Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 Down

twitter.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Auth0 Down

#71

Post by tyingq »

thinkharderdev wrote: post #69
dualvectorfoil wrote: post #5

What alternatives to Auth0 are worth looking into? Between this P0 (with no ability to check the status or file a ticket) and the Okta acquisition, I hesitate to continue using Auth0 as the default when spinning up new web apps.

Keycloak is pretty battle-tested and rock solid although it is a bit of a behemoth operationally. Outside of that they Ory ecosystem is really nice. We user Hydra, which is not a drop-in Oauth2 server but requires you to write several of the components yourself.

"Keycloak is pretty battle-tested and rock solid although it is a bit of a behemoth operationally."

Just looked. Java, Wildfly, Infinispan, Hibernate + A DB, network multicast if you want a cluster, your own separate load balancer, etc. So, a fairly large time investment if you aren't familiar with all of that.

Re: Auth0 Down

#72

Post by thinkharderdev »

tyingq wrote: post #71
thinkharderdev wrote: post #69

Earlier quoted context omitted.

Keycloak is pretty battle-tested and rock solid although it is a bit of a behemoth operationally. Outside of that they Ory ecosystem is really nice. We user Hydra, which is not a drop-in Oauth2 server but requires you to write several of the components yourself.

"Keycloak is pretty battle-tested and rock solid although it is a bit of a behemoth operationally." Just looked. Java, Wildfly, Infinispan, Hibernate + A DB, network multicast if you want a cluster, your own separate load balancer, etc. So, a fairly large time investment if you aren't familiar with all of that.

Yeah, it's not the easiest thing in the world to get up and running but not quite as hard as it might seem at first look. If you are already using k8s then you can use https://github.com/codecentric/helm-charts/tree/master/chart... to deploy Keycloak fairly easily. If you're not using k8s then it is probably more of an undertaking.

Re: Auth0 Down

#73

Post by thinkharderdev »

quesera wrote: post #70
thinkharderdev wrote: post #68

Earlier quoted context omitted.

Ha, whenever some 3rd party SaaS tool is down and I am obsessively refreshing their status page I'm always enraged with the lack of updates. But then later I think about what if I were one of the engineers trying to bring things back up. There is nothing worse than being heads down trying to get a mission-critical system back online and being constantly distracted by demands for "status updates." What is the ETA on g…

In my experience, Good organizations have scheduled updates for critical outages. No one pesters anyone, and everyone knows that a five minute update is expected periodically, e.g. at the top of every hour. Great organizations instantly spin up a response team which includes a communications liaison, who is technical enough to participate in the reponse, but is not presently leading it. They assist and communicate, e…

Yep, there is definitely a way to do it well and having scheduled, regular updates (as opposed to ad-hoc requests) is key. But when "the big one" comes then it is hard to maintain the discipline in that process.

Re: Auth0 Down

#74

Post by derekp7 »

thinkharderdev wrote: post #68
marcinzm wrote: post #57

Their status page is pretty depressing to read since all it really says, repeatedly, is "we're really sorry" and "we're working as hard as we can." You can just feel the abuse the person writing that must be getting from customers. I feel bad for them since they have no power to fix this and didn't cause the issue. No root cause or resolution yet and it's been 4 hours. Doesn't bode well for getting this resolved soon…

Ha, whenever some 3rd party SaaS tool is down and I am obsessively refreshing their status page I'm always enraged with the lack of updates. But then later I think about what if I were one of the engineers trying to bring things back up. There is nothing worse than being heads down trying to get a mission-critical system back online and being constantly distracted by demands for "status updates." What is the ETA on g…

And what is really frustrating is you see an error in a tool you depend on, try something to fix it (such as rebuilding a database index), then you sit back and wait without having any idea how long that process is going to take. Or if it is even going to fix the issue. So when someone asks how much longer, you really don't know. And there is a lot of quick pounding on the keyboard, followed by a long wait period where it feels like you aren't doing anything.

Re: Auth0 Down

#75

Post by Kiro »

SahAssar wrote: post #56
Kiro wrote: post #45

Earlier quoted context omitted.

The whole point for me is that I don't want to be responsible for user credentials. I don't trust the security of my app.

If you don't trust your app with credentials how can you trust your app with what those credentials are used to access?

If I get hacked I don't want to leak my users' passwords. The rest I couldn't care less about. It's nothing of value.

Re: Auth0 Down

#76

Post by SahAssar »

Kiro wrote: post #75
SahAssar wrote: post #56

Earlier quoted context omitted.

If you don't trust your app with credentials how can you trust your app with what those credentials are used to access?

If I get hacked I don't want to leak my users' passwords. The rest I couldn't care less about. It's nothing of value.

Basically every platform and framework has good salting and hashing built in. Usually it's scrypt, bcrypt or agron2.

Re: Auth0 Down

#78

Post by tedd4u »

twistedpair wrote: post #77

First RCA is out: https://cdn.auth0.com/blog/Summary_Root_Cause_Analysis_(RCA)... US-1 downtime: 4:20min. Cause: database query contention

This is the "quick" version. They write "we expect to provide our detailed RCA for this incident by 5:00pm PDT (24:00 UTC) on April 29th, 2021, or sooner."
Post reply on HN