Voice of the DBA

Tag: Database Weekly

  • Should we outsource identity management

    My Database Weekly editorial for Jan 30, 2012

    One of the first things many people build when they’re developing an application these days on the web is a login/identity system for their users. This allows them to identify people, customize the features and functions, and separate out the different classes of users from each other. However many developers don’t really understand good, secure design, much less encryption, and end up “storing passwords hair kari in unsecured databases”, a quote from this piece on password security.

    I’d hope that most developers know that passwords should be stored in a digest (one-way hash) form, but that’s like assuming most developers understand the issues with SQL Injection. It’s not true, and not necessarily going to be true until, well, it’s not likely to ever be true. Even if we had minimum standards, there are plenty of developers that would ignore them and plow forward with the arrogance that their custom method is better implemented, and more secure, than any standard.

    Passwords and password security are hard. I’d hope that most people would be looking to move to passphrases instead of passwords, but I don’t see the recommendations being widely disseminated in the world. I recently rebuilt a computer, requiring my kids to implement new credentials, and my recommendation was a simple phrase they can remember with a number. I was hoping it would serve the dual purpose of instilling good security habits as well as improving their typing skills. We’ll see if it helps.

    With large rainbow tables, creative social engineering, and poor application security, it’s even more important now that we use passphrases, and even develop better identity frameworks for applications. Personally I liked the Passport system Microsoft had, and I like the OAuth system even better. Perhaps we can get more of these frameworks implemented in reference applications and frameworks, as a default way of managing identity systems.

    That’s the easy part; convincing developers they can’t manage identity better is probably the hard part and I would love to see some good ideas for that.

    Steve Jones

  • No Overtime

    overtime clock
    Are you working too much?

    It’s been a long time since I received overtime at any job. Most of my IT work has been with a salary, and the expectation that I would work as needed to accomplish my assignments. Early in my career I worked as a contract for an hourly rate, and while it didn’t necessarily lower the hours I worked, I did receive a little more pay on long weeks. From there I worked for a company that provided “comp time” when the hours exceeded 20 hours in a month. That seemed to help reduce hours more than anything.

    There’s a bill that’s in the US Congress that adds some new job classifications to the exemptions for overtime pay. In addition to the system administrative jobs, it now includes database and network professionals. I’m not sure how many people this affects as the overtime requirements disappear once you make more than $27.63 an hour. That equates to about an annual salary of 57,491, without the benefits. If you make less than this, you should be getting overtime.

    Does overtime pay matter to most IT workers? I don’t know. There are lots of workers who make more than US$60,000 a year, and are exempt, but I suspect there are many others who make less than this amount and work long hours without any extra compensation. This bill is aimed squarely at reducing pay for those people in the industry that make the least amount of money.

    I struggle with whether the benefits and abuses of a salary. On one hand salaries provide a level of security to workers, along with a guarantee of payment for work that cannot easily be measured in terms of output per unit of time. On the other hand, employers sometimes see a salary as a way to push workers to their limits, burn them out, and impose strict requirements on the work needed for deadlines, themselves often arbitrary.

    I like the idea of allowing businesses to pay salaries, and stabilize their cost structures, but I do think we ought to implement a few bumpers that prevent abuses. Limiting hours across a month or quarter and ensuring that employees can take their vacations would be limits that I’d like to see implemented. This bill doesn’t affect those and I’m not sure we’ll see any limits implemented, but I do think it’s up to each person to stand up to their employer and ensure they are not overworking themselves.

    Steve Jones

  • A Variety of Interpretations

    What have you automated?

    Each month I look forward to T-SQL Tuesday week when there is a blog party. This is the brainchild of Adam Machanic (Blog|Twitter), and is usually hosted by a different person each month. I hosted December 2010, and that was probably the first time I wrote a post more than a day before the post date. It seems more people

    This month Pat Wright chose the topic of Automation, leaving it simply as that word to inspire people. His summary showed that 34 people participated and left trackbacks on his blog. I read through a number of them, and was struck that this month is seemed that people interpreted the topic very differently.

    You might expect that many people talked about SQL Agent, and they did, but there were some fascinating thoughts on how automation impacts an environment. Jason Bacani talked about data driven subcriptions in SSRS, which many people might not be aware of. These solve the problem of deliverying reports automatically to people, but in this case, the reports were not working. A little automation solves the problem and keeps the business running. Ted Krueger helps the DBA out by giving us a script to remove NOLOCK from code. An interesting way to enforce the rules that you might want to have in your environment. Grant Fritchey talks about keeping server side traces running all the time with a little automation to manage the process.

    There are a variety of other techniques, including getting a testing environment setup with Powershell. These ideas are inspiring, and they are the reason that I think events like T-SQL Tuesday are a great idea. They make me think widely, and re-examine the tools that I have with SQL Server, and how I might deploy those tools in a new way.

    Check out T-SQL Tuesday next month, and contact Adam if you’re interested in hosting one in the future.

    Steve Jones