Voice of the DBA

Category: Editorial

  • The Dangers of Travel

    I cross a lot of borders, and I have been worried at times about losing my electronic devices. There hasn’t even been an issue, but then again, I don’t really have anything of value other than the hardware. The bits themselves are fairly replaceable for me as I ensure I keep things backed up in multiple ways.

    However, I wonder if this will start to become a new type of data breach. Will officials of governments be required to relinquish their devices when proceeding through customs? Will this happen to corporate employees? Something like this happened and it was unclear if this was an action on the part of the Department of Homeland Security in relation to an investigation. However, could this start to become a standard practice as a way for governments to spy on other governments or even corporations?

    This definitely sounds like a movie plot more than something that occurs in real life I would guess this is what we’ll find to be true here. It’s also not likely to be that effective if it does become a standard practice. If devices were being confiscated and checked at any scale, I’m sure we’d all be looking to travel with blank laptops that only had a VPN connection. Once we crossed a border, we could easily access information and download it as needed, deleting it before we recross the border.

    However carrying information on a mobile device is always a bit risky. You could lose a device by accident or theft, and anything you had on the hardware could be exposed to others. For most of us, it’s not a problem, but since some of us carry around database backups or developemnt data, we should be sure that we aren’t carrying sensitive information. There’s really no excuse to do so, no matter what your deadline. Use masked sets of test data that you don’t mind losing, and you won’t have an issue.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.1MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • An Out of Date CAP

    I was reading this piece from Martin Kleppmann asking us to stop using the CAP theorem to talk about distributed systems. It’s of interest to me because we often see this applied to databases, and it seems I’ve seen database platforms described as fitting along one of the sides of the CAP triangle.

    However the complaint is good, although tough, reading. As I read through it, a number of the concepts and tradeoffs, and concerns are similar to what I see discussed in Azure systems, or any “cloud-like” distributed systems. We expect consistency and availability, as well as scaling through partitions. However, it seems that we are always trading consistency (what Keppmann notes is really linearizability) and availability in the data world. We simply can’t guarantee both of these things in a data world.

    Or can we? At some point, perfection isn’t required, and we can tolerate some level of inconsistency in the results clients might receive. I’m sure many of you have dealt with this in the past, and perhaps even gone so far as to add the report execution time to outputs to reduce client complaints. If two sets of data are compiled at different times, most clients tend to understand some discrepancies.

    Certainly many of us are starting to consider using database platforms that might not work like SQL Server. In those cases, availability and scale is often touted as the reason to abandon a RDBMS. On one hand, the lack of linearizability across nodes is often tolerable, and many of our businesses aren’t affected dramatically by them. On the other hand, if you can tolerate some delays in nodes, than perhaps SQL Server can work for you with multiple nodes in a replicated or AlwaysOn scenario.

    Distributed systems are hard, and certainly your decision shouldn’t be a simple one when it comes to choosing an architecture. However it also helps to think deeply about the problem in terms of not only the CAP theorem, but also the in terms of practical measures such as latency and practical failures.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.6MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Serious Hacking

    There’s a piece that calls the US Office of Personal Management (OPM) data breach the biggest government hack ever. It might be, but give us a few months and I’m sure something will be bigger. After all, we constantly acquire more data, so the next breech is likely to contain more information. I’m also not sure most of us are actually getting much better at security.

    There were a few notes about this that would apply to every company I’ve worked in. Such as the OPM not having a comprehensive list of devices and databases. I’m not sure any company does, and having worked with people that run SCOM-type systems, it’s a hard problem to solve. This doesn’t even cover the problems of Excel. Access, and soon, PowerBI data being scattered across systems.

    However there was one problem I think we could fundamentally improve in most companies. The article noted that OPM didn’t have control over how it’s systems were configured, meaning an attacker could reconfigure things. Far, far too many companies allow a (too) large group of people to deploy changes to servers. Even when larger companies limit rights for developers, I’ve too often seen operations staff log in and allow developers to change systems to get them working.

    As an industry, we really need to solidify and build better systems for ensuring the security of our hardware and software and preventing, or detecting, unauthorized changes. Certainly there will always be social engineering and other techniques that bypass security, but we should be able to prevent malicious changes to systems with solid architectures from our vendors/FOSS developers. We should also decide upon, and be sure, that our staff learn, understand, and follow, best practices.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Bad Management

    Many people know that a good manager can make a huge difference in the productivity of a staff. A bad manager can also lower productivity, but only to an extent. Fear of losing a job, or avoiding punishment can motivate plenty of staff to get work done, even when you have a poor, or even absent, manager.

    Some companies don’t value strong management skills much, some do. I think most of us would prefer to work for a company that does, but we don’t always get the choice. That’s one reason why I do promote the idea of branding yourself and ensuring you have other options for employment. The more options you have, and the more demand there is for your staff’s services, the more likely that your company will make an effort to work with, rather than lord over, their employees.

    For those of you that are managers, or those that might want to help their manager build some skills, I ran across an interesting story from David Haney on his experiences as a manager at StackOverflow. It’s a good set of principles that I tried to keep in mind as I managed people in the past. For those managers that might not know why their staff leaves, there’s a good warning that good IT staff are in short supply, and companies should make an effort to retain them in various ways.

    For many of us in the IT sector, we can provide a strategic advantage for our businesses as we enhance and extend software. Many of us are important insurance that keep systems running, hopefully at a peak level. Bad management can impact the effectiveness of our technology organizations, and it’s silly to accept bad managers. This is something that can be fixed with some training and accountability for the manager, with a little effort. Make a few suggestions, or try to show how a better manager (or style) might help you get more done.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.6MB) podcast or subscribe to the feed at iTunes and LibSyn.