Voice of the DBA

Category: Editorial

  • It’s Not Just Poor Coding

    We hear regularly about SQL injection continuing to be a problem (it is) and malware causing data loss for many companies. We’ve got misconfigured firewalls and backup tapes being lost. However even if we could solve all those issues, we’d still have security issues.

    A new study shows that many workers share a tremendous number of files with coworkers, and potentially friends on a regular basis through the various cloud services. I don’t worry so much about cloud service providers being hacked themselves, or their employees selling information. It could happen, and probably does, but it’s also likely just isolated incidents that have limited impact. However I’m more worried about the poor security practices of the employees.

    Many people tend to use the same passwords on different sites (a bad practice). They also often open attachments from “friends”, unaware of how dangerous it can be to pass along and share documents that can embed malware. Malicious coders are becoming smarter, learning to make their actions more subtle, often only infecting a device to use it to send emails or files to other users who are the real target of the malware. With all of these issues, it’s much more likely that a user will end up creating their own hack for malicious servers than targeted attacks will work. It’s also highly possible that many users will share documents with friends, unaware that they might be exposing corporate data to the general public with confusing settings in some of these services.

    Ultimately I’m becoming more cautious about sharing information with others. I won’t open many files sent to me by people I don’t know well, and never look at any “humorous” attachments. I won’t accept a USB key from you and plug it into my laptop. It’s sad because we’ve built some amazing services to allow us to communicate easier and faster than ever before, however we’ve also not built these applications with an eye towards security first, and convenience second.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.6MB) podcast or subscribe to the feed at iTunes and LibSyn. 

  • Double Up During Trips

    Would you do this? Combine two calls, like an INSERT and then a SELECT, into the same batch sent from a ADO.NET client? It’s a proposal from Visual Studio Magazine to combine code into one batch instead instead of making two query calls (and two round trips).

    It’s an interesting idea, and for those programmers that are older, we probably unconsciously think about this all the time. We still remember when bandwidth was measured in kbps and processing power in MHz, and we often consider those resources to be valuable. We try not to waste them, precisely because they impact performance. Perhaps that’s why we recoil at some of the ORM frameworks and other programming structures that make development easier but are tremendously chatty in how they communicate with our servers.

    I know that programmer salaries are high, and that labor is one of the more expensive parts of building software. However rather than building inefficient applications that will create customer complaints, shouldn’t we be educating our developers more to ensure they write efficient applications? They can still use a framework or template of some sort, but they should do so in an efficient way. Along with training, using code reviews and keeping everyone on a central VCS where all code is visible can help spread knowledge throughout your staff.

    I realize that many managers are loathe to invest in developers’ knowledge when those developers might leave your company for another position, but imagine that a manager elsewhere is investing in his developer. It’s entirely possible those other developers then come to work for you. Ultimately we all benefit if we work to spread and build better software development practices throughout the industry.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.1MB) podcast or subscribe to the feed at iTunes and LibSyn.

     

  • Connection Issues

    Recently I was practicing for the keynote talk at the 2014 SQL in the City events. There were three of us in the “Ship Often, Ship Safe” talk, and we’d been practicing remotely. For the most part that meant a Skype call where we could work on timing and a Join.me share of a remote desktop to work on demos. The whole delivery became smoother and smoother as we got closer to the event, and I’m glad we spent a few weeks practicing (that’s important).

    However, we had an issue when we all arrived in London to practice. The first few run throughs, using a live laptop instead of a remote session, went much slower and less smoothly. In fact, the entire timing of the keynote was a problem because certain tasks were taking entirely too long. We were starting to think that we’d have to rewrite the talk in places, or take screen shots and show those.

    One of the presenters then suggested that we find a working network connection and retry our demos. It sounded a bit silly, but we relocated to a hotel room and connected to the network. Sure enough, everything ran faster.

    It turns out that there were various services, our own products, IE, and a few more that all had a few delays built in to check something across the network. Together, those delays added up to substantial time lags for various processes.

    While I think we’ve come a long way towards building amazing connectivity at high speeds, there are still plenty of times, including common tasks taking place in server rooms, where we don’t have a live connection to the Internet. I would hope that people would consider that the network might not be live and allow their services to continue to function if Internet access is not a core requirement. I suspect far, far too many developers still do not think of this.

    I don’t know that we’ll get better written software to allow for a lack of Internet access, but if you find things running slow, you might try enabling an Internet connection and seeing if your performance improves.

    Steve Jones

     

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.7MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Pay It Forward

    There’s been a joke for years that responds to this question: what happens if I train my developers and they leave? The answer (and the joke) is this: what happens if you don’t train your developers and they stay?

    It’s rather stunning to me that companies don’t want to invest in the people that build their software. Software is one of the most valuable assets a company can create. However it’s not free, just as an investment in better machinery requires capital.

    I blame the MBAs in America (and possibly elsewhere) who started to look at the world very closely with a factory and accounting mentality, seeking to minimize, rather than just lower, costs, and treating far, far too many resources as homogeneous. That includes people, and the ill-conceived notion of human workers as “resources”.

    However I think that our industry has grown up with this idea that we are all tinkerers and like to learn on our own. We can learn on our own, and perhaps we can do so more efficiently than in a class. Classes far too often built and taught by a vendor that builds a product, but doesn’t use the software in the real world. There’s this idea that building software is easy and that we should be able to “pick it up” in our spare time.

    However many other industries invest in their employees, and spend time training them to work better. Doctors and nurses learn from other doctors and nurses. Accountants and lawyers attend continuing education, though often because they must do so for licensing reasons. Engineers study new techniques in their fields, but in these and many other industries, companies often give their employees time, funding, or experimental time in which they can improve their skills. Managers in other fields often recognize that people must continue to learn, or they will see their skills wane.

    Perhaps that’s where we should start. Let’s train managers to understand that training is important to produce higher quality software, faster.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.7MB) podcast or subscribe to the feed at iTunes and LibSyn.