3 ms·

With all due respect to the esteemed gentleman, I think sometimes an equally important question is "When this fails, should it be survived?" There may be some o

With all due respect to the esteemed gentleman, I think sometimes an equally important question is "When this fails, should it be survived?" There may be some operations that _shouldn't_ be worked around. For example, if my auth service goes down, should accesses continue, or should we prevent all accesses? I don't think I'm communicating myself clearly here, but I would like to thank the parent commenter for his insight into this area and more. Just to cover my bases. EDIT: I want to make clear that there is no sarcasm here. I respect WalterBright probably only behind Knuth in terms of effective programmers/engineers in the field today, and I doubt I could add anything to his opinions.

WalterBright 5y ago
If the auth service has failed, the correct response is to shut down all access to what that service was connected to. In order to survive shutting down that access, the system must be compartmentalized, so the shutdown is limited in scope. For example, the hydraulic system on an airplane has a redundant equivalent hydraulic system. But within a hydraulic system, it is designed to isolate failed sections of it from the rest, so the rest can still function. I.e. developing a leak in the elevator actuators won't disable the aileron actuators on the wings. The Fukushima plant and Deepwater Horizon rig both had a vulnerability to a single point of failure that produced cascading failures that unzipped the whole system. Both were easily and inexpensively preventable.
- bombcar 5y ago
  Even an auth system can be handled in various other ways - for example, auth tokens can be handed out as valid for 48 hours but normally cycled every 24 - in case of auth failure those who already have a token can keep working for up to two days. But that may not fit the risk profile, and you may need additional considerations - and perhaps even different levels of authentication.

WalterBright 5y ago

If the auth service has failed, the correct response is to shut down all access to what that service was connected to. In order to survive shutting down that access, the system must be compartmentalized, so the shutdown is limited in scope. For example, the hydraulic system on an airplane has a redundant equivalent hydraulic system. But within a hydraulic system, it is designed to isolate failed sections of it from the rest, so the rest can still function. I.e. developing a leak in the elevator actuators won't disable the aileron actuators on the wings. The Fukushima plant and Deepwater Horizon rig both had a vulnerability to a single point of failure that produced cascading failures that unzipped the whole system. Both were easily and inexpensively preventable.

bombcar 5y ago
Even an auth system can be handled in various other ways - for example, auth tokens can be handed out as valid for 48 hours but normally cycled every 24 - in case of auth failure those who already have a token can keep working for up to two days. But that may not fit the risk profile, and you may need additional considerations - and perhaps even different levels of authentication.