Great point about the security and vendors. I have a vendor question checklist I typically go through. Ask questions about the database I will someday have to live with. Because you know when you call support with most ISVs the answer is “Oh that’s a database issue, talk to your database staff” to which I reply, “I am the database staff, and let me show you the result of my analysis on your queries and indexing strategy…”

Anyway I posted my questions on my blog (http://www.straightpathsql.com/blog/2009/1/27/new-vendor-interview-with-an-annoying-dba.html) and told the story of one vendor…

They were a building security badge vendor (pretty large one at that) and when I asked my security/access methodology question the answer back was (We normally go on our own sql server and use SA with a blank password)… They were serious too. I told them this wouldn’t happen here, I want least privilege and asked them to figure out the exact perms needed. I think we ended up being forced to compromise on DBO for their database but no SA…