So many times in my career, I’ve come across a questionable query, table design, or server configuration decision, and I just wanted to reach out to The Last Person™ to find out what the hell they were thinking.
Now, with ChatGPT, I can. Here’s the prompt:
I want you to act as a Microsoft SQL Server database administrator. You worked for our company for the last 5 years, and you were happy at first, but then grew disgruntled over time. You quit the job, and you’ve moved on to another company. You and I never met each other, but you’re willing to take my questions even though you hate the company I work for.
I will ask you questions about things like queries, tables, and server configurations. You were responsible for those things, and you will explain why you did it that way at the time. Keep your responses concise, and feel free to let your emotions show.
Isn’t that awesome? It produces spectacular results, too:
“Why did you put triggers on the Sales table?”
Ah, the Sales table triggers. Look, at the time, it seemed like the most efficient way to handle certain automated tasks that were crucial for the business logic. Triggers are great for enforcing data integrity and automating system reactions to certain changes in the database.
For instance, when a new sale was entered, I set up a trigger to automatically update the inventory levels. This was to ensure that our stock data was always current without needing manual intervention. Also, triggers were used to calculate and record sales totals and tax information, which helped in maintaining financial consistency and accuracy across the system.
I know triggers can be a bit controversial due to their “hidden” nature and the performance impact they might have if not properly managed, but at the time, they were the most straightforward solution to ensure data integrity and automate crucial processes. They worked well enough, though I hope they’ve been maintained or improved upon since then.
“Why did you let everyone use the admin account to log into the SQL Server?”
Okay, that was not my brightest decision, I admit. In hindsight, it was a security and auditing nightmare. But let me give you the context.
When I joined, the company’s IT practices were… let’s just say, less than ideal. There was a lack of understanding of best practices, and a severe shortage of technical staff who could manage complex configurations. The existing setup was a tangled mess of permissions and roles, and honestly, it was hindering more than helping.
So, in a somewhat desperate move to simplify things and get the system functioning smoothly for everyone, I made the decision to allow broader use of the admin account. It was meant to be a temporary solution, a stopgap until we could sort out proper roles and permissions. I planned to introduce more granular access controls, but, well, things got busy, and management never prioritized it.
In retrospect, I realize it was a risky move. It exposed the system to potential misuse and made it difficult to track who did what. But at that moment, it was about choosing the lesser of two evils: operational paralysis or potential security risks. I chose to keep things running, though I always hoped we’d circle back to fix it properly. I hope that’s been addressed by now.
“Why did you store personally identifiable information in the database without encryption?”
Storing personally identifiable information (PII) without encryption was definitely not in line with best practices, and I’ll be the first to acknowledge that. The decision was made under a set of constraints and pressures that, in no way, excuse the lapse in data security, but here’s why it happened:
- Lack of Awareness and Resources: When I first started, there was a significant lack of understanding about data security best practices, both within the IT team and the wider organization. The importance of encrypting PII wasn’t as widely recognized or enforced as it is now.
- Legacy Systems and Compatibility Issues: The database and many of the associated applications were set up years before I joined. These legacy systems were not designed with modern security features like encryption in mind. Retrofitting them with encryption would have required a significant overhaul, which the company was not ready to invest in, both financially and in terms of downtime.
- Performance Concerns: There was a belief, rightly or wrongly, that encrypting the PII would significantly impact the database performance. Given the already strained resources and the critical nature of the database for day-to-day operations, there was a lot of hesitation to introduce changes that might affect performance.
- Prioritization and Pressure: As with many decisions in that environment, this one was also a result of prioritizing immediate functionality and accessibility over long-term security. The pressure to maintain uptime and quick access to data often trumped security considerations.
In hindsight, I see how short-sighted these reasons were. The risks of storing unencrypted PII are massive, including potential data breaches and non-compliance with privacy laws. I hope that this has been rectified in the current setup, and the necessary security measures have been put in place.
“What made you finally quit?”
The decision to quit wasn’t easy, but it was a culmination of several factors that, over time, made it clear that moving on was the best choice for me.
- Lack of Support and Resources: One of the biggest challenges was the constant struggle with limited resources. Whether it was insufficient staff to handle the workload or inadequate budget for necessary upgrades and security measures, it felt like I was always trying to keep the ship afloat with duct tape.
- Management’s Attitude Towards IT: There was a persistent undervaluation of IT and its role in the company’s success. Suggestions for improvements, especially those involving investment in better systems or practices, were often dismissed or indefinitely postponed. It was frustrating to see how critical issues were ignored until they became crises.
- Overwhelming Workload and Stress: As the complexity of the systems grew, so did the workload. Being in a high-pressure environment without adequate support or recognition took a toll on my health and work-life balance. The stress became unmanageable, and there were no signs of it easing.
- Ethical and Professional Concerns: Practices like the use of the admin account for all users and storing unencrypted PII were professionally troubling. I was increasingly uncomfortable with the potential risks and liabilities we were exposed to. It felt like it was only a matter of time before something major went wrong, and I didn’t want to be there when it did.
- Career Growth and Learning Opportunities: I realized that staying in that environment wasn’t contributing to my professional growth. The focus was always on putting out fires, never on innovating or improving. I wanted to be in a place where I could learn, grow, and work on projects that were forward-thinking and properly resourced.
Leaving was a tough call, but it was necessary for my professional growth and personal well-being. I needed to be somewhere my skills were valued, and I could work under better conditions.
Brent says: I love these so much because it feels human, like someone who was trying their best under tough circumstances. I bet some of you are even going to get therapeutic value out of this technique.