Perimeter
11/4/2010
06:27 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

NoSQL: Not Much, Anyway

I don't get the NoSQL movement. Most old-school database administrators don't. In fact, a lot of people don't understand what NoSQL is exactly because, quite frankly, there's not much there. Most of the features and functions we consider synonymous with databases are unwanted by developers of nontransactional systems and are falling by the wayside as companies push applications into the cloud.

I don't get the NoSQL movement. Most old-school database administrators don't. In fact, a lot of people don't understand what NoSQL is exactly because, quite frankly, there's not much there. Most of the features and functions we consider synonymous with databases are unwanted by developers of nontransactional systems and are falling by the wayside as companies push applications into the cloud.Conversely, application developers -- especially Web application developers -- don't "get" relational databases. They understand how they work, but they just don't understand why you need all that stuff. You know, like transactional consistency. Or predefined structures. Or rollbacks. Just give them some place to dump data -- any kind of data -- and a quick way to look it up again. They don't want to define data types in advance. They want all of the data manipulation and processing within their application. Further, accuracy and consistency are less important that speed and scale.

Database administrators respond by saying, "If you don't want the overhead of a database and you don't need transactional consistency, just use a file." And that's pretty much what application developers are doing and driving the NoSQL movement. The desire to store more data and inspect much larger data sets across distributed computing platforms has become a necessity for many Web-based applications. All without having to spend millions of dollars on a giant data warehouse. By reducing the complexity of the database engine, and by defining -- as they go -- how to store and reference that data, they get a lot better performance. It's a database, but it lacks most of the features and functions of relational database technology.

So what is NoSQL? That's a hard question to answer because NoSQL is more of a design concept than an actual product. Basically, NoSQL implementations are a storage engine. Most NoSQL variants strip away SQL statement parsing because NoSQL is not structured relationally. In many cases, there is no structure at all, just data with its index value. Without a relational structure, you remove the need for query execution plans, table concurrency, and locking for read consistency.

By removing all that code and complexity from the database engine, along with incredibly cheap memory from cloud service providers, most of the database code and data indices can be stored in memory. By removing tasks that require a lot of processing overhead and placing a higher percentage of code in memory, you speed operation by (nearly) an order of magnitude. Cheap and fast is a very attractive option!

I am certain there are some firms (Google, Amazon, and Facebook) and project managers out there who will be offended by my definition because BigTable, Dynamo, SimpleDB, and Cassandra are used by millions each day, whether or not they know it. But it's not off-the-shelf software. And for every relational trait a NoSQL database is supposed to forgo, you can always find one or more project or product variants that offers things like consistency, replication, or complex storage options.

Make no mistake: I am not trying to marginalize the efforts of the developers behind these projects or the need for this kind of tool. NoSQL is here and will be for a long time because it solves several fundamental problems for application developers. But don't confuse NoSQL with relational database. Think of it in terms of document storage.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

CVE-2015-2922
Published: 2015-05-27
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?