David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange

I am Director of System Architecture at SCI Semiconductor and a Visiting Researcher at the University of Cambridge Computer Laboratory. I remain actively involved in the #CHERI project, where I led the early language / compiler strand of the research, and am the maintainer of the #CHERIoT Platform.

I was on the FreeBSD Core Team for two terms, have been an LLVM developer since 2008, am the author of the GNUstep Objective-C runtime (libobjc2 and associated clang support), and am responsible for libcxxrt and the BSD-licensed device tree compiler.

Opinions expressed by me are not necessarily opinions. In all probability they are random ramblings and should be ignored. Failure to ignore may result in severe boredom and / or confusion. Shake well before opening. Keep refrigerated.

Warning: May contain greater than the recommended daily allowance of sarcasm.

No license, implied or explicit, is granted to use any of my posts for training AI models.

Replying to @crankylinuxuser@infosec.exchange

@crankylinuxuser @stefano @wronglang

With small systems, you need complete duplicates for reliability because one failure can take out the entire system. But this isn’t true at larger scales.

If you run a personal mail server and want to handle failure of a single machine, you need two computers, which doubles the cost. If you are hosting enough that it’s worth having two computers and load balancing between them, if one can handle the load with slightly degraded performance, you can get away without redundancy, but if you want to preserve performance in the event of single-node failure, you need one spare computer, which adds only 50% to the cost.

At cloud scales, this should be much cheaper. Cloud storage is very reliable because they build rack-scale storage systems that expose virtual block devices to the rest of the system and do a load of error-correction coding across disks for redundancy. They assume some percentage of disks (based on models informed by prior failures) will fail and design the systems around this. For cool storage, MSR had a system (which, I think, was deployed around the time I left MS) that took advantage of really bad disks that were guaranteed for 50 rewrite cycles for cold data. Over 50% of the total used disk bandwidth was spent rewriting redundancy because those disks failed a lot, but that didn’t matter, the rack kept working.

And yet, in spite of that, everything else seems t9 have terrible uptime. When I was at MS, my personal email had higher uptime than my work email. My personal email was self hosted on a single machine. Work email was on M365 and was supposedly run on a cluster of mail servers spread across independent failure domains.