11 ms·

The article went up an hour and a half ago, at the exact same time as https://status.lastpass.com/ https://status.lastpass.com/ updated to say they were investi

The article went up an hour and a half ago, at the exact same time as https://status.lastpass.com/ https://status.lastpass.com/ updated to say they were investigating. In under an hour, they acknowledged, identified, fixed, and verified the issue. The fix went out less than half an hour after they learned about it, and this HN submission was posted 1 hour ago, so no one learning of the issue by means of this HN submission will have been able to reproduce the problem. Also, if you've enabled offline access to your vault (which used to be the default IIRC, and would be smart regardless of your password manager of choic) this won't affect you.

djannzjkzxn 7y ago
Life is so good that we are re-using brain structures evolved to avoid being eaten by lions to complain about buggy software.
- Iolaum 7y ago
  Nowdays its more probable that one dies because of buggy software (Boeing MCAS) than get eaten by lions.
  - djannzjkzxn 7y ago
    If you find out about a bug in MCAS, you definitely should complain about it.
deleted 7y ago
[deleted]
nullspace 7y ago
That’s bullshit. In reality (I was affected by this and it’s now fixed), this happened 3 days ago, and I kept watching the status to see if they would identify it. I had to upgrade to premium support for them to even respond to the issue. I filed the issue on Friday or Saturday, and they got back to me on Sunday. And it looks like they have fixed it now. This was not a quick response time, don’t give them credit for this one.
- mk89 7y ago
  It's a nice trick that many companies use. The best way is to build small agents to monitor the service you depend on to know whether they truly respect their SLA. In case of LastPass they don't even have an SLA....so good luck with an updated status.
  - arcticfox 7y ago
    I learned another nice trick from GCP the other day; Stackdriver log ingestion was down, at least for me and a number of people on Twitter, and they simply put a yellow warning at the top of status.cloud.google.com while fixing it instead of making an official incident. Magic, 100% uptime!
    - ghastmaster 7y ago
      If the service is down for a limited amount of individuals I consider it still up. This does beg the question of how many constitutes "down". I think the nature of the problem and quantity of users affected is important.
      - deleted 7y ago
        [deleted]
      - jazzkingrt 7y ago
        I disagree. The SLA ought to be made on a per-customer basis. 1% of users affected would mean 1% of users would be entitled to refunds/remedies that the SLA prescribes.
        antoncohen 7y ago
        GCP has different SLAs for each product, but the ones I've seen are per-customer. The details vary by service, but they generally define downtime, like x% errors for y% amount of time, and then have financial penalties for z% downtime[1]. There are sometimes clauses requiring retries with exponential backoff[2]. Their SLAs are short and readable. It is worth reading a few of them, especially if you have a SaaS and are thinking about your own SLAs. Just search Google for [google $product sla] to find them. [1] https://cloud.google.com/stackdriver/sla https://cloud.google.com/stackdriver/sla [2] https://cloud.google.com/datastore/sla https://cloud.google.com/datastore/sla
sgift 7y ago
> The fix went out less than half an hour after they learned about it, The article says the issues started on Friday and users told them then. So, it seems to be three days for a fix, not half an hour.
- Supermancho 7y ago
  > it seems to be three days for a fix, not half an hour. You are trying to conflate 2 different metrics. The first assertion, is from the time the ticket was investigated, not submitted. It might be useful to talk about expectation of service, since that's what you are getting at. 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate.
  - dwaite 7y ago
    > 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate. This line of reasoning sounds backwards to me. It is the importance of the service that drives the needed level of reliability and people should expect there to be a cost to match that level of urgency and have guarantees that the vendor understands and will meet those needs. If LastPass expects user password management (aka consumer access to websites) to require under two 9's, they are wrong. If they can't meet a minimum level of reliability with a free tier, they should not be offering a free tier.
    - zaptheimpaler 7y ago
      That's one opinion. I'm happy with free and occasionally down rather than paid and always up.
    - dhhdysh2hd 7y ago
      They're obviously meeting a minimum reliability level for the free tier or else no one would be using it because they would find it too unreliable. The argument is about whether their resolution time for the free tier is acceptably fast which can be measured by how many people left the service because of this event. Paying money gets you better service is the other idea in what you quoted, it's hard to imagine why you wouldn't give people better service for paying money unless you were getting more value off them through practices such as data collection. But privacy activists hate the poor so it's pretty hard to thoroughly monetize the free tier without someone trying to start a boycott to make their world a better place.
jmull 7y ago
> The fix went out less than half an hour after they learned about it That's doesn't appear to be true. In one of the twitter feeds linked to in the article, "LastPass Support" says they are "actively investigating" reports on the 17th, so they knew something was up at least that far back.

djannzjkzxn 7y ago

Life is so good that we are re-using brain structures evolved to avoid being eaten by lions to complain about buggy software.

Iolaum 7y ago
Nowdays its more probable that one dies because of buggy software (Boeing MCAS) than get eaten by lions.
- djannzjkzxn 7y ago
  If you find out about a bug in MCAS, you definitely should complain about it.

deleted 7y ago

[deleted]

nullspace 7y ago

That’s bullshit. In reality (I was affected by this and it’s now fixed), this happened 3 days ago, and I kept watching the status to see if they would identify it. I had to upgrade to premium support for them to even respond to the issue. I filed the issue on Friday or Saturday, and they got back to me on Sunday. And it looks like they have fixed it now. This was not a quick response time, don’t give them credit for this one.

mk89 7y ago
It's a nice trick that many companies use. The best way is to build small agents to monitor the service you depend on to know whether they truly respect their SLA. In case of LastPass they don't even have an SLA....so good luck with an updated status.
- arcticfox 7y ago
  I learned another nice trick from GCP the other day; Stackdriver log ingestion was down, at least for me and a number of people on Twitter, and they simply put a yellow warning at the top of status.cloud.google.com while fixing it instead of making an official incident. Magic, 100% uptime!
  - ghastmaster 7y ago
    If the service is down for a limited amount of individuals I consider it still up. This does beg the question of how many constitutes "down". I think the nature of the problem and quantity of users affected is important.
    - deleted 7y ago
      [deleted]
    - jazzkingrt 7y ago
      I disagree. The SLA ought to be made on a per-customer basis. 1% of users affected would mean 1% of users would be entitled to refunds/remedies that the SLA prescribes.
      - antoncohen 7y ago
        GCP has different SLAs for each product, but the ones I've seen are per-customer. The details vary by service, but they generally define downtime, like x% errors for y% amount of time, and then have financial penalties for z% downtime[1]. There are sometimes clauses requiring retries with exponential backoff[2]. Their SLAs are short and readable. It is worth reading a few of them, especially if you have a SaaS and are thinking about your own SLAs. Just search Google for [google $product sla] to find them. [1] https://cloud.google.com/stackdriver/sla https://cloud.google.com/stackdriver/sla [2] https://cloud.google.com/datastore/sla https://cloud.google.com/datastore/sla

sgift 7y ago

> The fix went out less than half an hour after they learned about it, The article says the issues started on Friday and users told them then. So, it seems to be three days for a fix, not half an hour.

Supermancho 7y ago
> it seems to be three days for a fix, not half an hour. You are trying to conflate 2 different metrics. The first assertion, is from the time the ticket was investigated, not submitted. It might be useful to talk about expectation of service, since that's what you are getting at. 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate.
- dwaite 7y ago
  > 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate. This line of reasoning sounds backwards to me. It is the importance of the service that drives the needed level of reliability and people should expect there to be a cost to match that level of urgency and have guarantees that the vendor understands and will meet those needs. If LastPass expects user password management (aka consumer access to websites) to require under two 9's, they are wrong. If they can't meet a minimum level of reliability with a free tier, they should not be offering a free tier.
  - zaptheimpaler 7y ago
    That's one opinion. I'm happy with free and occasionally down rather than paid and always up.
  - dhhdysh2hd 7y ago
    They're obviously meeting a minimum reliability level for the free tier or else no one would be using it because they would find it too unreliable. The argument is about whether their resolution time for the free tier is acceptably fast which can be measured by how many people left the service because of this event. Paying money gets you better service is the other idea in what you quoted, it's hard to imagine why you wouldn't give people better service for paying money unless you were getting more value off them through practices such as data collection. But privacy activists hate the poor so it's pretty hard to thoroughly monetize the free tier without someone trying to start a boycott to make their world a better place.

jmull 7y ago

> The fix went out less than half an hour after they learned about it That's doesn't appear to be true. In one of the twitter feeds linked to in the article, "LastPass Support" says they are "actively investigating" reports on the 17th, so they knew something was up at least that far back.