Voice of the DBA

Tag: sql server

  • SQL Injection Everywhere

    I hope no one SQL Injects my washer

    I was doing the laundry the other day and thinking about SQL Injection. I have this fancy front load model that lets me load fabric softener and bleach into containers for release later, and it occurred to me that if my washing machine were connected to the Internet with some API, it’s possible someone could SQL Inject or buffer overrun a string that might release a stream of bleach into my colors.

    Not terribly dangerous, but it could be annoying, and it is exactly the type of hack some bored teenager would come up with. Then I started thinking about what else they might do. I wrote about the possibilities with cars recently, but what else could a hacker do in a connected world. What if someone could ignite my oven? Likely it wouldn’t do much more than cost me money. Turning up my fridge might make a mess of food, but not dangerous. However what if someone could turn off the lights when they saw you start running down the stairs?  That could be dangerous.

    What if they could remotely enable your sprinklers while you were at work. In some places that could result in a fine. Allowing that to happen a few times might get you arrested. Locking or unlocking your car doors (already a remote possibility) could endanger you. I’m sure there are more malicious possibilities I haven’t thought of, and as we move to a more connected world, I worry we will discover them only when some crime has been committed.

    I like the convenience of adding digital controls and remotes to more parts of our lives, but I do worry that we are doing so in a way that ignores security. Linking the convenience items of our lives to remote digital controls can be dangerous enough. Adding in more essential items, like heating, engines, etc., to the same control bus could be fatal.

    SQL Injection will likely be around for a long time, and it will get used in many new ways as more and more aspects of our lives are digitized. All developers should be aware of how an injection attack occurs, and code to be sure that we don’t allow any un-sanitized input into any of our databases, and that we also require separate authentication for the parts of a system that need more security.

    Steve Jones

    The Voice of the DBA Podcasts

  • The Standard Edition Wish List

    The SQL Server Platform. What does Standard Edition Need?

    I wrote recently about what might differentiate Enterprise Edition from Standard Edition, and there were some great responses from people. I don’t know if Microsoft will change the way they manage editions, but I know they are aware of the discussions on SQLServerCentral.

    This week, however, I wanted to turn things around. I’ve seen a few people talk about the reasons why Enterprise Edition makes sense, or what value you get. That’s good, but what about the people that are just stuck on Standard Edition? Corporate budgets are still tight, and many people might not even upgrade from their current version to SQL 11, even at Standard Edition.

    I wanted to see what might make the different for people in those situations. If there’s no hope for Enterprise Edition and you are even debating upgrading to the next Standard Edition version of SQL Server, answer this:

    What would you like to see in Standard Edition?

    If you had a wish list and could decide that one feature would get moved to Standard Edition, leave us a note in the discussion. Is there any one feature that would make a compelling case for your company to upgrade half their database servers to SQL 11?

    Enterprise has many things that you get with that large licensing cost: data compression, larger clustering limits, Resource Governor, partitioning, mirrored backups and more. It’s quite a list of features, but for me,  I’d like to have the ability with Resource Governor to limit the impact of certain groups of users on the server. I’d especially like to be able to throttle down the maintenance operations so they didn’t impact performance as much.

    Let me know this Friday what you really want to see in Standard Edition.

    Steve Jones

    The Voice of the DBA Podcasts

  • Am I a sysadmin? (or other SQL Server role)

    How do you check if you are a sysadmin? It’s fairly easy to do in Management Studio. You can go to Security \ Server Roles \ Sysadmin, as shown here:

    sysadmin1

    You right click sysadmin and click properties to get a list of sysadmins. You can do this for any role, and that’s the easy way if you want to verify permissions.

    sysadmin2

    What if you have an open connection to the server, say in a Query window or Powershell session and want to verify your role. There’s a function to help you: Is_SrvrRoleMember().

    If you execute something like this: 

    SELECT IS_SRVROLEMEMBER('sysadmin');

    You’ll get a one back if you are a member of that role, and a 0 otherwise. That will allow you to easily determine your current permissions, or check permissions programatically and continue on with your work depending on the results.

  • How to Fix Connect

    Microsoft Connect is the place to submit feedback

    The Connect system is the main way that all of us can feed back information on SQL Server to Microsoft . You can use this system to submit a bug or a suggestion, and your submission will go to the SQL Server development team so that they can respond. There is the ability to comment on other people’s posts, view workarounds that Microsoft or another user have posted, and vote a suggestion up or down. A great example that’s one of the most voted on items is the Create or Replace idea.

    Recently a large number of Connect items were closed, including a few that I had submitted. Based on all the Twitter comments, it seems that most of these items were closed and marked as “Won’t Fix”, which I assume means these will not be fixed for SQL 11.

    That’s good and bad. Having watched the Connect Feed for SQL Server, I’m surprised by some of the suggestions that I see come through. While I can appreciate someone wanting to know when SQL 11 “Denali” will be released, I’m not sure it’s worth a Connect submission. Or this brilliant duplicate indexes note. I feel bad for the people that triage these requests since these not-very-well-thought-out submissions create ill will and waste time. How would you like to get these type of suggestions for your software? My guess is most of these suggestions ought to be closed and this was a good thing.

    But it’s also discouraging for those of us that submit feedback and don’t necessarily get a good response on why our feedback doesn’t make sense, especially when you have dozens of people voting for the idea.

    For a long time I really liked the SQLWish email address where one could send ideas to Microsoft. That was discontinued in favor of Connect, which I think is a good idea. However I think Connect has a scale problem and doesn’t necessarily work as well for “ideas” as it does for bugs.

    I’m not sure how we can fix it, but one thing I’d like to see is a ranking of the top xx items that could be considered for the next version. Feed that back to the community and let us give you opinions on whether or not those items are still important. I know we can’t necessarily drive development, but I do think that SQL Server can evolve into a product that we are more likely to upgrade if our feedback is visibly and obviously considered.

    Steve Jones

    The Voice of the DBA Podcasts