The Serverless Revolution Will Make Us All Developers
nextplatform.com
nextplatform.com
1. Permissions are a nightmare. You have to give both users trying to run lambdas and the lambdas' service accounts some crazy permissions sometimes in order to get anything to work. This is especially true with a lot of the "make serverless easy!" libraries out there, which seem to want an IAM user with all sorts of access that's against our normal security policy.
2. Networking is equally nightmarish. We operate with lots of VPCs connected to on-premise hardware and network infrastructure via DirectConnects, and the only path out to the internet is through our corporate data center (again, security requirements). Most Lambda-centric tools seem not to like this arrangement, and often barf when there isn't an internet gateway attached to the VPC. Moreover, especially in development environments we use relatively small subnets, which Lambda can consume nearly instantly if a large volume of requests come through. Finally, there's some secret sauce to running Lambdas in VPCs that I still don't quite have down-it seems to only work half the time.
3. If the future of compute is serverless, then Lambda, Google Cloud Functions, and whatever half-baked monstrosity Azure has cooked up are going to have to get together and define a common runtime for these environments. I refuse to invest in serverless until I know that I can run the same code on minikube on my laptop as I can in <insert cloud provider here> because vendor lock in is real and will bite you in the ass one day.
/rant
With reference to this article specifically, please, please chop off my hands and pull out my eyeballs if cloud computing becomes yet another workflow engine. I though we killed those off in the 90s.
I'll second that.
Moreover, I'm not sure who the author of this article imagines will fix all of these busted building blocks when some ill formatted or out of bounds data starts arriving from one of these IoT devices, not to mention non-standards compliant data.
But, seriously. I read this the other day:
https://www.theatlantic.com/technology/archive/2017/09/savin...
There's a discussion on HN somewhere. TLDR; we're building complexity into software that developers can't keep in their heads any more, which is leading to more and more errors.
It crossed my mind today when I was fiddling with some AWS stuff. Keeping a mental-map of all of these services, security groups, VPC topology, IAM configs, etc. is also growing more difficult.
And now, this. Haven't done Lambda work, but the paradigm would seem to contribute to mental noise. On one hand, it seems liberating to move away from bound-servers, but who maintains the configs and mental-model for all of the "unbound" processes that can "materialize", do work, then quiesce again? How about the dependency map between Lambdas? Overall, seems they'd kind of become "phantoms" over time vs. servers.
>Permissions are a nightmare. You have to give both users trying to run lambdas and the lambdas' service accounts some crazy permissions sometimes in order to get anything to work
And once you've done this, it has to be recorded and mentally mapped.
On a related note, I find much of AWS to be this way. For all of its success, it is not the clearest to navigate, especially on the interoperability front. It's not always obvious what you need to do to connect things the first time around on any given service(s), and it requires more trial and error than I'd like. When it doesn't work, it generally just doesn't work. Is it a security group? VPC setting? Firewall? IAM role? Something I don't know that I don't know? Do I even need this or that component?
Always seemed that there's a lot of documentation on the parts, but that there's something missing on the whole/overall cohesiveness.
Lambda's are the unattainable Chalice.
The API Gateway that you have to go through is byzantine.
Then Route53, CloudFront, yada yada - AWS has become such a massive bureaucracy - it changes so fast, documentation incomplete.
The other issue is the inability to keep Lamda's 'hot' - as they often take several seconds to load.
And of course easy shared memory and persistent file access.
Lambda's are simply not designed for use web-app folks - they are designed to to back-end dev-ops and IT tasks.
I think it's been like 5 years now and they are still a mess, I really want to use them, but I wont.
Absolutely. I see people trying to serve websites out of cloud functions. Reminds me of the mid 90s when people ran httpd from inetd!
Are you PM's reading this?
Give us:
+ Lamdas without the clumsy API Gateay (or at least a simple 'pass thru' mode.
+ Support direct integration with Express or whatever, so we don't have to create Lambda-specific code
+ Allow us to keep them 'hot' so latency is low.
+ Give us a way to access some kind of persistent file storage with 'fs'.
+ Same thing for shared memory.
If this were true, I would see a massive flood of people moving to Lambda's.
Nobody likes to have to manage Linux instances. We'd all rather something more manageable and easy to use.
I feel we are on the cusp of this and I still can hardy believe nobody has 'got it right' just yet.
You can call AWS Lambdas directly through the AWS SDK (or dozens of other event sources like SQS, Timers, etc.)
+ Allow us to keep them 'hot' so latency is low.
You can keep lambdas "hot" with periodic invocations, it's not standardized, but it's a thing
+ Give us a way to access some kind of persistent file storage with 'fs'.
There's also access to 500mb of data on /tmp. It's not always cleared after each invocation of your function, especially if it's invoked multiple times in succession, so you can use it as a "scratchpad" that provides some soft caching under high load.
S3FS works if you just want to expose S3 through an 'fs' interface.
Even if they are accessible via a javascript api, we need them accessible via regular HTTP for so many reasons.
'Periodic invocations' my gosh man, that seems like a big hack, requiring yet another service.
I get that there is /tmp - but it's not guaranteed to be persistent. I wish it were.
Anyhow - my main point is ... Lambda's don't seem to be designed for us in mind :)
Thanks for the pointer on S3FS, I will definitely check that out.
Surely. But what exactly are those economics? It can't be that bad.
We use Cloud Function for a large part of our infrastructure, and it's all just Node under the hood. Some of it we recently ported to Iron.io for cron runs and it was a pretty smooth process. I'm just curious what changes you'd actually like to see made here.
Granted, I'm a little spoiled in that regard since 90% of my work is on Kubernetes, and besides a few very small pieces of connective tissue everything is identical from cloud to cloud.
We really need something we can point to to express and legitimize our frustration with Windows to those who don't understand how much more effort it takes to deal with a totally incompatible proprietary system.
As far as I understand you invoke them just like you would run a docker container.
I think you'll actually find Azure is well in the lead on this one, well ahead of where Amazon is anyway.
If that is your concern, then you may want to consider that serverless isn't the right solution for your problem.
All the serverless runtimes across all the providers are basically identical. But that's not what makes them interesting. What makes them interesting are the ecosystems around them.
Lambda is the glue that binds AWS together. Most of your lambdas should be AWS specific, enough so that your vendor lock in won't be because of the specific Lambda runtime, but because of the services that you're using with your Lambda.
Maybe in the future when AI can handle lots of that stuff we'll get there, but as of right now we have a LONG way to go.
IBM Cloud Functions is a hosted, managed version of that service, https://console.bluemix.net/openwhisk/, running on the IBM Bluemix platform.
IBM Bluemix, of course, offers OpenWhisk on their platform, but you can set up your own OpenWhisk platform if you want.
(disclosure: work for IBM, but not in Cloud)
The amount of incipient complexity in programming has been growing, not going down. What's more complex, "hello, world" to the console in Python, or "hello world" in a browser with the best and newest web stack? Mobility and microservices create lots of new edge cases and complexity—do non-programmers seem particularly well-equipped to handle edge cases to you?
The problem has never really been the syntax—if it were, non-programmers would have made great strides with Applescript and SQL, and we'd all be building PowerBuilder libraries for a living. The problem is that programming requires a mode of thinking which is difficult. Lots of people, even people who do it daily, who are trained to do it and exercise great care and use great tool tools, are not great at it. This is not a syntax problem or a lack of decent libraries problem. We have simple programming languages with huge bodies of libraries. What's hard is the actual programming.
I agree. There's a never-ending stream of things (remember Klik & Play?) meant to make programming "easy for everyone" and they never manage to actually do so, because it's not possible to take away difficulty without taking away flexibility.
One of my father's COBOL books from the punch-card days has a similar sales pitch about English-like syntax and ordinary people becoming programmers.
What people do now with, for example, excel, was certainly once reserved to people with programming skills.
Ordinary people have not become programmers.
The guy claimed that his company had "done it properly", but it required a huge upfront investment in infrastructure, setting up everything properly and keeping it running.
Wasn't the idea that they were supposed to make things simpler and cheaper?
What?
I'd argue that most new startups launch something resembling a 'monolithic back end' (granted probably on the cloud and leveraging other services).
Moreover, this has nothing to do with 'single page apps'.
I think it's safe to say that if any individual or company uses the word 'serverless' they are either stupid or have been taken over by marketing and can safely be ignored and ridiculed
Just because I'm not maintaining my car's engine doesn't mean my car's engineless! Just call it "managed cloud" or something -- calling it "serverless" is nothing short of a blatant lie!..
I have this software package that I happen to own (the car) whose engine (the backend code) is claimed to be nonexistent, which annoys me slightly more than just "slightly" which motivates me enough to exchange micro-rants on forums with complete strangers.
There two factors that affect it:
1. The unit of time that the rental is active for. 2. Who controls the idle time of the resource.
Personally, when describing Lambda to people new to the concept, I eschew this "serverless" confusion completely by describing it as renting a server in 100ms increments for fractions of a penny. Works well for me!
I'd say "houseless" was an acceptable description. "homeless", ok, that definitely doesn't work for a renter.
> I'd say "houseless" was an acceptable description.
“Houseless” would be a very strange description of someone with a legal possessory interest in a house.
I'm not sure renting gives you any "possessory interest" in the house, does it? Can you cite some sources for that?
Yes.
> Can you cite some sources for that?
Ta.
Serverless may not be the best choice for a name, but it's the de facto name now. Most people I personally know that have used this word, me included, know that there's a server behind and aren't idiots.
I can't just put "managed cloud" on my CV if I want to get a job or if I want to be easily understood. Does that mean I am stupid and I should be ignored and ridiculed?
The easy answer was "serverless" represents the first step in enabling the ability to turn remote function calls into first-class citizens of your development environment. Since these "functions as a service" are auto-scaling, self-healing, and you only pay for what you use, you can treat them as disposable and regard them with the same level of utility as locally-run, JIT-compiled functions.
The issue was, and still is, how the hell do you get there? Every provider has a different implementation strategy (different runtimes, function signatures, etc.), different platform offerings, and different business incentives for pushing serverless compute. "Serverless", as it currently stands, is not synonymous with "effortless" - you must still understand nearly all of the underlying HTTP infrastructure to configure it. To the vast majority of software developers, the abstraction of "serverless" compute is just an exercise in incidental complexity to save $$ on overprovisioning.
I don't think the real story of "serverless" compute is about cost savings to avoid over- or under- provisioning. That's what I think this article gets right. The story that (hopefully) will eventually be told is one where this revolution, driven by cost-savings, was reshaped and reformed to allow developers to attain mastery over the cloud as if it were merely an extension of their local development environment. To get there we need rigidly enforced Gateway standards, better ways to build, document, deploy and integrate the functions we're building, and a hell of a lot more. We've taken the first step towards this vision of the future with FaaSlang [2], our open spec for type-safety, error-handling etc. around Functions as a Service - but there's still a lot more to do.
Hm, too me personally it's: Why would I want that? My computer is fast enough to for 99.9% of the stuff I want to run.. and for the last 0.1% it's not that hard to spin up a vm.
What am I missing?
It's not "that hard" to spin up a VM in the same way it wasn't that hard to visit Blockbuster video. You shouldn't have to know how to drive or know somebody who does to rent a movie. It doesn't hurt, it's a good skill to have, it's fun to get out and practice, but if you just want to watch a movie, why is it necessary? Think about building web services in this way.
A majority of developers we talk to agree that web development has gotten too complex. It's too hard to solve simple problems. Problem is that it's everybody else that has made things too complex. In the same way you become noseblind to a strong perfume, developers become techdebt blind to old technologies they're the most familiar with, then complain about the smells other people layer on top and around them.
The true innovations around serverless tech are coming from the ground up; at StdLib, for example, we've reimagined web services as essentially JIT-compiled, type safe, remote procedure calls. It means we're throwing out the need to even understand HTTP or REST to build a webservice, but opens up all kinds of neat opportunities and a new programming model.
Anyway... I could go on, but tl;dr is try StdLib out for yourself if you get the chance. Our number one piece of customer feedback is, "I never thought it [web dev, serverless functions, APIs] could be this easy."
It's interesting. (I don't like JS for backend work so I'm not your target market.)
Sounds like the author of the article has a conflict of interest.
Wouldn't you have the same problem if you had one hugely capable server trying to interact with your internal server which is not as capable?
The apparent pressure to deliver a revolution seems inorganic and forced. It looks like ambition, but I think it's more like hype.
Or you write your own glue code. You would be surprised of how much can be done with just copy pasting and gluing code together. The interacting API's needs to be much simpler then today though. This is why I like Node.JS, here's an example:
// Siri, I want to make a web photo gallery
var photoGallery = require("photo-gallery");
// Use pictures from Instagram with the hashtag #ashley30
var instagram = require("instagram");
instagram.getPictures({hashtag: "#ashley30"}, function gotPictures(err, pictures) {
if(err) throw err;
photoGallery.addPictures(pictures);
photoGallery.listen({port: 80}, function serverStarted(err, conf) {
if(err) throw err;
console.log("Photo gallery now running on port " + conf.port);
});
});"Windows 10 is possibly the worst spyware ever made"
"Windows 10 is spying on almost everything you do"
"You still can't turn off Windows 10 built-in spyware"
"Microsoft Windows 10 has permission to spy on you"
I'm tired of this tech bullshit doublespeak. Not selling is not the same as not collecting.
HOWEVER I do share the sentiment of the autor that some Revolution is in the air and something is possible today. Maybe an assisted parser, where a human and a computer co-operate to transform the mentioned instructions into some kind of standard code.
That's why we are experimnting with the angle programming language [1] "debuggale applescript for python that actualy works".
[1] https://github.com/pannous/angle (lisp for siri)