Hacker News Reader

Comment by rsync | Hacker News Reader

Agreed - we are, in a sense, "cheating" because our product is so simple that we do have one of these "very narrow use cases".

The benefits are tremendous, however, and go beyond day to day operations. A dumb switch has no credentials to protect and there is almost zero attack surface.

Further, if our switch dies we can immediately replace it with any other dumb switch that just happens to be lying around.

If you read failure studies - like those in the excellent Charles Perrow book _Normal Accidents_[1] - you see that in many cases there is a very special component that fails and everything goes to hell when they can't find a replacement for it.

So, while I can't encourage everyone to use dumb, unmanaged switches (because not everyone can) I can encourage everyone to remove as many very special components as they can.

[1] https://en.wikipedia.org/wiki/Normal_Accidents

View on HN

I work in industrie automation and I can't agree more to dumb devices. There are a lot of nice special products, but if something goes broken, you have first tousend of pages manual, just maybe an identical part. The guy on the night shift has also to know this special part well .. and so on. The dumb devices, you can replace easy without any problems tomorrow or also in 10 .. 20 years.

This aptly describes why I do not want a smart home even as a tech professional and why I drive a generic Toyota with easily replaceable parts.

How are you providing network level redundancy with dumb switches? My only guess is that the ISP is already doing HSRP/VRRP on the gateway and you can setup multiple NICs/switches with something like CARP and being careful not to make L2 loops.

Why would they need nework-level redundancy? This is a backup service, and should not have production load on it at any time. I'd rather see a system with a dumb switch and the risk of a 3-4 hour outage if it fails than a smart switch that can then be cracked. (Even then, 3-4 hours is a stretch, as all the remote hands has to do to replace a failed switch is put in any other dumb switch.)

Your reasoning could be applied when there is low number of users doing not-so-urgent-nor-important-things. However, the service is provided for a lot of users at the same time here, spread globally and all with their own applications and problems, and accordingly the total impact could potentially be much bigger.

Having the handicap of needing to wait 3-4 hours before being able to access your backups in an emergency, could make a day-and-night difference for continuity.

So I would argue it has nothing to do with "being a backup service", but rather that their users could afford a 3-4 hours of waiting. Or that they don't think like that.

Charles Perrow only died recently, very sad.

Reply on news.ycombinator.com