Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post-Mortem for Google Compute Engine’s Global Outage on April 11

status.cloud.google.com

Post reply on HN
Print view View original

151–160 of 368 posts

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#151

Post by avs733 »

stcredzero wrote: post #98

In this event, the canary step correctly identified that the new configuration was unsafe. Crucially however, a second software bug in the management software did not propagate the canary step’s conclusion back to the push process, and thus the push system concluded that the new configuration was valid and began its progressive rollout. Classic Two Generals. "No news is good news," generally isn't a good design philo…

this was my exact thought...it would seem both feasable and reasonable to have a more active canary process i.e....

anycast "canary test in progress"

edge routers store new configs

anycast "canary test PASS"

edge routers activate new config

edge routers canary test new config (and pass or revert)

edge routers report home that all is well

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#152

Post by makip »

ThrustVectoring wrote: post #88
794CD01 wrote: post #80

Earlier quoted context omitted.

They don't have to be safer than driving is today. They can be significantly less safe while still being an improvement for society because drivers will be able to focus on other activities while travelling instead of wasting that time focusing on driving the car.

There's psychological and game theoretic factors that the safety has to overcome in order to be acceptable. Part of why human drivers are allowed today is because the people who bear the cost of driving decisions are directly involved in making those decisions. Once you give up control to a third party, they need to be significantly better to make it an acceptable choice on the individual level. In other words, I agr…

I see where you're going with this and I agree.

A significant consideration is whether owners of self driving cars will have the right to make code modifications to their vehicles.

Captured aptly here by Cory Doctrow.

https://www.theguardian.com/technology/2015/dec/23/the-probl...

Edit: salient quotes from the article:

"Here’s a different way of thinking about [the trolley] problem: if you wanted to design a car that intentionally murdered its driver under certain circumstances, how would you make sure that the driver never altered its programming so that they could be assured that their property would never intentionally murder them?"

"If self-driving cars can only be safe if we are sure no one can reconfigure them without manufacturer approval, then they will never be safe."

"Your relationship to the car you ride in, but do not own, makes all the problems mentioned even harder."

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#153

Post by elcapitan »

lallysingh wrote: post #117
deegles wrote: post #106

Earlier quoted context omitted.

This would have a dramatic chilling effect on hiring for self-driving car software developers, which would ironically make them less safe.

It might lead to some decent work on formal verification of programs.

Is there actually some way of formal verification of software that is driven mostly by machine learning? I imagine there's a small core of code that runs some trained models, but how are they being formally verified? How do we know there's not a blind spot in that model that turns out to be fatal under certain conditions?

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#154

Post by Afforess »

essayist wrote: post #148
gliderShip wrote: post #107

Earlier quoted context omitted.

Well No, There is an upper limit on the damage a bad driver can do by say crushing his car with a bus or something like that. Imagine a bug or malware triggered at the same moment world-wide. It could kill millions. So it not as simple as 'It just has to be better than a human'

I've been itching to release this terror movie plot into the wild: It's 2025 and more than 10% of the cars on the road in the US are self-driving. It's rush hour on a busy Friday afternoon in Washington, DC. Earlier that day, there'd been a handful of odd reports of self-driving Edsels (so as not to impugn an actual model) going haywire, and the NTSB has started its investigation. But then, at 430pm, highway patrol u…

I'm afraid Daemon (novel) beat you to the punch. It's an excellent novel, about fairly similar situations.

http://www.goodreads.com/book/show/6665847-daemon

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#155

Post by kevindqc »

agildehaus wrote: post #149
amelius wrote: post #140

Earlier quoted context omitted.

> Self driving cars don't have to be perfect. They just have to be safer then driving is today But how is Google or any other manufacturer going to test their software updates? Are they going to test-drive their cars for tens of thousands of miles over and over again for every little update?

Google's cars drive millions of miles daily in simulation already. They take sensor data (including LIDAR) from past drives and essentially redrive their entire dataset with the updated software. Here's Google talking about it: https://static.googleusercontent.com/media/www.google.com/en... Of course this is only one component to feeling confident about pushing out an update where lives are on the line, but it's a ke…

But if a new update changes how the car drives, wouldn't the data that would've been captured by the updated car be different than what the old outdated car recorded?

For example if the new update makes the car more aggressive, then other real drivers might be more careful, slow down more, etc compared to the original runs?

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#156

Post by Fiahil »

ben_jones wrote: post #64
brianwawok wrote: post #2

This is a very good Post-Mortem. As I assumed it was kind of a corner case bug meet corner case bug met corner case bug. This is also why I am of afraid of a self driving cars and other such life critical software. There are going to be weird edge cases, what prevents you from reaching them? Making software is hard....

Self driving cars don't have to be perfect. They just have to be safer then driving is today [1]. The real question is if society can handle the unfairness that is death by random software error vs. death by negligent driving. It's easy to blame negligent driving on the driver, we're clearly not negligent so it really doesn't effect us right? But a software error might as well be an act of god, it's something that mi…

As you say, it can be pretty difficult to accept the unfairness of death by random software error. However, this is a situation that already exist today, but understood and acknowledged by a very small portion of people in our societies. For (a non life-threatening) example, thanks to the post-mortem above, we have a pretty deep understanding of what happened and why during this outage; but for some people it could have been a mere "Spotify is down, again, no more music :(".

I'm very curious to see if our understanding (as a society) of our own technology will improve over time or if people will continue to blame the internet for "not working" 20 years from now.

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#157

Post by rayval »

essayist wrote: post #148
gliderShip wrote: post #107

Earlier quoted context omitted.

Well No, There is an upper limit on the damage a bad driver can do by say crushing his car with a bus or something like that. Imagine a bug or malware triggered at the same moment world-wide. It could kill millions. So it not as simple as 'It just has to be better than a human'

I've been itching to release this terror movie plot into the wild: It's 2025 and more than 10% of the cars on the road in the US are self-driving. It's rush hour on a busy Friday afternoon in Washington, DC. Earlier that day, there'd been a handful of odd reports of self-driving Edsels (so as not to impugn an actual model) going haywire, and the NTSB has started its investigation. But then, at 430pm, highway patrol u…

Cool plot line, I'd go see that movie.

A related scenario, one that theoretically could happen today, is hacking into commercial airliners auto-pilot systems, and directing dozens of flights onto a target.

Set aside the fantasy movie plot angle, how realistic is this today? Is it any more or less plausible than the millions of cars scenario? If people are truly concerned about the car scenario, shouldn't they be worrying about the aircraft scenario?

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#158

Post by agnivade »

cjbprime wrote: post #17

It looks like there were at least three catastrophic bugs present: 1. Evaluated a configuration change before the change had finished syncing across all configuration files, resulting in rejecting the change. 2. So it tried to reject the change, but actually just deleted everything instead. 3. Something was supposed to catch changes that break everything, and it detected that everything was broken but its attempt to…

I feel 1 is a timing related issue. Which are extremely hard to get right, and might happen.

2 and 3 shouldn't have happened. But since they aren't releasing any further details. It would be unfair to rate the system.

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#159

Post by rodgerd »

boydc wrote: post #22
VonGuard wrote: post #6

Earlier quoted context omitted.

Yeah, remember, auto-pilot in a plane needs to be 100% reliable, or everyone dies. A car needs to be, I dunno, 80%? Compared to a bad human driver, who still drives every damn day, a computer need only be about 60% reliable to be better. People suck at driving. Even a shitty self-driving car will save a ton of lives simply by obeying traffic laws.

Self-driving car could be better than human in average. But as long as there are human drivers who drive better than self-driving software, it would be disaster for these drivers. We definitely do not want some technique than do good for majority but do horrible things for minority, right?

The best drivers in the world (Formula 1) are already outcompeted by traction and stability control systems.

Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11

#160

Post by unprepare »

essayist wrote: post #148
gliderShip wrote: post #107

Earlier quoted context omitted.

Well No, There is an upper limit on the damage a bad driver can do by say crushing his car with a bus or something like that. Imagine a bug or malware triggered at the same moment world-wide. It could kill millions. So it not as simple as 'It just has to be better than a human'

I've been itching to release this terror movie plot into the wild: It's 2025 and more than 10% of the cars on the road in the US are self-driving. It's rush hour on a busy Friday afternoon in Washington, DC. Earlier that day, there'd been a handful of odd reports of self-driving Edsels (so as not to impugn an actual model) going haywire, and the NTSB has started its investigation. But then, at 430pm, highway patrol u…

I can see it now - a modern day tiananmen square as a lone figure stands in front of a long line of Edsels
Post reply on HN