Earlier quoted context omitted.
> That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right But this boils down to If you build systems using a high level of skill and foresight, it's easy to do . This is of course not a tautology, but a contradiction. I agree that inexperienced developers can…
> If you build systems using a high level of skill and foresight, it's easy to do. The point being made here is not necessarily a flippant 'git gud'. Instead, it is a statement that problems are tractable, and that getting some things right up-front can have good pay-offs down the road. In other words, don't give up and try to figure out what is good and bad practice.
Malicious attack on Wikipedia – what we know and what we’re doing
211–220 of 320 posts
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#212Earlier quoted context omitted.
Any serious mitigation solution must be BGP based, not proxy. Besides its technical merits and convenience, it also minimizes the risk of a benevolent controller (e.g. Matthew Prince of Cloudflare) ruining your company, because it becomes your upstream provider only during the attacks. Otherwise the GRE tunnels are not in use. The IP addresses are still yours always. We used Verisign for mitigation of a 44Gbps volume…
You appear to be extremely mad Cloudflare stopped proxying a website that encouraged large gun massacres.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#213Earlier quoted context omitted.
OTOH, shouldn't it be easier to scale Reddit horizontally by sharding the subreddits into separate DBs?
Certainly not trivially - the subreddits are not wholly independent entities. User accounts are shared between them, for instance, and every post a user makes is (searchably) linked to their account, regardless of which subreddit they posted it in. Users can also send each other private messages, and this does not take place in the context of any particular subreddit.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#214Earlier quoted context omitted.
You appear to be extremely mad Cloudflare stopped proxying a website that encouraged large gun massacres.
How did 8chan "encourage" large gun massacres exactly? By allowing users to post content?
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#215Just want to mention, WMF has a very small but elite team of engineers. Amazed they maintain an Alexa top 5 site with many orders of magnitude less engineering staff than Facebook or Reddit. I think they must count ~100 engineers? I can't imagine what such a small team must be going through with a major DDOS - wish them well in their efforts!
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#216Apparently this group is behind it. Also attacked WoW and twitch servers.. https://twitter.com/ukdrillas
Part of the liability should be shared with the people owning the compromised machines these crazies are using for their attacks, otherwise attacks like these will never stop as long as enough free “ammunition” is being left around by incompetent people who can’t be bothered to secure & monitor their systems properly. Edit: in reply to some of the (valid) counter-arguments, I'd like to say that there are indeed many…
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#217Earlier quoted context omitted.
> Serving giant websites isn't all that hard if you're just spewing out SQL queries into html templates. It all scales in all directions with a properly thought through architecture. No. 1. Your comment makes it sound like Wikipedia is just, or mostly, serving read-only content, which is far from true. Yes, static read-only content is significantly easier to serve than dynamic, editable one, but Wikipedia is the latt…
I've never heard anyone in my life say they could rebuild MS office in a weekend. What, in your opinion, would be the work needed to go from a 100k monthly active user site to a wikipedia scale site - that would be comparable to rebuilding MS office?
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#218Earlier quoted context omitted.
Wikipedia is blocked in China. It's politically undesirable for 1/8 of the human population...
I think undesirable here describes something like white nationalists. They have a problem getting web hosting.
Additionally, helping to block Wikipedia because China says so is much easier to excuse than blocking 4chan - they would just be complying with local regulations after all.
[1] https://www.cloudflare.com/press-releases/2015/cloudflare-an...
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#219Earlier quoted context omitted.
> Programming isn't that hard if you just do it right. That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right. Obviously that's not productive feedback without actually helping them be better, but it's far from a tautology. For anyone wondering, a tautology i…
> That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right But this boils down to If you build systems using a high level of skill and foresight, it's easy to do . This is of course not a tautology, but a contradiction. I agree that inexperienced developers can…
Yes.
> This is of course not a tautology, but a contradiction.
It's not quite a contradiction! If you bill $1 for changing the bolt, and $9,999 for knowing which bolt to replace, this shows that the work is easy, but the experience required to make the work easy is not easy. If the master can draw it in seven strokes, but you don't see the seventy thousand strokes they did before, it looks easy, and in fact it is easy, for the master but not for the novice.
> I agree that inexperienced developers can, as it were, 'make life hard for themselves', but that's (trivially) due to their inexperience. I don't think there's a silver bullet for inexperience.
That's right. However, we can also make life hard for each other, and there are some solutions for that that are better than doing nothing.
> Over-engineering is bad, as is under-engineering. Fuzzy principles like 'YAGNI' can't be applied without skilled discernment, which means experience.
Yes. This is why we have code reviews, design reviews, pair programming, and so on, but these aren't silver bullets either and there is no silver bullet, but if these things lead to increased awareness of why and not just what and how, then we can accelerate the process of acquiring that discernment. As Dijkstra said, if it goes to the grave with you and you didn't pass it on, you didn't really do your job as a senior engineer (paraphrasing).
>> Programming is hard, but we make it much harder than it has to be by doing it spectacularly wrong in many ways, both individually and collectively.
> I think I agree with this, but it depends on specifics. What sorts of things are you thinking of?
Using the wrong tool for the job. Using too many tools for the job. Using tools that do not afford mastery, because they are too complex for anything built on top of them to be comprehensible.
This is all quite abstract. A specific example: we (the JavaScript community) had a good thing in that JS was a small, human-scale, useful and commercially valuable language with applications beyond its initial environment on the web. We got excited and built the npm package archive, and filled it up, and now we have unmaintainable, incomprehensible piles of trash piled upon trash that can't possibly be used as a foundation for anything reliable, performant, or maintainable. This is unfortunate. What's even more unfortunate is that this piled-up-trash approach still has momentum, still lets people get useful work done, and still has some value to the community. So we keep using it, and even keep piling more on. It takes considerable effort to step back from all this, take a collective mulligan, and start over with a principle of taking things away to make things better, rather than adding more hacks to hide existing hacks.
This is one example of many, but I mention this one because I was there when JS was simpler and better and I watched as we made it markedly worse. I would have recommended JS as a first language to beginners when node.js and npm were new, and I did, but I cannot now recommend them in good faith, because they have become antagonistic to quality and to mastery of the craft.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#220Earlier quoted context omitted.
The question is whether you feel good enough about that probability to be held liable if the malicious code was hidden good enough. Also, some cases might be obvious on Windows PCs, but I don't think that's necessarily the case with phones. Take note that websites can also send malicious packets. When you load a webpage, the code is downloaded and immediately executed. Are you OK with being held liable for visiting a…
Liability boundary is an important question. There is no simple answer. Couple of years back owner of the abandoned building was declared liable of the death of the kid who entered to the fenced building despite all the signs no trespassing and so on. Neither your example nor mine negates that there should liability for various voluntarily and involuntarily acts, own or third party.
Honestly, that doesn't sound right. I hope I'm misjudging because of lack of details.