4 ms·

I used to work in a state government job as a student intern, and they said they wanted an internal directory for some various tasks. You can think of it like a

by ar_lan 8y ago

I used to work in a state government job as a student intern, and they said they wanted an internal directory for some various tasks. You can think of it like an inventory manager sort of website, purely on our intranet. The mad lad my lead was, said we would need a database for retaining some of the basic data we needed to keep track of. Nothing all that special, just a few tables, and by nature nothing sensitive would be tracked. This got rejected immediately, and our IT literally cited "no database installations are allowed per security team." Needless to say 4 months later, after some back and forth, he eventually said "whatever, we'll just store everything to files then" and that's how he came up with the world's slowest inventory manager - I suspect just the way they like it.

mountainofdeath 8y ago
Shh... Don't tell them that stuff like SQLite _is_ a flat-file database.
- sametmax 8y ago
  Besides, if you code your own database, at one point from a file to postgres, is it going to get rejected ?
  - sokoloff 8y ago
    "Is this system a database?" "No sir! It's just a base of data." <checks spec book> "Very well; carry on then..."
- Godel_unicode 8y ago
  I've never understood this argument; sqlite specifies a file format, but that's hardly the only requirement. By this argument, any database with a public file spec is a flat-file database.
kemiller2002 8y ago
I used to be a contractor and worked on a web application distributed across multiple web servers. We needed a state server at the time to hold some cached information and share it among the servers. Now there was a rule that said a web server was not directly allowed to communicate with the database. Okay I get it, that makes sense. The state server we were going to use to store some application metadata had the word "database" in the product name. For that reason alone we got flat out rejected. I said to them, "So it's OK to store all the stuff we need in memory and on the file system on the servers, just not stored in the state server." Their response was, "Yes, because it's not in a database." We finally switched to another product that did not have the word database in the name, and they were completely fine with it.
- lowercased 8y ago
  I'm having to switch CentOS servers over to RHEL servers because... support(?) Some state work got in trouble a few years back because they'd updated guidelines that no applications could be on the same machine as a database server. Enforced separation, for security. Having enough staff and management to distribute that message to people dealing with the apps and servers didn't seem to be a requirement, however. And... when I was given this mandate, I had to ask for another server, then told there weren't any available, and I'd have to wait for several weeks, and I probably should shut down the current service (which had run for 3 years this way, well before the guidelines were in place). Navigating govt IT stuff is crazy. About half the people I've encountered are between competent and really talented, and the other half don't understand the basics. FWIW, if the web server can't communicate 'directly' with a database... what process do you use to communicate between them? Some sort of proxy? Or something else?
  - GlenTheMachine 8y ago
    There's an infamous story at my shop. Twenty-some years ago, we used a software tool that was an important part of our mission, and it only ran on Silicon Graphics boxes. We needed to buy a new SGI machine, and SGI had started shipping all of their machines with built in monitor cameras, the first company to do so. Digital cameras were at that time strictly prohibited from even being on the premises. So my friend goes ahead and buys the machine he needs, on the assumption that if he doesn't everybody is out of a job, and he can always disable the camera. The machine arrives, he sets it up, and calls security asking for whatever official process they use for disabling webcams. Epoxying over the lens or something, was what he figured. At first they are very confused. It's like they can't parse the words he is telling them. It's as if he was trying to tell them there were six legged iguanas with Russian flag patches on their backs running around the server room. So he finally gets them to acknowledge that he is, in fact, speaking English in sentences that adhere to the rules of grammar, at which point they have to take his question seriously. So they ask: “did you procure these computers through <our base's> government procurement office.” To which he says, yes, of course, there's no other way to do it. They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.”
ip26 8y ago
I guess in their defense, databases were pretty famous for being a huge attack surface for many years.
- lowercased 8y ago
  mis or poorly configured, yes. "sa" and no password on MSSQL, with direct connection to public internet - saw those for years. PostgreSQL/MySQL configured to only listen to localhost connections, and properly escaped/prepared queries running to them, with "minimally needed security access" credentials - haven't seen many problems with those (that were the fault of the database).
- rishav_sharan 8y ago
  hand rolled file based storage solutions will likely be less secure than battle tested dbs.
wwweston 8y ago
> This got rejected immediately, and our IT literally cited "no database installations are allowed per security team." This is common enough across a variety of organizations (I've certainly run into the same issue at several large-ish companies) and isn't necessarily unreasonable... if IT also provides a process for getting what you need with their oversight/help (bonus if some part of the IT team actually has skills to do audits rather than cargo culting off a checklist).
- jve 8y ago
  > This is common enough across a variety of organizations... and isn't necessarily unreasonable So, how are applications supposed to store/retrieve data?
  - tremon 8y ago
    I guess they use a tuple store backend.
heartbreak 8y ago
This site, Hacker News, uses flat files for its database.
TimTheTinker 8y ago
Flat files are a perfectly acceptable way of storing and retrieving data. Never start a greenfield software project with "ok, first we're going to need a database." At least defer it until you know it's the best way forward.
k__ 8y ago
Had the same problem at a big corp once. They got MS Office approved for all PCs, so we ended up building all based on Excel, Word and Access.

by ar_lan 8y ago

mountainofdeath 8y ago

Shh... Don't tell them that stuff like SQLite _is_ a flat-file database.

sametmax 8y ago
Besides, if you code your own database, at one point from a file to postgres, is it going to get rejected ?
- sokoloff 8y ago
  "Is this system a database?" "No sir! It's just a base of data." <checks spec book> "Very well; carry on then..."
Godel_unicode 8y ago
I've never understood this argument; sqlite specifies a file format, but that's hardly the only requirement. By this argument, any database with a public file spec is a flat-file database.

kemiller2002 8y ago

I used to be a contractor and worked on a web application distributed across multiple web servers. We needed a state server at the time to hold some cached information and share it among the servers. Now there was a rule that said a web server was not directly allowed to communicate with the database. Okay I get it, that makes sense. The state server we were going to use to store some application metadata had the word "database" in the product name. For that reason alone we got flat out rejected. I said to them, "So it's OK to store all the stuff we need in memory and on the file system on the servers, just not stored in the state server." Their response was, "Yes, because it's not in a database." We finally switched to another product that did not have the word database in the name, and they were completely fine with it.

lowercased 8y ago
I'm having to switch CentOS servers over to RHEL servers because... support(?) Some state work got in trouble a few years back because they'd updated guidelines that no applications could be on the same machine as a database server. Enforced separation, for security. Having enough staff and management to distribute that message to people dealing with the apps and servers didn't seem to be a requirement, however. And... when I was given this mandate, I had to ask for another server, then told there weren't any available, and I'd have to wait for several weeks, and I probably should shut down the current service (which had run for 3 years this way, well before the guidelines were in place). Navigating govt IT stuff is crazy. About half the people I've encountered are between competent and really talented, and the other half don't understand the basics. FWIW, if the web server can't communicate 'directly' with a database... what process do you use to communicate between them? Some sort of proxy? Or something else?
- GlenTheMachine 8y ago
  There's an infamous story at my shop. Twenty-some years ago, we used a software tool that was an important part of our mission, and it only ran on Silicon Graphics boxes. We needed to buy a new SGI machine, and SGI had started shipping all of their machines with built in monitor cameras, the first company to do so. Digital cameras were at that time strictly prohibited from even being on the premises. So my friend goes ahead and buys the machine he needs, on the assumption that if he doesn't everybody is out of a job, and he can always disable the camera. The machine arrives, he sets it up, and calls security asking for whatever official process they use for disabling webcams. Epoxying over the lens or something, was what he figured. At first they are very confused. It's like they can't parse the words he is telling them. It's as if he was trying to tell them there were six legged iguanas with Russian flag patches on their backs running around the server room. So he finally gets them to acknowledge that he is, in fact, speaking English in sentences that adhere to the rules of grammar, at which point they have to take his question seriously. So they ask: “did you procure these computers through <our base's> government procurement office.” To which he says, yes, of course, there's no other way to do it. They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.”

ip26 8y ago

I guess in their defense, databases were pretty famous for being a huge attack surface for many years.

lowercased 8y ago
mis or poorly configured, yes. "sa" and no password on MSSQL, with direct connection to public internet - saw those for years. PostgreSQL/MySQL configured to only listen to localhost connections, and properly escaped/prepared queries running to them, with "minimally needed security access" credentials - haven't seen many problems with those (that were the fault of the database).
rishav_sharan 8y ago
hand rolled file based storage solutions will likely be less secure than battle tested dbs.

wwweston 8y ago

> This got rejected immediately, and our IT literally cited "no database installations are allowed per security team." This is common enough across a variety of organizations (I've certainly run into the same issue at several large-ish companies) and isn't necessarily unreasonable... if IT also provides a process for getting what you need with their oversight/help (bonus if some part of the IT team actually has skills to do audits rather than cargo culting off a checklist).

jve 8y ago
> This is common enough across a variety of organizations... and isn't necessarily unreasonable So, how are applications supposed to store/retrieve data?
- tremon 8y ago
  I guess they use a tuple store backend.

heartbreak 8y ago

This site, Hacker News, uses flat files for its database.

TimTheTinker 8y ago

Flat files are a perfectly acceptable way of storing and retrieving data. Never start a greenfield software project with "ok, first we're going to need a database." At least defer it until you know it's the best way forward.

k__ 8y ago

Had the same problem at a big corp once. They got MS Office approved for all PCs, so we ended up building all based on Excel, Word and Access.