Into the Borg – SSRF inside Google production network

Re:Into the Borg – SSRF inside Google production network by repolfx on Saturday July 21, 2018 @01:22PM (#17582758)

As a Xoogler myself, I have always wondered about the logic of "we can't open source X because it uses too many libraries and is too integrated". The obvious answer is, OK, open source the libraries and refactor the integrations to make them more flexible.

Reimplementing all of Borg from scratch seems crazy to me given the huge effort that went into it. Does Google want an open source cluster infrastructure or not? If yes, in what universe is it less effort to write a totally new one from scratch vs just progressively open sourcing things?

[ Parent | on HN ]

Re:Into the Borg – SSRF inside Google production network by jsnell on Saturday July 21, 2018 @01:28PM (#17582784)

What's the size of the transitive dependency graph of Borg? 10MLOC? 50MLOC? 100MLOC? I have no idea. But it's a lot of code no matter what. Open sourcing that much code is a huge undertaking, unless you're just planning to throw it over the wall with no expectation of external people working on it.

On the other hand starting from scratch you get to grow the community and the codebase in lockstep.

[ Parent | on HN ]

Re:Into the Borg – SSRF inside Google production network by repolfx on Sunday July 22, 2018 @07:51AM (#17586303)

It may be a large undertaking but yes, it's clearly still less work to release code that exists and build a community around it, than rewrite it all from scratch and also build a community around that too.

[ Parent | on HN ]

Re:Into the Borg – SSRF inside Google production network by gpshead on Monday July 23, 2018 @06:55PM (#17596706)

You just filled up my BINGO card by saying "clearly" to indicate that you have no idea what you are talking about.

[ Parent | on HN ]

Re:Into the Borg – SSRF inside Google production network by repolfx on Tuesday July 24, 2018 @08:47AM (#17600495)

I've worked at Google for many years, and built open source communities based on code I've written from scratch several times. This is not an area I'm inexperienced in.

[ Parent | on HN ]

Re:Into the Borg – SSRF inside Google production network by justicezyx on Sunday July 22, 2018 @07:37AM (#17586264)

Generally Google software has a bottom up completely different approach to industry norm/standard. And the divergence started from Google’s very beginning.

Open sourcing system software from its internal state requires the same amount of work as rewriting, plus the effort to morph interfaces and internals to fit external needs, plus changes to internal workloads (assuming a unified stack internal & external).

[ Parent | on HN ]

Re:Into the Borg – SSRF inside Google production network by repolfx on Sunday July 22, 2018 @07:59AM (#17586321)

I worked on google3 for years, most likely some of the code I wrote is still there. I've also done a lot of open source coding too. I'm quite familiar with the structure of google3 and it's not as different as you claim - Borg is a bunch of C++ libraries and programs that depend on each other, nothing magic about that.

So I completely disagree that open sourcing code is as hard as rewriting it from scratch. I think if you tried to argue that to anyone outside the Google bubble they'd think you were crazy. Writing code is hard work! Uploading it to github and creating some project structures around it is vastly less work.

I can't help wondering if this is engineers looking for new promotion-worthy projects.

[ Parent | on HN ]

Re:Into the Borg – SSRF inside Google production network by justicezyx on Monday July 23, 2018 @12:59AM (#17590684)

To rebuttal your statements, I seem need to reveal a lot of technical details. You did not mention what type of software you were open sourcing when you were in Google. But it seems our overlap in knowledge is rather small.

I'll leave this open.

But I want to emphasize that what I stated are reasonable reasons for open sourcing by writing from scratch.

[ Parent | on HN ]