Perimeter
11/4/2010
06:27 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%

NoSQL: Not Much, Anyway

I don't get the NoSQL movement. Most old-school database administrators don't. In fact, a lot of people don't understand what NoSQL is exactly because, quite frankly, there's not much there. Most of the features and functions we consider synonymous with databases are unwanted by developers of nontransactional systems and are falling by the wayside as companies push applications into the cloud.

I don't get the NoSQL movement. Most old-school database administrators don't. In fact, a lot of people don't understand what NoSQL is exactly because, quite frankly, there's not much there. Most of the features and functions we consider synonymous with databases are unwanted by developers of nontransactional systems and are falling by the wayside as companies push applications into the cloud.Conversely, application developers -- especially Web application developers -- don't "get" relational databases. They understand how they work, but they just don't understand why you need all that stuff. You know, like transactional consistency. Or predefined structures. Or rollbacks. Just give them some place to dump data -- any kind of data -- and a quick way to look it up again. They don't want to define data types in advance. They want all of the data manipulation and processing within their application. Further, accuracy and consistency are less important that speed and scale.

Database administrators respond by saying, "If you don't want the overhead of a database and you don't need transactional consistency, just use a file." And that's pretty much what application developers are doing and driving the NoSQL movement. The desire to store more data and inspect much larger data sets across distributed computing platforms has become a necessity for many Web-based applications. All without having to spend millions of dollars on a giant data warehouse. By reducing the complexity of the database engine, and by defining -- as they go -- how to store and reference that data, they get a lot better performance. It's a database, but it lacks most of the features and functions of relational database technology.

So what is NoSQL? That's a hard question to answer because NoSQL is more of a design concept than an actual product. Basically, NoSQL implementations are a storage engine. Most NoSQL variants strip away SQL statement parsing because NoSQL is not structured relationally. In many cases, there is no structure at all, just data with its index value. Without a relational structure, you remove the need for query execution plans, table concurrency, and locking for read consistency.

By removing all that code and complexity from the database engine, along with incredibly cheap memory from cloud service providers, most of the database code and data indices can be stored in memory. By removing tasks that require a lot of processing overhead and placing a higher percentage of code in memory, you speed operation by (nearly) an order of magnitude. Cheap and fast is a very attractive option!

I am certain there are some firms (Google, Amazon, and Facebook) and project managers out there who will be offended by my definition because BigTable, Dynamo, SimpleDB, and Cassandra are used by millions each day, whether or not they know it. But it's not off-the-shelf software. And for every relational trait a NoSQL database is supposed to forgo, you can always find one or more project or product variants that offers things like consistency, replication, or complex storage options.

Make no mistake: I am not trying to marginalize the efforts of the developers behind these projects or the need for this kind of tool. NoSQL is here and will be for a long time because it solves several fundamental problems for application developers. But don't confuse NoSQL with relational database. Think of it in terms of document storage.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.