News for hackers. Stuff that matters.
Re:GitLab Database Incident – Live Report by btgeekboy on Tuesday January 31, 2017 @08:28PM (#13537307)
> Our backups to S3 apparently don’t work either: the bucket is empty

followed by

> So in other words, out of 5 backup/replication techniques deployed none are working reliably or set up in the first place.

is no way to be running a public service with customer data. Did the person who set up that S3 job simply write a script or something and just go "yep, it's done" and walk away? Seriously?

Re:GitLab Database Incident – Live Report by overcast on Tuesday January 31, 2017 @08:38PM (#13537369)
Apparently the following insane interviewing process, wasn't enough to find someone competent enough to cover the basics.

https://about.gitlab.com/jobs/production-engineer/

-------------------

Applicants for this position can expect the hiring process to follow the order below. Please keep in mind that applicants can be declined from the position at any stage of the process. To learn more about someone who may be conducting the interview, find her/his job title on our team page.

Qualified applicants receive a short questionnaire and coding exercise from our Global Recruiters

The review process for this role can take a little longer than usual but if in doubt, check in with the Global recruiter at any point.

Selected candidates will be invited to schedule a 45min screening call with our Global Recruiters

Next, candidates will be invited to schedule a first 45 minute behavioral interview with the Infrastructure Lead

Candidates will then be invited to schedule a 45 minute technical interview with a Production Engineer

Candidates will be invited to schedule a third interview with our VP of Engineering

Finally, candidates will have a 50 minute interview with our CEO

Successful candidates will subsequently be made an offer via email

Re:GitLab Database Incident – Live Report by omgdresser on Tuesday January 31, 2017 @10:03PM (#13537833)
I went through all of the insane interviews except the CEO interview for the production engineer position and was rejected. I brought quite a bit of high-level operational experience from a few different places, including some pretty high-traffic video sites, HPC and a lucrative e-commerce site.

The reason for my rejection? I had an ongoing side project and development/consulting gig which had been paying the bills for a few years which they thought I 'misrepresented'. I guess they assumed I was still working there (I was and would continue to do consulting and development on my own time), but the biggest LOL of the whole shitty process was their reasoning: "We are very risk-averse in our hiring." No shit.

I guess they weren't risk-averse enough in their operations though, so I'm glad I didn't get through. It sounds like it would have been an uphill battle all the way to make changes to keep things sane.

And having to crowdsource your move from cloud to your own hardware? Listen to your people, they already had good ideas, all of which were documented in your open issue tracker.

Re:GitLab Database Incident – Live Report by marcinzm on Wednesday February 01, 2017 @09:38AM (#13540996)
>I guess they weren't risk-averse enough in their operations though, so I'm glad I didn't get through. It sounds like it would have been an uphill battle all the way to make changes to keep things sane.

I think they were risk averse which is the problem except they were judging against the wrong candidate profile. The risk adverseness meant they never hired anyone who diverged from their incorrect profile.

Re:GitLab Database Incident – Live Report by overcast on Tuesday January 31, 2017 @10:13PM (#13537875)
That's just crazy. Thanks for the insight!
Re:GitLab Database Incident – Live Report by developer2 on Wednesday February 01, 2017 @12:43AM (#13538577)
>> candidates will be invited to schedule a first 45 minute behavioral interview with the Infrastructure Lead

Yes, go right ahead and filter out some (disclaimer before the rant: some, not all) of the best talent. The kind of potential employee that gets rejected due to perceived personality problems is exactly the kind of person who would tell management to shove a stick up their ass for demanding a 2 week deadline for a project requiring 3 months to execute properly.

Maybe if GitLab had hired the best talent, instead of the best "behavioral/cultural fit", at least one of their 5 backup systems would have been functional. Many people who are perfectionists in their craft, who would never have allowed this kind of failure to take place under their watch, come with abrasive personalities. If you only hire those who are submissive during the interviewing process, you will get exactly what you chose - people with no backbone to push back against unreasonable business expectations.

Case in point: would you want to hire me based on this comment of mine? Hell no! You're going to steer clear of me and give me an instant fail during a "behavioral interview", because you can't look past my belligerence to understand that there is value in having employees who obsess over the little things like having systems that do what the fuck they're supposed to do, rather than being able to give a conformant first impression full of social prowess. "Whoa, he used the word 'fuck' to hammer home his point; definitely avoid hiring this guy!"

tldr; Sometimes, people who are "talented" or "skilled" get to that point by being obsessive freaks who sit at home in the dark all night hacking away at stuff, with no social lives. The result can be someone who knows what they are doing because they invest all their personal free time into the domain, but consequently has absolutely no social skills to put on display.

shorter tldr; Businesses focus on the liability of a person without considering the potential.

Re:GitLab Database Incident – Live Report by watwut on Wednesday February 01, 2017 @04:29AM (#13539503)
Abrasive personalities don't tend to create safe&sane process, many would just yell at the people when mistakes happen. That is not the same. Able not to make mistakes and able to create process with enough safeguards so that mistakes are guaranteed not to happen are sometimes in opposition. Obsessive freak who tend not to do little mistakes may resist the change toward safer process, preferring to play blame game.

Moreover, many with abrasive personalities are the ones who demand and take for granted excessive overtime the moment they are in senior or lead position. "I am too tired and it is late at night lets do it tomorrow" is not an option to abrasive personality.

As a rule, obsessive freak with no social skills you describe wont be able to effectively reorganize the team nor create process nor (if in extreme version) work within process someone else created. He is more likely to end up in endless quarrels about petty differences in coding style.

Ability to create, fight for and enforce sane process is not the same as being abrasive.

He is however absolutely fine when you have isolated position.

Re:GitLab Database Incident – Live Report by marcinzm on Wednesday February 01, 2017 @09:43AM (#13541045)
As others have said, abrasiveness isn't a virtue especially in a role that requires others to change their behavior. There are in fact diplomatic ways to convey the same information which have a much higher chance of causing others to listen and getting everyone to adopt new processes. That someone is diplomatic and knows/care about their stuff are not mutually exclusive.

That said, depending on their interview process they may be selecting out candidates who even diplomatically disagree about the existing ops processes which results in less than stellar hires.

Re:GitLab Database Incident – Live Report by elygre on Wednesday February 01, 2017 @03:16AM (#13539221)
Not vetting people based on behavior is perilously close to accepting the old adage "Say what you like about Mussolini, but at least he made the trains run on time".
Re:GitLab Database Incident – Live Report by watwut on Wednesday February 01, 2017 @04:32AM (#13539514)
And the fact is, trains were not on time at that time. It was mostly propaganda.
Re:GitLab Database Incident – Live Report by jpgvm on Tuesday January 31, 2017 @09:59PM (#13537809)
5 interviews isn't -that- insane, it's on the high end though.

But I do know for sure they have turned down extremely technically gifted people for "non-technical" reasons, the kind of people that would ensure this sort of disaster wouldn't happen.

So maybe the process really isn't that great.

Re:GitLab Database Incident – Live Report by omgdresser on Tuesday January 31, 2017 @10:08PM (#13537857)
I'm biased because I went through the process and was rejected, but I agree. There was more focus on asinine 'behaviorial' questions than the real reason you're talking to someone: are you (relatively) sane, and more importantly are you capable, can you do the job? Everything else is secondary, in my opinion.
Re:GitLab Database Incident – Live Report by ibejoeb on Tuesday January 31, 2017 @10:56PM (#13538098)
I wondered why they always have so many job reqs out, and why they're out for so long. It always seemed like an interesting organization to me, and I like the product, but everything about their hiring process seems to be shoeing people off. Perhaps this will be incentive to try onboarding people or at least to bring in some consultants to shore them up.
Re:GitLab Database Incident – Live Report by jpgvm on Wednesday February 01, 2017 @01:00AM (#13538655)
I think part of the problem, as it has already been touched on here is true Ops people are of a different breed to standard developers. They usually have similar coding ability (but different areas of expertise, automation and systems coding over business logic) but drastically different personalities.

This is an issue during hiring when companies have minimal Ops background. They (usually) attempt to interview the candidate as they would a normal dev position. This has 2 serious problems. 1) Real Ops candidates are going to seem lacklustre compared to web devs when giving web dev coding tasks and inteview questions. 2) You probably aren't going to ask them anything actually relevant to their ability to do Ops well because you just don't know.

This can usually be solved by hiring an experienced SRE manager. However those people are expensive and hard to find.

The next best thing is to have a gun SRE in your personal network that you can convince to join your team and help you build it out.

If you can't achieve that for whatever reason then you really just have to hire based on experience and suck up the cost of hiring an ex-Google/Facebook/Netflix/Twitter SRE that you can be reasonably confident will be good.

That is still hard though because those sorts of people know there is a ton of shit shoveling to be done if you are the first real SRE on board.. you have to clean up the mess left in the wake of "devs doing ops" which is not Devops btw. Devops is what is done by SREs. "devs doing ops" is how this sort of thing happens.

/rant

Re:GitLab Database Incident – Live Report by ibejoeb on Wednesday February 01, 2017 @07:15PM (#13546804)
I couldn't agree more. (My followup rant is general, and I have no knowledge of what's going on at GL.)

> Real Ops candidates are going to seem lacklustre compared to web devs when giving web dev coding tasks and inteview questions.

This drives me insane. I think 50% of my comment history this year is about how not to botch an interview.

> You probably aren't going to ask them anything actually relevant to their ability to do Ops well because you just don't know.

Yes. You won't be able to quiz that person. You can take a thoughtful look at experience and talk about that, though.

> hire based on experience

Yup. One of the spook factors at any company is when I see it only hiring down, i.e., lower than the aggregate skill level of its current team. If the VP of engineering knows more about each concentration area than the people he's hiring, there's a storm a-brewin'.

Re:GitLab Database Incident – Live Report by sidlls on Wednesday February 01, 2017 @12:12AM (#13538442)
It's worse: the technical interview for "some" positions apparently consists of pair-programming to resolve a Community Edition Issue which actually will (presumably, if it resolves the issue) become part of the product. No mention if that's paid time or not. That's shameful. I was considering using them, but if they're getting what is effectively free labor as part of their interview process my interest will wane considerably.
Re:GitLab Database Incident – Live Report by ChuckMcM on Tuesday January 31, 2017 @08:33PM (#13537339)

   > Did the person who set up that S3 job simply write a 
   > script or something and just go "yep, it's done" and 
   > walk away?
I don't know of course, but one failure mode that has to be explicitly tested for is continual monitoring that the existing backup process is still working. We had a backup process at Blekko which stopped working once when an S3 credential that appeared unrelated was removed, as I recall it was a Nagios test that detected that the next set of backups were too small and got that fixed.
Re:GitLab Database Incident – Live Report by problems on Tuesday January 31, 2017 @09:46PM (#13537739)
Yeah, the only solution is to test your backups - either automatically or manually through failure.

My small business uses a global network of cheap servers to provide low latency to customers, so we have encountered significant lengthy failures of disk or network once every few months, but hey, we can be damn sure our backups and deploy scripts work because we're forced to restore them all too often.

Re:GitLab Database Incident – Live Report by TimWolla on Tuesday January 31, 2017 @08:42PM (#13537396)
> is no way to be running a public service with paying customers

Is it even possible to pay for the hosted GitLab.com instance?

Re:GitLab Database Incident – Live Report by Shelnutt2 on Tuesday January 31, 2017 @08:56PM (#13537486)
Gitlab.com is free, not payed. https://about.gitlab.com/products/

The only for pay versions are self hosted EE and independent cloud hosting.

Re:GitLab Database Incident – Live Report by btgeekboy on Tuesday January 31, 2017 @08:57PM (#13537491)
Very well; my apologies. I've updated my comment.
Re:GitLab Database Incident – Live Report by Elizzy on Tuesday January 31, 2017 @08:38PM (#13537365)
To be fair the script is probably the same as what is in their repos, it probably wasn't set to report to a logging service that'd raise red flags.