Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visual Studio Code 1.7 overloaded npmjs.org, release reverted

code.visualstudio.com

Post reply on HN
Print view View original

31–40 of 94 posts

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#31

Post by ec109685 »

seldo wrote: post #13

I'd just like to say on behalf of npm that Microsoft's handling of this incident was A+. As soon as we alerted them to the issue they were all hands on deck and did a rollback. We've been really pleased that Microsoft chose to put their @types packages into the npm registry rather than a separate, closed system, and in general happy with Microsoft's support of node and npm. We're confident we can make the new feature…

"Many requests to the registry as the entire nation of India" per what time unit?

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#32

Post by oridecon »

ec109685 wrote: post #31
seldo wrote: post #13

I'd just like to say on behalf of npm that Microsoft's handling of this incident was A+. As soon as we alerted them to the issue they were all hands on deck and did a rollback. We've been really pleased that Microsoft chose to put their @types packages into the npm registry rather than a separate, closed system, and in general happy with Microsoft's support of node and npm. We're confident we can make the new feature…

"Many requests to the registry as the entire nation of India" per what time unit?

Approximately 3 new JS frameworks per hour.

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#33

Post by ceejbot »

mohamedhegazy wrote: post #30
paulftw wrote: post #18

Earlier quoted context omitted.

So one day they switched their entire user base to rely on a 3rd party free service without any load testing or heads up? What could possibly go wrong?

We have been testing this on insider builds of vscode for a few weeks as well as preview builds of visual studio with no issues. We were just notified today by npm that we are flooding their servers.

Your installed base is quite large indeed! Your testing load was a drop in the bucket of our daily usage, but once you released to VS users we noticed. Should be straightforward to design something that works for this access pattern and load, now we know what you need. Typeahead package name completion would be a neat feature.

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#34

Post by popmystack »

seldo wrote: post #22
Arnavion wrote: post #14

Earlier quoted context omitted.

Can you elaborate on what the issue is and how you want it to be fixed? Is it just something like rate-limiting requests or something more fundamental? Edit: Answered at https://news.ycombinator.com/item?id=12861118

A VSCode person can (and probably will) answer in more detail, but at heart it's simple: if you want to add type-checking goodness to a library that isn't itself written in TypeScript, you can create a thing called a declaration file: https://github.com/DefinitelyTyped/DefinitelyTyped Microsoft publishes a list of known good declaration files for popular npm packages to npm, under the scope @types: https://www.npmjs.…

>which is why most CDNs don't cache 404s in the first place.

That definitely isn't technically true. There are other mechanisms usually involved in these cases, and should be for any publicly available resource. Otherwise you're begging for someone to bypass a good bit of your publicly available resource's security.

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#37

Post by seldo »

ec109685 wrote: post #31
seldo wrote: post #13

I'd just like to say on behalf of npm that Microsoft's handling of this incident was A+. As soon as we alerted them to the issue they were all hands on deck and did a rollback. We've been really pleased that Microsoft chose to put their @types packages into the npm registry rather than a separate, closed system, and in general happy with Microsoft's support of node and npm. We're confident we can make the new feature…

"Many requests to the registry as the entire nation of India" per what time unit?

I was a bit vague :-) India's about 10% of total requests on any given day. VSCode was 10% of requests for a couple of hours.

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#38

Post by vonklaus »

PudgePacket wrote: post #26

I wonder if any warning was given to npm that they would be getting this potentially huge new source of traffic. It doesn't seem to be mentioned anywhere.

Eh, NPM is a pretty core service and both sides probably should have done things a bit differently. I don't neccessarily think vscode needed to reach out to NPM to let them know they were going to be consuming their public API. Both teams appear to be in communication as a result however-- which is good.

This will likely lead to more fault tolerant systems on both projects and hopefully more collaboration & features in the future.

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#39

Post by raisedadead »

BenjaminCoe wrote: post #24

As one of the folks on the front-lines helping patch this, I certainly have no hard feelings; and I'm excited to be able to support this feature properly ... also ... not going to lie, this was the first time we've gotten to test several of the checks and balances we have in the npm registry which I was jazzed about :)

Thanks, Benjamin, Laurie and everyone else for mitigating this, it feels great to know when the community chimes in together for such highly unanticipated scenarios.

On that note, however, respectfully I believe that features which have the potential of hitting the registry so bad should first be beta tested on a private registry and moved on to the high traffic serving CDNs of npm.

And 10% of the daily traffic is from India??? Whoa, every day is a school day.

Re: Visual Studio Code 1.7 overloaded npmjs.org, release reverted

#40

Post by CapacitorSet »

vonklaus wrote: post #38
PudgePacket wrote: post #26

I wonder if any warning was given to npm that they would be getting this potentially huge new source of traffic. It doesn't seem to be mentioned anywhere.

Eh, NPM is a pretty core service and both sides probably should have done things a bit differently. I don't neccessarily think vscode needed to reach out to NPM to let them know they were going to be consuming their public API. Both teams appear to be in communication as a result however-- which is good. This will likely lead to more fault tolerant systems on both projects and hopefully more collaboration & features…

>I don't neccessarily think vscode needed to reach out to NPM to let them know they were going to be consuming their public API.

VSCode is used by a non-negligible number of users, and seems to rely on npm to operate at its best. It would have been good etiquette to let npm know, even though they couldn't forecast this exact situation.

Post reply on HN