SQLServerCentral.com Community Update for {date}

Problems displaying this newsletter? View online.

Featured Contents

Question of the Day

Counting Bits IV

The Voice of the DBA

More Supply Chain Attacks

The latest code supply chain attack isn't a direct attack, but a failure of a system designed to be efficient. There is a Go (Go-lang) module that had a malicious module inserted into it years ago. Someone caught this and removed the module from GitHub, but Google had cached this and has kept it alive for the last three years.

This attack worked because it relied on the Go Module Proxy services, which prioritized caching. Even when the source changed, the cache wasn't invalidated or reloaded, which seems like a major ovesight or even larger design flaw, but I know everyone trying to maintain software archives at scale tends to cache a lot. After all, so many developers might load modules in their daily work, in CI, etc. that caching matters.

However, the bigger issue is that criminals are getting more enterprising and aiming for supply chain attacks where possible. One would hope that any PRs (pull requests) are carefully examined, but the truth is that a lot of people might depend on their unit tests passing in a CI build. They are not necessarily looking to see if anyone has actually entered malicious code or even poorly written code. I can see some people worried more about code structure and naming (or tabs/spaces) than what the code does. Imagine seeing a change that looks innocuous at the top of a file, all tests pass, and you merge the change, but didn't notice there was a few new functions added below in the file because they're not obvious in the UI.

Someone maintaining a popular code repo as a side project might be fooled here, but if this were in a corporate repository we might be even more susceptible. We have more reasons to trust the PR isn't a problem if the code passes tests inside of an organization. After all, who things criminals might insert code into their corporate repo? Not many people do, but we've seen quite a few successful supply chain attacks in the past. Who knows how many more we don't know about.

Security is a hard business, and when it's extended to the code we write, it might even be harder. I know there are security scanning solutions you can integrate into your codebase, but those detect what they know about and criminals keep finding new ways to attack us. Ultimately I think we depend on code maintainers carefully examining PRs from outside their circle of trusted individuals, and even then, things can slip through.

Some days I think it's truly a mad, mad world.

Steve Jones - SSC Editor

Join the debate, and respond to today's editorial on the forums

Featured Contents

Fabric Analytics for SQL folks: Part 1 - Fabric demystified

Frank A. Banin from SQLServerCentral

Unlock new opportunities for data-driven decision-making by grasping the significance of SQL and structured data in current data and analytics ecosystems like Microsoft Fabric.

Crazy number of Parameters… and a challenge

Additional Articles from SimpleTalk

The other day, my lovable coworker and frequent Simple Talk writer: Grant Fritchey, sent this post on X:

The State of the Database Landscape in 2025: Insights and trends

Steve Jones - SSC Editor from SQLServerCentral

How are you navigating the database landscape? Our latest report sheds light on the current state of database management and offers valuable insights into how organizations can navigate and simplify the growing complexities of the database landscape.

From the SQL Server Central Blogs - Tally Table Alternatives: #SQLNewBlogger

Steve Jones - SSC Editor from The Voice of the DBA

We published an article recently at SQL Server Central on Tally Tables in Fabric from John Miner. In it he showed how this can be efficient. A day after...

From the SQL Server Central Blogs - T-SQL Tuesday #184 Mentoring and Sponsorship

Diligentdba 46159 from Mala's Data Blog

This month’s T-SQL Tuesday blog party is hosted by Deborah Melkin – Data Platform MVP, WIT co-lead and WITspiration founder. Deb’s invitation is to blog about mentoring and sponsorship. What...

Big Data Analytics with Spark: A Practitioner's Guide to Using Spark for Large Scale Data Analysis

Site Owners from SQLServerCentral

Big Data Analytics with Spark is a step-by-step guide for learning Spark, which is an open-source fast and general-purpose cluster computing framework for large-scale data analysis. You will learn how to use Spark for different types of big data analytics projects, including batch, interactive, graph, and stream data analysis as well as machine learning. In addition, this book will help you become a much sought-after Spark expert.

Question of the Day

Today's question (by Steve Jones - SSC Editor):
	Counting Bits IV
What do these two selects return? SELECT BIT_COUNT (CAST (-1 as smallint)) , BIT_COUNT (CAST (-1 as bigint))
Think you know the answer? Click here, and find out if you are right.

Yesterday's Question of the Day (by Steve Jones - SSC Editor)

A Strange Choice

What is returned when I run this code in SQL Server 2022?

CREATE TABLE CatIndex
( indexval VARCHAR(20)
)
GO
INSERT dbo.CatIndex (indexval) VALUES ('1'), ('2'), ('3')
GO
SELECT CHOOSE(indexval, cast('2025-01-01' AS DATE), CAST('2025-02-01' AS DATE), CAST('2025-03-01' AS DATE))
FROM dbo.CatIndex AS ci

Answer: all three dates in one result set

Explanation: Since the characters in the table can be implicitly converted to integers, this returns all three dates in one result set. Ref: CHOOSE - https://learn.microsoft.com/en-us/sql/t-sql/functions/logical-functions-choose-transact-sql?view=sql-server-ver16

Discuss this question and answer on the forums

Database Pros Who Need Your Help

Here's a few of the new posts today on the forums. To see more, visit the forums.

SQL Server 2017 - Development

SQL 2017 server keeps locking up - I manage a two-node production SQL cluster running SQL Server 2017 CU31 on Windows Server 2019, which hosts one SQL instance and over 20 databases. As the system administrator, I’m responsible for keeping everything operational, but I lack advanced SQL debugging skills. For nearly a week now, I’ve been dealing with a frustrating issue: the […]

SQL Server 2016 - Development and T-SQL

Log Shipping of Production DBs in OffSite Disconnected Environment - Hi, We have some Windows Workstations Standalone and in Workgroup, and they all have SCADA application with SQL Express 2016 for writing Real-time Alarms to SQL DB and occasional reading. We are procuring a Server machine to be utilized as Centralized Database Server/Log Server. It will also contain SQL Server (Standard or Express depends upon […]

Development - SQL Server 2014

Display Data - Hi I want below data to appear like below using query CREATE TABLE [dbo].[Test]( [DocEntry] [int] NOT NULL, [Itemcode] [nvarchar](50) NULL, [Linetotal] [numeric](19, 6) NULL ) ON [PRIMARY] GO INSERT [dbo].[Test] ([DocEntry], [Itemcode], [Linetotal]) VALUES (34676, N'2560209620', CAST(15400.000000 AS Numeric(19, 6))) GO INSERT [dbo].[Test] ([DocEntry], [Itemcode], [Linetotal]) VALUES (34676, N'2560512620', CAST(7700.000000 AS Numeric(19, 6))) GO […]

SQL Server 2019 - Development

how do you explain the cardinal sin of warehousing to the chiefs? - hi we have an army implementing a mfg erp migration to netsuite. When they were in the sandbox, their customer, ship to, bill to and product codes were "external" columns. One or two might have been substrings of external columns but that was fine with me. When they went to their more qa like environment […]

using Sql without using Pivot . - Hi How to get the below data we can create dynamically using Sql in a Table and then display using query. I will not be using Pivot . I want to display data like below without Pivot. Locations can be more. How it can be done without using Pivot Location 1 Location 2 Location […]

Stored procedure - Delay validation - I have a utility stored procedure of the form: CREATE PROCEDURE [dbo].[sp_Utility] @rule [varchar](8), @result [int] OUTPUT AS BEGIN IF @rule = 'Rule1' BEGIN SELECT @result = [result] FROM [dbo].[table1] OPTION (TABLE HINT([f], INDEX ([idx_table1]), NOLOCK)) END IF @rule = 'Rule2' BEGIN SELECT @result = [result] FROM [dbo].[table2] OPTION (TABLE HINT([f], INDEX ([idx_table2]), NOLOCK)) […]

Analysis Services

The attribute key cannot be found when processing - Hi , Im Facing the Below Issue in Ananlytics. We have a Inventory Partition which is connected to WareHouse Dimension. Error Message: Errors in the OLAP storage engine: The attribute key cannot be found when processing: Table: 'T2_PieceInventory', Column: 'StorageID', Value: 'ERETURNS'; Table: 'T2_PieceInventory', Column: 'WarehouseLocation', Value: '3PL'. The attribute is 'Storage Location'. Errors in […]

Strategies and Ideas

Alternatiives to Junk Dimensions - Hello SSC, I am not sure if I posted this in the right spot, but I have a data warehouse question... I have a star schema with a "junk" dimension. I have never encountered junk dimensions before and from what I understand, they are simply dimensions that have no correlation to the fact table, but […]

Integration Services

Call Snowflake Stored Procedure using SSIS Execute SQL Task - Hi I am getting the below error when trying to call a Snowflake stored procedure in SSIS 2017 using Execute SQL Task. Any ideas on how to resolve it. I have confirmed the procedure works when calling from a Snowflake Worksheet. Error: 0xC002F210 at Execute SQL Task, Execute SQL Task: Executing the query "call procedure_name." […]

Resumes and Job Hunters

Job requires X years of SQL... How do you respond? - I can't even tell you how many jobs I've seen that require "X years of SQL experience". How do you know when you're near what that would be? For me, that's a nonsense metric. In theory, at one job, I did 8 months of SQL stuff, when in reality, I did the same things over […]

Presentations and Speaking

Solutions for Environmental Testing | Fare Labs - The state-of-the-art FARE Labs Environmental Testing Laboratory provides a comprehensive variety of testing services to evaluate product performance in various environmental settings. Check out this website: https://farelabs.com/services/testing/environment-pollution-testing-lab

SQL Server 2022 - Administration

Database restoration slowed down abnormally. - I'm running some restoration activity as part of a rehearsal to prepare for an actual SQL server upgrade from 2008 to 2022. We're planning to restore the backups taken on 2008 R2 database to SQL 2022. Our backups are stored in a storage shared between the old & new servers. We have completed this activity […]

Entra authentication Express version - I have a paleontological database, currently in SQL Server 2016, active since 2008 R2. People use it via an Access app and ODBC connection to the server. Our organization started using Active Directory right about the time I first created this system, so I enthusiastically embraced the concept of domain groups. Besides the basic departments, […]

SQL Server 2022 - Development

best tool for documenting your databases (more design decisions etc) - Any suggestions for a good tool for documenting a database and all the important objects in it? I'm trying to use Azure Data Tools, but not a huge fan. Maybe that's my best option, though?

SSIS Execute Process Task forfiles not working - I'm trying to use forfiles in an Execute Process Task in my SSIS package to delete files older than 10 days. When I run the cmd directly from commandline it works. But, when I run the same command from the Execute Process Task in my SSIS package nothing happens and no error is thrown. I […]

This email has been sent to {email}. To be removed from this list, please click here. If you have any problems leaving the list, please contact the webmaster@sqlservercentral.com. This newsletter was sent to you because you signed up at SQLServerCentral.com.