News for hackers. Stuff that matters.
Re:Twitter alerted employees all office buildings closed and... by hristov on Thursday November 17, 2022 @09:11PM (#33648948)
This will be an interesting experiment in large scale code rot. How long do you think twitter.com will work with the code base frozen?
Re:Twitter alerted employees all office buildings closed and... by fotta on Thursday November 17, 2022 @09:23PM (#33649052)
The TLS cert expires on December 12.
Re:Twitter alerted employees all office buildings closed and... by post_break on Thursday November 17, 2022 @09:27PM (#33649097)
Oh man I just smiled like the Grinch.
Re:Twitter alerted employees all office buildings closed and... by jfoutz on Thursday November 17, 2022 @09:58PM (#33649417)
Me too. I'm not proud of that.

but it looks like somebody had their eyes on that issue

Expires: Tuesday, November 14, 2023 at 3:59:59 PM Pacific Standard Time

Re:Twitter alerted employees all office buildings closed and... by fotta on Thursday November 17, 2022 @10:03PM (#33649466)
Aww man. Glad I grabbed a screenshot before it got rotated.
Re:Twitter alerted employees all office buildings closed and... by gonzo41 on Thursday November 17, 2022 @09:48PM (#33649312)
I had a job once, when TLS was new and half the internet was not using some form of SSL. We had to manually do keyswaps on a stack of machines to create a trust network for all the certs. IT really sucked. I made a note of the certificate expiry data and a calendar reminder 3 years into the future to start looking for a new job if I hadn't already.
Re:Twitter alerted employees all office buildings closed and... by 3-cheese-sundae on Thursday November 17, 2022 @09:59PM (#33649422)
Hopefully that reminder never slipped pasta your attention.
Re:Twitter alerted employees all office buildings closed and... by gonzo41 on Thursday November 17, 2022 @10:35PM (#33649797)
Yeah!, for context, I saw and fixed that spelling mistake of calendar / colander. This week really has been a wild ride. Can't text fast enough.
Re:Twitter alerted employees all office buildings closed and... by nothrowaways on Friday November 18, 2022 @09:22AM (#33655094)
I hope you don't end up in a job where someone left on cert calendar reminder.
Re:Twitter alerted employees all office buildings closed and... by dilyevsky on Thursday November 17, 2022 @10:01PM (#33649440)
There is absolutely no way in hell those aren’t autorenewed. I think the answer is “quite a long time” actually. Eventually disk/machine rot in DCs will take over but it can take many months or more
Re:Twitter alerted employees all office buildings closed and... by matt_s on Thursday November 17, 2022 @10:37PM (#33649813)
Sure auto renewal but is it built to automatically roll certs across every system without any human intervention?
Re:Twitter alerted employees all office buildings closed and... by dilyevsky on Thursday November 17, 2022 @10:39PM (#33649843)
I would expect yes given they have tens(hundreds?) of thousands of machines alone
Re:Twitter alerted employees all office buildings closed and... by avisser on Thursday November 17, 2022 @11:22PM (#33650254)
To be pedantic, that just mean a script exists that can roll the new cert out everywhere it needs to be. There could still be a human who needs to initiate that script being run.
Re:Twitter alerted employees all office buildings closed and... by bruce343434 on Friday November 18, 2022 @03:44AM (#33652010)
Putting it in the crontab is an absolute no-brainer if you already have the script.
Re:Twitter alerted employees all office buildings closed and... by SoftTalker on Thursday November 17, 2022 @10:18PM (#33649621)
Everything I run at work is 5-10 years old or older. It all just hums along. Occasionally I replace a hard drive or a power supply.
Re:Twitter alerted employees all office buildings closed and... by sockgrant on Thursday November 17, 2022 @11:38PM (#33650400)
You get massive DoS attacks pretty regularly? State sponsored hackers?
Re:Twitter alerted employees all office buildings closed and... by kccoder on Thursday November 17, 2022 @11:38PM (#33650401)
Now multiply that frequency against the ratio of machines Twitter has vs you.
Re:Twitter alerted employees all office buildings closed and... by XorNot on Friday November 18, 2022 @03:10AM (#33651791)
On a modest Hadoop cluster of 300 machines with 20 disks a piece, we replaced 3 hard disks a week.
Re:Twitter alerted employees all office buildings closed and... by dilyevsky on Friday November 18, 2022 @02:59PM (#33661175)
Spindles? That sounds like a ridiculous amount burn rate - it should be no more than 5-10% a YEAR. Backblaze reports only 1.6% quarterly failure rate https://www.backblaze.com/b2/hard-drive-test-data.html
Re:Twitter alerted employees all office buildings closed and... by dilyevsky on Friday November 18, 2022 @06:32PM (#33664469)
Er actually missed its total 6k disks seems about right then
Re:Twitter alerted employees all office buildings closed and... by matwood on Friday November 18, 2022 @08:32AM (#33654343)
Is your stuff on the internet? I agree that systems that are 100% internal can get by for awhile without much maintenance, but anything on the internet is a completely different beast. Add in that Twitter is a huge target for DDoS, zero-days, etc..., and I don't see how anything just 'hums along' without near constant monitoring.
Re:Twitter alerted employees all office buildings closed and... by colechristensen on Thursday November 17, 2022 @10:26PM (#33649709)
> There is absolutely no way in hell those aren’t autorenewed.

I’d take that bet.

Re:Twitter alerted employees all office buildings closed and... by sidibe on Thursday November 17, 2022 @10:20PM (#33649638)
I'd be very surprised if disk/machine rot is what it would take for such a large organization to start experiencing major problems. Strange user patterns from all this and recent features/refactors that are suddenly not monitored would hurt something in the stack within a couple weeks if it was really abandoned. Having a few dozen senior engineers/SREs familiar with big chunks of the infra could make it months though.
Re:Twitter alerted employees all office buildings closed and... by notacoward on Thursday November 17, 2022 @10:49PM (#33649941)
Exactly. Things that are abandoned will eventually fail.

Not everything is automated. There's a finite amount of time to create new automation, and that time goes first toward the things that happen hourly or daily. The things that happen monthly still get handled by humans. Not everything is in the runbook either, and what is often ends up scattered among many wiki pages and help notes in tools, so it's not easy for a newcomer to find. So those monthly things have to be done by people who remember.

They remember how to clean stuff up when a quota/capacity limit is being approached, and who to call when they need more, and they can expect a response. They remember how to recognize when their service is approaching overload, or about to enter an oscillating state, and they know how to nudge it back toward sanity before the errors start to pile up. None of that happens when whole groups are gone.

Sooner or later, a service will start to run off the rails in one way or another, and the person who inherited that service will either not recognize it or not find the solution in time. Then it's Fail Whale time.

Re:Twitter alerted employees all office buildings closed and... by BWStearns on Thursday November 17, 2022 @11:05PM (#33650108)
Commenting to save this for Dec 13th!
Re:Twitter alerted employees all office buildings closed and... by dilyevsky on Friday November 18, 2022 @12:49AM (#33650886)
If you click on post timestamp you can favorite the comment ;) I guess I hold twitter infra in higher regard after all these years they’ve been in business but who knows…
Re:Twitter alerted employees all office buildings closed and... by BWStearns on Friday November 18, 2022 @02:34AM (#33651514)
I hold them in high regard but honestly there's just so many moving parts the odds of anything that complex being able to ghost ship indefinitely aren't fantastic. Apparently the NOC team is gone too. If it makes it 1 week without major outages/major malfunctioning the departed devs/sres deserve all the props.
Re:Twitter alerted employees all office buildings closed and... by notatoad on Thursday November 17, 2022 @11:19PM (#33650233)
maintaining any reasonably popular web property is a constant battle of striking down spammers, scammers, and hackers. their basic server code might keep running for months, but unless their engineering teams have been doing some truly magical work up until now the quality of the content is going to rapidly degrade if there isn't active intervention to keep the bad actors suppressed.
Re:Twitter alerted employees all office buildings closed and... by coffeeblack on Friday November 18, 2022 @07:47AM (#33653814)
And yet, somehow new Twitter has FAR fewer bots and spam tweets that three weeks ago. Hmm…

Edit: downvoting doesn’t change reality

Re:Twitter alerted employees all office buildings closed and... by coffeeblack on Friday November 18, 2022 @10:00AM (#33655660)
What is up with the rage downvotes? It’s pretty easy to look at the replies to popular Twitter users. There are waaay fewer crypto scam bots everywhere. Why deny reality?
Re:Twitter alerted employees all office buildings closed and... by mrguyorama on Friday November 18, 2022 @12:35PM (#33658328)
Those crypto bots being less pronounced probably has more to do with the entire crypto ecosystem being a bit... dying right now.
Re:Twitter alerted employees all office buildings closed and... by brohee on Friday November 18, 2022 @10:32AM (#33656158)
I had to eventually disable inbound PMs because the "offers to gain money working online" were just too many. So your mileage may vary.
Re:Twitter alerted employees all office buildings closed and... by tstrimple on Friday November 18, 2022 @01:50AM (#33651241)
> There is absolutely no way in hell those aren’t autorenewed.

Pretty sure a number of AWS and Azure engineers believed the same thing.

Re:Twitter alerted employees all office buildings closed and... by toast0 on Friday November 18, 2022 @04:03AM (#33652146)
I ran certificates for a well known service with lots of users (and not many employees), and it was all manual until well after we were aquired. If you don't have very many different certificates, it's not that hard to do it manually, and it doesn't look like they have that many [1]. Digicert is pretty easy to work with on a manual basis.

Of course, even if it was automated, you still have to pay the bills, and if payroll quit as has been suggested in the thread, I'd be suprised if accounts payable is sticking around

[1] https://crt.sh/?q=twitter.com

Re:Twitter alerted employees all office buildings closed and... by dragontamer on Thursday November 17, 2022 @11:14PM (#33650181)
The certificate looks like it was created on Nov 14th and is valid until Nov 14th 2023 to me.
Re:Twitter alerted employees all office buildings closed and... by fotta on Thursday November 17, 2022 @11:36PM (#33650372)
Yeah it looks like they rotated it. It used to be this one: https://crt.sh/?q=DA26F72EACAC75CCEE794140441020848697AEB0

The new one isn’t even indexed on crt.sh yet.

Re:Twitter alerted employees all office buildings closed and... by herpderperator on Thursday November 17, 2022 @11:41PM (#33650420)
My browser said that too, but that certificate may be cached from a while ago. The terminal gives a different reply:

  $ openssl s_client -servername twitter.com -connect twitter.com:443 2>/dev/null | openssl x509 -noout -dates
  notBefore=Nov 14 00:00:00 2022 GMT
  notAfter=Nov 14 23:59:59 2023 GMT
Re:Twitter alerted employees all office buildings closed and... by fotta on Thursday November 17, 2022 @11:47PM (#33650470)
I think they rotated it. The new one isn’t in crt.sh yet, but for posterity’s sake this is the old one https://crt.sh/?q=DA26F72EACAC75CCEE794140441020848697AEB0
Re:Twitter alerted employees all office buildings closed and... by notacoward on Thursday November 17, 2022 @09:54PM (#33649375)
Not long, but perhaps not for the reasons you think. With the code base frozen, no new incompatibilities can be introduced. That's how software (including operating system) releases worked for many years, and they did work. VM/container images are still basically this way, and they tend to keep running quite well too. One problem with both of these models is that existing security vulnerabilities don't get fixed, but that's not code rot. It's a serious but separate issue.

No, the way I think a frozen codebase will rear its head is when things that haven't been restarted in too long start to misbehave. When new updates are being pushed out frequently by a busy team, every machine (container, process, whatever) is being restarted regularly. People don't even realize what they're avoiding each time. Resource leaks, deadlocks, and timer issues can remain undetected a long time in that environment, then surface when the longevity increases. Even worse, some things tend to fail after a predictable amount of time, i.e. across most or all machines at once in a cluster.

I first saw this in 1990 at Encore, when our shiny new SMP version of UNIX became capable of staying up for a whole month at a time. Because of problems like those mentioned above, getting from one month to two took almost as long as getting from zero to one. I've seen the same scenario play out on many other systems since, and there's no reason to believe the systems within Twitter are immune.

Stasis is not the same as stability.

Re:Twitter alerted employees all office buildings closed and... by bydlocoder on Thursday November 17, 2022 @11:22PM (#33650259)
Dude, they use machine learning to tune JVM and OS scheduler, they'll handle restarts just fine.
Re:Twitter alerted employees all office buildings closed and... by solarkraft on Friday November 18, 2022 @03:51AM (#33652050)
Just put some Tesla autopilot engineers on it.
Re:Twitter alerted employees all office buildings closed and... by orangepanda on Friday November 18, 2022 @05:53AM (#33652957)
To accelerate server crashes?
Re:Twitter alerted employees all office buildings closed and... by notacoward on Friday November 18, 2022 @08:36AM (#33654399)
"They didn't get run over the last two times they ran across the freeway, so running across the freeway is perfectly safe."

They developed those methods of dealing with JVM and scheduler issues because those problems rose in prominence against the background of a zillion other problems. They became the longest poles, most worth spending time and effort on. But those other problems still exist, with more appearing every day. Yes, even without code change, because environments and workloads change too. Anyone who has actually been responsible for large complex systems, not just in the sense of working at the same team/company and riding the coat-tails of those who actually understood it, knows that they require continued attention and always will. Entropy exists.

Re:Twitter alerted employees all office buildings closed and... by thrwyoilarticle on Friday November 18, 2022 @08:44AM (#33654514)
I spoke to a HFT software engineer who said how useful the limited market opening hours can be - memory leaks are a non-issue, just kill it at the end of the day.
Re:Twitter alerted employees all office buildings closed and... by dangerface on Friday November 18, 2022 @10:07AM (#33655759)
This is very true. I learned this the hard way when I moved from making games that only ran for an hour to making server stuff and wondering why I couldn't keep a site up for more than a day and how are you supposed to debug if it takes a day for it to reach failure point. I haven't had the issue in a long time but I can see that being an issue if you are used to break stuff and release quick.
Re:Twitter alerted employees all office buildings closed and... by themenomen on Thursday November 17, 2022 @10:12PM (#33649549)
Until the AWS credit card gives up.
Re:Twitter alerted employees all office buildings closed and... by JyB on Friday November 18, 2022 @04:56AM (#33652572)
Is twitter completely on AWS?
Re:Twitter alerted employees all office buildings closed and... by jillesvangurp on Friday November 18, 2022 @02:20AM (#33651420)
Here's a crazy idea: 1) get rid of most of the existing code base and simply re-implement and migrate existing content and remaining users to the new thing. 2) get some small team together that does this. 3) stop bleeding cash while that plan is being set into motion. 4) keep the existing code base limping along while that is being put into motion.

I'm pretty sure that that's the plan Elon Musk is executing. It's simple, brutal, nasty, and probably not very well thought through. And yes he's not being very nice about it (to put it mildly). But it's not completely crazy if you can get over how obnoxious he's being.

He's clearly not interested in keeping the current team. He's never going to win them over at this point and from his point of view they were part of the problem, not the solution in any case. He bought a company that was basically not profitable, bleeding cash, and fresh out of ideas on how to fix any of that for many years. And he's now on the spot to keep that train wreck going. So, first order of business is to just cut the cost. That means decimating the team to a fraction of its size.

The Twitter team is basically rage quitting at this point so that's solved. Again, I don't like how he's doing it but undeniably, there are going to be vastly less people on the payroll very soon and cost will be a lot lower. The law suits that follow will be interesting though. But my guess is that he'll just buy those off and that will be it.

Of those that remain, he can cherry pick a team to salvage/build whatever he needs and then re-enforce it with some outsiders. Building a micro blogging platform is not rocket science and Elon Musk is actually deeply into rocket science. So, I actually get his gut feeling that this simply should not require thousands of engineers obsessing about all sorts of arcane software bits and pieces that somehow implement Twitter. It's a micro blogging platform with a fairly simplistic feature set. And he just called bullshit on how that was done at Twitter. And we're talking about a person with a long track record of having absolutely no tolerance for bull shit.

Again, not liking his methods but I can see his line of reasoning here. He has no respect for the Twitter team and he actually wants them gone. He wants to rebuild Twitter in a way that is cost effective and interesting to him. And he is not a risk averse person. So, in his mind that means a small team that can execute fast. I kind of agree with that part.

Will this work? I don't know. I see no technical reason that this plan could not work. But the big question is if the Twitter brand name will be worth anything by the time he's done or if he's just going to shut down the whole thing and walk away from it. He can certainly afford to do that. But letting this thing coast along just never was going to be a thing.

Re:Twitter alerted employees all office buildings closed and... by gjulianm on Friday November 18, 2022 @02:42AM (#33651565)
> It's a micro blogging platform with a fairly simplistic feature set.

Yeah, you can do Twitter on a weekend… if you only use it yourself and a few friends.

But we are talking about a platform with millions of users, all of which want real-time access to tweets written from anywhere in the world, including image and video content. Just getting to “no outages” and “low enough latency” parts is going to take a lot of effort to build from scratch. Don’t underestimate the complexity of Twitter.

Re:Twitter alerted employees all office buildings closed and... by jillesvangurp on Friday November 18, 2022 @03:00AM (#33651727)
Yep, just like Whatsapp. That team had about 50 people when Facebook bought them and a billion or so users. Twitter as it exists today is complicated and bloated. Doesn't mean that that's the only way to do it.

I bet mastodon doesn't have thousands of very active committers. They are taking a lot of users right now. With a hacked together pile of ruby and javascript. Easy to forget that that is how Twitter once started out as well. The bloated org chart came later.

Re:Twitter alerted employees all office buildings closed and... by bambataa on Friday November 18, 2022 @03:38AM (#33651964)
Isn’t the crucial difference with WhatsApp that it doesn’t store the actual message data? I thought that their servers just told what apps to send where. I may be completely off base here.
Re:Twitter alerted employees all office buildings closed and... by jillesvangurp on Friday November 18, 2022 @04:15AM (#33652232)
It's probably part of how they keep things simple. But you seem to imply that storing lots of data is hard. It doesn't have to be. I've worked with search teams that operate at a very large scale. You need lots of hardware but not necessarily lots of people.

The scale of Twitter is large but not enormous. Basically a few trillions of messages overall. Most of them pretty small. All of them immutable (well so far). And lots of images/videos with some CDN in front of that. It's a lot of bytes but not a whole lot of complexity. And a couple hundred million users and user profiles. I can think of a quite a few ways of dealing with all that.

What's hard is things like algorithms and good search. But that's a space where you can achieve a lot with a small and focused team with access to lots of hardware. And obviously this is also something where Twitter has maybe been a bit underwhelming and struggling. User growth and engagement stagnated years ago for them. This was not a healthy social network. It's not like they were nailing this. Throwing more people at the problem wasn't working.

Re:Twitter alerted employees all office buildings closed and... by tacker2000 on Friday November 18, 2022 @04:34AM (#33652387)
I believe back in the day the messages were stored on the users phone, but now with the web version, i think they might be storing the data now.
Re:Twitter alerted employees all office buildings closed and... by gjulianm on Friday November 18, 2022 @04:06AM (#33652167)
For one, the distribution patterns of Whatsapp are far more simple than Twitter. Whatsapp is mostly one-to-one and then one-to-some with groups (with those groups being limited to as little as 100 users at some point, the current 1024 user limit has only been implemented recently). Twitter is one-to-many, with "many" being "several million".

But also, how much time did Whatsapp have to get to that point? I'm not saying it's impossible, but that it's difficult and takes a lot of effort that shouldn't be underestimated.

> They are taking a lot of users right now.

And still less activity than Twitter, and with federation, and with some servers already locking new account creation (mastodon.social, the biggest one, doesn't let you create new accounts).

Again, it's not that it's impossible. It's that it's hard.

Re:Twitter alerted employees all office buildings closed and... by VaxWithSex on Friday November 18, 2022 @04:30AM (#33652363)
Easy to forget the "Fail-Whale", too...
Re:Twitter alerted employees all office buildings closed and... by nprateem on Friday November 18, 2022 @02:32AM (#33651498)
> Simply

Lol

Re:Twitter alerted employees all office buildings closed and... by tacker2000 on Friday November 18, 2022 @03:44AM (#33652008)
Rewriting software from scratch is almost always a very bad idea and im sure even Elon knows this.
Re:Twitter alerted employees all office buildings closed and... by bodge5000 on Friday November 18, 2022 @08:46AM (#33654551)
> simply re-implement and migrate existing content and remaining users to the new thing

You did warn us it was crazy

Re:Twitter alerted employees all office buildings closed and... by yreg on Friday November 18, 2022 @06:37AM (#33653233)
What code freeze? Surely Elon will keep pushing the team to merge and deploy changes fast as long as there are any engineers left. They will break it themselves.