Voice of the DBA

Tag: syndicated

  • Don’t Use MD5

    “The hashing alone being MD5 tells me that they really don’t care about their passwords too much, so it’s probably some pre-generated site.”

    That was from this article on an Anatomy of a Hack. It’s an interesting quote, and it shows a few things.

    First, we have a history issue with our frameworks and the lack of updates as we learn more about a technology, or circumstances change. This could be that frameworks are not being updated. It could be that developers are not updating their frameworks. It could be that they are downloading the wrong versions.

    The bottom line is that older technologies, those that have vulnerabilities, are still being used. If you use encryption for passwords, don’t use MD5, and I’d say that SHA1 is a bad idea. If you are on a version of SQL Server prior to 2012, SHA2 is not available, but with the SQL CLR and SHA2 in .NET, you can write your own.

  • Speakers: Rehearsals Help

    Today was a rehearsal day. Actually the last 2-3 days of work have been split between rehearsing talks that I’m giving at SQL in the City this week, and handling the other daily work I need to do. With an extra load of family chores this week, I’ve had some long days.

    I have quite a load this Friday as I have 4 talks to give.

    • One I’ve given 10 or 15 times, and I just need to review.
    • One I gave earlier this year, but it’s been rewritten with about half new content.
    • One is brand new, never delivered
    • One is a joint presentation, of which I have few parts, but I do need to be ready for those parts.

    When I work on presentations, I go through the deck, build demos, practice things, maybe go back and forth a few times as I find the flow between the items is not smooth. By the time I’m ready for a full hour practice, I’ve usually been through all demos and the slides a dozen or so times.

    The Whole Enchilada

    However going through everything in one shot is important. Your timing matters, and your smoothness in transitioning between talking, demos, and even the various elements you deal with on the screen. When I see a presenter struggle to find a setting or a button on the screen, I’m think they haven’t practiced enough, especially the whole talk.

    It’s very easy to work on parts of the talk, maybe even all parts, separately and assume you can pull them together. When you do this, however, you tend to gloss over mistakes and tell yourself that you’ll fix things the next time. At some point the next time is the actual presentation to an audience, and that’s not the right time to deliver the entire talk the first time.

    I usually set aside an hour, and actually go through the talk from end to end. I may do this silently, running through the words I want to use in my head so that my family doesn’t think I’ve gone insane, talking to myself. I’ve learned if that’s the case, I’m usually talking 15-20% faster than if I actually had to voice the words. It’s quicker to practice this way, and I’ll do this a few times. I even do this on airplanes when I’m traveling to events.

    However there’s nothing quite like delivering the talk out loud, in real time. I usually do this by myself, with the door closed so as not to frighten the children with my arm waving and pacing. I open my mobile phone’s stopwatch application, start it, and keep an eye on it as I run through the slides, talk, and demos in real time.

    A Sigh of Relief

    Today was a full practice day for 2 talks, but with a twist. One of those, the brand new talk, was one I had to give on a conference call to a few people at Red Gate. This was partially to let the project managers know what I was demoing, but also as a backup in case something happened and I wasn’t able to deliver the talk.

    After about 20 minutes of Livemeeting issues, I finally was online and ready to go. I was short of time, so I ended up going through the synopsis of each slide, and then running through most of the demos, skipping a few items where my virtual machine was acting up. It wasn’t the best run-through, but it was complete.

    When I was done, it was nice to hear the people on the other end complement the talk and content. It’s always a little worrisome for me with a new talk, since I’m never sure how well people might receive the content. A sigh of relief today that people liked the talks.

    Recordings

    One of the things I did recently to practice a talk was to record myself. Using Camtasia, I delivered the entire talk to myself, recording the session. I was able to review it later, look for spots where the content did not flow together, as well as speaking issues (um, err, etc).

    I found that to be very helpful in terms of delivering a better talk, and building confidence in the material. I found that after recording myself, reviewing the talk, and incorporating my own critique into the talk, it went much smoother than expected in front of a live audience.

    Practice

    If you plan on delivering a talk, practice it beforehand. The whole talk, in real time. It will help you prepare and you will be surprised how much it might reduce your anxiety.

  • SQL in the City Goes Mobile

    sitc_e.jpgThis week is the kickoff of the third year of SQL in the City from Red Gate. As we have the other years, we start 2013 off in London, and I’ll be leaving Wednesday on a quick trip across the water to speak. I’m looking forward to seeing lots of familiar faces and a few new ones as well. These events are always fun and well run by the staff from Red Gate. We have a new venue this year, the Congress Centre in the West End as well, which means more Underground map reading and memories for me as I make my way across the city from Heathrow. I lived just off Bayswater Road for a semester in college and it’s always nice to wander around the area and look for familiar landmarks.

    We’ve gone mobile this year, so if you’re coming to the event, check out our app at http://m.twoppy.com/sitc-ldn/, It’s a great way to get information on the event and follow along with what’s happening. I don’t know how much I’ll be tweeting this year since I’ve got four talks scheduled, but I’ll get a few in here and there.

    The event is full, so if you aren’t coming, please cancel and allow someone from the waiting list to take your place.

    If you’re in the US, our fall our will kick off in California in October and make it’s way across the US for 2 additional dates. You can get more information at the SQL in the City site.

    See you in London.

  • T-SQL Tuesday #43–Hello, Operator?

    tsqltuesdayIt’s T-SQL Tuesday time, and this one is a bit of a challenge for me. Rob Farley is hosting, and asking for people to write on Plan Operators, those various elements that go into the execution plans in T-SQL. I don’t dive too deeply into these items, unlike some others, so I’m going to tackle this at a high level with something I learned a few years back, but a few years after I started working with execution plans.

    T-SQL Tuesday is the monthly blog party from Adam Machanic. It’s the second Tuesday of each month and if you want to participate, watch for the announcement on Twitter, or Google search it and then publish a post on the specified day, GMT time. If you want to host, you need a blog, need to participate, and then contact Adam.

    Parallel Operators

    Many of us know that execution plans can be serial or parallel. Which plan we want depends on the situation, but you can determine which plan is being executed from the plan. However I didn’t know the depth to which I could determine the parallel plans from the images.

    When I first looked at the Graphical Execution Plan Operator Icon page, I saw a lot of operators, many of which I’ve seen in the past. There’s a section for parallel operators, and if you look at it, you only see three items: the Distribute Streams, Repartition Streams, and Gather Streams icons. I’ve shown that section below.

    parallel

    These operators work to combine to separate out the data into separate parallel operators. If you see these items in your plan, you know there are some parallel operations.

    However, do you know which operations are parallel?

    If you look at the nonclustered index seek operator, it looks like this:

    nci

    The description doesn’t say anything about this being serial or parallel. This icon is serial.

    A parallel icon looks like the one shown in the image below (from Paul White’s Forcing a Parallel Query Execution Plan). It’s the lower right icon in the image.

    parallel2

    Note that the icon has two arrows overlaid on it. In fact, this is a parallel plan that has a parallel clustered index scan, a parallel nonclustered index scan, two repartition streams (parallelism operators), a parallel merge join (top row, second from the left) and a gather streams (parallelism operator). Lots of parallel work being done.

    If you look at an execution plan, you can tell which items are parallel with those two arrows overlaid on the icon.