How to close SQL Server operational blind spots (linked servers, DMVs, and KILL command security risks & fixes)
The SQL Server attack pattern is consistent: attackers do not always need a spectacular vulnerability. They often succeed by chaining normal features that were granted too broadly, trusted too much, or monitored too narrowly. In this article, I’ll foc …
[Video] Office Hours Off the Coast of Long Beach
A couple times a year, I go away for a week to think about what’s working well, what I need to change, where our industry is going, and how I need to react. I usually do it on a cruise because the crappy internet makes it easier to disconnect and refle …
Announcing a New Way to Reinforce Your Resume: My Alumni List.
I hope you never have to look for another job. However, if you do, I wanna give you as much reinforcement as I can. If you’re the kind of person who attends my live classes, pays attention, asks questions, and does the lab homework, you deserve to be a …
How to run PostgreSQL in Docker (getting started with PostgreSQL, part one)
The goal of this guide is simple: get PostgreSQL up and running in the fastest, easiest way. You’ll then learn how to create databases in PostgreSQL and the objects that live within them. The two easiest ways to get started working in PostgreSQL are to …
Database Animations: Stop Using Page Splits to Justify Lowering Fill Factor.
You’re looking at page split numbers in a monitoring tool or Perfmon, and you’ve heard that page splits are bad, so you’re lowering fill factor, expecting your page splits to go down. You’re monitoring the wrong number. To prove it, let’s check the pag …
The one big difference between MySQL and MariaDB you may have overlooked
The big difference between MySQL and MariaDB largely revolves around database storage engines and anything related to them. In this article, I’ll walk you through some of the key differences between storage engines in MySQL and MariaDB, explain which i …
How test data management helps meet DORA’s resilience testing requirements
DORA requires financial institutions to run tests that prove their systems can withstand operational disruption without exposing sensitive data. This article explains how test data management practices can provide the realistic but safe data needed for …
Join Me at Day of Data Orlando Next Month
Next month on Saturday, October 17, I’ll be speaking at the free Day of Data Orlando. Registration is open now. The event is 8AM-4PM at the Seminole State College Sanford/Lake Mary Campus at 100 Weldon Boulevard, Partnership Building, Sanford, FL 32773 …
What happens when your AI coding agent starts a database on its own (building an app with AI, part six)
At the end of the previous article in my series on building an app and database almost entirely through an LLM, there was a functional WordPress plugin accessing my PostgreSQL database sitting on Azure. It’s secure (protected against SQL Injection), an …
[Video] Office Hours: Open Q&A for Microsoft Databases
Today I’m back in the home office, finishing up teaching Mastering Index Tuning and getting ready to head out on a Mexico cruise. Let’s go through your top-voted questions from https://pollgab.com/room/brento. Here’s what we covered: 00:00 Start 00:30 …
Live Class Enrollment Opens Soon – For Just $995!
I teach Microsoft SQL Server performance tuning in a 4-class rotation. The winter rotation is getting ready to start: Fundamentals Week – November 2-6 Mastering Index Tuning – November 30-Dec 4 Mastering Query Tuning – January 11-15, 2027 Mastering Ser …
Should your SQL Server database use foreign key constraints?
Foreign key constraints exist to stop bad data before it happens, yet plenty of production SQL Server databases run without them. Is that a reasonable trade-off or a ticking time bomb? Greg Low looks at the most common reasons teams skip foreign keys, …
“But NOLOCK won’t hurt me if I’m using an index!”
NOLOCK is bad and you probably shouldn’t use it, but every time I mention that publicly, the pushback just keeps coming. I don’t know why people so firmly believe that their situation couldn’t possibly be affected by bad/random data from NOLOCK. Today’ …
How a Microsoft-signed SQL Server stored procedure lets sysadmins bypass disabled xp_cmdshell
SQL injection inside Microsoft-signed system stored procedures is not supposed to happen. Yet, as I’ve been documenting in this series, it happens more often than you may assume. This article walks through another one I found and reported to the Micros …
How to delete personal data for GDPR & CCPA compliance
Deleting a customer’s personal data under GDPR or CCPA means erasing it everywhere it’s stored — not just the primary database, but replicas, backups, caches, search indexes, logs, and every third-party tool that touched it — usually within 30 to 45 da …