Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Weave is kinda slow

generictestdomain.net

Post reply on HN
Print view View original

81–90 of 164 posts

Re: Weave is kinda slow

#81

Post by Confusion »

otterley wrote: post #66
Confusion wrote: post #36

Earlier quoted context omitted.

So what are the decades old solutions to these problems?

Thankfully, they are all discussed in the linked article.

I read the article: if they are, that is quite unclear to me.

Possible answers that are discussed are only 'some sort of IP encapsulation', which is vague and GRE, which is just a single solution. He doesn't seem to disapprove of VXlan, so probably something was missing in 'IP encapsulation and GRE'. Was 'all problems solved decades ago' merely hyperbole or is there actually something to it?

Re: Weave is kinda slow

#82

Post by wmf »

justincormack wrote: post #65
q3k wrote: post #29

Earlier quoted context omitted.

Actually, userspace packet switching can be fast (10GbE linespeed-fast) thanks to approaches like DPDK [1], where a userspace process has zero-copy, direct access to NIC ring buffers. 1 - http://dpdk.org/

The problem is Docker containers expect a system network endpoint, while dpdk gives you a userspace network endpoint.

Yep, DPDK is great for NIC-to-NIC traffic and maybe for VM-to-NIC now that vhost-user exists. But that's leading people to suggest DPDK as the answer for everything, which it isn't.

Re: Weave is kinda slow

#83

Post by wmf »

otterley wrote: post #69

I'm not sure I even understand the problem that weave and Docker bridging/NAT solves for real world cases. IP allocation for containers isn't a problem for most networks, is it? Certainly AWS can give you up to 8 IPs per instance, and every datacenter I've ever worked in can give you even more, if you ask. All you have to do is spin up additional virtual NICs with virtual MACs and use DHCP to assign IP addresses to t…

Docker was designed to be very easy to get started on your laptop with one IP address and it looks like some people are getting stuck in that model.

I agree that if you are running on AWS VPC or some other overlay you should just use VPC for container networking. You shouldn't overlay your overlay. But there isn't any tooling that I know of to do that.

Re: Weave is kinda slow

#84

Post by weavenetwork »

msutherl wrote: post #75
weavenetwork wrote: post #58

Earlier quoted context omitted.

I don't think anyone meant, or said, "fuck you". Why are you even implying such a thing? Ultimately we can't work on even a fraction of the features that every person wants, and Laurie said his idea was simple to implement... so why not show how it's done? Honestly, it's not that sinister and it is certainly not rude.

To put it simply, if @monadic were receptive to @lclarkmichalek's ideas, why did he end the conversation? But let's look at the Tweet in question: "@lclarkmichalek @weavenetwork please, if it is so simple and robust you are very welcome to contribute a patch." 1. He says "please", which in this case is sarcastic. 2. Then he says "if it is so simple," which is a dismissive way of saying "you think that it's simple, bu…

I'm sorry but I find your interpretations of 1-4 completely uncharitable and unreasonable.

Re: Weave is kinda slow

#85

Post by kordless »

weavenetwork wrote: post #47
kordless wrote: post #27

Earlier quoted context omitted.

I'm thinking replies like this should come from an individual, not an account representing a company. Having an individual behind the words (instead of a loose consensus mechanism for a company) goes a long way to establishing trust. Hoping to see a direct address of the observations raised in the post!

I'm not sure why you think so, but fwiw, irl, I am alexis at weave dot works

Because it represents a loose consensus mechanism, as I explained. That's fine for marketing, but not technical rebuttal to a claim.

Re: Weave is kinda slow

#86

Post by markbnj »

pnathan wrote: post #57
weavenetwork wrote: post #22

hello, weave here. a few very quick comments! weave has lots of very happy users who find that weave is plenty fast enough for their purposes, see eg http://blog.weave.works/2015/02/24/get-your-kicks-on-cloud66... the strong points of weave network, as it is right now, are ease of use (not to be sniffed at), and enormous flexibility. it is really quite easy to create an application involving containers, that runs any…

The 'good enough' attitude does not lead to quality in the long run. It drags the entire system down. (C, PHP, Windows, etc).

Except that people who can recognize when something is indeed "good enough" and then move on to the next most important thing are ultimately the only people who get things done and accomplish goals.

Re: Weave is kinda slow

#87

Post by weavenetwork »

api wrote: post #72
bascule wrote: post #39

Weave has other issues... like they homebrewed their own ECDHE-PSK-based transport encryption protocol on top of NaCl. Homebrewing your own crypto, especially transport encryption which has to solve problems like key exchange, replay attacks, etc is generally the wrong answer. Also, even if they were using a standard transport encryption like SSL/TLS or IPSEC, PSKs are generally frowned upon for anything other than p…

You speak as if SSL/TLS hasn't been a rat's nest of problems. If they did it competently, there is no reason they couldn't implement their own crypto encapsulation. As far as why they rolled their own... have you ever actually tried to use IPSec? It's a usability nightmare. It's also problematic in containers due to container permission issues. I suppose they could have used DSSL (datagram SSL) but that'd probably ad…

True. We did try ipsec, and couldn't find an implementation that was oss, demonstrably safe, and easy enough to pull into a first release. As weave matures, we'd love to work with experts to implement standard solutions, even if they are costly to put in place.

Re: Weave is kinda slow

#88

Post by com2kid »

api wrote: post #76
msutherl wrote: post #51

Earlier quoted context omitted.

This "our project is open source, feel free to submit a patch" dismissal is so passive aggressive. If you mean "fuck you," then just say "fuck you." That said, you shouldn't be saying "fuck you" in the first place: it's rude, it contributes to bad vibes in the OSS community, and it hurts you more than anybody. Try instead something like: "I'm having trouble understanding your argument, do you mind explaining in more…

"Fuck you" would have indeed been a more appropriate response to "how dare you try to implement crypto" FUD. Crypto is hard, but it's no harder than a lot of other hard things. If you think someone's crypto is broken, you could point out why you think it's broken. I see no evidence that consigning crypto to a forbidden zone is going to improve real world security, and the old "mature" cruftpiles seem to manifest prob…

> Crypto is hard, but it's no harder than a lot of other hard things.

Crypto is a LOT harder than some other things.

3d graphics programmers don't have to worry about side channel attacks through timing disclosures through random numbers returned over an HTTP GET.

Physics simulations don't have to worry about tens to hundreds of millions of dollars of losses because Intel changed the L2 cache slightly in some revision of a processor and now it is possible to glean a couple bits of information about the entropy one uses.

Of all the projects I have worked on, maybe the C/C++ compiler had a set of worries close to what an encryption suite has.

You could toss me into almost any field of software engineering and after a few months I'd feel good. Some of them would have a longer ramp up time (order of months). Some of them might require me to go take a few online courses to learn the field (3D, physics sims, etc).

Encryption requires an entire life of devotion. New attacks are coming out all the time. There is so much financial incentive in the field that the competition is insanely fierce.

3D graphic techniques get pushed forward by publishers wanting the latest AAA game title.

Encryption gets pushed forward because they are trying to outrun either large international criminal organizations or entire governments.

Re: Weave is kinda slow

#89

Post by weavenetwork »

weavenetwork wrote: post #22

hello, weave here. a few very quick comments! weave has lots of very happy users who find that weave is plenty fast enough for their purposes, see eg http://blog.weave.works/2015/02/24/get-your-kicks-on-cloud66... the strong points of weave network, as it is right now, are ease of use (not to be sniffed at), and enormous flexibility. it is really quite easy to create an application involving containers, that runs any…

edit:

here is a kubernetes link: https://github.com/GoogleCloudPlatform/kubernetes/pull/4483#...

the author, who was part of the MS Azure team at the time, said: "as of today, this Weave/CoreOS tool and doc is the only way I was able to provision a Kubernetes cluster in Azure"

Re: Weave is kinda slow

#90

Post by weavenetwork »

kordless wrote: post #85
weavenetwork wrote: post #47

Earlier quoted context omitted.

I'm not sure why you think so, but fwiw, irl, I am alexis at weave dot works

Because it represents a loose consensus mechanism, as I explained. That's fine for marketing, but not technical rebuttal to a claim.

Using an account that I share with other people in the same team is not the same as 'marketing'. I am sorry if this somehow offends, but think of the handle as just one poster.
Post reply on HN