Voice of the DBA

Category: Editorial

  • Change Management

    Hurry up and wait.

    Hurry up and wait.

    In a couple of the large enterprises I’ve worked in, that might have been the IT motto. It seemed as though the internal developers were always under pressure to get applications finished as soon as possible. However we often found that when applications were finished, there would be a delay in deploying the new code to the production servers, usually because of a strict change control process that required documentation and testing of the changes on related systems. In many smaller companies I’ve worked in, we had no change control process at all and could deploy updates at any time.

    I’m not sure which of those two systems I prefer. In general, I prefer to have some change management process to ensure that I can easily determine what changes were made at any time. However I’ve found that any change management quickly becomes a bottleneck devoid of common sense and full of bureaucratic nonsense. This Friday, I decided to ask a question about change management, but not about your opinion of whether it’s good or not. The question this week is:

    Do you follow a change control process 90+% of the time?

    By this question, I mean is change control a habit, an ingrained sense of the way you work and deploy updates to a live environment. I’m not asking if you have a formal process, if it’s a team process, or anything about the details, but rather do you actually follow some methodology to track and manage changes?

    I’d like to think most of us would, if for no other reason than to answer the common “what changed?” question that always comes up when something breaks. However I’m curious to see the results.

    Steve Jones

    The Voice of the DBA Podcasts

    We are still having hosting issues with the podcasts. We hope to resolve this and be back to releasing the podcast versions of the editorial next week.

  • Disk Drives in the Sky

    Not too many data professionals are working with databases in the cloud, and while I think it’s a platform that will grow, it’s not suited for all environments. One thing all of us need, however, is bigger, better, and faster storage for our data. Our data volumes are growing, sometimes surprising us with the sheer number of bits our queries must go through, and access times for storage are often a bottleneck in our systems.

    There have been some interesting advances in how storage is connected to our systems, and there are some even more interesting ways in which the large cloud vendors are tackling the storage issues they face. I read a fascinating piece on the various storage systems used by Google, Amazon, and Azure. It talks about the various architectures being used, and there are some innovative ideas being implemented in order to ensure there is a high level of reliability and performance for these systems.

    Should you be interested in storage architectures as a data professional? I think that having a basic idea of the options out there will give you the chance to understand the options your storage people (or vendors) may recommend in the future, and have some idea of the suitability of these systems for your databases. I don’t think you need to understand the detailed implementations, but knowing the pro and cons of these systems, as well as the experiences of other companies, may help you detect how much fluff is being presented to you.

    There’s one part at the end of the piece that caught my eye: “as data volumes continue to go up for “big data” applications, server memory is becoming “the new disk” and file systems are becoming where the log for application activity gets stored—”the new tape.” That’s interesting. Maybe we’ll start to do more in stream processing, ala Streaminsight, on our data and keep more aggregations and analysis in memory, reducing the need for disk access.

    Steve Jones

    The Voice of the DBA Podcasts

    My apologies. The hosting provider for the podcasts is having issues, so we do not have them available today.

  • Should we outsource identity management

    My Database Weekly editorial for Jan 30, 2012

    One of the first things many people build when they’re developing an application these days on the web is a login/identity system for their users. This allows them to identify people, customize the features and functions, and separate out the different classes of users from each other. However many developers don’t really understand good, secure design, much less encryption, and end up “storing passwords hair kari in unsecured databases”, a quote from this piece on password security.

    I’d hope that most developers know that passwords should be stored in a digest (one-way hash) form, but that’s like assuming most developers understand the issues with SQL Injection. It’s not true, and not necessarily going to be true until, well, it’s not likely to ever be true. Even if we had minimum standards, there are plenty of developers that would ignore them and plow forward with the arrogance that their custom method is better implemented, and more secure, than any standard.

    Passwords and password security are hard. I’d hope that most people would be looking to move to passphrases instead of passwords, but I don’t see the recommendations being widely disseminated in the world. I recently rebuilt a computer, requiring my kids to implement new credentials, and my recommendation was a simple phrase they can remember with a number. I was hoping it would serve the dual purpose of instilling good security habits as well as improving their typing skills. We’ll see if it helps.

    With large rainbow tables, creative social engineering, and poor application security, it’s even more important now that we use passphrases, and even develop better identity frameworks for applications. Personally I liked the Passport system Microsoft had, and I like the OAuth system even better. Perhaps we can get more of these frameworks implemented in reference applications and frameworks, as a default way of managing identity systems.

    That’s the easy part; convincing developers they can’t manage identity better is probably the hard part and I would love to see some good ideas for that.

    Steve Jones

  • Morale Data

    Would you use this service to make work more happy?

    Would you use this site to enter your morale at work? It’s an idea by a new company that should enable employees to enter information about how they feel at work, how their job is going, and other meta data that describes their attitude for the day. Managers get access to an aggregated look at their employees, as well as anonymous feedback about the way people feel about their jobs.

    As much as I’d like to say this is a good idea, I can see this being more of a tool for abuse than a tool for making changes. I suspect most managers would take negative feedback personally and investigate more, perhaps even asking network people to comb through logs to find out who posted comments, or perhaps even assume that a particular employee had written the commend without any evidence. We are often entirely petty in our reactions to criticisms, and I’m not sure most of the managers I have worked with would actually use this data to improve the way they perform their job.

    However this is exactly the type of data that might really help some companies improve their internal operations. If they care about their employees, and want to retain the skilled knowledge workers, this type of site could help identify groups of people that are unhappy, or even managers that need improvements in their own skills. I do like that this is a third party site, which gives me some degree of confidence that this data could remain anonymous, something I wouldn’t assume would happen if the software were hosted on a company’s own servers.

    I would like to know if any of you would use this type of tool at your job, and if you think it would help your company’s morale. In order for it to work, I think that the various manager’s bonus plan would need to be based on the results. Even if the manager’s “gamed” the system a bit to get a better score, that would result in a better work environment for most employees. One word of caution: if you do criticize managers, be careful how you do so. Some people can be identified by their word choice and writing style. Have someone review your message before you post it and let you know if the writing reads like your other communications.

    Steve Jones

    The Voice of the DBA Podcasts