Ten Years with MCSD

A few months ago, I downloaded my Microsoft Certified Professional Transcript. The significant portion is shown here:

Ten years ago today, I passed the SQL Server 7.0 exam—the final requirement for MCSD certification.

Remember SQL 7? That was back when none of us really knew whether Microsoft would be a serious player in the RDBMS space. I think we know the answer now.

We started building AdvancedMD using SQL 7, but migrated to SQL 2000 by the time we released. Today, we’re enjoying the T-SQL and data type benefits (think XML) of SQL 2005, and our DCO team is in the process of migrating our primary client database servers to SQL 2008. Combined with Windows Server 2008, it’s giving us some significant performance perks.

Back when I passed Exam 176, we were still basking in the glow of Windows NT 4.0, and the “Option Pack” (including MSMQ and MTS) that came out in 1998. (I started building on MSMQ when it was in beta testing in 1997.)

So…ten years since I passed any sort of Microsoft certification exam, and now I’m waxing nostalgic over a queueing system. I must be getting old…maybe it’s a good thing I’m not writing code any more!

Microsoft SQL Server: World's most secure RDBMS

Hey, that's a pretty controversial headline for a mild-mannered blog like this one! But I think it's supported by evidence.

In November of 2006, Enterprise Strategy Group released an "Information Security Brief" that makes the following conclusions, based on Common Vulnerabilities and Exposures (CVE) data from the National Vulnerability Database:

• Oracle’s results over the past two years show that much work has to be done to bring the vulnerabilities into line with competing database products from IBM, Microsoft, MySQL and Sybase.
• ESG considers Microsoft to be years ahead of Oracle and MySQL in producing secure and reliable database products.
• Microsoft’s results are almost too good to believe, and thus serve as a model for other database vendors.

During that same month, David Litchfield did a separate study based on a broader set of data and reported:

• It is immediately apparent...that Microsoft SQL Server has a stronger security posture than the Oracle RDBMS.
• The conclusion is clear – if security robustness and a high degree of assurance are concerns when looking to purchase database server software – given these results one should not be looking at Oracle as a serious contender.

Even before those reports were compiled, Cesar Cerrudo of Argeniss put together this presentation in which he provides lists of Oracle security flaws and SQL Server security strengths and asks, in apparent exasperation, "Why do you think [Oracle] is Secure?" And, "Why do you think [Microsoft] is not Secure?"

It's interesting that Microsoft has several pages on its website where you can find articles like these (albeit not these specific ones) touting the security of SQL Server, while I couldn't find anything on Oracles site (and I looked) citing independent analyses that provide evidence that Oracle is more secure than SQL Server...and Oracle has had a couple of years to respond.

OK...so, all of this does NOT mean that SQL Server is better than Oracle. Recent releases of Oracle 11g and related products offer all kinds of features that SQL Server doesn't. I'm certain that there are literally thousands of companies currently using Oracle that would be foolish to consider a switch to SQL Server. There may even be hundreds of companies that should seriously consider switching from SQL Server to Oracle, for any number of valid reasons.

But, c'mon, think about it: Microsoft SQL Server more secure than Oracle??? Are we talking about the same Microsoft and Oracle? Unbreakable Oracle?

And don't forget that ESG found SQL Server to be more secure than MySQL...and MySQL doesn't have a target painted on its back. Hackers exploiting flaws in MySQL would be like animal rights activists vandalizing PETA headquarters. Well, not exactly, but it makes an entertaining simile.

In any case, SQL Server has worked great for us. We're looking forward to using some of the features in SQL Server 2008. I'll try to describe how we end up taking advantage of those features in future posts.

SQL2008: Solving the file system vs. database BLOB quandary

I found a recent post on The Data Platform Insider blog very interesting:

One of the most exciting new features in SQL Server 2008 is the ability to store files and BLOBs directly in the file system, while maintaining transactional consistency with a SQL Server 2008 database. SQL Server 2008’s new FILESTREAM attribute for VARBINARY data type solves the age old dilemma facing developers and IT Pros: Is it better to store files directly in a database or store them in the file system with path and filenames stored back in tables to maintain the relationship with the database?

We've been fighting with this for years, for all of the reasons cited in the blog posting.

It doesn't solve one big problem, though: Some of our customers have multiple gigabytes of images and documents each. Add that to half a gig or more of transactional data, and then multiply that by a few hundred customer databases, and you've got a real challenge storing and moving database backups around.

To paraphrase (and, apparently, misquote) Senator Everett Dirkson, "A terabyte here, a terabyte there, and pretty soon you're talking a lot of data."

It's good to be king!

Only Microsoft could get away with launching a product that won't actually be released for another six months or so.

Was it just me, or was anyone else expecting a concurrent release of Windows Server 2008, Visual Studio 2008, and SQL Server 2008?

Turns out we were confused. What's been happening all around the world for the past several weeks at "Heroes Happen Here" events, is the launch of those three products, not the release.

Apparently, "launches" no longer have to coincide with "releases", as attested by Microsoft's announcement of the delayed release of SQL Server 2008, in a post on The Data Platform Insider blog on January 25, 2008.

That delay is no big deal, of course--SQL2005 is a fine product, and I think we'd all agree that a high-quality release is more important than a quick one. Just disappointing...especially to our Engineering and IT teams, who have their eyes on a couple of the juicier features.

As Joe Wilcox says on eWeek's Microsoft Watch, Microsoft doesn't need to rush, because those of us who license Microsoft products under their SPLA or annuity models are going to keep ponying up the cash in anticipation. The only possible downside may be the acquisition of MySQL by Sun. (Huh? A billion bucks for "free" software?)