> What I had missed is that we deployed a new internal service last week that sent less than three GetPostRecord requests per second, but it did sometimes send batches of 15-20 thousand URIs at a time. Typically, we'd probably be doing between 1-50 post lookups per request.
That’ll do it.
98codes 1 days ago [-]
Ahh, the three relevant numbers in development: 0, 1, and infinity.
jandrese 1 days ago [-]
The incredible part about this is because their backend is all TCP/IP they were literally exhausting the ports by leaving all 65k of them in TIME_WAIT, and the workaround was to start randomizing the localhost address to give them another trillion ports or so.
kyledrake 22 hours ago [-]
This is a pretty interesting solution. I could see how this could useful for certain kinds of problems (as part of a ddos attack mitigation for example).
The simple answer is that atproto works like the web & search engines, where the apps aggregate from the distributed accounts. So the proper analogy here would be like yahoo going down in 1999.
tapoxi 1 days ago [-]
This is a fantastic write-up, thanks for sharing!
fiatjaf 23 hours ago [-]
Sorry, but this analogy is very misleading, no one browses websites through Google's servers.
For example, right now in my URL bar I read "news.ycombinator.com", not "google.com/profile/news.ycombinator.com".
If Google goes down now I can keep browsing this website and all the other websites I have in all my other tabs as if nothing had happened.
danabramov 22 hours ago [-]
Does Google Reader help you make sense of it? It’s more like each app is like its own Google Reader. And indeed you were able to access the same posts via other apps at that time of outage.
_heimdall 18 hours ago [-]
> no one browses websites through Google's servers.
Didn't Google's AMP project do exactly that?
pfraze 22 hours ago [-]
Technically you can still view the posts directly from the PDS. It’s just uninteresting compared to web pages
evbogue 22 hours ago [-]
Do you have ideas about how Bluesky could decentralize?
wmf 22 hours ago [-]
Not the original poster but I do have some ideas. Official Bluesky clients could randomly/round-robin access 3-4 different appview servers run by different organizations instead of one centralized server. Likewise there could be 3-4 relays instead of one. Upgrades could roll across the servers so they don't all get hit by bugs immediately.
evbogue 22 hours ago [-]
If multiple personal data servers (pdses) share the same set of posts how would we guarantee that they are tamper resistant to third parties?
wmf 22 hours ago [-]
PDSes should be sharded not replicated. Your posts live on your PDS which lives in one place (although it can move).
evbogue 22 hours ago [-]
What's stopping us from doing both?
wmf 22 hours ago [-]
Cost and complexity tradeoffs. IMO the relay/appview is the current bottleneck.
evbogue 21 hours ago [-]
This is why I'm hoping fiatjaf has a recommendation here. I have a feeling he might have a proposal that solves this. But doesn't solve all of it, just some of it.
isodev 1 days ago [-]
Google and MSN Search were already available at this time. Also websites used to publish webrings and there was IRC and forums to ask people about things.
isodev 1 days ago [-]
It’s more of a concept of a plan for being distributed. I even went through the trouble of hosting my own PDC and still, I was unable to use the service during the outage
Retr0id 1 days ago [-]
Mastodon infra can have outages, too.
tapoxi 1 days ago [-]
It's just confined to one instance if it goes down, not all of Mastodon.
direwolf20 1 days ago [-]
It's not really distributed. It's a centralised service that pulls some parts of 0.01% of user profiles from their own servers.
chr15m 15 hours ago [-]
"decentralized"
LoganDark 1 days ago [-]
A web interface and home server can have an outage. Bluesky is just a web interface and home server.
mwkaufma 1 days ago [-]
Tell us more about this buggy "new internal service" that's scraping batch data :P
goekjclo 1 days ago [-]
> The timing of these log spikes lined up with drops in user-facing traffic, which makes sense. Our data plane heavily uses memcached to keep load off our main Scylla database, and if we're exhausting ports, that's a huge problem.
I expect this is common.
jonstaab 1 days ago [-]
nostr never goes down
jandrese 1 days ago [-]
If nostr went down would people even notice?
yangm97 1 hours ago [-]
The good thing about nostr is that, contrary to popular federated protocols, your identity is not tied to any single server, you own the keypair to your account, so you can continue using it just fine even if some relays experience a downtime.
nout 1 days ago [-]
If any major nostr relay goes down, no one notices. That has happened many times, the network is very resilient to that.
jonstaab 1 days ago [-]
probably not
pfraze 1 days ago [-]
All support to other decentralizers but nothing never goes down.
nout 1 days ago [-]
The comparison here is to something like TCP/IP. TCP/IP never goes down. TCP/IP is a protocol, the servers may go down and cause disruption, but the protocol doesn't really have the ability to "go down".
Nostr is also a protocol. The communication on top of Nostr is pretty resilient compared to other solutions though, so that's the main highlight here.
If tens of servers go down, then some people may start noticing a bit of inconvenience. If hundreds of servers go down, then some people may need to coordinate out of bound on what relays to use, but it still generally speaking works ok.
arter45 9 hours ago [-]
That's because TCP/IP is a protocol, not a (centralized or decentralized) server. A protocol cannot go down. It can trigger failures, it can be abused, but it cannot go down.
It's like saying "English never burns". Sure, you can't burn English but you can burn specific books, newspapers and so on.
jonstaab 1 days ago [-]
1000x redundancy makes it vanishingly unlikely. Although I know we're due for a pole shift so all bets are off I suppose.
numpad0 1 days ago [-]
Wasn't aware there are ~2k relays now. Have inter-relay sharing situation improved?
When I tried it long time ago, the idea was just a transposed Mastodon model that the client would just multi-post to dozen different servers(relays) automatically to be hopeful that the post would be available in at least one shared relays between the user and their followers. That didn't seem to scale well.
jonstaab 24 hours ago [-]
Getting clients to do the right thing is like herding cats, but there has been some progress. Early 2023 Mike Dilger came up with the "gossip model" (renamed "outbox model" for obvious reasons). Here's my write-up: https://habla.news/hodlbod/8YjqXm4SKY-TauwjOfLXS
The basic idea is that for microblogging use cases users advertise which relays their content is stored on, which clients follow (this implies that there are less-decentralized indexes that hold these pointers, but it does help distribute content to aligned relays instead of blast content everywhere).
Also, relays aside, one key difference vs ActivityPub is that no third party owns your identity, which means you can move from one relay to another freely, which is not true on Mastodon.
chr15m 15 hours ago [-]
A difference with Mastodon is your account is independent of any relay.
> scale well
It is up and it is growing.
bit1993 20 hours ago [-]
Bitcoin, BitTorrent never go down.
emidoots 22 hours ago [-]
There's stark contrast for an average human visiting the landing page of bsky.app vs nostr.org
jonstaab 9 hours ago [-]
That's what decentralization looks like. You might also try:
Good to know the discussion about decentralization and federation had finally ended
pembrook 1 days ago [-]
Distributed social media goes down? hrmmm.
Email and the internet don't have "downtime." Certain key infra providers do of course. ISPs can go down. DNS providers can go down. But the internet and email itself can't go down absent a global electricity outage.
You haven't built a decentralized network until you reach that standard imo. Otherwise its just "distributed protocol" cosplay. Nice costume. Kind of like how everybody has been amnesia'd into thinking Obsidian is open source when it really isn't.
iAMkenough 1 days ago [-]
Bluesky is a provider. Blacksky didn’t go down.
pembrook 1 days ago [-]
Is there anything running on Blacksky other than Bluesky with more than say, 100 active users?
AOL never even got to that level of dominance in the internet 1.0 era.
The point is it's not a distributed network if one node is 99.9% of all traffic.
mwagstaff 21 hours ago [-]
With my SRE hat on, dare I ask... could/should this have been picked up in testing?
And then normally there's a nice discussion about how production is very different to the test environment.
gsibble 1 days ago [-]
Did all 3 users notice?
dogemaster2027 1 days ago [-]
[dead]
ffsm8 1 days ago [-]
Naw, only one did. Turns out the other two were his socket accounts he used to upvote and comment on his own content.
Okay, nuff trolling for today
dogemaster2027 1 days ago [-]
[dead]
templar_snow 1 days ago [-]
[flagged]
lavela 1 days ago [-]
Why?
rvz 1 days ago [-]
Thank you for the post mortem on this outage.
electrondood 1 days ago [-]
Great write up... curious about the RCA. Thanks!
streetfighter64 23 hours ago [-]
> They represent real user-facing downtime
Off-topic, but "real" feels like the new "delve". Is there such a thing as "fake" or "virtual" downtime, or why do people feel the need to specify that all manner of things are "real" nowadays?
jmclnx 1 days ago [-]
Lite Blue on a dark Blue background. That is a new one, I have seen grey text on lite grey, but blue on blue ?
The article does work in lynx, at least I can read it.
drewg123 1 days ago [-]
Golang's use of a potentially unbounded number of threads is just insane. I used to be fairly bullish on golang, but this, combined with the fact that its garbage collected, makes me feel its just unsuitable for production use.
floating-io 1 days ago [-]
You can have this problem with any kind of thread -- including OS threads -- if you do an unbounded spawn loop. Go is hardly unique in this.
Goroutines are actually better AFAIK because they distribute work on a thread pool that can be much smaller than the number of active goroutines.
If my quick skim created a correct understanding, then the problem here looks more like architecture. Put simply: does the memcached client really require a new TCP connection for every lookup? I would think you would pool those connections just like you would a typical database and keep them around for approximately forever. Then they wouldn't have spammed memcache with so many connections in the first place...
(edit: ah, it looks like they do use a pool, but perhaps the pool does not have a bounded upper size, which is its own kind of fail.)
slopinthebag 24 hours ago [-]
Rust's async doesn't have this issue. Or at least, it's the same issue as malloc in an unbounded loop, but that's a more general issue not related to async or threading.
15-20 thousand futures would be trivial. 15-20 thousand goroutines, definitely not.
floating-io 23 hours ago [-]
I don't know enough about rust to confirm or deny that -- but unless rust somehow puts a limit on in-flight async operations, I don't see how it would help.
The problem is not resource usage in go. The problem is that they created umpteen thousand TCP connections, which is going to kill things regardless of the language.
verdverm 21 hours ago [-]
case in point, an old HN post about scaling Go to 1M websocket connections
Go can scale but only if you sidestep goroutines and use something like https://github.com/lesismal/nbio (which is awesome, highly endorse)
22 hours ago [-]
tombert 1 days ago [-]
Why does garbage collection make it unsuitable for production use? A lot of production software is written in garbage collected languages like Java. Pretty much the entire backend for iTunes/Apple Music is written in Java, and it's not doing any kind of fancy bump allocator tricks to avoid garbage. In my mind, kind of hard to argue that Apple Music is not "production use".
There are certainly plenty of projects where garbage collection is too slow, but I don't know that they're the majority, and more people would likely prefer memory safety by default.
madeofpalk 22 hours ago [-]
Based on my experience of Apple Music being pretty bad at streaming music, i would say that it's not ready for 'production use'.
tombert 19 hours ago [-]
Ok, judging by this job posting [1] it looks like Spotify uses Java as well.
That’ll do it.
https://news.ycombinator.com/item?id=21865715
The simple answer is that atproto works like the web & search engines, where the apps aggregate from the distributed accounts. So the proper analogy here would be like yahoo going down in 1999.
For example, right now in my URL bar I read "news.ycombinator.com", not "google.com/profile/news.ycombinator.com".
If Google goes down now I can keep browsing this website and all the other websites I have in all my other tabs as if nothing had happened.
Didn't Google's AMP project do exactly that?
I expect this is common.
If tens of servers go down, then some people may start noticing a bit of inconvenience. If hundreds of servers go down, then some people may need to coordinate out of bound on what relays to use, but it still generally speaking works ok.
It's like saying "English never burns". Sure, you can't burn English but you can burn specific books, newspapers and so on.
When I tried it long time ago, the idea was just a transposed Mastodon model that the client would just multi-post to dozen different servers(relays) automatically to be hopeful that the post would be available in at least one shared relays between the user and their followers. That didn't seem to scale well.
The basic idea is that for microblogging use cases users advertise which relays their content is stored on, which clients follow (this implies that there are less-decentralized indexes that hold these pointers, but it does help distribute content to aligned relays instead of blast content everywhere).
Also, relays aside, one key difference vs ActivityPub is that no third party owns your identity, which means you can move from one relay to another freely, which is not true on Mastodon.
> scale well
It is up and it is growing.
nostr.com nostr.how nostr.net nostrich.love nostrhub.io usenostr.org And of course https://github.com/nostr-protocol/nostr
Email and the internet don't have "downtime." Certain key infra providers do of course. ISPs can go down. DNS providers can go down. But the internet and email itself can't go down absent a global electricity outage.
You haven't built a decentralized network until you reach that standard imo. Otherwise its just "distributed protocol" cosplay. Nice costume. Kind of like how everybody has been amnesia'd into thinking Obsidian is open source when it really isn't.
AOL never even got to that level of dominance in the internet 1.0 era.
The point is it's not a distributed network if one node is 99.9% of all traffic.
And then normally there's a nice discussion about how production is very different to the test environment.
Okay, nuff trolling for today
Off-topic, but "real" feels like the new "delve". Is there such a thing as "fake" or "virtual" downtime, or why do people feel the need to specify that all manner of things are "real" nowadays?
The article does work in lynx, at least I can read it.
Goroutines are actually better AFAIK because they distribute work on a thread pool that can be much smaller than the number of active goroutines.
If my quick skim created a correct understanding, then the problem here looks more like architecture. Put simply: does the memcached client really require a new TCP connection for every lookup? I would think you would pool those connections just like you would a typical database and keep them around for approximately forever. Then they wouldn't have spammed memcache with so many connections in the first place...
(edit: ah, it looks like they do use a pool, but perhaps the pool does not have a bounded upper size, which is its own kind of fail.)
15-20 thousand futures would be trivial. 15-20 thousand goroutines, definitely not.
The problem is not resource usage in go. The problem is that they created umpteen thousand TCP connections, which is going to kill things regardless of the language.
https://news.ycombinator.com/item?id=21865715
There are certainly plenty of projects where garbage collection is too slow, but I don't know that they're the majority, and more people would likely prefer memory safety by default.
[1] https://www.lifeatspotify.com/jobs/senior-backend-engineer-a...