I was looking into the history about why SYSDATE() and NOW() behave differently in MySQL, and it looks like in 4.0 and 4.1 they used to be the same. But as of MySQL 5.0, SYSDATE() was changed to emulate Oracle’s behavior, that is, it returns the time as of the function execution, not as of the statement start.

There are a number of bug reports related to this: 15101, 12480, 12481, and 12562.

I am not an Oracle expert. Does NOW() return a constant result within an Oracle query, like NOW() in MySQL does? Or is there no NOW() in Oracle, and you use SYSDATE() instead? Why is Oracle’s SYSDATE() functionality worth emulating? It looks to me like some …

I’ve been seeing a few occasions where Neil J. Gunther’s Universal Scalability Law doesn’t seem to model all of the important factors in a system as it scales. Models are only models, and they’re not the whole truth, so they never match reality perfectly. But there appear to be a small number of cases where systems can actually scale a bit better than linearly over a portion of the domain, due to what I’ve been calling an “economy of scale.” I believe that the Universal Scalability Law might need a third factor (seriality, coherency, and the new factor, economy of scale). I don’t think that the results I’m seeing can be modeled adequately with only two parameters.

Here are two publicly available cases that appear to demonstrate this phenomenon: Robert Haas’s recent blog post on PostgreSQL, titled …

This year’s Surge conference was a great sophomore event to follow up last year’s inaugural conference. A lot of very smart people were there, and the hallway track was great.

I presented on three things: a lightning talk about causes of MySQL downtime; I chaired a panel on Big Data and the Cloud; and I showed how to derive scalability and performance metrics from TCP traffic. I’ve sent my slides to the Surge organizers, and I understand that they will be posting them as well as integrating them into the video of my session. In the meanwhile you can download my slides from Percona’s presentations page.

Further Reading:

• I’m speaking at Surge 2011
…

“I want to ensure that the MySQL code base (under the name of MariaDB) will survive as open source, in spite of what Oracle may do.” -- Michael “Monty” Widenius. Michael “Monty” Widenius is the main author of the original version of the open-source MySQL database and a founding member of the MySQL AB company. [...]

A special extended edition of Tech Messages for 2011-08-31 through 2011-09-21:

• Lab Overview
  This guy is serious about his lab!
• Throughput
  All sorts of useful information here. My favorite is the first table which includes bandwidth and packet throughput for different kids of circuits.
• Must see: 5 Steps to Scaling MongoDB (Or Any DB) in 8 Minutes
  These tips are relevant no matter what database system you are using.
• Understanding and …

Two of my proposals for Percona Live London on October 24-25 have been approved! Yes, I really had to propose them and get them approved like everyone else, although as I’m sure you can imagine, I had a good chance at being accepted :-) Not all of my talks were accepted, though.

I’ll be presenting a half-day tutorial on how to get great results when troubleshooting MySQL problems, and a conference session on how to use TCP packet headers to measure and analyze a surprising variety of aspects of MySQL performance and scalability.

The …

I’ve never objected to someone making money from MySQL. I’ve only expressed disappointment that they weren’t doing it effectively enough. As I have predicted many times, Oracle is good at this. Oracle is the number one reason I didn’t start a new career in some other database a few years ago. Oracle is making MySQL more successful not only for Oracle, but also for the users, the community, and the competition.

I am glad that Oracle is offering more pay-only extensions to the server in a way that creates opportunities for others to do the same, and I look forward to even more of them in the future.

Further Reading:

• …

I have just signed the contract for High Performance MySQL, Third Edition. The third edition will include major updates and new content in these areas:

• Recent performance and reliability advances, particularly in MySQL 5.5 and the InnoDB storage engine.
• A new chapter on using MySQL in cloud computing environments.
• Updates on modern hardware, including many CPUs, large memory, and solid-state storage.
• Improvements in clustering and high availability, including middleware and third-party solutions.
• Improvements in replication.
• New material on profiling MySQL, benchmarking, and tools and techniques to help you measure, monitor, and manage your MySQL installations.

The book will be available for purchase early next year. It’s been a great three years since the second edition was published, and …

As announced on the Maatkit and Aspersa mailing lists, Daniel and I have created a new toolkit that represents the union of the two, and will be focusing efforts on this Percona Toolkit moving forward. The goal is to make them simpler and significantly more powerful, and to create more tools. The tools will continue to be open-source, but will be developed primarily to meet our MySQL support and consulting staff’s needs.

If you’re interested in challenging software engineering in Perl and shell, then please apply online. You can work online from anywhere, but I strongly prefer someone in the Americas timezones.

Further Reading:

• Planned change in Maatkit & Aspersa development …

Time-Based Blind SQL Injection

 
Overview
=======
Blind SQL Injection is an attack which the attacker gets an indication for the query execution success. The attacker doesn’t get the query results.
Most of the time, the indication bases on server errors or customized application errors.

Time-Based Blind SQL Injection
======================
Sometimes the attacker might not be able to identify the query execution success, because the server/application doesn’t show any error.
One of the techniques to get an indication for the query execution success called Time-Based Blind SQL Injection.
With this technique, the attacker executes functions that take some time to finish (for example: Benchmark, Delay, etc.). By measuring the time took the application to response, the attacker might be able to identify if the query executed successfully or the query execution failed. …