Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fastest de-referer service... with AWS Global Accelerator

lifeofguenter.de

Post reply on HN
Print view View original

61–70 of 79 posts

Re: The fastest de-referer service... with AWS Global Accelerator

#61

Post by rstupek »

sudhirj wrote: post #48
ignoramous wrote: post #25

Earlier quoted context omitted.

Correct me if I am wrong: fly's anycast has its limitations compared to Global Accelerator (GA) though: On ocassion, it breaks UDP protocols that are "connection oriented" (like QUIC and WireGuard, though both have built-in capabilities to recover). There is no way to pin traffic to VMs (route / client affinities) or shape traffic. 100+ locations with GA, and two Anycast IPs (in two distinct "zones"). --- Alternative…

For the most part, yes, everything makes sense. There are some things worth noting though: > On ocassion, it breaks UDP protocols that are "connection oriented" (like QUIC and WireGuard, though both have built-in capabilities to recover). Yes, and no, in that QUIC and WireGuard do work consistently, it's not that they break. But Fly doesn't currently offer UDP flow hashing or sessions or pinning. > There is no way to…

Could one run caddy and serve their own TLS termination?

Re: The fastest de-referer service... with AWS Global Accelerator

#62

Post by sudhirj »

rstupek wrote: post #61
sudhirj wrote: post #48

Earlier quoted context omitted.

For the most part, yes, everything makes sense. There are some things worth noting though: > On ocassion, it breaks UDP protocols that are "connection oriented" (like QUIC and WireGuard, though both have built-in capabilities to recover). Yes, and no, in that QUIC and WireGuard do work consistently, it's not that they break. But Fly doesn't currently offer UDP flow hashing or sessions or pinning. > There is no way to…

Could one run caddy and serve their own TLS termination?

Yes, it’s possible to ask for the raw connection to be passed to the application and self-manage TLS.

Re: The fastest de-referer service... with AWS Global Accelerator

#63

Post by RKearney »

lucacasonato wrote: post #35

It is 2021, and AWS Global Accelerator still does not support IPv6. Google Cloud has supported this on their global anycast load balancers since September 2017.

Google is by far the worst cloud provider when it comes to IPv6 support. They only support IPv6 on VPC networks in asia-east1, asia-south1, europe-west2, and us-west2, you cannot access the metadata service over IPv6, and IPv6 on load balances just left Alpha last year I believe.

Re: The fastest de-referer service... with AWS Global Accelerator

#64

Post by lifeofguenter »

alberth wrote: post #37

> ”Cloudflare will not serve traffic from all edge locations, especially Australia is hit hard.” I’ve read a few (dated) posts about bandwidth costs being extreme in Australia and Cloudflare would route around it, causing higher latency in that region. Is that still the case though?

Yes, this is still true in 2021 (why I switched) and even true that you will not always receive the closest PoP even in bandwidth-cheap countries.

For example from Sweden I was usually routed via Denmark. I was Pro user, more PoPs are available to Business or Enterprise customers however.

Re: The fastest de-referer service... with AWS Global Accelerator

#66

Post by lifeofguenter »

kentonv wrote: post #55
mcintyre1994 wrote: post #5

Neat, I didn't know AWS had an AnyCast service like that. The Cloudflare workers issue is a bit disappointing, I remember their blog about eliminating cold starts and how clever it seemed, but I guess it's still not there? On another note have you evaluated fly.io at all for this? This looks right in their wheelhouse of many regions + AnyCast + IPv6, and I could definitely see configuration being simpler with them th…

The latency that this individual was experiencing with Workers wayyyyy back in 2019 was not caused by cold starts, but rather a bug in the workers runtime which caused rare but long pauses. Specifically, the bug involved a hash map with a broken hash function. Here's me publicly facepalming over the issue at the time: https://twitter.com/KentonVarda/status/1189966124688953344 But that was two years ago, Workers has g…

I used cloudflare-workers still this year and only switched a couple of months ago: https://securitytrails.com/domain/url.rw/history/a

The performance was still very bad from a 95 percentile perspective.

Re: The fastest de-referer service... with AWS Global Accelerator

#67

Post by NathanKP »

ignoramous wrote: post #25
sudhirj wrote: post #15

Full disclosure, I work at Fly.io now. This exact setup is easier on Fly.io - our proxy layer runs in 20 regions worldwide with anycast, so your requests hit the nearest region and quickly terminate TLS there. You can also run any Docker container, and either choose regions to run them in, or just set the min/max and ask us to start and stop containers in whichever region has demand, so your deployment follows the su…

Correct me if I am wrong: fly's anycast has its limitations compared to Global Accelerator (GA) though: On ocassion, it breaks UDP protocols that are "connection oriented" (like QUIC and WireGuard, though both have built-in capabilities to recover). There is no way to pin traffic to VMs (route / client affinities) or shape traffic. 100+ locations with GA, and two Anycast IPs (in two distinct "zones"). --- Alternative…

AWS engineer from the container services team here. One small point of clarification on "AppRunner charges for deploys": We only charge for deploys if you are using App Runner's built-in integration to watch your repo, and automatically build/rebuild your container image from source code.

This is not a required feature for App Runner to function though. For example if you are using Copilot with App Runner you can drive the build and release to App Runner from your local dev machine, so there is no extra deployment charge beyond what it costs you for electricity to build your container on your own laptop. You only get charged for App Runner deployment automation when you are using AppRunner as a Github Actions / Jenkins replacement to do the Docker image build on the server side.

Re: The fastest de-referer service... with AWS Global Accelerator

#68

Post by kentonv »

lifeofguenter wrote: post #66
kentonv wrote: post #55

Earlier quoted context omitted.

The latency that this individual was experiencing with Workers wayyyyy back in 2019 was not caused by cold starts, but rather a bug in the workers runtime which caused rare but long pauses. Specifically, the bug involved a hash map with a broken hash function. Here's me publicly facepalming over the issue at the time: https://twitter.com/KentonVarda/status/1189966124688953344 But that was two years ago, Workers has g…

I used cloudflare-workers still this year and only switched a couple of months ago: https://securitytrails.com/domain/url.rw/history/a The performance was still very bad from a 95 percentile perspective.

This isn't the feedback we get from most customers, so I guess there was something unusual going on. Sorry we weren't able to dig into this while it was still relevant to you.

Re: The fastest de-referer service... with AWS Global Accelerator

#69

Post by mwcampbell »

mrkurt wrote: post #57
mwcampbell wrote: post #54

Earlier quoted context omitted.

If I'm not mistaken, you were using Equinix Metal (formerly Packet) at some point. Did that change?

Kind of! We still use Equinix Metal in some regions. Leasing servers and buying colo isn't all that different from Equinix Metal so I'd class that as "our own hardware".

Fair enough. And using multiple upstream providers is of course a good idea.
Post reply on HN