Go reliability and durability at Dropbox

https://about.sourcegraph.com/go/go-reliability-and-durability-at-dropbox-tammy-butow

by astdb • 9 years ago

194 101 9 years ago

about.sourcegraph.com

dan-compton• 9 years ago

What a terrible article.

TRManderson• 9 years ago

This post was best-effort live-blogged at the conference

Cut them some slack.

breakingcups• 9 years ago

To promote their own service. While the actual talk will probably be actually posted online in multiple forms.

lathiat• 9 years ago

I think that is, in part, because it's a summary of a talk. So it's written a bit awkwardly and probably misses maybe some more interesting in-depth details from the actual talk. It does seem on the surface though like potentially a good text summary, having not watched the actual talk.

On the flip side, I have been frustrated particularly at linux.conf.au last year at how "not deep" many of the talks were. Having done quite a few talks over many years at similar conferences, it's actually quite hard to nail something technical and be entertaining for a presentation at the same time. Someone who nails that quite consistently is Aaron Paterson (from the Ruby/Rails world). Watch some of his talks on Youtube.. I aspire to produce more content on a level similar to his. To combine good entertaining presentation with actually educating an audience about the technical non-obvious details of something they probably didn't know -- and something that was relevant in a practical project he took on. Working on it, not there yet...

0xCMP3• 9 years ago

Oh, I thought Dropbox was using Rust instead of Go for a lot of things, but maybe they ended up using both. I can see why they'd have wanted to be just moving to either Rust or Go since from what I understand they used to be mostly Python for everything.

Cool that they use Go a lot.

didibus3• 9 years ago

Easier to go from python to go than to rust.

Dowwie2• 9 years ago

How so? You can extend Python with Rust but you can't with Go. Go requires a complete rewrite or independent service.

kibwen2• 9 years ago

Last I checked, server-side Rust usage at Dropbox is reserved for the very bottom of the stack, for the bits that are performance-sensitive enough that the alternative would have demanded they be written in C++. Apparently there's a significant amount of Rust in Dropbox's Windows client as well, though I don't know the story there...

newhouseb• 9 years ago

We're making a pretty big bet on Rust in the client (if you'd call it a bet, I don't see a scenario where we walk this back). The majority of new Sync code in the client (read: not UI) is being written in Rust and it's been a blast so far, not to mention much easier to reason about correctness which is really what we care about.

(something something we're hiring)

nsm• 9 years ago

Here is a talk by Jamie Turner of Dropbox about where Rust is used: https://air.mozilla.org/rust-meetup-may-2017/

(I work at Dropbox)

0xFFC• 9 years ago

Go and Rust are not competing for same space. They are different language for different purposes.

coldtea2• 9 years ago

Rust is multi-purpose, and with improved tooling and a little more maturity (Rust 2.0) I can see it getting all the (network/server) systems and command line stuff Go does.

(But not vice versa: Go wont be able to handle the no-GC close-to-the-metal use cases).

0xCMP3• 9 years ago

Sure they can be. Rust just isn't able to compete in some areas where Go is objectively easier and better, but they're areas which can be fixed with improved documentation, training, and libraries.

YMMV, but I think people just want something fast, productive, and safe by default. Normally you had to pick just two, but Go gives you 2.5 (Not as safe as it "could be") and Rust only gives you 2 right now (Not as productive, libraries too immature), but it is on it's way to giving all 3 as soon as libraries gain maturity.

kylequest• 9 years ago

Here's the actual video: https://youtu.be/5doOcaMXx08

tlb• 9 years ago

What does "Reliability of 99.9999999999% (twelve 9s)" even mean? Obviously you have to exclude large classes of user-visible failures (network outage, account over quota) to achieve that. I don't think they're claiming less than 0.00000000001% chance of a zombie apocalypse/Mad Max/ex Machina/asteroid impact end-of-times situation. So just what failures are counted?

For comparison, public telephony systems aimed for five 9s. That was usually expressed as "20 minutes downtime over 40 years, combined hardware and software budget, for outages affecting more than 32 users." One software crash requiring human intervention would count for more than 20 minutes, so you were allowed <1 of these in 40 years system lifetime.

oconnor663• 9 years ago

The next bullet point is availability, so presumably they mean reliability in the sense that you won't permanently lose data?

tw04• 9 years ago

I feel like they mean resiliency, not reliability. I could see 12x 9's resiliency with them factoring it based on x amount of data stored for y days. There's 0 chance they could claim that level of reliability for the reasons you mentioned among others.

agrajag• 9 years ago

That's a claim of the durability of the data, or the odds that a chunk of data will be lost in a year.

They calculate this through the odds that a single node fails, and then multiplying that odd out through all replicas. This covers the most easily quantifiable failure mode.

Obviously the real odds are somewhat higher when you consider that a rogue admin, malicious actor, or buggy code could delete multiple instances of replicated data at once. There's no way to estimate these odds though, and really they don't matter - they're big enough events that they could spell the end of Dropbox if they happened.

fulafel• 9 years ago

Another major class of data loss in this kind of system is operator error when dealing with rare, unrehearsed events requiring operator intervention. Often combined with confusing messages or behaviour from the software.

sllabres• 9 years ago

The video linked by kylequest below [1] speaks about durability, not reliability: "Create a system that provides annual data DURABILITY of 99.9999999999. Create a system with availability of over 99.99%"

[1] https://youtu.be/5doOcaMXx08?t=220

pebers2• 9 years ago

Data durability - the probably that your data is not lost.

FWIW Amazon make a similar claim of 11 9s for data durability on S3: https://aws.amazon.com/s3/faqs/

dis-sys• 9 years ago

reliability != durability. The article separately mentioned reliability/durability -

"Go reliability and durability at Dropbox" "Dropbox hires engineers who care about reliability and durability"

for S3, in your link, there is very clear definition of the claimed durability, there is no similar definition in that dropbox article -

"(S3) designed to provide 99.999999999% durability of objects over a given year. This durability level corresponds to an average annual expected loss of 0.000000001% of objects."

coldtea2• 9 years ago

For comparison, public telephony systems aimed for five 9s. That was usually expressed as "20 minutes downtime over 40 years, combined hardware and software budget, for outages affecting more than 32 users." One software crash requiring human intervention would count for more than 20 minutes, so you were allowed <1 of these in 40 years system lifetime.

And all of that is total bogus (the "aim", not your information), as no public telephony system (and surely not in my country) ever had anything close to that.

A few hours of downtime a few times a year is much more like it, although it has been getting better over time.

kuschku4• 9 years ago

Not really. The German phone and power networks get quite close to this reliability. I've had less than 30 minutes combined downtime in my life.

amelius• 9 years ago

What does "Reliability of 99.9999999999% (twelve 9s)" even mean?

Sort of worst case: what it could mean is that every hour, the system reboots and this process takes 10^-12 of an hour, which doesn't seem like much, but you'd have to restart your client as well, which may take longer and is annoying, and you could lose data. So basically, the system would be useless :)

tc• 9 years ago

The PSTN and similar systems do target five-9s, but fortunately that only requires keeping it to ~20 minutes downtime over 4 years. ~20 minutes over 40 years would be six-9s.

    (* 1e-5 365.2425 24 60 4) => 21.038
    (* 1e-6 365.2425 24 60 40) => 21.038

mostafah• 9 years ago

I have an off-topic question: This is the second company (after GitLab) I see with an “about” subdomain. Is this a new trend of using “about.x.com” for the marketing website and “x.com” for the web app? Is there a blog post or discussion about this?

usrusr2• 9 years ago

Browsers are thankfully highlighting the https-verified part of the URL (hostname) relative to the rest, so that a "paypal.com.fake.com" phishing attack is easier to spot. It was just a matter of time before UX people would put that highlighting to creative use. I like it.

On the technological side, I guess separate hostnames might make some ops things a little easier. But that alone can hardly be the reason. Easier and good looks can. Also: In a large scale outage, an about.x.com that is not running on your main cloud provider could be valuable for status updates, because far more people would know about about.x.com than about some status.x.com you might have if your "about" content was on the main hostname.

jrimbault2• 9 years ago

I don't see this highlighting in the latest Chrome (60.0.3something, I just updated it).

Is there a specific flag to enable ?

greenhouse_gas3• 9 years ago

In addition to it hurting SEO

mercer• 9 years ago

How does it hurt SEO?

sytse• 9 years ago

At GitLab we first used www dot the marketing site and the apex for the app but many people assumed they would have the same content. That is why we introduced about. Cool to see we might have started a trend.

tokenizerrr• 9 years ago

Wow, never noticed that. When did you change? It would have confused me so much.

didibus3• 9 years ago

Does rust gurantee data race free code?

Perceptes• 9 years ago

Yes, if you stick to safe Rust.

general_pizza• 9 years ago

This explains pretty well: https://doc.rust-lang.org/beta/nomicon/races.html

didibus3• 9 years ago

It’s easy to be productive in Go.

Hum, I'm not sure what this means. Is it saying go is a productice language, or just that you'll master go quickly and reach peek go productivity quickly?

SwellJoe• 9 years ago

I think it's only slightly ambiguous. It doesn't seem to be making a claim about mastering go or peak go productivity. It just says it's easy to be productive (not maximally productive, just "productive"). Which seems to be borne out by the huge amount of new code written in go just in the past few years.

barsonme3• 9 years ago

Both, really. Go's so small you can be quite proficient with in months. While it's not as productive as, say, Python (wrt how quickly you can get your code up and running) it's much quicker than other languages (and nicer to use in the long run).

smegel• 9 years ago

months

? Go is tiny. The tutorial takes an afternoon. A C programmer will be profecient within days.

bborud4• 9 years ago

I disagree slightly. The problem with Python is that it may be quick and easy to cobble together something that does what you want, but it is a pain in the ass for someone else to install and use.

There is no shortcut where you can produce and distribute a binary so every damn user of your program will have to deal with Python versioning, installing dependencies etc.

So for the user, Python is not productive. It is time-consuming and bothersome.

twic3• 9 years ago

While it's not as productive as, say, Python (wrt how quickly you can get your code up and running) it's much quicker than other languages (and nicer to use in the long run).

I can see that an experienced Go developer would be more productive than an experienced C developer. But, based on my experience of writing Go, i can't see how they could be more productive an experienced developer in any other current mainstream(ish) language - by which i suppose i mean Python, Ruby, Java, Scala, Kotlin, and (modern) C++. Go's great strength is how fast it is to get up to speed with, not how productive it is once you are.

mbesto• 9 years ago

wrt how quickly you can get your code up and running

Why is this such a huge benefit for code that typically works at the system level? Wouldn't you value reliability, consistency, etc when adapting system level functions over speed to deployment?

_ph_• 9 years ago

Go is a very productive language in several senses in my eyes. It is a language you can master quickly, and it is a very productive language in day to day work. There it is important to consider the overall productivity. There are certainly languages, which allow you to implement something a little bit quicker, but you have to consider also the effort of maintaining and further extending a program. For long-term maintenance, Go especially shines. It is easy to come back to some software and pick up modifying it again, and also when there are properly set up packages, Go software tends to be maintainable and extendable.

rlaanemets• 9 years ago

I find it also interesting that they only have 1.3M loc of Go given the 15+ teams and hundreds of engineers. I would expect this number to be at least 10x larger. They either still use a lot of Python or other languages or are very efficient at reusing code.

nolanpro• 9 years ago

She talked at GopherCon 2017 about

Ya'll too young to remember OG Gopher https://en.wikipedia.org/wiki/Gopher_(protocol)

apta• 9 years ago

The biggest pain with Go that Tammy identified was in dealing with race conditions.
Data races are the hardest type of bug to debug, spot, fix, etc.

Exactly what Rust aims at preventing. Sad to see that the industry is not learning.

jacquesm3• 9 years ago

Sad to see that the industry is not learning.

Sad that Rust advocates are not learning. This sort of comment is what drives people away from Rust. Stop ramming your stuff down other people's throats. Go build that exclusively Rust based Dropbox clone that outperforms Dropbox and show how well Rust performs in that situation.

Rust has trade-offs just like Go has trade-offs. Being honest about the deficiencies of ones chosen platform is a good thing, it helps to keep you sharp and to avoid problems associated with those deficiencies.

Besides having an over-zealous community that posts off-topic comments all over threads that have nothing to do with Rust, Rust has deficiencies too.

Note also that Dropbox is already using Rust in some places.

innocentoldguy2• 9 years ago

Is it off-topic though? Go has warts and is plagued by poor design decisions, just like most software. I think it is worth mentioning those, and offering recommendations that don't have those issues, so people can make the best technical decisions when choosing a stack for their projects. It also may help Go maintainers in fixing legitimate complaints in Go, thus making it better. I've never used Rust, but I have used Go, and found certain things about it unappealing, so I'm interested in this information, and I'm also interested in Go improving.

kibwen2• 9 years ago

Not to condone the grandparent's zealotry, but the article does mention Rust by name, Dropbox is using Rust, and preventing data races is one of Rust's two raisons d'être. It's not off-topic in the least. There's no need to stoop to zealotry yourself in order to fight zealotry.

codygman• 9 years ago

Stop ramming your stuff down other people's throats.

Pointing out your preferred language addresses one of the hardest problems in another language qualifies as "ramming your stuff down other people's throats"?

I find that hard to believe.

justinclift2• 9 years ago

Anyone know where in the talk it has the mention of "Debugging tools (mostly!) work well"?

I'm skipping back and forwards through it, but the talk isn't in the same order as this article which is making it very difficult without watching the whole talk from start -> end.

Asking because debugging is a pain point I've been having with Go for a few months, so am surprised to see it described as mostly working well. I'd like to get my debugging experiences to at least that level of "(mostly) working well". :D

ctrlrsf• 9 years ago

What are you having trouble debug? Or what do you think isn't working well for you?

justinclift2• 9 years ago

The two main problems are:

a) Pretty much any platform other Linux doesn't seem to work (for debugging). ;)

b) Breakpoints occasionally not firing even when running Linux (Fedora 25 in this case)

This is with CGO enabled code, which isn't optional as it's from the libraries we use (no choice).

Using Delve for debugging (though Gogland atm), as we're not yet in production.

Fairly worried about how things will er... go ;) in prod though when we get to rolling things out.

With Delve, it's apparently the state of the art with Go debugging. If something else actually works reliably though, I'm happy to try it. :)

zzzcpan• 9 years ago

Yeah, Go has the worst possible model for concurrency there is - shared memory multithreading. Hopefully more and more companies will realize how bad this model really is and start looking into languages with decent concurrency models, like Erlang and Elixir or at least stick to event loops.

innocentoldguy2• 9 years ago

That is exactly why I use Erlang and Elixir, and not Go. Also, Go processes are 10 times the size of those in Elixir.

billrobertson42• 9 years ago

What are you measuring? Memory use?

falcolas• 9 years ago

I give you Python and Ruby as worse - shared memory and an interpreter lock to limit concurrent operations.

That said, Go is the best of the C-style concurrency breed; having typed message passing and green threads built into the language.

twic3• 9 years ago

The worst possible model? Oh my dear fellow, not even close:

http://catb.org/esr/intercal/ick.htm#Multithreading-using-CO...

rrdharan2• 9 years ago

My favorite is still the multithreaded apartment model...

https://blogs.msdn.microsoft.com/larryosterman/2004/04/28/wh...

Go reliability and durability at Dropbox

Related Stories