Voice of the DBA

Category: Editorial

  • A SQL Server Bug and Data Security

    This week I saw a post from Microsoft Tiger Team on the issues with backup compression and TDE databases. Apparently when they added compression, they didn’t test a few edge cases. Or a few regular cases, like WITH INIT. There is a possibility that your data could be corrupted, which is a major problem. I have found the SQL Server backup and restore capabilities to be very solid over the years, so this is disturbing. If you use TDE, apply SQL 2016 CU7 for RTM or SP1 CU4 ASAP. Test your restores, and be sure you know what you can recover and what you can’t. If Mr. Murphy has anything to say about it, you’ll have an issue soon, so test your restores.

    Overall, SQL Server security is very good, but there are certainly issues with applications and devices that connect to SQL Server. You never know when some item that queries or alters data in SQL Server will cause issues. This week there were a couple notes from Bruce Schneier on FaceID and Bluetooth security, the latter of which has a vulnerability issue. Be sure you are aware of issues here to actually help protect yourself with your devices, but I was amazed to see this piece on infrared camera hacking. A POC on using light to jump air gaps is truly frightening. It seems that truly anywhere that we are processing data, we need to be thinking about security.

    The last few weeks are especially scary for many people, particularly with the Equifax breach. I know they have released numbers on people’s data, but I’d assume that everyone who has ever had credit in the US has a potential issue. I know I am being careful with credit and watching for issues myself. You should, too, and demand better security from companies you do business with. We can improve systems, but it will take more pressure to get companies to put more emphasis on better software and security.

    Steve Jones

  • The Flash DBA

    The job as a DBA is the job. That’s been my view for a long time, which is why I am always concerned about the staff when I interview. The people I work with make the job good or bad. I can always handle the job, which is often very similar in many organizations. I might do more tuning in one place, or more infrastructure management in another, write more reports than the last gig, but the skills and techniques are very similar in many positions.

    I have also found at some, maybe many, companies there isn’t always a full time need for a DBA, or architect, modeler, etc. Instead, there are periodic ongoing needs for those skills. At one position, I was negotiating a deal to only be employed 3 days a week, planning on spending the other two at another company consulting. I was about ready to implement my plan when the first company lost funding and went out of business. Since then, most companies haven’t entertained the idea, even when there wasn’t necessarily a full time need for a DBA position.

    I thought back to that job when I read this piece on flash organizations, where the idea is to bring people together for a project or (relatively) short period of time to do some work. I have seen similar project teams in larger organizations, but those teams are limited to the talent within the company. A Flash team would bring contractors together for a project, perhaps with employees. Certainly consultants or contractors are sometimes used today, but they often aren’t seen as part of the “team”, or at least, they aren’t treated that way. That disparate treatment often means that there aren’t necessarily shared goals or the same focus among everyone in the team.

    If you’d asked me to consider flash teams a decade ago, I wouldn’t have thought that we had the management maturity to accept outside help for many types of work. However, the advent of cloud services (and more adoption than I would have thought), along with the use of pull requests and agile development services have me wondering if this might not be the type of things we see more often, especially for software. I could even see this for specialized skills, such as data science and ML model training.

    I do think that this type of work is harder for data professionals to walk into, since intimate knowledge of the meaning of data fields and their relationships is important. Coming up to speed on the way a business uses data can be easy when you start,but there are often edge cases and the complex ways in which business people often use data takes more time. I would expect time spent as a flash data professional would be front loaded in trying to gain an understanding of the environment. However, perhaps that would mean that there would be better documentation for future projects. Maybe even an ER diagram or two that actually matched the database system.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.1MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • A SQL Server Bug and Data Security

    This week I saw a post from Microsoft Tiger Team on the issues with backup compression and TDE databases. Apparently when they added compression, they didn’t test a few edge cases. Or a few regular cases, like WITH INIT. There is a possibility that your data could be corrupted, which is a major problem. I have found the SQL Server backup and restore capabilities to be very solid over the years, so this is disturbing. If you use TDE, apply SQL 2016 CU7 for RTM or SP1 CU4 ASAP. Test your restores, and be sure you know what you can recover and what you can’t. If Mr. Murphy has anything to say about it, you’ll have an issue soon, so test your restores.
    Overall, SQL Server security is very good, but there are certainly issues with applications and devices that connect to SQL Server. You never know when some item that queries or alters data in SQL Server will cause issues. This week there were a couple notes from Bruce Schneier on FaceID and Bluetooth security, the latter of which has a vulnerability issue. Be sure you are aware of issues here to actually help protect yourself with your devices, but I was amazed to see this piece on infrared camera hacking. A POC on using light to jump air gaps is truly frightening. It seems that truly anywhere that we are processing data, we need to be thinking about security.
    The last few weeks are especially scary for many people, particularly with the Equifax breach. I know they have released numbers on people’s data, but I’d assume that everyone who has ever had credit in the US has a potential issue. I know I am being careful with credit and watching for issues myself. You should, too, and demand better security from companies you do business with. We can improve systems, but it will take more pressure to get companies to put more emphasis on better software and security.
    Steve Jones

  • Help from Cortana

    I’ve been reading about and watching some of the experiments that people are conducting with Cortana and other types of devices. I’m not quite sure what I think, though I would like to experiment with Cortana at some point and see how useful a computer assistant might be. I have tried to make notes of ideas that I think could be helpful, but for some reason I haven’t really gotten the speech bug. I don’t talk to my computer or phone very often, with the exception being texting with my family while driving. In that case, speech is handy and much safer than anything else. My wife is the opposite; she really likes speech.

    It seems many companies have been working to implement more assistant-like interactions with users. Amazon has the Echo and Dot devices with Alexa, Google has the Home speaker, and I’m sure more and more devices are coming over time. I don’t know how useful these are in multi-person situations where people are speaking, but it does seem that some people like the help from devices. Perhaps I’m too much of a DYI person, since I prefer to push buttons and make my own selections. However, it seems some people prefer to talk, even in busy, loud, crowded situations.

    Many of us are data professionals, and even if we aren’t planning on using speech, there is the possibility that bots or other technologies might help us improve the way we work with databases or help our customers use the information we manage. I’ve seen some interesting interactions with Slack, including one company that allows limited developer access to systems through a Slack bot that handles some provisioning work, including raising and closing a ticket, without requiring human interactions.

    I could even see some sort of alerting or “check this soon” interactions that might alert developers or administrators to take actions in a more casual way, perhaps doing so as part of a conversational queue of things to check rather than a list of items in a tool or a stack of email messages. An interactive assistant can be useful not only in providing information, but managing the flow to prevent overload. A personalized assistant might even do a better job or reminding you of items over time, perhaps anticipating future needs, or realizing some task hasn’t been completed in some time. Certainly the same type of bot or agent might perform work on your behalf.

    This week, I’m wondering how many of you might find ways that a narrow, niche assistant might help you. Is there something in your work that an assistant might help you do? Or maybe there’s some way that a device might help you in your life, separately from a simple notification on your mobile or through email. Perhaps in conversation or in a semi-structured fashion. I’m sure many of you have a creative way that you might like to see technology assist you.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.5MB) podcast or subscribe to the feed at iTunes and Libsyn.