5 ms·

> The deletions were automated, triggered by a script that drops TDE database tables when their corresponding keys can no longer be accessed in the Key Vault, e

> The deletions were automated, triggered by a script that drops TDE database tables when their corresponding keys can no longer be accessed in the Key Vault, explained Microsoft in a letter reportedly sent to customers. By what logic is this NOT a terrible idea?

booi 8y ago
It sounds like they do this for a data security and compliance reasons but it seems like sloppy engineering to not consider unreachability as possible temporary error.
mh8h 8y ago
At least it needs better error handling. A "not found" and "cannot resolve domain name" should behave differently.
- rcostin2k2 8y ago
  Perhaps that was exactly the response they've got in that moment.
LoSboccacc 8y ago
The whole "managed resources have a mandatory public dns and ip" idea is insane Yeah they come with a firewall but still. Imagine competing with everyone else on a single namespace. At least for the s3 bucket is justified because those are meant to be accessible, but the databases?
- derefr 8y ago
  If the "public dns" are arbitrarily-nested subdomains, and the "ips" are IPv6 addresses, I don't see what the problem is. We've got essentially-unbounded amounts of both of those.
  - LoSboccacc 8y ago
    > If the "public dns" are arbitrarily-nested subdomains, not names. those are the limited conflicting resource, and they aren't arbitrarily nested: "The server can contain only lowercase letters, numbers, and the hyphen (-) character" - "The domain name postgres.database.azure.com is appended to the server name you provide." it also means I cannot just create parallel environments on their own subnet with the same scripts, I've to enter and manage configuration points for all the names, either as dns aliases or straight up in the application connection strings, and it also makes unnecessarily harder to just migrate the stuff around as needed to a failover node i.e. rds advantage was zero downtime upgrades too, then and then sent a mail everyone last week with "we going to have 5 minute downtime to upgrade your db, whether it's multi zone with replicas or not"? you can't trust them with that, the cloud is just somebody else computers', you need your own failover on top, and instead of changing one entry in the namespace I've to redeploy all clients, oh joy.
microtherion 8y ago
Well, it's certainly one way to guarantee database consistency after a network partition…
- cal5k 8y ago
  Hey now, we have guaranteed eventual consistency! ...at the heat death of the universe
- tanilama 8y ago
  eventual elimination..
sowbug 8y ago
It's reasonable to delay deleting encrypted data (which can take a long time) and just delete its keys (which is very fast) upon a user request to delete the data. If you believe in encryption, then once you delete the only remaining copies of keys, the encrypted data is as good as deleted. So that's why it's a great idea to implement data deletion as a two-phase sequence of synchronous key deletion, then asynchronous low-priority block scrubbing (or marking free for reclamation). But not handling the case where your system is confused whether the keys are deleted (versus just temporarily unavailable) is less of a great idea.

booi 8y ago

It sounds like they do this for a data security and compliance reasons but it seems like sloppy engineering to not consider unreachability as possible temporary error.

mh8h 8y ago

At least it needs better error handling. A "not found" and "cannot resolve domain name" should behave differently.

rcostin2k2 8y ago
Perhaps that was exactly the response they've got in that moment.

LoSboccacc 8y ago

The whole "managed resources have a mandatory public dns and ip" idea is insane Yeah they come with a firewall but still. Imagine competing with everyone else on a single namespace. At least for the s3 bucket is justified because those are meant to be accessible, but the databases?

derefr 8y ago
If the "public dns" are arbitrarily-nested subdomains, and the "ips" are IPv6 addresses, I don't see what the problem is. We've got essentially-unbounded amounts of both of those.
- LoSboccacc 8y ago
  > If the "public dns" are arbitrarily-nested subdomains, not names. those are the limited conflicting resource, and they aren't arbitrarily nested: "The server can contain only lowercase letters, numbers, and the hyphen (-) character" - "The domain name postgres.database.azure.com is appended to the server name you provide." it also means I cannot just create parallel environments on their own subnet with the same scripts, I've to enter and manage configuration points for all the names, either as dns aliases or straight up in the application connection strings, and it also makes unnecessarily harder to just migrate the stuff around as needed to a failover node i.e. rds advantage was zero downtime upgrades too, then and then sent a mail everyone last week with "we going to have 5 minute downtime to upgrade your db, whether it's multi zone with replicas or not"? you can't trust them with that, the cloud is just somebody else computers', you need your own failover on top, and instead of changing one entry in the namespace I've to redeploy all clients, oh joy.

microtherion 8y ago

Well, it's certainly one way to guarantee database consistency after a network partition…

cal5k 8y ago
Hey now, we have guaranteed eventual consistency! ...at the heat death of the universe
tanilama 8y ago
eventual elimination..

sowbug 8y ago

It's reasonable to delay deleting encrypted data (which can take a long time) and just delete its keys (which is very fast) upon a user request to delete the data. If you believe in encryption, then once you delete the only remaining copies of keys, the encrypted data is as good as deleted. So that's why it's a great idea to implement data deletion as a two-phase sequence of synchronous key deletion, then asynchronous low-priority block scrubbing (or marking free for reclamation). But not handling the case where your system is confused whether the keys are deleted (versus just temporarily unavailable) is less of a great idea.