A Fine Slice Of SQL Server
Chris Brown notes some changes:
I was doing some analysis work with R today (don’t get to do that very often anymore) and R wasn’t playing with VS Code nicely.
Turns out there has recently been a major update to the VS Code R editor extension.
So if you are having issues, check out the Extensions page for setup instructions.
Click through for some of the major changes and for some thoughts on Positron versus base VSCode. H/T R-Bloggers.
Leave a CommentWhile a valid cryptographic digital signature ensures the authenticity and integrity of a compiled binary, targeting dynamic database runtime components—such as In-Memory OLTP (XTP) directories—presents a severe attack vector if integrity controls are bypassed.
Because database services like SQL Server frequently operate under high-privilege service accounts (such as NT AUTHORITY\SYSTEM or a high-privileged virtual account), an adversary who achieves local administrative access could attempt to substitute or hijack dynamic runtime DLLs. A successful payload injection into the SQL Server process memory (sqlservr.exe) would inherit the service’s privileges, facilitating arbitrary code execution, local privilege escalation to SYSTEM, or the establishment of an outbound reverse shell.
Click through for a demonstration and Microsoft Security’s response.
Leave a CommentChris Webb deals with management:
As you’ve probably seen in the blog post for the September 2026 release of Power BI, Import mode and Direct Lake mode semantic models now support the ApproximateDistinctCount() DAX function. I tested its performance on a Direct Lake semantic model with a 1.4 billion row fact table based on the NYC Taxi sample data and as you would expect, it was a lot faster than doing a regular distinct count in most cases.
Chris notes that the primary challenge is human: getting people to understand that, for their purposes and at the scale in which approximate distinct counts makes sense, non-biased approximations are just as good as actuals. That’s because 119,374,399 and 118,998,706 generally aren’t distinguishable in practice for things like monthly unique user counts. In both cases, the actual business user would still write “120 million” (or maybe “119 million” to be more precise).
Now, in cases in which the precise number does matter? Absolutely use the real distinct count. But those scenarios are rarer than you’d think.
Leave a CommentHugo Kornelis continues a series on storage internals:
To understand spatial indexes, we first need to understand a process known as “tessellation”. This is a process where a shape is divided into smaller elements, that then can be recursively divided even further, to result in a list of cells with, for each, an attribute that indicates whether the object partially or fully covers that cell.
Read on to learn more about the concept, how SQL Server uses the idea of tessellation to convert shapes into a practical tabular form, and why it’s so valuable to have an index over this form.
Leave a CommentChad Timms lays out some benefits:
Flexera’s 2026 State of the Cloud Report found that estimated waste in cloud infrastructure and platform spend rose to 29% this year. That is the first increase in five years. Managing cloud costs remains the top challenge for 85% of respondents. Your database estate sits inside that cloud bill through licensing, capacity, and the people who keep it running. It is rarely examined line by line. Database cost optimization seldom fails for lack of effort. It fails because the spend gets treated as a purchasing problem when it is really an operating one.
Renewals get negotiated. Cloud service tiers get compared. Meanwhile, the decisions that actually set the number are made on the ground, often by whoever is on call that week. Below are seven questions a finance or IT leader can put to their own team, or to a provider, along with what a strong answer and a weak answer sound like.
The target of this post is more for managers versus line employees, but it’s good to think about how you would answer the questions in the post.
Leave a CommentIvan Palomares Carrascosa checks the date:
Topics we will cover include:
- How to extend standard subject-predicate-object triples into time-stamped quadruples stored in a simple temporal graph.
- How to calculate recency weights with exponential decay and use them to rank conflicting facts as of a given query date.
- How to tune the half-life parameter and integrate the temporal graph into a deterministic 3-tiered Graph-RAG retrieval pipeline.
This is especially important if you’re searching over the news or other systems that value more recent information over older information.
Leave a CommentWarwick Rudd takes us through some steps:
Most people know they need backups. Fewer have thought about what happens when somebody else gets to them first. Ransomware doesn’t start by encrypting your databases. It starts by finding your backups, because once those are gone you have nothing to recover to and every reason to pay. So a backup that anyone with the right credentials can delete is only a partial answer. It protects you from a failed server. It doesn’t protect you from someone who has made their way into your environment.
What you want is a backup that can’t be changed or deleted by anybody until the retention period you set has passed. Not an attacker, not a compromised admin account, and not you on a bad day. SQL Server 2025 makes this a lot more practical. Backup to URL now supports Managed Identity, so you can write backups to immutable Azure Blob Storage without handing out a SAS token or a storage key. There’s no secret sitting in a credential waiting to be found.
Click through for steps to set up the storage account.
Leave a CommentI’ve seen quite a few posts lately about how PostgreSQL can do everything. And, while I do believe it’s the most advanced and fastest-growing relational database available right now, that doesn’t change the fact that – at its core – it’s still a relational database.
This thinking goes all the way back to the mid-2000s, when I was working on SQL Server and starting to explore the NoSQL movement with Elasticsearch, Hadoop, Hive, HBase, and their respective tools.
Even back then, people said these new technologies could solve every problem. Take it from me: please don’t use any technology for every problem you have.
Read on for Pat’s argument. Pat has tailored this one specifically for PostgreSQL but you can swap out a few things and have it apply to pretty much anything.
Leave a CommentEmad Al-Mousa finds a way around:
Adversaries continuously exploit every available vector to exfiltrate sensitive data while evading detection. This risk is magnified because critical threats originate from both external cybercriminals and trusted insiders.
To counter this, robust database auditing acts as a foundational line of defense, enforcing tailored policies that align with corporate security and compliance mandates. By streaming these granular audit logs directly to a SIEM solution, Security Operations Center (SOC) analysts gain real-time visibility to spot anomalous queries and unauthorized modifications. Furthermore, these logs serve as an immutable evidentiary trail for post-incident forensics. Ensuring that the database security and logging engine functions reliably is therefore non-negotiable for enterprise risk mitigation, rapid incident response, and regulatory compliance.
The quick idea is that you can view database histogram data without tripping audit logs, and those histograms might contain some amount of the sensitive data that you don’t want people to see.
Leave a CommentCarlos Robles, et al, announce a new version of Data API Builder:
Data API builder (DAB) 2.1.5 is now available as a stable release, and it is about meeting modern data where it lives: documents next to rows, embeddings next to both. This release brings native support for the SQL
jsonandvectordata types to the REST and GraphQL endpoints, so the same entities that serve your CRUD traffic can now store and expose document-shaped data and embeddings without custom code. It also introduces DAB as an embeddable NuGet library, hardens the MCP endpoint, moves the engine to .NET 10, and ships a set of security and reliability improvements.
Click through to see what’s new.
Leave a Comment