5 ms·

Does no one do preemptive load testing any more? This kind of metastability _should_ be detectable through fairly simple load till failure testing and recovery

Does no one do preemptive load testing any more? This kind of metastability _should_ be detectable through fairly simple load till failure testing and recovery monitoring. The 10x load cited is a red herring when pulling static config during recovery is their bottleneck

IMTDb 3y ago
Hindsight is 20/20. This specific attack configuration highlighted a weak point. What you don’t know about are all the other attacks that did not impact the service, because the way load testing was performed already lead to some mesures being taken.
- rvba 3y ago
  DDOS seems to be "the" standard attack though... the one you test against
bobnamob 3y ago
Also, the post mortem fails to give any meaningful numbers detailing user impact :( Was this a global outage for 90+% of deno deploy hosted projects? “A large chunk” doesn’t give me much faith that it was isolated to any one region
smarx007 3y ago
Any recommendations of frameworks and learning materials? Ideally, something that could be integrated in the build process. I have mostly found some SaaS services (no-go) and Apache JMeter tutorials mostly aimed at QA (e.g., using GUI mode predominantly) so far.
- goliatone 3y ago
  I have used k6 in our CI/CD pipeline to do integration testing and then ran nightly actions to do smoke and load testing. It was easy to setup and it worked great. The framework provides a clean way to define expectations and to produce data that can then be visualized in grafana. https://k6.io/ https://k6.io/
- gillh 3y ago
  Deploy Aperture for runtime protection. https://github.com/fluxninja/aperture https://github.com/fluxninja/aperture
brasic 3y ago
People inevitably convince themselves that DDOS-levels of traffic are unrealistic until they’ve actually been attacked a few times.
- catlifeonmars 3y ago
  Really? I’ve always found that DDoS is a constant specter in design/development due to how easy it is to execute.

IMTDb 3y ago

Hindsight is 20/20. This specific attack configuration highlighted a weak point. What you don’t know about are all the other attacks that did not impact the service, because the way load testing was performed already lead to some mesures being taken.

rvba 3y ago
DDOS seems to be "the" standard attack though... the one you test against

bobnamob 3y ago

Also, the post mortem fails to give any meaningful numbers detailing user impact :( Was this a global outage for 90+% of deno deploy hosted projects? “A large chunk” doesn’t give me much faith that it was isolated to any one region

smarx007 3y ago

Any recommendations of frameworks and learning materials? Ideally, something that could be integrated in the build process. I have mostly found some SaaS services (no-go) and Apache JMeter tutorials mostly aimed at QA (e.g., using GUI mode predominantly) so far.

goliatone 3y ago
I have used k6 in our CI/CD pipeline to do integration testing and then ran nightly actions to do smoke and load testing. It was easy to setup and it worked great. The framework provides a clean way to define expectations and to produce data that can then be visualized in grafana. https://k6.io/ https://k6.io/
gillh 3y ago
Deploy Aperture for runtime protection. https://github.com/fluxninja/aperture https://github.com/fluxninja/aperture

brasic 3y ago

People inevitably convince themselves that DDOS-levels of traffic are unrealistic until they’ve actually been attacked a few times.

catlifeonmars 3y ago
Really? I’ve always found that DDoS is a constant specter in design/development due to how easy it is to execute.