别让 AI 带走写软件的乐趣:Hussein Nasser 谈数据库与工程判断
原题Don't lose the joy of software to AI
看前速览
Hussein Nasser 从数据库和 ORM 的具体取舍谈起,认为理解软件的乐趣来自亲手排查问题;不加审查地接受 AI 生成代码,可能掩盖成本并削弱工程判断。
易读的抽象也可能隐藏昂贵的数据库操作
按 ID 循环创建对象可能变成大量查询;改成批量查询后,又可能取回过多字段。
数据库调优要结合引擎与实际负载
Nasser 比较索引设计和执行计划控制,强调应用掌握的业务信息可能超出优化器估计。
排错实践能帮助工程师真正理解并掌控系统
他将根因分析与长期理解联系起来,担忧未经追踪就接收 AI 代码会削弱这项能力。
性能代价会在系统各层之间转移
访谈区分数据库开销与应用内存、CPU 开销,也提醒读者考虑同一操作被大量用户重复执行的情况。
完整摘要
在与 Rashid Al-Hassan 的长访谈中,后端工程师 Hussein Nasser 回顾了自己从 GIS 走向数据库和系统底层的经历。他解释,不同数据库引擎的索引结构与执行计划各异,调优要结合实际负载;比起不可控的优化器选择,他更看重行为的稳定性。一个详细的 ORM 例子说明,可读的对象构造方式可能让循环悄悄产生 100 次查询;简单改为批量查询,又可能取回过多字段,把成本转移到数据库和应用内存。由此他提出更广泛的担忧:抽象和 AI 辅助编码让产出变得容易,却可能绕开建立系统模型所需的审查和排错过程。他的立场带有个人色彩,部分判断也较宽泛,但性能案例和取舍分析使访谈具有实际参考价值。
章节
文字稿
Content
This is a conversation between myself and Rashid Al-Hassan from University of Nebraska. He is a PhD candidate working on security of AI databases and other interesting topics. Uh we chatted about uh the passion of programming and OMS, databases and the effect of AI on our critical thinking and where are we headed in the coming few years with AI and the passion of software engineering. I hope you enjoy it. Uh Hussein Naser. [snorts] So he's a [clears throat] software engineer of course and he's a host of the backend engineering show uh at YouTube. However, rather than that, if I'm not wrong, uh he specializes in the field of uh geographic information systems and uh from 2005, he had helped many organization to develop GIS and have been working in this technologies and also I should also mention [clears throat and cough] that uh he has been working in S3 as a senior principal product engineer if I'm not wrong.
Uh is
Host: right. Um yeah and of course um there is a there is a book he wrote which is root cause uh stories and lessons from decades of backend engineering bugs. So um and let me [clears throat] just tell a little bit about this project. So this is this interview series is part of Nebraska IICAR project. So IR is um a development project from NSF which helps uh academicians on other people who wants to translate their um learning and lessons at a as um uh like a company in future. So this is a program through which we can actually talk to different segments of people and understand their thoughts and analysis. So uh without further delay um I would like to give the floor to you. Um please briefly introduce yourself and tell me your day-to-day activities.
Guest: Uh thank you so much Rashid. So I like like any software engineer we started by grabbing the joy of programming. The fact that you can tell the computer a sets of instruction and it does what you want it to do. There is there is joy in in that and I think every programmer every engineer can relate to that. Uh unfortunately we we are being robbed from that joy today with AI because no we no longer work and craft the these instructions to produce the output. But I'm I'm talking this is this is 1998 1999 I think when I first wrote my first program ever. But but there's there's joy with that. And then I know that I wanted to kind of pursue computer science which which I started I built a lot of programs. Then I went to university in 2001 in computer science. One thing led to other. Um I my uncle runs a uh a GIS which is stands for geographic information system distributor in Bahrain where I was born and raised.
and uh he hired me as an intern there and we started building application. I started building an applications there. That was maybe 2004 I think when I was hired and then one thing led to another. I I I found myself uh in the field of GIS but every field every domain there is this dimension which is the software engineering dimension regardless of the domain itself. And that's what's always fascinated me. So I built many applications that it has this GIS geographic mapping solutions. But fundamentally geographic information system depends on there's always a front end, there's a back end and there's a database. Guess what? This is every system out there. It's just the compute can be a little bit different. GIS tend to live more in the database. and that's where I specialize. Um, I started my blog around that area 2008 I think.
I wrote about what I know. Uh, a publisher reached out to me uh to write a book about one of those GIS technologies I wrote about. And then one thing led to another. I came to the state. I I was hired by Israeli because they saw the book. So this for whoever is listening out there, if there is a if there is a touch of inspiration that you're feeling, pursue it. Even if you there is a thought that prevents you from doing that, just go with it, you know? just just do it because you never know what opportunities can open up because I decided to write that blog post. It opened up an opportunity for me to write a book which then was seen by one of the biggest GIS companies and I was hired.
of course the whole visa process went through and then yeah I'm moved to the US and then I started my YouTube channel that same era 2014 I started with GIS then I shifted completely to backend engineering because that's where I live as GIS it's more mostly database and backend engineering and I just fell in love with that so I studied more on protocol and HTTP and and and and uh web servers and how how backends receive requests and and and kind of the the gist of how you can take a request and process it. There is so much going on there and that's where I just like to spend my days uh thinking about how can I process a request as fast as possible and it might be a simple question but it's not really that simple. I I had a I did a talk in 2025 I think last year in HA proxy in conference I my talk was exactly the journey of a request to the back end and I'm still finding more and more things that happen and uh I don't want to make this a very long intro but that's kind of that's where I am right now back in engineering I have my YouTube channel I wrote root cause Because during my 20 years career, I run into a lot of, you know, issues and bugs.
And I enjoy the feeling of running into a bug and then it's like a puzzle really trying to solve it and and then going through the process of finding the root cause. And on the way there, you learn valuable lessons that nobody can teach you. Even if you ask someone for the answer, you're being robbed of that feeling and and then I I know I've been relating things to AI, but that's how it tr how I truly feel. It's useful, but we're losing our critical thinking because of that. But yeah, so root cause was my latest book. I wrote so many books other about GIS technology but yeah it's just essentially uh it was it was based on that passion of troubleshooting. So
Host: yeah that's thank you for sharing all this um all this experience and reflections. Um I I totally agree that AI like when AI integrated into development workflow and coding task and everything things seemed easy but people uh forgot to actually go back and understand um like the fundamentals and which actually hampers our development as a software engineers and developers which was very important reflection that you shared and um like from your experience and your books I think like if we teach like the new kids they probably would be able to learn a lot more than just learning it from AI. So you mentioned that uh you work you love to work with a lot with backends and databases. So when you were like working with databases like what like do you design everything? Uh and what components do you spend your most time on like how do you do that?
Can you tell me like a sequentially like you're designing an application, this is the database and like so on and so on. Please go ahead.
Guest: Right. So in my dayto-day activities, um we in Ezri work with many database systems.
Host: Mhm. So there is the application that we built of course and that application sits on top of an abstraction that's called the geo database and then that talks to a different database system. So you can imagine that regardless of what client application code is executing, it might be executed against a a certain database systems as AP Hannah, Oracle, SQL server or Postgress. So my job becomes how do I tune the queries that are executed by this layer so that it is optimized for that platform and believe me the things we studied in in the university like oh I just want to do a normalized table that's just the simplest piece of it just designing what fields there are but it's a layer on top of that where you need to define what field type is appropriate, what kind of indexes you are going to create.
And guess what? When you create an index on postcris, that index will not work on other databases because they they're just different composite indexes versus included indexes. Some databases don't even have included columns. And then for those who don't know included column and indexes are are this uh it's an index that you create on a key but then you can when you search the B tree you can then optionally include a field from your heap table so that you can return it in line without going back to the original table.
Guest: Right? So you cannot search on that field but you can return it. Composite index is it bloat the B tree but it allows you to search with both keys. That's basically it. So things like that you know the the and and I got to be honest I I struggle a lot with Postgress because it is it is one of the databases that are not as mature as other platforms to be honest. Right? People don't like to hear that, but postcus is still is in in its infantry compared to other databases like Oracle and SQL Server. And I'm going to get a backlash on this. But the the thing about these platforms is they have huge backings, right? Oracle and SQL Server and they give you huge tooling to select the path of execution and it gives you fine level control and post is getting better and better. The planner for these platforms are much better than the planner for postquest.
I have queries that run fine on other platforms but when I run it on Postgress it tanks and I have to tweak the configuration of pro Postgress to allow it to execute in a proper path and and that's why and this is a good thing that's why we have t tons of resources on support on postcris right it's a free thing but you need a lot of support and a lot of understanding of how it works to make it perform in in an optimal way and so so things like that that's what I'm I'm deeply going in every day onto database internals to understand how can I execute that query in the most optimal way essentially so that's kind of the the gist of what I'm what I do and in the in the in the process I learn a lot every day I learn something about these different databases I'm not an expert in all of them at all.
But I'm just as I dig deep, I learned that oh, Postgress like the the new asynchronous features in Postgres 18, it's it's a huge game changer and I use it all the time. In fact, I used it recently and I have one old instances where this IO method I try to flip to IO ION which is an asynchronous uh uh what is it called asynchronous IO reading mechanism in Linux and post supported in 18. I accidentally used the same configuration in in my old instance and I got an error. I was like oh IO method is not I was like what what what is that? I got used to use a configuration from a new posgress version and I got an error on an old one. So things like that, right? So so relying deeply on these new features and and one thing that is absolutely fascinating about like SQL server which a database I love is you can even select the path of how the index B3 is scanned.
Host: Mhm. using hints you can you can tell posus doesn't allow you to do that at all it does not allow you to select a hint at all which is something I completely against you need the the database does not know everything the application developer has the full context that's that's my personal opinion it's very controversial I know but the application knows way more than the database. When I create a table, yes, the database sees it as empty, but I know that it's going to have a 3 million rows. So, don't do a full table scan just because it is empty. Now, use the index even if it's expensive. Don't switch on me. This this inconsistency is the worst thing that happen in production. We always air on the side of consistency. That's why I need a hint. Let's say hey I know you might look at this table statistics and it looks empty but no don't don't do a table scan please or or it looks like it have a five rows don't do a full table scan please use the index so that's one of the things that kind of uh frustrates me about postcrist but you have this flexibility against other databases we're learning post is getting better of course and then uh yeah so that's uh that's just a thought.
Guest: Yeah, thank you. Thank you for sharing um your like the interview process and the details on Postgress. Of course, Postgress is like I think it's quite popular because there are so many communities and I've talked to people who are like Postgress experts and advisors. So I understand why the hype is there and why people use it. So um you mentioned a lot about Postgress its uh usefulness and migration issues. So would you say you have to migrate your Postgress developed work to other databases like uh what's the role of like OMS or other technologies there and also uh how does the migration volume like correctness look like when you do that process if you have some of the experience you can share with me. [clears throat]
Host: There are two pieces to that question. First, I'm going to tackle the migration aspects. Yes,
Guest: I do that all the time. I have a database that I receive and it's in say SAP HANA
Host: and then I want to move it to Postgress. Luckily, our software in in ESRI allows you to do that easily because it it needs to know it know how to read all of that. So, just it's literally a copy and paste. So you can move all the data to to to Postgress, right? But if I would sometimes need to do it manually, I would have to write the queries by hand to create a data link between the two connection and then essentially just do a pouring of the data from one place to another. So it's doable. uh things to watch out for is um is the data types and uh and this is some of this stuff is is legacy right like some of the fields UU ID I think I I can't remember like don't quote me on that but some UID it was introduced a certain feature certain uh version of Postgress well uh while it was it was before it was not there so sometimes you get a field that is UID But it's actually a 38 character string.
So you got to watch out for these kind of things. But other than that, migrations is uh you move all the data. You need to make sure that you recreate all the indexes and of course critically always vacuum before doing anything in your postcard. For instance, uh I run into a bug last week in uh Amazon Aurora Postgress. Uh I I have a workflow where I'm running on a local postcress instance and it's a completely you know fast. I'm getting you know sub millisecond latency. The CPU is happy. Everything is working fine. I run the same workflow on the same data on Amazon Aurora postcress the CPU is getting maxed out 100%. And as a result, you might know that if your CPU is maxed out, the most precious resource you might think it's IO, it's not really with databasees CPU. So all these queries are starving for CPU time and they're not getting it.
So you the performance drop. The data is identical. What could be the the difference after a lot of back and forth. The the the thing that stood out in the Amazon Aurora was there was a shared buffer default which is I think it's like 80 gabyte. that's the default that you're using or maybe a little bit more that led to the whole data being cached in the shared buffer and because we're sharing everything in the shared buffer you no longer see the IO so you see that everything is cached in memory so you might think oh the queries then should be running fast right everything in memory that kind of confused me a lot it turns out. After looking at the plans, Postgress on Aurora was using a full table scan on all the queries.
was not using any of the indexes and as a result it was scanning these shared buffers as doing a table full table scan reading all these tables but as you're scanning you're just copying things to the CPU because like what is what is a full table scan it's literally looking bite by bite you're looking for the rows so there's a lot of copying involved to the CPU to do this matching so you're using the CPU to do this full table scans And the reason it was doing that is because the data was copied but vacuum analyze was never run. So the database statistics was out of date. And because the database statistics were out of date, Postgress thought that these queries, oh this table has zero rows or 10 rows or 100 rows when in fact it had 5 million, 6 million rows. and possess doesn't update the statistics frequently.
It just uh it just waits for an opportunity and that opportunity were not given apparently. So because of the database was not updated the full table scan plan was used and as a result the CPU was was [snorts] hammered because and Amazon has its own proprietary ways of scanning you know doing a lot of parallelism. So of course more cores will be used and you you you see the the the the high usage of the CPU. The solution was run vacuum analyze on all the tables and all of a sudden all the database statistics are updated and because of that now you see the proper plan. goes back to my point where hinting is really critical because if I hinted that in my application if I post gave me the choice to hint it will not choose a full table sc don't do that use the index ignore your statistics use the index because I know that this table is large you don't the database doesn't the database does not know the context.
The application developer does of course the application developer who cares about their system right who knows that's where being an important you know being a really well adapt software engineer that knows your entire system that's where you get to get these choice and fine grain the things I'm saying is is for kind of intermediate to advanced engineers not for beginners of course right so this this is what I'm kind of targeting in my in my talks essentially but yeah so these are the the two kind the migration and then uh we didn't talk about OM right if unless you have a comment on that yeah
Guest: yeah of course um thank you for sharing that yes of course um so have you had experience working with the OMS and um like yeah please share go ahead
Host: yes so so OM OM is a necessary evil unfortunately Because if it was up to me, I mean, this is the thing, right? If I if I was up to me, Hussein, I would not use an OM. I would just write my own my own SQL to the database because I know what I'm doing, right? I know what I mean and I just write it. The problem with that is if this code is shared and going to be read by other people, then they they won't necessarily understand that code cuz like it's going to it's not going to be clean. It's not going to be pretty. And I I'm not aiming for pretty code. I'm I'm aiming for optimized code. I don't care if my code is clean or or pretty or organized or that that's not a priority, right? My priority is is executing efficient code even if it's unreadable. Yes. The problem with that of course you have to there's a trade-off.
If there are multiple people who are going to work with you, you need to make the code readable. An object relational mapping is one way to make the code readable. Here's another controversial thing. The moment you make your code readable, you sacrifice something. Always. Someone will say that not always, but I'm going to say almost always. You're going to sacrifice something. If you make something readable, that means you kind of twisted something else and then you you sacrificed another area and likely it's either efficiency or or performance. That's the things you make. An OM is just clearly one of that cases. If you have an if if you look at a table and it's called item, it's it's great to create a class in your in your project that is called item and then you create an array of items.
Wow, it's very nice. I can read it. It's better than executing a query, a record set and looping through the record sets, right? So I can hide all this comp complexity. Ah, I'm going to create a new item. I just created a new item. Oh, I want an item by ID. You pass in the ID and the constructor. That's readable. That's nice. But what does that translate to? It translate into a query to the database where ID equal blah. And that you might say, oh that's okay, that's fine. The problem is that readability gave you the illusion of simplicity.
Guest: So now what what would a junior developer or even an intermediate developer do if they see this class and they want to create 100 items and they have the ids of this items. Oh, here is an constructor item. You pass it by ID. Oh, clearly I'm going to loop and pass in the ID each uh array item and I create 100 item and I'm going to put in my array. That seems benign, but it's not. On the back end, what you just hid is the complexity of what is actually happening. Now you just executed 100 queries when you could have executed one with an end list. And that's just a simplest example. You could come back and say, well, I'm going to create another constructor and another class called items that takes an array of item ids and then that will send one query and build all these item ids. See what we're doing right now?
Mhm.
Host: We're just complicating the system more to solve one thing. And get then I'm going to come back to you and says, "Okay, nice. Now you solve the 100 queries problem. Now you have one query." But the guess what the item table has 150 fields.
Guest: Are you pulling all of them? Okay. Oh, yeah. Yeah. Yeah. Yeah. I'm I'm going to pull all of them. So what what's going to happen? Well, I don't know. Nothing's going to happen except there is like a five blob fields and 50 string fields. Are you going to need all of them? And then you started going back and forth and back and forth making this OM this object rational and mapping almost similar to the SQL which kind of defeats the purpose. Just write a SQL to begin with, right? because you're going to start adding a fields parameter. Oh, what fields do you want? I just need the ID and the name and the product ID. Then you give more options and more options and more options. And you make them optionals, right? And when you make them optional, of course, rarely anyone would use these optional fields.
So they would just use the default. What would be the default value for you? you find yourself answering more questions about this object model than actually doing work. That's what I found happening with object relational mapping OMS. And it's useful when you create a fantastic one, but you it's easy to shoot yourself on the foot with them because you're going to use them in the way. For that matter, SQL is the same. By the way, I'm not kind of defending SQL or anything. SQL is is is kind of the same problem. Uh because inherently the standard tells you select uh ID from employee where name equal blah or select name from employee where ID equal blah. Right? What does that mean? The SQL says just tell me what you want and I'll take care of it. And and that's the same problem with the object related mapping.
What do you want and I'll take care of it. This idea of I'll take care of it. That's that's where problems occur. You're hiding something because it's complex. You're hiding it. The sequel has the same problem. It it will pick your own plan and it will end up picking the wrong plan and then you're going to feel it. And um I think Juul who invented this uh I forgot his last name. uh he invented this concept called uh leaking uh uh leaked abstraction right where the abstraction you just created it just leaked back to you in form of CPU 100% usage in terms of complexity in terms of performance you're going to feel it later right and that's that's the that's the challenge we're having and sometimes you're gonna use it if You built the Orion and you built it and you know all the the the nuts and bolts of it for sure you know how to use it up in an optimal way and that's what's happening right so the the all the OMS are there GraphQL is kind of one of those I don't know if you can call it an OM but kind of is it has the same thing it it presents com simplicity but It's really complex.
It allows you to do a lot of things, but most users use it because it's simple. And if you use something because it's simple, you're going to abuse it. You're not going to use it, right? You're going to probably use it in an in an causes problem. So, yeah, that's kind of my two cents of OMS. No, thank you for sharing like um all the details and all your reflections of the OM. So you mentioned a lot of things uh while discussing OMS and of course if the data is redundant of or if you have like millions of customer data to manage you have to have some sort of adaptations with the OM. So do you believe that um you have to have some sort of trade-off analysis with the OMS like the OM needs to handle memory well or it needs to handle query processing well like what are the factors like in OM would you like to see or what tradeoff analyszis do you prefer while designing or working with OM
Host: uh what tradeoff is I I'd like not to use it. that that's the if again if it's ask me I'll never use it because of of what you you said rash right
Guest: you said that oh now that I'm using an OM how have how do I handle memory usage and how do I handle CPU usage and and then guess what this is at the client side now
Host: you giving me more problems not solutions I'd rather not do any of that that's that's my answer but if I would if I would then I would make these as as lean as possible.
Guest: And if I'm reviewing a PR, I would look at the code if there is a if there is a user or is it is it abusing that API or not? Are we loading too many things? Do we need to pull 100,000 rows to the client? Can we do this processing whatever we're trying to do in the database? And these questions can be applied both to raw SQL and ORM, I suppose, right? Uh I seen this a lot. A lot of people would they see an API they say to sort, right? Sort by product price, right? This is a perfect example. I want to sort the products I have. I have let's say the user selected in a table and in a like a in a UI selected 100,000 rows says okay sort by price that's cheapest to more expensive. I know how to do that in SQL but how do to do it with OM? If I give this to a junior developer, they would use the new API we just authored, right?
New products with an S, pass in the array, and then it will get all the products and they would do products dots sort because everything is an object. I can sort and I can pass in the field, the price. Oops, I forgot to actually fetch the price. Let me add the field to the price. So, it comes back and then it comes back and I'm sorting everything in the client side because we fetched all the 100,000 rows from the database to the back and now actually we're in the back end, right? It's going to be worse if this code is actually in the browser. I hope not, but it could be. Right? There's the API itself that talks the database and there is the browser itself that does the sorting. This is the worst case scenario. You fetched everything from the back end. Now from the back end to the client, the web app and now you're doing the sorting here, right?
And then after you sorted, you display everything to the user. So you used memory precious memory to first you used precious network to pull all this stuff from the database to the back end. Then you used precious memory to store them on your back end. Then you used precious. I use the word precious because these are really scarce resource and I like to kind of add an adjective to them to add emotional effect. So there's precious CPU as well where it you're just sorting in the back end where why why did you do all of that? Because the code looks nice. How else would you do it? You don't think about what is happening behind the scenes. The OM tells you, oh read all the products and then sort them. It does not. It hides what's happening behind the scenes. And that's what where I have a problem with.
You really if you want to be a good engineer, you really need to have to know what is happening behind the scene. And I'm talking everything that you care about in in this case. So that's my problem with with with the this memory consumption. So things like that, how to answer your question, Raja? How do I deal with memory? High memory consumption. Well, you have to understand what's happening behind the scenes. If you understand what's happening behind the scene,
Host: Mhm.
Guest: you will know the answer to this question. Oh, why am I fetching 100,000 rows to the database? The problem is like you didn't even know that there is 100,000 rows being fetched from the database. That's that's the problem with with or it hides that volume and anything that hides this under the carpet, right? That's the problem. When you when you have something, you're hiding things to seem it's like my son. I told him, "Go clean your room." What does he do? He shves all his toys in the closet and then close it. He cleans it. Well, the room looks clean. Mhm. right? The code is readable, but is it really clean? What's happening behind the scenes? So that's that's the same thing. And that's yeah, that's just um my two cents on this on this topic.
Host: Interesting. Interesting. Yeah. Thank you for sharing all this like um so when you are like what you actually uh mentioned so when actually the data is not actually getting cleared but it's hidden. Yes,
Guest: probably it's increasing more overhead on the machine or the CPU itself. So, um does that comp I don't want to interrupt you but let's specify which machine are we talking about here. It's not a database. Database did its work.
Host: You well to a certain extent. So now the machine we're talking about is the backend
Guest: AP where the API is running. There is memory and CPU consumption here. Now always anything you do multiply it by by 100 because multiple users would do the same task, right? It will it will happen on the same box or VM or container or whatever. So it's going to be the same output and there is another aspect which is the database CPU usage right which now what you did is like you did a full table scan you did an index scan to pull these 100,000 but you you taxed the database with these expensive queries. I'm sorry I interrupted you. You were talking about I wanted to just clarify that.
Host: Yeah. Yeah. Of course. Um, of course that actually does not add up and it increases the overhead on the CPU eventually. Um, so how does like scalability and security looks like? Because when you are managing this with OMS and it's not working very well. So is that secure? I mean how do you ensure the scalability and security aspects with it? um with the OM
Guest: scalability is is very difficult.
Host: Okay.
Guest: Because we because of the topics we just talked about, right? Because when we talk about scalability, yeah, I'm talking about this the vertical scalability of that machine itself,
Host: right? because it's going to be saturated if you did not do that right. It's uh with SQL you don't get that problem because you are forced to write it with hand. So you know what you're doing. You're selecting this from where ID equal that. So you it's in your face that you're going to fetch 100,000 rows. So, might as well just do a sort in the database. Do the same query but do an order by on the database, right? So that it the rows comes back to you in an ordered manner instead of actually doing the sorting on the client side. So that's something and by client I mean the back end in this case. But yeah, that's something you have to think about these with scalabilities. Uh security uh [sighs] I suppose I cannot think of how this would affect security but you might be the fact that we're hiding things like the fields we're fetching.
You could be fetching fields that you're not supposed to fetch. [snorts] And this goes into the protocols which is some a topics I absolutely love which is the backend and the database protocol communication. Uh is it encrypted or not? Right. So most all pass all databases support uh TLS encryption on top of the uh protocols. Right? So that should be enabled so that if someone is snooping there is a switch or a router between those two two nodes then nobody can fit can see what's happening there but then there is even if that's enabled there is everything is encrypted then even if you fetched fields that you're not supposed to fetch like say I don't know SSN or things like That is the same problem I think in SQL or uh or OM right because if you fetch a field that you're not supposed to fetch OM hides those fields from you you don't know what you f SQL you have to do star which is a bad practice select star right which also hides right what you're selecting kind of so you have the same problem with raw SQL and I think this just comes to education and then company policies, right?
You're not supposed to fetch that field. Even if it's encrypted, don't fetch it because if you fetch it, it could be leaked back to the client and the client shouldn't see it or it in in a in an unlucky situation. If the machine is compromised and someone did I don't know a buffer overflow happened to read your content they can read these fields very highly unlikely but it did happen back in 2004 with heart bleed so may happen again but yes this this is my thoughts about security I'm not really uh very I don't have much much thoughts on the topic of security with Of course. No, that's totally fine. Um, that was very, I think, important reflection that you shared. Um, yeah, let's let's go back a little bit and talk about you mentioned a lot with AI and AI how AI is actually disrupting the development mindset and workflow of the developers.
So, in your company uh in your development projects, do you use AI in some level like not like fully automating the project? Do you use like AI to generate test cases or do something
Guest: [snorts]
Host: test cases. No.
Guest: Okay.
Host: I use it I use it for queries about a database system that I don't know how to write. like an example. Um I want to list I have a I have a I have a blocking scenario in my SAP HANA
Guest: or DB2 for example IBM DB2.
Host: Mhm.
Guest: I want to know what is the query that lists all the table locks in DB2. Guess what, Rashid? I would have done 10 years ago.
Host: I would have searched Google. I I would never guess what that is.
Guest: Mhm.
Host: The documentation sometimes not that great. Like it's going to take me a lot. So I would search and would hope that someone in Stack Overflow would post that answer.
Guest: Yes.
Host: Guess what I would do today? I would do the same thing. I would search.
Guest: Oh, okay.
Host: I would I would search for Chad GBD. give me the query that uh how do I list the tables on uh full locks and DB2 and it will give me the query I will look at it so that it's not doing something shady I want I will execute it and there you go it's reading from this table so that's how I do it so things like that that I would do do search I just using I'm just getting faster results. That's the main primary focus on using thing. Another example, I always I write in JavaScript sometimes, but I always forget how to use reduce and map. Always always these functions. I don't know which parameter which arguments comes first and I write in the browser most of the time. So there is no intellisense, right? I was like okay is this is the reduced text an array or not? What's the function? Is it the accumulator?
So I would just ask AI okay how do what's the reduced parameters and it will tell me right because sometimes now in Google you cannot ask these questions because the AI for Gemini is just weird sometimes it just talks a lot instead of just giving you the answer. So I I like sometimes to get the answer of that prototype. Other than that, test cases. I don't I don't like to use it to generate test cases because guess what? Who's gonna who's going to debug the test cases? Me. I'm going to look at the test. And if the test case is not generated by me, I have no idea if this test has failed. I don't know how to look at it because AI generated that. So I would not use that for to generate test cases cuz I don't know what this is and anything that I don't know and I care about I would not let AI do it.
Guest: I see
Host: a query that I'm going to execute just to list the table. I care about the output. I don't care about how the query is written. So sure, give me the answer to that because I I have a goal in mind and I want to reach that. But if the goal is to write a test case so I can discover bugs. If AI is writing my test cases then okay I run let's say we installed the a PR that broke five tests. If I'm stepping on that test code I would have no clue what what this test code is. I like how would I debug it? I don't know what what's this code what does it do unless like I have to tell AI oh describe it and add comments and add this and add this maybe but I would like just I can write it myself I can use AI if I if if I'm stuck in a certain step like how to I don't know like how to fetch how to do this particular query to fetch certain values that I I'm I'm never wrote it before.
So yeah, help me with that. But the whole test case, I would rather write it myself, especially like with the context that like deeply involved context that AI doesn't even know about, right? It's like I would I would spend more time and I think a lot of people do that. They spend more time back and forth with AI to get the answer than actually just go ahead and write it yourself. Yeah. So I would just I kind of in the middle with this with these kind of things. Yeah.
Guest: Yeah. Yeah. [clears throat] Of course. Of course. Thanks for sharing. I understand like when you generate test cases with AI and you have to validate them yourself and so many other issues actually you like run into when you start working with AIdriven development. So do you believe or do you feel that if you're generating something either it's a test case or a schema or a piece of table or data objects or something uh does the validation how does the validation look like? Would you use formal methods or something else to actually validate that so that you don't have any doubts that this is hallucinated or does not work or you would completely prefer that I do it manually myself? Uh like based on my own knowledge.
Host: Exactly. I would do do it manually because of the things you just mentioned because there is hallucinations there is the fact of the hallucination is one thing. The second thing is even if the code works like how would I looking at that is going to be a bunch of code that I never seen before and I'm just okay I didn't write it so if I didn't write it I don't know what it is I need to step through it and you might say oh you cannot just take the test case from AI you have to review it yourself but still if you did not write it it's different than you actually wrote it you understand and There is there is personality in the code you write. It's just the way and then the validations just I think there is more work we're doing with AI than actually being productive at some point. There is a there is a there's a a line that we need to watch out for.
Yeah, of course. Of course. Thank you for um sharing all of your experience with databases and the development and of course reflections with AI. Um I think we will um finish soon but before that let me ask you um I know that you have some books of course you have written a lot based on your experience. Root cause is definitely a popular book. So what are you like what are you planning to talk about a recent any book or uh are you giving any talks somewhere or what are you doing? Uh I'm just u currently I'm working on on on on my platform a training platform that will include uh I never shared this with anyone but I guess this is
Guest: so I'm working on my own website that I can move my the current courses I have and I'm gonna focus on making advanced intermediate to advanced courses.
is about deep dive on a technology like engine X or haroxy or certain popular web server for those people who are interested in in going in depth and understanding these technologies like databases I'll pick one of them and I go through them so I'm making that I'm also making the same site it'll be kind of a bug versus feature news site where if there is like if let's say if engineext fixed a very critical bug I would go through it and and explain how it works what was the effect and as a result what was the root cause and because of that these kind of articles will link back to these courses and will who whoever reads these articles will will get better at understanding the the in the the internals of these systems because I'm I'm fascinated about internals especially of backend systems like EngineX JRxy you know databases I love that stuff so you'll see hopefully by the beginning of the year I'll announce something but yeah courses I'm working also on an on a new book about patterns of backend communications that's I find I find that fascinating how how you the back end has a listener and then that listener accepts just raw connections but the bytes on those connections represent the requests and the cost of the kernel reading those requests and then moving those to a to a queue to be executed and that request eventually because of the nature of the backend needs to talk to a database you need another connection pool.
So I'm talking I'm I'm my book describes all the possible permutation of you know patterns that you that can emerge from having a front end talk to a back end and then a backend with a worker pool and then worker pool with a connection pool and how many communications you can have a private connection pool. You can have a global connection pool. you can have a a private worker pool and then things like that. So, I'm working on that, but I still don't have a title for it, but yeah, this is something in the works. It's going to come up probably sometimes next year, but yeah, that's what I'm working on.
Host: Of course, uh thank you for um talking to me today. Uh thank you for all the important reflections. I [clears throat] know you're very busy and uh from this busy time, you gave some time for this interview and I'm really grateful that you did it. Um, yeah, I would love to stay connected with you if you permit me. I can send a request on you on LinkedIn and I'd be happy if you connect me to more of your friends or someone who I can talk to, but you don't have to, but I'd be happy if you do it. Um, hope you have a wonderful day. Um, Hussein and yeah, have a great day.
Guest: Thank you so much.
Host: Of course. Bye.
Guest: Take care. Bye-bye.
