Voice of the DBA

Tag: software development

  • Source Code Security

    I’m not surprised, and I had expected to read about something like this much sooner. Apparently someone at the ride sharing company, Uber, posted a security key online in a GitHub distribution. I assume this was some sort of code repository for Uber that may or may not have been supposed to be shared publicly, but having used GitHub, I could see someone making a mistake and accidentally putting private code in the public space.

    Uber is worried as the key is a security authorization key used to access their databases. Someone apparently downloaded Uber database files and now Uber is attempting to track them down. The whole situation is a mess, but there are a number of problems here that we could learn from.

    I give a talk on encryption options in SQL Server and one of the main problems I see with symmetric keys in SQL Server is that they can be reproduced with the same parameters passed to CREATE SYMMETRIC KEY. This means that your source code is now a security hole, at least if the production values are stored in a VCS.

    However that’s a no-no. Developers shouldn’t have access to account information or keys that are used in production. There should be separate credentials used in development, precisely for this reason. If someone gets your code, or hacks a dev machine, they shouldn’t be able to jump to production.

    There’s also the issue of using a service like GitHub, or any online VCS. The distinction between private code and public code shouldn’t count on a human checking or un-checking the right box. I’d like to see some better separation, perhaps requiring separate accounts and connections for public and private distributions.

    As we see here, convenience can easily result in poor security. That’s not a trade-off we should be making with our security and applications. Especially not for software developers.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.5MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Software Engineering in Practice

    I ran across a review of a developer’s first year at a company. The company is endjin and the poster describes their first year as a “software engineer apprentice,” which is an interesting way to look at one’s early career. While it’s not for everyone, I suspect that many developers in this business could actually use a bit of apprentice time to solidify their foundation of knowledge.

    The post talks more about the way in which the work is done than the actual tools involved. A few are mentioned, but this is really a look back at the philosophical way in which the company solves problems. More importantly, it’s the view of an apprentice learning a trade.

    I wonder if this apprenticeship mentality might make a good approach for DBAs. It seems so many people working with databases lack fundamental SQL skills and even thoughtful approaches to solving problems. There are people that grow to be experts by diligently working through complex problems on their own, but it seems most people don’t get solid grounding in relational principles, or even learn good engineering practices, like measuring systems before and after changes are made.

    Many companies rush to get work done. They want code written quickly, which I completely understand. However if your staff isn’t well grounded in building solid code, then I’m not sure that poorly written applications are getting work done quickly. I suspect they’re just getting something done, which then has to be fixed, enhanced, and refactored before it allows work to move faster (if at all).

    All of that takes place in the time that it might take someone with more skill to do it well the first time.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.0MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • The Worst Comments

    I was watching a presentation recently on refactoring C# code and was amazed by some of the comments that the speakers showed in the code. The example was a real application that had been obfuscated and simplified a bit for the talk. The comments, however, had only been changed when they might disclose a specific person or company. The speakers pointed out a few of those changes, but also noted that most of the comments were verbatim from the original code.

    Comments like “Dave changed this from the old way”  or “Bug 445: as per the operations group” were good examples of bad comments. These items don’t really help a developer understand the code. The comments in application code should be there to add to the code itself, helping someone understand a reason for the code, not an obscure reference or an obvious statement (“this code adds two balances together).

    With that in mind, I’m sure many of you have come across some comments in code that have evoked a wide range of emotions. I’m sure you’ve been frustrated, annoyed, or something else. Perhaps even from your own comments. With that in mind…

    What are the worst comments you have found in code?

    I hope you don’t have examples in your current application, but perhaps you do. Perhaps you have even committed your own code recently without really taking the time to accurately describe the change. Maybe you want to go look in your VCS and see what you’ve entered lately.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.0MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • The Design Investment

    This editorial was originally published on Sept 29, 2010. It is being re-run as Steve is traveling.

    I ran across a bit of a rant from Don Halloran on the lack of design effort being made in many applications and software. He talks about a lack of consistency in databases, confusing column names and datatypes not used correctly. Don laments that “It seems database design doesn’t get much respect, and I really don’t understand why this is.”

    We all probably have some idea of why systems get built like this: the designer is ignorant, or lazy, or maybe doesn’t pay attention because it’s not part of their job. Any reason could fit, but ultimately it comes down to someone taking on a job without making the investment in their own career.

    If I were putting tile in my own bathroom, I accept a few mistakes, and I might cut some corners. I might be happy to accept a little fumbling around while cutting tile. I would not, however, put up with that if I were paying someone. I would expect a more professional job. If I decided to change careers and lay tile for a living, I’d also expect to make an investment in my own skills to learn how to do a professional job.

    I understand that developers are paid to write code, and that they are more interested in manipulating objects, methods and properties and implementing DR or indexing. If you plan on working with SQL Server, it pays to make the investment in learning how to do it properly. If for not other reason than because you should consider if part of your professional responsibility.

     

    Steve Jones