Voice of the DBA

Category: Editorial

  • A Data Attack

    I got a new mobile phone and was going through the setup. On top of numerous Android updates, I had to reset a number of applications back up. While it’s a pain, I also appreciate from a security standpoint that moving access to my data and sites to a new device could be an issue. One of the applications I was trying to set up was Garmin Connect, as I track my exercise, heart rate, and more on my watch. When I first tried this, I got a 404 in the app, which was strange.

    Apparently Garmin was having issues. They had a large outage. The next day I saw that article, and while I could get to the main Garmin site and log in, I couldn’t get a new install of the app to connect on my phone, and I couldn’t get access to any of my workout data. Even old data, apparently isn’t on my phone, as I thought. It’s being read from the cloud. That’s disconcerting, though I record my data separately at MapMyRun, so I’m not overly worried. I even found a procedure and tested it for saving my data locally.

    Over the weekend after this happened, I didn’t do much, but as of the Monday after the attack, the Verge reported that some data was visible and sync was working. Not for me, but for someone. That’s good, and Garmin has a touch of information about the outage, saying they expect devices to begin syncing at some point. Mine didn’t that day, but did a day or two later.

    This is interesting as an attack because it’s not just the company’s own internal data, but also their customers’ data. I don’t know if that was the intention, but what better way to put pressure on a company that take away their customers’ data. I don’t know that this would make them respond differently than losing their internal data, but it  likely would be more public. It also might put more pressure on them to pay some ransom.

    Ultimately, this is an area that I think the GDPR started to help, but allowing customers to access copies of their data, as well as have rights over how it is used. I think having the right to not only get a copy of my data, but a regular backup is something I think should be required of organizations that collect information about me. Likely there might need to be a charge, but perhaps some regulation about what is reasonable and how this data should be available is a something else that might need some regulatory boundaries.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Finding Separation During WFH

    Work life isn’t the same for all of us. In fact, as I read through this HN thread, I find that work is more varied than I often consider. I haven’t worked for any of the big tech firms (FAANG or MSFT), but I have worked for companies that had a variety of perks, including food, gyms, childcare, and more. I’ve taken advantage of, and not been interested in, these perks at different times in my life.

    Many of us are working from home (WFH) for the first time in an extended fashion. I’ve been quite fascinated in the differences amongst my co-workers. Most of them love this and are looking forward to the remainder of the year at home. Some don’t like it, and feel trapped. I’ve been WFH for nearly 20 years, but I’ve often been able to change my environment through travel or working in public spaces, which aren’t really a good idea right now, even if possible. So I’m perhaps struggling to cope more than I expected.

    Now that we’re four months in for most of us, I wonder how many people are coping, and maybe more importantly, how are you achieving separation from work in your life? Are you setting work hours or shutting down your work communications? Perhaps you have some other technique?

    I have tended to pop into my office often in the past, most every day, even weekends. The flip side if I often pop out of the office during the week for the gym or to do some personal task. I’ve also started to avoid even going into my office on the weekends, using my laptop if I need to browse the Internet for some knowledge, without opening Slack/Outlook/Twitter/etc. Trying to completely disconnect on the weekends.

    If you are coping, or perhaps not coping, feel free to drop a note in the discussion, give a tip, ask for advice, or just let us know what you like or don’t like about your environment.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Security for 2FA

    I got a new mobile device recently and despite the restore from backup, I still had to perform quite a few setup chores. Reconnecting various apps to services by logging in was time consuming, but simple. A password manager was useful here, since I have different passwords everywhere. I set that application up first and then proceeded from there.

    The only trouble I really had was with Outlook and mail. I have an IMAP provider for one account and Outlook doesn’t make it easy to figure out where to change the settings for this. The second issue was with my corporate mail, which is secured with a 2FA connection through Duo.

    This is a technology that doesn’t use text, but has an application on devices and pushes a notification to them. I get a push when I log onto corporate assets from my PC, and I have to approve a login from my mobile. This prevents sum of the sim hijacking that can occur, where someone might have access to my SMS messages. It also prevents a lazy guy with Google Messages from getting a code on the same device rather than walking to the other room to get my phone an ensure I have it.

    I had to get help from our admins with the new device, despite having the old device connected and able to approve the connection. I had thought this would work, but there was some issue with Duo. On one hand, maybe this is good that it isn’t simple and I can’t quickly approve a new device, in that it prevents someone from stealing my identity on a cloned device. On the other, in an organization of any size, where mobiles might change constantly, this feels like a time sink.

    This might not be an attack vector to be worried about, but I think it’s better to be safer here than we might need. I do think that good security is worth some hassle. I don’t really complain about having to periodically re-authenicate, the requirement for strong passwords, and I love having 2FA enabled on many services. I hope we continue to find more and stronger methods of protecting individual and corporate data, along with more respect for the rights of humans whose data is being captured and used by most organizations. I also hope that we continue to improve the security options in SQL Server, including adding 2FA.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Seeing the World Differently with a Coach

    I ran across an article recently that got me to stop and really think about how I proceed through life and who my coaches, confidants, and mentors are in the world. There are a few people I lean on, and while I don’t get the same advice from them as in this piece, I did find this to be a series of things in this post that made me stop and think.

    Leo Widrich is a coach to CEOs, founders, and executives.  Last year he coached 101 people and wrote about a few takeaways. It is an interesting read, and paints many of these executives with feelings, emotions, insecurities, and other frailties that I have. I suspect many others feel the same way in their lives.

    Each of these items made me think a bit, but perhaps the one that had the most impact on me was to think about non-attachment. I think this might be my biggest struggle, to accept difficult situations, and not lash out or get upset, but let the emotions wash over me, experience them, and then let them go. I struggle to do this without some sort of reaction, or most often, overreaction. I have recognized this a few times as I get older and gotten better at experiencing things without a out sized emotional response, but I still have work to do.

    Maybe the best quote for me was at the top: “… people have heard me say that I think it quite reckless and silly for founders and other executives to go through their life and business world (when you can afford it) without a trusted mentor, coach, advisor or therapist.” I actually think this is something most people need, especially those in stressful situations. I don’t know you need to pay a life coach, though a therapist is often a good idea. A good adviser, someone trusted and with your best interests at heart is invaluable as you go through life. I think I have a couple of them, and I’m glad I do.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.