Hacker News Reader

Comment by ykonstant | Hacker News Reader

And rather than an indication that it is not working, I was just told to login again; since the attempts were unsuccessful, I was led to reset my password. Now I have no clue if the password has been reset properly or an old one is used, or login with google is used, or if I will continue to be logged out after they fix stuff.

If your service is down, please say "my service is down".

View on HN

One weekend I was on-call, we had a system we ran for the government, but authentication was handled by another government owned service, hosted and managed by another company.

A user called in early Saturday evening, saying that the system was down. After a bit of debugging, wondering where our alerting had failed, I concluded that the system was perfectly fine, but the authentication service had been returning 500 errors for around an hour. When I called the user back he made a comment that rather changed how I think about monitoring and systems. He says: Well, from my point of view it really doesn't matter which part isn't working, it's just down.

I've learned the same lesson, and why things like ping checks aren't enough. Even just a WGET of the front page isn't enough. You need the monitor to login and replicate at least part of the user experience if you have a complex setup. It's very embarrassing when someone tells a user "shows it's up from my side." and they're relying on a naïve monitor.

I lament the fact error messages are rarely, if ever, displayed anymore. Just a generic message in its place, usually not even indicating whether it's a 'you' problem or a 'them' problem :(

It amazes me how most smartphone apps- which operate in a wireless environment of likely flaky connections, don't seem to be tested or designed at all to handle loss of connections. They tend to just become non-responsive or do erroneous things like play the first second of an audio file and then auto-pause, without reporting any errors.

Sooo like the Spotify app for the past 10 years.

Spotify is in offline mode...

This bug has been there since the first time I installed Spotify on a smartphone and it's still there a almost 15 years later.

These 1 percent of edge cases take so much effort to test and handle though.

A smartphone having a flakey internet connection isn't an edge case.

Exactly, it's a daily thing for users- it's only an edge case for the developers, because they are likely developing and testing with hard wired high speed connections.

Good chance most of the phones are virtualized as well to test across OS builds and that the actual deploy to real phones aren't tested nearly as well.

Personally, I despise cutesy error messages that try to make the program sound more human. "Oops, we're sorry this happened! Would you like a nice cup of hot cocoa while we try and figure out what happened? Or should I read you Goodnight Moon" again?"

1 percent is extremely frequent though. Like literally thousands of times per second on prod if it's a b2c application

Yeah, but at least it's a bit understandable that its changed in that direction, and usually you can get a developer-friendly error message if you look at the HTTP responses in the devtools.

I remember one time a company I worked at received a support message where the title was (paraphrased) "DONT HURT MY CHILDREN" from some person who saw an error message saying something about "couldn't dispose of child" or something similar, when the frontend broke. "Child/children" being kind of common in programming, I'm sure others faced similar scenarios.

I'm not sure if they were genuinely scared or just decided to have some fun with us while reporting the issue, but after that we made the error messages even more generic, so nothing could be misunderstood.

I guess it is this quest to not alienate the lowest common denominator that is the reason behind the stupidification of error messages. On one hand, people won't get scared, on the other hand, people get less context about why the error happened in the first place.

Wonder how many of the average users actually care?

The original Mac would pop up a dialog with a threatening icon of a bomb with a lit fuse, whenever it crashed! https://en.wikipedia.org/wiki/Bomb_(icon)

>The Bomb icon is a symbol designed by Susan Kare that was displayed inside the System Error alert box when the "classic" Macintosh operating system (pre-Mac OS X) had a crash which the system decided was unrecoverable. It was similar to a dialog box in Windows 9x that said "This program has performed an illegal operation and will be shut down." Since the classic Mac OS offered little memory protection, an application crash would often take down the entire system.

Unfortunately, the Mac's bomb dialog could cause naive users to jump up out of their seat and run away from the computer in terror, because they though it was going to explode!

https://www.youtube.com/watch?v=zQGX3J6DAGw

And Window's "This program has performed an illegal operation and will be shut down" error message was just as bad: it could cause naive users to fear they might get arrested for accidentally doing something illegal!

Generally error messages get watered down to nothingness because it gives news reporters less meat to chew on. Not knowing if its a "me or you" problem means that small problems might actually get missed and not need any PR response. Details won't leak and produce all kinds of speculation over the causes, etc.

You have to be careful with error messages. It's possible to give too much away and enable security vulnerabilities.

I'd assume the security vulnerability is there no matter what the error message says, but I guess very explicit and verbose error messages might expose details to make it easier to find said vulnerability.

There are so many microservices everywhere with different teams responsible, that if just one team doesn't forward errors properly it is messed up.

Integration tests are a thing.

You mean e2e from mobile app? Because they would have to be able to trigger those failure situations from all layers of microservices for which they have no control over.

I thought I got hacked and tried to retrieve my password.

Got a weird email with the same code every time from facebookmail.com

My first thought was that I'd been hacked as well...

I have gotten 4-6 "here's your facebook reset" type emails over the last month. All unrequested. I've always assumed they're casual attacks (mostly interested in seeing if my password can be stuffed into another, more valuable account)

I really hate that companies do this. PayPal does it sometimes, too.

It sounds like you are struggling with withdrawal symptoms. I recommend a detox and get your life into order.

It has nothing to do with Facebook; it's the trend of sending email from alternative domains like facebookmail.com that train users to trust unknown domain names.

It's particularly egregious with critical stuff like banking.

Password works on THREE other machines, fails completely on ONE.

I was logged in when the outage happened on machine A and phone B - immediately tried to reset password, which took me into the hellish abyss many of us are experiencing now...

This evening - about 18hrs about the event, I fire up machine C - it logs STRAIGHT INTO Messenger. OK... This is something, too scared to open a browser in case that triggers the session disconnect...

So I fire up laptop D - STRAIGHT INTO MESSENGER... OK, open browser, STRAIGHT INTO FB. Log into Google password manager, VISUALLY CHECK password, and it is my last known good password (in use at time of outage).

Fire up iPad E - Straight into Messenger!!! All these machines are on the same network!

Back to Machine A - clear cookies and try to log in, no joy; different browser and try to log in, no joy; try to reset password on this different browser (I might add, I did get a new Change password Token number off this attempt), but no joy; clear cookies and restart, then attempt to log in, no joy!

WHAT THE F?!?!?!?

I initially thought it may have been a 24hr block due to password change attempts? But now not so sure... I've also tried logging in on via Machine A in a VM from a different O/S to see if it may have something to do with it - but again no joy - this environment had NOT been logged in to FB before...

Thoughts????

MAC Address being flagged?

But on the flip side, I was able to create a back up profile in a different VM on this machine.....

I'm just waiting for all my relatives to breathlessly call me saying "I THINK MY FACEBOOK WAS HACKED".

Already got a call from someone who regularly gets caught in unprompted xfinity password reset loops saying “it’s happening again.”

Inexcusable to catch people in a reset loop during a login outage, and not confirm which password is the current one.

Same... This was literally the first time I wanted to use my Facebook account in years, so I changed my password twice before I realized that there must be an issue on their end.

I just wanted to use their oauth login to buy a jonsbo n3 case from AliExpress. Sadge

Logging everyone out across all platforms and telling them to just try logging back in sounds like an excellent way to DDOS yourself.

This should be a fun postmortem.

Yeah, and they've dug themselves a hole with having near permanent login persistence. I can't remember the last time on a computer I use frequently that I've had to log in.

Yeah, same thing happened to me so will likely need to reset my password again once Facebook is up again.

That was my cue to check hacker news

Yup - same here...

I fear my initial attempts to 'reset my password' and getting that same security(at)facebookmail.com email with the SAME reset code, have not helped me - if only I'd been asleep, I probably could have slept through it.

At least Insty came back up - though to be honest I cant remember that password either and now terrified to try and recover or change that now too!

Me too, after the first couple of "is it down" websites I tried failed to load.

HN never fails us when a big website is down.

I was also almost ready to reset my password.

Fwiw I tried to reset my pw and it didn't work either. Because FB web app said I input wrong pw.

I have exactly this issue. Been frantically jumping around this morning dealing with perceived security issues and have no idea where my many FB resets led to.

MY SERVICE IS DOWN.... I did exactly as you.. I have no clue now

Reply on news.ycombinator.com