Earlier quoted context omitted.
Work in finance and you can move integers around!
Work in the news industry and you can flip booleans! (too subtle?)
!(!(fake news))
Zanzibar: Consistent, Global Authorization System
41–50 of 137 posts
Re: Zanzibar: Consistent, Global Authorization System
#42Earlier quoted context omitted.
The harsh truth of working at Google is that in the end you are moving protobufs from one place to another. They have the most talented people in the world but those people still have to do some boring engineering work.
What is the right data format to move around? JSON?
The point is you're writing mostly business logic and glue. You get a server request, you transform it with some logic, call some other servers, combine the responses and run some more logic, and return a response.
The scalability and interesting work has been factored out and handed off to infrastructure teams that build stuff like this auth framework, load balancers, highly scalable databases, data center cluster management tools, etc.
Which really is the smart way to do it. To the extent that you can stand on the shoulders of giants who've basically made scalability the default, you are free to focus on what you're actually trying to build. The only downside is if all the interesting engineering challenges are already solved for you, the remainder might not that be that interesting to people who enjoy engineering challenges.
Re: Zanzibar: Consistent, Global Authorization System
#43I love reading about Google's systems, but I wish I could work on those problems at scale, that is my dream really. I wonder what more systems Google has that we don't know about. I know Borg has become what we know as k8s but surely there must be more things that Google has made internally that are not open source. Curious about this and would like to know more about it from anyone in the trenches at Google.
The worst part about any job is politics, the extremely competitive nature of Googlers makes it a less than fun place to work.
The competitive nature of Googlers is what make Google a very fun place to work.
Re: Zanzibar: Consistent, Global Authorization System
#44Re: Zanzibar: Consistent, Global Authorization System
#45I love reading about Google's systems, but I wish I could work on those problems at scale, that is my dream really. I wonder what more systems Google has that we don't know about. I know Borg has become what we know as k8s but surely there must be more things that Google has made internally that are not open source. Curious about this and would like to know more about it from anyone in the trenches at Google.
> I love reading about Google's systems, but I wish I could work on those problems at scale, that is my dream really. I wonder what more systems Google has that we don't know about.
I work for Google and I used to have this exact thought too. I think the reality is not quite as rosy, though far from bad!
You have to realize that there are hundreds of people who work on systems like this, and as a consequence, your day to day work is more or less the same as what you would do on systems of a smaller scale.
Before I joined Google I always wondered what things they did differently and what magical knowledge Googlers must have possessed. After joining I realized that while on average the engineers are definitely more capable than other places I've worked, there's no special wisdom and instead they just have more powerful primitives/tools to work with.
Of course, maybe I am mistaken and just don't know of the magic?
Re: Zanzibar: Consistent, Global Authorization System
#46Am I alone in thinking that 99.999% measured availability for a service so completely in the critical path for almost everything is relatively low? Phrased another way, when it is not availability, do end users experience service disruption, and if not, how is that mitigated?
I think you might be alone. 5.26 minutes of down time per year is beyond excellent for any moderately complex system.
I have a simple system that depends on another system and I can't keep it up for a week without 15 minutews downtime
Re: Zanzibar: Consistent, Global Authorization System
#47Earlier quoted context omitted.
99 - 99.9 - That is amazing.
This is absolutely incredible. Since we saw login with Apple yesterday, makes me wonder if any of the other big companies can compete with this. Curious about Facebook/Netflix/Amazon. Netflix seems zippy, but I've never looked at the request timings, which could differ pretty dramatically from UI load times. I imagine Google also dwarfs their login scale. Would be interesting to see numbers capturing full load time f…
In addition to what the neighbor comment says about authorization, an ACL is an internal service: it provides an “if (the user is allowed to X) then ...” to the business logic code. It's not a user-facing service.
Re: Zanzibar: Consistent, Global Authorization System
#48What do other large (non-google scale) to medium companies use for authorization? Can anyone recommend open source (preferably) or close source products?
https://github.com/ory/ladon is an option. Essentially, it imposes a lot of the fine-grained access control model on you, but then it's up to you to implement the actual database/business-logic layer [1] as well as the API layer to actually expose the service.
[1] You do so by implementing this interface: https://github.com/ory/ladon/blob/master/warden.go
Re: Zanzibar: Consistent, Global Authorization System
#49What's interesting to me here is not the ACL thing, it's how in a way 'straight forward' this all seems to be. It's the large architecture of a fairly basic system, done I supposed 'professionally'. I'm curious to know how this works organizationally. What kind of architects involved because this system would have to interact with any number of others, so how do they do requirements gathering? Do they just 'have expe…
That’s how you design at this scale: keep it simple, don’t be a jackass. If the result looks complicated from the outside, you blew it.
Re: Zanzibar: Consistent, Global Authorization System
#50> There's also a story behind that project name. That is not the original project name. The original project name was force-removed by my SVP. Once my hands are free again, I can explain https://mobile.twitter.com/LeaKissner/status/113663143751427...
Yeah, that's kinda understandable. Although I'm not sure how the current name fits the project any better.