And I ask once again… why do people run Oracle?

www.businessinsider.com/yikes-oracle-issues-emergency-fix-for-a-big-fat-security-problem-2012-1?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+businessinsider+%28Business+Insider%29

1. Systems require security. Hard stop. no if’s and’s or but’s about it. Designing security from the start is a hard task. At Microsoft there are several practices and resources we use to design and evaluate security. These have been in place for ~10 years and have been refined. My assessment is it’s working. Look at the security track record for SQL2K5 through SQL2K8R2. Pretty darn solid, especially when compared to Oracle. We spent a significant amount of time reviewing existing product functionality and in designing and testing new functionality. It’s simple ignorance to release new infrastructure software, much less anything else, without designing for security.

2. It’s additional ignorance like the following that cause me serious concern; from the same article:

“While [James Phillips, co-founder and senior vice president of products for Couchbase, a NoSQL platform firm] agrees that there is still an experience gap with such a new technology, he believes that some of the security concerns should be at least a little quelled if organizations consider the typical use case for NoSQL. He believes that these data stores usually contain less sensitive information than the typical relational database and that they tend to have limited touch points to other applications within the enterprise network.”

What in the world does “less sensitive information” mean? Philips goes on to say:

“"They're using the technology not as a database per se, like you would consider perhaps an enterprise data store where you're collecting and aggregating lots of the business data of the organization that other apps are going to tie into," he says. "Rather, if I'm building a social network or social game or building a very specific web application that has certain functionality, it tends to sit behind the firewall and it ties to this application and usually isn't available for other parts of organization to tap."”

The belief that security attacks only come from outside the organization is pure ignorance. The belief that security concerns will be quelled if the implementers of the technology consider the typical use case for NoSQL is another example of ignorance. And finally the characterization that only social network and social game companies are going to use NoSQL and that they don’t hold sensitive data is flabbergasting; think of the Sony incident.

My intent isn’t to personally attack Mr. Phillips. I’m sure there are many people in the software industry that use the same spin when it suits them or or their company’s product. Imagine if Microsoft or IBM took the same stance as Couchbase? Couchbase considers themselves a platform company. Their lack of outward concern for security is proof they are not a platform company.

I want to state again that I have nothing personal toward Mr. Phillips or his company. I’ve never met him or used his company’s product. But he is simply doing NoSQL and his company a disservice by attempting to downplay the lack of security in NoSQL.

As I said, adding security after the fact is extremely hard. But this doesn’t mean we should give up or position the technology as not needing it. As an IT professional it’s your responsibility to understand the benefits and limitation of all technology you implement, do a security review and ensure it meets the business requirements. Hard Stop!

The presentation and scripts can be found here. Two questions came up which I couldn’t answer on the spot: 1) what is the load precedence of profiles and 2) what PowerShell books would I recommend.

Profile Load Precedence

msdn.microsoft.com/en-us/library/bb613488(v=VS.85).aspx

The profiles are listed in load order. The most specific profiles have precedence over less specific profiles where they apply.

• %windir%\system32\WindowsPowerShell\v1.0\profile.ps1
• %windir%\system32\WindowsPowerShell\v1.0\ Microsoft.PowerShell_profile.ps1
• %UserProfile%\My Documents\WindowsPowerShell\profile.ps1
• %UserProfile%\My Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

PowerShell Book Suggestion

Learn PowerShell in a Month of Lunches by Don Jones (no relation)

Windows PowerShell in Action, Second Edition by Bruce Payette

You can download it here.

This is a feature rich CTP and is deserving of your attention, though I can’t discuss where this falls into the overall release schedule – we haven’t made any official announcements and I’m not doing so here, that’s beyond my pay grade.

Download, install, exercise it and give us feedback!

Here are some areas to delve into and how to give us feedback.

Now is the time to test new features and send us feedback!

Download SQL Server "Denali" CTP3 - here!

Microsoft Connect is the place to submit bugs. This tool connects right into our bug tracking database, Team Foundation Server.

To promote your participation in testing SQL Server Code Name “Denali” we are running the Feedback Challenge.

Starting on Friday August 19, we will be sending SQL Server gifts packs valued at $30 to each person who submits bugs or provides feedback on how we can improve SQL Server Code Name “Denali” up through August 31, 2011 (or to the first 300 respondents).

Here are a list of areas we want your feedback:

• Database Engine Features
  • AlwaysOn
  • Beyond Relational
  • Development & Management
  • Others
• BI Features
  • Project Crescent
  • Analysis Services
• Other Areas
  • Product Update
  • Data Quality Services
  • Master Data Services

AlwaysOn

• AlwaysOn Availability Groups
  • Sync/Async data movement configurations
  • Automatic failover with Sync
  • Quorum configurations and Disaster Recovery
  • Client connectivity configuration via AG Listener
  • Setup, Deployment, Management experiences
• AlwaysOn Failover Cluster Instances Enhancements
  • Stretch Clustering
  • Configurable Failure Detection Levels
  • Failover/Recovery time enhancements
• Windows Server Core support
• Manageability (Management Studio, PowerShell, Monitoring, T-SQL)

Beyond Relational

• FileTable functionality and performance
• Semantic Search
• Fulltext Search functionality & performance 

Development & Management

• Contained Databases
• Project “Juneau”
• Management Studio
• PowerShell 2.0 Support
• Data-tier Application (DAC)

Others

• Columnstore Indexes
• LocalDB
• Extended Events Profiler & Distributed Replay

Project Crescent

• More information on Project Crescent

Analysis Services

• Tabular Modeling
• Tabular Model Solutions
• Extended Events

Product Update

• More information on testing the new Product Update feature

Data Quality Services

• More information on Data Quality Services

Master Data Services

• More information on Master Data Services

We need your help testing this feature.

Peter Saddow, of the Deployment Platform team, has a comprehensive blog post detailing how to test this feature, therefore I won’t repeat it here.

Thanks in advance for helping make “Denali” the best release of SQL Server yet.

As we’re in the early stages I have yet to reach any conclusions on which communities we should engage with and how we should engage.

This means it’s the perfect time for you to share your thoughts and insights. Some of the areas I’d like to hear from you include:  Which communities do you spend your time? Which hashtags do you follow? What LinkedIn groups are you part of? Where would you like us to engage? What would you like to see us do more/less of?

I’m a big believer in listening to customers and users who ultimately make a community strong and vibrant. While I can’t respond to each, I promise you I read each and every comment. Thank you in advance for sharing.

For whatever reason the words evangelism and evangelist, in the tech community, have been casted in a negative light.  But I happen to really like them to describe certain people in the SQL Server community, namely MVPs.

Merriam-Webster defines evangelist as an enthusiastic advocate. The Encarta World English Dictionary defines Evangelism as great enthusiasm, fervor or zeal for a particular cause.

Isn’t this a huge part of what MVPs are? After all why would they spend their own money traveling to conferences both big (SQL PASS) and small (SQL Saturday)? Why would they go on SQL Server themed cruises? Why would they spend as much time as they do blogging and answering questions on #sqlhelp?

I’ve said here before I believe MVPs do a fantastic and selfless job in the community. They are an incredibly important part of the community. Their technical and operational knowledge of the product is top notch. Their passion shines through on a daily basis.

Take the characterization as evangelist as a complement. That’s the way it’s intended.

The first problem is being on outdated hardware and software. This doesn’t just exist on the desktop but also in the data center. There are still an incredible number of system still running Windows XP (I don’t have any specific numbers so this is anecdotal evidence). Windows XP was released at the end of 2001. I also talk to a number of people who have laptops or desktops that are four or more years old. Back in the data center the story is a bit better. Again this is anecdotal evidence but I’m seeing the instances of Windows Server 2003 dwindle and I see almost no Windows Server 2000. As for SQL Server, while there is still a somewhat hefty number of databases on SQL Server 2000 that number it dropping pretty rapidly, though not as fast as I’d like to see. I’m not saying that companies have to be on the bleeding edge of technology, but being on any technology that’s more than six or seven years old is plain negligent.

The second problem is outdated applications. When I was in IT our primary mission was to support the business. This entailed updating existing applications to support changing business requirements and writing new applications in support of new business opportunities and needs. There’s been plenty of articles and blog posts on the consumerization of IT. This effectively means for the first time in the history of IT consumers have access to more cutting edge technology than what IT is making available to solve business problems. I blame this back on the extremely tight IT budgets and the lack of vision by company leaders to see the value of funding IT.

So far I haven’t said a word about pilot projects – the title of this posting. Before 2000 my company used pilot projects to try out new technologies (hardware and software). We would start with small targeted projects using well defined metrics to track success. Some of them were successful and resulted in broader rollout and usage. Others, the majority, were harvested for learning and then shelved. The point isn’t to track your success rate but rather to keep trying out new things. Almost every consumer products company (think P&G) does this with new products and they’re not afraid to shoot poor performing products in the head, quickly.

I like the mantra of “fail fast”. It sets the right mindset that failures are going to happen but without them change and innovation doesn’t happen. In IT this is equivalent to running pilot projects. Take Windows Azure, for example. Many of the survey results I see ask the wrong sets of questions which I believe lead ITDMs (IT Decision Makers) down the wrong path and cloud their thinking (pun intended). Every company should either have Cloud Computing already baked into their IT strategy or at the very least have a handful of pilot projects trying out different cloud providers to solve various business problems.

Today I wouldn’t go work for a company that had its head in the sand regarding cloud. And I certainly wouldn’t work for a company that was still running Windows XP. Both speak volumes about the IT leadership and the value (or lack there of) the company places on technology.