Pete Finnigan's Oracle Security Weblog

My day job is Oracle security and that covers a massive area of topics from performing security audits, helping customers secure data in their Oracle databases, forensics, building and designing audit trails and reports, secure coding in PL/SQL, encryption of data from TDE to custom native encryption in PL/SQL or using any manor of Oracle cost options such as Database Vault, Virtual Private database and even third party tools.

I love to code and I code in PL/SQL, C, C++, Lua and .net including VB and c++/cli as well as even developing in vba in Excel.

So, AI? - I still use documentation and search engines to find out a setting or command that I cannot remember when developing for Oracle or configuring and setting up something such as Database vault or audit trails but over the last few months I have been also testing and playing with AI; Chatgpt or google Gemini or Microsoft co-pilot. I want to understand what the AI says compared to what I find out myself on Google.

Standard models are good but for specific subjects such as Oracle they often come up with the wrong answers. I can think of some simple examples I have tried for fun. I asked one of the free AIs how to truncate the unified audit trail in Oracle and it said truncate table unified_audit_trail. hmmm. The AI says it with confidence. Instead of saying; i am not sure or I do not know it tells me to truncate the table. I asked another question on changing a database password to the previous one and it showed me using ALTER USER IDENTIFIED BY VALUES but it did not tell how to get the old password first and also used the very old syntax before spare4 was used. I asked it for fun (because I know already) how to connect with a proxy. It just made up the syntax which was wrong. I also asked is Database Vault available with 21c XE and it said no. I knew it was as I had the license pdf open. I corrected the AI and it said - You are right - Oracle Database Vault is included in Oracle 21c XE. My earlier statement was incorrect. I have many many more examples of incorrect answers gathered over a while.

if you know what you are looking for and know what roughly the answer should be then the AI is good because you can recognise if the answer is probably right or not; is it better than the docs or Google; difficult to say; probably not. I know there are better models that you have to pay for but I am from Yorkshire and we are as they say tight. I also know you can augment the AI in three ways to make it better. You can create a well crafted system prompt and add input data via RAG and also use skills.md files to target the right answers.

My fear is the inexperienced person completely relying on the free chat interfaces and then implementing what it tells them in real systems.

We can use AI such as chatgpt as a web based chat window but of course the power of AI is to be able to use things like agents and automate what you want to do; so instead of getting a sample command in a chat window and the using it yourself you can set up AI to run the command on your real systems.

If you do not really know what you are doing in the first place then you should be wary of AI and not simply use the answers.

There has been a lot of noise and chatter about AI for a long time now with some suggesting the industry is a bubble bigger than the dot com bubble and some talking about the huge costs of teaching models that looks unlikely to be recovered by paying customers. There is also the increases in price and shortages of the GPU hardware and the huge energy costs of the data centers.

In the last few days there have been some prominent news articles discussing AI sovereignty and focusing on building AI internally to retain all of the data / prompts passed to the AI. This is exactly paralleled with my Oracle security day job - protecting the your data. As I said in Oracle security in my trainings and here; it is not the job of Oracle to protect your data; it is your job to project your data using the standard features of the Oracle database and even cost options from Oracle or third party solutions. The same applies in AI. If you want to use AI you must protect your data that is fed into the AI .

Is a free on line tool better than a home run LLM (Large Language Model)? this depends on a lot of things; the hardware that you use, the sources of data that you can add to it via RAG or the context window and of course the model you download and use.

My experience so far with the free tools is that you get blocked quickly particularly if you upload files. Load 2 and you are fine, load three and it says come back tomorrow in 24/25 hours and try again.

I have been playing with a local LLM recently as well to test how good it is. I am feeding it skills files and sources via RAG and testing is in early stages but looks great so far. I m using a Mac Book Pro M5 with 64gb of RAM and a 2 TB SSD. There are so many models to use so I will be trying quite a few. I have tested qwen2.5 coder so far. My experience of setting up the local LLM was great, downloading the models takes the biggest time but setting up to run with a chat interface was simple.

More on this soon as I will report back here on my experience with a local LLM. Having a local LLM that does not have limits and is almost as fast as chatgpt and the answers are at a similar level so far is good.

#oracleace #sym_42 #ai #llm #localllm #oracle #security