News for hackers. Stuff that matters.
Re:Millions of accounts compromised because there is no spec... by bagels on Tuesday April 21, 2015 @11:45PM (#9418567)
Can existing LDAP implementations scale a single directory to hundreds of millions of users?

I can find no clear answer after a few minutes of searching.

Re:Millions of accounts compromised because there is no spec... by beagle3 on Wednesday April 22, 2015 @06:41AM (#9419485)
You can probably list the organizations (outside of China, perhaps) that have over a hundred million of users in a twitter message - (Facebook;Twitter;Google;Walmart;WhatsApp;Instagram;Hotmail;Snapchat;Yahoo;IRS[0];Blizzard;AOL;AT&T;Verizon) is probably more than 30% of the list already. And AFAIK not a single one of them uses LDAP - but assume one of them does.

So, practically speaking - does it matter?

[0] And equivalent for each country with >70M people

Re:Millions of accounts compromised because there is no spec... by hyc_symas on Wednesday April 22, 2015 @12:53PM (#9421736)
You're quite wrong here. Google, AT&T and Verizon on your list use OpenLDAP. OpenLDAP scales to billions of users in a single instance, and of course it distributes across multiple nodes for even greater scaling as needed. Most of the telcos around the world use it now; it scales far beyond every other data storage technology out there.

http://symas.com/docs/2014-LOADays-jkozyra.pdf

80% of the US population that owns cellphones are OpenLDAP users, whether they realize it or not. 90% of the US population that subscribes to cable TV (Comcast, Time-Warner, etc.) as well. Nothing else actually works for hundreds of millions of users. These companies know, they've tried a lot of "solutions" already.

Re:Millions of accounts compromised because there is no spec... by beagle3 on Wednesday April 22, 2015 @04:38PM (#9423388)
Then I'm glad to stand corrected - I suppose I'm horribly out of date from the days they tried other "solutions". I'm less surprised about AT&T and Verizon, more surprised about Google.

My own personal experience with LDAP in general (and some with OpenLDAP in particular) dates back to 2000 or so -- and at some point I just gave up on the complex and unreliable beast that it was (for whatever reason, BDB would occasionally lock up or get corrupted) - but I know a lot has changed since, LMDB is amazing -- I guess it is time for another look.

Re:Millions of accounts compromised because there is no spec... by hyc_symas on Wednesday April 22, 2015 @07:16PM (#9424181)
OpenLDAP didn't start to become seriously usable until about 2003 (that's when HP dropped SunDS and adopted OpenLDAP for all of their global infrastructure). A lot of work went into it in the 2001-2002 timeframe to get it there. Yeah, a lot has changed, you've missed a couple generations of advancements. BDB's complexity was definitely a pain, but that's all in the past.
Re:Millions of accounts compromised because there is no spec... by Spooky23 on Wednesday April 22, 2015 @10:02AM (#9420447)
I'm pretty sure that with the appropriate infrastructure, The answer is yes. From a scaling limits POV, AD can support billions of objects. Pretty sure the Netscape derivatives (Oracle, the former Sun Directory Server, Red Hat) have implementations that large. I've worked with one with 40M user accounts and we weren't near any scaling limits.
Re:Millions of accounts compromised because there is no spec... by viraptor on Wednesday April 22, 2015 @12:07AM (#9418615)
OpenLDAP is limited by LMDB, which is pretty much limited only by what your filesystem and address space can handle. For scaling out it does support multi-master and slave configurations. So yes, it should.