" title="Mu Dynamics Blog">Mu Dynamics Blog - insites into vulnerabilities and secure coding practices

We launched pcapr over a year ago now with just a few of us working part time to build and manage the site. pcapr is powered by CouchDB, a NoSQL database written in Erlang with JavaScript as the primary query language. Frankly, this has been a disaster. We are planning on rebuilding the site with Java, Hibernate and MySQL for a number of reasons.

Programming, especially with databases, used to be challenging. I remember having late night meetings about tables, normalization and migration and how best to represent the data we have for each packet capture. For a startup, these kinds of late night meetings are critical in establishing a bond amongst the engineers who are just learning to work with each other. NoSQL destroys this human aspect in a number of ways.

Erlang is Spooky

CouchDB, written in Erlang is honestly spooky. With an up time of 8 months and memory utilization of 0.1%, we think it’s actually survived a few power outages too! The joy of running an online community site is the debugging, thinking and solving locking and concurrency issues, outages and how best to scale the site as the traffic continues to increase. CouchDB has taken all that fun away. :-( Things just work, we never have to see why something’s broken and not worry too much about scaling. This means we don’t have to hire more people to manage the site which means we can’t show the investors and our customers that we are growing rapidly.

Lack of JOINs kills the brain

A recent Scientific American article shows that solving complex problems actually helps the brain. Solving normalization and data representation issues increases brain development and helps the engineers be very creative about solving these challenges.

The whole Map/Reduce thing ruins everything and puts the brain in sleep mode for the most time. What used to take hours and weeks now just takes a couple of minutes and most of our engineers are starting to not show up to work. They get everything done in a few hours and go home and the office looks like it’s haunted. Not good, not good at all.

What’s up with this JavaScript anyways?

We want our typed languages back! We want compile errors, exceptions thrown around, dead locks, memory leaks, NULL pointer exceptions and more of those. When you can do 90% of the work in the browser, there is no compile-debug-run cycle anymore. What happens to all those IDE’s and compilers that other startups try and build? It ruins the economy, IMHO. What we need is native Java support in browsers. Maybe we can push the HTML5 group to seriously consider this. I would rather do

PacketSplitter packetSplitter = new PacketSplitter();
packetSplitter.run(new IPacketSplitterProcessor() {
    public void run() {
    }
});

than

packetSplitter.run(function() {
    ...
});

More code implies more complexity which means better brain cycles spent on debugging and solving problems.

No more SQL injection

NoSQL obviously means no more SQL injection and this just puts an end to all web app scanners. Gone are the days security engineers used to geek out on how 1+1 meant DROP TABLE, while all it now stands for is a boring 2! When your site doesn’t have SQL injection, you lose the ability to show off how much you know about prepared statements and input validation and frankly it’s a buzz killer at parties.

I could go on and on, but you get the point. Life’s just too simple now. And it shouldn’t be this way for startups. It’s bad for investors, bad for the economy and I think we are losing the edge that programmers used to have by switching to NoSQL.

So get on your logo makers and build a “Say No to NoSQL” banner. We need this No-NoSQL movement to help make startups fun again. And yes, we are ripping out CouchDB from pcapr and moving to an all Java, Hibernate, MySQL stack. If you find a page on pcapr that’s not vulnerable to SQL injection, please let us know! We can then do a coordinated security advisory and be the talk of the day!

If you’ve gotten this far. Stop. Check the date on the blog. Don’t panic. It’s just a blog. Still upset? Go load test your app with blitz.io and bring down some dynos. Should make you feel better.