Hacker News Reader

Comment by dimitar | Hacker News Reader

I've used both and will gladly recommend AWS over Azure:

* Azure APIs, tools and services get deprecated often. As soon as 3rd party docs get good and the bad bugs get fixed it will get deprecated. AWS has its share of v2 APIs, but most of the fundamental services are the same for more than 10 years. The new services build on top of the old ones, instead of replacing them.

* MS reps will endlessly spam you and every colleague in your org to adopt their latest preview features (gasp! You are not using ML and AKS??); But if you end up trying them you will find that they are half baked and if you get any sort of incident they will ask you to rewrite your app to accommodate them, rather than fixing their own bugs/state.

* AWS has great 1st party documentation, and the stability means great 3rd party documentation gets created as well. Azure gets astroturfed "community" docs written by Microsoft employees. Community means that support and official pages link to them, yet Microsoft has no obligation to keep them up to date or take any responsibility of their contents.

* I admit I like Azure resource groups (a logical container of resources in an account, required for every resource and simpler than the AWS equivalent). However I don't really miss them when I follow best practices (billing alerts, separate accounts for environments, IAC, tags).

View on HN

> Azure APIs, tools and services get deprecated often

My experience with "new" Microsoft is that they're still learning how to play nice with others.

Not in that they don't want to, but that they're objectively bad at it, because it's not something they're institutionally used to doing.

"Old" Microsoft was "We build what we want, how we want, at the pace we want, and we produce some very polished final docs, and you use what we built how we expect."

Continually iterating on externally facing services owned by a small team, and consumed in arbitrary ways by third parties, is a very different model than the above. We'll see if Microsoft can re-org to the challenge.

There is no "old" or "new" microsoft. Time and time again they've shown us they are still the same old thing. Company DNA is what it is. Uber also falls into this category.

Don't let yourself be fooled by the same trick repeatedly.

Or we could accept that huge enterprises have a lot of institutional inertia, and real change plays out over a decade+.

Or as the quip goes: culture doesn't change until the previous generation retires or dies.

Huge enterprises are big enough they don't care about you.

You need to pick right sized providers so that you'll get decent service.

Relying on Google, AWS or Microsoft and not paying them millions means they won't give a crap about you.

Meh, Microsoft is enormously different than they used to be. They still might not be what you want, but they aren't the same.

My firm is investing quite a lot of money / time / effort in our Azure infrastructure for relatively large and complex models (financial models with up to 10k cores; nothing very fancy just lots math and lots of customers). Our engineers are capable, they seem happy with the stack and we actually get pretty solid support from Microsoft. We ran into several Azure-specific bugs in the last few years which get timely triage, quick fixes within hours and solutions within weeks. We’re probably overpaying and have been Microsoft-centric for the decade I’m with the firm, so the local relationship is probably excellent. All in all it’s a lot more affordable than the license fees for niche supplier software we were using before. Point being it’s relative cost and engineer satisfaction that matter more than the last few million in costs.

Might be worth comparing them with other cloud providers rather than niche supplier software.

Part of our experience away from vendor specific tooling was building a team that could handle the transition. It started with perhaps 2 or 3 engineers doing PoC’s. Then an architect came on board with Azure experience. Things went from there. We’re now at about 40 engineers working for / with about 100 actuaries / quants. I know the lead architect has theoretical vendor neutrality in scope, but the aspect of successful teams working in the MS ‘package’ is alluring as well. We don’t need to squeeze the last drop - the projects are already successful both in financial and human terms. End of the day a business always has vendor risks. It’s about picking the cost-risk-reward structure that fits. All in all MS serves us well.

(We do have healthy laughs about the internal accountmanager for MS always chasing the latest and greatest. Virtual desktops, Azure ML and such. The lead architect mentioned luckily decides on the stack, not our sales reps.)

Hah from what I understand Azure ML might be late, but it is not great :D

They’re the same asshats. With a thin layer of marketing veneer over the top, telemetry underneath all floating on a vat of poor testing, poor delivery and poor quality.

I had a defect open for 9 years on connect that affected 20,000 users. Couldn’t pay them to fix it even as a gold partner. Now they just abandon all their shit in GitHub instead and sell you a subscription to be served up ash and beer dregs while reminding you that they love Linux and open source while trying to get leverage and replace whole chunks of it with their bananas ecosystem.

Edit: must be lunch time at MSFT. Downvote flurry.

I think it's more that your comment is 95% salt and 5% substance an so isn't adding much to the conversation. More details like the connect issue and less "ash and dregs".

I will write up the 30 years of using MSFT stacks and OS up at some point. That’ll be 100% substance. But the salt will have to remain.

If you want to see the real MSFT check out the dotnet team handling of the customer demands to remove telemetry. This is on GitHub issues. Or was if they haven’t reorganised all the repos again thus backing up the other schizophrenic donkey comment.

See https://isdotnetopen.com

Well that was an interesting read and entirely unsurprising.

I would never consider building a new product on .Net. It’s an insane proposition at this point.

Well, to give just one example: zip deploys (code) to azure functions always return 200 OK, regardless of whether the deployment actually succeeded. To know if the deployment succeeded, you need to use a second API (the kudu mgmt api) to access the text logs, and scan the text logs for errors. Due to our CI infrastructure, we do multiple deploys per day, and I can tell you that most of our deployments require 2-3 attempts to deploy successfully. We have a whole salt mine of workarounds like that in our deployment infrastructure.

It's been that way for years. Every now and then, they pull another Microsoft on top of this. The latest that I remember is that even after successful deployment, the function would actually not get activated until you polled its existence using the Az cli tools. We hit that one because we used the Powershell Az module, and of course the cli tools and powershell exercise different code paths :/

Oof. I've come to despise Kudu for these kinds of reasons. We ended up ditching direct zip deployments and now do Docker images, which get pulled automatically using the webhook on the container registry. It is far more reliable and also far easier to integrate into a devops pipeline.

Hi tremon. I work for the Azure Functions team. Sorry for the trouble. This should not happen. We should be giving you a proper response code when the deployment fails. It looks like you are using the sync version of the API but just double checking if you are using the sync or async version ? If you are using the async version then in that case we do return a 201 immediately and then you can use the status url to poll for the status. I would like to dig in and figure out what's happening here.

For the PowerShell Az issue as well - it would be good to know what command you were using/what you were trying to do. We dont support deployment of code using the Functions PowerShell Module (https://www.powershellgallery.com/packages/Az.Functions/4.0....). Did you deploy using AZ CLI and then using the PowerShell Module ?

You can either share your Function App info here by using this method: https://github.com/Azure/azure-functions-host/wiki/Sharing-Y...

or just email me at anirudhg at microsoft.com and I will look into this.

Thanks again for using Functions.

Do you have any plans for “easy auth” (that’s what MS support called it despite it not being called that anywhere in the Azure UI or documentation) with azure functions or at least not allowing people to try to set up auth for azure functions when according to your internal support AD-B2C “easy auth” is not compatible?

BTW I just want to say that functions kinda work aside from the above issue, but having to write a boot-loader that handles auth, kinda defeats the purpose. Or is it just that AD/B2C is so bad even your support guys don’t know how to set it up? Tried this about 12 months ago so maybe it’s changed in that time but fuck me dead getting auth to work with functions was a pain in the ass and made me swear I’d never touch another azure project again. I don’t think the problem is with Azure Functions per say, every interaction with AD/B2C at every org I’ve worked for that used Azure has been a monumental disaster of poor documentation and excessive complexity. You need a true expert in auth to work with it and even then they will spend half their working life swearing. The auth offerings from Google and AWS just work.

AD/B2C is also the biggest problem with teams (I just can’t log in on my machine as I’ve too many accounts for it not to get in a tizzy). I can’t even play minecraft cross platform because of it.

We don't perform the zip push manually, we use the AzureFunctionApp pipeline task. What that uses under the hood, I can't tell.

  - task: AzureFunctionApp@1
    inputs:
      appType: functionApp
      deploymentMethod: runFromPackage

This task always succeeds. Whether that is because it's using the async API and ignoring the status url or because of different reasons is beyond my control. All I can tell is that with regular occurrence, the wwwroot will contain the file 'FAILED TO INITIALIZE RUN FROM PACKAGE.txt' instead of the actual deployed code (web.config will show "503 Site Unavailable: Could not download zip").

Our retry code repeats the same push using Publish-AzWebApp, which is sync FAFAIK (and regularly fails the same way as the pipeline task). We don't use AZ CLI at all. As long as Microsoft keeps updating both the CLI and Powershell modules, we expect them both to be equally supported.

Thanks for the details. Will let you know what we find.

Hello tremon,

I am the PM working on Azure Functions Deployments. Thank you for sharing your experience. We are currently investing in improving our deployment flows via Azure DevOps and this is a known issue. There are two aspects here - one is to address the not so optimal user experience that sets an incorrect expectation of "success" and second to actually provide more visibility into errors that cause deployment failures. I have prioritized the former to go out as part of the next DevOps release and will be happy to help you with the latter if you can create a support ticket with more details so we can investigate further. Please feel free to email me with any additional feedback on sokulkar at microsoft.com. Again thank you for your valuable feedback and usage of Azure Functions.

I can add some salt on azure web apps. I routinely get "everything is wonderful" answers from their weird admin guis, for services that I observe cannot reach their database or even start up. Unless I operate azure from the commandline, the ui is questionable.

AWS also actively work on reducing wastage on behalf of their customer and pass them back. Ther instance pricing have reduced some 30+ times I beleive.

> Couldn’t pay them to fix it even as a gold partner.

People complain about the old MS, but it used to be if you paid enough things got fixed. Cough up enough money and you'd get a direct line to the lead developer of whatever product you were having an issue with.

When I first joined MS back in ~2006 I got to witness this first hand, a high value customer had a problem with some C++ code and MS provided a translator and put the customer in contact with the compiler team.

The issue with "metric driven development" is that if something doesn't move the needle, it isn't addressed. What the #s don't show is that the sum total of small annoyances lead to massive customer unhappiness.

> while reminding you that they love Linux and open source while trying to get leverage and replace whole chunks of it with their bananas ecosystem.

Many of the senior/principle devs at MS now grew up reading /. and hating the MS of the 90s. The culture there is massively different, both for better and for worse. 1990s MS had huge documentation teams and tested the living daylights out of all code before it hit customers. The massive doc teams were laid off during the '08 recession and AFAIK never hired back (at least not in the incredible # they used to be), and after Google/Facebook scared MS with "move fast and break things", MS got rid of their testers as well (as has the entire industry), so now the code isn't as reliable.

>Edit: must be lunch time at MSFT. Downvote flurry.

>Please don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.

>Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

https://news.ycombinator.com/newsguidelines.html

* Every time you open a new tab, the new tab loses auth status and needs to re-auth. When I opened tabs for a bunch of VMs I got locked out for hitting the auth endpoints too quickly. Auth happens with a nonce so if you open two tabs, completing auth on the first tab causes the 2nd tab auth to fail so you need to refresh and do it again.

* The UI doesn't list any info on VMs, you have to click on each vm to see the details. Going back loses your list filters, etc.

* If boot logs get too large they never load in the web UI, you have to dig up the storage path, manually dig through the blob storage UI to locate the file, download it, and look at it with a local editor.

* Unlike AWS, they decided it would be better if every resource had a composite ID - subscription, resource group, name. You need to carry these things around together throughout your code. In the Go library you need to pass them to separate calls as separate params, for other things you need to pass them formatted as a URL path (generating the path by hand).

* The Azure official Go library shells out to the Python CLI to do saml auth!

* The Go library goes 100% against Go paradigms. API calls return a future, which then needs _2_ more calls to wait for and get the result from (WaitForCompletionRef, Result -- rather than just blocking the goroutine), each with errors that need to be checked. One of the two calls seems to be a leaky abstraction working around the fact that Go didn't have generics.

* WaitForCompletionRef never returns for a VM if it doesn't boot. So if you have a multi stage boot it'll just hang there.

* Their Go library is the epitome of inconsistency. There's at least a handful of different auth methods, and they have like three or four simultaneous generations of library apis (in the same library) that are all incomplete. To this day, constant breaking changes, dep incompatibilities (with their own libraries, with newer/recent older versions of Go). Iterating collections was similarly painful, with multiple "Paginator" object styles each with unique idioms (and dozens of bugs due to not getting the idioms quite right -> skipping pages or ending iteration early, etc).

Half of it feels like someone said "We need to be different from AWS so it doesn't look like we're copying them" but since AWS was doing things the best way they had to do things poorly instead.

(edit: AWS has tons of issues and I don't want to pretend otherwise, but the comparison to Azure is night and day)

The spamming (and outright lying) from MS reps was pretty ridiculous. At a prior employer we couldn’t tell if our rep was clueless or unethical. We raised to three iterations of bosses but his leadership changed annually so he was never held to account. Finally a user revolt caused them to lose an $8mm deal. Even then they reassigned him rather than fire him.

I’m impressed that they’ve moved on from being a Windows and Office company but their culture hasn’t caught up.

Typical Microsoft. Using their shit is like riding a schizophrenic donkey. I have been burned tens of times over the years and stuck with deprecated products and frameworks that were the official supported way of doing stuff on their platforms.

Azure also has Azure AD, thus first class support for user and app identity. Cognito isn't even close.

What does Cognito lack?

Oh so much. We hear this from our users all the time.

Full disclosure, I work for a Cognito competitor, so I'm definitely talking my book here. But our users are not. Here's a summation.

* There is only one deployment model, a SaaS offering on AWS.

* The user pool and identity pool concepts can be difficult to grasp.

* The user interface presented to your customers is inflexible and hard to customize.

* You can run Cognito only in the geographies supported by AWS.

* Cognito pools are not multi-region. If the AWS region that your pool is in is unavailable, you have few options.

* It doesn’t support localization of messages or the user interface.

* You can’t backup or export all user data, notably password hashes.

* SAML accounts are expensive after you grow beyond the free tier.

* Possibly most concerning, Amazon Cognito has been relatively static and has received few recent improvements over the last few years. The console UX got an overhaul in 2021, though.

* The customizability of the user interface and workflows are lacking.

* Since you can't export your password hashes, if you move to a different provider, you have to reset user passwords or use a drip migration.

Here's a funny video from Corey Quinn about Cognito: https://www.youtube.com/watch?app=desktop&v=x70EypnAH1Y&feat...

That said, I've heard rumors they are working on multi-region Cognito (see this vague tweet from an AWS employee: https://twitter.com/sarah_cecc/status/1486346455790985228 ) which would absolutely be a game changer. And they have a nice serverless model if you can get by with their functionality and deployment model.

#1 make no sense as a criticism of an AWS service, thats true (and the point) of all AWS services (excluding services on Outposts but that's not used casually).

Agreed that #1 is due to it being an AWS service. There are a number of issues with Cognito that are shared with other AWS services.

That doesn't necessarily disqualify Cognito for all situations. But certain auth providers (including my employer, but also many other solutions) can be deployed elsewhere (in other clouds, on-prem, etc).

Hm thanks. I suppose I wasn't so clear as to say "vs Azure AD", which I was really after. But that is also a useful summary for thinking more generally about auth! I guess Azure AD would at least have the same restrictions on deployment, but restricted to Azure regions instead (IIRC Azure AD B2C only has 4 regions globally, although I may be out of date.)

Ah, did you want to compare it to Azure AD or Azure AD B2C? As you allude to, they are different solutions aimed at different spaces (IAM vs CIAM).

I'm less familiar with Azure AD B2C than with Cognito, but from my research and tinkering, Azure AD B2C has similar limits on UX customizability (basically CSS was the only way to change the look and feel when I checked it out), but more flexibility around workflows, using custom policies: https://docs.microsoft.com/en-us/azure/active-directory-b2c/...

Azure AD B2C wins on pricing (no SAML surcharge, I believe and the per MAU beats Cognito's until you get to 10M users for p1), but, as you'd expect, is less straightforward.

As far as regions/availability, I couldn't find a straightforward answer. This: https://docs.microsoft.com/en-us/azure/active-directory-b2c/... indicates you can choose one of 4 places to store user data, but it isn't clear to me if there are multiple regions/data centers that apply if you choose, say, France. Cognito's availability story is much clearer.

Hard agree here. AZURE has been playing hard catchup with AWS in terms of feature parity, but scratch the surface of almost any of their services and you will discover shonky, bug ridden implementations (and many things seem to be in perpetual preview) that are more expensive than their AWS analogues.

This has been my observation too. AWS started with primitives needed to operate a cloud service. I remember the days of AWS where many features were available via API’s only, no Web Console. Then built higher level services on top of those as customer needs became clearer.

Using Azure always felt like that the inside development must be led by marketing team: “here are all the services AWS has, go build them as cheaply as possible from all the existing garbage we have, by yesterday!”

Counterpoint: They're both huge trash. They both have advantages over the other (the API is just better for Azure IMO), but those advantages pale when viewed through the lens of how bad both platforms are. If you can use anything else you should do so.

Given that, having a discussion about which is less bad and how isn't very useful. When viewed holistically, they are both bad.

I completely agree. I've been complaining about AWS UX and how they name, split and bill for their services for ages.

I'm now on Azure (for no choice of my own) and it's a complete dumpster fire, even worse than AWS.

GCloud (which I was on 5 years ago) was the least worse of the big one and it wasn't good either.

I've been impressed by DigitalOcean, but it's not a popular choice in large companies. Nobody got fired for recommending AWS, Microsoft or Google.

For my own hosting I pick Hertzner simply because it's cheaper and I don't need a UI or services that hold your hands.

> If you can use anything else you should do so.

Honestly, for my personal needs I just use the smaller hosts: Scaleway, Hetzner, maybe DigitalOcean or Vultr. Actually right now I'm using Time4VPS (a regional host) because of some nice yearly discounts. I choose Debian/Ubuntu LTS and install Docker or another OCI runtime and run containers inside of Docker Swarm or Kubernetes (K3s), with something like Portainer or Rancher for graphical management.

So in a way, I'm building my own PaaS solution (well, more like launching existing turnkey solutions with minimal to no customization), since I just don't care about getting vendor locked.

For example, managed databases are cool, but a PostgreSQL/MariaDB container is pretty close (for my needs) anyways. Fancy load balancers are awesome as well, but most of the time I need little more than Caddy/Nginx/Apache to act as my ingress with Let's Encrypt (DNS-01 challenge or cert directory shared over NFS or soemthing). Updates? Just bump a tag after backup, validate if works, restore if doesn't. Crashes? Automatic health checks and restarts, or maybe notifications to my Mattermost instance/e-mail if I'm feeling fancy.

And if I want to migrate elsewhere, I just carry over the bind mount directory, launch the containers with same config there and update DNS records, monitoring, backup config. That's it.

That said, self-hosting most of your stuff is great, but lots of people rightfully don't care and don't want to bother gaining that skillset, which is perfectly fine. Use whatever works for you, even managed Kubernetes is a good step to avoid vendor lock if you use containers. Or, you know, use whatever your corporate dayjob setting mandates.

> if you get any sort of incident they will ask you to rewrite your app to accommodate them, rather than fixing their own bugs/state.

As it happens I recently ran into this exact situation with AWS. My team hit a surprisingly low undocumented scale limitation with one of their services. The error message stated that the limit could be increased on request, so I did exactly that. Rather than simply increasing it, they delayed and kept asking to setup a call to talk about how my team could rearchitect our code to work around their limitation. I told them no thanks, finding a way around the limit was not the issue, having to burn time implementing it on our end was.

Overall though I do agree with your point. AWS is generally pretty good about handling scale and not breaking older APIs, but there are exceptions.

Did they end up raising the limit? Curious what the limit was.

Resource groups seems awesome, and are nice in some ways, but they are sort of this slippery slope that encourage you to put more into a single subscription than you probably should.

Why “should” one not put services in the same subscription?

I mean, there is no right and wrong answer I suppose. You can have all the code for your project in one file. Forget a class per file or whatever, maybe it works for you.

What I saw is that the more you co-locate in an AWS account or Azure subscription, the higher the bar goes on ensuring your cost reporting and access control are also completely aware of resource group boundaries.

You really want to know is that $ for project A or B? You really want to ensure folks on project A have access to their cloud resources, but not project B. You can do that even in AWS, combine them and use IAM to segment things. I think there is just more room for error if you combine.

Also I think Azure has some per subscription quota limits and you may not want team A and B competing for them.

Again, no right answer, but I know we've done projects to split accounts and have never done one to combine them..

AWS Organizations are actually quite good for this. There's a "consolidated billing" function which puts everything under the same umbrella.

I’m quite sure all the scenarios you mentioned can be managed leveraging resource groups and AAD settings. OTOH I can agree that for big engineering groups managing settings can become a challenge. IMO it’s not a matter of correct config, but about a threshold over which a single sub takes more effort to maintain.

Because one subscription is paid by exactly one entity/organization. Sometimes you split off services for legal/regulatory reasons.

yeah that’s a good reason, though it sounded like one should never do that. I believe the majority of small and medium enterprises are ok with a single bill, so putting all services in one subscription is fine. Logical organization can be done via resource groups.

This is a general problem with Microsoft and not just Azure. You can’t rely on anything new that Microsoft has released in the last 1 to 2 years. And especially anything that they are heavily promoting. They naively seems to think that rewriting something that ALREADY WORKS with a half-baked unproven new technology is a good way to invest developer salary $. How naive is that? Remember Silverlake? Remember Microsoft trying to pretend that C++ is dead for years and being forced to back flip because strangely companies out there did not rewrite their proven 10 million line C++ applications in C#? Microsoft in general has zero clue on what is important to the companies using Microsoft tech. What matters to mature developers and companies is stability. Being able to rely on a tech for decades without having to throw out millions of $ to rewrite everything using the latest wet dream tech generated by Microsoft.

>Azure APIs, tools and services get deprecated often

This is one of the most shocking things with "new" Microsoft, Microsoft always had the best backwards compatibility, now with Azure and Office 365 is seems they do not give 2 shits about backwards compatibility and breaking changes

Every day there seems to be a new breaking change or some API, Powershell Module, Sync Application, or service that is being depreciated often with limited or no drop in replacements

Have workflows, automation or systems dependent on the things.... who cares move to the new thing

How did you obtain the estimate if the azure customers having that problem?

Reply on news.ycombinator.com