5 ms·

This stood out, negatively: Since Cassandra uses Apache Thrift as the default RPC mechanism, exposing the Thrift layer to any non-controlled data can be danger

by mahmud 17y ago

This stood out, negatively: Since Cassandra uses Apache Thrift as the default RPC mechanism, exposing the Thrift layer to any non-controlled data can be dangerous. We use firewalls on our nodes to make sure our Thrift ports are only exposed to a very small set of machines, because even just telneting into the port and typing "hello" can cause the JVM to OOM. -- I use Redis and heavily guard its telnetable port, but it doesn't OOM. This issue should have been fixed before public release, imo. You wouldn't want something as simple and common as a port scan to shutdown your data layer.

pquerna 17y ago
This is an issue specifically with Thrift -- not with Cassandra. You can see the opinion of the Cassandra developers, which is pretty negative towards thrift, in the linked ticket: https://issues.apache.org/jira/browse/THRIFT-601 https://issues.apache.org/jira/browse/THRIFT-601 This is one of the many reasons the Cassandra developers are looking at replacing Thrift with Avro: http://hadoop.apache.org/avro/ http://hadoop.apache.org/avro/
- rmanocha 17y ago
  Can someone explain why Protocol Buffers (http://code.google.com/apis/protocolbuffers/ http://code.google.com/apis/protocolbuffers/) is not being used more widely?? It it 'cause of the limited language support (Java/C++/Python only) or some other reason??
  - wooster 17y ago
    Myself, I've stopped using protobuf because it's super slow in Python.
  - ddispaltro 17y ago
    It definitely has much better documentation.
  - evgen 17y ago
    Protocol Buffers has limited language support, the implementation in one popular language (Python) blows goats, and even though it predates Thrift it was not released until after Thrift arrived so its community is smaller. The number of people who need this sort of product is relatively limited, so the early traction that Thrift has gained will take a bit of time or some compelling reasons to overcome.
  - jhammerb 17y ago
    Google also kept the RPC side of Protocol Buffers, which is called Stubby, as an internal project.

by mahmud 17y ago

pquerna 17y ago

This is an issue specifically with Thrift -- not with Cassandra. You can see the opinion of the Cassandra developers, which is pretty negative towards thrift, in the linked ticket: https://issues.apache.org/jira/browse/THRIFT-601 https://issues.apache.org/jira/browse/THRIFT-601 This is one of the many reasons the Cassandra developers are looking at replacing Thrift with Avro: http://hadoop.apache.org/avro/ http://hadoop.apache.org/avro/

rmanocha 17y ago
Can someone explain why Protocol Buffers (http://code.google.com/apis/protocolbuffers/ http://code.google.com/apis/protocolbuffers/) is not being used more widely?? It it 'cause of the limited language support (Java/C++/Python only) or some other reason??
- wooster 17y ago
  Myself, I've stopped using protobuf because it's super slow in Python.
- ddispaltro 17y ago
  It definitely has much better documentation.
- evgen 17y ago
  Protocol Buffers has limited language support, the implementation in one popular language (Python) blows goats, and even though it predates Thrift it was not released until after Thrift arrived so its community is smaller. The number of people who need this sort of product is relatively limited, so the early traction that Thrift has gained will take a bit of time or some compelling reasons to overcome.
- jhammerb 17y ago
  Google also kept the RPC side of Protocol Buffers, which is called Stubby, as an internal project.