Pete Finnigan 算是一个 Oracle 安全领域的技术专家了.因为他长期关注 Oracle 的安全技术而入选 OakTable .Pete 的 Blog 很精彩,我将他的Blog收录到我的 Lilina 中,每天早晨打开 IE 的时候就可以方便阅读. 或许是”专注观察天上的星星,而没有注意脚下的坑”,前几天他的 Blog 和论坛居然被黑了! 不知道 Pete 当是什么感受… 当然,这次的危害并不是很大,Hack(或许是脚本小子)只是修改了他的 Blog 的 Index 页面.
Tag Archives: Oracle
OCFS2
Oracle宣布发布 OCFS2. OCFS2 正式支持SuSE Linux Exterprise Server 9 (SP2+) 和 RHEL 4 ,都是 Linux Kernel 的2.6 核心,对 2.4 kernel 不支持。OCFS2 比 OCFS 来说是一个大进步。但是高版本居然不兼容低版本，给使用 OCFS 的用户升级带来了很大的难度。
- Node and architecture local files using Context Dependent Symbolic Links (CDSL)
- Network based pluggable DLM (distributed lock manager)
- Improved journaling / node recovery using the Linux Kernel “JBD” (journaled block device) subsystem
- Improved performance of meta-data operations (space allocation, locking, etc)
改进了元数据操作的性能 - Improved data caching / locking (for files such as oracle binaries, libraries, etc)
Buffer gets increase on the same SQL
同样一条SQL ,有的时候 buffer get 会暴增?! Oracle-L 中有人提了一个这样的问题：
I have a batch process that executes individual transactions, normally
a transaccion e.g. a simple select would take 8-10 buffer gets but in
the batch processing it takes 45 buffer gets.
Zhu Chao (Chao_ping,这家伙现在一篇文章都不写，只能从邮件列表里看到他的踪迹) 给了一个解释：
the job is processing some very hot blocks. So it always need to reverse back and find the CR block from buffer, so it will generate some more buffer gets for that execution.
如果是因为Hot Block 的原因,那么主要的症状应该是 Wait. 如果这个 SQL 在运行的时候数据已经发生了变化,那么为了维持一致性不可避免的会生成回滚,所以这个解释更为准确一些:
If a query does a consistent get on a block that has been changed since that query began or that had uncommitted changes at the time that that query began, then it is necessary to rollback those changes for read consistency. The consistent changes statistics counts the number changes rolled back. However, most consistent gets do not require any such rollback, and so it is normal for the number of consistent gets to be much greater than the number of consistent changes. This is reflected in the no work – consistent read gets statistic
我们不妨来做个例子.假定我们现在有两个Session,首先在第一个窗口做如下操作
数据库安全与花喇子模信使问题
最近关于数据库安全有个有趣的问题。Oracle 公司的CSO(chief security officer)写了一篇文章,When security researchers become the problem,首先这位 Davidson 不认为安全研究人员 “push vendors to work faster” 是个好事情; 更为可笑的是 Davidson 觉得这个安全研究人员其实都是为了谋利益而来的:
Many researchers think that the more vulnerabilities they disclose publicly, the more vendors will hire them as consultants.
这多少有点小人之心度君子之腹了.这篇文章一经发出,在安全届引起了不小的讨论.