Let's talk Oracle vs Postgres rather than USA vs Russia

So - as a long time Oracle DBA (who also loves Postgres), I've been seeing a lot of companies do this sort of move.

There are a couple of downsides, but really - there's a lot more upsides to Postgres than downsides (IMO).

I'd love to hear more detail. We hear a lot from the PostgreSQL team and its fans (amongst whom i count myself!), but a lot less from people on the Oracle side.

Oh, as the benefits of Oracle vs Postgres?

So the biggest in my experience is not enterprise support. Folks generally expect it to be. The biggest is actually flexibility. Oracle DB is good at handling some edge-case scenarios, such as a RAC cluster with a failover cluster running an Advanced Dataguard Reporting instance in a whole different state.

Basically you are running a (super expensive) near real-time cluster that's doing compressed log-shipping to another cluster, and you have a standby on that secondary cluster that's open in a read-only mode. And none of it requires cron jobs or excessively complicated setup.

However... even though I've done stuff like this for a number of clients, there are SO MANY better ways to address these sorts of scenarios with creativity and elbow-grease that Postgres tends to be a better tool.

The caveat, of course, is when the person who sets it up leaves, and some other person has to take over. With Oracle's scenario, it's mostly just a slightly unusual config of a standard set of tools. The more creative Postgres solution might be quite a bit more of a learning curve.

This is just an example off the top of my head, but it is one that came up recently. A client had a shipping/receiving system that could not go down, so the 20k+ per node was trivial. To reduce the load for reporting, they just simply had us open a standby DB for read-only reporting on the failover cluster - and they liked that so much, we set up another one for them local to the offshore reporting team.

It's absolutely possible to do something like that with Postgres clustering, but there's a whole lot fewer folks doing it.

Actually, i was thinking more of the upsides to Postgres - apologies for not being clear.

I thought you were already a huge Postgres advocate? Or do you mean 'upsides to postgres that appeals to heavy oracle sites'? /edit Perhaps that wasn't you...

So #1 benefit of Postgres for Oracle shops is transition cost. It's cheaper than Oracle (by sometimes substantial amounts), and relatively painless to switch to. A lot of code can move unmodified, all the same platforms, and often even the same teams of folks in the same jobs. Postgres scales very well, at the very least it can handle 90% of a given company's Oracle load with no real issue. Things like clustering, backups, failovers, and reporting systems can be re-engineered to work in similar ways on Postgres, though some will require substantial hackery.

The #2 benefit is stability. Oracle has a very bad track record (especially lately) when it comes to patching and supporting older databases. If you just want a DB to sit in the corner and work for a year, with push-button easy security patches at most... Oracle isn't really the product anymore. Oracle CPU (critical patches) are cumulative now, and the bloat is getting out of hand. I recently just installed a set of patches that were almost an extra 5GB for the footprint... minor for a 20TB database, but ridiculous if you're thinking of thousands of small distributed hosts.

What's Oracle's patch deployment strategy now? The last time I had to deal with it was around 2008, when a security update was a tarball with a README file telling you which files to copy where. I've heard it's improved considerably since then.

Not a ton different, if you've used OPatch already. Basically it copies around files, runs a bunch of perl, runs a bunch of sql, and then you run the usual patch upgrade scripts at the end. The in-place patching is safer and smoother in 12c than it was in 11g, but the cumulative patching has really gotten out of hand.

For example - on a QA system we were running a couple of custom one-off patches delivered by Oracle Support. These blew up the entire patch process. I had to stop, back them out, re-patch, then re-apply the one-off patches.

Oh, and 12c is a seriously whiny bitch about XDB. Just for added fun.

You seem to think that having your data hosted in Moscow is a worse privacy concern than in USA? That's a joke. You realise that google just made location tracking mandatory for anyone using maps or app store, right? The USA is way worse in this respect. Or let me re-phrase that: we know for a FACT that the USA is very very bad in this respect, whereas Russian just has a bad reputation.

I absolutely think that data hosted in Moscow is a worse privacy concern, yes - because while I don't doubt the governments of both countries are spying on that data, I trust the US government far more than I trust the Russian government.

A useful series of tweets by @SwiftOnSecurity about why storing data in the US isn't a bad idea:

https://twitter.com/SwiftOnSecurity/status/77549120598337126...

One word: jurisdiction. The GU might read my emails, but they don't have the authority to execute 4am raids on my property and kill me with impunity in the name of "officer safety" as an eventual consequence of something XKeyScore flagged.

At the end of the day, the people who have the guns and the authority to use them against you take a more prominent place in one's threat model than a foreign entity with no jurisdiction.

You trust the us gov? The same that has denied manning his/her rights, driven her to suicide and now hunger strike? The same that got sweden prosecutors to re-instate assange's rape accusations after they had been independently dismissed by the initial prosecutor, so they can extradite him to the us? Ok buddy, keep trusting the us gov.

I think you've been so thoroughly brain-washed by russian-hating american media that you can't even think straight any more. I realise that this isn't really an argument, but I already presented my argument (that with the usa gov you have facts, whereas the russian gov you have suspicions) and it didn't seem to make a difference, so i don't really care to continue this conversation.

Jesus Christ. No.

It ought to be obvious to anyone that applying black and white judgements in these situations is idiotic. Do I think the US government is beyond reproach? No. Do I think the US government is more open and accountable than the Russian government? Yes.

> (that with the usa gov you have facts, whereas the russian gov you have suspicions)

Yes, because the US government is open and accountable enough that this information is public. The same cannot be said for the Russian government.

Would Snowden agree with you?

That's actually a very interesting question. I don't know. And I doubt he is currently in a position to be very frank and honest about it.

There you go with your anti-russian bullshit again. Snowden talks shit about russia as well all the time. Why wouldn't he? Because putin comes and kill him, right?

> You seem to think that having your data hosted in Moscow is a worse privacy concern than in USA?

Yes. In fact, I'd say that's the case even if your only concern is with the US government.

Virtually all of the controversy over US government actions with regard to local data is about violation of expectations (some of which are codified into law) about domestic surveillance by doing things which are uncontroversial in the context of foreign surveillance, and its not like the US lacks capacity or will for foreign surveillance.

That said, Russia doesn't even have the constraints (legal or mere expectations) on domestic surveillance that the US domestic actions raise concern for violating, so if your concern extends beyond US government surveillance, then that compounds the problem when hosting in Russia.

How many reporters and dissidents are murdered in the US versus Russia? Russia is way worse in civil rights and surveillance. Doesnt excuse America for the schemes they pull but it's definitely safer here unless you're in the hood.

Well, it's kind of safe for their citizens too, if they don't get involved in the things that get them killed, as those are not random things. But civil rights aside, online surveillance there is not yet at the level of reading everyone's emails and while they really want to do that they have a hard time implementing something like this for various reasons. It's definitely safer to use those online services, than the ones in your own country or allies.

How do you know that? Russia doesnt publish what Russian intelligence is doing. They also don't have a Snowden who leaked almost all their secrets. That we did is only reason you can make thag comparison. I'd love to see an equivalent dunp for Russia to do the comparison. ;)

It's not like that in Russia, they don't benefit from hiding surveillance, they do it openly. They had SORM for some time now, but only recently, like a month ago, created a law attempting to force local companies to implement backdoors and provide access to and store everything they have on users, etc.

The USA is probably bad, but hides it well. Russia makes no qualms about hiding it.

They moved most of their hosting to Amsterdam (and Stockholm?) 2-3 years ago, I heard. Since then the founder has been forced out by Putin, so I guess it might be back in Moscow now though. (Haven't really had any semi-inside information for the past year.)

now it's split between Russia (for russian audience) and Netherland and Finland (for others). Also this https://sputniknews.com/world/20151024/1029057531/finland-he... may be interesting for you.

My feeling is that data center services are much cheaper and more reliable in Europe, so they have probably moved most things that are not directly frontend-facing to CIS there.

(Everything just works and there are no insane bribes to pay to various mafias.)

Oh no, at least not now. Electricity and land so cheap today in Russia, what Yandex starts to build and sell their datacenter to provide "cheap AWS alternative for Russian companies".

But how about the bribes (to get e.g. electricity)?

http://www.nytimes.com/2009/09/12/business/global/12ikea.htm...

Bribes for infrastructure is not how modern days high level corruption works in Russia. What happens is that for various preferences that a company receives from the state like tax rebates, cheaper electricity etc. one pays back to the official who authorized the deal. The payment (otkat or "rollback" in Russian) is typically indirect, like using a supplier or outsourcing to a company where the official or their relatives have a stake.

The direct bribes is really for low-level clerks like police officers or fire hazard inspector s.

Yandex is a public company with stocks on NASDAQ. Can you ever imagine how it is hard to hide bribes inside of public company budget? :)

Just give someone a big performance bonus with the understanding that part of it is to be used on bribes? Seems rather easy.

Nope, both salaries and bonuses (even on C level) is too low in Russia to hide any amount of bribe in them. Anyway, I never heard about bribes for electricity for last 5 years in Russia.

> salaries and bonuses (even on C level) is too low in Russia to hide any amount of bribe in them

Let's say someone claims that their programmer genius Ivan saved a company ~1m USD/year with latest commit; and awards him $100k. And you see this unusual bonus, how are you going to know 99% of that doesn't go to someone other than Ivan?

Typical Ivan with good developer skills costs $30k/year in Moscow. But you are right, theoretically it is possible to hide some money if you really wants to. As far as I know there's no big non-gov companies who spend something on bribes right now. May be it's because I too believe in humankind.

I think you're an advanced version of a putinbot :).

He's an employee of Yandex, well-known in the Russian dev community.

Well-known? Thanks :)

Not very. International listings don't need to abide by normal US listing regulations for financial reporting.

Two words: "consultancy services"

You can check it on sec.gov. Yandex spend nothing on consultancy for 2014 and 2015 years

I can't be bothered to dig right now, but you're saying that a company with 5000+ employees did not use any consultants at all, zero, for 2014 and 2015? I really can't believe that.

Edit: there are many ways to hide bribes, of course. Typically it involves overpaying for something. It would be hard for even a non-corrupt tax authority to tell the difference between having bad negotiation skills and bribes.

My point is "big non-government companies in Russia doesn't pay any bribes". But you're right, it's definitely possible do hide some amount of bribe money if you really want to.

It was the Vkontakte founder, Pavel Durov, that was forced out. Yandex hasn't had any notable public conflicts with the Putin regime.

Except that it had to sell it's "golden" share to state-owned Sberbank.

Putin himself verbally attacked in 2014 [1]

[1] https://www.bloomberg.com/view/articles/2014-04-25/how-putin...

The founder has been driven out by Putin? Aren't you confusing with Parov, the founder of VK?

Yeah, I probably did mix them up.

I was possibly confused by this article just before posting that comment:

http://calvertjournal.com/news/show/3035/founder-of-yandex-r...

(It's hit #4 in Google for his name.)

> Parov, the founder of VK

It's Pavel Durov. https://twitter.com/durov