▲ 422 ▼ ‘There isn’t really another choice:’ Signal chief explains why the encrypted messenger relies on AWS (www.theverge.com) submitted 1 year ago by schizoidman@lemmy.zip to c/technology@lemmy.world 104 comments fedilink hide all child comments cross-posted from: https://lemmy.zip/post/51866711 Signal was just one of many services brought down by the AWS outage.
[+] net00@lemmy.today 13 points 1 year ago (10 children) [deleted] permalink fedilink source hideshow 10 child comments replies: [–] magguzu@midwest.social 7 points 1 year ago This is the actual realistic change a lot of people are missing. Multi cloud is hard and imperfect and brings its own new potential issues. But AWS does give you tools to adopt multi region. It's just very expensive. Unfortunately DNS transcends regions though so that can't really be escaped. permalink fedilink source parent [–] shalafi@lemmy.world 15 points 1 year ago* (2 children) us-east-1 went down. Problem is that IAM services all run through that DC. Any code relying on an IAM role would not be able to authenticate. Think of it as a username in a Windows domain. IAM encompasses all that you are allowed to view, change, launch, etc. I didn't hardly touch AWS at my last job, but listening to my teammates and seeing their code led me to believe IAM is used everywhere. permalink fedilink source parent hideshow 2 child comments replies: [–] amzd@lemmy.world -2 points 1 year ago (1 child) How is that even legal, I thought there were data export laws in the eu permalink fedilink source parent hideshow 1 child comment replies: [–] shalafi@lemmy.world 8 points 1 year ago Nothing to do with moving data. But you can't move data without authentication. I want my service to do a $thing. It won't do $thing without knowing who I am and what permissions I have. The data doesn't have to cross borders, the service simply needs to function. Does that make sense? As I said, didn't do much in AWS, but the principles are sound. permalink fedilink source parent [–] Evotech@lemmy.world 6 points 1 year ago (3 children) Apparently even if you are fully redundant there's a lot of core services in US east 1 that you rely on permalink fedilink source parent hideshow 3 child comments replies: [+] carrylex@lemmy.world -7 points 1 year ago (2 children) No, there isn't. If you of course design your infrastructure correctly... permalink fedilink source parent hideshow 2 child comments replies: [–] Evotech@lemmy.world 4 points 1 year ago (1 child) Wrong. Stuff that wasn't even in us east went down too. Dns is global permalink fedilink source parent hideshow 1 child comment replies: [–] carrylex@lemmy.world -1 points 1 year ago Not sure if you are have read the AWS incident but the DNS records for the DynamoDB endpoint got ONLY accidentally removed in us-east-1 and not on the entire world. All other regions worked perfectly fine. permalink fedilink source parent [–] lando55@lemmy.zip 5 points 1 year ago (1 child) This has been my biggest pet peeve in the wake of the AWS outage. If you'd built for high-availability and continuity then this event would at most have been a minor blip in your services. permalink fedilink source parent hideshow 1 child comment replies: [–] shalafi@lemmy.world 4 points 1 year ago Yeah, but if you want real redundancy, you pay double. My team looked into it. Even our CEO, no tightwad, just laughed and shook his head when we told him. permalink fedilink source parent
[–] magguzu@midwest.social 7 points 1 year ago This is the actual realistic change a lot of people are missing. Multi cloud is hard and imperfect and brings its own new potential issues. But AWS does give you tools to adopt multi region. It's just very expensive. Unfortunately DNS transcends regions though so that can't really be escaped. permalink fedilink source parent
[–] shalafi@lemmy.world 15 points 1 year ago* (2 children) us-east-1 went down. Problem is that IAM services all run through that DC. Any code relying on an IAM role would not be able to authenticate. Think of it as a username in a Windows domain. IAM encompasses all that you are allowed to view, change, launch, etc. I didn't hardly touch AWS at my last job, but listening to my teammates and seeing their code led me to believe IAM is used everywhere. permalink fedilink source parent hideshow 2 child comments replies: [–] amzd@lemmy.world -2 points 1 year ago (1 child) How is that even legal, I thought there were data export laws in the eu permalink fedilink source parent hideshow 1 child comment replies: [–] shalafi@lemmy.world 8 points 1 year ago Nothing to do with moving data. But you can't move data without authentication. I want my service to do a $thing. It won't do $thing without knowing who I am and what permissions I have. The data doesn't have to cross borders, the service simply needs to function. Does that make sense? As I said, didn't do much in AWS, but the principles are sound. permalink fedilink source parent
[–] amzd@lemmy.world -2 points 1 year ago (1 child) How is that even legal, I thought there were data export laws in the eu permalink fedilink source parent hideshow 1 child comment replies: [–] shalafi@lemmy.world 8 points 1 year ago Nothing to do with moving data. But you can't move data without authentication. I want my service to do a $thing. It won't do $thing without knowing who I am and what permissions I have. The data doesn't have to cross borders, the service simply needs to function. Does that make sense? As I said, didn't do much in AWS, but the principles are sound. permalink fedilink source parent
[–] shalafi@lemmy.world 8 points 1 year ago Nothing to do with moving data. But you can't move data without authentication. I want my service to do a $thing. It won't do $thing without knowing who I am and what permissions I have. The data doesn't have to cross borders, the service simply needs to function. Does that make sense? As I said, didn't do much in AWS, but the principles are sound. permalink fedilink source parent
[–] Evotech@lemmy.world 6 points 1 year ago (3 children) Apparently even if you are fully redundant there's a lot of core services in US east 1 that you rely on permalink fedilink source parent hideshow 3 child comments replies: [+] carrylex@lemmy.world -7 points 1 year ago (2 children) No, there isn't. If you of course design your infrastructure correctly... permalink fedilink source parent hideshow 2 child comments replies: [–] Evotech@lemmy.world 4 points 1 year ago (1 child) Wrong. Stuff that wasn't even in us east went down too. Dns is global permalink fedilink source parent hideshow 1 child comment replies: [–] carrylex@lemmy.world -1 points 1 year ago Not sure if you are have read the AWS incident but the DNS records for the DynamoDB endpoint got ONLY accidentally removed in us-east-1 and not on the entire world. All other regions worked perfectly fine. permalink fedilink source parent
[+] carrylex@lemmy.world -7 points 1 year ago (2 children) No, there isn't. If you of course design your infrastructure correctly... permalink fedilink source parent hideshow 2 child comments replies: [–] Evotech@lemmy.world 4 points 1 year ago (1 child) Wrong. Stuff that wasn't even in us east went down too. Dns is global permalink fedilink source parent hideshow 1 child comment replies: [–] carrylex@lemmy.world -1 points 1 year ago Not sure if you are have read the AWS incident but the DNS records for the DynamoDB endpoint got ONLY accidentally removed in us-east-1 and not on the entire world. All other regions worked perfectly fine. permalink fedilink source parent
[–] Evotech@lemmy.world 4 points 1 year ago (1 child) Wrong. Stuff that wasn't even in us east went down too. Dns is global permalink fedilink source parent hideshow 1 child comment replies: [–] carrylex@lemmy.world -1 points 1 year ago Not sure if you are have read the AWS incident but the DNS records for the DynamoDB endpoint got ONLY accidentally removed in us-east-1 and not on the entire world. All other regions worked perfectly fine. permalink fedilink source parent
[–] carrylex@lemmy.world -1 points 1 year ago Not sure if you are have read the AWS incident but the DNS records for the DynamoDB endpoint got ONLY accidentally removed in us-east-1 and not on the entire world. All other regions worked perfectly fine. permalink fedilink source parent
[–] lando55@lemmy.zip 5 points 1 year ago (1 child) This has been my biggest pet peeve in the wake of the AWS outage. If you'd built for high-availability and continuity then this event would at most have been a minor blip in your services. permalink fedilink source parent hideshow 1 child comment replies: [–] shalafi@lemmy.world 4 points 1 year ago Yeah, but if you want real redundancy, you pay double. My team looked into it. Even our CEO, no tightwad, just laughed and shook his head when we told him. permalink fedilink source parent
[–] shalafi@lemmy.world 4 points 1 year ago Yeah, but if you want real redundancy, you pay double. My team looked into it. Even our CEO, no tightwad, just laughed and shook his head when we told him. permalink fedilink source parent