On Friday last week, after the intensive days of the conference, Ars Technica wrote and published a nice article about MariaDB including many of the messages we had been delivering during the conference, http://arstechnica.com/business/news/2012/04/mysql-founders-latest-mariadb-release-takes-enterprise-features-open-source.ars.

MariaDB seals
MariaDB seals

Last year, when it became clear that O’Reilly wasn’t going to arrange the MySQL user conference in the future, there was a lot of discussion on who should arrange it. In the end Percona was pretty fast informing everyone that they had booked the convention center in Santa Clara to arrange the conference this year. Now with the results to hand it’s easy to say that the conference was very well arranged. Great work Percona!

The MariaDB booth was located in the .Org section of the expo hall and we experienced a huge crowd, especially on the first day (Wednesday) of the conference. Our t-shirts were really popular and we could probably have handed out even double the amount of what we had with us. Unfortunately for those in attendance, we had to put some aside for our next upcoming event in Bellingham, WA, USA 28-29th of April. It’s the LinuxFest Northwest 2012, http://linuxfestnorthwest.org. We hope to see some of you there!

We released MariaDB 5.5.23 GA on Tuesday of the conference. Apparently people just loved this news and we’ve enjoyed double our usual download rates since then.

On the SkySQL MariaDB Solutions Day on Friday the 13th, the MySQL founders Monty and David started the day with a panel and the day continued with sessions on all kinds of MariaDB and MySQL related topics. Make sure you read SkySQL’s summary, http://www.skysql.com/blogs/jenwilbur/seal-you-next-year-successful-mysql-friday-13th-santa-clara.
SkySQL has also posted pictures of the event on https://www.facebook.com/skysql.

Happy panelist Monty
Happy panelist Monty

During the conference we had many interesting conversations with people and businesses that we haven’t had a chance to meet before who had migrated to MariaDB. I’m certain there will be even more of these discussions this year and next.

To stay up to date with MariaDB, add yourself to the MariaDB announce list, which informs mainly about new releases. Also add yourself to the MariaDB Facebook page to get even more MariaDB news. Sign up at http://mariadb.org.

The MySQL community has something new on their radar. First up, it looks like MySQL is now part of Oracle Software Security Assurance, and this is something all MySQL users should be happy about. Next, it is worth noting that MySQL is now part of the Oracle Critical Patch Update (Oracle CPU), as the MySQL product line has made it into its first Oracle CPU advisory for January 2012.

As part of the MySQL community, CPU’s are new to us — they are released on the Tuesday closest to the 17th day of January, April, July and October. This kind of reminds us of Patch Tuesday, but let’s not digress.

This is the first time MySQL is part of the Critical Patch Update, and the advisory suggests that there are 27 new security fixes for Oracle MySQL, with one of the vulnerabilities having the possibility of remote exploitation without authentication. As developers of a MySQL branch we are naturally concerned towards the nature of these CPU’s.

For starters, it’s good to note that MariaDB is always based from a branch of MySQL (MySQL 5.1 for MariaDB 5.1, 5.2 & 5.3, and MySQL 5.5 for MariaDB 5.5). So whenever there are security fixes which Oracle makes into MySQL 5.1 or MySQL 5.5, we inherit them. This is one of the benefits of being a branch as opposed to being a fork.

“Oracle advisories include all issues that appeared since the last advisory. But this is the first advisory for MySQL. So either Oracle found 27 new problems since October 2011 or this includes everything that’s been outstanding,” said Sergei Golubchik, VP of Architecture for MariaDB and former MySQL security contact when I asked him about the 27 security fixes.

Upon looking up all the CVE numbers, the reports were vague, like “Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote attackers to affect availability via unknown vectors.” Additionally, the reports do not reference bug numbers, so from a bit of guesswork, we might assume that this commit is possibly the fix for the most serious vulnerability — the one that can be remotely exploited without authentication. That bug, incidentally, was fixed in May 2011, and has long been present in both MySQL and MariaDB (though our implementation varies from upstream).

We notice most CVEs being reported in January 2012, but have no idea when they were reported to the Oracle bug database (or to bugs.mysql.com), or when they were fixed. We believe that this is perhaps Oracle including MySQL into their Software Security Assurance program, which is what triggered all security bugs to be reported on cve.mitre.org, all on the same day.

Whether these 27 fixes are new or existing ones now being bundled up and reported in a Critical Patch Update remains open until more accurate information on what bugs they address is provided. We’re actively working on finding out the answer.

Parts of the world are already celebrating Christmas Eve and it’s time to relax and spend time with family and friends. Even if you don’t celebrate Christmas this is when there is time for less work. Here are a few words to round off MariaDB’s current state and where it’s heading.

This year culminated in MariaDB 5.3.3, the release candidate of 5.3. This is a significant release that makes years of work available by default in the database server. Earlier releases still required features to be explicitly switched on, but thanks to thorough testing assuring the quality of the new functionality we have now enabled them. It’s still called a release candidate which means it’s ready for general usage, but we want more user feedback before calling it stable. Make yourself familiar with the MariaDB 5.3.3 release notes.

Most of the new features and functionality of 5.3.3 are performance related making it possible to suddenly e.g. make use of subqueries, which previously has been a rare sight in MySQL® based applications due to the limitations that has existed. This is now addressed in MariaDB and we encourage you to start using subqueries. You will actually get a result to your query in a reasonable time.

Another nice addition in 5.3.3 is the new GIS (Geographic Information System) functionality. MariaDB introduces spatial functionality in accordance with the OpenGIS specification. If you have the need for GIS functionality in your application try MariaDB.

We had some challenges with the packaging of the authentication plugins and our release schedule was affected. Watch out for MariaDB 5.2.11 and MariaDB 5.5 in early 2012.

During 2011 we saw a huge increase in MariaDB popularity. We saw MariaDB being selected as the database for really critical systems (stay tuned for case studies of some of these systems). We saw some of the biggest IT companies making initial bets on MariaDB. A better basis for MariaDB’s 2012 couldn’t exist!

Thank You and Happy Holidays!