Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zanzibar: Consistent, Global Authorization System

ai.google

Post reply on HN
Print view View original

31–40 of 137 posts

Re: Zanzibar: Consistent, Global Authorization System

#31

Post by lclarkmichalek »

alexeldeib wrote: post #15
ktta wrote: post #5

Earlier quoted context omitted.

99 - 99.9 - That is amazing.

This is absolutely incredible. Since we saw login with Apple yesterday, makes me wonder if any of the other big companies can compete with this. Curious about Facebook/Netflix/Amazon. Netflix seems zippy, but I've never looked at the request timings, which could differ pretty dramatically from UI load times. I imagine Google also dwarfs their login scale. Would be interesting to see numbers capturing full load time f…

This isn't a login service, this is an ACL service. Related space, but different concerns. You wouldn't send a user's password here to find out if it's correct (authentication), you'd use this to figure out if a user can do something once you know who they are (authorization) :)

Also, generating the login page etc is often more expensive than the actual 'validate the username and password'. Getting to the server is also going to dwarf these latencies; you probably don't store all your passwords in PoPs, so you need to make the full trek to your local Google datacentre to complete a login :)

Re: Zanzibar: Consistent, Global Authorization System

#32

Post by xfitm3 »

colesantiago wrote: post #6

I love reading about Google's systems, but I wish I could work on those problems at scale, that is my dream really. I wonder what more systems Google has that we don't know about. I know Borg has become what we know as k8s but surely there must be more things that Google has made internally that are not open source. Curious about this and would like to know more about it from anyone in the trenches at Google.

The worst part about any job is politics, the extremely competitive nature of Googlers makes it a less than fun place to work.

Re: Zanzibar: Consistent, Global Authorization System

#33

Post by have_faith »

jjeaff wrote: post #30
izacus wrote: post #10

Earlier quoted context omitted.

But you can reduce any job to this can't you? Pretty much all engineering is just moving some strings around.

Work in finance and you can move integers around!

Work in the news industry and you can flip booleans! (too subtle?)

Re: Zanzibar: Consistent, Global Authorization System

#34

Post by TheMagicHorsey »

colesantiago wrote: post #6

I love reading about Google's systems, but I wish I could work on those problems at scale, that is my dream really. I wonder what more systems Google has that we don't know about. I know Borg has become what we know as k8s but surely there must be more things that Google has made internally that are not open source. Curious about this and would like to know more about it from anyone in the trenches at Google.

There are open source projects you can work on. You already mentioned one: Kubernetes. But there are also others.

Re: Zanzibar: Consistent, Global Authorization System

#35

Post by jameshart »

lclarkmichalek wrote: post #31
alexeldeib wrote: post #15

Earlier quoted context omitted.

This is absolutely incredible. Since we saw login with Apple yesterday, makes me wonder if any of the other big companies can compete with this. Curious about Facebook/Netflix/Amazon. Netflix seems zippy, but I've never looked at the request timings, which could differ pretty dramatically from UI load times. I imagine Google also dwarfs their login scale. Would be interesting to see numbers capturing full load time f…

This isn't a login service, this is an ACL service. Related space, but different concerns. You wouldn't send a user's password here to find out if it's correct (authentication), you'd use this to figure out if a user can do something once you know who they are (authorization) :) Also, generating the login page etc is often more expensive than the actual 'validate the username and password'. Getting to the server is a…

In fact, validate the username and password might need to be artificially slowed down to protect against side channel and credential stuffing attacks :)

Re: Zanzibar: Consistent, Global Authorization System

#36

Post by dmoy »

Xorlev wrote: post #26
duality wrote: post #17

Earlier quoted context omitted.

What is the right data format to move around? JSON?

It's just a saying. All we do is move protos from one service to another. JSON is definitely not the right stuff.

The encoding/decoding cost is painful :(

I mean in this context if you're doing that level of scale. For a lot of purposes json is totally fine.

Re: Zanzibar: Consistent, Global Authorization System

#38

Post by idlewords »

colesantiago wrote: post #6

I love reading about Google's systems, but I wish I could work on those problems at scale, that is my dream really. I wonder what more systems Google has that we don't know about. I know Borg has become what we know as k8s but surely there must be more things that Google has made internally that are not open source. Curious about this and would like to know more about it from anyone in the trenches at Google.

Wait until you get a glimpse into the exciting world of real-time ad bidding. It's every engineer's dream!

Re: Zanzibar: Consistent, Global Authorization System

#39

Post by justicezyx »

the-rc wrote: post #24
iampims wrote: post #2

“Zanzibar scales to trillions of access control lists and millions of authorization requests per second to support services used by billions of people. It has maintained 95th-percentile latency of less than 10 milliseconds and availability of greater than 99.999% over 3 years of production use” Impressive!

"This caching, along with aggressive pooling of read requests, allows Zanzibar to issue only 20 million read RPCs per second to Spanner." ("Only") I'm surprised by all the numbers they give out: latency, regions, operation counts, even servers. The typical Google paper omits numbers on the Y axis of its most interesting graphs. Or it says "more than a billion", which makes people think "2B", when the actual number mi…

Kind of needed in the cloud war where many actually question if the mysterious Google supermacy in global infrastructure is really true.

Re: Zanzibar: Consistent, Global Authorization System

#40

Post by shereadsthenews »

Boulth wrote: post #7
colesantiago wrote: post #6

I love reading about Google's systems, but I wish I could work on those problems at scale, that is my dream really. I wonder what more systems Google has that we don't know about. I know Borg has become what we know as k8s but surely there must be more things that Google has made internally that are not open source. Curious about this and would like to know more about it from anyone in the trenches at Google.

On the other hand Google engineers are vendor-locked-in using Google specific tech one way or another.

Yeah the whole time I was there every time I had to use bigtable or Spanner I always muttered to myself “I wish I could be using some free software garbage instead of this proprietary Google stuff right now.” Every Googler secretly yearns for the performance, reliability, and elegance of MySQL.
Post reply on HN