3 ms·

> As recently as 2013, a leading file systems developer was still arguing that file systems didn’t have to save file data reliably by mocking users for playing

> As recently as 2013, a leading file systems developer was still arguing that file systems didn’t have to save file data reliably by mocking users for playing computer games. Tso neither mocks users for playing games, nor argues that filesystems should not be required to be reliable. He says: "[Lortie, that filesystem operation that you said was guaranteed to be safe actually isn't safe. You mis-read the docs. It's racy, and here are the two races that you could lose. Losing both could lose your data. Here's an analogy to illustrate the races: ] The failure scenario would probably be something like the user who plays tux racer all the time, and uses crappy proprietary drivers that crash the system every single time an OpenGL application exits. If they think that's normal, and are willing to live with the crap proprietary drivers, and they are also the sort of people who carefully position all of their windows to be precisely just so, and if the !@#!?! desktop libraries are still bogusly rewriting the entire contents of every single registry file, regardless of whether the application changed anything --- then eventually, said user will whine about how the hours she spent obsessively setting up their window layout got lost after Tux Racer creashed (sic) their system again." Notice the carefully constructed persona used in the illustration: * Tolerates terrible, crashy, OpenGL drivers. * Makes use of the OpenGL drivers by playing a video game. * Spends a lot of time meticulously positioning application windows. * Uses a WM that stores application window position in a single file that gets updated all the damn time for no reason at all. * Whines when the enormous amount of work put into positioning windows gets wasted when the poorly-designed software they're using crashes and takes some of their data with it.

vaurora 12y ago
It was safe to rename() a file and expect the data it contained after crash to either be (1) the data before the rename(), (2) the data after the rename(). What changing the ext4 default logging mode to "data=writeback" did is add two more options, (3) nothing (0 bytes), and (4) whatever random garbage it found on disk, potentially including a copy of /etc/shadow. No-one misread the docs, the behavior changed. But hey, if you're angling to be hired by a YC-funded storage startup, this is certainly a post.
- simoncion 12y ago
  > No-one misread the docs, the behavior changed. I write this without a hint of snarkiness or ill will. Please keep this fact in mind as you read on. If you read the message by Lortie [0] that Ts'o responded to [1] you find that Lortie was specifically talking about the guarantees made by ext4 in regards to rename behavior. In that message Lortie says "[the documentation of ext4 in Documentation/filesystems/ext4.txt] says to me "replace by rename is guaranteed safe in modern ext4, under default mount options"." Ts'o opens his message with "It's not _guaranteed_ safe." I understand that people are frustrated about ext4's default options. In the referenced exchange, neither Lortie nor Ts'o were talking about the merits of the differences between the rename robustness guarantees of ext4 and other filesystems. Lortie was double-checking his understanding of the documentation of the guarantees that ext4 provides with its default options. Ts'o was correcting Lortie's misunderstanding of that documentation. [0] http://www.spinics.net/lists/linux-ext4/msg38774.html http://www.spinics.net/lists/linux-ext4/msg38774.html [1] http://www.spinics.net/lists/linux-ext4/msg38778.html http://www.spinics.net/lists/linux-ext4/msg38778.html
  - vaurora 12y ago
    Trying to figure out how to apply Charles' Rules of Argument to the situation, I realized I wrote an entire article on this topic (and linked to it from the OP): http://lwn.net/Articles/351422/ http://lwn.net/Articles/351422/ Short version: ext4's behavior under default mount options changed. You can't blame it on someone mis-reading the docs.
    - Dylan16807 12y ago
      The actual behavior is orthogonal to the guarantees in the documentation.
WhatBalance 12y ago
According to the OP, Ted T'so is a rape apologist and rape sympathiser because he dared to question the unquestionable. The OP feels that if you don't share their ideology then everything you do technically must be incorrect. Another way ideology kills everything.

vaurora 12y ago

It was safe to rename() a file and expect the data it contained after crash to either be (1) the data before the rename(), (2) the data after the rename(). What changing the ext4 default logging mode to "data=writeback" did is add two more options, (3) nothing (0 bytes), and (4) whatever random garbage it found on disk, potentially including a copy of /etc/shadow. No-one misread the docs, the behavior changed. But hey, if you're angling to be hired by a YC-funded storage startup, this is certainly a post.

simoncion 12y ago
> No-one misread the docs, the behavior changed. I write this without a hint of snarkiness or ill will. Please keep this fact in mind as you read on. If you read the message by Lortie [0] that Ts'o responded to [1] you find that Lortie was specifically talking about the guarantees made by ext4 in regards to rename behavior. In that message Lortie says "[the documentation of ext4 in Documentation/filesystems/ext4.txt] says to me "replace by rename is guaranteed safe in modern ext4, under default mount options"." Ts'o opens his message with "It's not _guaranteed_ safe." I understand that people are frustrated about ext4's default options. In the referenced exchange, neither Lortie nor Ts'o were talking about the merits of the differences between the rename robustness guarantees of ext4 and other filesystems. Lortie was double-checking his understanding of the documentation of the guarantees that ext4 provides with its default options. Ts'o was correcting Lortie's misunderstanding of that documentation. [0] http://www.spinics.net/lists/linux-ext4/msg38774.html http://www.spinics.net/lists/linux-ext4/msg38774.html [1] http://www.spinics.net/lists/linux-ext4/msg38778.html http://www.spinics.net/lists/linux-ext4/msg38778.html
- vaurora 12y ago
  Trying to figure out how to apply Charles' Rules of Argument to the situation, I realized I wrote an entire article on this topic (and linked to it from the OP): http://lwn.net/Articles/351422/ http://lwn.net/Articles/351422/ Short version: ext4's behavior under default mount options changed. You can't blame it on someone mis-reading the docs.
  - Dylan16807 12y ago
    The actual behavior is orthogonal to the guarantees in the documentation.

WhatBalance 12y ago

According to the OP, Ted T'so is a rape apologist and rape sympathiser because he dared to question the unquestionable. The OP feels that if you don't share their ideology then everything you do technically must be incorrect. Another way ideology kills everything.