As a side note, this is one of the amazing things I see with technology these days. There are many incredibly creative people who do amazing things. Even the music/reels/etc. that I don’t like can showcase amazing talent. I love it and hope more people can succeed at using their creativity to make a living.

The story in the song is that the boss heard AI was used by one person to do something amazing, so we should be doing that in our company. Does that sound familiar? Any of you out there being wow’d by stories told by management of some other company using AI to do more work than your entire team? I’ve heard a few of those stories from people, though not at Redgate. We know AI can help us, and we have a lot of usage in engineering, but our view is that AI assists and helps developers. It doesn’t replace them.

The song, and a few friends, note that AI is supposed to compress roadmaps and timelines. I do think you might get more code written, perhaps get things done that no one has time to do, but I’m skeptical that true production-level, high-quality systems are being built at 100x engineer speed. Some people might get more code written, and some people are amazing at directing AI.

AI models also go off the rails, and there are certainly some “steps backward” taken when models hallucinate or implement features that don’t exist. I’ve personally seen models tell me features could be used that don’t exist in SQL Server. Or that I could load a library in Python that hasn’t been written. One part of the song that made me laugh (and want to cry) dealt with this, noting the model made up a library that doesn’t exist and a hacker wrote it and slipped it in.

I bet that’s happened.

I wouldn’t be surprised if hackers were asking LLMs to write code for something in Node/JS (or something) and, when they see a hallucinated library, writing one, and publishing it. What a great thriller/hacker movie idea that might be happening now. I’m sure we’ll see plenty of libraries appearing in package managers that people use, not knowing they’re full of vulnerabilities, specifically planted inside.

It’s a fun song. Some of the things in the song are real. I know people have given AI Agents admin privileges. I know boards and some execs love the idea of firing people and replacing them with AI tokens. I’m sure there’s plenty of tests mocked (or changed) by AI agents to create the appearance of code that’s well validated. I’m also sure that there’s plenty of AI code that no one knows how it works. For sure, bots have deleted databases.

To be fair, a lot of the failures of AI are things humans do. Dropping databases? Not creating tests or mocking them and never adding code? Fixing a bug and making it come back? People do that. AI does it faster.

AI is a tool. It doesn’t think, no matter how amazing it can seem. Learn to use the tool well.

Or just shake your head and enjoy the video.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.

We’ve got a bunch of images from up high, where employees were spelling out our anniversaries. We have the 12th anniversary here, with a disorganized view.

and an organized one.

There are other photos in the book as well, which mimic what we have in the offices. In each location, we have some photoboards where we’ve captured moments and memories from the past. Here’s one of the boards in Cambridge.

Here’s the packed on in Pasadena.

I love that we still share  physical photos, as well as lots of digital images. Slack and our in-office monitors are constantly displaying photos of things happening at Redgate.

It’s a neat way to bring a little levity to what can be a stressful environment at times.

I have a copy of the Book of Redgate from 2010. This was a book we produced internally about the company after 10 years in existence. At that time, I’d been there for about 3 years, and it was interesting to learn a some things about the company. This series of posts looks back at the Book of Redgate 15 years later.

In this post, I look at one of these, the ##MSDatabaseConnector## role.

Another post for me that is simple and hopefully serves as an example for people trying to get blogging as #SQLNewBloggers.

Users and Logins

This role is a new one that contains very narrow permissions. It allows a login to connect to any database without requiring a user account mapping. Typically if I create a login for “Steve”, I also create a User in a database that maps here. The convention for most people is to create a user “Steve” that links to the login “Steve”. Typically this is with code like:

CREATE LOGIN [Steve]
WITH PASSWORD = N'asdfasdf' MUST_CHANGE,
     DEFAULT_DATABASE = [master],
     CHECK_EXPIRATION = ON,
     CHECK_POLICY = ON;
GO
USE [sandbox];
GO
USE [Westwind];
GO
USE [AdventureWorks];
GO
CREATE USER [Steve] FOR LOGIN [Steve];

NOTE: This isn’t the real password.

Note 2: Don’t use passwords like this

NOTE 3: Don’t skip the checks.

Here I am mapping a user to a login, and while the name is the same, these are different objects. If I want the user, Steve, to have access to objects in AdventureWorks, I need to grant rights, or add the user to a Role.

I could also do this:

USE [sandbox] GO CREATE USER [Stephan] FOR LOGIN [Steve] GO

In the Sandbox database, there is no User Steve. Instead, you can see below from SSMS that there is a different user here. My database has no “Steve” in the users, but “Stephan” is mapped to the login Steve.

The Login properties shows this as well.

I added a new user with this fixed server role, and no other database mappings. Here is the server role:

And the user mappings (trust me these are all blank)

I then logged in with this user to the AdventofCode database. As you can see, there are no users here for this login.

The login can connect, however, and I see the current user as the login name.

What can the user do? Well, he can’t access this table, 2021.Day1.

He can access schemas, which I saw with SQL Prompt Intellisense. That makes sense as the sys.schemas dmv is open to the public.

I granted rights to public for one table.

The login (or user with public) can query this.

If I check permissions for the login, I don’t see anything in the database other than basic things: connect, view CEK, view DMK.

This is interesting. It’s like a pseudo-user has been created for this session, mapped to the login. I’m not sure if this is correct or intended, but it’s what I’ve observed.

I don’t know how useful this permission is, though I’m sure someone has a use case where they want something like a monitoring system, or maybe a pen-test available to check what a public user can see in every database.

SQL New Blogger

While I was investigating this role, over the course of testing a few things in 10-15 minutes, I sketched this post. I then spent another 20 minutes capturing some code and screenshots to see how things work.

This is a good post of evaluating how things work and better understanding the system. I could use this as guidance, and perhaps tell an AI whether this role is useful or not. Or to avoid it.

Write your own post, maybe even using AI to help you learn about this role or others. Those skills will help you in the future and you can showcase them for others.

Over the last year, I’ve been asked numerous times when I’m plan to retire. This question has come from friends, parents of kids I coach, coworkers at Redgate, and even from Microsoft. A few people have asked about my succession plans for leaving, as I have a public site at SQL Server Central, and the charity in SQL Saturday. I’d like those things to continue past my time, so I am thinking about how to do that. I already have plans to hand off T-SQL Tuesday next year to someone else.

No worries, I’m not retiring soon. I have quite a few years left, though a decade is probably the outer range for me.

Randolph West retired from Microsoft, and perhaps from tech. We’ll see, and I hope Randolph’s writing efforts go so well that they make that a new career. I love reading, and we always need great writers. I wish Randolph the best and hope their endeavors are successful. However, I’m going to miss Randolph, as they have made the SQL Server docs so much better, and we’ve corresponded about my PRs many times over the years. I have a hit-and-miss acceptance rate, and often, Randolph made my edits better.

In any case, making a big change in your life is hard. Whether this is career or personal, I’ve seen many people struggle with big changes. I’ve seen many, many more people be afraid to make a big change, often wishing they could but continuing along their current path anyway. That continuation often involves a lot of stress and many complaints, which is why I constantly advise people to make a plan, build their skills, and then make a change.

Whether you’re planning for retirement, a new job, or even a vacation, it pays to ensure your world is set for someone else to take over. Even if you don’t leave, having things organized, scheduled, planned, maintained, etc. makes your job easier every day. This doesn’t mean everything is automated, though automations are helpful. Routines that are documented, protocols that catch and handle exceptions (automated or not), clean boundaries between tasks, even clear communication- these are the things that ensure that your job runs smoothly. Often we create these habits that we internalize and (mostly) consistently execute, but we could be better and smoother with a little effort. Especially with AI agents (helping and watching, with approval, not doing all the work independently).

I saw someone say recently that it’s not just death and taxes that are inevitable. Change is also something you can count on. I think working with the idea of change helps us prepare for it, whether it comes sooner or later.

I’m working on setting up continuity for the things I want to live past me, which are both inside of work and outside of it. Especially things for my family, where I want to document how things around the ranch work in case they need to take over.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.

I ran across this quote recently and it struck me that it’s expresses a thought I’ve had for some time. Instant, magical success isn’t often what it appears. Anyone that seems to have sprung up overnight with success in anything has often spent a lot of time getting ready.

Outside of lottery winners, of course. If you bought a ticket, that’s instant success. Unless you buy a dozen every week, then you’ve likely been doing your own (poor) preparation over time.

Whether it’s software, sports, business, anything that takes off, goes viral, or suddenly catches the public’s collective eye is the result of a lot of small things. Practice, learning, continuous improvement. It’s a formula that works in music, in sports, in manufacturing, and in software.

Perhaps the most important part of this quote is the ending. Things have to be brought together. In software, we work in teams, and we have to coordinate and collaborate. Whether with other human developers, AI agents, or Operations. We have to learn to ensure our efforts, our knowledge, our evolution works together. This might be especially important in ensuring database and application code changes mesh well. That’s becoming a concern for more organizations, and more management that realizes that the database has to become a part of the software development life cycle. Either developers need to learn more, or work closer with database staff.

We can do great things, we can build amazing systems, but it takes effort, and it takes teamwork.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.

However.

I hadn’t done much in the last couple of months on Azure. For some reason, I decided to check my bill. What I found was that there were charges for $35-ish/month. This is within my free credit limit as an MVP, but that seemed high. I have a few serverless dbs and some storage, but I was expecting more of a $15 charge.

I decided to investigate. I started with the Billing section, where I saw that Microsoft Defender was swamping the charges in my bill. I don’t remember enabling this, and typically skip this stuff since I work with test data and nothing sensitive.

As you can see, the Defender items are charged, but not linked to a resource?

WTF? How do I debug this? I have a small subscription, maybe a few dozen resources. Imagine you had a larger estate? I decided to ask Copilot. I get this result:

OK, environment settings, let’s check the items under here.

Now, where is this enabled? I checked the Defender properties for the subscription.

I went into the various Azure SQL databases, clicked the Security section for Defender and I keep seeing nothing enabled.

I’m ready to open a case, and waste the days and then multiple contacts trying to work through this with some customer service person in another time zone, who reads docs.

Digging further, I keep clicking around, Copilot being of no use here. I eventually start clicking in every resource, and I get to the logical server for my Azure SQL Databases. Here’s where I see it, at the server-level.

I don’t think I turned this on, but perhaps I tested something.

In any case, I click settings and then disable Defender.

I’m less concerned that this got turned on, because I might have done that. I would love some auditing of actions to determine this, as I could see someone else in my team (if my team were bigger than me and the 3 dogs) trying this out. I’d want to know who to talk to about changing settings.

More, I’m annoyed that the bill doesn’t link to resource settings, or that this being enabled at the logical server level isn’t reflected and noted at the database level.

This was a 45 minute investigation that should have taken 3, so a word of warning to you Azure users. Be careful what you enable, and when you have billing issues, check the resource group and logical servers, in addition to your databases.

That’s a quote from Robert Haas’s “Postgres 19 is late” post. He goes on to say that PostgreSQL has lots of bugs in it. It’s the way it’s been for a codebase that’s over 40 years old. He goes on to note that it’s easier to find bugs with LLMs, and easier to fix them. It’s not, however, as easy to do the latter as the former.

The impact on PostgreSQL 19 is that they’ve had to revert a number of features much later in the process because the humans were reviewing and fixing bugs found by LLMs. This effort delayed other work and has affected the release.

As someone who primarily works with SQL Server, I’m not that worried about delays in PostgreSQL or other platforms. I think it’s a fine choice, but I’m focused on SQL Server, which I think is more of a joy to work with.

However, there are a few interesting things in here. First, I think SQL Server has had a lot of bugs found lately (likely by AI LLMs). I recently wrote about the frequency of patches, which is higher in 2026. This is probably due to LLM code review, and that’s good. It also means we likely will have more patches coming, not just in SQL Server or PostgreSQL but also in our other systems. What’s the likelihood that someone will run an AI review and find bugs in other COTS software, internal apps, or even those no-code/lo-code systems people have been deployed? That’s not even mentioning the vibe-coded prototypes that are suddenly important enough to put into production.

The other interesting thing was that Robert accepts that LLMs are likely to find more bugs in the future. How will they find time to work on them? After all, from the article, fixes “still need to be reviewed and committed by humans.”

Maybe the best part of the last paragraph. He says LLMs are going to require every developer to raise their game. Every feature is going to be scrutinized by AI. That’s a challenge and an opportunity, but the key is that developers need to get better. AI can help you and write code at amazing speeds, but it doesn’t think.

We need sharp developers that think in order to cope with AI.

Steve Jones

I can remember asking you a question years ago at a SQL Saturday about the way an execution plan was formed, and you patiently explaining to me something I didn’t understand. I’m sure I asked some poor questions, but you tried your best to help me understand some aspect of why the plan was shaped a certain way. Your patience and exuberance still stand out in my mind today. You trying help me understand something that I’m not sure I understand to this day.

We caught up at one of the MVP Summits at night, at a time when our children were approaching the end of secondary school education. We had a common thread in theater, brought to us by our (not-so) young ones, and I recollect the pride with which you talked about your kid performing, me feeling the same way about mine.

At the PASS Summit, I gave a career talk a long time ago, and you came up to me at the end. You told me I hadn’t said anything you didn’t know, which made me feel a little as if I’d failed. You then told me I’d presented it in a way that made you think and inspired you to think about doing something differently. I was amazed that I’d touched someone like you, who I felt had already succeeded.

Hugo Kornelis has been one of the SQL Server experts who have helped, shared, inspired, and taught many of us over the last few decades. He runs SQLServerFast.com, where he provides a wealth of training, both free and paid (support him, buy a course). He’s also been battling leukemia for a few years, and recently posted Game over, as his fight has taken a turn for the worse. Hugo has faced this challenge by fighting with grace and honor in a way I’m not sure I would, or many have. I kept hoping he would keep improving and I’d have many more opportunities to see him. Grant and I have agreed to take over hosting his site, with support from Redgate, and I’m not happy about it. I wish I didn’t have this opportunity.

I’d much rather have more conversations with Hugo.

Just typing that line brings tears to my eyes. Hugo has been a friend, a mentor, a teacher, a joy to chat with, and an easily spotted man in a crowd with his trademark blond streak. I was thrilled to come over to Belgium right after the pandemic and spot that blond streak above a mask, knowing I’d have another chance to spend time with him.

Life is short, and I’m acutely aware of that as I age. I will cherish the words and moments I’ve shared with Hugo and hope I get the opportunity for more. Fingers crossed his fight continues for the foreseeable future.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.

I don’t think EVs are good for everyone, and for most people, this is likely a bit of a calculation that you have to make for your situation.

UPDATE: I had the Escape cost at $0.81. It’s $0.081.

Charging Costs

My cost of power is (usually) $0.14/kWh. There can be a higher charge if I pull power between 4p and 8p, but I can avoid that with scheduled charging. You have to input your own power cost for calculations, which can vary dramatically around the world.

My Tesla used to use around 260Wh/mi over the long term (75k miles). For the Lucid Gravity, I tend to use more like 285Wh/mi. Those are strange numbers, but if I convert those to a per-mile cost, I get something like:

• 2021 Tesla MY – $0.036 / mi
• 2026 Lucid Gravity – $0.04/mi

These can be compared to my other cars. For comparison, I’ll use my older cars, with a few stats.

• 2012 BMW X5 – 23mpg
• 2021 Ford Escape Hybrid – 48mpg
• 2022 RAM 3500 – 12mpg
• Gas in the Denver – avg about $3.90 today
• Diesel in Denver – avg about $5.40

If I use those numbers, I get calculations that look like this:

• Tesla MY – $0.036 / mi
• Lucid Gravity – $0.04/mi
• 2012 BMW X5 – $0.17/mi
• 2021 Ford Escape Hybrid – $0.08
• 2022 RAM 3500 – $0.45

Clearly the truck is the worst, but a gas SUV which is about the same size as the Tesla, is 5x more expensive to run. The Lucid is larger, and it’s 4x more expensive. Even the hybrid is 2x+ more than the EV.

There are also the maintenance costs, which are higher, but the quicker tire wear from the EVs offsets some of this for regular maintenance. For longer term stuff, gas cars cost more to maintain.

What does this mean? I tend to drive in the 12k-15k a year range. At 15k, this is:

• Tesla MY – $546
• Lucid Gravity – $600
• 2012 BMW X5 – $2.550
• 2021 Ford Escape Hybrid – $1,220
• 2022 RAM 3500 – $6.750

The truck tends to run just a few thousand miles, but those are pretty good costs. My charging station cost me $750 installed, which is slightly above the savings from the hybrid. Across 2 years, it’s not close.

However, if you spend more on power, or your charging station costs more, or you charge at expensive public chargers (Denver Superchargers can be $0.50-0.60), then the savings go away.

Of course, if you can charge at home, you have lots of time savings as well over the year.

Charging Time

What about time? There are plenty of horror stories where people say it took an hour or more to charge. That’s a common concern, as the 0-100 time for a large battery, say 80-100kWh can be high.

I charge at home, and in 5+ years of owning EVs, I have probably charged 30 times away from home. That’s about 6 times a year. I think the longest I charged was about 45 minutes while eating dinner, but we didn’t need to charge that long.

Almost all of my charges were while traveling away from home and staying overnight. Most of those sessions were 15-20 minutes. The EVs calculate how much charge you need to get to your destination, which isn’t something most of us are used to with gas/diesel cars. We think in terms of miles.

For me, 99.9% of the time, I plug in at night (10s) and unplug the next day (10s) and that’s it. Almost never do I exceed a 200mi a day drive. If I do, I might or might not charge. If I’m going 300 mi, which I have done, I would likely charge somewhere along the way for 10 minutes, which is about what a gas stop is with a fill up, bathroom break, purchase a coffee.

Overnight, whether I’m at 10% of 60%, the car is charged by 7am. I typically set my charger at 34A and start at 10p. Most of the time it’s a 2-3 hour charge if I’ve been driving around.

Plenty of people worry about taking a long trip. If you do that a lot, then you have to make a calculation of how much extra time you might need. For lots of people this is maybe an hour or two on a long trip, like 1,000 miles.

How often do you do that? Almost never for most of us. If I were pressed for time on a long trip, say an 8 hour drive to Omaha (600 miles), I’d likely rent a car. Heck, I’ve done that in the past to not wear my car and tires. Otherwise, I’d stop and charge at a few places. The EVs might stop you with 50% to charge or 20% to charge, depending on where chargers are, and they calculate a minimum charge time, so you are often only stopping for 15 minutes.

The reality in my experience, and in a few friends that have purchased EVs is that the “long trip” isn’t really a common occurrence or issue. Think ahead and make the decision that makes sense.

Of course, I have a friend in an apartment, no charging available. He sometimes has run an extension cord at 110V to add 4-5mi overnight to his car, but he tends to just use public chargers a few times a week, letting the car charge while he shops or eats nearby.

If you drive a lot, and you have time constraints, charging might be an issue. That’s not most people.

Is It Worth Buying an EV?

To me, with no real cheap EVs in the US, I think it’s worth exploring if you want a new or used car at the EV price points. It’s not likely worth it to change your existing car if you’re happy with it.

• Oct 2026 – GDR
• Sep 2026 – GDR
• Jul 2026 – GDR
• May 2026 – GDR
• Apr 2026 – GDR
• Mar 2026 – GDR

That’s a lot of out-of-band patches. In the last decade of SQL Server, there have been relatively few GDRs. Often the main CU comes a day or two later (or a month later for older versions). If you react and start to plan patching, you might find yourself trying to decide if you apply CU9+GDR or wait for CU10, or do both.

There have been few GDRs in the last , but before that, relatively few: three in 2025, two in 2024, and two in 2023. I suspect that AI is being used to discover bugs in existing software, and this is forcing Microsoft to perform remediation work. Brent posted a similar thing, noticing a large number of security fixes and speculating that AI is finding issues.

That’s good, right?

Or is it? If Microsoft can find security issues, can’t malicious actors? Including nation-state-sponsored hackers? I’m not even sure that Microsoft is finding most of these, as there are lots of CVE issues, which can be discovered by anyone and sent to Microsoft. This might be to obtain a bug bounty payment, as Microsoft and other vendors will pay security researchers.

Or it could be that a hacker finds an issue and exploits it. A customer then notices an issue and reports a problem to support. Microsoft realizes there is a vulnerability, works on a fix and reports the issue to the CVE database.

AI is great for security, as it can scan software and look for known issues. We have decades of security bugs that have to be included in the frontier LLM training, so using AI to scan your code is a good idea. I am sure code scanning tools are adding AI review to their systems. I’m also sure those vendors are worried you’ll use AI on your own to scan code and find your own issues.

You can do that, but ensuring your AI does a good job scanning isn’t necessarily easy. Or fast. Deterministic systems, like SonarQube and Flyway can find code issues quickly, in a deterministic fashion, and likely with less cost than AI. That’s not to say AI doesn’t have a place, but it’s likely an out-of-pipeline review that takes place less often than every CI build.

Security is a constant battle, and it’s hard. The age of AI makes it easier and harder (and more expensive) to manage security, but I think that’s a good thing. We’re seeing lots of vulnerabilities, but also more patches. Perhaps the better outcome is that there is more awareness and focus on security from vendors who now know if they don’t scan their code carefully, someone else will. Perhaps someone they don’t want finding issues.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.