• 2 Posts
  • 55 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle






  • I think it’s a fallacy to say that you can or should build an application layer that’s completely DBMS agnostic. Even if you are very careful to only write SQL queries with features that are part of the official SQL standard, you’re still coupled to your particular DBMS’s internal implementations for query compilation, planning, optimization, etc. At enterprise scale, there’s still going to be plenty of queries that suddenly perform like crap, after a DBMS swap.

    In my mind, standardization for things like ODBC or Hibernate or Entity Framework or whatever else isn’t meant to abstract away the underlying DBMS, it’s meant to promote compatibility.

    Not to mention that you’re tying your own hands by locking yourself out of non-standard DBMS features, that you could be REALLY useful to you, if you have the right use-cases. JSON generation and indexing is the big one that comes to mind. Also, geospatial data tables.

    For context, my professional work for the past 6 years is an Oracle/.NET/Browser application, and we are HEAVILY invested in Oracle. Most notably, we do a LOT of ETL, and that all runs exclusively in the DBMS itself, in PL/SQL procedures orchestratedbbybthe Oracle job scheduler. Attempting to do this kind of data manipulation by round-tripping it into .NET code would make things significantly worse.

    So, my opinion could definitely be a result of what’s been normalized for me, in my day job. But I’ve also had a few other collaborative side projects where I think the “don’t try and abstract away the DBMS” advice holds true.



  • Generally speaking, fault protection schemes need only account for one fault at a time, unless you’re a really large business, or some other entity with extra-stringent data protection requirements.

    RAID protects against drive failure faults. Backups protect against drive failure faults as well, but also things like accidental deletions or overwrites of data.

    In order for RAID on backups to make sense, when you already have RAID on your main storage, you’d have to consider drive failures and other data loss to be likely to occur simultaneously. I.E. RAID on your backups only protects you from drive failure occurring WHILE you’re trying to restore a backup. Or maybe more generally, WHILE that backup is in use, say, if you have a legal requirement that you must keep a history of all your data for X years or something (I would argue data like this shouldn’t be classified as backups, though).


  • JakenVeina@lemm.eetoProgramming@programming.devLinux and Winforms
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    4 months ago

    I know folks in the C# Discord have talked about getting WinForms to work on Linux, you could post a question there. But unless you’re specifically dealing with maintaining some legacy app, you should not be using WinForms, much less on Linux. Avalonia or Xamarin are definitely the way to go if you’re making something new and want cross-platform desktop support.

    Protip if you do go down that route: Tutorials tend to ignore the fact that you don’t have to use XAML to make anything in these frameworks. You should. But if it’s more comfortable for you to write WinForms-style imperative code that you’re used to, you 100% can, the APIs are not significantly different.


  • The “base password” concept isn’t completely crazy, I’ve got a friend who claims to have a system like this, to keep all his passwords in memory.

    The key, though, is that the modification to the base is NOT just “usbank” or “facebook” or whatever. If your system for modifying the base is too simple, then if one of the sites you do this for is breached, and its passwords exposed, you can bet that attackers that get ahold of those are smart enough to search for “usbank” and “facebook” and other variations, to figure out what your base password is, and take that and apply it on as many other sites as they can, and may well breach your other accounts.




  • I would be wary of using STIGs as a reference point for good security practices. They are notorious for being poorly-enforced in the real world, and it stems from the fact that they are written too ambiguously. Getting STIG reviewed can have wildly different results just depending on the reviewer’s interpretation of the written text. I’ve seen this first-hand in my job, where we’ve gotten dinged on specific STIGS for code that hasn’t changed in a decade, just because a reviewer decided to interpret a STIG differently than others from the past. And trying to be pro-active about complying with STIG requirements ahead of time always boils down to arguments about “well, what does the STIG MEAN here?”