Got Users? How About 100M of Them? | Hacker News Reader

Got Users? How About 100M of Them?

inversoft.com

57 pointsSbobby8365 comments

> Did you know that each time you log into Facebook, check your email or fire up Candy Crush, a software engineer has thought about user registration and authentication.

It's a bad sign when the very first sentence of your promotional blogpost has no coherent meaning in the English language.

> I am quite sure that if your application actually grew that quickly the rest of your infrastructure would fail spectacularly. But rest assured, Passport will be just fine.

Another thing about writing promotional blogposts: don't belittle your potential clients.

Interesting take. I didn't see this as a put down of any potential client but more to say it is difficult to grow so quickly. Imagine the load on game servers if you grew to 125 million users over a weekend, this load is considerably different than that of an authentication server.

I am trying to figure out the use case of login as a service. There obviously is one, but I am having trouble thinking of it. Clearly login means something different to each app, right?

The registration and login parts are usually the simple features to implement. Its the localization, emailing, password encryption, disciplining, rewards, two-factor authentication, OAuth, login reporting, registration reporting, daily active users reports, and monthly active users reports that are the more challenging features to build yourself. Almost every application needs all of these features, but very few have them because they take so long to code.

So encryption, emailing, oauth... DJango or another modern framework does all of that out of the box or with a plugin.

Login reporting is cool... But if you build your own you can get full app reporting. Not sure of the exact value add but I would way rather have reporting on all pages not just login.

Localization? The hard part is translating my entire app. Not sure if I do that work, I'm going to be mad I have to translate the word login and logout

I know that I've found that above the base features that many frameworks provide such as DJango - if you start pulling the thread on features like forgot password / reset password - I quickly find there is a lot of coding to be done.

Click reset, store a unique id, send the user an email with a link including the unique id, verify that ID on the request and then allow a password change. Then to be secure that unique id needs to be timed out once it is generated to ensure the link is only good for a short period of time, etc.

Not to say anyone couldn't code all of that, but some of the simple features once fully thought out end up being fairly complex. In my experience many of the out of the box options still need to be extended to be fully realized for enterprise usage.

I don't have a ton of experience with DJango specifically so I could be mistaken - perhaps it does more than I know.

I'm thinking separating user auth (and details required) with something like this from user domain data would drastically reduce the likelihood that one hack could compromise everything all at once.

The old scatter your seeds and hope approach?

I think adding more systems increases your odds of being hacked, even if slightly lowering the damage of one hack. I would kinda prefer to avoid hacked all together.

That sentence is a little awkward but I'm not seeing anything horrible about it. (Surely you're not complaining that there should be a "?" at the end?)

I stuck it into the Stanford NLP parser ( http://nlp.stanford.edu:8080/parser/index.jsp ) and the output matched my prior reckons.

Perhaps it's just wrong? A software engineer doesn't think about user authentication and encryption every time someone logs in to any popular service. That would be silly, and impossible. I mean, maybe it's just being hyperbolic

Or maybe it is just supposed to mean that a software engineer had to think about, and set up, the login system for each system you log in to at some point.

Technically, it's trivially true. Of course a software engineer has at some point "thought about user registration and authentication."

I presume that's what it's going for, but all in this is one of the worst promotional blog posts I've ever read.

I was being generous and assuming they meant "every time a user logs in, a software engineer thinks about security" because the alternative is literally meaningless.

To elaborate, statements like "every time you shake hands with someone, a volcano has erupted" are equally, trivially, true. They just don't mean anything-- anything at all. There exists some volcano which has erupted. Therefore any time you shake hands with someone, eat a meal, go to sleep, push a button, etc... that statement is still true, just like it was and would be with or without your entire existence. At which point you're just saying words to hit some word count or something. Or maybe allude to some unstated connection... ?

I wasn't addressing its truthiness, just responding to the claim that it "has no coherent meaning in the English language".

I don't see this as belittling customers or incoherent at all. I'm pretty sure every engineer has thought about these issues before and we've all seen spectacular crashes from load. I think the idea of the article is that user registration and login isn't as simple to scale as everyone thinks it is.

Not a good reflection on your actual ability to scale when a 500 word blog post makes your entire web server choke after just a few minutes on the front page.

That's what happens when 10,000 people hit your website all at once. :) I think it's probably Wordpress that is sucking here though.

That makes it better? This is a marketing post and should reflect your company's strengths, especially when the topic of the post is about said quality.

I always remember in moments like these that Cloudfare is something like $50-200 a month. Wait, a quick look is $0/$20/$200 with $0 or $20 probably covering it. Hmmm.

Cloudflare doesn't cache your sql queries.

It's a static webpage. You shouldn't need to re-run SQL queries for each user.

Pages like this is literally what CDNs are great for.

That's what I was thinking. Only need to do SQL on actual registration process. That's if you use a SQL DB for it as opposed to in-memory, key-value store that persistently writes to disk. Alternatively, doing data at app layer (eg AllegroCache-style) with a partitioning scheme distributing among a number of inexpensive nodes. Quite a few things to do before we run into SQL's problems even if it involves data processing.

I'm building a CMS in the same vein as the others (WordPress, etc.) and made static page caching a first-class feature that bypasses the autoloader completely.

https://github.com/paragonie/airship/blob/e24ea5a4605336b171...

This is something that really ought to be baked-in in 2016.

Hey, while you're on, I have a quick question. I've avoided PHP in favor of more static, safe languages with small TCB's. Early on, I thought about reimplementing the runtime/libs in one or compiling it to one. Discovered Quercus PHP on Java system that claimed benefits of both. Had potential given Java gets constant bughunting and has many implementations.

What do you think of compiling PHP plus libs for app compatibility to something like Rust, Ada, or Cyclone where possible? And do you know if anyone has assessed quality/security of Quercus/Resin code in particular? Seems something like that compatible with WordPress or Airship could be quite a boost in defense of code injection at system level. Performance, too, as we saw with HipHop.

I think that would make for a very fun research project, especially if a memory-safe language like Rust were used.

In addition to your examples of Quercus and HHVM, someone is currently working on compiling PHP to .NET: http://www.peachpie.io

I'm not aware of any security audits on any of these efforts.

Well darn. I was hoping someone had reviewed them. Good to see positive feedback on the concept, though. Btw, there's also Phalanger for .NET:

https://en.wikipedia.org/wiki/Phalanger_%28compiler%29

Already runs WordPress, phpBB, etc. Anyone doing this sort of thing on .NET might consider starting with contributions to it. I'm trying to avoid CLR and JVM due to runtime complexity where possible. Aside from Rust, Go is another possible target for a simple runtime.

Cool stuff. Also libsodium by default as I expected. :) You got a summary page listing the features and advantages of the CMS for those that don't do PHP? Other than probably extra attention to quality/security. As usual, I'll pass the info along to people online that might benefit from it.

In fact, I do. It's still beta software (and the design used in the screenshot is out-of-date already).

https://paragonie.com/project/airship

Working on the PKI and plugin distribution system right now, so people can make/share themes and whatnot.

Alright. Bookmarked. So, it's a basic CMS for the niche of people/companies who need more security or uptime than feature bloat. Has better update policy and works hard to make some security features more usable. Am I reading it right?

Yep, that's about it in a nutshell.

Alright, I'll pass it along to PHP people starting new sites as I run into them.

True, but the post is about scaling Passport, not really scaling Wordpress. I haven't seen the site crash, so I seems like its just taking the server a while to server up the static content.

Your dismissive tone is concerning. Because your Wordpress site doesn't load, we can't learn about your "Passport" service, so you're wasting 10,000 prospective customers.

Implementing something as simple as W3TotalCache and CloudFlare, and eliminating slow plugins via p3profiler, should mitigate any initial scaling issues assuming your server architecture is set to scale properly via dynamic scaling or horizontal if for some reason you're using on-prem, physical hardware.

Wordpress only sucks if you don't configure it for the expected traffic. At scalability anyway.

Which sadly is out of the box.

Not that hard to scale static blog post wordpresses.. but man the default is like 4 requests per second bad ;)

Ouch. Looks like we need to do some serious blog tuning. :)

I've had a blog post sit at the #1 spot on HN for nearly 24 hours and my server never even sweated.

I have a cheap VPS and didn't do anything fancy with caching. I just don't code like a n00b.

Also, either use SuperCache or ditch WordPress entirely.

Plenty of sites with bigger traffic spikes than this run on WordPress. It shows that they haven't put any effort into scalability.

More realistic worst case scenario is a huge chunk of those 18 year olds trying to get an account after school. You'd need a tad more than 400 requests a second to handle it. Even one percent of one percent of them doing it is 7,300 users at once. Maybe request buffering and storage could help while the main node just does its measily 400 a second.

Then again, 400 a second doesn't sound that fast given what HSM's and databases do. Maybe this software is just doing something complicated with each request.

This is 400 _registrations_ per second not logins. On the test hardware, Passport can handle 1,000 logins per second. Remember that the server this test was run on is 10 years old and has crap hardware. Running these tests on a modern box with new Xeon CPUs and a 2400MHz bus would probably double or triple those numbers.

Scenario: Servers has to be restarted (or crash) during rush hour with 100M active users.

Even being generous and allowing for 10000 logins per second, it will take almost 3 hours for everyone to relogin. Oops.

Ok, so that 100M is clearly not viable for services that actually expect a significant amount of their users to use the service at roughly the same time (that is - it would clearly not handle Facebook amount of load).

A much more relevant metric would be how many simultaneous sessions you can handle while being able to claim good service (say, the 99th percentile being able to login without getting time-outs).

Also, generally speaking, most authentication systems will involve at least a few server-side writes for logins, meaning the difference to new registrations shouldn't be all that big in a well designed and compartmentalized system.

Disclaimer: Yeah, I used to work for a company that did authentication servers for ISPs.

There we go. That a good example of the kind of issue I was talking aboug. A much more realistic one, too. Of course, we're talking about registration rather than just authentication. Their authentication numbers are probably much higher and such are easy to HW accelerate.

Ah, yeah I test on old hardware for efficiency too. One thing Im trying to assess is how registration might be accelerated. What operations are involved in a registration request that arent a trade secret or something?

During registration, you need to handle things like assigning roles to the user for your application, verifying the users email, setting up two-factor authentication (if they want) and storing metrics. The metrics are helpful for tracking registrations and correlating them to things like marketing campaigns.

Ok, so it's not sounding so bad at this point. Plenty of acceleration opportunities for such things.

Seriously thought this was going to be about getting a 100M users, not load balancing for them.

Haha. I wish! That would be awesome, but getting to 100M users is probably 10% planning/process and 90% luck.

If you define luck as knowing how to do it, sure; otherwise, no, it's not luck, but not easy.

Google Cache: https://webcache.googleusercontent.com/search?q=cache:aGmxOP...

If I can save time and not have to figure out security, reporting and everything else, I'm on board!

Agreed, but if I'm a dev - I prefer something free to start with, generally I'm not going to spend a lot of money when there are free alternatives.

I like how Atlassian does it - they more or less give it away for free for small companies and then once you can afford it they start charging more. Unless I can get going for free, probably a non starter.

Passport is free for up to 50 users. This is enough for most developers to get started and into production (depending on the use case). Plus, you don't have to pay more for internal versus external users. Everything is based on the total number of users in the database, so pricing is simple.

Awesome company and awesome team!

400 requests per second.

Look, I get it, there aren't a lot of female engineers and saying things like "you guys" is probably annoying to the few there are.

That said, inserting "she" everywhere just feels disengenuous, and I notice it everywhere from technical blogs to a16z write ups.

Sure your company is 30% female in all positions (amazing for the industry in this hypothetical) and you're top tech team is all over it. You're core engineer, she's digging through mounds of code with only her team of 2, an african american native inuit, top of her year at stanford, and a trans person.

I would love to see the industry be attractive to all types. However, you can't just swap pronouns because it sounds so fake amd disingenuous. Probabalistically speaking, your engineering team is not 100% women or even close.

idk, maybe blasphemous or inflammatory, just strikes me as a feeble attempt to notmalize something that isnt normal...

edit; wow, I apologize I guess? It seems forced to me that the whole industry changed pronouns (if little else) over night. So I guess I am a misoginist for actually thinking more equitable demographics would be better than some language nuance, which just feels forced

edit2: i deleted some comments that basically said the above, but slightly more rudely. apologies.

What exactly is "not normal" about female engineers?

Occasionally using "she" to refer to an unknown person is a welcome relief from the abundant writing which solely uses the male pronoun. When documentation uses "he" it doesn't mean engineering teams are 100% male and using "she" doesn't mean the inverse.

It isn't normal unfortunately. It's why there is a push for women in tech. There isn't a top company that is 50/50(i don't believe this has to be the case accross the board) but using it just feels disingenuous.

Idk, i'm not a femal engineer. Maybe passport was predominently written by female engineers. If I was a minority in some arena,I suspect I would be slightly off put if they just pretended I wasn't

Why on Earth would it have to be 50/50 for something to be "normal?"

Only about 43% of college students are male. Does that mean it's not normal to have a male college student?

Please take your casual sexism elsewhere.

You are literally saying that 'she' isn't welcome. And having 'she' everywhere is no more disingenuous than having 'he' everywhere. Neither one covers everybody, and just defaulting to the majority has a ton of problems. Even more problematic is when people feel the need to shout it down when they see minority representation. Why did you feel the need to stamp this out instead of responding to the actual content of the post?

In a lot of the US, 'you guys' is standard plural you regardless of gender, but we don't have a gender neutral pronoun other than "they" which only works some of the time. https://en.wikipedia.org/wiki/Singular_they

But in this case it would have worked fine: "a software engineer has thought about user registration and authentication. Hopefully they have thought a lot about it."

Let's push for the expanded use of "they" as gender neutral singular rather than pushing "she" down.

i think it sounds odd given what I know about the demographics. Almost as if the problem is perception, not real numbers. So i agree with you for sure. I'm not against it, I just think "she" started getting wodespread use after the demographics issue came to a head earlier in the year.

edit:

> you are literally saying she isn't welcome

If I literally said that, qoute me...

It's one hypothetical person in this article. One!

A lot of females say "you guys" when referring to other females. I've heard it many times in everyday conversation.

'She' appears exactly once in the article, 'her' never.

You are complaining about a single instance of 'she' involving a hypothetical person.

I hope for your sake you are trolling, because you have some warped world of priorities if not.

Mo users, mo problems.

Truth.

Reply on news.ycombinator.com