Voice of the DBA

Category: Editorial

  • Serious Security

    I almost long for days when security was this simple.
    I almost long for days when security was this simple.

    There’s an interesting piece at Wired on hackers and their impact on security. Despite the constant hacks and cracks of passwords, the regular lectures and pieces written on the subject, many people refuse to use separate passwords on every site, or choose long passphrases, or implement many of the best practices that are published on security. Some of that might be a lack of knowledge, but much of it is likely explained by behavioral economics.

    Most people are never hacked and don’t have issues. Even if they do experience some problem, they can often recover fairly easily. Lots of hacks are just annoying, like using your email account to send SPAM, akin to random vandalism. As a result, many people don’t bother to change their habits. It might also be a tendency that’s hard-wired in our personalities. I’ve educated friends on passwords and given them Password Safe. A few use it religiously, but others keep forgetting, preferring to keep regenerating and changing passwords or re-using them.

    To solve some of these issues and create the behavior that we want, there are suggestions in the article for software designers. One is requiring stronger mechanisms up front, another suggests perhaps changing from alphanumeric pass-phrases to image based ones. One poses the idea of enforcing penalties on users. These might be ways in which we can convince software users to take security more seriously. If it’s true that software is eating the world, then perhaps the designers and developers should do their part to help make sure security is a part of the new world.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Message Queues in Software

    Message queues are great ways to scale out your application, among other uses.
    Message queues are great ways to scale out your application, among other uses.

    I had high hopes for Service Broker when it was introduced in SQL Server 2005, but it doesn’t seem that many people have bothered to architect their applications to take advantage of it. I do see some people starting to use it, but it hasn’t been anywhere near the levels of adoption that I would expect.

    I ran across a piece on 10 reasons to use a message queue that points out a number of possible ways that queuing could help you. There are some great ideas, including a few suggestions for scalability and resiliency for your application. One of the more interesting ones to me is the idea of using a queue to buffer the slower processes that may be a bottleneck in your application.

    I still think this is a great way to build applications, especially distributed ones, using queues instead of linked servers, ETL, etc. However until we get more people developing in a service oriented architecture, and getting experience, I think we will struggle to see message queuing gain widespread acceptance. This is a departure from the way most developers are comfortable with building an application, and the way that queues work in SQL Server certainly confuses many DBAs.

    I’d challenge many of you to think about using queuing in any applications where you are moving data from one database to another, or trying to trigger an action on a remote machine. It’s a great way to scale out your systems, and it’s a very solid, reliable architecture for your systems.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Cramming for Interviews

    SQL books
    Are you tackling any of these subjects in 2013?

    On SQLServerCentral, there are a lot of common questions that I see asked over and over. Perhaps the most common is the “why is my transaction log so large it filled my disk” question, which seems to occur constantly (C’mon, Microsoft, change the default recovery model).  However there is also no shortage of people asking for help with interview questions.

    In general, I don’t mind helping people learn more about their craft. I’s how I learned, and I think honest effort should be rewarded. If you spend some time trying to learn something or understand a concept and have questions, I am more than happy to try and clarify things. However I don’t think that anyone on a phone interview, completing some type of employment exam, or even just memorizing a number of new concepts is doing themselves, or the employer, any good.

    Cramming for an evaluation of your skills makes sense. I did it for school exams, and I see plenty of people working in groups or through exhaustive simulations of features in SQL Server to prepare for the MCM exams. However in those cases, it’s a refreshing of the concepts and knowledge that one will need to complete the exam quickly. This is knowledge the person already has learned in the past.

    As long as you are trying to brush up your skills, and are not deceiving anyone about your talents in an area, I think cramming some facts and ideas into your brain is a good way to present yourself in an interview. Attempting to misrepresent your ability to produce professional work in some area to get a job isn’t acceptable. I won’t help you, and I would encourage others to avoid helping as well.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Global Insecurities

    Don't find yourself in this situation. Change your defaults.
    Don’t find yourself in this situation. Change your defaults.

    Reading this article about the insecurities found from various scan in 2012 is a little scary. I wonder how many of my former employers have videoconferencing systems, remote control/access systems, or some commercial software with a default password connected to the Internet and unsecured? Reading the article I’d bet at least one of them does.

    I also wonder how many of them have old versions of software with known vulnerabilities that can be exploited, not just by dedicated hackers, but by script kiddies. Lots of people have excess time available, powerful computing resources, and mischief in their hearts.

    This is slightly maddening to those concerned about the security of computer systems. How hard is it to change the default passwords on the installation of an application? How much more time does it take to configure a system properly? It doesn’t’ ta

    ke much at the moment, but it does take time in advance. Proper security requires knowledge, which means that an administrator much have spent time learning how to properly configure a system, or getting a comprehensive list of vulnerabilities and their patches.

    I’d love to see vendors publish a best practices document, or a couple of them, for each version of software they release. Give people specific steps to follow on the installation of the software to ensure it is securely configured as well as known vulnerabilities and the patches available. I can publish information, and there are likely any number of blogs out there that my give some best practices, but for new users, the vendor’s site is the only resource that many people will follow.

    I know I’d be willing to allow vendors to link to any best practices I published, or republish the information on their own site if they wanted to. I’m sure others would feel the same way. Now if only the vendors would agree to use the information.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.