I recently stubmbled upon this website that hosts a publicly available Oracle RDBMS instance running Oracle v2.3.2, which according to this Wikipedia article is the first commercially available version of Oracle. This version is not written in C, but in PDP-11 assembly. The website also has the manuals available. At this time the company was called Relational Software Incorporated or RSI for…
The new protocol dissector for X Protocol in MySQL was just merged to the master branch in Wireshark. To get it build Wireshark from the master branch or wait for the next release. This protocol is using Google Protobuf, which makes it much easier to work with than the regular MySQL protocol. See also: https://dev.mysql.com/doc/dev/mysql-server/latest/page_mysqlx_protocol.html If you like what…
The internet has changed to a place where most protocols like HTTP etc now use secure connections with TLS by default. While both HTTP and the MySQL Protocol use TLS for secure connections there are still many differences which make it difficult for MySQL to benefit from the same advancements as HTTP has seen in the last so many years. What is TLS? TLS stands for Transport Layer Security and is…
This is a follow-up for MySQL GTID tags and binlog events , but you don’t need to read that first. One of the recent innovations in MySQL was the addition of Tagged GTID’s. These tagged GTID’s take the format of <uuid>:<tag>:<transaction_id> . And this change means that the GTID_LOG_EVENT ’s in the binary logs needed to be changed. The MySQL team at Oracle decided to not change the existing…
Introduction Query Attributes are a relatively new feature of the MySQL Protocol. This is availble since MySQL 8.0.23. Before Query Attributes were introduced there already was already another similar feature: Connetion Attributes, which provides per-connection metadata in the form of key/value pairs. This is what connection attributes look like: mysql > SELECT ATTR_NAME, ATTR_VALUE -> FROM…
MySQL 8.4 and newer have extended the Global Transaction ID (GTID) functionality with a new “tag” option. Refresher on GTID A GTID is a unique ID that is assigned to a transaction. This is used if gtid_mode is set to ON . The benefit of this is that a transaction can be uniquely identified in a MySQL replication setup with multiple levels. Among others this makes it easier to refactor a…
In this post I will talk about release management with MySQL as example. Release management has to do with what to put in a release, how often to do a release, how to long to support a release and how to number or name the releases. The early years Today software is almost exclusively delivered over the internet, but this didn’t use to be the case. Software used to be delivered in a box that you…
This story starts with a pull request for go-mysql to allow setting the collation in auth handshake that I was reviewing. The reason why the author wanted to do this is to speedup the connection setup as he has a latency sensitive application and a lot of connection setups and tear downs. While looking at this I noticed that the collation would be stored in a single byte. However the list of…
The MySQL Protocol is the network protocol that is used between a MySQL server and a client. This is called the “classic” protocol as there is now a newer protobuf based protocol called X Protocol . However the “classic” protocol is used by many database drivers, applications, etc. and also by MySQL Replication. The MySQL Protocol has the option to compress network traffic. Most client libraries…
The code for this tutorial is available here . Objectives This tutorial demonstrates how easy it is to add a new function to TiDB that can be used in a SQL-statement. We want to add a function for creating QRCodes. TiDB is aiming to be compatible with MySQL . However as the functionality we’re adding doesn’t exist in MySQL this isn’t a real concern. For reference here is the architecture of a TiDB…
I've updated the bug tide graph I made in 2016 with today's data. The source code and details are here .
Oracle recently announced a new authentication plugin: caching_sha2_password . This was added in 8.0.4 , the second release candidate for MySQL 8.0. The new plugin is also made the default (can be configured by changing default_authentication_plugin . Why? Phasing out SHA1 As Oracle said in the blog post to annouce this change they want to move to a more secure hashing algorithm ( SHA256 ). Which…
In conversations about SSL/TLS people often say that they either don't need TLS because they trust their network or they say it is too slow to be used in production. With TLS the client and server has to do additional work, so some overhead is expected. But the price of this overhead also gives you something in return: more secure communication and more authentication options (client…
Backup traffic After securing application-to-database and replication traffic, you should also do the same for backup traffic. If you use Percona XtraBackup with streaming than you should use SSH to send your backup to a secure location. The same is true for MySQL Enterprise Backup. Also both have options to encrypt the backup itself. If you send your backup to a cloud service this is something…
The mysql_sha256_password doesn't use the nonce system which is used for mysql_new_password , but instead forces the use of RSA or SSL. This is how that works: The client connects The server changes authentication to sha256 password (or default?) The server sends the RSA public key. The client encrypts the password with the RSA public key and sends it to the server. The server decrypts the…
In my previous blogs I told you to enable SSL/TLS and configure it to check the CA. So I followed my advice and did all that. Great! So the --ssl-mode setting was used a few times as a solution. And it has a setting we didn't use yet: VERIFY_IDENTITY . In older MySQL versions you can use --ssl-verify-server-cert . Both turn on hostname verification. The attack Get any certificate which is trusted…
In my previous blogs I told you to enable SSL/TLS and force the connection to be secured. So I followed my advice and did forced SSL. Great! So now everything is 100% secure isn't it? No it isn't and I would never claim anything to be 100% secure. There are important differences in the SSL/TLS implementations of browers and the implementation in MySQL. One of these differences is that your browser…
Intro In my previous blog post I told you to use SSL/TLS to secure your MySQL network connections. So I followed my advice and did enable SSL. Great! So first let's quickly verify that everything is working. So you enabled SSL with mysql_ssl_rsa_setup , used a OpenSSL based build or put ssl-cert , ssl-key and ssl-ca in the mysqld section of your /etc/my.cnf and now show global variables like…
Intro In a set of blog posts I will explain to you how different attacks on the network traffic of MySQL look like and what you can do to secure your systems againt these kinds of attacks. How to gain access To gain access to MySQL network traffic you can use tcpdump, dumpcap, snoop or whatever the tool to capture network packets on your OS is. This can be on any device which is part of the…
Running out of disk space is something which, of course, should never happen as we all setup monitoring and alerting and only run well behaved applications. But when it does happen we want things to fail gracefully. So what happens when mysqld runs out of disk space? The answer is: It depends It might start to wait until disk space becomes available. It might crash intentionally after a 'long…
The mysql client is a tool which I use every day as a DBA. I think it's a great tool. When I used a client of several other SQL and NoSQL databases I was quickly reminded of all the features of the mysql client. Note that psql (PostgreSQL client) is also very nice. Some other interesting things about the mysql client: It is build from the same mysql-server repository as MySQL Server. The source is…
In a recent labs release a new feature was introduced by Oracle, or actually two very related new features were introduced. The first new feature is Common Table Expressions (CTEs), which is also known as WITH . The second feature is recursive CTEs, also known as WITH RECURSIVE . An example of WITH : WITH non_root_users AS (SELECT User, Host FROM mysql.user WHERE User<>'root') SELECT Host FROM…
The issue On 12 September 2016 (three days ago) a MySQL security vulnerability was announced. The CVE id is CVE-2016-6662 . There are 3 claims: By setting malloc-lib in the configuration file access to an OS root shell can be gained. By using the general log a configuration file can be written in any place which is writable for the OS mysql user. By using SELECT...INTO DUMPFILE... it is possible…
On the MySQL Bugs website there are some tide stats available. These show rate of bug creation. I've put them in a graph: I made these with this IPython Notebook . There are more detailed graphs per version in the notebook. Update: The version in the notebook now uses the same range for the Y axis and has a marker for the GA dates of each release.
This is a response to the JSON document fast lookup with MySQL 5.7 article by Frederic Descamp. It is very easy to also use MySQL Workbench and the new GeoJSON support to actually show the features. My query: SELECT ST_GeomFromGeoJSON(feature->"$.geometry",2) AS feature FROM test_features WHERE street='BEACH' ; The result: