GDPR : The good, the good and the good!

As is the way with reporting these days, most of the posts about GDPR that have gained any sort of traction over the last few years/months/days have been focused on the doom and gloom side of things. I too have found myself focussing on this side of the issue, being the natural worrier that I am. Having said all that, I think it’s really important to take a step back and look at the issue as a whole…

I’ve seen a few comments from people outside the EU, and some inside, that can be summarised as, “F**k You EU!” I can understand that to a certain extent, but I think it’s important to remember what this is all about.

The Good : It’s about protecting you!

It’s really easy to gather massive amounts of data about you. This data is used to profile you and subsequently influence your decisions. There’s a reason why those pizza adverts keep coming to me, but I never see adverts for booze…

The stories about companies like Cambridge Analytica highlight how this data can be used to influence more than what food you buy. It can potentially influence who/what you vote for, and we can see how that has worked out for us in the UK and those in the USA recently…

I understand you may not like the implementation of GDPR from a business perspective, but surely you’ve got to agree that some control over the collection and use of this data has to be put in place?

Understanding what data is held about you and how it is processed is a good thing.

The Good: The technical stuff is easy

There are challenges associated with the technical side of GDPR, but for the most part we have the technology, tools and intellect to deal with this. Depending on how much work your company has put into security over the years, there may not actually be that much to do on the technical side.

For a number of people GDPR has been good leverage to finally deal with some important stuff that has been moved down the priority list for years, because it’s more important to add a new spangly widget to an application than to patch a server.

If nothing else, this type of work keeps us techies in work, which is a good thing. 🙂

The Good: The business process is where it’s at

If you’re reading this you are probably involved in IT, so the technical side of things is probably your main focus. Where is the data, is it secured, does it need to be encrypted etc. This is the tip of the iceberg, and as mentioned previously it’s all pretty easy, but labour intensive, to identify and fix. The really tough stuff is to identify and secure the business processes…

Burt uses an APEX interactive report to display some data he’s interested in. He downloads it as a spreadsheet and emails it to Beryl because she is the “Seven of Nine” of Excel and has macros coming out of her ears. She works her Excel Borg magic and emails the resulting masterpiece back to Burt. Burt then emails it on to Barbara who downloads it on to her laptop so she can take a look through it on the train on the way to the next board meeting…

Is anyone seeing the problem with this all too common business process? It really doesn’t matter how secure your database and applications are if people are going to download the data onto their PC, play around with it, print it, email it to people and then lose their unprotected laptop or memory stick on the train…

GDPR incentivises you to identify these stupid processes and secure them, or preferably replace them by something more sensible. This is a good thing. It’s something we in the IT world have been trying to encourage for years. Not only is it a good idea, but it’s also going to keep us techies in work. Do you see a pattern here? 🙂

Conclusion

I’m not saying GDPR is perfect. I understand it introduces a set of problems for companies. I realise it’s easy to go down the rabbit hole of doom and gloom, but this really is a good thing.

Speaking for myself, it’s been quite enlightening reading through the GDPR information and going through the process for my website and blog. I was surprised about how much data was being captured that I didn’t know about, especially considering this is just a crappy “read only” resource, not a proper business that needs to track customers/clients etc.

The next few years will prove interesting.

Cheers

Tim…

PS. I might have forgotten to mention it keeps us techies in work… 🙂

Riga Dev Days

In about a week I’ll be at Riga Dev Days 2018 in Latvia.

It’s a very diverse event, covering a whole bunch of technologies over the three days, which includes a workshop day and the two conference days.

There is an Oracle track, so if that’s your thing you will find it there, but there’s also a bunch of different technologies discussed too, so there’s something for everyone. Check out the schedule here.

See you there!

Cheers

Tim…

New XPS 15 : The Wait is Over

Followers of the blog will know I’ve been moaning about my MacBook Pro and macOS for a while now, and talking about making a switch back to Windows. That time will arrive soon, because I’ve just ordered one of these.

It’s a Dell XPS 15″ with 32G RAM, 1TB M.2 drive and an i9 (6 core) processor.

It’s a little over the top, but I tend to hold on to laptops for quite a while, assuming they work properly. I might have gone down-market a bit if Dell had released something in the middle range. In the UK they currently have low spec or mega spec in the new 15″ range, and I’m getting increasingly worried about my current MBP, so I just went for it. Working for a university has the distinct advantage that I get a fantastic Higher Education discount from Dell when buying kit for home use. We also get an OK discount from Apple, but who cares…

This will be my main desktop and travel laptop, so I’ll be interested to see how it stacks up. I know a couple of people with the 2017 model and they say it is awesome, so on paper this looks like it will be great, assuming it works. 🙂

I was tempted to go for one of the 13″ versions, which Connor McDonald recommended. The extra portability would be nice, but having recently spent some time working from just the laptop with no extra screen, I would go mad on such a small screen, no matter how good the resolution was.

Of course I’ve bought a dock for home and I already have a great monitor, so hopefully is should all slot into the setup nicely. I probably won’t get to use it for the next couple of conferences because of delivery dates, setup and understanding what adapters I need to connect to the real world. I’m not carrying the dock around with me. 🙂

I’ll no doubt write about the experience has it happens. I’m using Windows 10 at work, so I don’t think that will be an issue as it is working out fine. It’s always a bit of a concern when switching over to a new bit of kit. What if you get “the bad one”, which has certainly happened with this last MBP. Also, I’ve got my setup documented, but I always worry I will miss something out… 🙂

Fingers crossed this will work out…

Cheers

Tim…

PS. For context, you might want to read my post here before you tell me how great your preferred desktop OS is… 🙂

Chrome 68, HTTPS , Let’s Encrypt and ORDS

In February Google released a post about Chrome 68, due for release in July, which will increase the pressure to adopt HTTPS for all websites because of this behaviour change.

Basically HTTP sites will be marked as insecure, rather than just getting the (i) symbol.

Recently I’ve seen a bunch of sponsored posts talking about this in an attempt to sell certificates. GoDaddy are pushing the advertising hard. I just wanted to remind people there is a free alternative called Let’s Encrypt you might want to consider.

Let’s Encrypt

I’ve been using HTTPS for a few years now, but over a year ago I switched to using the free Let’s Encrypt service to get my certificates and so far I’ve had no problems. I wrote about this in a blog post here. That links to this article about using CertBot to automate the certificate renewal, which includes the Apache HTTP Server config.

The article also links to this article about configuring HTTPS for Tomcat, which includes an example of using a Let’s Encrypt certificate.

I always run Oracle REST Data Services (ORDS) under Tomcat, so this is how I HTTPS enable ORDS. If you would prefer to run ORDS in standalone mode, but still want to use a real certificate Kris Rice has your back with this article.

Of course, you shouldn’t be having direct traffic to Tomcat servers or standalone ORDS services you care about. They should be sitting behind some form of reverse proxy, or a load balancer acting as a reverse proxy, which is performing the SSL termination. In my company, we have the real certificates on the load balancers, which perform the SSL termination, then re-encrypt to speak to the services below them.

Thoughts

In general I think the push towards HTTPS is a good thing, but I do have a few reservations.

  • There are plenty of sites, like my own, that don’t really do anything that requires encrypted connections. You are just there to read publicly available stuff. Marking them as insecure seems a little stupid to me. Update: As pointed out in the comments, it does make it harder for people to intercept and change the information during transit.
  • A bigger beef is the fact that anything with a valid HTTPS certificate is marked as “Secure”. If you work in IT you understand this just means the connection is secure, but what does it mean to other people? I could understand it if some people thought it meant it was a safe website to visit, when it means nothing of the sort. If HTTPS is the new “normal”, I think the browser should stop marking it as secure, and only flag when it is insecure. Update: It seems this is going to change (here). Thanks to Gary for pointing this out.
  • It worries me that Google can make this decision and the rest of the world has to jump. This all started when they began to alter index ranking based on the presence of HTTPS, which is why I first enabled HTTPS on my website about 4-5 years ago I think. Now the Chrome market share of about 60% is such that they can make big changes like this without having to get buy in from the rest of the world. The motives are good, but I don’t like it.
  • I’m not saying you shouldn’t pay for certificates. My company still does. I’m just saying you have a choice, especially if it is something that you do for fun like this website. In this case the free option is always the good one. 🙂

Happy encrypting…

Cheers

Tim…

Oracle Code : Warsaw – The Journey Home

I woke up at silly o’clock to begin my journey home. I checked out of the hotel and got a taxi to the airport, where I breezed through check-in and security and found myself at the boarding gate 2 hours before the flight. Another hour in bed would have been nice… 🙂

As usual, out came the laptop and I played catch-up on the blog and some of the other stuff I had missed during the conference.

The flight from Warsaw to Frankfurt was a little under 2 hours. I don’t think I’ve flown with LOT before, and it was quite a nice experience. The plane had a clean and modern interior with power sockets at every seat, which was cool. I didn’t have an aisle seat, but the flight wasn’t full, so I was able to move to one. 🙂

I had a 90 minutes stop over at Frankfurt, before starting the hour flight home to Birmingham. That fine was easy, even though I had a window seat.

A quick taxi ride home and Oracle Code : Warsaw was complete.

Thanks to the Oracle Code crew for inviting me to the event, and to the Oracle Developer Champion and Oracle ACE Programs for making this possible for me. Most importantly, thank to the attendees and speakers for coming to the event and making it all happen!

The posts for this event were:

Cheers

Tim…

Oracle Code : Warsaw

Oracle Code : Warsaw started for me with my first presentation of the day as I was in the first block after the keynotes…

My first session was about Analytic Functions. It’s a little difficult to predict the makeup of the Oracle Code crowds. In some cities you get predominantly Oracle developers, while in others it’s the opposite. As a result, you never know how what you are doing will be received until you get there. I shouldn’t have been concerned as the room was full. I had a little glitch at the start, which was caused by my laptop switching between the hotel and event wifi. Once I sorted that the connection to my Oracle Cloud DBaaS service was fine, which meant I was able to run through my demos. 🙂

Next I watched “Database DevOps and Agile Development with Open-Source Utilities” by Susan Duncan, which was another standing room only session. This included a demo of Oracle Developer Cloud Service, a freebie when you buy other Oracle Cloud services, and it looked pretty good. The demo was of the full lifecycle of an incident from logging through to release of a fix, which included database changes managed by FlyWay, with a quick a mention of LiquiBase and utPL/SQL.

After lunch I went to watch “Graal: How to Use the New JVM JIT Compiler in Real Life” by Chris Thalinger. I finally got to see this presentation, having clashed with Chris’ session slot at all previous events. I’m trying to think of something to say to make it sound like I understood what he was talking about, but between you and me it was a complete mystery to me. He did some awesome “Jazz Hands” though! 🙂 The session was a live comparison of Graal with an unmodified JVM, showing examples of potential performance improvements, and examples of where performance is no better too. I guess the take-home message that will impress most people is Twitter run all their Scala microservices in production on Graal and it’s saving them a bundle of cash because of improved performance…

Next up was Ewan Slater with “Honey I Shrunk the Container”, who amongst other things talked about using Smith to produce microcontainers, which looks really interesting. In one example he was able to shrink a container from about 850 meg to about 85 meg, which is pretty darn impressive. It’s definitely more impressive than –squash.

After that it was me with my session on REST enabling the database. I think this was a case of preaching to the converted, but I did get some questions at the end. 🙂

After my session I got chatting to some folks, so I missed the last session of the day, which meant that Oracle Code : Warsaw was over for me. Thanks to everyone that supported the event, including the Oracle Code crew, the other speakers and of course the attendees!

In the evening we went into town to get some food and I was introduced to a drink called The Terminator, which tasted really nice, but was rather deadly. I think it contained more alcohol than I normally drink in about 2 years… I was also given a shot of some vodka which was incredibly smooth. Despite feeling rather inebriated, I was sensible enough to switch back to water and juice for the rest of the evening. The photos of me with the empty vodka bottle and some bison grass (from the bottle) in my mouth were staged. 🙂

I was intending to be in bed really early as I needed to be up in the morning at 04:45 for my flight. I got back to the hotel at about midnight, so that didn’t work out so well… Thanks to the POUG folks for taking us out for the evening. It was much appreciated!

Cheers

Tim…

Oracle Code : Warsaw – The Journey Begins

For a change it was a normal wake-up time for me. The advantage of flying late morning is you don’t have to get up so early. The disadvantage is the traffic. I left an hour earlier than usual, just to make sure, and it paid off. I missed some of the traffic, but there were some questionable decisions by my taxi driver. He seemed like a nice guy, but his SatNav was taking us on a rather strange route, and when he chose to ignore it, it seemed to be for all the wrong reasons, like he was speaking on his phone and missing the turn… Despite the long time and erratic route the price was the same as normal. Odd… 🙂

Having started off super early I arrived in plenty of time, so much so that the Brussels Airlines desk wasn’t open. Despite this delay, I managed to get through security pretty quickly, grabbed some food and a drink and parked at a table for about 90 minutes to do some work.

The first flight of the day was Birmingham to Brussels. We took off on time and it took about 55 minutes, so no drama there. The lady in the seat behind had a really shrill laugh, which I couldn’t block out with headphones. I noticed a number of people turning to look, so I wasn’t the only person this was annoying.

I had a 2.5 hour stop at Brussels, so not surprisingly I got the laptop out etc.

The 2 hour flight from Brussels to Warsaw was delayed a little, but it didn’t make much difference to our arrival time. I was meant to wait for Brendan to get a taxi, but instead Brendan was waiting for me. We got an Uber to the hotel, then it was pretty much time for the speaker dinner. I was going to duck out of this, but got persuaded. It was a good evening. 🙂

I mentioned in a previous post on the subject, I had agreed to do a second presentation to fill and empty slot. I went through that presentation a couple of days previously and wasn’t happy with it, so I spent the evening doing some work to tailor it more to the Oracle Code audience, who are not all Oracle techies…

Tomorrow (probably today when this gets released) is Oracle Code : Warsaw. See you there!

Cheers

Tim…

VirtualBox 5.2.12

VirtualBox 5.2.12 has been released for some platforms.

The downloads and changelog are in the usual places.

I did the upgrade to my MacBook Pro in Brussels Airport and I’ve just done the upgrade to my Windows 10 PC at work.

The upgrade went fine on macOS, but I ran into a little glitch with the Windows 10 upgrade. The upgrade itself seemed successful, but no VMs would run once the upgrade was complete. 🙂

I did an uninstall, followed by an install again, then everything was fine on Windows 10 too.

I mostly use Vagrant for managing my VMs these days, so my first reaction was it was a Vagrant issue, but it wasn’t. No drama though. All working now… 🙂

Happy upgrading.

Cheers

Tim…

Oracle Code : Warsaw, Poland

In a little over a week I will be travelling to Poland for the first time to speak at Oracle Code : Warsaw.

The Oracle Code events are free 1 day events. The fact they are only a single day means it’s pretty hard to get a slot. As usual I put in a few papers, so they had alternatives in case there were subject clashes with other speakers. I got an acceptance for one of my talks, so happy days…

About 5 days ago I had an email from the organisers asking if I wanted to fill another slot… Does this sound familiar? So now I’m doing two sessions at the event. 🙂

I think my destiny this year is to be the backup kid. Have talks, will fill in at the last minute… 🙂

The hotel and flights are all booked, so all I’ve got to do now is turn up… 🙂

See you there!

Cheers

Tim…