Live data from Hacker News

Knightmare: A DevOps Cautionary Tale (2014)

dougseven.com

161–170 of 294 posts

Re: Knightmare: A DevOps Cautionary Tale (2014)

#162

Earlier quoted context omitted.

Great reply. Counterpoint though: that automation in and of itself is more failure area. I can imagine a similar story where the deployment pipeline incorrectly rolled back due to some change in metric format and caused the infinite loss, for example. The thing with these being a 1 in a million chance is that there's thousands of different hypothetical causes. The more parts the harder to predict an interaction and w…

Test test test. If that’s not enough, pick better tools. I’m rewriting bash scripts in rust at work because it gives me the ability to make many invalid states impossible to represent in code. Is it overkill? Maybe, but it is such a huge quality of life improvement. Automated things can fail. Sure. But consider that playbooks are just crappy automation run by unreliable meat computers. Also you can take an iterative…

Part of the solution is at the level of attitude, just one more productive than "don't fuck up"

To create a contrived example, say someone reads your note on replacing bash scripts and decides they agree with the principle.

They go into work tomorrow, their fellow engineer agrees on the technical merit, and they reimplement a bunch of bash scripts in Rust with a suite of tests bigger than anyone imagined, and life is great.

... fast forward a few months from now and suddenly a state the bash scripts were hiding flares up and everyone is lost, and type safety didn't help.

A shared culture of "conservation of value" can help in a lot of ways there. That's the attitude that creation of value is always uncertain, so you prioritize potential future value lower than currently provided value:

- instead of looking at technical merit of the new, we prioritize asking: What specific shortcomings the old way have? What can we improve downstream so that the value those systems provide is protected from invalid states we're worried about this tool generating?

- does switching the language reduce the number of people who can work on it? Do we reduce the effect surface area of the team providing value to it? When hair is on fire do we know the sysops guy won't balk?

- when it goes down, with a culture of "conservation of value", your plan A is always rolling back, there's no back and forth on if we can just roll this one fix. If you cause the company to lose a million dollar trade, it's already codified that you made the right decision

Obviously these are all extensions of a contrived example, but to me culture is heavily utilized as a way to guide better engineering.

I think these days people tend to think in terms of culture that affirms, as a reaction to cultures that block anyone from accomplishing anything: to me a good engineering culture is one that clashes with what people want to do just enough to be mildly annoying.

Re: Knightmare: A DevOps Cautionary Tale (2014)

#163
Hold on. Are we blaming the plane crash on the pilot here? It seems there is so much other stuff wrong with this company first that such a deployment would tank it.

No kill switch. Literally needs to be a power switch and a trader who runs to the room and flips it. Ridiculously small amount of cash for the trading volume, and no way to borrow more to stay in business (but that borrowing requiring manual intervention no accessible to the trading system). Obviously the decision to leave that code in there, and for there to be config setting to bring it back.

Then the devops stuff - rollback plans, approvals, pairing on deployments, etc.

Re: Knightmare: A DevOps Cautionary Tale (2014)

#164
post #144
post #53

But ChatGPT would have fixed the issue faster in 45 mins than a human would. /s A high risk situation like this would make the idea of using LLMs for this as not an option; before someone puts out a 'use-case' for a LLM to fix this issue. I'm sorry to preempt the thought of this in advance, but it would not.

That's an odd nonsequitor strawman you constructed to knock down. Did someone suggest LLMs as the solution or are you just asserting superiority over an imaginary guy?

As expected it seems many here, even you couldn't figure out what the '/s' means even as I preempted it in advance before anyone comes and tries to claim it anyway.

So even putting the '/s' to denote sarcastic intent doesn't work on HN. Can't even take a joke here.

Re: Knightmare: A DevOps Cautionary Tale (2014)

#165

Earlier quoted context omitted.

I’ve had to fill out forms for new algorithms / quant strategies with questions like: - how many orders per minute do you expect to create? - how many orders per minute do you expect to cancel/amend? - what’s your max per-ticker position? - what’s your max strategy-level GMV/NMV? Etc. Any one of those questions can be used to set up killswitches. [edited for formatting]

Sure, but there is always the possibility that then you shut down trading when things _arent_ broken. There are always two error rates. Defining behavior is great for retrospective analysis but would you really feel comfortable putting hard cuts into production based on the answers to those questions? I’m genuinely asking, because IME I wouldn’t be.

That last nine in a trading system uptime has exponentially low value unless you have customers who care quite a lot.

Seriously, suppose you have a truly awesome system making $100B per year of revenue. If you unnecessarily shut down 0.1% of the time, that’s only $100M per year lost, and an 0.1% unnecessary shutdown rate seems pretty high.

Re: Knightmare: A DevOps Cautionary Tale (2014)

#166
Wild west times ! It's worth noting, that things changed a lot in trading systems since then.

When I started working in this domain (2009), it was pretty crazy how unreliable those systems were, on all sides - banks, brokers, exchanges. Frequently you needed to make sure over the phone, what quantities got executed etc.

I remember when the Italian exchange was rolling out their systems, at some point we did "tests" on a mix of production and UAT - if my memory is correct, we were just changing IPs to which to connect for order passing to test for the upcoming release, after the market closed. We couldn't just test in their UAT environment, since it was so bugged and half down most of the time.

And let's not even talk about Excel spreadsheets with some VBA code that would make chatGPT swear, that were pricing instruments with volumes traded with a lot of zeros.

It's very different nowadays, in part thanks to stories like this one. Most things are automated, and there is much less cowboy's attitude.

There are mandatory kill switches, a lot of layers of risk / trading activity monitorings (on your side, on exchange side), and really a lot of hard learned lessons incorporated into the systems. That's also part of the reason why people sometime tend to be naive about how hard it is to build a good trading system - the strategies are sometimes now really smart - it's mostly about how to avoid getting killed by something that's outside of usual conditions.

Re: Knightmare: A DevOps Cautionary Tale (2014)

#167

While nice automated deployment is the wrong lesson here, it's really not anticipating backwards incompatibility and poor altering and incident training. Flags should never be reused and should be retired after they're no longer useful.

> Flags should never be reused and should be retired after they're no longer useful.

That's such a "no-brainer," that I don't think it's even written down, anywhere.

When I read that, I was like, "Whut?"

In the Days of Yore, when we hammered programs directly into the iron as Machine Code, we would do stuff like that, but I can't even imagine doing that with any halfway modern language. They don't say, but it's probably C++. I know that's popular for HFT.

Re: Knightmare: A DevOps Cautionary Tale (2014)

#168
post #121

Related: Knightmare: A DevOps Cautionary Tale (2014) - https://news.ycombinator.com/item?id=22250847 - Feb 2020 (33 comments) Knightmare: A DevOps Cautionary Tale (2014) - https://news.ycombinator.com/item?id=8994701 - Feb 2015 (85 comments) Knightmare: A DevOps Cautionary Tale - https://news.ycombinator.com/item?id=7652036 - April 2014 (60 comments) Also: The $440M software error at Knight Capital (2019) - https://n…

Early theory about the cause (incorrect, as it turns out):

Nanex ~ 03-Aug-2012 ~ The Knightmare Explaned - https://news.ycombinator.com/item?id=4337359 (no comments)

Re: Knightmare: A DevOps Cautionary Tale (2014)

#169
post #26

I'm not sure how automated deployments would have solved this problem. In fact, if anything, it would have magnified the impact and fallout of the problem. Substitute "a developer forgot to upload the code to one of the servers" for "the deployment agent errored while downloading the new binary/code onto the server and a bug in the agent prevented the error from being surfaced." Now you have the same failure mode, an…

> The blame here lies squarely with the developers--the code was written in a non-backwards-compatible way. The blame completely lies with the risk management team. The market knew there was a terrible problem, Knight knew there was a problem, yet it took 45 minutes of trying various hotfixes before they ceased trading. Either because they didn't have a kill switch, or because no one was empowered to pull the kill sw…

They were asleep at the wheel, not unlike all the random brokerages that blew up when swiss central bank pulled the CHF peg in 2015.

This is a culture problem - as soon as you load up your trading firm with a bunch of software industry hires, you end up with jiras and change management workflows instead of people on deck that have context for what they're doing. That's the only way to explain reverse scalping for 45 mins straight.

Post reply on HN