Meta outage • Hacker News Board

Re: Meta outage

#711

Post by shkkmo » Tue, Mar 05, 2024, 6:22 PM UTC

shadowgovt wrote: post #677

shkkmo wrote: post #562

Earlier quoted context omitted.

You can't plan for every contigency, but you can reserve potentially scary message for situations where you know they are correct. An unpected error state should NOT result in a "invalid credentialiald error".

This is the nature of credentials errors. The more information you give, the more you're telling an untrusted and therefore assumed-hostile agent. I hate it because it's bad UX, but that's the thinking behind it.

Pushing people to unnecessarily reset credentials increases risk. Not only does it increase acute risk, but it also decreases the value of the signal by crying wolf.

The argument here is the kind of nonsense cargo cult security that pervades the industry.

Re: Meta outage

#712

Post by TulliusCicero » Tue, Mar 05, 2024, 6:23 PM UTC

citrusybread wrote: post #644

TulliusCicero wrote: post #439

Earlier quoted context omitted.

The Quest 3 is kind of the obvious mainstream consumer choice for a VR headset. Standalone wireless headset, reasonably powerful chipset, can optionally stream from a PC either wired or wireless, good optics/resolution, decent controllers/tracking, large game library, large suite of features (including hand tracking and color passthrough), all for a reasonable price. Not sure any other headset really competes on all…

can we really call it standalone if you need it to phone home to Meta? and doesn't it require an account one of their services too? they did a fantastic job with hardware. I just wish they didn't couple the software so tightly.

> can we really call it standalone if you need it to phone home to Meta?

Yes.

Re: Meta outage

#713

Post by TulliusCicero » Tue, Mar 05, 2024, 6:24 PM UTC

Analemma_ wrote: post #667

TulliusCicero wrote: post #439

Earlier quoted context omitted.

The Quest 3 is kind of the obvious mainstream consumer choice for a VR headset. Standalone wireless headset, reasonably powerful chipset, can optionally stream from a PC either wired or wireless, good optics/resolution, decent controllers/tracking, large game library, large suite of features (including hand tracking and color passthrough), all for a reasonable price. Not sure any other headset really competes on all…

The parent's comment is about how it quite literally is not a standalone headset, as is currently being demonstrated.

It is a standalone headset. You don't need a tethered gaming PC or console for the Quest series of headsets.

Re: Meta outage

#714

Post by TulliusCicero » Tue, Mar 05, 2024, 6:25 PM UTC

docmars wrote: post #700

citrusybread wrote: post #644

Earlier quoted context omitted.

can we really call it standalone if you need it to phone home to Meta? and doesn't it require an account one of their services too? they did a fantastic job with hardware. I just wish they didn't couple the software so tightly.

It makes me wonder how the world would be if monitor manufacturers did the same thing, it would be unacceptable. I view VR headsets and their peripherals as no different than a mouse, keyboard, and display. Companies requiring all this nonsense to use your device, put in that light, is ludacris.

A silly comparison. A standalone VR headset is more comparable to a smartphone or game console than a monitor or keyboard. The latter have little to no compute.

Re: Meta outage

#715

Post by jtuple » Tue, Mar 05, 2024, 6:26 PM UTC

shkkmo wrote: post #574

lanstin wrote: post #482

Earlier quoted context omitted.

Come on use a little imagination. DNS lookup for the db holding the shard with the user credentials disappears. Code isn’t expecting this, throws a generic 4xx because security instead of a generic 5xx (plenty of people writing auth code will take the stance all failures are presented the same as a bad password or non-existing username); caller interprets this a login failure. Same auth system system used to validate…

> plenty of people writing auth code will take the stance all failures are presented the same as a bad password or non-existing username Those people would be wrong. You can take all unexpected errors and stick them behind a generic error message like "something went wrong" but you should not lie to your users with your error message.

It's about not leaking sensitive information.

If you have different messages for invalid username vs invalid password, you can exploit that to determine if a user has an account at a particular service.

"Invalid credentials" for either case solves this problem.

But sure, let's report infra failures different as "unexpected error"

Now, what happens if the unexpected error is only when checking passwords, but not usernames?

Do you report "invalid credentials" when given an invalid username, but "unexpected error" when given a valid name but invalid password?

If so, you're leaking information again and I can determine valid usernames.

So, safe approach is to report "invalid credentials" for either invalid data or partial unexpected errors.

Only time you could safely report "unexpected error" is if both username check and password check are failing, which is so rare that it's almost not worth handling. Esp. at the risk of doing wrong and leaking info again.

Re: Meta outage

#716

Post by ImPostingOnHN » Tue, Mar 05, 2024, 6:26 PM UTC

ceejayoz wrote: post #707

ImPostingOnHN wrote: post #702

Earlier quoted context omitted.

Ignore the comments on DownDetector for a moment and check out that huge spike in reports recently. Clearly something wrong happened with AWS's user experience. That's something AWS needs to resolve, in the eyes of their users. >The chart shows a big spike this morning, but there was no AWS outage Are you sure? If hundreds of users simultaneously reported there was some sort of outage, particularly a huge spike like…

> Clearly something is going on with AWS's user experience. But that's not the case. It's a false positive. Pick a DownDetector service and open the page every day for a few days. You'll see it most of the time just reflects people waking up in the US timezones.

Is it a false positive, though? The data shows there was an outage. We would need more evidence to conclude hundreds of users, at that 1 spike, weren't actually having issues.

In other words, we have hundreds of people saying there was an outage, and 1 person saying there wasn't.

That's a problem AWS needs to resolve, regardless of what they think might be the root cause. If the users weren't experiencing any issues with AWS, I doubt they'd be reporting it.

Your comment about timing is a good point: if people are working with AWS early in the day, and AWS is giving them problems, then they will probably report problems with AWS early in the day. I wouldn't expect them to report problems while they're sleeping.

Re: Meta outage

#717

Post by dzlobin » Tue, Mar 05, 2024, 6:27 PM UTC

DeusExMachina wrote: post #281

Looking at the Downdetector home page [1], it looks like many more services are having outages, not just the ones owned by Meta, including: - Google - YouTube - Google Play - T-Mobile - X (Twitter) - Discord - TikTok - Pokemon Go - Snapchat It looks like they all have the same failure point. [1] https://downdetector.com

This is just a knock-on affect from 1B+ users moving their timespent elsewhere during the outage

Re: Meta outage

#718

Post by callalex » Tue, Mar 05, 2024, 6:28 PM UTC

ndiddy wrote: post #535

neocritter wrote: post #499

Earlier quoted context omitted.

It's real. Single core performance improves all the time. People overestimate how much power it takes to handle lots of queries per second on a well-tuned system and well-written software in 2024. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

I see the "sorry, we are receiving too many requests, try again in a few minutes" error several times a day on here. I don't think that HN is reliably able to handle the amount of users it currently has.

That is a generic rate limiter that is independent of system load. As far as I can tell if you make more than one request per every 5 seconds, you will always be served the rate limit page.

Re: Meta outage

#719

Post by jermaustin1 » Tue, Mar 05, 2024, 6:28 PM UTC

newswasboring wrote: post #577

ndiddy wrote: post #535

Earlier quoted context omitted.

I see the "sorry, we are receiving too many requests, try again in a few minutes" error several times a day on here. I don't think that HN is reliably able to handle the amount of users it currently has.

I have been using HN daily since I was a teenager. I've seen that message maybe 10 times outside of serious issues in last 15 years. It's strange to me that it happens so frequently for you.

I've been seeing this multiple times a week for the past couple of years. It's gotten worse since 2020. I think that they are preparing to upgrade it, or did upgrade it?

Re: Meta outage

#720

Post by ceejayoz » Tue, Mar 05, 2024, 6:29 PM UTC

ImPostingOnHN wrote: post #716

ceejayoz wrote: post #707

Earlier quoted context omitted.

> Clearly something is going on with AWS's user experience. But that's not the case. It's a false positive. Pick a DownDetector service and open the page every day for a few days. You'll see it most of the time just reflects people waking up in the US timezones.

Is it a false positive, though? The data shows there was an outage. We would need more evidence to conclude hundreds of users, at that 1 spike, weren't actually having issues. In other words, we have hundreds of people saying there was an outage, and 1 person saying there wasn't. That's a problem AWS needs to resolve, regardless of what they think might be the root cause. If the users weren't experiencing any issues…

> Is it a false positive, though?

Yes. AWS was not down this morning.

> In other words, we have hundreds of people saying there was an outage, and 1 person saying there wasn't.

We have hundreds of millions using AWS and AWS-backed services successfully this morning.

I'm out.