4 ms·

>> Since we also had control of the client experience in almost all cases, we were able to measure from the client side as well (and trust that data), and inclu

>> Since we also had control of the client experience in almost all cases, we were able to measure from the client side as well (and trust that data), and include that data in our measurements. The W3C Network Error Logging specification now allows websites to register client-side errors (DNS, TCP, TLS etc.), record them offline, and send them via side-channel telemetry to a different endpoint later on. This has changed how we measure client-side availability on browser-based services. Chromium-based browsers (68+) support this feature, enabled by default. >> Where things got interesting was when say a large ISP was down. NEL also helps the service owner determine with some level of accuracy whether a problem in an ISP is specifically related to the service, or to the ISP {disclaimer: work for MSFT, specifically on NEL-related tech} [1] https://w3c.github.io/network-error-logging/ https://w3c.github.io/network-error-logging/

jedberg 7y ago
How do you guarantee that the client hasn't modified the telemetry data?
- yjftsjthsd-h 7y ago
  I doubt you can, but why would they? I mean, yes, maybe an unethical competitor could use it as an attack, and yes we live in a world where AdNauseam exists, but I would be surprised if that kind of thing was enough to matter at any scale (i.e. it'd disappear below your noise floor unless it was a really good mass attack).
  - jedberg 7y ago
    Well, it depends on the use case. At Netflix for example, it was the outliers that were interesting. There aren't many 2011 LG TVs out there, but if they were all consistently failing, that would be something we'd want to call out. Even every 2011 LG TV failing at once falls below the noise floor, unless you're specifically looking for it. But if your are specifically looking for outliers, than a single bad actor can really mess up your day.
- feyman_r 7y ago
  I don't think a guarantee can be made that the client can't tamper with it - its just an HTTPS POST request to an endpoint with a JSON body that's generated from the browser. However, if NEL is run globally, it just becomes a part of the noise floor (someone else mentioned this as well), and to do effectively with malice will require doing this 'at scale' (that fav. phrase). So far, we haven't seen changes in the outcomes from telemetry analysis. One way of removing malicious noise could be to apply the same bot-detection capabilities for NEL that you apply for the service its monitoring.

jedberg 7y ago

How do you guarantee that the client hasn't modified the telemetry data?

yjftsjthsd-h 7y ago
I doubt you can, but why would they? I mean, yes, maybe an unethical competitor could use it as an attack, and yes we live in a world where AdNauseam exists, but I would be surprised if that kind of thing was enough to matter at any scale (i.e. it'd disappear below your noise floor unless it was a really good mass attack).
- jedberg 7y ago
  Well, it depends on the use case. At Netflix for example, it was the outliers that were interesting. There aren't many 2011 LG TVs out there, but if they were all consistently failing, that would be something we'd want to call out. Even every 2011 LG TV failing at once falls below the noise floor, unless you're specifically looking for it. But if your are specifically looking for outliers, than a single bad actor can really mess up your day.
feyman_r 7y ago
I don't think a guarantee can be made that the client can't tamper with it - its just an HTTPS POST request to an endpoint with a JSON body that's generated from the browser. However, if NEL is run globally, it just becomes a part of the noise floor (someone else mentioned this as well), and to do effectively with malice will require doing this 'at scale' (that fav. phrase). So far, we haven't seen changes in the outcomes from telemetry analysis. One way of removing malicious noise could be to apply the same bot-detection capabilities for NEL that you apply for the service its monitoring.