News for hackers. Stuff that matters.
Re:“It appears that Twitter is DDoSing itself” by arter4 on Saturday July 01, 2023 @03:15PM (#36553928)
This is interesting.

Judging from the screenshot, a huge amount of GET /TweetDetail is generated which triggers some rate limiting, as shown by the 429.

If this is indeed due to the recent decision to enforce authentication for all API calls, it means the curlprit may actually be the API gateway or something similar downstream.

Also, this behavior seem to never stop, which isn't what one would expect from an exponential backoff retry.

I don't claim to be a better engineer than the folks working at Twitter, but it is interesting to see something like this in the wild, all Musk-related considerations aside.

Re:“It appears that Twitter is DDoSing itself” by rideontime on Saturday July 01, 2023 @03:32PM (#36554116)
Keep in mind that Twitter engineers are under extreme pressure, knowing that their H1B visas are at stake, to implement Elon’s whims as quickly as possible on systems they’re unfamiliar with. I doubt many of us would perform better in their situation.
Re:“It appears that Twitter is DDoSing itself” by xyzzyz on Saturday July 01, 2023 @03:38PM (#36554202)
Do you know how many current Twitter engineers are on H1B? Is this based on some data, or just speculation?
Re:“It appears that Twitter is DDoSing itself” by morelisp on Saturday July 01, 2023 @03:39PM (#36554214)
Re:“It appears that Twitter is DDoSing itself” by lolinder on Saturday July 01, 2023 @03:55PM (#36554386)
That's all employees, not just engineers.
Re:“It appears that Twitter is DDoSing itself” by georgeecollins on Saturday July 01, 2023 @04:06PM (#36554518)
Do you think twitter has a lot of marketers, PR, product managers under H1B? I don't have data, but in the tech companies I have worked at it engineers were the H1B visa holders, almost exclusively.
Re:“It appears that Twitter is DDoSing itself” by alephnerd on Saturday July 01, 2023 @04:26PM (#36554769)
They absolutely have a number of PMs on work visas. I'm friends with a lot of them.
Re:“It appears that Twitter is DDoSing itself” by booi on Saturday July 01, 2023 @04:31PM (#36554845)
I would imagine the vast majority of those are engineers. It’s pretty hard to get an H1B in a non technical field and I’m not sure Twitter would even have many of those types of jobs.
Re:“It appears that Twitter is DDoSing itself” by kibwen on Saturday July 01, 2023 @04:18PM (#36554664)
H1-B is for "highly skilled" workers, what skilled workers would Twitter have other than developers?
Re:“It appears that Twitter is DDoSing itself” by mikequinlan on Saturday July 01, 2023 @04:27PM (#36554779)
"fashion models of distinguished merit and ability"

https://www.dol.gov/agencies/whd/immigration/h1b

Re:“It appears that Twitter is DDoSing itself” by goldenkey on Saturday July 01, 2023 @05:05PM (#36555217)
Potential trophy wives of billionaires, of course.
Re:“It appears that Twitter is DDoSing itself” by YokoZar on Saturday July 01, 2023 @05:19PM (#36555352)
Is the assertion here that Twitter is employing H1-B fashion models?
Re:“It appears that Twitter is DDoSing itself” by morelisp on Sunday July 02, 2023 @08:31AM (#36560852)
You can look at the NAICS codes, the overwhelming majority are 54.
Re:“It appears that Twitter is DDoSing itself” by lmeyerov on Saturday July 01, 2023 @04:43PM (#36554982)
So maybe 20-30% of dev, which would be overrepresented here?
Re:“It appears that Twitter is DDoSing itself” by bialpio on Saturday July 01, 2023 @05:00PM (#36555158)
I think that may be outdated. Searching at https://www.uscis.gov/tools/reports-and-studies/h-1b-employe... yields around 60 applications in 2023 (but note that I'm not sure how things are counted given that H-1B is valid for 3 years).
Re:“It appears that Twitter is DDoSing itself” by morelisp on Saturday July 01, 2023 @05:28PM (#36555423)
The year is also only half over.
Re:“It appears that Twitter is DDoSing itself” by bialpio on Saturday July 01, 2023 @06:05PM (#36555782)
IIRC the H-1B application period is some time in the first half of April every year (so all the ones that would be filed this year have already been filed), but IDK if renewals need to catch that train.

Edit: clarifications.

Re:“It appears that Twitter is DDoSing itself” by morelisp on Sunday July 02, 2023 @08:46AM (#36560970)
H-1B approval has two stages, the registration period (March/April) and the petition period (ends 90 days after post-registration selection). AIUI this is counting petitions (i.e. I-129s), so won't be accurate until at least 90 days after selection notices - which would be around now - but then the site itself says it can further trail by a quarter.
Re:“It appears that Twitter is DDoSing itself” by cactusplant7374 on Saturday July 01, 2023 @04:31PM (#36554833)
You can access H1B job titles and salaries. It's public.
Re:“It appears that Twitter is DDoSing itself” by bheadmaster on Saturday July 01, 2023 @03:40PM (#36554221)
Yeah, I'd like some source on that, or I'll just assume you're pulling shit out of your ass because you jumped on the Elon hate bandwagon when Reddit told you to.
Re:“It appears that Twitter is DDoSing itself” by timeon on Saturday July 01, 2023 @03:55PM (#36554387)
> when Reddit told you to

Is this projection?

Re:“It appears that Twitter is DDoSing itself” by bheadmaster on Saturday July 01, 2023 @04:34PM (#36554875)
Nope, but apparenly I hit a nerve.
Re:“It appears that Twitter is DDoSing itself” by dcunit3d on Tuesday July 04, 2023 @06:50PM (#36593513)
I tried to point this out below. It's not even a DDoS, it's fake news.

https://news.ycombinator.com/item?id=36561808

it's a 429 error, so the developer who posted this is an idiot. they're not even wrong. the 429 doesn't even touch twitter's infrastructure. the HTTPS TLS terminates at a Google VM, which gets relayed depending on the VIP used to hit it, but the traffic never gets past that Google VM. This is literally /HOW/ companies deal with DDOS.

https://blog.twitter.com/engineering/en_us/topics/infrastruc...

it's unbelievable that my median salary for the past decade is $3,000 after several years of "Startup" followed by "How to Start a Reboot of My Life"

Re:“It appears that Twitter is DDoSing itself” by bheadmaster on Saturday July 01, 2023 @04:38PM (#36554925)
> If this is indeed due to the recent decision to enforce authentication for all API calls, it means the curlprit may actually be the API gateway or something similar downstream.

The way I understand it, DDoS is not caused by enforced authentication - enforced authentication is just a temporary measure against DDoS.

Re:“It appears that Twitter is DDoSing itself” by Quarrelsome on Saturday July 01, 2023 @04:40PM (#36554944)
I would guess the front end was written under the assumption that the back end would still work without auth. Perhaps the backend changes (mandatory auth + rate limiting) were pushed without sufficient testing of the front + back?
Re:“It appears that Twitter is DDoSing itself” by cactusplant7374 on Saturday July 01, 2023 @04:43PM (#36554984)
Did Elon pay the AWS bill? That seems like a likely culprit. Twitter instances are being forcibly shutdown.
Re:“It appears that Twitter is DDoSing itself” by amluto on Saturday July 01, 2023 @04:50PM (#36555045)
Twitter operates its own datacenters.
Re:“It appears that Twitter is DDoSing itself” by cududa on Saturday July 01, 2023 @05:32PM (#36555471)
Yeah but they use GCS for auth, moderation, and caching. They apparently haven’t been paying Google since April and the contract expired June 30th
Re:“It appears that Twitter is DDoSing itself” by vuln on Saturday July 01, 2023 @07:50PM (#36556570)
For someone that portrays they know so much about the agreements and deadlines you missed this article. It doesn’t help your narrative.

https://www.bloomberg.com/news/articles/2023-06-21/twitter-r...

Re:“It appears that Twitter is DDoSing itself” by afavour on Saturday July 01, 2023 @08:45PM (#36556955)
Is using the word “narrative” the new hot thing we’re doing to try to discredit someone we disagree with? It’s so difficult to keep track.
Re:“It appears that Twitter is DDoSing itself” by seattle_spring on Sunday July 02, 2023 @04:09PM (#36565160)
It's been hot for a while now. "Narrative" and "agenda" / "pushing an agenda."
Re:“It appears that Twitter is DDoSing itself” by cactusplant7374 on Saturday July 01, 2023 @04:55PM (#36555100)
"Twitter and AWS signed a five-and-a-half-year contract in 2020, which AWS is not willing to renegotiate."

https://gritdaily.com/twitter-owes-aws-millions/

Re:“It appears that Twitter is DDoSing itself” by williamsmj on Saturday July 01, 2023 @05:01PM (#36555163)
Twitter.com and the associated user-facing services do not run on AWS.
Re:“It appears that Twitter is DDoSing itself” by vGPU on Saturday July 01, 2023 @07:49PM (#36556564)
While it looks like they never started the move over to AWS, the press release makes it sound like they do use some AWS services.

> In addition, Twitter will continue to use AWS services such as Amazon CloudFront (AWS’s fast content delivery network service that securely delivers data, videos, applications, and APIs with low latency and high transfer speeds to customers globally) and Amazon DynamoDB (AWS’s key-value database that delivers single-digit millisecond performance at any scale).

Re:“It appears that Twitter is DDoSing itself” by williamsmj on Saturday July 01, 2023 @07:57PM (#36556622)
I worked there. Services running on GCP are a significant part of the internal service infra (ml platform, etc.) and it's no impossible that the abrupt loss of GCP would cause user-facing problems. The GCP spend was many, many times the AWS spend. Unless things changed since last November, AWS is not a meaningful part of the internal or user-facing infra.

With respect to DynamoDB specifically, Twitter has its own custom distributed key-value store: https://blog.twitter.com/engineering/en_us/a/2014/manhattan-... that twitter.com itself runs on.

Re:“It appears that Twitter is DDoSing itself” by 18pfsmt on Saturday July 01, 2023 @08:34PM (#36556888)
Thanks for weighing in with some actual first-hand knowledge. It is appreciated.

The latest on cloud hosting is from a week ago, and I'm guessing you don't have any more recent info than this:

https://www.reuters.com/technology/twitter-resumes-paying-go...

Re:“It appears that Twitter is DDoSing itself” by williamsmj on Saturday July 01, 2023 @08:56PM (#36557021)
Correct, no more recent (or less public) info than that. Like I say, losing GCP could cause problems users notice, but sounds like that’s not going to happen.
Re:“It appears that Twitter is DDoSing itself” by stefan_ on Saturday July 01, 2023 @06:59PM (#36556207)
And yet they also host with AWS, Google Cloud and Oracle. Cloud people take note: this is what lock-in looks like, and it's coming to a place near you.
Re:“It appears that Twitter is DDoSing itself” by SkyPuncher on Saturday July 01, 2023 @07:04PM (#36556250)
No, this has nothing to do with lock-in. This has done nothing to do with decision making that subverts good engineering.
Re:“It appears that Twitter is DDoSing itself” by firesteelrain on Saturday July 01, 2023 @08:12PM (#36556745)
Cloud agnostic is hard
Re:“It appears that Twitter is DDoSing itself” by badwolf on Saturday July 01, 2023 @06:16PM (#36555895)
Well, they haven't paid their GCP bill... https://theconversation.com/twitter-is-refusing-to-pay-googl...
Re:“It appears that Twitter is DDoSing itself” by vuln on Saturday July 01, 2023 @07:48PM (#36556553)
They’ve came to agreement.

Try to keep up with the story before you post 2 + week old articles that only show your bias. Thanks.

https://www.bloomberg.com/news/articles/2023-06-21/twitter-r...

Re:“It appears that Twitter is DDoSing itself” by 18pfsmt on Saturday July 01, 2023 @08:30PM (#36556868)
HN doesn't seem to care about facts anymore, just "SpaceMan Bad!"

https://www.reuters.com/technology/twitter-resumes-paying-go...

Re:“It appears that Twitter is DDoSing itself” by afavour on Saturday July 01, 2023 @08:41PM (#36556935)
I mean, when spaceman has been bad over and over and over you can’t be all that surprised when people see something go wrong and say “probably spaceman bad”.
Re:“It appears that Twitter is DDoSing itself” by fomine3 on Saturday July 01, 2023 @08:36PM (#36556899)
Refused paying once is enough to say the man is stupid.
Re:“It appears that Twitter is DDoSing itself” by o1y32 on Sunday July 02, 2023 @08:04AM (#36560665)
Re:“It appears that Twitter is DDoSing itself” by colechristensen on Sunday July 02, 2023 @11:53AM (#36562626)
This is not remotely a likely culprit.
Re:“It appears that Twitter is DDoSing itself” by romseb on Saturday July 01, 2023 @05:02PM (#36555184)
"curlprit" for too many GET's causing a 429 is just the perfect typo.
Re:“It appears that Twitter is DDoSing itself” by readyplayernull on Saturday July 01, 2023 @05:34PM (#36555488)
Could someone report the error at [email protected] and see what they think about it?
Re:“It appears that Twitter is DDoSing itself” by vuln on Saturday July 01, 2023 @07:43PM (#36556518)
Quite the knee slapper. Thanks. I hope you didn’t spend many brain cycles on it.
Re:“It appears that Twitter is DDoSing itself” by Scalene2 on Saturday July 01, 2023 @08:27PM (#36556841)
Making jokes about Twitter is too easy.
Re:“It appears that Twitter is DDoSing itself” by meepmorp on Saturday July 01, 2023 @09:43PM (#36557340)
Why do you take people criticizing Elon Musk so personally?
Re:“It appears that Twitter is DDoSing itself” by oneeyedpigeon on Sunday July 02, 2023 @03:46AM (#36559263)
Do you think it's more or less funny than auto-replying to all PR enquiries with poo, when you are an incredibly large company?
Re:“It appears that Twitter is DDoSing itself” by ineedasername on Saturday July 01, 2023 @09:10PM (#36557145)
Whoever is in charge of that account went all Oregon Trail on things and caught dysentery
Re:“It appears that Twitter is DDoSing itself” by kccqzy on Saturday July 01, 2023 @08:27PM (#36556837)
While exponential backoff is theoretically optimal, I doubt it's actually used that often in practice. I've seen too many cases where someone decides serving user requests with low latency is so important that they'd rather have a constant randomized backoff than exponential backoff. I've been in many design meetings and seen enough documents where the decision not to use exponential backoff is explicitly made, understanding the tradeoff with overloading and system recovery.
Re:“It appears that Twitter is DDoSing itself” by klabb3 on Saturday July 01, 2023 @09:05PM (#36557112)
I wouldn’t be surprised if this has no back off or limit at all. 10 RPS is fast enough that it may simply be sequential.
Re:“It appears that Twitter is DDoSing itself” by colechristensen on Sunday July 02, 2023 @11:51AM (#36562617)
I’ve had to… uhh… eagerly advocate for exponential backoff for weeks of constant uptime issues before someone listened and actually implemented it and solved the problems.

Like several times in different roles.

People do it, exponential backoff is everywhere in your stack, but it doesn’t end up in your application layer until you have enough traffic that you actually have to manage throughout.