Voice of the DBA

Category: Editorial

  • Effective Engineering

    I’m not the smartest developer or DBA. I find myself mystified at times by Itzik’s posts on T-SQL queries and I’m amazed at times by the complex systems that I see the DCAC people put together. I can usually figure things out (sometimes by asking the authors a question), but it’s not always easy to do. We have some truly gifted, incredibly intelligent people in this business.

    I am, however, effective. I have been very successful in my career at getting things done well enough, things that work well, meet the needs of my client/employer, and meeting deadlines. I don’t just slap things together, but think about them, build them, test them (don’t forget this), and then make sure they’re working when they’re deployed.

    Sometimes this might take a few PRs or patches for patches, but I get things done. And my customers/clients are happy.

    I saw this post on Linked In noting Platform Engineering is Dead, which is a great title, but not really true, and not quite reflected in the piece. The author worked on the Software Delivery Enablement team, which is what the platform engineering team is supposed to do.

    I see similar complaints about DevOps, and previously saw complaints about Cloud computing or Agile or Scrum or SOLID. There have been similar complaints about how some new methodology or idea isn’t working and should be abandoned in favor of this other new thing.

    Ultimately, near the end of the piece on Linked In, there is this:“we also knew how to help them use solutions to deliver software better, and we partnered with them instead of inflicting things upon them.”

    This is what Software Engineering should be. In waterfall, we want to have customers tell us what they want and build that. Often customers don’t know what they want, so we decided Agile would help. DevOps is a way of talking about a partnership between developers and operations that still delivers what the customer wants, quickly.

    Platform Engineering or Software Delivery Enablement or whatever name you give it is still partnering with customers to deliver what they need. Not what you think they need or what you want to build, but what they need.

    Whenever Agile or Scrum or DevOps or Platform Engineering doesn’t work, it’s because you’ve forgotten that this is a partnership. That’s what effective engineering is, and it’s what I’ve practiced. Partnering with others to achieve our aims.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • Dead to Me

    I saw a note from someone recently that reminded me of Policy-Based Management. This was (is?) a technology in SQL Server that I thought might have great potential. I even had a few presentations on the subject, but sadly I’ve rarely seen anyone implement it. I’m sure some do, but I think for me, this is dead technology.

    There have been other tech items from which I’ve been turned off or abandoned over the years. It seems in SQL Server, we have some tech that even Microsoft has abandoned and doesn’t put any development resources into improving.

    This week, I’m asking if you have technology that’s dead to you. It could be in the SQL Server or Microsoft Data Platform, or it could be elsewhere. Let us know in the discussion below.

    I have often moved on from some technology to something newer or better, but that’s not because the old software was dead to me, but rather because I found something better.

    However, I have abandoned some things. Database Mirroring is something I see as dead, as does Microsoft. I think for me, any source control system other than Git is dead to me, though maybe that’s more because Git has proven to be better (and ubiquitous). I’d say that I find most multi-platform messaging clients dead to me, mostly because they can’t keep up or implement good interfaces that work across many places. At least not in a way that makes sense for me. I’d say these days, digital cameras (and video cameras) are dead to me as a casual snapper who can live with a phone.

    I’m sure there are other dead technologies that you’re just annoyed with or think don’t (or can’t) meet your needs. There are likely many more which didn’t keep up with you over time, which you wouldn’t have abandoned if they had just improved a bit.

    Let us know today what you think.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • AI Is Great and Tech is Failing

    On a recent weekend, I got a text from my bank that they had declined a charge to one of my business accounts. I called them back and they let me know there had been a couple of weird charges on the account that their AI system detected. This seems to happen every year or two so I wasn’t overly worried. I cancelled the card and ordered a new one.

    A day later, my wife got a call about our credit card with the same issue. She cancelled the card and got new ones ordered. However, I use that card to travel and I had a trip booked. Suddenly I was without a credit. Luckily, we have another card for my wife’s business that I could use. I called the bank and had a card expedited, but the situation created some stress. In fact, I panic-bought an RFID-shielded wallet. I’ve resisted for years, using an older, large wallet me daughter bought for me one Father’s Day that always reminds me of her. The timing across a few cards was weird, and I suspect my wallet got scanned somewhere and both card numbers were stolen.

    A few things. First, be careful with the new tap cards, as they can be scanned and read from a distance, albeit a short one. Second, having a spare payment method might be nice in this age of non-cash transactions. Third, why is technology failing with new cards?

    I lost a card last year and knew it was gone. There were no charges, but I couldn’t find it and needed a replacement, so I cancelled it and ordered a new one. In minutes the digital cards on my phone (and watch) had been replaced. I had new numbers and could transact business.

    Why would this be different? The banks arguably have better knowledge of my digital wallets, and replacing those is much easier than relying on a snail mail server and the time it takes to deliver cards. In my rural area, we regularly have reports of stolen mail, with thieves targeting credit cards and physical checks sent by snail mail.

    This was a minor issue in my life, and I am fortunate I have other ways to manage payments in this minor crisis. I was (and am) happy that AI systems are often detecting fraud. I haven’t had any fake charges go through in a decade and almost every real charge is approved, even with my crazy travel schedule. However, I’m disappointed in technology in this case.

    Many organizations are engaged in a digital transformation. They’re hiring software developers and trying to take advantage of all the data they have to improve services and efficiency. Security, service, and spending would be served better with a little technology improvement here.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • No Backdoors

    Every once in awhile I hear about someone in law enforcement sure that tech people can build in a safe, secure way for data to be unencrypted by the company or vendor. The latest appears to be from Australia, where the Security Intelligence Organization wants tech companies to build this into products.

    Backdoors never work. Anytime an encryption key is stored, it could be stolen. We see this all the time. Keys are just data, and companies lose data all the time. At scale. Governments are certainly not immune from this. One of the reasons that Azure allows a BYOK (bring your own key) for encryption mechanisms is that many organizations don’t want to trust Microsoft to store their keys. I’m guessing Microsoft doesn’t want the liability, either.

    Many of the data protections an organization might implement are outside the scope of data professionals, but we certainly have responsibilities in this area. We should certainly manage our keys appropriately, and my recommendation for many people is that they have a separate repo and pipeline for the deployment of privileged objects, such as encryption keys. Your organization also ought to have a process (and test it) for key rotation. Keys expire relatively infrequently and the person who last rotated the key might not be available when you realize this process needs to be completed.

    It’s especially important everyone knows how this works for those emergency situations where something expires and none of you realize there’s a problem until a client calls.

    There are plenty of other security mechanisms we ought to be using. Secure your backup files and limit access to shares or even processes that move these files around. In general, limit access to those who need access to everything. Using organizational groups is the best way to do this, along with regular audits to ensure that those who change jobs are removed from groups that aren’t needed. I haven’t seen any organization that has a good process for knowing what positions need what access. I often only see people given new access for a role change, giving them the new roles that match some other employee. This is usually done without any previous access removed when it is no longer needed. The most senior people often have the most access, not because they need it, but because they keep getting new roles.

    Managing security with roles too granularly can become a nightmare, though ensure you use roles everywhere you can while trying to limit the numbers of roles. For most databases, we are giving access to nothing or everything, but there are reasons to limit access for certain data. You might consider two roles by default in most places: one for privileged users and another for everyone.  Easy to ensure new objects get grants to one or both roles and let access be managed by role membership.

    Keep it simple, but keep it secure.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.