Voice of the DBA

Tag: Microsoft

  • Stale Data Causes Security Issues

    Security has become better and better in many organizations. At the same time, hackers and malicious actors are doing a better and better job of finding new ways to attack systems. Some work to target specific individuals, often because of government or industrial espionage. Most of us aren’t likely to deal with those issues, unless we work with (or are) someone that is very important in a particular situation.

    Instead, many of us deal with wider spread attacks that look to exploit vulnerabilities in technology or humans at scale, hoping to find the weak links. Lots of people I know have dealt with viruses in the past that shut down systems, and more recently, had to rebuild systems crippled by ransomware.  Despite their best efforts, this often means lots of extra unexpected work, combined with the stress of falling behind on our commitments. We have plenty of other work to do.

    Windows has been vulnerable throughout its history, and it appears, lately through a data problem. There is a class of attacks that look to use approved, though old and unpatched, drivers as a vehicle for gaining a foothold inside a network. This was a problem (called the BYOVD issue) and Microsoft addressed this with a block list that was used to prevent the loading of vulnerable drivers. They updated this list through Windows Update.

    Except they didn’t. In database terms, we had an eventually consistent set of data, which was being updated at Microsoft, but not being sent to client workstations. There were over 3 years of the list not being updated, despite assurances from Microsoft that Windows 10 PCs were protected. There are instructions for manually updating your machine.

    I don’t envy this being a process I’d want to build. Getting data from security researchers or elsewhere, putting it in a database (I hope), then exporting this into a text format and getting that loaded into the Windows Update process, all while trying to ensure the process is secure along the way. That can’t be easy inside a large company like Microsoft. At the same time, not noticing this wasn’t working isn’t excusable. Likely there were issues, but my guess is someone didn’t want to admit a failure and get a bad annual review.

    Data sync issues are nothing new, and many of us struggle with these on a weekly basis. However, these are important issues. Replication can fill log files (and disks), broken ETL processes can cause execs to make poor decisions, and in the security space, not updating drivers and block lists leave us vulnerable.

    This situation isn’t excusable and Microsoft ought to be ashamed. Some of these execs ought to lose bonuses, at the very least. It’s also not excusable in our orgs. We ought to be sure we’re patching on a regular basis and minimizing the attack surface area we present. It’s the least we can do as IT professionals.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Killing IE

    Sort of. Apparently, Microsoft will kill off IE in Feb 2023 in Windows 10. The lifecycle page notes that IE will be permanently disabled with an Edge update. For earlier OSes, it isn’t quite clear what will happen. However, extended support ends this month, Jan 2023, for Windows 7 and 8.

    Does anyone use Windows 8?

    I have used IE many times in my career, but the last decade of so I’ve shuddered every time I need to run it on a server or remote machine. It’s ancient technology that feels cumbersome, much like trying to get something done on a Palm Pilot instead of a modern smartphone.

    I know there are lots of websites and apps that use technology that works in IE, and Microsoft is adding an IE Mode to Edge for those cases.  Microsoft has a “what you need to know” article you can read, but it seems more like an advertisement for Edge than an informative article.

    I could care less about IE, and I mostly don’t think I’ve needed it in years, but I do encounter that technology in a few places. Outlook is the main one where some sort of IE-based control is still being loaded for some authentication mechanisms. I think removing IE is one thing, but getting rid of embedded controls based on IE is going to be a much harder and longer-term issue.

    I know so many developers that used various versions of the browser control in their apps, and I suspect there is no shortage of places that IE tech will continue to be a problem. I’m sure it works most of the time, but probably not always.

    Hopefully, most of you out there use a modern browser for your work, and if you need one inside an application, you use something besides an embedded IE-era control. If you need an alternative, there’s an older Stack answer that might help. Please, use anything by an IE control. It’s time we let that technology retire gracefully in a museum somewhere.

    Steve Jones

  • What Do We Want to See in SQL Server?

    I like the feedback system that Microsoft built for SQL Server. This used to be the Connect system, but all the bug reports and feature requests are now at feedback.azure.com. That’s the place where you can send notes to Microsoft or vote on those that others have submitted.

    In case you are wondering if this makes a difference, it does. Years ago, there pushback for Service Packs from Microsoft, and after a lot of lobbying from myself and others, and a number of votes, Microsoft released more Service Packs for a few versions. They’ve also made a few other changes in the product, or fixed bugs when enough people vote. Not always, but it does happen at times.

    When this system was first released, I wondered if Microsoft would email a digest or some list of items that they had triaged of how the various items were rated. I could see this as a way customers might learn what others think is important, as well as what Microsoft sees as feasible. Maybe where would be some repeat voting that could influence the products’ direction.

    Recently I saw Brent Ozar posted the top 10 items by votes with a few comments. Of the items on this list, I found some interesting ones. I know STRING_SPLIT gets an ordinal in Azure and SQL Server 2022, so that’s one item that MS responded to. I see a few SSMS ones, which are always interesting to me. I’d hope that MS would include a dark theme and the (maybe) the debugger back in as many people request those features. I’m not sold on the debugger, and it wasn’t always stable for me, so I wouldn’t use it, but lots of people like the idea of a debugger. Maybe if it were limited to the dev edition?

    Microsoft looks at the feedback, but the feedback isn’t a vote in their mind. It’s a metric that helps them triage and decides when things are important enough to work on, assuming the effort isn’t extremely high. Working in a software company gives me a better appreciation for the decisions made on which features to include or not, especially given the long-term support effort for any features.

    It can feel hopeless when you vote for something and Microsoft doesn’t build it, but when enough people, especially big customers, want something, it gets built. If you look through the top items, a few have been added to SQL Server 2022. Personally, I want a FOR CSV along with a BULK EXPORT command. I appreciate some difficulties here and possible permission/security issues, but this would be very handy.

    What changes do you want today? Is the dark theme or the debugger at the top of your list or is there something else?

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • My Favorite Data Platform Feature

    At SQL Bits a few weeks back there was a community keynote on Friday. Ben Weissman and Rob Sewell put this together as a fun way of involving others. They invited a number of people to each take 5 minutes and talk about their favorite part of the data platform, which encompasses a wide variety of technologies and products. There were a few people who chose Purview, Azure networking, and quite a few ways of using Power BI.

    Me? I choose the Create button in Azure. Really, Azure itself because of the amazing array of things that you can deploy in minutes. It’s stunning to me to think back to the mid-2000s, when I first saw the Azure platform at TechEd and a Microsoft employee demo’d a key-value table, literally a two-column table. They were trying to sell this as a great way to deploy lookup data to mobile sales applications at scale. I was less than impressed.

    This year I deployed a Synapse workspace in less than 10 minutes. Maybe less than 5. I know little about Synapse, and the idea of building a data warehouse and analytics platform, loading data, and running queries isn’t something I’d think I could do in 10 minutes, but I did it. I’ve found containers to be similarly useful in quickly getting something up and running, but even they require Docker or some other software installed and configured. In Azure, I can set things up in minutes.

    In the last year I’ve set up numerable resources, from databases to web apps to a Kubernetes install. All in minutes, which is quicker than I could do something on my local system except for creating databases. If I had prepped things or had more knowledge that might not be the case, but the lack of needing to prep or learn a lot to get something set up is amazing in and of itself. This is especially true when I want to experiment with a technology or a new solution. I can quickly build an array of systems with much less effort than on-premises.

    I don’t know how many of you use the cloud at work, but I find it amazing. It’s one part of the data platform from Microsoft that I really appreciate, especially as I’ve tried to work with MongoDB, Redis, and other technologies at home. The cloud makes things easier, even with databases.

    Today, I’m wondering what your favorite part of the data platform might be. Is it something in SQL Server? Maybe a related technology? Perhaps something else that helps you work with data these days. Let us know what data platform thing is exciting to your career.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.