Voice of the DBA

Category: Editorial

  • Stale Data Causes Security Issues

    Security has become better and better in many organizations. At the same time, hackers and malicious actors are doing a better and better job of finding new ways to attack systems. Some work to target specific individuals, often because of government or industrial espionage. Most of us aren’t likely to deal with those issues, unless we work with (or are) someone that is very important in a particular situation.

    Instead, many of us deal with wider spread attacks that look to exploit vulnerabilities in technology or humans at scale, hoping to find the weak links. Lots of people I know have dealt with viruses in the past that shut down systems, and more recently, had to rebuild systems crippled by ransomware.  Despite their best efforts, this often means lots of extra unexpected work, combined with the stress of falling behind on our commitments. We have plenty of other work to do.

    Windows has been vulnerable throughout its history, and it appears, lately through a data problem. There is a class of attacks that look to use approved, though old and unpatched, drivers as a vehicle for gaining a foothold inside a network. This was a problem (called the BYOVD issue) and Microsoft addressed this with a block list that was used to prevent the loading of vulnerable drivers. They updated this list through Windows Update.

    Except they didn’t. In database terms, we had an eventually consistent set of data, which was being updated at Microsoft, but not being sent to client workstations. There were over 3 years of the list not being updated, despite assurances from Microsoft that Windows 10 PCs were protected. There are instructions for manually updating your machine.

    I don’t envy this being a process I’d want to build. Getting data from security researchers or elsewhere, putting it in a database (I hope), then exporting this into a text format and getting that loaded into the Windows Update process, all while trying to ensure the process is secure along the way. That can’t be easy inside a large company like Microsoft. At the same time, not noticing this wasn’t working isn’t excusable. Likely there were issues, but my guess is someone didn’t want to admit a failure and get a bad annual review.

    Data sync issues are nothing new, and many of us struggle with these on a weekly basis. However, these are important issues. Replication can fill log files (and disks), broken ETL processes can cause execs to make poor decisions, and in the security space, not updating drivers and block lists leave us vulnerable.

    This situation isn’t excusable and Microsoft ought to be ashamed. Some of these execs ought to lose bonuses, at the very least. It’s also not excusable in our orgs. We ought to be sure we’re patching on a regular basis and minimizing the attack surface area we present. It’s the least we can do as IT professionals.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Will ChatGPT Write Our Queries?

    The short answer is no.

    The longer answer is it depends, and perhaps to be more complete, ChatGPT likely will help us produce the simple, tedious queries with much less effort.

    There has been a lot of news about AI and ChatGPT and how well it performs for a computer. That last phrase is important because while it’s impressive, I don’t know that any of us would consider ChatGPT to be in our list of the Top 5 Dream Dinner Guests. The tool isn’t that impressive compared to most people, especially our friends.

    I look at Ayende Rahien’s blog often, and he recently had some thoughts on this topic, experimenting with ChatGPT and coding. Some things worked; some didn’t. In general, to get good code, you still need a subject matter expert, which is also the case with humans. We have plenty of people writing code that aren’t great at their jobs. We do see a lot of bad code, but we also have some great coders that help others to learn or just refactor their code later.

    So is ChatGPT better than a below-average developer? I don’t know. While the tool will get better, one advantage with people is we can complain to them, or send them problem queries, and they’ll learn to paste better code in from the SQL Server Central forums or StackOverflow or somewhere else. Perhaps ChatGPT will learn, but will it learn to improve and refactor code? I’m not sure how easy it will be to teach the system to edit something rather than just produce new code.

    I do think that the assistance features of AI, suggesting ways to complete sentences or lines of code, can be very valuable. They are a great productivity tool that can enhance your ability to get work done. If they learn to work in your style, suggesting the things you’ve done in the past, then these tools will help. As with most tools, they aren’t a replacement for your knowledge, but merely a lever to make you more efficient.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • The Top 5 Technologists

    There’s a common party question about which 5 people would you invite to a dinner party? Often this is amended to include living or dead people, and it’s often interesting to hear people tell you who they’d invite and why.

    Since most of the people reading this work in technology in some way, I was wondering who you would invite to a party that’s related to technology. Living or dead, however tangential, is there a list you can come up with?

    I’ll give you my list and then a few thoughts. For the list, I’ll say Steve Wozniak, Sal Khan, Reed Hastings, Gladys West, and Lawrence Lessig. Maybe not all technologists per se, but all had an influence on my life using technology.

    Steve Wozniak because he was a geek hero and he seems like a fun person. Someone that enjoys technology. I had an Apple II early on and always wanted to meet him.

    Salman Khan because I think his use of technology to teach others, for free, was incredible. Education is something that’s a big part of my life, and I appreciated his lessons helping my kids at times. I think someone that sees the world in this way would be a great conversationalist.

    Reed Hastings has been an incredible businessman in the tech world. He founded Pure Software and Netflix, and has been on the boards of Microsoft and Facebook. He has had an influence on education efforts in California. I would love to listen to him talk about business and technology.

    Gladys West is a mathematician who worked on a number of topics that built computer models for submarines and analyzing satellite data. She has had quite an influence on the GPS system many of us use every day in our phones. I’d love to know what it was like for someone like her to work and grow in our field.

    Not least, just last. Lawrence Lessig is a professor of law, and someone that has worked hard to ensure our legal world better represents fairness and ethics in technology. I’ve read a number of his books and would be interested in talking about how we ought to view the digital world from a fair rights perspective.

    That’s my list. What’s yours?

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • The Danger of Sharing Data

    In the past, many businesses hired employees whose role was deciding which prices to charge for their goods or services. At one point, organizations largely set prices based on their costs, though over time they tend to look at their competitors and set similar prices. If, however, management from multiple companies went into a room and determined prices, this would be price-fixing.

    Price fixing is illegal. In many countries, we would not allow different companies to work together in a way that might reduce competition or take advantage of consumers. However, that might be a struggle in the future as we find companies using various services to help them manage their systems.

    In this case, a few different Las Vegas hotels used the same company to help them decide how to price their rooms. Rainmaker is a revenue management platform, which uses lots of data to help hotels price their rooms in a way that maximizes their revenue. That sounds great, but if this company is successful and many of their clients are in the same location, this is really a way of sharing data by proxy. The hotels are being sued because of their use of this platform.

    This one of the problems (or advantages) of lots of data. It allows information to be drawn out of data that wouldn’t otherwise be obvious. Certainly, lots of companies look at their competitors and make decisions based on what they see. I’m certain there are lots of people inside airlines constantly checking the prices of their competition. However, they are gathering this data independently and making their own decisions. If Rainmaker were used by American, United, and Delta to set prices for flights, I imagine many would see this as an anti-trust violation.

    Big data is powerful. It can help give an organization an advantage over its competition. This is one reason lots of companies hire data professionals like us; they see data as a very valuable asset. However, in this case, I feel that one company selling this data, or rather the conclusions, to competitors is a problem.

    I expect more problems like this in the future as smart people look to harness the power of data and sell their services to competitive companies in many industries.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.