Still, it’s worth examining our assumptions. For example, for years we were told that enterprises couldn’t replace Oracle Database or SQL Server with PostgreSQL. For many workloads, that’s simply not true today, and it almost certainly wasn’t as “true” in the past as some would have us believe.
Although PostgreSQL has always had a large community, it has also had a chorus of critics. Meanwhile, every major cloud provider has a PostgreSQL database service. Going further, in 2021 AWS launched Babelfish, an open-source project that makes it easier to add PostgreSQL to applications written for SQL Server.
Likewise, there’s a reason every major cloud provider offers MongoDB in one form or another, and the database has been downloaded more times in the last 12 months than in the previous 12 years combined (a total of 265 million downloads to date).
Both PostgreSQL and MongoDB have grown significantly in popularity compared with Oracle and SQL Server. MongoDB now leads the industry in security, with the release of Queryable Encryption.
Atomicity, transactions, and so on.
The company has always been a developer favorite for its ease of use, but around that same time MongoDB announced its acquisition of WiredTiger, paving the way for document-level concurrency control and compression, starting with MongoDB 3.0 (WiredTiger as an option) and progressing with MongoDB 3.2 (WiredTiger by default).
Most of the work to deeply integrate WiredTiger into MongoDB was completed in 2015, setting up a steady drumbeat of database improvements over the next several years. One of my all-time favorites—multi-document ACID transactions—arrived in MongoDB 4.0.
As MongoDB co-founder Eliot Horowitz wryly wrote in 2018, “MongoDB Gives Up ACID,” and the MongoDB world was never the same again. In MongoDB 5.0, the company introduced a versioned API that let developers upgrade the database without having to change their application, time-series functionality, a new serverless offering, dynamic sharding, and much more.
More recently, at MongoDB World, the company announced a number of things to make developers’ lives easier: Atlas Data API, serverless instances, Atlas CLI, and more. For me, the two most interesting announcements were in analytics and security. Oh, and open source.
Analytics in the MongoDB world lets developers build better applications, rather than data analysts running offline analysis. In today’s world, the need for real-time business insights is pushing data analysis and reporting closer to the applications that generate the data.
MongoDB has clearly recognized this growing need and announced several new ways to make it easier to run analytics on operational data, including a new SQL interface, Atlas Analytics nodes, Atlas Data Federation, and Atlas Data Lake.
Still, I’m struck by the fact that the company’s key announcement for applying analytics to real-time data was Columnstore indexing. Since columnar formats are ideal for analytical workloads, this indexing option lets developers easily store documents in the right model for their applications without moving the data, and run efficient analytical queries against that data in real time for their applications.
If all this is a surprise to those who think MongoDB is all about web scale, Queryable Encryption is an even bigger shock.
Raising the stakes on data security
Nothing MongoDB (or any other database company) releases would be very useful if it couldn’t match features and functionality with security. MongoDB has long offered excellent security, but the introduction of structured encryption for field-level encryption takes things to the next level. Most databases have figured out how to protect data at rest or in motion, but not how to protect data in use, when it’s vulnerable to insider access and active database breaches. Enter field-level encryption.
Field-level encryption protects data in the server’s memory and on disk. It’s the highest level of protection against breaches, but there’s a downside: it doesn’t allow rich, expressive queries on encrypted data. Sure, you can do an exact match, but you have to use deterministic encryption.
Researchers have been working on this problem since 2001, but this week MongoDB announced the first commercially available structured encryption model, called Queryable Encryption. With this structured encryption, MongoDB can transform an encrypted field in a cryptographically secure way so it can store anonymous metadata that allows expressive and efficient queries. For example, structured encryption lets a developer build a banking app that can find transactions using a date range or dollar amounts to investigate fraud.
This is best-in-the-industry stuff that doesn’t leave the MongoDB developer community behind. In short, using Queryable Encryption in MongoDB helps developers focus on building compelling, data-driven applications while solving the industry’s toughest data privacy problems. No PhD in cryptography required.
That would be interesting enough on its own, but MongoDB has taken a particularly noteworthy position on Queryable Encryption: it will be 100% open. As Porter said in his talk: “We will publish the code, algorithms, and math behind it because we believe in white-box security, not black-box security.”
This may come as a surprise to those still picking at MongoDB’s license change in 2019. (Developers don’t seem to mind, given their higher priorities.) But it shouldn’t. MongoDB contributes to Apache Lucene, releases WiredTiger under an open-source license, and also offers its Realm mobile database as open source.
It’s easy to paint companies in black and white, but it’s usually wrong, as it is in this case.
To sum up
All of this is a long way of saying that maybe it’s time to hit “refresh” on your views of MongoDB. No, it won’t be the right data platform for all your workloads. Nothing is. But it’s better to make that decision based on today’s reality, not outdated myths.
