4 ms·

A simple layer 2 network topology only works in very narrow use cases (like this one). But a "dumb switch" means you also lose a lot of observability and it's v

by booi 6y ago

A simple layer 2 network topology only works in very narrow use cases (like this one). But a "dumb switch" means you also lose a lot of observability and it's very difficult to apply consistent network acls.

rsync 6y ago
Agreed - we are, in a sense, "cheating" because our product is so simple that we do have one of these "very narrow use cases". The benefits are tremendous, however, and go beyond day to day operations. A dumb switch has no credentials to protect and there is almost zero attack surface. Further, if our switch dies we can immediately replace it with any other dumb switch that just happens to be lying around. If you read failure studies - like those in the excellent Charles Perrow book _Normal Accidents_[1] - you see that in many cases there is a very special component that fails and everything goes to hell when they can't find a replacement for it. So, while I can't encourage everyone to use dumb, unmanaged switches (because not everyone can) I can encourage everyone to remove as many very special components as they can. [1] https://en.wikipedia.org/wiki/Normal_Accidents https://en.wikipedia.org/wiki/Normal_Accidents
- _trampeltier 6y ago
  I work in industrie automation and I can't agree more to dumb devices. There are a lot of nice special products, but if something goes broken, you have first tousend of pages manual, just maybe an identical part. The guy on the night shift has also to know this special part well .. and so on. The dumb devices, you can replace easy without any problems tomorrow or also in 10 .. 20 years.
- chris_wot 6y ago
  Charles Perrow only died recently, very sad.
- Bluecobra 6y ago
  How are you providing network level redundancy with dumb switches? My only guess is that the ISP is already doing HSRP/VRRP on the gateway and you can setup multiple NICs/switches with something like CARP and being careful not to make L2 loops.
  - secabeen 6y ago
    Why would they need nework-level redundancy? This is a backup service, and should not have production load on it at any time. I'd rather see a system with a dumb switch and the risk of a 3-4 hour outage if it fails than a smart switch that can then be cracked. (Even then, 3-4 hours is a stretch, as all the remote hands has to do to replace a failed switch is put in any other dumb switch.)
    - kbr2000 6y ago
      Your reasoning could be applied when there is low number of users doing not-so-urgent-nor-important-things. However, the service is provided for a lot of users at the same time here, spread globally and all with their own applications and problems, and accordingly the total impact could potentially be much bigger. Having the handicap of needing to wait 3-4 hours before being able to access your backups in an emergency, could make a day-and-night difference for continuity. So I would argue it has nothing to do with "being a backup service", but rather that their users could afford a 3-4 hours of waiting. Or that they don't think like that.
- stonesweep 6y ago
  This aptly describes why I do not want a smart home even as a tech professional and why I drive a generic Toyota with easily replaceable parts.
duxup 6y ago
Yeah in a previous career I was a networking engineer. I ran into a number of folks who were pure (or largely) layer 2 only environments. In the right situation it's doable and potentially highly desirable due to the simplicity, but requires a lot of discipline by everyone involved, and the right conditions to make it work. It was a design I supported and thought it was a great idea for the right situation, but I also was hesitant to introduce it to anyone but the 'right customer'.... who probably already knew what they needed to know about it.
deleted 6y ago
[deleted]

by booi 6y ago

rsync 6y ago

Agreed - we are, in a sense, "cheating" because our product is so simple that we do have one of these "very narrow use cases". The benefits are tremendous, however, and go beyond day to day operations. A dumb switch has no credentials to protect and there is almost zero attack surface. Further, if our switch dies we can immediately replace it with any other dumb switch that just happens to be lying around. If you read failure studies - like those in the excellent Charles Perrow book _Normal Accidents_[1] - you see that in many cases there is a very special component that fails and everything goes to hell when they can't find a replacement for it. So, while I can't encourage everyone to use dumb, unmanaged switches (because not everyone can) I can encourage everyone to remove as many very special components as they can. [1] https://en.wikipedia.org/wiki/Normal_Accidents https://en.wikipedia.org/wiki/Normal_Accidents

_trampeltier 6y ago
I work in industrie automation and I can't agree more to dumb devices. There are a lot of nice special products, but if something goes broken, you have first tousend of pages manual, just maybe an identical part. The guy on the night shift has also to know this special part well .. and so on. The dumb devices, you can replace easy without any problems tomorrow or also in 10 .. 20 years.
chris_wot 6y ago
Charles Perrow only died recently, very sad.
Bluecobra 6y ago
How are you providing network level redundancy with dumb switches? My only guess is that the ISP is already doing HSRP/VRRP on the gateway and you can setup multiple NICs/switches with something like CARP and being careful not to make L2 loops.
- secabeen 6y ago
  Why would they need nework-level redundancy? This is a backup service, and should not have production load on it at any time. I'd rather see a system with a dumb switch and the risk of a 3-4 hour outage if it fails than a smart switch that can then be cracked. (Even then, 3-4 hours is a stretch, as all the remote hands has to do to replace a failed switch is put in any other dumb switch.)
  - kbr2000 6y ago
    Your reasoning could be applied when there is low number of users doing not-so-urgent-nor-important-things. However, the service is provided for a lot of users at the same time here, spread globally and all with their own applications and problems, and accordingly the total impact could potentially be much bigger. Having the handicap of needing to wait 3-4 hours before being able to access your backups in an emergency, could make a day-and-night difference for continuity. So I would argue it has nothing to do with "being a backup service", but rather that their users could afford a 3-4 hours of waiting. Or that they don't think like that.
stonesweep 6y ago
This aptly describes why I do not want a smart home even as a tech professional and why I drive a generic Toyota with easily replaceable parts.

duxup 6y ago

Yeah in a previous career I was a networking engineer. I ran into a number of folks who were pure (or largely) layer 2 only environments. In the right situation it's doable and potentially highly desirable due to the simplicity, but requires a lot of discipline by everyone involved, and the right conditions to make it work. It was a design I supported and thought it was a great idea for the right situation, but I also was hesitant to introduce it to anyone but the 'right customer'.... who probably already knew what they needed to know about it.

deleted 6y ago

[deleted]