Voice of the DBA

Category: Editorial

  • Data Clarity

    There was an Associated Press (AP) report recently that noted Google applications track your location, even if you’re turned off Location History on your Android phone. The article has details about what the AP noted, as well as the report from some researchers that were testing the functionality. You can read the details, but the issue doesn’t seem to be as simple as the headline of the report.

    Google has responded to the claims, saying that they document and explain the various settings that need to be changed in the applications themselves to prevent any tracking. That might be the case in the eyes of the engineers that built the functionality, but I would tend to argue that the expectations, the descriptions, and explanations we use as technology professionals might not be clear enough for most users. We ought to be documenting, explaining, and even coding systems for users that aren’t as familiar as we are with the technology.

    This is an interesting issue. Not the location tracking, since I assume Apple, Google, government, and more can track my phone if they really want. To me, the issue is that we have data practices that are not clear to the end user. What Google documents, what they do with new services and features, and what the clients expect are not necessarily the same. That’s an issue, and I suspect it’s a similar issue for many companies.

    Most of us collect some level of detail from our software on how the user interacts with it. This might be a local log, or it might be some sort of telemetry, similar to what Microsoft collects from SQL Server. In either case, I think it’s important to spell out what data is being collected and to what extent this data is related to a specific individual or company. The changes to data handling as a result of the GDPR and other legislation might require that we do a better job of disclosing any data we collect, and in which specific circumstances.

    I know that data matters, but I also think that lots of the information that is collected doesn’t need to be related to a specific individual. Aggregates or tokenized data is often enough, though if you need to track a particular individual over time, such as the features they use in their install, be sure that you are very careful with any sensitive data, such as names, locations, etc. Most of us don’t have Google’s resources to combat legal action if customers find we are infringing on their privacy.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.6MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Protecting Our Stream of Data

    Protecting the data our companies collect is important. Many of us go to great lengths to secure our databases, firewall connections, limit access, and more. However, we can’t secure the data before it gets to us, and that can be a problem. I ran across a link on Bruce Schneier’s blog that shows a criminal placing a skimmer on a credit card scanner in a convenience store. The original video is gone, but there are plenty more.

    In general, the loss of data from the application (and physical hardware in this case), isn’t really a database issue. After all, the data is essentially split into two streams, with some going to the legitimate database and other processes while another stream goes to the skimmer. If this happens, and the skimmer isn’t discovered, however, it’s entirely possible that any data loss might be blamed on the database or IT infrastructure.

    If someone suspected you were hacked because of data being lost, could you prove you weren’t hacked? Or that the data didn’t come from your database? This is impossible, since you can’t prove a negative, but would you have any evidence that could be used to bolster your claims? Is there auditing or other tracking of activity? Does your organization keep any logs that would show a lack of activity and are protected against tampering? Ideally you would find the source that lost the data, but if you can’t, it can be difficult to prove that the losses didn’t come from your systems.

    For most of us, we might not have much in the way that would show our systems have only had legitimate access. Instead we’d depend on the limited SQL Server logging, as well as other infrastructure tracking, such as firewall activity logs. The strength of our presentation would likely determine whether security staff or management accepted our claims as valid.

    Point of Sale systems are different than the applications that most of us use, but certainly we have database security concerns that we should address. I would hope that SQL Server would bolster its capabilities in this area, providing a way to set up a tamper proof log easily that accepts writes of activity from a database in some structured text file that uses minimal resources. I’m not even sure what I’d want here that I can’t get from XE, but I do think having something more robust and standardized would be nice. If nothing else, a local SQL Server could stream XE events out to a file target in a remote location that only supports writing. This wouldn’t necessarily prove anything if the connection were disrupted, but it would ensure that a business was aware of the breakdown between the instance and audit log.

    I know the ways in which people attempt to access and steal data will continue to evolve and become more complex and creative. We can’t protect against many of them from the database side, but I’d like to think that we could protect the data we have. We should ensure it is safe from theft, loss, or inappropriate access and prove we have done so.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.2MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Limiting the Ability to Concentrate and Collaborate

    I used to have an office. I guess I have an office now, but it’s not mine; it’s shared with my wife. As I look back at my career, I realize that I’ve often taken a job that switched me from a more open working environment to an office, and back. Early in my career, we had cubes, which a few of us combined into an open 4 desk space at one point. Then I took a job with an office, then back to an open plan (10 developers in a room), then my own office, before ending up with my shared office. Actually, I’m always sharing a space. When I travel to the Redgate offices, they have an open plan, so I get a desk that’s open to a few dozen other people.

    I’ve gone back and forth on whether or not I want a shared space. I’ve come to the conclusion that it really depends on my job. When I worked as a sysadmin, where we were constantly collaborating with others, an open, shared space worked well. We could easily talk to each other, which was an efficient way to work.

    When I’ve worked as a developer or a manager, I’ve preferred having my own office. The ability to concentrate for longer periods of time is helpful for me, and while headphones separate me, they aren’t as private, as there can still be visual distractions as people move around. I’ve had people come up to tap me on the shoulder, which can ruin my concentration at times.

    There’s an article at Ars Technica that talks about a study showing that open plans result in much less productivity and even less interaction. That seems counterintuitive, as I’d expect an open plan to encourage more interaction. Indeed, when I’m at the Redgate office, I find that someone will often turn and chat with a friend. Or if two people are talking, it can become a watercooler atmosphere where others join in. There seem to be plenty of interaction.

    When I’ve been at Microsoft, where everyone has a small office and most with a window to the hallway, I find lots of open and closed doors, with the former inviting others in and the latter discouraging it. I do see plenty of workers get distracted if someone stops and looks in the window. At the same time, I also find there are lots of open spaces where people can engage with others and even work in an open space if they desire.

    I don’t know if one way is better or worse than the other. I know that I feel differently at different times about how I work. At Redgate, we do have some pods for private work if you choose, but they aren’t completely closed off. They’re more like a cube or a small space for one person. I do find that having a private space is important for me at times, and if I were to go back to a company’s location on a regular basis, I’d want to ensure I had some sort of private office, even if it were only for a portion of a week and others used it when I wasn’t there.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 5.1MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Fun at Work

    I am lucky in that I get to travel and speak at a number of events every year. As a result, I meet lots of people in a variety of situations. Many of these places have a social component and often result in pictures. I love that because pictures are memories for me, and I look back at them to reminisce about good times in life.  I greatly appreciate having Facebook remind me of images from the past, some of which I’ll share back out as they’re great memories for others in my family.

    This has changed dramatically in the last decade, as everyone seems to have a camera on them at all times in their phone. That means many more memories I can capture. Some of these are silly, and I wrote a blog with some of the funny ones I’ve gotten over the years. In the past, I have relatively few pictures from work. Early in my career, film cameras were rare. We only carried them around for special events, which wasn’t often at work. I do have actual physical pictures of a few work parties, but rarely of workspaces and situations. There are certainly some I wish I’d been able to capture and save.

    For many of you, I’m sure that’s different now. Some of you have grown up with cameras and spent most of your career with them. When I asked about desks, quite a few of you posted pictures, with some really interesting items. Those are likely going to be fun memories for you at some point in the future.

    Today I’m wondering if you have some funny, silly, even head shake photos of yourself or work. Nothing that will get anyone in trouble or be offensive, but maybe you’ve run across a sign on a wall, some wild cabling, or even a snapshot of you and others celebrating some accomplishment. If you can share them. Check out the fun pics on my blog over the years that make me smile, and if any of you have old pictures of me, please post or send them along.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.1MB) podcast or subscribe to the feed at iTunes and Libsyn.