Originally by: TOGAKURE Daisuke

---

Anyway, majority of ccp employees only have tools which they can interact with. Those tools then interact with the database without telling the users the credentials the tool is using. All basic security.

Most likely different tools in ccp employees possessions use different sql userid's and passwords to manipulate the db, so that the 'petition interface tool' cannot affect, in any way, even in the case of programming error, the tables which for example, store the location of stargates (although that might have hilarious effect ;)).

Most likely only the senior database admins have remote console access to db servers and/or have sql userid/passwords to do anything they wish on sql console. But maybe CCP has gone nuts on security and they can't do even that. Only in maintenance break the CTO takes a keyring from the safe which can then be used to generate the one-time pass which give unrestricted access.

Now, bigger enterprise databases are 'transactional' databases. The transaction log keeps record of each and every sql command made in the system. For example, if you loose your actual database now and you have a full backup from last friday, you just need to 'play back' the transaction log and you can get to any point of time. Transaction log is usually on a very high speed filesystem (it fills up pretty fast) and it would show any delete's made in the tables. You also take good care of your transaction log (it's binary, not human readable) since that's most likely your incremental backup since your last full.

Anyway, enough of db babble. Not really in the topic. But if CCP says that normal employees (except database admins and even they would have to sweat a little to cover their tracks) have no way to alter the petition pool so that a petition is really deleted, I believe them. Any half-wit db admin would design the tools in that way.

---