Voice of the DBA

Category: Editorial

  • How Much AI Do We Need?

    I like to cook and bake. The act of putting something together relaxes me, and I’ve certainly had plenty of time in 2020 to do this. In fact, I’ve been doing so much that my wife and daughter ordered me a new stand mixer while I was making them cookies this past weekend. They thought it would make it easier for me to continue to prepare more meals when life returns to some sort of normalcy.

    I’m not a chef, and I certainly struggle through some recipes, but I enjoy the time working through the act of assembling something. I also struggle with fitting in the time to prepare things around an otherwise busy life. When I saw this article on smart appliances, I stopped to think that some of these might be nice, but perhaps they’re also reduce some of the skills I’ve built and perhaps make my time in the kitchen less enjoyable. Would I become dependent on them, entitled, or even less excited about the task of cooking?

    It’s something I hadn’t considered too often, especially in other areas where AI and “smart” items are becoming more commonplace. I think some of advances in the data platform are good, and certainly some of the cloud services handle tasks that are fairly simple and they do them well. Backups happening in many of the PaaS services are mostly something we don’t need to configure or worry about, though we ought to be sure we know how to actually perform a restore. I have high hopes for some of the index automation and other changes, though there is a ways to go.

    Is the use of more AI in systems better? In some sense I think this can help us cope with busier and more complex lives, and allow us time to focus on the things we want to focus on. At the same time, I suspect these systems aren’t as mature as the marketing suggests, and the options certainly command a premium, which is something that might benefit the vendor more than the consumer.

    Like any advance, this could be helpful or hurtful for any of us. I like to assemble things from scratch more often than not, and I’m not sure if I think the AI gadgetry is something I’d enjoy. For now, I’m taking a small step, with a little mechanical assistance that might let me less time on the physical activity of combining things and more time planning my next steps or chatting with the audience that is often sitting at the counter.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • The Conferences of the Future

    I’ve been fortunate enough to attend many technical conferences during my career. I’ve gotten to many Microsoft shows, most of the PASS Summits, and been lucky enough to go to my favorite, SQL Bits, quite a few times. I look forward to SQL Saturdays every year in locations all around the world, and I get to help plan and present at Redgate’s SQL in the City shows.

    Microsoft has rebooted their conference strategy in light of the Covid-19 pandemic, with no plans to have a live event before July 2021. That’s amazing for a company that hosts the large Ignite, Build, and Inspire events, as well as many other events. I saw recently that Agile+DevOps event has gone virtual as well, with reduced costs. I imagine Microsoft will follow suit as well. SQL Bits moved their event to September, and PASS has announced the Summit will go on, but I wonder if either of these will be live events.

    I recently got a note from a SQL Saturday that had initially cancelled, informing me that the event had gone virtual and I could still present. While I’m happy to do so, what’s the difference between SQL Saturday Denver and SQL Saturday Oslo if they go virtual this fall? Not much, in my opinion, though I do hope anyone holding a “local” event gives priority to local speakers. I’m happy to present, but I shouldn’t get more engagements at events when there are others that would like opportunities.

    More virtual events are good in one sense: more people get access to presentations that they wouldn’t otherwise be able to attend. We also dramatically increase the equality of access to learning, inspiration, and the other value that speakers deliver to audiences. At the same time, there are plenty of downsides. Organizers may struggle to fund their events because nothing is free and the value of a virtual event is less, sponsors and vendors will see less value.

    Many speakers may struggle to get exposure and speaking slots. If you can choose Paul Randal, Denny Cherry, Andy Leonard, and Brent Ozar to present at your event, would you pick me? Or many of the other speakers that submit to SQL Saturdays? Maybe, maybe not, but there is a tendency to stick with the best if you can get them.

    Maybe the biggest losses in my mind are the lack of networking and the inability to focus. I went through the Microsoft MVP Summit from home, with 3.5 days of sessions all day. I struggled to stay focused, I was distracted by not being in a room with less of my life around, and I still had other things on my mind. It was hard, and I got less from it than an in person event. How many people will get a ticket to a virtual event from their boss and not have to come into the office? How many are willing to sit in front of a screen for hours at a time? It’s hard, and I don’t know if it’s the most sustainable model.

    Maybe in-person conferences are an anachronistic way of gathering together a group of people for an event. Maybe the virtual event is better, and I do think it is for some. It’s also worse for some. Personally I hope live events make a comeback in the future, but I’m curious what the rest of you think. Let me know today.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Hiding Data Isn’t Always Easy

    There is an article about redacting data in a report done poorly. A consulting firm hired by Frontier Communications wrote a report and redacted lots of information. However, they apparently didn’t do a good job as all the information they blacked out could be read if the data were copy and pasted elsewhere. Something that’s much easier in digital reports than analog ones.

    This was a PDF document, and I checked it. On page 25, there is this sentence: ” Annual capital expenditures for Frontier’s West Virginia local exchange carrier companies have averaged over XXXXXXXX for the past nine years.” The XXX is blacked out, but pasting it into a document shows this is a $70mm amount. It pays to know your tools.

    This certainly isn’t a good technique for hiding information, but it’s not far off from what some people do when trying to mask or obfuscate sensitive production data in development environments. There are lots of cases where people use scripts that change data in one table, but not related data. Or that the changes are incomplete and don’t do a good job of ensuring there isn’t sensitive data leakage.

    To be fair, this is a hard problem, and there are no perfect solutions. Anyone masking data likely needs to take a few passes at the problem, making adjustments over time to try and ensure that the data is protected from unauthorized disclosure. There also isn’t a perfect solution, as many researchers have found ways to reconstruct the original data after it’s been anonymized.

    This is an area that I think is still somewhat immature, with relatively few best practices available for anyone to look at. While I have seen some guidance, I don’t see much on how one could verify they had done a good job. I hope we find ways to do better in the future, with more knowledge that helps data professionals ensure they are doing a good job. Otherwise, we won’t be able to protect data the way we want to protect it.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • BYOD Fingerprint Concerns

    Many modern devices, whether mobile phones, tablets, or laptops, contain fingerprint readers. We’ve had readers for a long time, but they were very expensive and not widely deployed. That changed with mobile phones and now many devices include fingerprint readers as standard equipment. So much so that this seems to be a very common way of authenticating access on lots of devices.

    This isn’t necessarily a very secure way of protecting data. An ArsTechnica article notes that fake fingerprints were able to access these devices 80% of the time. That’s a success rate that might worry a lot of security personnel. Most organizations allow some sort of BYOD device, including many financial, medical, and other organizations that deal with sensitive data. Since control of a device often includes saved credentials and the ability to approve 2FA implementations, this could be an issue.

    Certainly nation states might try to take advantage of this to gain control of a device and access data from other governments, but I’m sure corporate espionage is in play here as well. I wouldn’t be surprised if this also becomes a technique for pranksters and jokers. Imagine you can bypass the fingerprint on a colleague’s phone. Maybe you want to change their wallpaper. Maybe you want to send an embarrassing email to friends. Maybe you want to add a backdoor to some code using their GitHub credentials. You could do anything from an innocuous joke to a malicious career threatening action. Imagine you choose to do this while your colleague is at lunch, with their phone forgotten on their desk.

    No security is perfect. Many of us that work with someone often might be able to guess a PIN or pattern on a device if we see it often enough. We certainly could easily put a keylogger on a wired keyboard at someone’s desk. There are plenty of vulnerabilities, and in this age of being highly connected through our devices, there are potential issues with all access. There’s no perfect solution, but we should be diligent with physical control of our devices and react swiftly if we think one might be stolen. Remote disable and a good backup might be top of my list.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.