« first day (1681 days earlier)      last day (3190 days later) » 
07:00 - 20:0020:00 - 23:00

7:04 AM
Congrats on the diamond @PaulWhite . Well deserved. DBA is lucky to have you around.
 
@MikaelEriksson Well, we'll see. I'll try. And thanks!
 
7:35 AM
@billinkc Admittedly, 1 PW is still an enormous amount of power.
 
7:54 AM
You won't hear from Bill for a while ;)
 
@PaulWhite abusing your mod powers already, nice!
 
Would be rude not to, eh?
 
I'd be disappointed if you didn't
 
And no more deserving target than ol' comedy Bill.
 
 
1 hour later…
9:27 AM
Pretty please, Santa, can I have one of these?
2
 
 
2 hours later…
11:47 AM
morning
 
evening
 
afternoon
 
morning (midnight)
Is this a terrible question?
-4
Q: Database fragmentation

JuneHow can we find the list of fragmented objects in the database. And how much space we can reclaim by defragmenting those objects.

I mean, it's brief, sure - but is it actually terribly localized? Don't Oracle people want to know such things?
Just wondering what people think. Not massively concerned.
 
12:04 PM
Just added a reopen vote. Make the mod decision harder ;)
 
I'll confuse it more and say the whole thing is meh. The question is not good but so is the answer.
It verges on a link-only answer to me
 
@bluefeet What would make it a good question? And, <devil's advocate> how is a better answer going to appear if it remains closed?
I wonder if we have a better Q & A for the underlying question already. I couldn't find it so far.
 
@PaulWhite you voted to close it, too.. You should know :P.
 
I don't see one, it seems like a rtfm type of question. The only reason is wasn't auto-deleted was because the answer was upvoted
 
@Marian Turns out I'm not infallible :)
@bluefeet You might be right. I can just imagine quite a good version of that question, at least for SQL Server. It would require writing some DMV queries, for instance.
 
12:11 PM
@PaulWhite ok now, don't worry, give that little diamond to @Bill. Slowly..
we voted for you because you were perfect :/
 
You must be sooooo disappointed right now.
Too late though! MWAHAHAHAHA
 
14 hours ago, by Paul White
With great power comes a great lack of responsibility.
brilliant :D
 
What have we done
 
@PaulWhite 8 months / 120 views on the question - not a strong signal it's drawing positive attention
 
Now you're just confusing the whole issue with facts.
3
 
12:13 PM
you're welcome
 
Almost 9 actually, and for almost 8 of them the question has been closed – probably couldn't draw much attention in that state.
 
@AndriyM a good answer to a problem can still draw attention to a post
it happens on SO a lot
 
Much higher volume there though. 120 views isn't awful here, but hardly compelling either; though @AndriyM makes a good point. Also the title is hardly SEO gold.
Conclusion: everybody wins.
Except me, obv.
 
12:28 PM
Should the latest revision by rolled back?
It seems to change the intent of the question, after it has been answered and answer accepted.
 
Reopened this question since the (relatively minor, in my view) latest edit makes it clear it is not a duplicate and the existing accepted answer is not invalidated by the change. — Paul White ♦ 35 mins ago
And comment by the OP on the accepted answer:
This reply solved the problem and performs better in the benchmarks against my database. As I have no intention of using JSON returns this is the most useful answer. — Gauss 4 hours ago
 
@PaulWhite OK, but the question was focused on how to preserve the column names and json was related.
> changing the sites selection to
> array_to_json(array_agg(row(sites."name", sites.created))) as sites
> causes the fields to lose their names
This was in the original question. If they had included that they don't care about JSON, the answers would probably be entirely different.
 
@ypercube I thought about that, but the OP seems pretty clear that he's happy with the json-ness or not of the accepted answer.
 
It doesn't seem right to me.
 
Overall, I'm happy it's in the right state now.
 
12:36 PM
What if a new answer comes in - that using the added paragraph *"performing the array selection without using JSON is preferred"* - has no json functions at all. And is accepted.
I think I wouldn't be happy if I had originally answered.
 
@ErwinBrandstetter LATERAL is exactly related to the question. Failing to use LATERAL is why your altered query in your edited answer does not work. The post is not misleading. The title and summary contained nothing about JSON and it was deliberately not tagged with JSON, the accepted answer meets the requirements of the post exactly. — Gauss 2 mins ago
@ypercube Maybe so, but there's often someone left less than perfectly happy after these things play out. The existing answer stands to maybe lose an accept, while keeping the upvotes. Overall, I think that's a better outcome than the alternatives. I might be wrong, of course.
 
@PaulWhite All right but how this matches this part of the question?
> however I would like not to have the "id" field in the JSON output.
 
@ypercube Well Gauss might be wrong too :) But it's his question after all. If you see a better way forward, feel free to express it!
 
12:54 PM
Erwin seems to be responding positively anyway, with @AndriyM's help ;)
 
1:12 PM
Did I do anything? ;)
Seriously, though, I think Erwin was already on the verge of submitting his edit when I commented. The notification about the edit came very soon after my comment and it was a little more than what I mentioned – very likely that he'd already noticed the issue at that point.
 
Yes he went through a rapid series of edits in the grace periods.
@AndriyM Nicely done on the comment clean up by the way. Though it's still visible to some people :)
 
Yes, to those with petawatts of power.
 
Kin
Hello All
 
Hey Kin
 
1:31 PM
Why? If you can drive a car or ride a bike the 'correct' way, do you want to know other ways of doing those things too? This site is for asking "practical, answerable questions based on actual problems that you face.". You don't have an 'actual problem' you need to solve. — Jack Douglas ♦ 1 min ago
I'm tempted to delete the question altogether
@ConcernedOfTunbridgeWells there's been a couple more tube strikes announced around that date
 
@JackDouglas It isn't very likely to offer lasting value. Aditya has good answers. Don't see the point in keeping it.
 
@JackDouglas Indeed. I'm looking into the week earlier as @MarkStorey-Smith might be in town then. Haven't had any confirmation yet, though.
 
have you seen his latest question? (unpivot)
Almost all his question has something like "I want his but not in that way and not using that or ..."
I've flagged several comments in his SO questions 2 days ago that were just requests to the any guy had answered them, to go and check his dba X question and help him solve it.
 
Not a sparkling set of contributions so far.
 
@ypercube ypur comment there is 'the answer'
 
1:45 PM
@JackDouglas I meant to add "problem solved." but seemed too much ;)
 
@ypercube agreed; but I'm thinking it's not because scanning a table is "faster" than navigating through an index.
 
No, true. I plan to make a new question - and answer - about this. Probably on the weekend.
As I don't think the OP has any plans to make such a question.
 
My first foray into code review. Immediately upon posting I was hammered with complaints about the title.
3
Q: This code performs loops and times them

Aaron BertrandI am a casual C# programmer, not formally trained in OOP at all; mostly I focus on Transact-SQL in SQL Server, and so when I write C# apps I get grief about the constructs and methods I use. Here is a simple app I wrote for this blog post - it was not meant to be a production app, and performance...

^---- not the original title, btw
 
Can I pick the brains of the gurus in here for some pointers on sqling stuff?
 
@AaronBertrand The title doesn't have to be too wordy. Just describe the purpose of the code there with a short description. Your body is fine already. — Ethan Bierlein 23 mins ago
@AaronBertrand At least you have a fine body :) Oh and LOL at the edit description.
@bluefeet Sure.
 
1:56 PM
@AaronBertrand what are you trying to accomplish - making the code run faster?
 
@MaxVernon not really, no
Just told that my C# sucks
^--- see the comments
@PaulWhite seriously, that was a lot of discussion about the title
@Max It seemed to do exactly what I wanted to do, and to me is easy to follow and understand. But I would like to write more optimal code (even if those changes don't make it faster)
 
@PaulWhite I'm looking for possible ways to identify obsolete posts and I'm trying to do this using voting velocity - meaning we check the # of up /downvotes over time. If a post is garnering more DVs now, then that might be a signal for obsolete data. I tried a variety of things to get this, like total number of months a post has been around, the total # of UP/Down votes during that time
 
@AaronBertrand I too look forward to Code Review Beta Title Review Alpha
 
@AaronBertrand it doesn't seem overly bad to me. The comments about using for ... instead of while are pointless, and only reflect the style of the developer. The compiler optimizes them to the same code path anyway.
The key to "good" code is to make it readable and understandable down the road. And NEVER use EF (not that you would)
 
@MaxVernon Entity Framework?
 
2:02 PM
@Zane yes. Have you seen the queries that monstrosity generates? Oh, and it's not just Entity Framework; pretty much any object model code generator is going to suck at writing SQL.
 
@MaxVernon don't worry, ORM is a four-letter word in my house and in my company
 
lolol. no kidding!
I can't wait until Cortana can write T-SQL for me. /sarcasm
 
Ouch
once again -- an incredibly good answer to a really dumb question. Thanks Aaron — Hogan 3 mins ago
3
 
@MaxVernon Oh I know. I was just making sure I knew what you were talking about.
My C# skills are not good.
 
@Zane phew
 
2:08 PM
@AaronBertrand Would up vote, but hit the cap again.
@bluefeet I did read your meta question/discussion just recently, but are you asking for algorithmic input, or a way to construct accurate/fast T-SQL to implement that algorithm on SEDE? Sorry if I'm being slow, has been a long day.
Credit where it's due:
5
A: This code performs loops and times them

EBrownIn the case of both if your while loops, you could easily make them for loops instead, which tends to be the best practice. int i = 1; while (i <= 100000) { // main while code i++ } Should be rewritten as: for (int i = 1; i <= 100000; i++) { // main while c...

A reverse Q/A role for:
9
A: Select all records, join with table A if join exists, table B if not

Aaron BertrandHere is the first approach I came up with: DECLARE @ChosenLanguage INT = 48; SELECT sc.Id, Result = MAX(COALESCE( CASE WHEN lst.LanguageId = @ChosenLanguage THEN st.Text END, CASE WHEN lst.LanguageId = sk.DefaultLanguageId THEN st.Text END) ) FROM dbo.SupportCategories AS sc INNER JO...

Funny.
 
Neat, how did you find that?
 
@PaulWhite I'm trying to figure out a way to query this somehow in SQL on our version of SEDE. The public version doesn't have voting data
 
@AaronBertrand TL;DR: Got lucky. // He said you were a legend on dba.se, so I looked his user up, and there was that question with your answer.
 
@PaulWhite the story I made up in my head was much better
 
@AaronBertrand Actually I used advanced Quantum Physics and a length of rubber hose. Didn't want to make you feel inadequate.
 
2:20 PM
@PaulWhite is just overwhelmed at being a diamond
 
A little, perhaps ;)
 
it happens to everyone
 
@bluefeet Well obviously I'll help in anyway I can, but I don't know SEDE really at all, let alone being able to imagine how the voting data is structured. I hope someone else says something on this topic soon because this is getting awkward LOL
 
@PaulWhite haha.
I figured you knew everything
 
-4
Q: One to Many Relationship Join Issue

blmillerI'm working with a ticketing program where a Incident can lead to multiple tasks and I'm having an issue where I need to build a query to get all active Incidents where all the tasks are closed. The issue I'm running into is if an incident has 3 tasks and 2 of the tasks are complete with 1 still ...

Might as well say "Can you help me with the thing, you know that computer thing."
 
2:35 PM
@bluefeet No, only SE employees know everything
 
@bluefeet Is there a defined period for questions/answers to be considered old? A period for votes to be considered recent? Perhaps the percentage of the "recent" downvotes of their total number could be an indication?
 
Yeah I suspect window functions are going to be your friend. SEDE is on 2014, right?
 
JNK
@bluefeet Have you tried a PIVOT?
but yeah windowing functions are the way to go on that
Top of my head, something you could do is build a CTE to get the last X votes for each post, and then join to that to determine the vote velocity
 
2:51 PM
i tried to unpivot last night but decided that select x,y,z,zval from t union all select x,y,a,aval was more straightforward
 
Not necessarily window functions, perhaps just normal aggregate functions.
 
@AndriyM whatever time frame I want - but I'm looking at the life of the post - same for example an answer got 100 Upvotes in the 1st year but over the past 3 years it steadily gets DVs and no upvotes, then we wold use that as a signal for possibly being obsolete
 
unpivoting time-series data is a PITA.
 
JNK
;WITH RecentVotes AS
(
	SELECT p.PostID, v.VoteID,
	RN = ROW_NUMBER() OVER (PARTITION BY p.PostID ORDER BY v.VoteDateTime DESC)
	FROM Posts P
	JOIN Votes V
	 on P.PostID = V.PostID
)
You can join on that WHERE RN < 20 to get last 20 votes per post
 
Is there a preferred "Code Documentation" style for SQL-Server? Just started my first DB-related job a couple of days ago and I'm finding myself documenting a number of ad-hoc queries saved as *.sql files
 
2:55 PM
@JNK wow. two days in a row?
 
I was thinking you might want a rolling/running aggregate as well/instead.
 
I'm finding myself using a style similar to JavaDoc because that's what I'm most used to, but don't know if that's appropriate or preferable
 
JNK
@swasheck im trying to do better
Work still kicking my butt
 
in my experience (which is limited compared to others), i'm happy just to find documentation at all
2
 
@Phrancis I'm pretty sure most shops just agree on a style that works for the people involved. There might be actual standards and products/tools out there, not sure.
 
2:57 PM
@swasheck Likewise
 
SELECT SUM( (case when upvote then 1 else -1 end)
                   / (1+datediff(month, v.VotedateTime, getdate())))
          / count(votes)
FROM ... ;
 
@JNK now that we've elected @PaulWhite you're starting to feel the heat? yeah. i try to compare myself to him all the time. always found wanting.
 
@PaulWhite I tried something similar to that with lead/lag but obviously I might be doing something wrong - my sql skillz are failing me
 
will give you some rough idea (recent votes counting more than old ones)
 
JNK
@swasheck no but it made me more aware of how little I've been around
 
2:58 PM
@ypercube ooo, interesting I'll play with that
 
@bluefeet ROWS UNBOUNDED PRECEDING FTMFW
 
@swasheck You drink beer better than me :)
 
@PaulWhite you got me
but i'm starting to dislike beer
 
You're doomed then!
 
daughter has celiac so we purged gluten ... beer is hard to come by and so i've come to not enjoy it as much. i'd much rather have scotch
 
3:00 PM
@swasheck bourbon and ginger ale
 
@bluefeet If only there were somewhere convenient you could ask about this, maybe with some sample data or something...?
 
@bluefeet scotch. neat.
 
JNK
@swasheck Manhattans are the best
 
@PaulWhite I see, I'll ask around. AFAICT I'm the first person here to think writing documentation in queries is a good idea.
 
@swasheck I'm on a red wine thing at the moment. Well not right now
 
3:01 PM
/**
 * Find Server & DB location, basic client info and transaction information where processing has encountered key reference issues.
 *
 * Note: Connect to server PBISQL72I1\IFR to run this.
 *
 * Manual Check #1
 * Run `03 - Telehealth Mark Status As Error.sql` if...
 *   - result of query `02 - TeleHealth GetPatient ID.sql` based on `Patient.[THVSPI_PATIENTNAMELAST]` is null,
 *   update Processed to 'E'.
 * or...
 *   - `Patient.[THVSPI_INSERTDATE]` from this query is between `epi_StartOfEpisode` and `epi_EndOfEpisode`
 
@PaulWhite i would say that i'm better at injuring myself ... buuuuuuuuuutttttt ... push
 
@PaulWhite yes I could but then the world will know what I'm working on.....
 
@Phrancis Yes it's surprisingly rare.
 
@JNK i do enjoy a good manhattan ... and a good old fashoined
 
I think it looks OK, at least to me - But this is a C# shop so JavaDoc-style might look foreign :)
 
3:01 PM
@bluefeet You're also doomed then.
 
@PaulWhite i enjoy red wine. we're bottling some tomorrow evening with some friends
 
@PaulWhite exactly :)
 
And the day started so well.
 
JNK
@bluefeet you could always ask in...that other place
 
@bluefeet So you can't reveal the algorithm publicly? Or are you just worried about the data? Or ... just that people would know you work?
 
3:03 PM
@PaulWhite all of the above :P
 
You're just making this hard for fun now. Private chat room?
 
@bluefeet Things you can play with might be the granularity and constants. changing (1+datediff(month, ... to (@c + @d * datediff(day, ... where @c=1, @d = 0.02 for example, etc.
 
I'll try to mock up some data
 
JNK
@PaulWhite the secret is that they just store a running total for votes and are embarrassed
 
Aha!!!
 
3:04 PM
@JNK that's not a secret
 
There are all sorts of cool things that can be done in this area, we just need a little detail to work with.
And there are degrees of private chat room we could invoke.
 
@bluefeet how closely does the stackexchange data dump format mimic the actual logical model?
exactly. that guy's an idiot
 
@swasheck there is no voting data in that
 
@bluefeet in the dump?
 
I hear he doesn't even drink beer.
 
3:06 PM
@swasheck I believe so
 
so the [Votes] table is an aggregation
@PaulWhite as untrustworthy as a left-handed person
 
@swasheck oops sorry, some of it is purged
 
backtracking like michael dukakis
 
@ypercube Do you think there's any hope for that Relax question? The one with the super long chat?
 
@ypercube this is where I started to get this. Basically, I was trying to get the total # of months for an answer, the number of up/down votes during that time and number of distinct months a vote came in to the answer.
then I was going to try to get the velocity by looking at the totalvotes / the number of distinct months for each type of vote - I was thinking this was the speed of the votes
then using that "speed" to get the velocity over the life of the answer - but I think that's the wrong way to go about it
 
3:23 PM
I missed the discussion. Is this to try to find obsolete answers?
 
Yes
 
@Lamak yes trying to find a signal that something might be obsolete
 
@PaulWhite was going to post a link to the frankie goes to hollywood video ... but some may consider that nsfw
 
@bluefeet sounds like a difficult problem
 
@Lamak it is, which is why I'm picking the brains of the heap
 
3:25 PM
@bluefeet If I had to try something, I think I would start with question that have generic technologies tags (like [sql-server]) with no version, and just see old answers
 
@bluefeet i think that you need to figure out what are you key indicators of obsoletion. vote acceleration ... is that the best metric? i'm not sure, because the answer's popularity is probably more correlated with the question's popularity than it is with the answer's obsoletion
 
but that's too simplistic
 
@swasheck we are assuming voting velocity is the indicator of it. Let's say there is an answer that's been highly upvoted for years but the technology changes (no one edits the answer) so people to come upon it start DVing it. If this answer no longer gets upvotes but steadily accumulates DVs, we are assuming something might be wrong with it
I know that's not a perfect solution but we have to use something
 
@bluefeet I think the key might be to define precisely what "velocity" means. It could be as simple as a change on the previous period, or more complex like a delta on a rolling average. All these things are possible to express in SQL.
 
which is why i used "acceleration" ... also you qualified it ... vote acceleration, dependent upon edit velocity
 
JNK
3:31 PM
yeah I think acceleration is a better term here
change in velocity
it's going from "good" to "bad" which is downward accel
 
@PaulWhite so here's another way I tried to find this - data.stackexchange.com/stackoverflow/query/… only taking answers with a Score > 10
 
JNK
velocity is the direction and magnitude, so a lot of upvotes
 
ok, then acceleration. We've been discussing it as velocity so that's where my brain has been stuck
I've probably been thinking about it too long
 
JNK
I like it though
So you have two things you need to quantify...magnitude (number of votes) and direction (up or down)
over X time period
 
that's what I was trying to do here - data.stackexchange.com/stackoverflow/query/…
 
JNK
3:33 PM
Then you can detect the change in that
which would be a good indicator I think
 
but I know I'm going about it wrong
 
@bluefeet what's the granularity? votes per day? per hour? per minute? per week?
 
@swasheck I was using month because we're looking at all answers over time
 
how are you weighting edits to the answer?
 
JNK
honestly if you take the velocity/acceleration model you may not need to aggregate over time
 
3:35 PM
@swasheck I'm not. Right now I'm trying to find a signal that something might be wrong based on votes
 
@JNK yes you do.
 
JNK
velocity is at a point in time
So AT noon today this post has 10 net upvotes
At noon tomorrow it has 8 net upvotes
 
instantaneous velocity is. acceleration is change in velocity over time
 
JNK
At noon Friday it has 5 net upvotes
yeah but you don't need ot aggregate
you know what it is at 2 points and just get the delta
You don't need to know "this many votes in the past month"
 
See why I needed help with this discussion. :)
 
JNK
3:36 PM
yeah
 
@JNK yeah. i've not even gotten to the aggregate thing.
 
People here seem convinced that we are being payed per line of code. Or maybe by the pound.
 
i agree that aggregates may not be in play, but time and granularity almost certainly is
 
JNK
oh time is for sure
 
Isn't everyone paid by the chat message?
 
3:39 PM
Change of score in the first N months versus change of score in the last M months?
4
 
JNK
@PaulWhite that reminds me, be sure to check out SQL Sentry Performant Adviser™ for all your Performant Advicing needs!
 
Especially the sign of change
 
JNK
<cashes check>
 
Well played.
 
JNK
there is some weird ad logic happening in twitter for me with SQL Sentry
every link I open has embedded sql sentry ads
which kills me because I ALREADY BOUGHT YOUR PRODUCTS
 
3:40 PM
@JNK not just twitter for me. it's every site :)
 
JNK
I'm a fan and supporter
 
just mobile browsers, though
 
JNK
@AndriyM nailed it
 
i think @AaronBertrand hacked my phone
 
JNK
and the best part of that, @AndriyM, is that it's change in acceleration
the technical term for which is...
In physics, jerk, also known as jolt, surge, or lurch, is the rate of change of acceleration; that is, the derivative of acceleration with respect to time, and as such the second derivative of velocity, or the third derivative of position. Jerk is defined by any of the following equivalent expressions: where is acceleration, is velocity, is position, is time. Jerk is a vector, and there is no generally used term to describe its scalar magnitude (e.g., "speed" as the scalar magnitude for velocity). According to the result of dimensional analysis of jerk, [length/time3], the SI units are m/s3...
 
3:42 PM
Drop the mic
 
@JNK I kind of suspected that with velocity and acceleration we were getting nowhere. :)
 
@PaulWhite Since you're getting paid by the chat message, do you know what the rules named _OJNtoSM do?
 
JNK
is SQL Fiddle dead?
 
@JNK isn't it always
 
@JamesLupolt Explores a logical outer join implemented as a sort-merge
 
3:44 PM
@PaulWhite I might answer if I'm not bored
It's not very clear though.
 
@PaulWhite Thanks, I was having trouble figuring out that SM meant sort-merge.
 
@ypercube Ok thanks. I was toying with putting on hold as unclear until the chat discussion came to a conclusion and the question was put into an answerable form.
 
@PaulWhite Rolando has answered. I'll check if I can add anything
 
Cool.
 
The chat was more of a train wreck, more than the yesterday's with the "index-scan is slower than table-scan" guy.
 
4:03 PM
@ypercube IIRC you came to a common conclusion at the end of that one, so it wasn't all bad was it?
Today's did ruin a perfectly good train, it's true.
 
@PaulWhite Yesterday's?
 
@ypercube Yes. The ignore all indexes one.
 
Yes. I told Andriy I might post a question and answer about that issue. "Index scan slower then table scan oddity"
 
Sounds good.
 
@ypercube It's embarrassing but I don't remember you telling me that...
But of course Andriy is not a very rare name in Ukraine, so...
 
4:18 PM
really it could have been anyone
and who are these dipwads?
> Opponents have called pro-metric people communists and other not-so-nice labels.
 
@ypercube I guess I misunderstood. We did talk about that some time ago, I remember that. I just thought for a moment that you meant we talked about that yesterday or otherwise very recently.
 
4:37 PM
@AndriyM Sorry, it was someone today.
I thought it was you but I'm obviously wrong about that. It was Max.
Max, Andriy, ... Dementia is showing
 
@ypercube You remember the names – all is not lost.
 
 
1 hour later…
Kin
5:51 PM
Has anyone see the errror before
It says the .wrk file is being used by another process(mscorlib) .. I checked using PsFile but cannot find any file handles
 
@Kin Maybe something like antivirus, a software inventory scanner, or SCCM was opening it?
 
Kin
@JamesLupolt we are running Microsoft endpoint protection .. but it happens randomly on this server only .. there are other servers running logshipping with endpoint protection running but we dont see the symptoms there
 
I think the message is that saying that the error is occurring when executing a function in the mscorlib library, not that mscorlib is the process that has the file open. It's phrased oddly.
 
requiring me to login to SQLServerCentral.com SUCKS. Why do I need to login???
4
 
+1 @MaxVernon ... would vote again
 
6:04 PM
@Kin Perhaps it's a timing issue or you need to adjust the AV exclusions? My workspace is using MS Endpoint Protection without issues (that I know of!), but we have all SQL and SSAS filetypes and processes excluded.
@Kin How often does the error happen?
 
@MaxVernon just sucks.
 
@swasheck I understand the "economics" of trying to get everybody who visits you to "sign up", but FFS, please make it stop!!!
 
Kin
Its happening since 2 days
 
and @swasheck I didn't mean to make it sound like that is your fault.
 
I would consider using Process Monitor to track file open calls to .wrk files from processes other than SQL Server.
There isn't that much overhead if you configure it carefully.
 
Kin
6:06 PM
@JamesLupolt opened a case with MS .. since we have tried all possible tricks ... Good we have a good engineer (Chris Skorlinski - msrepl guy)
 
@MaxVernon didnt take it that way
 
@Kin Nice, I'm always relieved when I open a case with MS and get someone knowledgeable & helpful.
 
@swasheck I was going to read an article there; now I'm just going to hit the "X" to close that window.
@swasheck oh good. Just making sure!
 
canadian
2
 
lol
does anyone know of an existing rainbow table database of SQL Server login hashes? or do I have to make my own.
 
6:09 PM
huh?
 
TIL:
A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes. Tables are usually used in recovering a plaintext password up to a certain length consisting of a limited set of characters. It is a practical example of a space/time trade-off, using less computer processing time and more storage than a brute-force attack which calculates a hash on every attempt, but more processing time and less storage than a simple lookup table with one entry per hash. Use of a key derivation function that employs a salt makes this attack infeasible. Rainbow...
 
A rainbow table is a table with a list of colors in it... just like a numbers table contains a list of numbers.
Just kidding.
 
@JamesLupolt You were probably not, judging by that picture
 
@MaxVernon I'm incredibly curious what you're planning on doing.
 
@Zane i get the NSA bounty because i asked "huh?" first
 
6:13 PM
@MaxVernon I'm totally out of my league here, but I think rainbow tables are only helpful with unsalted hashes.
 
@MaxVernon google says something about project rainbow crack.
 
I'm thinking of creating a table of hashes and passwords, so I can easily validate password complexity. Also, we have a login we do not know the password for.
 
@JamesLupolt that is correct (as per my understandig)
 
And I'm pretty sure SQL Server salts everything (in recent versions anyhow)
 
i prefer curry
 
6:14 PM
@JamesLupolt yes they are. However, since SQL Server allows you to create a login with password, then extract the hash for moving to another server, you should be able to compare the known hash with the one generated by LOGINPROPERTY('xxx', 'PasswordHash')
I'm just testing it now.
 
@swasheck you are an underrated humorist
 
anyone care to run this, and share the hash?
CREATE LOGIN hashtest WITH PASSWORD = 'aaaaaaaaaa', CHECK_POLICY = OFF, CHECK_EXPIRATION = OFF, DEFAULT_LANGUAGE = us_english;

SELECT COALESCE(UPPER([sys].[fn_varbintohexstr](CONVERT(VARBINARY(MAX), LOGINPROPERTY(sp.name, 'PasswordHash')))), '')
FROM sys.server_principals sp
WHERE sp.name = 'hashtest';
on SQL Server 2012
 
ah, can't help you
 
my instance says the hash is
0X0200EF57BA374D1AD8C94B595AEB3AD5537676B3E10ECA0CDD8F0F0AA44975FBFCB46FFA5C5DB9700AEDEAD07B5A9485F6B73ABE7105B5E20C65C1DD20F0FC59EB4E8456621A
on 2008 R2, the hash is:
0X0100DC5F9CC0A0BEFB06516C0BC5D50E3984C2B4307A40F97A3C
 
6:21 PM
I got 0X0200C7D517133C297239994A03DA5A41F20741CFC63ED3AC1BC7B18C9A4ECDCA521F205883FA3797F1542104C6F706022A19FE23C0F99EADDBC87315D7E50E1B5BBEDEB9B1C8 on run 1 and
0X020039F002A5FD575E474D3C2E3585C86062C3FB1B1EE3C384EDDC6EF184209B574A6732D2500925C3D4558C6F5E64F4966A63C8E7AC67214FEC22310E50201DFC07AC68874F on run 2.
Both on 2012 SP2 CU3
 
oh well. so much for that.
thanks, @JamesLupolt
 
Sorry, the first time I pasted the same thing twice.
 
It sounded simple, but I wasn't all that hopeful to be honest.
 
@MaxVernon Is it worth trying brute force or dictionary-based methods instead?
 
@swasheck what's RT?
 
6:23 PM
@JamesLupolt I doubt it.
@Zane Russia Today
 
Putin Today
@MaxVernon I gave up on brute forcing (non-trivial) 2008 hashes after a few days. I'm not sure how much faster it is if you have access to decent GPUs and lots of time.
But to be honest, a good dictionary would have caught most of the SQL passwords at several places I've worked.
 
@swasheck can't find a confirming report elsewhere.
Not even from their source.
There we go. BBC has it now as well.
 
@JamesLupolt if SQL Server can deduce the password from the hash, the salt must be predictable.
 
JNK
6:40 PM
@MaxVernon it could be based on a machine key of some sort
 
although I suppose that doesn't help with storing the hash, and comparing them. I guess that's the point of it being salted.
 
@MaxVernon Interesting point. I'm curious how it works now.
 
JNK
actually no it's not a machine key if its transferrable
 
one gets the impression one just needs the source code for SQL Server, et voila
@JNK I'm thinking it must be something related to the login name; although there must be something temporal in there since the hash is different each time it is generated by the same instance.
CREATE LOGIN hashtest WITH PASSWORD = 'aaaaaaaaaa', CHECK_POLICY = OFF, CHECK_EXPIRATION = OFF, DEFAULT_LANGUAGE = us_english;

SELECT COALESCE(UPPER([sys].[fn_varbintohexstr](CONVERT(VARBINARY(MAX), LOGINPROPERTY(sp.name, 'PasswordHash')))), '')
FROM sys.server_principals sp
WHERE sp.name LIKE 'hashtest%';

DROP LOGIN hashtest;

CREATE LOGIN hashtest WITH PASSWORD = 'aaaaaaaaaa', CHECK_POLICY = OFF, CHECK_EXPIRATION = OFF, DEFAULT_LANGUAGE = us_english;

SELECT COALESCE(UPPER([sys].[fn_varbintohexstr](CONVERT(VARBINARY(MAX), LOGINPROPERTY(sp.name, 'PasswordHash')))), '')
^^^^^ that produces two different hashes
 
JNK
bizarre
 
6:45 PM
@JNK yeah, it's a mind-bender
 
JNK
what version of SS are you on?
 
the above was ran on 10.50; it also produces two different, much longer hashes on 11.0
 
JNK
ok
 
Guy behind me keeps asking why his processes are running so slow. Easy answer there cheif. Because you wrote it.
 
@Zane lol
Ziiiiinnnnng!
 
6:58 PM
He needs his test to finish by EOD or he can't move it to prod.
If it's taking this long I don't want it to go to prod.
 
JNK
@MaxVernon interesting reading here
7
Q: How to decrypt a password from SQL server?

sefI have this query in sql server 2000: select pwdencrypt('AAAA') which outputs an encrypted string of 'AAAA': 0x0100CF465B7B12625EF019E157120D58DD46569AC7BF4118455D12625EF019E157120D58DD46569AC7BF4118455D How can I convert (decrypt) the output from its origin (which is 'AAAA')?

answer by Ian Boyd is informative
 
@JNK yah, that is super-interesting! Thanks!
so you'd clearly need a rainbow table for each salt, i.e. a rainbow table for each and every login you're interested in. Which of course negates the advantages of a rainbow table in the first place.
hmmmm... actually no. you don't need a rainbow table for each and every password. You just need a rainbow table of HASHBYTES() for each password candidate, which you'd then pass through Ian Boyd's code.
very interesting.
nope. wrong again. natch.
 
7:47 PM
Security is complicated business.
 
JNK
yeah I read the IT Security SE newsletter
super interesting stuff in there
 
yep. This works, as adapted from Ian Boyd's answer:
CREATE TABLE dbo.Pwds
(
	Pwd VARCHAR(128)
);
INSERT INTO dbo.Pwds (Pwd)
VALUES ('aaaaaaaaaa');

SELECT sl.name
	, p.Pwd
FROM sys.syslogins sl
	, dbo.Pwds p
WHERE 0x0100 + CONVERT(VARBINARY(4), SUBSTRING(CONVERT(NVARCHAR(MAX), CONVERT(VARBINARY(MAX), sl.password, 0)), 2, 2))
	+ HASHBYTES('SHA1', p.Pwd + SUBSTRING(CONVERT(NVARCHAR(MAX), CONVERT(VARBINARY(MAX), sl.password, 0)), 2, 2))
	= CONVERT(VARBINARY(MAX), sl.password, 0);
assuming you've already ran CREATE USER hashtest WITH PASSWORD = 'aaaaaaaaaa'
at least, on SQL Server 2008 R2. Not on 2012+, clearly.
Running it with ~26,000 words in the dbo.Pwds table takes around 7 seconds on my box.
 
07:00 - 20:0020:00 - 23:00

« first day (1681 days earlier)      last day (3190 days later) »