Voice of the DBA

Category: Editorial

  • Secure Programming

    This editorial was originally published on Mar 19, 2009. It is being re-run today as Steve is away at DevConnections.

    Writing secure software is hard. The way most people learn software, from simple examples that slowly build our knowledge, doesn’t encourage complicated solutions that provide robust error checking, error handling, and secure practices. Most examples that I’ve seen in the world include “dumbed down” code that is easy to understand and explain in a class or seminar.

    And that’s the code that often gets used by developers.

    They go with the simple example, and enhance it, not really concerning themselves with best practices, or even great practices. In fact, if you search for sample code on the Internet, read articles on various sites about programming, or buy a book from an “expert” it seems that more often than not, the code isn’t well written from a security perspective. Yet that’s the code, and the mentoring, that many developers get.

    And for a DBA, that code is a nightmare.

    Too often the code samples and practices that are taught to people include dynamic SQL built in the application with little to no thought about SQL Injection. And it doesn’t matter if the application is at fault. As the DBA it’s often your phone that rings, and you that end up explaining to your boss why all the products on the site cost $1, or why every customer’s name is “0wned by S&p#rG##k.”

    The NSA, along with a number of other companies, is trying to do something about poor programming practices. They have release a list of the 25 most dangerous programming mistakes. What’s interesting is that some government agencies, and hopefully companies soon, are using this list as a litmus test for vendors. Software companies are being asked to guarantee that their software contains none of these mistakes.

    I think it’s a great idea, and I wonder how well it will be enforced. Microsoft and Oracle, among quite a few other software vendors, provided input into the list. You’d hope that their software would be fixed, or at least all new software would comply with the recommendations and not contain any of these mistakes.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are available atsqlservercentral.mevio.com. Comments are definitely appreciated and wanted, and you can get feeds from there.

    You can also follow Steve Jones on Twitter:

    Overall RSS Feed:  or now on iTunes! 

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • The Need for Tape

    This editorial was originally published on Mar 26, 2009. It is being re-run as Steve is away at DevConnections.

    One of our SQLServerCentral authors sent me this post, which I found to be pretty amazing. Apparently hackers broke into a backup server at WebHostingTalk, which is a community for hosting providers to discuss issues. They deleted backups first, and then moved on to deleting tables from the database.  It resulted in some downtime, and then a restore of an old copy of their database prior to trying to restore more recent copies. More information from the admin is here.

    Now that’s just malicious and nasty.

    Hopefully this wasn’t an inside job, though I could see that as a possibility. For a service like this, that just provides a place for a community, let’s people interact and talk, this is just vandalism. It serves no purpose. It’s likely no one even knows it was “M@M@sB0Y” or some other hacker, so there’s no fame, and it disrupts people who just want to converse with colleagues.

    I’d hate to think about this happening here. We have lots, and lots of posts from people all over the world, and while it wouldn’t kill us, it would really annoy many people that have volunteered their valuable time to help others by losing their work. We definitely need to make sure we don’t have an issue here.

    I see two takeaways from this incident for most DBAs and administrators. First be sure that your backup servers are just as secure as your production ones. There is production data in the forum of backup files here, and you should be providing as much security for them, and perhaps more, as on other servers. Don’t treat these servers lightly.

    Second I think this shows that there’s a need for tape backups, or some type of non-linked backup. A tape grabs the files from your server, completely separately from the SQL Server (or other application). It is a pull link, and it’s not obvious from the source server where these files have gone. That’s good in that it prevents some type of attack on the main server from propagating on. Most people use a push from their server to a remote device as part of the backup process. That’s OK, but it provides an easy link for someone to attack the backup server from the main one.

    And one more benefit of tape? Usually they’re rotated out, so even if a hacker or insider knows how to get to the backup system, without physical access they can’t touch your tape.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are available atsqlservercentral.mevio.com. Comments are definitely appreciated and wanted, and you can get feeds from there.

    You can also follow Steve Jones on Twitter:

    Overall RSS Feed:  or now on iTunes! 

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    I really appreciate and value feedback on the podcasts. Let us know what you like, don’t like, or even send in ideas for the show. If you’d like to comment, post something here. The boss will be sure to read it.

  • Hybrid Databases

    SQL Server already handles hybrid data.

    We are dealing with more and more data all the time, and in more and more formats. As noted in this piece, companies are receiving data in new formats, from a variety of sources, and the traditional relational database isn’t always the best fit for the processing, storage, and management of the information.

    However SQL Server isn’t just a relational database. It handles unstructured data well, with the Filestream and Filetable enhancements to varbinary columns. We can even read into this unstructured data with iFilters that we install on our instances. In fact, I’ll be talking about these filters at DevConnections on Wednesday.

    SQL Server has StreamInsight for complex event processing, allowing you to handle very quick streams of data that could overwhelm your OLTP architecture.  If that’s not enough, there are connectors that allow you to integrate with other data processing architectures, like Hadoop.

    With all the various subsystems like SSIS (ETL), Reporting Services (exports to other formats), Service Broker (messaging), spatial data, and more, I think SQL Server is an amazing hybrid database platform in and of itself, without any extra charges for the various features (like some other platforms). That’s not to say you shouldn’t use any other platfoms. If they work, use them and integrate with SQL Server, but if you don’t have other databases in place, I’m not sure you need to look past SQL Server for many of your needs.

  • Scripting

    One of the directions in which Red Gate Software is to build more tools and utilities that all of you can use for working in cloud environments. We aren’t ignoring the desktop tools like SQL Compare and Prompt (v6, yeah!) that you’ve come to appreciate and depend on, but we are investing in expanding these tools to work with a remote, services style architecture since there are plenty of companies looking at AWS, Azure, or other providers for a portion of their applications.

    I’ve been learning a bit more about the way cloud services work and one of the things that becomes important in an IaaS environment is scripting. The environment you get is a base install and if you need more software or processes to run when a new VM starts up, you need to script the various installations or configurations.

    There are some great scripting features for SQL Server, like Finebuild for installs and Powershell for most everything else. Scripting is a great way to accomplish tasks, but like most skills, it needs to be used in order to be efficient and practical for most tasks. I’ve struggled with this, and I’m sure many others feel the same way.

    However I am starting to think that Powershell might be the best investment in my future skills. The quicker I can write it and build scripts to accomplish tasks, the more I’ll be able to do over time as I build a library of commandlets and scripts. That’s if I remember to document them well so I can easily search for what I need.