moden or Itzik Ben-Gan? Or maybe closer to their level?

    The goal is to become better at your craft. Like the woodworker who improves their skills in shaping wood, or the chef becoming better at creating more tasty recipes, or maybe the weekend race car driver who learns to shave seconds off their lap times with improved driving technique.

    If it isn’t important to you to become the best in your team, maybe this will help. The cloud, AI, and competition from younger people will ensure that if you don’t improve your skills at all, you’ll slowly fall behind and your current manager, or the one that takes their place, might find a way to replace you with someone that does the job better, faster, and cheaper.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • The Stagnant Career

    Do you feel stagnant in your career? Or maybe the better question is do you care if you feel stagnant in your career?

    You might need to define what that means to you, as what might feel stagnant to one person could be comfortable to another. Apparently, there was a study of tech professionals, who despite a tight labor market, are citing lack of salary increases and dim promotion prospects as reasons to leave their jobs. The survey was across a number of larger technology companies, and likely answered by more talented employees. After all, good talent can usually find jobs and is less worried about leaving. Less talented people usually cling to their jobs.

    A lack of salary increase could be a problem. Everyone, or most everyone, wants regular raises. However, depending on where your salary bracket is and your living expenses, you might not rate this as a very important criterion for sticking with a job. Someone making USD$40,000 might be more concerned about a raise every year than someone making USD$200,000, but perhaps not.

    Having a career progression was more important to me at 30 than it is after 50. Again, the varies among people, but I find a lot of people like their jobs and don’t really want to change. Many of them would likely be happy to keep working at their level as long as they can get raises. I see people complaining about their current position when they’ve bumped up against a salary limit for that position, but otherwise, they’re satisfied.

    The work matters. I do think there are plenty of people who are unhappy with the work they do and want to be challenged, or at least interested, in the work. At the same time, lots of people are happy to just do a minimal variety of work day after day. I think this is why I encounter lots of people who seem to have 4-6 months of experience repeated 10+ times.

    My view is that you ought to make your career what you want, and that means actively managing it. Spend time thinking about what you want, ask others about their work, and make plans to move in the direction that matters to you. Implement those plans and find a balance between advancing your skills and living your life. It’s easy to do too much of one or the other, but often that’s not the problem, it’s the motivation and effort to actually improve yourself.

    I can’t tell you how to structure you career or what to learn or what to improve. You have to decide what is interesting to you and what fits in your life, and then make an effort to move in that direction. Sharpen your saw, improve your craft, and learn those soft skills that help you work with others. That’s how you find the career you want, which will never be stagnant.

    Note: We do have a career forum on SQL Server Central. If you want advice or have questions, post something and I (or someone) is happy to answer.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Be Careful with Missing Index Requests

    One of the things that has been interesting to watch over time is how the SQL Server platform has expanded the amount of information that we get back about the performance of the query optimizer and query processor. While it’s not perfect, and there is room for improvement, the advances made with intelligent query processing are helping many systems run faster. Not all queries, but some.

    As I’ve done a little work on other platforms, there are ways to look for potential missing indexes in PostgreSQL and MySQL, but these aren’t built into tools, nor are they easily accessible to developers or DBAs. There’s work to be done on many platforms, though I’m not sure if there is more work than required in SQL Server. On all these platforms, you need to dig into queries and understand why they are slow, though the tooling for SQL Server, with graphical plans in SSMS (or with Plan Explorer) can make the job easier.

    One thing SQL Server does is provide missing index recommendations in the query plan. You can find information on this in the docs, but you should make sure you read the limitations section. The recommendations returned should not just be run. I should repeat that for junior DBAs, accidental DBAs, and developers:

    DO NOT JUST RUN THE MISSING INDEX RECOMMENDATIONS WITHOUT TESTING LOTS OF QUERIES.

    I hate using all caps, but that is important. As an example of why, watch this short video from Erik Darling, where he shows that the simplistic view of the missing index is helpful, but not as helpful as it can be. In case that’s not enough, there are other issues that Brent Ozar, Phil Factor, and Aaron Bertrand share some of the problems they’ve found.

    There is a wealth of information that is available about queries in SQL Server and how they are processed. It will help you in your career to learn more about performance tuning and how to evaluate queries. We have articles here, there are more on Simple Talk, and Erik Darling produces information every week and also has training to help you learn to tune queries better. There are plenty of others that will help teach you as well.

    Maybe the best benefit of learning about tuning is that you can learn to write better queries the first time, which means no rework, no effort responding to complaints, and a cheaper bill if you move into the cloud. That might be something you point out to your boss and ask him or her to fund a little education to help you and your employer.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.