Lichess: Post-Mortem of Our Longest Downtime(lichess.org) |
Lichess: Post-Mortem of Our Longest Downtime(lichess.org) |
BTW consider donating if you use lichess.
It looks like the servers are individually managed via OVH or similar, rather than running their own gear in co-location or similar. Wonder why?
I wonder what the "Misc dev salaries" is for - only curious because it's a flat $5k
I really appreciate the benefits package for patrons. Thibault is zee best.
It's also weird seeing that they are still waiting on their provider to tell them exactly what was done to the hardware to get it going again, that's usually one of the first things a tech mentions: "ok, we replaced the optics in port 1" or "I replaced that cable after seeing increased error rates", something like that.
There are many red flags which beg questions.
That said, I stopped taking them at their word years ago, this isn't the first time they've had dubious announcements following entirely preventable failures. In my mind, they really don't have any professional credibility.
People in the business of System Administration would follow basic standard practices that eliminate most of these risks.
The linked post isn't a valid post-mortem, if it were it would contain unambiguous details of the timetables and specifics, both of the failure domains and resolutions.
As you say, a network connector could mean any number of things. Its ambiguous, and ambiguity in technical material is used to hide or mislead most times which is why professionals detailing a post mortem would remove any possible ambiguity they could.
It is common professional practice to have a recovery playbook, and a plan for disaster recovery for business continuity which is tested at least every 6 months, usually quarterly. This is true of both charities and business.
Based on their post, they don't have one and they don't follow this well known industry practice. You really cannot call yourself a System Administrator if you don't follow the basics of the profession.
TPOSNA covers these basics for those not in the profession, its roughly two decades old now, it is well established, and ignorance of the practices isn't a valid excuse.
Professional budgets also always have a fund for emergencies based on these BC/DR plans. Additionally, using resilient design is common practice; single points of failures are not excusable in production failure domains especially when zero-downtime must be achieved.
Automated Deployment is a standard practice as well factoring into RTO and capacity planning improvements. Cattle not Pets.
Also, you don't ever wait on a vendor to take action. You make changes, and revert when the issue gets resolved.
First thing I would have done is set the domain DNS TTL to 5 minutes upon alerted failures (as a precaution), and then if needed point the DNS to a viable alternative server (either deployed temporarily or running in parallel).
Failures inevitably happen which is why you risk manage this using a topology with load balancers/servers set up in HA groups, eliminating any single provider as a single point of failure.
This is so basic that any junior admin knows these things.
Outlandish workarounds only happen when you do not have a plan and you are dredging the bottom of the barrel.
The people behind lichess are very much professionals, have worked in companies before, and know about everything you're writing. However instead of building a business they decided to run a completely free and ad-free non profit living off donations.
You don't get the same budget doing that compared than a subscription base / ad supported service. That's true for the number of people maintaining it as well as the cloud cost you can afford.
If you look at their track record, uptime have been pretty good. Shit happens, but if you ask me it's worth it to have a service like Lichess that can exist completely on donations.
Disclaimer: I'm not a network engineer so I may be misunderstanding the practicality and complexity of such a workaround.
Is it that complicated for big tech to reply politely with the above statement when they suddenly disable your account for no obvious reason!
It is much more difficult for corporate cogs to have that level of care compared to someone who does their things with passion.
If a commercial provider told me they're dependent on a single physical server, with no real path or plans to fail over to another server if they need to, I would consider it extremely negligent.
It's fine to not use big cloud providers, but frankly it's pretty incompetent to not have the ability to quickly deploy to a new server.
By increasing the complexity you multiply the failure points and increase ongoing maintenance, which is the bottleneck (even more than money) for volunteer-driven projects.
Kubernetes or complex cloud services are not required to have some basic deployment automation.
You can do it with a simple bash script if you need to. It's just pretty surprising to see the reaction to a hardware failure being to wait around for it to be repaired instead of simply spinning up a new host.
That being said, removing dependence on single hardware nodes isn't something you need a big team for. I've done failover at 1-person startups.
Your idea of "so far out of line", would include any communication you disagree with, and is absent rational principles or social norms/mores basis, it is absurd.
I stuck to the objective issues in my previous post, you should too before making baseless claims.
Do some due dilligence on the business entities involved, peruse their github history (the deleted parts). Get a real picture about what's going on there. You'll find many contradictions if you dig.
The question on any critical IT professional's minds is how can you run the service given the resources claimed. Yes he runs the top traffic site for chess, and its done on a bespoke monolith.
You napkin math/sketch it out by required component services, and it quickly becomes clear that nothing adds up. When nothing is consistent, or supported, you examine your premises for contradictions and lies, which goes again back to credibility.
(Hint: https://trufflesecurity.com/blog/anyone-can-access-deleted-a...)
TLDR if you want to see production-quality Scala code that this very second is serving 40k chess games -- and mostly bullet/blitz where ms latency is of course crucial -- definitely take a look.
Not as much hype for the language at the moment over Rust or Kotlin, say, but it remains my language of choice for web backends by far.
To me those numbers seem on the high side as I'm (personally) used to (for cheap projects) scavenging together stuff from Ebay before deploying to a data centre. ;)
We will have to disagree. You have clearly contradicted yourself in at least one way, and attempt to mislead readers in a number of other ways which I won't go into here.
From these, I have to come to the conclusion that you don't have credibility.
The downtime would not have happened if they had followed professional practices. Even a qualified Administrator coming into the outage fresh would have had a fix within 30 minutes if they were working at a professional level.
Yes shit happens, but professionals have processes in place so that common shit does not just happen. This was preventable.
If you read the following books by established experts, you should be able to rationally answer the question for yourself as to the why and the how. The subject matter involves torture for thought reform, real not fantasy. This differs from SERE training which is geared towards resisting information extraction.
China by their own words (internal leaked documents), seeks the destruction of the national will, of their enemies. This involves an identity based approach to torture/thought reform, which falls under the military strategy, Divide and Conquer. Digital attacks are cost effective when weighed against other options.
Anything you believe, love, or common experiences that you share with other people is fair game for inducement and then destructive interference to promote nihilism, while segmenting individuals into two groups, disassociative responses (apathetic/non-response), and psychotic break responses.
The items targeted include chess, along with many other things. Inducement of struggle sessions to break people.
If you spend the time to review the material I mentioned, you'll likely find out that a core belief of yours is untrue, that belief being that something like this is fantasy and impossible. This has a way of breaking the weak-willed, often in a psychological reversal/delusion.
I hope you are a strong person, we need more rational people if we are to survive as a species.
Robert Lifton (Thought Reform and The Psychology of Totalism) Joost Meerloo (Rape of the Mind) Robert Cialdini (Influence) USMC Press (Political Warfare)(Free ebook at their website)
Worse. In Single AZ deployments you get (short, but not that short or strongly bound) downtime for daily backups and when doing snapshots. Source:
- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_...: "During the automatic backup window, storage I/O might be suspended briefly while the backup process initializes (typically under a few seconds). [...] For MariaDB, MySQL, Oracle, and PostgreSQL, I/O activity isn't suspended on your primary during backup for Multi-AZ deployments because the backup is taken from the standby. ",
- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_...: "Amazon RDS creates a storage volume snapshot of your DB instance, backing up the entire DB instance and not just individual databases. Creating this DB snapshot on a Single-AZ DB instance results in a brief I/O suspension that can last from a few seconds to a few minutes, depending on the size and class of your DB instance.".
Not to mention that multi-AZ deployments incur extra transfer cost between zones - not between DB instances (this one is free, last time I checked), but between your compute deployments and DB instances, if your compute does not automatically follow the zone of the db host it talks to.
You can beat AWS on pricing but not like this. You need to be finding areas where you have a lot of baseline demand – enough to amortize the cost of all of the lower level work – and can cut some of the things they do which you don’t need. For example, if you can afford more downtime in a disaster scenario or can rely on an external rebuild process if the database backups turn out to be unusable.
Here is a comparison of free and their premium accounts:
Can't tell if its pathological or malevolent... probably both. Pray that we never meet.
Thankfully, it is not such a simple thing to discredit when world renowned experts all agree and say a thing, and the longer they have been established the more one should listen.
Saying I need to seek professional help for repeating what's been documented by experts, yeah that is rich.