Voice of the DBA

Category: Editorial

  • Beginner, Expert, or Both?

    It seems that there’s no shortage of interviewers complaining about the lack of qualified candidates for open positions. It seems to me that the best thing you could do to get a better job is work through all the articles and lots of forum posts from SQLServerCentral, complete all the exercises in your favorite SQL Server book, and improve your skills so that you shine in an interview. If most candidates are really that bad, it can’t be that hard to make yourself stand out with a little work.

    However it seems few people do that. In fact, it seems that quite often we find people that have 5 years of experience with SQL Server really have 2-4 months of experience repeated 15-30 times. What’s more disconcerting is that they don’t realize how much knowledge they lack.

    This article might provide some of the reasons why people think they’re more experienced than they are. They’re expert beginners, and since they can accomplish the things they’re asked to do at their jobs, they think they’re complacent. They have success because they’re not asked to do more, perhaps because their employer only needs a small fraction of SQL Server knowledge to keep their systems running along.

    I think this is a hard trend to break. Employers don’t want to pay you to learn skills that aren’t important to them, and they certainly don’t want to pay you to learn things that will move you to a new job. However that doesn’t mean you should have the same attitude.

    I think you should continue to expand your skills, grow your knowledge, and try new techniques. The best people in all professions continually question their current skills and techniques, looking for better ways to accomplish tasks. It’s good to use what works and ensure stability in your systems, but always be prepared to evolve if you find something that works better.

    And keep looking for ways to do better.

    Steve Jones

    Video and Audio versions

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    Follow Steve Jones on Twitter to find links and database related items and announcements.
    Steve Jones Windows Media Video ( 18.9MB) feed

    MP4 iPod Video ( 16.2MB) feed

    MP3 Audio ( 3.4MB) feed

    Feeds are available at iTunes and Mevio

    To submit an article, rant or editorial,
    log in to the Contribution Center

  • IT Security

    IT security is a concern for many businesses. At least that’s what a survey at the recent Black Hat conference concluded. Most of the respondents couldn’t be sure that a foreign state-sponsored attack had not occurred in their networks. About half of the people were not confident that their staff could even detect an attacker. That’s a little scary as many of the people felt their systems might come under attack within the next year.

    Digital technology has changed the world in many ways, but one of the most amazing to me is how it has leveled the environment in which all of us can interact. No longer does communication, publication, research, even war require the resources of a country or even a large organization. In the cyber world an individual can make as much impact as a large entity. As with most things, this is a double edged sword, and I’m sure many of us will find that vandalism, as well as malicious attacks on our systems will increase in the future.

    However the threats, or perhaps the consequences, aren’t severe enough yet. Most companies allow shoddy code, vulnerable to SQL Injection, to pervade their internal (and sometimes external) applications. Security training is limited, and review of third party applications is extremely lax. The respondents at Black Hat are making efforts, but those are a self-selective group. Most organizations would never send an employee to Black Hat events or even monitor the trends and information published by groups like SANS.

    I do believe that security will become more and more of an issue. I suspect, however, that until businesses are liable, and decide to purchase insurance, we won’t see much change. Once insurance premiums start to depend on the level of security you implement, I suspect we’ll see the quality of application code increase.

  • The Ratio

    It seems we never have enough staff in many of our technology departments. I have worked in companies where I thought we had too many IT employees, but somehow it seemed my department was always short of resources.

    However one thing that I’ve seen almost universally is a larger number of developers than DBAs in most companies. That makes sense as I think there usually is more code to write than instances to administer, and I’ve usually found companies have to hire a few developers before they see the need for a DBA of any sort, whether production or development focused.  I’ve also found the relative levels of staffing have widely varied.

    This week I’m curious what ratios you’ve seen between these two jobs. I’d like an answer to this question, based on your experience:

    How many developers does a DBA support?

    I’m looking for the real ratios that you’ve experienced. In the places where I’ve developed code, or worked with developers I’ve typically seen about 1:10 DBAs to developers, but that number has varied. I’ve seen 1:5 and 1:20+, but in most cases it’s been near 1:10.

    Let us know this week and get a little market research that might help you convince your boss that you need a helper or two.

    Steve Jones

    Video and Audio versions

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    Follow Steve Jones on Twitter to find links and database related items and announcements.
    Steve Jones Windows Media Video ( 12.5MB) feed

    MP4 iPod Video ( 15.0MB) feed

    MP3 Audio ( 3.4MB) feed

    Feeds are available at iTunes and Mevio

    To submit an article, rant or editorial,
    log in to the Contribution Center

  • The Challenges of Being Safe

    This editorial was originally published on Mar 19, 2009. It is being re-run today as Steve is away at DevConnections.

    One thing we recommend is to make sure that production data is always kept safe, which means that you keep control of where it lives and how it’s used. I saw a post recently where someone needed to send data to a business partner and wanted to obfuscate it.  I think that is a great thing to do and was glad to see someone asking for advice.  Sending data to business partners is required, but you want to be sure that you are not necessarily giving away too much information, especially identity, privacy, or financial information that you shouldn’t.

    However what about your test and development environments? I’ve seen people obfuscate data here, but not always. In fact, not usually. This is despite the fact that you might turn over developers often, expose that data to testers, or other people that might not normally have access, and the fact that these environments almost never have auditing enabled.

    We need to mimic production environments and data, but there are quite a few challenges with doing this in a safe and secure manner. Just having scripts to obfuscate data is a challenge in and of itself. I’d love to see a tool built that would do this automatically, though I wonder how many companies would actually buy it. I’m not sure there’s a great market for tools here until insurance companies start require it for your “data loss insurance.”

    But building those scripts is both hard and time consuming. How do you decide what to obfuscate? What values do you use? How do handle PK/FKs to ensure that things match up correctly if you’ve used personal information, like a SSN, as a key field?

    Beyond that, there’s much more. What about ensuring that data matches up correctly? Can you really determine if there is an issue with some calculation or relationship if you have random data. After all people many times will have favorite accounts that they know well and understand what the data should look like. A developer may expect certain order details or address information, and use that as a benchmark when developing new code. If the data is random every time his environment is refreshed, does that slow his productivity? How do you test things like URLs and emails if data is randomized?

    And what about when you alter your schemas? How much work is there to update your scripts?

    And what about mistakes? How often has someone pointed development code at a production server? What happens if they accidently run an obfuscation script against production? If you’ve scrambled data around, would you catch it quickly enough to restore before too many transactions were sent through?

    Using some type of data obfuscation or randomization is a great way to help ensure that your production data is kept safe, but it definitely makes for a much more complex environment, and likely, more headaches for DBAs and developers.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are now available atsqlservercentral.mevio.comto get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed:  or now on iTunes! 

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    I really appreciate and value feedback on the podcasts. Let us know what you like, don’t like, or even send in ideas for the show. If you’d like to comment, post something here. The boss will be sure to read it.