Voice of the DBA

Category: Editorial

  • What’s New for the Microsoft Data Platform

    Today is the first day at the PASS Data Community Summit and I’m in Seattle where I’ll get to open the conference and introduce the Microsoft keynote. I’m sure the keynote will be full of announcements on something, but what?

    I’m writing this a little over a week before the event, and I have no idea what Microsoft will do. Actually, by the time you read this I may have some ideas as there was a practice session yesterday, but I can’t tell you anything. NDA, and really, by the time I got something organized, the keynote will be done.

    You can stream the keynote, and watch the opening (and wave to me if you want) for the conference for free. Some of you may read this before that time, and if you do, then think about this question: what do you want to hear Microsoft announce or what would get you excited about data work.

    I don’t often spend time thinking about what I might like, mostly because I can’t influence things and I don’t like to spend too much time dreaming about databases or what things would help sell more licenses or compute or anything else. However, I am interested to know if a new version of SQL Server is coming (and when) and what might be in it. Or if there are structural changes that might be interesting to me as someone who helps customers work with databases and data.

    If you complain about the performance of SQL Server 2022 and want bugs fixed, that’s fine, but that’s not going to be in a keynote. Instead, think about what things could be added to SQL Server, Azure, Fabric, or some part of the data platform. Where will Microsoft go that might help our organizations or be interesting? Think about what you might want to adopt in a year or 2 if it works as designed.

    I have no idea, though I suspect AI is going to be said once, maybe twice, or maybe even a few more times 😉

    Leave a guess in the comments. If you don’t watch it live, then take a guess and watch it tomorrow to see if you were right.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • Republish: Idempotent

    Traveling today to Seattle and running around to Redmond as well. No time to look at anything, so you get a republish: Idempotent

    Enjoy and hope you learn something.

  • I Need a CS Degree. I Don’t Need a CS Degree

    For a long time I’ve felt that my recommendation for people wanting to enter technology wasn’t to go to college and get a degree, but rather start to learn on your own and get an entry level job (help desk, tech support, etc.) and start to work in the industry. That’s a good way to both experiment and understand what you’re considering undertaking as a career, as well as limiting your investment. It’s also nice to get paid to learn something.

    College is great, but it’s also expensive. I find that for many people, it can be hard to get a good ROI from college these days. The fast rising cost, not to mention the uncertain opportunities after college lead me not to recommend pursuing a CS degree, or really any degree, as a default view. There are exceptions, but for many people, I’d prefer to work and try to better understand where they should invest in education.

    However.

    Jerry Nixon has a great (long) post on Twitter on this topic, answering the question of whether someone should get a degree or not, mostly focused on developers and CS degrees. It’s a very nuanced view that you both should and shouldn’t get a degree. It really depends on what you want to do. There are cases where we might want someone to get a degree and deeply understand complex development. It’s one thing to build internal web apps or design a database used by internal sales teams. It’s quite another to design encryption for a military application or ensure a rocket can land on a floating platform.

    Both things can be true together. You should get a degree to be a developer and you should not get a degree to be a developer, but the more detailed answer depends on where you want to work and what you want to achieve. A nice optimistic view from Jerry is that some people want to achieve something bigger than a paycheck, bettering the world with software, not to earn more, but to make life better in some way. I wish more people felt that way.

    A great piece of advice from Jerry is to listen to those who you want to become, not the loudest people. I somewhat lament that so many of the very, very smart people I know or hear about are focused on tooling that generates revenue or income, and not necessarily pursuing improvements in the world. That’s their choice, and I can’t get upset about so many extremely capable technologists working in finance or FAANG rather than areas where they might change the world for the better. I can be though, and am, sad.

    Read the post, and think deeply about what this means to you. And if you want to be a great software or database engineer, then do great things. Work hard at your craft and constantly sharpen your saw.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • The Cloud Security Problem

    Your management gets a great demo from a cloud vendor and decides that the organization needs to implement the new service/application/etc. quickly. Your team tries to comply, furiously learning and experimenting with integrations, software changes, infrastructure configuration, and more. Things get deployed are working. Clients and management are happy with the new capabilities and you breathe a sigh of relief.

    After a bit of time there’s a security issue and all of a sudden there’s blame pouring down on everyone. The vendor takes a hit because it’s a public security problem, but the reality might be that your organization didn’t completely understand how to configure strong security. The public doesn’t blame your organization, but internally your team don’t know how to make changes to ensure future security.

    That’s a bit of what happened with the Snowflake customer hacks, and a good description of some of the issues is in this piece from Joey D’Antoni. Snowflake didn’t necessarily have bad security, but they allowed customers to have bad security and also limited the options for customers to implement stronger security.

    I think about this all the time as I look at the challenges of security that many organizations face. In my decades of working in different situations, the one thing I know is that pressure to move fast often creates security shortcuts. Much of the early security problems with SQL Server could easily be traced to a) allowing installs with no password, b) developers not understanding the security model and granting sysadmin (or using sa) in their applications, and c) management agreeing that this was OK because a deadline needed to be met.

    In all these situations, workers had the best of intentions to go fix things later, but there was rarely the time or energy to do so. As someone who forced apps to change away from sa in a large org, and required separate accounts and passwords for servers, I can tell you no one liked me and I got a lot of pressure to leave things alone. That is until I could explain the risks to managers with security people present. Even then there was no shortage of people who wanted me to assume the risk of apps using sa and let things be.

    Cloud security is pretty good from the major vendors. Most of the smaller co-location facilities I’ve worked with in the past also had good security. It was the clients that caused problems, often because of a lack of knowledge or the desire to hurry.

    Joey says Entra is a great system. I agree, and I love the SSO capabilities I’ve seen implemented. I also know that trying to set things up and configure them has been difficult for me, and I think I can be pretty sharp about lots of technology. Joey has patiently answered many of my ignorant questions because I didn’t understand how some part of Entra (AAD) works. I think lots of tech people don’t understand this and don’ t necessarily have a Joey to call on.

    Most of us working in technology need more security education, better habits, and the patience to implement strong security. That includes management. At the same time, I wish that the solutions out there were easier to understand, or maybe better explained for those of us who need to use some portion of the authorization and authentication systems in our software.

    Unfortunately, security software is still software and those vendors push out changes and updates quickly as well, leaving education and documentation to the user. This is a bad situation that continually arises with regular issues in many organizations.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.