Unpkg CDN down causing dependent website outages

Unpkg CDN down causing dependent website outages(github.com)

40 points by ManWith2Plans 2 years ago | 37 comments

apitman 2 years ago |

Unless you're running a site that you know is constantly getting hits from all over the globe, using a CDN will make your site load slower for some users.

And you almost certainly don't need one for scaling purposes. I've handled frontpage traffic multiple times without.

What I wish existed (or maybe does) is something like a CDN with ~8 global locations that promises to keep your static site in a warm cache for a small fee, without me having to set up a fly.io app manually. That would let my blog always load fast anywhere on the planet even for the first hit in a region.

supriyo-biswas 2 years ago | |

You're looking for a CDN with an integrated storage service, bunny.net has that feature[1]. They also have a volume tier for cheaply serving files[2] which seems to meet your need for a low PoP count (with some discounts to go along with it).

[1] https://support.bunny.net/hc/en-us/articles/360017093479-Und...

[2] https://bunny.net/network/

KomoD 2 years ago | |

> What I wish existed (or maybe does) is something like a CDN with ~8 global locations that promised to keep your static site in a warm cache for a small fee

cloudflare cache reserve or bunny.net as someone else mentioned

madeofpalk 2 years ago | |

> What I wish existed (or maybe does) is something like a CDN with ~8 global locations that promised to keep your static site in a warm cache for a small fee

IIRC this is what Cloudflare Argo is supposed to do? https://www.cloudflare.com/en-gb/application-services/produc...

Rather than routing cache misses to origin, it'll route to other PoPs with the cached content?

grepfru_it 2 years ago |

“Works on my machine”

Depend on external services, die by external services. If you can’t afford redundancy, then you must accept downtime.

I build all of my dependent libraries locally and bundle with my app. For one application, I maintain and build the entire OS from source. I depend on aws,azure cloud storage for my own hosted cdn. I can fail back to my own hosts if necessary.

CoastalCoder 2 years ago |

This is one thing I never understood about web development.

I would have thought the risks from 3rd party production dependencies would make devs do all in their power to minimize them. But IIUC it's a somewhat common practice.

Is there something about the market dynamics that make this a reasonable tradeoff? E.g., the problems are rare and this somehow allows faster time to market?

(Asking as a systems programmer, very much not a web developer.)

afavour 2 years ago | |

> But IIUC it's a somewhat common practice.

I don’t have any data but I really don’t think it actually is that common. I definitely heard it used a lot more in the 2000s jQuery era but not really today. Browsers even have isolated storage these days so the benefits really are infinitesimal.

evilduck 2 years ago | | |

I think it's fairly common. I was reviewing an implementation of a phone number input component last month. It looked great, changing the country code automatically showed the correct country's flag or vice versa select your flag and the country code updated, plus a bunch of useful phone number validation logic was provided, you just add the NPM package and use the resulting component and magic happened. But open up dev tools and you see that all the flags are being brought in from a CDN. The only fix is to fork the library and change asset paths in their code to self host. Many libraries are like this, icon collections, design system web components, whatever. If you're not vigilant it's easy to lazily include CDN hosted assets without explicit intent.

thedanbob 2 years ago | |

Part of it is just because it's easier. There's a bootstrap theme I've used that relies on a Google font. Rather than package the font, which would require extra work on the webdev's part to serve locally, they just stuck a CDN URL in the css.

niutech 2 years ago | | |

But the webfont is not crucial to website UX as a blocking 3rd-party <script src="..."> without async/defer in <head> is.

re-thc 2 years ago | |

> I would have thought the risks from 3rd party production dependencies would make devs do all in their power to minimize them.

Tell that to any developer (not just web) that outsources everything these days e.g. authentication, storage, analytics, database, etc - you name it.

They think it's less risk (and this includes managers and directors in larger companies). Apparently in-house would take forever, cost more and be unable to maintain anything these days.

I don't get it either but it's the current train of thought / trend and is not tied to individual developers.

phailhaus 2 years ago | |

> the problems are rare and this somehow allows faster time to market?

Yep. Entire teams work on these products. You have a couple of options:

1. Use them

2. Make it internally with less staffing, resulting in an inferior product

Option 2 is viable if you really only need a small subset of features/deep customization, but if you run into the edges the problem space will explode on you. At that point, you either have to throw more resources at it or go 3rd party.

daveoc64 2 years ago | |

I'd imagine for many developers, the probability of something like Google's Hosted Libraries (https://developers.google.com/speed/libraries) going down or being hacked is far, far lower than the probability of their own site hosting having a problem.

giancarlostoro 2 years ago | |

Personally if I'm going to rely on someone to host it, I check if my hosting provider does it for me already. I believe Microsoft pre-hosts some JS packages. Google hosts fonts and such as well.

I also miss being able to host random CSS and assets on Tumblr.

Otherwise, it should be on my own CDN. Especially for enterprise sites.

geocar 2 years ago | |

It is because the data (web logs containing web pages, timestamps, ip addresses, cookies, etc) can be sold.

evilduck 2 years ago | | |

It's also because the big reputable third party CDNs are more reliable hosts with better uptime and SLAs than many of the sites that use them.

jimaek 2 years ago |

I invite everyone affected to consider switching to a production focused CDN https://www.jsdelivr.com/

There is also a tool to simplify migration https://www.jsdelivr.com/unpkg

account42 2 years ago | |

I invite everyone (even those not affected in this instance) to consider switching away from relying on random third parties for your hosting. Like wtf how is did this ever become the norm even when there was a slight performance advantage from a shared cache, which doesn't even exist anymore these days.

arkh 2 years ago | | |

A very specific problem with third party hosts : if you use noscript and only allow main domain script as a default, you have to either whitelist those CDN or authorize them on every site using it. Not the best experience. Especially with some sites having dozens of third party scripts so instead of trying to find the right one(s) to authorize you just close the tab and forget about it.

alzoid 2 years ago | | |

I do both. If you are loading a JS lib then check for its existence on the client. If it's not found load the resource from your server. You could also achieve this on the server side.

madeofpalk 2 years ago | |

Why? If you care about being even remotely reliable (hinted at with "production-focused"), why would you do this? Just use the same host as where you serve everything else from.

Browsers have partitioned caches per origin for over 10 years, so there's no performance gains from getting cache hits from other websites.

cagenut 2 years ago |

its a fascinating little tech-anthropology quirk that front-end/web developers use the term "CDN" to mean a different thing from how devops/sre/infra people use the term.

in the strictest sense, unpkg is not a cdn. unpkg is a javascript library hosting service that uses cloudflare as a cdn. cloudflare is not down, therefore this headline "unpkg cdn down..." reads as a massive "oh shit!" to infra/devops type cloudflare customers who then have to immediately worry that their site is down, only to realize no, they're fine, this is just devs using the term to mean a different thing (roughly: "third party javascript host").

re-thc 2 years ago | |

> its a fascinating little tech-anthropology quirk that front-end/web developers use the term "CDN" to mean a different thing from how devops/sre/infra people use the term.

Do they? Same to me.

> in the strictest sense, unpkg is not a cdn. unpkg is a javascript library hosting service that uses cloudflare as a cdn.

This is just arguing over semantics. It even says on the website that unpkg CDN is powered by Cloudflare.

By your analogy if a website hosted on AWS is down, is the whole of AWS down? If I provide managed kubernetes on GCP and my service is down, does that make GKE or GCP down? No.

A CDN is a CDN just like a website is a website, whether it's backed by Wordpress, NextJs or any other thing.

pier25 2 years ago |

So what was the issue?

Unpkg runs on Fly with Cloudflare as CDN.

taspeotis 2 years ago |

I assume the developers who use a free third party service for serving their dependencies are the same devs who :pikachu_face: when they are told they can’t statically link GPL libraries into their proprietary apps.

afavour 2 years ago | |

Personally I’d say the overlap between web developers linking out to a JS CDN and native developers statically linking GPL libraries is probably pretty small.