7 ms·
Got Users? How About 100M of Them?
- robotdan 10y agoMo users, mo problems.
- kstra 10y agoTruth.
- anorwell 10y ago400 requests per second.
- hack_edu 10y agoNot a good reflection on your actual ability to scale when a 500 word blog post makes your entire web server choke after just a few minutes on the front page.
- brokenwren 10y agoThat's what happens when 10,000 people hit your website all at once. :) I think it's probably Wordpress that is sucking here though.
- hack_edu 10y agoThat makes it better? This is a marketing post and should reflect your company's strengths, especially when the topic of the post is about said quality.
- nickpsecurity 10y agoI always remember in moments like these that Cloudfare is something like $50-200 a month. Wait, a quick look is $0/$20/$200 with $0 or $20 probably covering it. Hmmm.
- ddorian43 10y agoCloudflare doesn't cache your sql queries.
- morgante 10y agoIt's a static webpage. You shouldn't need to re-run SQL queries for each user. Pages like this is literally what CDNs are great for.
- nickpsecurity 10y agoThat's what I was thinking. Only need to do SQL on actual registration process. That's if you use a SQL DB for it as opposed to in-memory, key-value store that persistently writes to disk. Alternatively, doing data at app layer (eg AllegroCache-style) with a partitioning scheme distributing among a number of inexpensive nodes. Quite a few things to do before we run into SQL's problems even if it involves data processing.
- CiPHPerCoder 10y agoI'm building a CMS in the same vein as the others (WordPress, etc.) and made static page caching a first-class feature that bypasses the autoloader completely. https://github.com/paragonie/airship/blob/e24ea5a4605336b17190cefc300660b13c2a9535/src/public/index.php#L30-L55 https://github.com/paragonie/airship/blob/e24ea5a4605336b171... This is something that really ought to be baked-in in 2016.
- nickpsecurity 10y agoCool stuff. Also libsodium by default as I expected. :) You got a summary page listing the features and advantages of the CMS for those that don't do PHP? Other than probably extra attention to quality/security. As usual, I'll pass the info along to people online that might benefit from it.
- 10y ago
- brokenwren 10y agoTrue, but the post is about scaling Passport, not really scaling Wordpress. I haven't seen the site crash, so I seems like its just taking the server a while to server up the static content.
- melvinmt 10y agoYour dismissive tone is concerning. Because your Wordpress site doesn't load, we can't learn about your "Passport" service, so you're wasting 10,000 prospective customers.
- takno 10y agoWordpress only sucks if you don't configure it for the expected traffic. At scalability anyway.
- brianwawok 10y agoWhich sadly is out of the box. Not that hard to scale static blog post wordpresses.. but man the default is like 4 requests per second bad ;)
- brokenwren 10y agoOuch. Looks like we need to do some serious blog tuning. :)
- autotune 10y agoImplementing something as simple as W3TotalCache and CloudFlare, and eliminating slow plugins via p3profiler, should mitigate any initial scaling issues assuming your server architecture is set to scale properly via dynamic scaling or horizontal if for some reason you're using on-prem, physical hardware.
- morgante 10y agoPlenty of sites with bigger traffic spikes than this run on WordPress. It shows that they haven't put any effort into scalability.
- CiPHPerCoder 10y agoI've had a blog post sit at the #1 spot on HN for nearly 24 hours and my server never even sweated. I have a cheap VPS and didn't do anything fancy with caching. I just don't code like a n00b. Also, either use SuperCache or ditch WordPress entirely.
- nickpsecurity 10y agoMore realistic worst case scenario is a huge chunk of those 18 year olds trying to get an account after school. You'd need a tad more than 400 requests a second to handle it. Even one percent of one percent of them doing it is 7,300 users at once. Maybe request buffering and storage could help while the main node just does its measily 400 a second. Then again, 400 a second doesn't sound that fast given what HSM's and databases do. Maybe this software is just doing something complicated with each request.
- brokenwren 10y agoThis is 400 _registrations_ per second not logins. On the test hardware, Passport can handle 1,000 logins per second. Remember that the server this test was run on is 10 years old and has crap hardware. Running these tests on a modern box with new Xeon CPUs and a 2400MHz bus would probably double or triple those numbers.
- nickpsecurity 10y agoAh, yeah I test on old hardware for efficiency too. One thing Im trying to assess is how registration might be accelerated. What operations are involved in a registration request that arent a trade secret or something?
- brokenwren 10y agoDuring registration, you need to handle things like assigning roles to the user for your application, verifying the users email, setting up two-factor authentication (if they want) and storing metrics. The metrics are helpful for tracking registrations and correlating them to things like marketing campaigns.
- nickpsecurity 10y agoOk, so it's not sounding so bad at this point. Plenty of acceleration opportunities for such things.
- 10y ago
- johnloeber 10y ago> Did you know that each time you log into Facebook, check your email or fire up Candy Crush, a software engineer has thought about user registration and authentication. It's a bad sign when the very first sentence of your promotional blogpost has no coherent meaning in the English language. > I am quite sure that if your application actually grew that quickly the rest of your infrastructure would fail spectacularly. But rest assured, Passport will be just fine. Another thing about writing promotional blogposts: don't belittle your potential clients.
- brianwawok 10y agoI am trying to figure out the use case of login as a service. There obviously is one, but I am having trouble thinking of it. Clearly login means something different to each app, right?
- brokenwren 10y agoThe registration and login parts are usually the simple features to implement. Its the localization, emailing, password encryption, disciplining, rewards, two-factor authentication, OAuth, login reporting, registration reporting, daily active users reports, and monthly active users reports that are the more challenging features to build yourself. Almost every application needs all of these features, but very few have them because they take so long to code.
- brianwawok 10y agoSo encryption, emailing, oauth... DJango or another modern framework does all of that out of the box or with a plugin. Login reporting is cool... But if you build your own you can get full app reporting. Not sure of the exact value add but I would way rather have reporting on all pages not just login. Localization? The hard part is translating my entire app. Not sure if I do that work, I'm going to be mad I have to translate the word login and logout
- robotdan 10y ago
- nxzero 10y agoSeriously thought this was going to be about getting a 100M users, not load balancing for them.
- brokenwren 10y agoHaha. I wish! That would be awesome, but getting to 100M users is probably 10% planning/process and 90% luck.
- nxzero 10y agoIf you define luck as knowing how to do it, sure; otherwise, no, it's not luck, but not easy.
- Willson50 10y agoGoogle Cache: https://webcache.googleusercontent.com/search?q=cache:aGmxOPfJqhQJ:https://www.inversoft.com/blog/2016/04/19/got-users-100-million/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:aGmxOP...
- vonklaus 10y agoLook, I get it, there aren't a lot of female engineers and saying things like "you guys" is probably annoying to the few there are. That said, inserting "she" everywhere just feels disengenuous, and I notice it everywhere from technical blogs to a16z write ups. Sure your company is 30% female in all positions (amazing for the industry in this hypothetical) and you're top tech team is all over it. You're core engineer, she's digging through mounds of code with only her team of 2, an african american native inuit, top of her year at stanford, and a trans person. I would love to see the industry be attractive to all types. However, you can't just swap pronouns because it sounds so fake amd disingenuous. Probabalistically speaking, your engineering team is not 100% women or even close. idk, maybe blasphemous or inflammatory, just strikes me as a feeble attempt to notmalize something that isnt normal... edit; wow, I apologize I guess? It seems forced to me that the whole industry changed pronouns (if little else) over night. So I guess I am a misoginist for actually thinking more equitable demographics would be better than some language nuance, which just feels forced edit2: i deleted some comments that basically said the above, but slightly more rudely. apologies.
- morgante 10y agoWhat exactly is "not normal" about female engineers? Occasionally using "she" to refer to an unknown person is a welcome relief from the abundant writing which solely uses the male pronoun. When documentation uses "he" it doesn't mean engineering teams are 100% male and using "she" doesn't mean the inverse.
- vonklaus 10y agoIt isn't normal unfortunately. It's why there is a push for women in tech. There isn't a top company that is 50/50(i don't believe this has to be the case accross the board) but using it just feels disingenuous. Idk, i'm not a femal engineer. Maybe passport was predominently written by female engineers. If I was a minority in some arena,I suspect I would be slightly off put if they just pretended I wasn't
- morgante 10y ago
- voidmain1 10y agoIf I can save time and not have to figure out security, reporting and everything else, I'm on board!
- robotdan 10y agoAgreed, but if I'm a dev - I prefer something free to start with, generally I'm not going to spend a lot of money when there are free alternatives. I like how Atlassian does it - they more or less give it away for free for small companies and then once you can afford it they start charging more. Unless I can get going for free, probably a non starter.
- brokenwren 10y agoPassport is free for up to 50 users. This is enough for most developers to get started and into production (depending on the use case). Plus, you don't have to pay more for internal versus external users. Everything is based on the total number of users in the database, so pricing is simple.
- ecospace 10y agoAwesome company and awesome team!