Voice of the DBA

Category: Editorial

  • Number Security

    There’s a scary item recently in a Database Weekly newsletter. Apparently your credit card number code can be guessed in seconds. Using techniques that spread guesses around to a number of sites, criminals can avoid triggering alarms, which makes some sense. I would hope that banks would find ways to patch this quickly as I’d expect that some central system should be providing authorization. However, since banks haven’t shown much inclination to adopt DevOps and move quickly when required, perhaps I’ll be changing my credit cards every quarter this year instead of just once.

    Perhaps a new card that can change numbers make sense. There is a technology that could change the actual digits on a card. That reminds me of the RSA SecurID VPN cards that I used to carry with a number that changed every minute. The current number was required to log into VPN and you only had a minute to enter it. I had expected this might be required more and more, but it seems relatively few companies implemented the system. I know some companies have moved to software based token systems, and certainly two factor authentication has become more widespread, but not as widely as I’d have hoped.

    However, no matter what is implemented, anything that is widespread, easy to use, and predictable, will likely be cracked. While I could see banks wanting to verify each charge somehow, that might be unwieldy in today’s highly cobbled together, distributed systems. The move to machine learning and more intelligent data mining can help, but when criminals try to make charges that don’t cause simple flags to be raised, what will banks do then? I think we will see more intelligent criminal attacks that avoid machine learning algorithms, especially when there criminals get organized and focus on digital attacks.

    I don’t mean to get caught up in the specifics of credit card numbers. I’d rather think more widely about the issues of data leakage and how information can be extracted from any mechanism that we use to try and secure information. Look at the Dynamic Data Masking (DDM) feature in SQL Server 2016. It’s a great feature in some ways, and as a convenience for developers, this makes sense. However, for determined attackers, there are easy ways around this. Query for a specific value, and SQL Server processes the query, even if the result returned to you is masked, you’ll know the underlying value. There are similar holes in Row Level Security, giving intelligent hackers the ability to determine what data is in your tables.

    I think ultimately some of the ways in which we can protect our individual data come from being able to analyze query patterns. Machine learning and an integration with the Query Store maybe helpful in performing this analysis. If we know what queries we expect from a system, then we can detect anomalous behavior, which may let us know there are attacks being performed. While we might not be able to prevent all information from being disclosed, being aware and limiting future access can be valuable in preventing the impact of a data breach from growing too large.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.6MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • The Salary Range

    We published the results of our 2016 Salary Survey today, which has some interesting numbers in it. I haven’t done a lot of analysis of the data, but it seems as though the averages are higher than I expected for SQL Server professionals. That’s good news, and it’s one of the reasons I switched from being a developer to a DBA. Our DBA back in 1990 made more than every other programmer in a larger Fortune 500 company. Since I enjoyed database work, I moved in that direction and never looked back.

    I also ran across this interesting post on programmer earnings on Quora, and found some of the answers interesting. There are people showing the entry level salaries being high at large tech companies like Google and Facebook. I’m sure that happens, but those salaries often skew what most of us might see when we start in this field. I think non-tech companies that are trying to fit developers in with other entry level jobs (sales, marketing, operational positions in their industry, etc.) don’t view programmers as special. I would guess that the technology pay is better, but still below US$50k/yr in most places.

    While I think in the US there isn’t necessarily a cap around US$100k/yr as there used to be for most of my career, I do think that it’s still hard to make more than this for most people. The average programmer is just that, average. Without being driven to develop strong skills, make a different in their organization (and learn how to do this), and stand out substantially from everyone else, management often doesn’t want to substantially increase their labor cost. They won’t want to pay more for a developer without a good reason.

    All the number are useless if you become a freelance consultant. That’s easy to do in this field, though finding work is a challenge. As is the demands on freelancers outside of the technical work. On your own, you need to manage accounting, sales, marketing, and more, which are not necessarily the work that most people enjoy. In my view, if you become a freelancer, you earn that extra money with the hassles of running your own business (it’s not uncommon for freelancers to easily make over US$100k with successful ones going to US$200-300k/yr).

    Many of us know people that love programming computers, and don’t worry too much about salary. Most of us would like to earn more, for a variety of reasons, but few of us actually work to earn more. There’s a good quote in the article: ” Because some folks never ask for raises and never leave a company. They built up experience, but didn’t leverage it, so their compensation never rises.” I’ve found that to be true. Far too many people never learn how to increase their salary, whether by changing jobs, becoming more valuable, or even just asking for more money in a way that is likely to be successful. We usually just take what’s offered.

    Money isn’t everything. I think that working in technology strictly for money is a bad idea. There are downsides to this work (sedentary, stressful, complex and ever changing), but I also know that many people have enough of a talent to get by and have other interests in life. If that’s the case, and you want a job you can do for most of your life and earn a decent living, this isn’t a bad field. There are plenty of answers from people that recommend you don’t pursue programming if you don’t enjoy it, but I think that it can be hard to find employment in an area you really enjoy and also make ends meet. Certainly if you are starting a career, I recommend you try to find work in an area you enjoy. Build a budget that suits your earnings, and find some satisfaction and enjoyment in your career and life outside of work. Once you have a family or other responsibilities, it can become hard to make a drastic change in your career path and you may find yourself stuck working at a job you don’t enjoy.

    There is one answer that struck me. The final line of that one says: “A bottom tier developer should probably stop being a developer.” This is a place I’d disagree. Almost every industry has no shortage of people that aren’t that talented at their craft. I know poor plumbers, electricians, doctors, lawyers, retail workers, and yes, programmers. Some of them may lose employment regularly and struggle to find jobs. If that’s the case, and it is a problem in your life, then perhaps you should look for other work. However, if you have a job, then why stop? Every team I’ve worked in or managed has a need for a variety of work. Some hard, some mundane. Some easy, some complex, but in all cases, it’s good that we have a spectrum of talents on the team. There is always some work that is better suited to less talented employees, whether they are electricians or programmers. There is also work that can only be done effectively (or efficiently) by the most talented.

    If someone is willing to pay you, and you’re willing to do the work, then that’s the definition of a job you can do. Why stop, especially in this business, if you have employment that suits your situation? There’s nothing wrong with going to a place of employment every day, and doing a day’s work for a day’s pay, even if you don’t do it as well as others.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 7.4MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Technology Guilt

    This editorial was originally published on June 15, 2013. It is being re-run for the New Year holiday.

    I was reading a piece recently about the problems many new college graduates will face as they enter the workforce. There are less and less jobs available in many industries and a large reason for this is the advances in technology that have eliminated many jobs. Technology has made people more efficient, allowing companies to hire less staff. Or at least management thinks less staff is needed. New applications and devices have allowed self service operations for many types of tasks that might have required an employee in the past. This is a trend that is likely to continue.

    Do we just need less people working in the world? I don’t think so. For every job we eliminate, there are new opportunities that come about. Unfortunately the new openings often require different skills from the position eliminated, which means that often the person who lost the job can’t take advantage of the new opening without some re-tooling of their skills.

    Those of us in technology find ourselves moving from place to place, learning new skills and technologies easily because that’s the nature of the business. However in many other fields, it’s not as easy for individuals to gain new skills. This Friday I wanted to ask those in technology if they think about the impact their work has on others.

    Do you feel guilty about the jobs that technology eliminates?

    I used to feel that it was up to everyone to ensure they could find a new job if they lost their current one. It seemed to be a capitalist market idea that change will occur, new industries will arise as old ones die, and everyone ought to be prepared to transition to a new career. However technology seems to hasten the process, and so many people do not seem to be able to make the change quickly to a new field or a new industry.

    Or perhaps they are too slow to embrace the idea of change.

    I feel that technology has made the world better overall, and the tremendous amount of data that we capture, analyze, and use to make decisions allows the world to function better. We have room for improvement, and we certainly have security and privacy concerns, but we do need to find solutions to those problems and prepare for change in the future. We also need to make sure the next generation also understands that they will need to be more flexible and better trained than in the past.

    Steve Jones

  • What Will 2017 Bring?

    What do you think will happen in the database world in 2017?

    That’s a question I want to ask you today, the last work day of 2016. When most of us come back to work next week, a new year starts, though it won’t really mean much to most of us. We’ll continue on with the projects we’ve been working on, managing the same systems and dealing with similar issues to those we face today. Budgets may reset, which could be a good thing if you can find a way to divert some of that money for your own training or pet project use. In general, next week will just be a continuation of the work many of us have been doing.

    If I look forward and try to imagine where 2017 will take us, I envision focus in a few areas, and perhaps a few things that won’t change. As much as I find the progress our industry has made in the last ten years amazing, I also think that year to year we tend to make small changes. It’s rare that a huge advance in computing drives us forward. Usually we can see the technology emerge, gain momentum, and then grow very quickly. That happened with SSDs. The first models were exciting, and expensive, but also prone to failure and burnout. Across a few years, quality improved, prices dropped, and all of a sudden most new machines now use SSDs. In fact, it seems most people working with databases wouldn’t consider purchasing hardware without at least some SSD storage.

    There’s a lot of media attention being paid to Artificial Intelligence and Machine Learning these days, and I think these will grow more rapidly in 2017. As we get more tools that make it easier to build applications that incorporate AI and ML, I envision pressure on many developers to begin incorporating these features into applications. Those that are able to do this effectively will likely help their organizations gain a significant advantage over competitors. The maintenance and evolution of these systems is harder than expected. While our tooling will lower the bar to get started, my suspicion is that most of the applications that get built will not provide the expected results and will get abandoned.

    That brings me to the second area that I think will grow in 2017. Data Science, and the idea of somehow analyzing all the Big Data (from 2015) to gain amazing new insights will be an even bigger focus in 2017. The media attention and hype have so many managers thinking they need more data science. The interest means higher paychecks, which have everyone that passed Introduction to Statistics in university claiming some data science skills to get a larger paycheck. This will snowball in 2017, as more and more people on both sides press the issue.

    The reality is that data science and more complex analysis is hard. It’s much harder than most people realize, requiring lots of knowledge and patience to experiment with data. I’m not sure that most people are willing to make the investment in time and resources that it takes to become a good data scientist. Of course, if it’s like many of the other career paths in technology, even average skills can end up with a successful career.

    Security will continue to be a problem, especially as more and more hackers continue to probe organizations and systems for vulnerabilities and weaknesses. Some do this for profit, some (maybe most) for basic vandalism, but we’ll continue to find SQL Injection, phishing, and other attack vectors to be problems. As we connect more and more systems together, and as there is pressure to build more distributed systems, whether with cloud services or business partners, we will have more and more weak points. I wish I could say that 2017 would be the year that our aging systems will see pressure to improve their security and patch more rapidly, I suspect that far, far too many large organizations will continue to tolerate poorly written systems (from a security standpoint) and allow their developers to deploy code that doesn’t remotely adhere to best coding practices. Perhaps one day…

    In our SQL Server world, I think we’re going to have an interesting year. All signs point to another SQL Server version, one that runs on both Windows and Linux, so we’ll start to have the challenges and excitement of moving databases across platforms. Add in the ability to run inside containers, and I think we’ll see some crazy growth in SQL Server deployments that will stretch the ability of administrators to keep track of how many instances are actually running. I suspect that we’ll see lots of data loss from small instances that are deployed by developers quickly and easily, without a backup plan. I wouldn’t be surprised to see a whole new set of issues when transaction logs grow to fill disks from instances running in containers that never back them up. Maybe we’ll get the simple recovery model as the default for SQL Server 2017? I can hope.

    All in all, I think 2017 is just another new year, but it is the time for you to take stock of your life, decide what you like, what you don’t, and where you want to go. Perhaps you should take another step on your epic life quest, maybe you want to improve your skills, maybe you want to find a new job, or perhaps you have something outside of work that will be important this year. No matter where you are in life, the end of one year and beginning of a new one is a good time to reflect, reminisce, and dream about the future.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 7.5MB) podcast or subscribe to the feed at iTunes and Libsyn.