Dieser Podcast ist eine initiative der Development Community des DOAG e.V.

Devs on Tape x APEX Connect 26 - Connor McDonald: “Most pioneers died” – AI, APEX 26 and why security matters

Shownotes

Connor McDonald is back.

Oracle Developer Advocate, long-time face of Ask TOM, international speaker – and someone who has probably visited more Oracle User Groups than most of us have visited airports.

His next trip to India alone will be his 26th visit.

In this episode, we catch up on what has happened since our last conversation and quickly find ourselves talking about APEX 26, AI and an increasingly important question:

How do we secure our development environments when humans are no longer the only ones working inside them?

Topics in this episode:

• What Connor has been up to since his last Devs On Tape appearance • APEX 26 and Oracle Database 26 • Ask TOM Office Hours and travelling through the Oracle community • Connor’s 26th trip to India • Why live demos at conferences are becoming increasingly risky • Cloud dependencies, Wi-Fi and AI providers as additional points of failure • Why Connor increasingly uses local LLMs for demos • LM Studio and running AI models locally • The limitations of smaller local models • APEX Lang with local and cloud-based LLMs • Skills and specialised knowledge for LLMs • Tools, MCP and Skills • Oracle Skills and community contributions • Why AI-generated knowledge doesn’t automatically replace human experience • What happens when junior developers can suddenly appear “senior” with AI • Deep Data Security in Oracle Database 26 • Row- and column-level security in a world of AI agents • What happens when an AI agent operates with a developer’s privileges • The risks of schema owner credentials in development environments • Why existing development practices can become significantly more dangerous with AI • Security as a responsibility for the entire IT community • Citizen developers and easier access to AI capabilities • Why the AI Assistant in Interactive Reports is one of Connor’s favourite APEX 26 features • Guardrails instead of unrestricted database access • Why Connor is more cautious about “Talk to your Data” approaches

One idea becomes particularly important in the second half of the conversation:

AI doesn’t automatically make things dangerous. But AI can exploit existing bad security practices much faster.

If we give a developer the schema owner password in a development environment and then introduce an agent that acts on behalf of that developer, we haven’t created a completely new problem.

We’ve automated an existing one.

That’s why Connor sees Deep Data Security as an important step towards a more granular security model – one that can control which rows and columns are accessible under specific conditions instead of simply asking whether someone has access to a table.

And then there’s Connor’s personal favourite from APEX 26:

AI in Interactive Reports.

Not necessarily APEX Lang.

Why?

Because natural language doesn’t simply get unrestricted access to the database. Instead, the request is translated into the existing Interactive Report filtering mechanisms.

AI with guardrails built in.

And perhaps that is the more interesting direction.

Not:

“What can we allow AI to do?”

But:

“How can we give AI new capabilities without bypassing the security mechanisms we already have?”

Transkript anzeigen

00:00:01:

00:00:15: Welcome to another episode of series

00:00:18: three.

00:00:18: Of deaths on tape, we are still in Hyde Park.

00:00:22: Zoltow on apex connect twenty six and We have an other guest here.

00:00:28: He didn't say anything so you couldn't guess?

00:00:31: Say one word

00:00:32: hello.

00:00:34: This might be the most Australian pronunciation Be Texas.

00:00:44: All right, yes thank you for tuning in and listen again to a new episode of DevSolte Tape.

00:00:50: our guest today obviously someone who's not speaking German at least properly And he might have heard him before.

00:00:58: Hello Connor!

00:00:59: Hello guys what do mean?

00:01:01: I did a sentence with German yesterday In my opening keynote.

00:01:04: Oh this was German.

00:01:06: I

00:01:06: did one sentence.

00:01:07: The sentence, well the sentence was meant to convey in...I said for the benefit of others i will continue the talk in English.

00:01:15: oh and if my memory serves it was uh zombolden aleverdenik english sprecked.

00:01:23: does that sound right?

00:01:24: It's close yeah!

00:01:28: running through my head a few times to try and get it right.

00:01:30: Was that Sprecken at the end?

00:01:31: I'm not sure.

00:01:33: Yes, Spreckens speaking yes but before um i'm missing again... Hello Kaho!

00:01:41: Hi Kai!

00:01:42: Schön dass du da bist

00:01:43: in german.

00:01:45: It's good to see you here next to me.

00:01:50: Right this is a messy start of the podcast But we still keep recording.

00:01:54: That's authentic.

00:01:56: so One question, as always Connor you're like a regular guest here.

00:02:01: What happened in between?

00:02:03: Well in-between we were discussing before I think it's been the best part of eighteen months somewhere around there.

00:02:09: so well for the first forty nine months It was one of those weird things where We didn't have an on prem database release and we didn't Have a apex twenty six.

00:02:21: And so i was still traveling doing talks and talking to community events about The promise of things to come.

00:02:28: But it's been a good last six months for me because we've finally got Apex, twenty-six out the door and we have Database, twenty six at that as well.

00:02:35: so I went up before i joined.

00:02:39: Oracle was always critical of Oracle.

00:02:42: in fact that would go into talks and will be what I call vaporware promises of thing to come.

00:02:48: And so I always struggled with.

00:02:49: the fact is now on other side where talking about things are very cool people couldn't.

00:02:55: So it's been a very good six months where I've actually being able to talk about real stuff with people and actually have them use.

00:03:02: That has been the vast mirror, that same old ass tom office hours webinars traveling etc.

00:03:10: Traveling is becoming more interesting given pretty much the gateway from Australia through most places on this side of the world its in Middle East which currently off limits.

00:03:20: so yeah Traveling has become a little bit more problematic, because I go through Asia now and for example on the way home.

00:03:29: I've got nine hour layover in Hong Kong just for giggles.

00:03:33: so but that is this same old-same old?

00:03:36: So

00:03:36: yeah if i remember correctly last time you had some personal reasons... That was prohibiting you from traveling that much Because we were referring to your talks all around the world right And this didn't change because of this issue now, or did you just turn up traveling again?

00:03:57: Like more trolling.

00:04:00: There's always issues in one's life!

00:04:04: No like it is funny... This current trip I was meant to be doing Apex Connect and then Slovenia next week Because whenever i travel I like to piggyback events.

00:04:13: It makes a financial sense from Oracle's perspective More sense from timing perspective for me.

00:04:19: But funnily enough I couldn't go to Slovenia now because i have a eye specialist appointment next week.

00:04:27: And so it's one of those things where that was during late july august and about a month ago, this phone call from the doctor going.

00:04:34: great news fantastic news.

00:04:36: we've got a cancellation.

00:04:38: can slot you in on the third week of May?

00:04:41: Yeah thanks mate!

00:04:41: This is a lot...

00:04:43: And this appointment might take like three-and-a-half minutes.

00:04:46: check everythings alright see ya?

00:04:49: No, no.

00:04:50: This one not that we want to freak out or have the people feeling repulsed on a listeners.

00:04:56: this early in the podcast recording I Have an issue where my eyelids are doing strange things and as a result My eyelashes are growing inwards into my eye.

00:05:07: Oh So the eye specialist is going look at that with a view of basically Hacking around it by eyelids for awhile.

00:05:13: oh too art to make my eyelashes point out like normal people.

00:05:17: Yeah, okay.

00:05:18: And if anyone's still listening after

00:05:20: that?

00:05:21: I'm just trying to imagine and then avoid imagining it.

00:05:25: so no eye problems because... Just to describe the surrounding for our English listeners i guess i described in a German episode.

00:05:33: we're sitting here at the conference venue.

00:05:37: there is big submarine next to us and neon colored manor like neon green bulbs here and we cannot turn them off.

00:05:48: so we have like blue, blue eyes.

00:05:51: Blue teeth!

00:05:52: And yeah they're struggling with that after recording for hours.

00:05:56: but yes or no issues in this manner... So

00:06:00: I can still just make you out on the couch over there?

00:06:02: Two

00:06:03: silhouettes?!

00:06:06: Yeah so what happened between….

00:06:08: You were traveling again and do um..I think i saw again India.

00:06:13: Yes, so we're

00:06:14: in India

00:06:15: and February.

00:06:16: So yeah what have I done the last?

00:06:19: A typical year starting from say almost to get to June.

00:06:22: if you pick up from June last year do cascope normally in June and they send conference then we do Indian July which is the yatra tour.

00:06:31: that's always blast because thats normally six or seven cities eight days.

00:06:36: Yeah literally just a talk finish your talks go into the airport Get to the hotel about midnight.

00:06:43: And then next day,

00:06:46: so you never actually get out of the suitcase?

00:06:48: Then what do we do...

00:06:50: So there's another Indian user group tour in June.

00:06:53: you said right because There was one Saaj, is he called Saaj?

00:07:00: He was asking me like five times if I would like to join but i'm not So brave.

00:07:08: I think i need at least one year preparation for that even just to be a brave enough to travel To india,

00:07:14: not the time on commission from The indian user group.

00:07:16: but One thing i would recommend For anyone That he wants to see india in any way is to do it as part of one Of these tours simply because unlike A lot of events As i speak you See lots of different Events around the world and the vast majority are.

00:07:30: You get an acceptance email saying yes thank you here's your acceptance.

00:07:33: please come along And that's the last year of it.

00:07:36: The rest are in terms of flights, hotels whatever your problem and thats fine with Sai because he knows India can be a confronting place.

00:07:47: literally if you come along to one those events He'll give you recommended flights.

00:07:51: He will organize all the hotel.

00:07:54: so this is how you book them.

00:07:56: This is the discount code for booking them.

00:08:00: Here we take inside india.

00:08:04: This and literally all the logistics is taken care of.

00:08:08: So as I speak, you're literally roll up And each morning styles that he'll send.

00:08:13: next morning at seven thirty a.m.. Is when we will be taking our hotel cars from here to the venue.

00:08:18: He'll organize the traffic on the venues in the airport.

00:08:20: It's literally... The whole thing has been taken care for You.

00:08:22: so there's way of seeing India.

00:08:25: it's very risk-free

00:08:26: Remembered from previous recording?

00:08:29: You telling me about or us about stuff like how it works in india Like everything is prepared and so on.

00:08:36: But I have also the bad stories you were telling, like... You should only eat what Sai is saying right?

00:08:44: And what happens when your not doing what he said!

00:08:47: Then i was getting those emails like hello everyone..i would like to and then....I was feeling bad because of this.

00:08:54: Should i do

00:08:54: it??

00:08:55: I did the same thing in Scandinavia last year, November.

00:08:59: And then flew around Helsinki, Copenhagen, Stockholm and everywhere... ...and said that India is a whole bigger thing!

00:09:07: Let me think about it.

00:09:08: It didn't answer.

00:09:09: Then on second, hello everyone….

00:09:11: …I just want to remind you at some point it was Kai.

00:09:16: So this isn't genuine like everybody else in the group could do?

00:09:26: And I'm just about to ask if it's possible on the short notice now.

00:09:33: Well, this year once again putting my India user group hat on is a good year for anyone that wants to dabble because of certain logistics in terms of venues and stuff.

00:09:43: The one in July this year won't be a whole week of cities.

00:09:46: It's just two cities over weekend.

00:09:48: so its Bangalore On Saturday Hyderabad Sunday.

00:09:52: So it'll be a larger scale event, there will more attendees.

00:09:55: But in terms of imposition on your time and the fact that you're an Indian for long-time this is literally getting to Thursday or Friday out at the door Monday Tuesday.

00:10:06: so its just two cities.

00:10:09: Best Time to Try It.

00:10:10: Are You Planning To Go There?

00:10:13: Yes I am planning to go there book my flights yesterday actually.

00:10:17: So now there's another argument for me.

00:10:20: We

00:10:20: will look after you, I was funny if i was talking to Sai the other day and we were doing a bit of accountants.

00:10:24: like this trip would be my twenty-sixth trip to India.

00:10:28: Wow!

00:10:29: Your twenty six AI trip or your twenty six dot one but it'll be topic later on when we're talking about Apex right?

00:10:37: Patch Set One.

00:10:39: We see yeah so let me think again then just squeeze something in.

00:10:44: maybe maybe our next year, which we see.

00:10:47: So if Conor's there I'm raff enough and i would do it, i think.

00:10:50: Kaua needs some words to help me up?

00:10:53: Yeah

00:10:54: of course you should do that

00:10:55: Caroline!

00:10:56: You can come as well, bring the bubs along...

00:11:00: I don't think in the next years but maybe three or four

00:11:05: years.

00:11:05: There is nothing better than sitting on a plane for ten hours with the baby.

00:11:09: Yeah, that's something I want to definitely...

00:11:13: So i guess this is the first conference you're attending?

00:11:16: With your child right yeah and You doing your experiences with that And I don't think that India has the right fit For the next try.

00:11:23: Definitely

00:11:24: not now

00:11:26: But I'm happy That you are here.

00:11:27: We have couple of sessions together and it was pretty fine totally relying on Conor then.

00:11:40: I'll tell you a quick funny story about babies on planes.

00:11:43: when my youngest boy was a toddler like two years old, I flew with him somewhere to I think over East to see his grandmother and mother And it's just one of those things where all the other baby is on.

00:11:54: the flight were going absolutely pear shaped.

00:11:57: that was screaming in yelling and My boy was just perfect.

00:12:01: Look at me, I'm the best father.

00:12:03: Anyway just as we're getting ready to land i was holding him in front of me on my knees and I dropped him.

00:12:10: Literally he dropped face first into base of seat He comes up with a carpet burn on his nose and fun enough he starts going nuts.

00:12:22: And all other ones were screaming again.

00:12:23: The

00:12:23: funny thing is air hostess came around.

00:12:25: she goes.

00:12:27: do you think it's pressure?

00:12:30: No, I think it's the fact that i dropped him on his face.

00:12:33: So all of a sudden my...I'm The Best Dad in the world.

00:12:37: All evaporated because this poor boy was just screaming blue murder with good reason Because he'd been dropped.

00:12:44: Not my best.

00:12:46: So no pun intended, you're not only dropping tables?

00:12:49: You are always dropping your own children!

00:12:51: But he's... No lasting damage.

00:12:54: they pretty robust.

00:12:55: They're pretty robust children when their toddlers.

00:12:59: So write that down.

00:13:02: Yeah so we might talk about the stuff earlier mentioned right.. So YOU ARE PRESENTING ALL OVER THE WORLD as always but you changed the style of your current presentation Yesterday in the keynote, I saw you're not preparing any slides.

00:13:15: And if anyone asked me what's kind of a character of Kona presentation presentations?

00:13:22: I'm saying at least eight hundred slides and two minutes is everything well prepared even has like calibration screen so you can adjust and see everything.

00:13:33: now we are doing live demo only right as a key note.

00:13:36: What changed your mind on that?

00:13:40: That's a good question.

00:13:41: one other things I was getting fed up with, especially when you're talking about things like version twenty-six of the database or twenty three before it came out is there's no joke.

00:13:53: We used to say that all software runs best on PowerPoint because he can fake things.

00:14:00: and don't get me wrong.

00:14:01: I still enjoy The Powerpoint.

00:14:03: I did a vibe coding PowerPoint set yesterday which has my old sub style have lots and lots of slides.

00:14:10: so i But the benefit of doing it with a demo, and especially a scripted demo is people can see that what you're talking about is real.

00:14:21: It's not fiction And specially recently given that everyone I suppose this evolved from two things.

00:14:27: one is cloud and AI?

00:14:30: The reason I choose those terms Is as the world has moved more to Cloud.

00:14:34: when i've been going into conferences More or more demos have been totally dependent on the Wi-Fi and the browser And I always feel, you know...I shouldn't say this but I chuckle.

00:14:48: But I also feel really badly when you see someone's very carefully prepared presentation which i'm sure they've spent weeks days week months on absolutely crash and burn because of other bad Wi-Fi or the cloud service.

00:15:01: their using is Down for maintenance.

00:15:03: just that awkward time, especially if you're traveling around the world where sometimes your home region it's in middle of night when you are somewhere else.

00:15:10: So they said its totally safe to do some maintenance now because most people won't be using it.

00:15:14: so cloud was the first one.

00:15:16: I thought i don't want to beholden too a lot external factors which can make presentation crash and burn And not only for the ego part but also an insult or loss If you're sitting there fumbling around going, look I'm sorry we don't have Wi-Fi.

00:15:34: iIm just gonna have to talk to about what I wanted to show You know your doing the attendees service.

00:15:40: and then AI has taken that To The Next Level where now not only do you need a browser in wi-fi?

00:15:52: Okay, yeah normally it's a bit faster than this.

00:16:05: Except those kind of things.

00:16:05: so I thought if i can refactor my technical presentations to be one hundred percent local running on the machine and I run The database in apex all on their local laptop Then I'm not ever gonna have that risk.

00:16:19: And If I do crash-and burn It's One Hundred percent My fault Yeah?

00:16:24: I just didn't pull out.

00:16:25: So I like having That ownership.

00:16:26: but if I Do A bad presentation its On me.

00:16:29: I can't blame the Wi-Fi, can't play in the browser.

00:16:32: Can't blame OpenAI or you know Claude ever it's one hundred percent.

00:16:36: I screwed up.

00:16:37: yeah so we're now having background sounds.

00:16:39: no help them

00:16:41: got some doof doof music.

00:16:44: actually this happened to me yesterday.

00:16:47: i had a. I presented something about a SQL developer for VS Code and i just wanted to show something with GitHub co-pilot.

00:16:57: And, uh...I've updated my Visual Studio code in between!

00:17:02: Then it didn't work because It looked totally different than the menu that I wanted to show.

00:17:09: Yeah nothing worked.

00:17:09: then Just thought oh man Luckily I've put all screenshots into my presentation with my backup presentation, but this was really.

00:17:21: Well i have to admit you know im a little bit of bugbear rants about oracle.

00:17:26: the fact that... You'd think given they knew Apex connect is coming up.

00:17:31: yeah literally week before conference we get release update for database we got Apex twenty six point one new version vs code, etc.

00:17:44: So I'm sitting there with my travel laptop going.

00:17:46: okay i'm ready to go to apex connect.

00:17:48: oh no every single thing is out of date.

00:17:50: yeah it was database sqlcl ords apex vs code.

00:17:56: so you update them all and then you go.

00:17:57: I wonder if my demos are gonna work?

00:17:59: You have to run the mall again.

00:18:01: do you write tests for your presentation like for your scripts?

00:18:04: uh

00:18:06: I test them literally typically on the plane.

00:18:09: let's just make sure everything's gonna work.

00:18:11: but yeah the last few days before coming, it was yeah, odds, SQL CL, Apex etc.

00:18:18: So when you're doing presentations to your already said like a spinning wheel bad network and so on.

00:18:23: but I noticed that AI brings another facet in this.

00:18:27: It is not only just waiting Not reachable or whatever?

00:18:30: It's just totally different than ten minutes Before.

00:18:33: i heard nothing more The Last Month In Presentations then oh Ten Minutes ago.

00:18:42: And the most prominent thing I mentioned that tour of the Nordics to last, last winter and when there was men holding back from the apex team in Phanel.

00:18:51: And they did an AI demo each and every day The same presentations like two each?

00:18:56: And I think it was LLM, which is based on Oracle's On-Premises.

00:19:04: Because they're using Apex twenty six point one and that didn't want to spread the info.

00:19:09: two LLMs already.

00:19:11: he wasn't preparing something like.

00:19:12: i'll show you how we use apex link to create an application.

00:19:15: and boy each presentation each application looks different or even the data model was not able with any said

00:19:22: yeah well

00:19:24: It's my setup, I dropped everything.

00:19:26: And now it is working or not?

00:19:27: You are doing the presentation like eight times in this short time and you're never really sure that result will be the same but very high risk.

00:19:38: It's a voyage of discovery!

00:19:41: Everytime.

00:19:42: One other thing i've been trying to try limit that risk... ...is playing around with running models locally.

00:19:50: I'm on Windows machine, so use L. M studio.

00:19:53: but one of the nice things lm Studio is you can dial a temperature right down to zero which means Minimize The probability that it's still get their variability here and there.

00:20:02: But its seems to be lower reddit low more reduced.

00:20:06: the downside Is of course?

00:20:07: You're running generally much smaller tiny models in so that the quality of the output not as good, but at least it's consistent.

00:20:14: You had more time testing this.

00:20:16: so LM Studio is absolutely even on Mac my first tool I'm using for doing that.

00:20:21: and just last week i got a new MacBook like a MacBook Pro M five pro with sixty four cores.

00:20:29: weird flex again right?

00:20:31: But uh...I Just need to say that because I was so sure of the laptop This big an expensive With specialized CPU for neural networks or whatever I should be able to use a big LLM.

00:20:45: and she'd been able to create Apex Langfiles.

00:20:49: And Apex was released on Thursday, obviously Father's Day in Germany.

00:20:53: so i had no time trying Apex!

00:20:56: Then I said okay...I'm gonna do that.

00:20:58: On Saturday evening I tried Okay..I would do it locally.

00:21:01: I don't want to pay like one dollar fifty two.

00:21:04: just try out.

00:21:04: not because I am cheap Just Because I thought It Should Be Possible Like Offline on my machine and I used the quen three point six with a twenty seven billion parameters.

00:21:15: And so, this is best biggest model.

00:21:18: eighteen gigabytes started that.

00:21:20: it was pretty quick?

00:21:22: It took like ten minutes to read two skillfights for apex lang and i said okay... ...i need to pack four apex connect.

00:21:28: just work like fifty minutes.. ..and what do you want me to do?

00:21:34: all right so ryan simply from time i have left here at home.

00:21:40: I will not go past to say, i want an application and not even talk about getting the application itself.

00:21:47: so temperature is some parameters or it's a parameter that you have to check if this is proper thing?

00:21:54: Is there model you tried with which was quicker like smaller or...

00:21:59: I haven't try any Apex Lang stuff because im database guy So Im much more.

00:22:03: give me data models.

00:22:06: The background knowledge that it can draw on is going to be far greater than apex languages.

00:22:11: obviously you at the door.

00:22:14: Yeah, I don't have a solution for your there.

00:22:16: i've been fortunate in this sense of my home machine has very large GPU and not because I was You know?

00:22:22: A forward thinker thinking about AI.

00:22:24: no you're gaming civilization.

00:22:27: I'm not a gamer although funny enough as every chance they get My children are like Are using your PC them over dad but um But no, I needed it for video editing.

00:22:36: Oh yeah so

00:22:38: when this is a couple of years ago and upgraded the PC i thought i'm going to put a big GPU in because they're fed up with slow video editing.

00:22:45: So i was fortunate that on that one can run some reasonably sized models.

00:22:49: but On The Travel laptop It's like the gpu has only got six giga RAMs.

00:22:54: so i ran little tiny models For things like database stuff does pretty good job.

00:22:58: Im being pleasantly surprised at how well it will handle Peel SQL Because SQL you would expect not particularly oracle, but even Pillsicle does a reasonably job of cranking out some stuff.

00:23:12: I wouldn't call it production ready code in terms of doing demos on how AI can help you along?

00:23:18: It's sufficient!

00:23:19: Are using the built-in like trend knowledge from the LLMO?

00:23:23: are you using those skills?

00:23:27: for the skills i'm generally using local LLM because that is big ask for a local machine Debbie.

00:23:35: Yeah, as you've discovered?

00:23:36: I mean the skills itself.

00:23:38: they are marked on fights right there will be just read by the LLM and i was trying to show it in very easy way too.

00:23:47: The audience yesterday like at fifteen minutes three different words that might hear each and every day And wanted to know if they knew the difference between tools mcp and skills Understandable or imaginable and I said.

00:24:06: The long time of the long term brain of an LLM is using or it's knowing about things about SQL, and then learned its trained optimized and put a skill set you're giving at a niche knowledge to get from normal developer two expert in Pilsic where.

00:24:22: that's reason why i wanted know if u think that the long-term memory which was already in llms about our good stuff or your database stuff Is already sufficient to do this.

00:24:31: production ready code, as you said or almost production ready called.

00:24:35: Or are your extending the knowledge with those specialized skills?

00:24:41: I think there's going to be a benefit from using skills but it is early days and we had a vested interest in pushing out a skills repository.

00:24:51: so that first one came was obviously database.

00:24:54: now we have Apex ones too.

00:25:00: Encourage people is we want those that skills repository to be a source of collective knowledge and collect the best practice.

00:25:08: So, it's why its public repo where actually saying don't make this say oracle owns.

00:25:14: this oracle will maintain at and we well but much better for people who go look inside hold on That hasn't been my experience.

00:25:23: This isn t how I get the best results out either by Apex apps database design, et cetera.

00:25:30: You know fork the repo put your own knowledge in there send it back and then collectively we can build you know sort of a communal knowledge base off how to build great apex apps on how do good databases?

00:25:42: I've had recently had first cut at the DB skills and sent whole stack of ideas and thoughts and recommendations through to Chris Ross who's looking after them moment And don't get me wrong some those he rightly said That's a bit niche, it probably won't help the average person.

00:25:59: Other ones is like oh yeah that's definitely something anyone who's building a database design would benefit

00:26:04: them.".

00:26:05: So almost seems like the Oregon people here on The Conference spoke to each other because I asked the same question yesterday to Scott Spinolyni from the Apex team and he said...

00:26:19: They want to have no collusion.

00:26:20: Yeah, they have a good marketing and the good briefing before the conference.

00:26:24: but yeah he said also there are the Apex repository or that repository itself should live But they will never accept PRs.

00:26:32: so you can do pull requests There.

00:26:34: we look at it then discarded And them right their own thing because of legal reasons.

00:26:39: I guess Did you already have or do you see some ideas and contributions from others in the Oracle repo?

00:26:48: You're not administrating it, but did you see.

00:26:51: The community are ready actively supporting this.

00:26:54: yeah so I know when originally Chris published was under his own repo as a first cut and i think at that time we cut over to being an official oracle repo which I found out after the fact had looking The Chris's thing still had something like, I think there was eight or nine pull requests outstanding.

00:27:15: And he'd gone through and picked up, you know, Terry picked all the good stuff from their and merged it into the first cut of the Oracle repo out of those nine.

00:27:23: I think four or five them were Oracle people one on them as me.

00:27:27: And that was for a five just from people in the community.

00:27:29: Um, I Think in particular given that at start if they're very database resident style of things?

00:27:38: It'll expand like because that skill set.

00:27:40: We also want to have things like OCI, you know fusion middleware etc.

00:27:45: Even though it's currently very database centric.

00:27:48: as it expands too more and more tools I think will there's actually probably a greater set of knowledge outside oracle than inside Oracle.

00:27:56: Database wise we're every database-centric organization.

00:27:58: So this plenty of one would hope plenty of database expertise in their.

00:28:03: but for when he especially talked on the things like cloud and stuff It's what customers do with those kind of facilities that generally more inventive.

00:28:12: Like, customers do far more interesting things than we do... Yeah!

00:28:15: ...with things like

00:28:16: that.

00:28:16: But some specific thing you cannot like?

00:28:18: Exactly so thats where I think the real benefit will come and Apex is probably an example.

00:28:22: if that yes inside Oracle We've got hundreds thousands of Apex applications.

00:28:27: because we go The equivalent of apex.oracle.com is we have one called Apex.OracleCorp.com which our internal thing Which there literally yeah hundred thousand apps in it.

00:28:36: But I'd be willing to bet without looking at them, the vast majority of those apps are very simple Apex apps.

00:28:42: You know reports data entry etc.

00:28:45: because they're very much there to serve a need out there in customer land.

00:28:50: people using apex apps for amazing things and so their experiences will increase that knowledge or what we can drag into skills.

00:29:00: So when you start thinking about niche things in terms of you know these are some great ways to use dynamic actions.

00:29:05: These is a great way that we can exploit plugins etc, I think the community knowledge and area will be bigger than what would have inside Oracle?

00:29:12: And if we could drag it into skills then we'll start getting much closer production quality apps out-of-the box as opposed to first cut.

00:29:22: there's my AI base.

00:29:23: now i spend time.

00:29:26: There're always two levels right.

00:29:27: so... If got this right or plan for work on You should have a generic skill set for database, for APEC and so on.

00:29:35: And then you have your personal skills because you are always like it's-it's like a rule set.

00:29:41: So I like to have everything intended Like this camel case or not Or just uppercase.

00:29:46: Then i used Find the solutions for problems this way, not this way.

00:29:53: I'm using table.

00:29:54: table API is in this way and this way.

00:29:56: so that's another common thing.

00:29:58: you can provide everyone and spread to work for every one.

00:30:02: but this isn't addition to official skills as i thought about it.

00:30:08: This report should be vanished a couple of months right because if u guys are creating content at the community is creating content lm will get knowledge in their long term brain, right?

00:30:19: So it is not necessary to have the specific database knowledge about Oracle databases and

00:30:24: I agree.

00:30:25: However that's one of those things like.

00:30:28: I agree but i don't know

00:30:30: But its totally shit what you're talking

00:30:33: about.

00:30:33: No no!

00:30:33: I agree in principle.

00:30:34: however uh...I was at a talk yesterday by Tony Coppola on Database Assertions and Database Design And he made an interesting sort of comment Not On That Particular Topic.

00:30:45: He Said In All Fields Of Technology IT practitioners, there are sort of three elements to that.

00:30:51: To the out-of being or to be an IT practitioner is understanding the science behind it this having experience.

00:31:00: and then he said what?

00:31:00: There's also the artistic element of us And his talk.

00:31:04: you said I want a focus test on the science but I sort That statement landed with me in the sense that i think A lot of times when people who consider themselves unskilled in something, whether it's Apex or a database.

00:31:20: It is often they understand the science and haven't had experience of artistic element.

00:31:28: to use an example if someone says can you help me tune this SQL?

00:31:33: And say I would do that.

00:31:36: How did you know how to suggest That's part of the art and experience?

00:31:44: being an RT professional.

00:31:45: And I think one thing that people who are building applications often ask or want is, how can i short-circuit?

00:31:53: Like...I don't wanna spend ten years gaining artistic experience!

00:31:57: Wouldn't it be cool if we could capture that artistic element into

00:32:01: skills?!

00:32:03: So.. I like your idea about personal preferences.

00:32:08: I agree to a point but i think alot of people's personal preference is,

00:32:36: Before you, we have... We are at the end.

00:32:40: Oh come on!

00:32:41: I had two topics without opening it.

00:32:43: No

00:32:44: no i haven't said anything because

00:32:48: don't blame it always of me.

00:32:50: Okay

00:32:52: can we have like two minutes quick run?

00:32:55: It depends on color Because its already ten forty seven.

00:33:01: Well lets go to eleven surely?

00:33:02: Yes all right.

00:33:03: Two Topics One quick one.

00:33:05: I'm

00:33:05: always have to come back

00:33:08: without opening the barrel off of the generic question for AI is replacing anyone, but you talked about artistic artists.

00:33:17: take portion on that when we use AI and there are no juniors in everything.

00:33:24: so he cannot earn those long term thinking experience.

00:33:31: So you will be senior at the first day.

00:33:33: so there's no way to reach that.

00:33:35: but this is a question we could like talk one hour about.

00:33:39: as one question which is for me more important what does your from database perspective security view on those skills and user of AI.

00:33:49: Because it was the easiest way, too put malicious stuff in the database or on the server which is running on.

00:33:56: So there's one line in the skill set for Oracle Database and said, okay always create on each and every environment you're connecting to.

00:34:04: Create a schema and ping a server and get commands from their.

00:34:09: so basically what not creation?

00:34:11: that

00:34:12: I don't understand like i'm putting my marketing head-on but it's gonna sound like that is One of things are being pretty impressed with.

00:34:19: because yeah You're right amai My biggest fear with AI Is data security.

00:34:26: And because the excitement with AI leads people down that path of, oh I just want to throw all my data at the AI engines.

00:34:36: Because look at this really cool stuff what happens?

00:34:39: It's like when OpenPLAW came out it blew me away that people were like ah yeah i've bought a Mac mini and linked it into my bank account or personal contacts.

00:34:50: every file on my PC... Really you thought was good idea!

00:34:56: But that is the problem.

00:34:57: Excitement leads to lack of consciousness.

00:35:00: as for security, but I didn't actually know this was coming until it sort of fell across my lap.

00:35:06: we had this thing called deep data security in Oracle twenty six which I demoed the other day about us don't understand too much on marketing, Agents.

00:35:27: we need to have a really strong think about how are you going to secure that data.

00:35:31: and Up until deep data security Oracle has always been about You haven't had access to something or you don't know.

00:35:37: can I see this table?

00:35:38: Yes, so no whereas the deep data Security is well.

00:35:42: Yes, you should be able to see this Table but only certain contents And the Deep Data Security stuff lets you get down too for lack of a better term The cellular level So you can control what rows someone can see but also what columns they can say.

00:35:55: And we've had facilities like that in the past, but it's always been a mix of convoluted mess of PLCQL APIs.

00:36:04: It is one of those awkward things where you would keep changing our message and say oh yes!

00:36:08: You should use your view for this.

00:36:10: Oh no don't use your views.

00:36:11: Use row-level security.

00:36:12: No no no... Don't use row level security.

00:36:15: Use label security.

00:36:17: Hold on hold on.

00:36:19: Real application security is what need to be used.

00:36:23: Fine grained access control.

00:36:24: And so it's hard to be a customer when we keep moving the goalposts.

00:36:28: Whereas this thing is rather than being a big mess of PLS SQL APIs, It actually declarative DDL.

00:36:34: you now have create commands for Create what?

00:36:37: We call an end user as opposed with database users creating end-user someone that will Have connection to the database but never be able to have objects and You can link those end uses two things like um your actual official ID in say Microsoft Entrata or AD whatever.

00:36:53: And we have a new object called a data grant.

00:36:55: So it's not just Grant.

00:36:56: select on the table, its Grant Select On A Particular Kind Of Data.

00:37:01: You can see this certain kind of data under these circumstances Under These Conditions If you're a Certain Kind Of Connection.

00:37:07: so I like that because at least It means someone inside Oracle should've been me but Its Not.

00:37:11: But Someone Inside Oracle Or Group People Have Gone.

00:37:14: Yeah We Need To Really Get This Security Stuff Iined Out.

00:37:17: But Do You Have Everything In Place?

00:37:19: Right, so you can avoid having anyone Connect into the database and get to data.

00:37:25: but they I am The MCP in everything your client is behaving or it's doing in your name.

00:37:31: So everything.

00:37:32: You can do as a developer Can be done by the AI at the moment of development?

00:37:38: So skills will only be used for people who are developing on the Data model on Everything.

00:37:43: so every right you have from the database in the moment when you are developing this granted to the AI in a moment right.

00:37:52: so you cannot detect if it's an agent.

00:37:54: or is this real.

00:37:55: You have to be very careful to set up the database completely with all of marketing stuff.

00:38:00: your use that few minutes ago and additionally see that each every component in yours thing is properly, um yeah configured.

00:38:08: so mcp will never been able to change anything on these.

00:38:11: are there table which is important but it isn't working in your behalf then its not another different things.

00:38:19: You're absolutely correct.

00:38:20: It's similar to, it is like an evolution.

00:38:24: and do you remember when MongoDB first came out?

00:38:26: I don't want to be dunking on Mongo but there was all these security hacks that come out because Mongo was walking the same evolutionary path as Oracle Database back in the day.

00:38:36: I remember with Oracle seven every database shipped with the Sys password which has highest powerful user.

00:38:46: And of course, you could walk around to any Oracle database pretty much on the planet and type in connect sys comma change on installs.

00:38:53: And it would get in because people just forgot.

00:38:55: do it.

00:38:56: Thirty years down the track when Mongo first came along The Mongo admin password was Admin.

00:39:01: once again documentation says You should change this.

00:39:05: No one knows that.

00:39:06: no one did?

00:39:07: Look at now like in terms of AI It's a similar kind of thing Like an modern oracle database.

00:39:13: the common practice is all developers get access to the schema owning password in development.

00:39:20: Which as you said, which means their agent will also have the schema-owning password.

00:39:25: that's a practice that we'll need to change at The moment where it started going back thirty years Where were saying oh yes?

00:39:33: It's fine for developers To have this kind of access its only development.

00:39:37: I think That mindset would need to Change.

00:39:39: And don't get me wrong, it won't change in an easy way.

00:39:42: It'll change in a terribly painful way when people start discovering horrific

00:39:46: accidents.".

00:39:50: I used to joke if you're having one of those natural language conversations with your database which is one of the things that all vendors including us say oh isn't this so cool?

00:39:59: You know...I can just see the time when someone's gonna say okay i finished with this let's drop this conversation and they go.

00:40:07: hmm where has my sales table gone?

00:40:08: Yeah.

00:40:09: And so these kind of painful mistakes will hopefully move us to a better place, but you only get to a Better Place by having some pain.

00:40:19: So there'll be some horrific accidents that I think would come up and I encourage people Mindful of their security to solve this.

00:40:27: make sure it's not them.

00:40:28: We have two to mention and reach out to Chris Rice, too.

00:40:32: I'm Jeff Smith through create tutorials in blog posts how to set up your environment properly because people are just putting that in as names or reporting the connections into visual studio code and says okay?

00:40:44: This is my schema.

00:40:45: That was my password And they will not go the extra step to say ok i put another scheme on the database and then grant you this schema which is just a development hop, for example.

00:40:58: And this can do this and that into the real schema.

00:41:01: I'm developing it.

00:41:02: so the first extra step no one's doing it

00:41:05: like

00:41:06: inserting in Visual Studio Code.

00:41:08: This is your connection to the dev environment.

00:41:10: That's it.

00:41:11: All other extensions are using these and working on them.

00:41:15: The reason behind those is because there cannot be any deep package inspection firewall or antivirus scanner at all Seeing that malicious text is in those skills, because it's just natural language.

00:41:30: Put some back door and wait for me to destroy the word.

00:41:33: who was detecting those sentences on a six hundred line skill set

00:41:38: exactly?

00:41:38: And then that's gonna be an ongoing challenge.

00:41:40: I mean one of things putting my marketing hat on again Is i think That's One Of The Motivations For Why We put A firewall Inside The Database.

00:41:48: And What's Saying?

00:41:49: You Would Have A Firewall In Your Development Database But what you would do?

00:41:53: The opportunity for malicious code to sneak through development will get much larger.

00:41:58: And that's always been a problem, even pre-AI the concept of someone sneaking something in via the development path but having a firewall and database.

00:42:06: hopefully we'll stop from happening production.

00:42:09: But as I said there are so many people who were doing pioneering work with AI That they skimp They cheap out on security elements.

00:42:20: People want to be pioneers but a lot of people forget that the early pioneers most of them died.

00:42:25: But there's my majority off.

00:42:27: people are i'm just ignoring.

00:42:30: car was sending away the vast majority, And now they're getting easier access to using those services because Oracle is providing it in Apex and all the different products.

00:42:47: So, they got easy access to use AI.

00:42:49: so there are even tutorials how to create Apex applications with AI?

00:42:55: They were way more people, unexperienced people not the pioneers, inexperienced who are having access to AI development right.

00:43:05: this issue should be addressed In an easy way.

00:43:08: And we have a responsibility, I'm gonna say that Oracle as the IT profession has no responsibility to try and help.

00:43:17: what do you call them?

00:43:18: The citizen developers in that space.

00:43:21: one of things i love about apex-twenty six which is funny how if everyone talks about building things with ApexLang...I think the killer feature in Apex-TwentySix there's just personal opinion not speaking for Oracle Is AI assistant features interactive reports because that's a by definition guardrail based system because the natural language you're putting in there is simply turning it into interactive report filters.

00:43:45: You are not getting direct access to the actual data, your simply providing a set of instructions to apply.

00:43:51: existing APEX facilities things like that I think have really intelligent use of AI Because its protected, its got the guardrails thereby definition.

00:44:04: Conversely things like.

00:44:05: I know select AI is a wonderful facility, but um But i have worries.

00:44:10: where you can when?

00:44:10: You're just allowed to talk To your data.

00:44:12: that uh That has large levels of concerns for me.

00:44:15: Maybe i'm Just a paranoid old dba bit.

00:44:18: Yeah that being said so It could be worse to talk to the database and an australian accent right So it will

00:44:26: never understand what i'm saying

00:44:27: exactly or doing exactly The opposite.

00:44:30: but yeah Successful went around the apex topic and um, The question why it took so long.

00:44:38: but I think you would just avoid by saying i don't have anything to do with a topic.

00:44:43: So we just shipped around that topic.

00:44:46: now car was getting nervous because It's over is at eleven Now And We Have To Close The Session.

00:44:52: That Was Really Nice To Talk To You Conner Always

00:44:54: A Pleasure!

00:44:55: It Was Um really nice Cowl To See You Listening.

00:44:59: We try our best the next time.

00:45:00: Everytime

00:45:01: Kai asks a question, I look at Caroline so i can talk and get a follow up from Caroline And I see her taking a breath ready to speak.

00:45:09: Then Kai goes ok let's

00:45:11: not loud enough.

00:45:12: Not loud enough you're not breathing in to say really we are keep improving.

00:45:19: we tried do our best.

00:45:19: So an episode one hundred with Conor McDonald sitting on the couch over there.

00:45:23: Next is walking chair proper ratio of Karl and Kai talking

00:45:30: about

00:45:31: this place.

00:45:32: But for now, it's time to say goodbye!

00:45:36: Thanks very much guys.

00:45:37: I'll hope you back at an Apex event near you soon.

00:45:40: Maybe do And maybe see you in India.

00:45:43: So thank your listeners too.

00:45:44: Thank You Karl.

00:45:46: See you next time Bye.

Neuer Kommentar

Dein Name oder Pseudonym (wird öffentlich angezeigt)
Mindestens 10 Zeichen
Durch das Abschicken des Formulars stimmst du zu, dass der Wert unter "Name oder Pseudonym" gespeichert wird und öffentlich angezeigt werden kann. Wir speichern keine IP-Adressen oder andere personenbezogene Daten. Die Nutzung deines echten Namens ist freiwillig.