Voice of the DBA

Category: Editorial

  • Your 2017 Goals

    Last week I wrote some predictions for 2017, and plenty of you added your own thoughts. Overall, security is a concern for most people, with little hope things will improve. I certainly hope they do, but like most of you, I think expediency and profit will overwhelm any chance that organizations will make patching their systems a priority, much less improving their data security.

    As the new year came and went, I ran across a great post from Buck Woody that’s a few years old. Inthe post, Buck notes that he likes to make goals in the new year with his family, not resolutions. That sounds like semantics, but I agree with Buck. There is power in making goals instead of open ended changes. Goals can help drive you, especially if they’re measurable and time boxed. Having someone else keep you accountable also helps.

    This week, as we start a new year of our careers, I wanted to ask you what goals you might have. List a few and think about asking a friend, spouse, parent, child, someone else to help hold you accountable and check on your progress each month. If you have just a few goals, chances are that you will achieve some of them. Don’t forget, you can always add a few more later in the year if you finish everything.

    Perhaps you want to learn something about a new technology. If that’s the case, make a specific goal. Don’t try to “learn Azure”, but instead think about “building a database to track my own movie reviews in Azure and use it for a year.” If you want to get better at a specific technology, like T-SQL, then think about challenging yourself with a specific set of problems, like the T-SQL challenge. Or complete something like the Advent of Code in T-SQL.

    Set aside some time to improve your career and take a step forward. Data professionals working with SQL Server have no shortage of new features, subsystems, and solutions to practice with as our platform grows wide and deeper each year.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.5MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Number Security

    There’s a scary item recently in a Database Weekly newsletter. Apparently your credit card number code can be guessed in seconds. Using techniques that spread guesses around to a number of sites, criminals can avoid triggering alarms, which makes some sense. I would hope that banks would find ways to patch this quickly as I’d expect that some central system should be providing authorization. However, since banks haven’t shown much inclination to adopt DevOps and move quickly when required, perhaps I’ll be changing my credit cards every quarter this year instead of just once.

    Perhaps a new card that can change numbers make sense. There is a technology that could change the actual digits on a card. That reminds me of the RSA SecurID VPN cards that I used to carry with a number that changed every minute. The current number was required to log into VPN and you only had a minute to enter it. I had expected this might be required more and more, but it seems relatively few companies implemented the system. I know some companies have moved to software based token systems, and certainly two factor authentication has become more widespread, but not as widely as I’d have hoped.

    However, no matter what is implemented, anything that is widespread, easy to use, and predictable, will likely be cracked. While I could see banks wanting to verify each charge somehow, that might be unwieldy in today’s highly cobbled together, distributed systems. The move to machine learning and more intelligent data mining can help, but when criminals try to make charges that don’t cause simple flags to be raised, what will banks do then? I think we will see more intelligent criminal attacks that avoid machine learning algorithms, especially when there criminals get organized and focus on digital attacks.

    I don’t mean to get caught up in the specifics of credit card numbers. I’d rather think more widely about the issues of data leakage and how information can be extracted from any mechanism that we use to try and secure information. Look at the Dynamic Data Masking (DDM) feature in SQL Server 2016. It’s a great feature in some ways, and as a convenience for developers, this makes sense. However, for determined attackers, there are easy ways around this. Query for a specific value, and SQL Server processes the query, even if the result returned to you is masked, you’ll know the underlying value. There are similar holes in Row Level Security, giving intelligent hackers the ability to determine what data is in your tables.

    I think ultimately some of the ways in which we can protect our individual data come from being able to analyze query patterns. Machine learning and an integration with the Query Store maybe helpful in performing this analysis. If we know what queries we expect from a system, then we can detect anomalous behavior, which may let us know there are attacks being performed. While we might not be able to prevent all information from being disclosed, being aware and limiting future access can be valuable in preventing the impact of a data breach from growing too large.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.6MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • The Salary Range

    We published the results of our 2016 Salary Survey today, which has some interesting numbers in it. I haven’t done a lot of analysis of the data, but it seems as though the averages are higher than I expected for SQL Server professionals. That’s good news, and it’s one of the reasons I switched from being a developer to a DBA. Our DBA back in 1990 made more than every other programmer in a larger Fortune 500 company. Since I enjoyed database work, I moved in that direction and never looked back.

    I also ran across this interesting post on programmer earnings on Quora, and found some of the answers interesting. There are people showing the entry level salaries being high at large tech companies like Google and Facebook. I’m sure that happens, but those salaries often skew what most of us might see when we start in this field. I think non-tech companies that are trying to fit developers in with other entry level jobs (sales, marketing, operational positions in their industry, etc.) don’t view programmers as special. I would guess that the technology pay is better, but still below US$50k/yr in most places.

    While I think in the US there isn’t necessarily a cap around US$100k/yr as there used to be for most of my career, I do think that it’s still hard to make more than this for most people. The average programmer is just that, average. Without being driven to develop strong skills, make a different in their organization (and learn how to do this), and stand out substantially from everyone else, management often doesn’t want to substantially increase their labor cost. They won’t want to pay more for a developer without a good reason.

    All the number are useless if you become a freelance consultant. That’s easy to do in this field, though finding work is a challenge. As is the demands on freelancers outside of the technical work. On your own, you need to manage accounting, sales, marketing, and more, which are not necessarily the work that most people enjoy. In my view, if you become a freelancer, you earn that extra money with the hassles of running your own business (it’s not uncommon for freelancers to easily make over US$100k with successful ones going to US$200-300k/yr).

    Many of us know people that love programming computers, and don’t worry too much about salary. Most of us would like to earn more, for a variety of reasons, but few of us actually work to earn more. There’s a good quote in the article: ” Because some folks never ask for raises and never leave a company. They built up experience, but didn’t leverage it, so their compensation never rises.” I’ve found that to be true. Far too many people never learn how to increase their salary, whether by changing jobs, becoming more valuable, or even just asking for more money in a way that is likely to be successful. We usually just take what’s offered.

    Money isn’t everything. I think that working in technology strictly for money is a bad idea. There are downsides to this work (sedentary, stressful, complex and ever changing), but I also know that many people have enough of a talent to get by and have other interests in life. If that’s the case, and you want a job you can do for most of your life and earn a decent living, this isn’t a bad field. There are plenty of answers from people that recommend you don’t pursue programming if you don’t enjoy it, but I think that it can be hard to find employment in an area you really enjoy and also make ends meet. Certainly if you are starting a career, I recommend you try to find work in an area you enjoy. Build a budget that suits your earnings, and find some satisfaction and enjoyment in your career and life outside of work. Once you have a family or other responsibilities, it can become hard to make a drastic change in your career path and you may find yourself stuck working at a job you don’t enjoy.

    There is one answer that struck me. The final line of that one says: “A bottom tier developer should probably stop being a developer.” This is a place I’d disagree. Almost every industry has no shortage of people that aren’t that talented at their craft. I know poor plumbers, electricians, doctors, lawyers, retail workers, and yes, programmers. Some of them may lose employment regularly and struggle to find jobs. If that’s the case, and it is a problem in your life, then perhaps you should look for other work. However, if you have a job, then why stop? Every team I’ve worked in or managed has a need for a variety of work. Some hard, some mundane. Some easy, some complex, but in all cases, it’s good that we have a spectrum of talents on the team. There is always some work that is better suited to less talented employees, whether they are electricians or programmers. There is also work that can only be done effectively (or efficiently) by the most talented.

    If someone is willing to pay you, and you’re willing to do the work, then that’s the definition of a job you can do. Why stop, especially in this business, if you have employment that suits your situation? There’s nothing wrong with going to a place of employment every day, and doing a day’s work for a day’s pay, even if you don’t do it as well as others.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 7.4MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Technology Guilt

    This editorial was originally published on June 15, 2013. It is being re-run for the New Year holiday.

    I was reading a piece recently about the problems many new college graduates will face as they enter the workforce. There are less and less jobs available in many industries and a large reason for this is the advances in technology that have eliminated many jobs. Technology has made people more efficient, allowing companies to hire less staff. Or at least management thinks less staff is needed. New applications and devices have allowed self service operations for many types of tasks that might have required an employee in the past. This is a trend that is likely to continue.

    Do we just need less people working in the world? I don’t think so. For every job we eliminate, there are new opportunities that come about. Unfortunately the new openings often require different skills from the position eliminated, which means that often the person who lost the job can’t take advantage of the new opening without some re-tooling of their skills.

    Those of us in technology find ourselves moving from place to place, learning new skills and technologies easily because that’s the nature of the business. However in many other fields, it’s not as easy for individuals to gain new skills. This Friday I wanted to ask those in technology if they think about the impact their work has on others.

    Do you feel guilty about the jobs that technology eliminates?

    I used to feel that it was up to everyone to ensure they could find a new job if they lost their current one. It seemed to be a capitalist market idea that change will occur, new industries will arise as old ones die, and everyone ought to be prepared to transition to a new career. However technology seems to hasten the process, and so many people do not seem to be able to make the change quickly to a new field or a new industry.

    Or perhaps they are too slow to embrace the idea of change.

    I feel that technology has made the world better overall, and the tremendous amount of data that we capture, analyze, and use to make decisions allows the world to function better. We have room for improvement, and we certainly have security and privacy concerns, but we do need to find solutions to those problems and prepare for change in the future. We also need to make sure the next generation also understands that they will need to be more flexible and better trained than in the past.

    Steve Jones