Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Dependency Has Risks

blog.miloslavhomer.cz

Post reply on HN
Print view View original

171–180 of 238 posts

Re: Microsoft Dependency Has Risks

#171

Post by graemep »

bitpush wrote: post #43
hilbert42 wrote: post #41

I still find it hard to believe that so many people and companies are prepared to use Microsoft's online/cloud services. Not ony is this a single point of failure but it's one they've no control over whatsoever. Same goes for Google/Youtube etc. It's as risky as flying a passenger jet with only one engine. What are they thinking, why are they prepared to risk everything? It boggles my mind.

Most companies enter into a contract with Microsoft. That is infinitely better than using a 2 person startup that runs out of a garage. Contracts come with strict terms of service, SLAs, service expectations and such. If you had a restaurant, would you source your produce from your trusty friend who grows vegetables as a hobby or from an established mega-farming-company?

> That is infinitely better than using a 2 person startup that runs out of a garage.

The big advantages with the 2 person startup are

1. A small business a customer who matters to them, and you will get better service

2. You can get terms such as having control of backups, hosting of your choice, and access to systems so you can get someone else to maintain things

> Contracts come with strict terms of service, SLAs, service expectations and such.

How close do these come to covering the consequential losses of an extended outage?

Re: Microsoft Dependency Has Risks

#172

Post by dspillett »

duped wrote: post #60
bob1029 wrote: post #18

The trick with Microsoft is to very carefully separate the good parts from the bad ones. Labeling all of Microsoft as banned is really constraining your technology options. This is a gigantic organization with a very diverse set of people in it. There aren't many things like .NET, MSSQL and Visual Studio out there. The debugger experience in VS is the holy grail if you have super nasty real world technology situation…

Microsoft, for all their warts, has the absolute best documentation for every public API in Windows. I'd go so far as to say it's better on average than manpages in Linux and BSD and light years better than the actively hostile bullshit from Apple. Submitting a bug report though, you gotta know people or know where to ask.

> Microsoft, for all their warts, has the absolute best documentation for every public API in Windows.

That is true in some areas of MS's output, but far from all. Some of their documentation is concise but understandable, complete, and up-to-date. Some of it is auto-generated garbage that is only of use if you already know what you are doing and looking for a remainder of a detail.

Some of it is absolutely awful, I've run into numerous issues with Azure related documentation. This is in part because that side of things is rapidly evolving, but sometimes the new information isn't even there, and sometimes it is faff to identify it from information about the previous couple of iterations that are now deprecated. One recent example: installing some of their SQL Server and Azure storage access tooling on the latest Ubuntu LTS release (24.04, now over a year old). The repos are there, maintained, and supported, but the documentation doesn't mention anything beyond 22.04. Yes it is easy to work out what to change, mostly just substitute 24.04 for 22.04, but the docs should be updated. Also, instructions from different documents, all from MS, put their public keys for package signing in different places, which can cause confusion (not an issue for someone like me familiar with apt & related tooling, but I can imagine it being very frustrating to someone less experienced with those parts).

Re: Microsoft Dependency Has Risks

#173

Post by jiggawatts »

herbst wrote: post #160
jiggawatts wrote: post #148

Earlier quoted context omitted.

It’s wildly different now. The first release that would run at all on Linux was 9 years ago and was essential a beta or maybe just a proof of concept. The current .NET 9 version has trivialised my development projects to the point that I feel bad for taking the customer’s money. The only problem I’ve had with .NET is that it doesn’t have the same breadth of third party libraries that Java has. If you need something r…

That sounds magical. What makes it so superior tho? You mean in terms of ready made libraries doing the heavy lifting? If so would nodejs or rails not be even easier? Or do you mean specific on desktop applications? I have no idea about that field

ASP.NET Just Works and has Batteries Included.

As an example, just over the last few days, I hit all of these common issues with Node.js apps (that don't happen with ASP.NET):

1) Node apps are typically a "transpiled language on a language" because JavaScript is unusable for large-scale software development so everyone uses TypeScript compiled to JavaScript instead. But this is a hack! A clever, useful hack, but a hack nonetheless. You can't go two steps without finding the rough edges, such as "any" everywhere or the use of "monkeypatching" which makes static analysis impossible for either tools or humans. (This reminds me of the earliest days of C++ where compilers like Cfront transpiled C++ to C.)

2) It's single-threaded! Sure, this is simpler, right up until it's not. It means you need about one process per core. Which means that on typical hardware you get a max of 4-8 GB of memory per process, because that's what most hardware has per core. This means in-memory caching is generally too inefficient. (I finally understand why Redis is so popular!)

2b) Okay, let's take a look at Redis! What do you mean it doesn't properly support multiple databases per cluster!? It's single threaded too!? Wat!? Is this a database for children?

3) It takes minutes to start! I hope you never have an emergency update that needs to go out right now!. ASP.NET takes seconds at most. This is largely because it's precompiled and ships as a small number of large binary files instead of millions (literally!) of tiny files that are very slow on almost all server-grade storage. There's now ahead-of-time (AoT) compilation modes for ASP.NET that make it comparable to C++, Rust, or Go in startup performance!

4) I'm sure Node people have heard of certificates and HTTPS, but I'm fairly certain they think it's a fad and it'll just "go away" eventually.

5) NPM libraries are under constant churn. Just updating packages requires minutes of 100% computer power to resolve the dependency graph logic... which has changed. In a breaking way. Either way, it can be mathematically impossible to disentangle the mess before the heat death of the universe. I'm not kidding! It's possible to get into a situation where "error: timed out" doesn't quite do it justice.

6) In .NET land there's basically only two ORMs used: Entity Framework from Microsoft and Dapper from StackOverflow. They work fine. Someone at $dayjob picked "typeorm" for Node. Is it the best? Who knows! There's dozens to pick from! None of them work properly, of course. I do know that typeorm doesn't allow me to pick my own database driver. Why? Because they're too busy, according to the GitHub issue tickets. Entity Framework uses a pluggable interface with dozens of well-supported implementations. This is because the entire platform, all of its database support, and the ORM on top were written by one vendor in a coordinated way and is pluggable via interfaces in the standard library instead of a hodge-podge of random code thrown together by literal children. [2]

Etc, etc...

[1] Under-funded is the more generous reason.

[2] A very significant portion of NPM packages were written by people under the age of 18. This is either commendable or horrifying depending on your perspective. It's hard to prove though, because contributions are effectively anonymous.

Re: Microsoft Dependency Has Risks

#174

Post by ArcHound »

graemep wrote: post #168

I am not convinced by the argument about cost, particularly "You’d still have to be more efficient than Microsoft though - that’s a challenge" 1. Most, even quite big organisations, do not have the complexities of operating at the scale of MS services. 2. I have no idea how efficient MS are. maybe they are highly efficient, but I know enough big businesses are inefficient that it is not a given.

Fair point.

If you take it directly on a Walmart scale, then I'll argue that you can't outcompete Microsoft. Note that you need to bring your own ID, Auth, Office, desktop system, etc.

If you have a smaller scale, then you've invested less resources into MS therefore you have a lesser budget to work with.

Re: Microsoft Dependency Has Risks

#175

Post by ArcHound »

jiggawatts wrote: post #47
th0ma5 wrote: post #38

Earlier quoted context omitted.

I have a lot of respect for organizations that get a lot done with Microsoft technologies. I think your perspective could be thought of as the benefits of vertical integration and vendor lock in. These do help people get things done! In the academic and open source world those things are fought against because you don't want to be at the mercy of the software developer in the context of certain rights. I think for ev…

Perfectly valid points. I've worked in academia, and their insistence on non-Microsoft technologies was helpful in certain fields where openness and long-term reproducibility is critical. The downside is that this produces a microcosm of obscure technologies that can have... strange effects on industry. Some FAANG-like companies have a habit of hiring only recent graduates, so their entire staff is convinced that wha…

I agree with this, I see the AD as critical. Do you please have a source for these numbers? Would love to include it in the article.

Re: Microsoft Dependency Has Risks

#176

Post by herbst »

jiggawatts wrote: post #173
herbst wrote: post #160

Earlier quoted context omitted.

That sounds magical. What makes it so superior tho? You mean in terms of ready made libraries doing the heavy lifting? If so would nodejs or rails not be even easier? Or do you mean specific on desktop applications? I have no idea about that field

ASP.NET Just Works and has Batteries Included. As an example, just over the last few days, I hit all of these common issues with Node.js apps (that don't happen with ASP.NET): 1) Node apps are typically a "transpiled language on a language" because JavaScript is unusable for large-scale software development so everyone uses TypeScript compiled to JavaScript instead. But this is a hack! A clever, useful hack, but a ha…

That's really an insightful answer I enjoyed reading. Really brings me back!

I dislike nodejs for the same reasons. But do get the feeling that rust and go, maybe even something more exotic like elixir would be good alternatives as well for your use case.

I have barely anything to compare to your requirements tho. I personally would get panic attacks and couldn't sleep anymore if my dependencies aren't open source and I would depend on a company for any reason. But that's just me, it definitely sounds very mature

Re: Microsoft Dependency Has Risks

#177

Post by herbst »

entuno wrote: post #169
herbst wrote: post #162

Earlier quoted context omitted.

What do people consider as NAS? A Network Harddrive? If you buy a "normal" Synology Nas it comes with shared calenders, office, VPN control, several backup options including Aws and Azure and a lot more. Typical setup and forget setup, thanks to their high package quality. And I am sure there are even better options than a household Synology. But putting everything in a cloud and fully depending on a single provider…

Well yeah, that's what a NAS is. What you're talking about is just self-hosting a all-in-one server, like people used do with Windows Small Business Server, and all the problems and limitations that comes with. And plenty of small businesses and hobbyists do that, and then after they "setup and forget" it they get compromised or lose their data a few years down the line.

Yes and no. I've been in companies with windows business servers that were a constant pain to manage. Whereas the modern NAS, Building on stable open source software mostly offers the 'just works' experience people are looking for + the business grad documentation.

Why would using a NAS (or small server) mean ignoring any basic logic (and business requirements) and not having off-site backups?

Re: Microsoft Dependency Has Risks

#178

Post by entuno »

herbst wrote: post #177
entuno wrote: post #169

Earlier quoted context omitted.

Well yeah, that's what a NAS is. What you're talking about is just self-hosting a all-in-one server, like people used do with Windows Small Business Server, and all the problems and limitations that comes with. And plenty of small businesses and hobbyists do that, and then after they "setup and forget" it they get compromised or lose their data a few years down the line.

Yes and no. I've been in companies with windows business servers that were a constant pain to manage. Whereas the modern NAS, Building on stable open source software mostly offers the 'just works' experience people are looking for + the business grad documentation. Why would using a NAS (or small server) mean ignoring any basic logic (and business requirements) and not having off-site backups?

SBS server "just works" if you just set it up once and then ignore it, your requirements never change, and and don't do basic things like maintenance and installing updates as well.

People absolutely should be setting up offsite backups. And more importantly, testing them so that they can prove that they work. But if they have no technical team then neither of those things are going to happen.

Re: Microsoft Dependency Has Risks

#179

Post by graemep »

ArcHound wrote: post #174
graemep wrote: post #168

I am not convinced by the argument about cost, particularly "You’d still have to be more efficient than Microsoft though - that’s a challenge" 1. Most, even quite big organisations, do not have the complexities of operating at the scale of MS services. 2. I have no idea how efficient MS are. maybe they are highly efficient, but I know enough big businesses are inefficient that it is not a given.

Fair point. If you take it directly on a Walmart scale, then I'll argue that you can't outcompete Microsoft. Note that you need to bring your own ID, Auth, Office, desktop system, etc. If you have a smaller scale, then you've invested less resources into MS therefore you have a lesser budget to work with.

I wonder. Even Walmart is still not operating at the scale the hyperscalers do, and their systems will be far less varied, far more homogenous and under their own control. They are big enough for a lot of economies of scale to kick in.

> Note that you need to bring your own ID, Auth, Office, desktop system, etc.

Do Microsoft entirely manage all these systems for them? Otherwise they just swap managing one system for another. A quick search seems to show Walmart do hire sysadmins so the current cost on top of what they pay MS is not zero.

Re: Microsoft Dependency Has Risks

#180

Post by tiahura »

mrweasel wrote: post #110
iimblack wrote: post #50

Earlier quoted context omitted.

How do you separate the good from the bad? What do you do when Microsoft changes the good things into bad things? My take is that Microsoft consistently makes bad things and makes "good" things into "bad" things; so, I don't have much expectation or faith that anything that I currently think is "good" will stay that way.

> How do you separate the good from the bad? Developer tools and enterprise stuff good (mostly). Consumer products bad.

MS office is 30 years ahead of open office.
Post reply on HN