I don't think having a system sit completely unresponsive to anything for a huge amount of time is exactly optimal either.

Absolutely, which is why configurable knobs are things that exist. I already have to mess with the OOMkiller on my servers; I'm fine with fiddling with knobs on my desktop box too. This is Linux, after all.

Wasn't one of the constant talking points in the war over the Init System That Shall Not Be Named that Linux needs to scale from embedded to big iron?

If you work in the cloud for any length of time you learn this is not true. Every system must be able to handle processes being killed unpredictably otherwise you will have problems. Better to deal with it and plan for it than expect a system to have 100% uptime. Because you never have 100% uptime.

The oom killer already exists on servers and already can kill programs.

If you want to turn off overcommit and have the system power off when it runs out of memory, the kernel allows that.

Whatever knob they add will certainly be configurable, and ubuntu desktop can configure it one way while ubuntu server configures it the other, if it turns out people would prefer that.

In practice, people running servers seem to want oom killers to kick in before the server barfs. One example of this is facebook's oomd [1]. I assure you, they're running that on their servers, not their web-browser-machines.

[1]: https://github.com/facebookincubator/oomd

With no script it’s rare for Firefox to eat all my memory (with 4GB of ram) more often It’s GCC. I really just need to be involved when that happens, going and killing things isn’t the answer.

One thing I do want to try is sand boxing the browser using UML (which I’ve been using a lot of lately.) This way since it gets its own kernel I can totally limit everything.

Having the system thrashing as described is worse than most alternatives, including those below for most workloads. There are probably a few workloads where thrashing is better, as maybe an operator can get in despite the thrashing and do the right thing.

a) killing the malfunctioning process (this is often hard)

b) killing the biggest process

c) kernel panic / locking up

d) killing more or less random processes until memory pressure is relieved

Thrashing in a distributed environment is probably going to end up with partially failed health checks and all the nastiness that comes with flapping. If you're lucky, failing health checks will reduce load and memory usage, and get you back to a happy place; if you're realistic, you probably got into the thrashing situation because of a burst of latency or traffic that resulted in slower processing for a bit and the resulting retries killed the system.

Then make it very predictable. Set a minimum amount of disk cache. Now you know that the OOM killer will trigger exactly X hundred megabytes sooner, and also that your performance won't tank because running code is all paged out.

I've had that argument countless times.

The last thing you want during operations (whatever your actual job description) is a server that's essentially not serving, not remotely available for troubleshooting and not crashing.

Connection refused is way better for the average server stack than timeouts or even worse accepted connections with transfer rates of 30 seconds per byte. "Connection refused" is a huge signal flare going off instantly, timeouts and extreme slowness will by definition take longer to notice while impacting systems, even if your monitoring were perfectly set up to look for it.