4 ms·

I meant single kind of component, not one thing handling everything. If you use juniper routers, for example, a juniper specific software, hardware problem or

I meant single kind of component, not one thing handling everything. If you use juniper routers, for example, a juniper specific software, hardware problem or a mistaken assumption about juniper specifics could take down all routers and an entire network.

close04 8y ago
Usually any kind of such issue wouldn’t take out every component of a type unless user error is involved. Like deploying the wrong policy to all devices. Which again comes back to humans being the weakest link. I can’t really imagine a particular hardware problem that would kill all components at once. This being said I probably didn’t experience all possible problems so far :).
- peterwwillis 8y ago
  Sure, humans are the weakest link, who cares? Regardless of the cause of the failure, catastrophic cascades are more likely if the systems and operations involved are homogeneous. That's why evolution prefers diversity.
  - close04 8y ago
    Natural evolution. Because it follows vastly different rules. I still fail to see any example given for how one “cascade failure” takes down all the routers in an infrastructure like Cloudflare’s. I can think of a dozen ways a non-homogeneous system can fail (like incompatible updates and config, confusions between the types of components, etc.). In the end you usually end up with massive expenditure that introduces just as many problems as it solves. You may be onto something that nobody else spotted but so far the arguments are too generic (“failure”) or incompatible with the premise (rules of natural evolution applied to very artificial systems). Don’t get me wrong, I’m happy to learn something new and understand a different point of view but so far the arguments don’t help me.
    - zzzcpan 8y ago
      I actually used that example because they had this exact problem in the past, here's the link: https://blog.cloudflare.com/todays-outage-post-mortem-82515/ https://blog.cloudflare.com/todays-outage-post-mortem-82515/
      - peterwwillis 8y ago
        And Google had a similar issue recently where they didn't test their firmware upgrade auto rollback, so a boned firmware upgrade bricked a region until they could manually recover it. If they had rolled out to all regions at once, and all the devices were the same, it would have been chaos. Often the only thing preventing mass upgrades from becoming mass outages is some part of the network just happens to work differently.
        close04 8y ago
        Well... sure. Just as long as you keep in mind that a "not really tested [something]" will very easily get replicated on multiple vendor devices. It's not like they did it because they hate Vendor1 but will make sure to test all the corner cases with Vendor2. Some scenarios will by design ensure you can't have all of them fail because they are not susceptible to the same failure modes. But to compensate you introduce additional failure modes (especially human error) by using a heterogeneous environment. Not to mention the expense. I was actually hoping for an interesting human independent failure. A cosmic radiation caused bit flip that would occur on a particular device. :) Human error can overcome any setup.
JakeTheAndroid 8y ago
Without saying too much, cf has a fairly diverse network in terms of hardware. Partly because the sprawl makes it hard to keep every single colocation running the same hardware, when a single colo can consist of hundreds of independent nodes (metals).

close04 8y ago

Usually any kind of such issue wouldn’t take out every component of a type unless user error is involved. Like deploying the wrong policy to all devices. Which again comes back to humans being the weakest link. I can’t really imagine a particular hardware problem that would kill all components at once. This being said I probably didn’t experience all possible problems so far :).

peterwwillis 8y ago
Sure, humans are the weakest link, who cares? Regardless of the cause of the failure, catastrophic cascades are more likely if the systems and operations involved are homogeneous. That's why evolution prefers diversity.
- close04 8y ago
  Natural evolution. Because it follows vastly different rules. I still fail to see any example given for how one “cascade failure” takes down all the routers in an infrastructure like Cloudflare’s. I can think of a dozen ways a non-homogeneous system can fail (like incompatible updates and config, confusions between the types of components, etc.). In the end you usually end up with massive expenditure that introduces just as many problems as it solves. You may be onto something that nobody else spotted but so far the arguments are too generic (“failure”) or incompatible with the premise (rules of natural evolution applied to very artificial systems). Don’t get me wrong, I’m happy to learn something new and understand a different point of view but so far the arguments don’t help me.
  - zzzcpan 8y ago
    I actually used that example because they had this exact problem in the past, here's the link: https://blog.cloudflare.com/todays-outage-post-mortem-82515/ https://blog.cloudflare.com/todays-outage-post-mortem-82515/
    - peterwwillis 8y ago
      And Google had a similar issue recently where they didn't test their firmware upgrade auto rollback, so a boned firmware upgrade bricked a region until they could manually recover it. If they had rolled out to all regions at once, and all the devices were the same, it would have been chaos. Often the only thing preventing mass upgrades from becoming mass outages is some part of the network just happens to work differently.
      - close04 8y ago
        Well... sure. Just as long as you keep in mind that a "not really tested [something]" will very easily get replicated on multiple vendor devices. It's not like they did it because they hate Vendor1 but will make sure to test all the corner cases with Vendor2. Some scenarios will by design ensure you can't have all of them fail because they are not susceptible to the same failure modes. But to compensate you introduce additional failure modes (especially human error) by using a heterogeneous environment. Not to mention the expense. I was actually hoping for an interesting human independent failure. A cosmic radiation caused bit flip that would occur on a particular device. :) Human error can overcome any setup.

JakeTheAndroid 8y ago

Without saying too much, cf has a fairly diverse network in terms of hardware. Partly because the sprawl makes it hard to keep every single colocation running the same hardware, when a single colo can consist of hundreds of independent nodes (metals).