Voice of the DBA

Category: Editorial

  • Trade-offs

    scale
    There are always trade-offs when building software.

    I’ve always told my managers that building software is a trade off. We can do things cheaply, or we can do them quickly, but we can rarely do both. We can certainly fail in both ways, and many people do, but I usually see the need to trade time for money, or vice versa, when building software.

    I ran across a piece recently that was similar, though in it Allan Hirt says you can do things right, do them fast, or do them cheap. Allan talks about limited resources in working on projects. At some point time, budget, and staff resources are constrainted and you can’t expect stellar performance on extremely large workloads in a 24x7x365 environment. Something has to give, and one of those resources is going to let you down.

    I had always looked at people as a “money” cost, since they are paid for work, but there is another constraint to people that I hadn’t considered. Each individual in your company isn’t just a resource that’s exchangeable for others. Each individual has knowledge and skills that aren’t easily transferred to, or replaced by, other employees. In addition, each person has time constraints; they will only work so much in a given time period.

    Building powerful, efficient, effective systems, whether in software, infrastructure, or even in culture takes effort, time, and money. However if you do it well, it’s something you’re not only proud of, but something that pays for itself over and over.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Rewrite the Coding Rules

    Cryptanalyses
    It’s becoming more important to code securely.

    Security is a problem in technology. Whether it’s technological misconfiguration, social engineering, or brute force attacks, we see a constant stream of headlines about security issues. The situation is not likely to change anytime soon as security isn’t seen as a priority by many companies. If that’s the case, then is there anything that can be done to improve security?

    Security expert Dan Kaminsky says that we need a fundamental change in the way we write code. By rewriting the way that code is developers, rewriting the rules, we can reduce the vulnerabilities in our applications. One theory is that our languages and the coding techniques used are making it entirely too easy for vulnerabilities to creep into code.

    It’s an interesting theory, especially these days when it seems so many of our applications are under attack. I suspect that we have lots of poor habits ingrained in many developers. People are loathe to change and they like to continue working in ways that have worked for them. However the world of security in software changes constantly. What might have made you a very effective and productive developer five years ago might make you a liability today.

    I believe that we need to somehow build new coding methods, but even more importantly I think people that provide sample code and framework need to do so in a way that showcases best practices and good habits from a security perspective. That includes presenters, who should never show security issues, even if it’s for the sake of simplicity. Raise the bar and your audience will come along with you.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Teammates

    Terry Tate
    Are you like Terry Tate in your office?

    I loved the Terry Tate commercials as a young office worker. They were unveiled at the Super Bowl in 2003, when I was still managing a database team at Peoplesoft, with weekly issues occurring on our production systems. There were times I wished I could hire Terry to try and convince more people they should be working together using the stick instead of the carrot.

    I have known a few people that worked with former atheletes in real life. If you didn’t recognize them from their past, you might never realize they used to play sports for a career. I was reminded of them by this short slide show that imagined various NFL players as office workers. If you can get past the idea of professional athletes attacking your business problems in the same way they play on the field, the piece shows a number of different personalities that you might find in business. I’ve dealt with many of these in the past, with mixed experiences. I certainly haven’t enjoyed working with the “Lawrence Taylors” of the business world.

    This Friday I wanted to make this a fun poll. I thought you might want to describe yourself or your boss with a famous figure:

    Which professional athlete (or other star) displays the type of traits you think would best suit your position?

    It doesn’t have to be an athlete. Pick someone in the arts, music, movies, etc. Just choose someone famous that you think would exemplify the person you want to be perceived as, or would like to grow to be like. Or represents you now if that’s the case.

    For me, I think Lawrence Lessig has a fantastic way of expressing himself in relatively few words, but in a very logical manner. I also appreciate his passion and knowledge on various topics. Some day I hope I can express myself as well as I think he does.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Data Worms

    The FLAME malware
    Are we going to see more and more targeted cyberwarfare attacks in corporations? I wouldn’t be surprised.

    Effective data administration include backups. I would argue this is the most important part of managing your data since no matter what happens, backups give you the ability to recover your system. Whether it’s an accidental data modification by a user, a hardware failure, a natural disaster or some other event, having a copy of your data (or log) on some other system or media can be the difference between getting back to work and having to go find other work.

    For the most part we’ve been concerned over disasters that are random, and while they may be destructive, their effect is usually limited in scope. SQL injection attacks often affect a single system, and with a good backup, you can usually recover your data quickly. However that may be changing as the world grows closer together.

    The Shamoon malware has been causing problems lately and making companies rethink their incident response. The worm has wiped workstations and destroyed data. Destructive software is nothing new, but as more and more cyber warfare takes places at the government level, it’s likely that retaliation might target civilian targets, especially successful companies. I’d hate to think that destructive malware might target databases, but I’m sure it will. The SQL Slammer worm was a complete disruption of our database services for days at JD Edwards almost a decade ago, but it could have been much worse if that malware had been written to be destructive.

    We don’t have default names and passwords in SQL Server, but we should make sure all accounts have strong passwords. There’s also some value in not configuring all systems identically. It makes management easier, but it also makes a successful attack that much more successful.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.