New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 630732 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Jul 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Feature



Sign in to add a comment

Provide finer control for accelerating component update checks (and avoid mistakes)

Project Member Reported by sorin@chromium.org, Jul 22 2016

Issue description

The component updater supports a command line argument to facilitate DEBUGGING of component updates --component-updater=fast-update. When specified, the flag affects the timings of the component update checks, such as the time to initial check, and the time interval between successive checks.

These flags should not be used in production code. Nevertheless, they were.

There have been instances in the past where DDOS conditions occurred when the embedders of the component updater had used the fast-update flag to speedup the install of a specific component without realizing that the flag results in increasing the number of update check QPS by three orders of magnitude.

The proposal is to implement the following testing flags:
* fast-update: the existing fast-update flag only accelerates the initial check. It will not change the frequency of update checks. 
* fast-update-next-check-delay: how long to wait until the next update check, in seconds.
* fast-update-ondemand-delay: the cooldown until the next ondemand delay can be handled, in seconds. 
 
Cc: lafo...@chromium.org anan...@chromium.org kerz@chromium.org

Comment 2 by sorin@chromium.org, Jul 22 2016

Another option could be to support only one flag and nerf its effect:
* fast-update: the existing fast-update flag only accelerates the initial check. It will not change the frequency of update checks. 

This way, we eliminate the possibility of a DDOS entirely, in theory.
I think the proposal in comment #2 avoids the potential of embedders shortening the delays (perhaps creating worse potential for DDOS).

Comment 6 by sorin@chromium.org, Jul 26 2016

Status: Fixed (was: Started)
For now, fast-update flag only accelerates the first component update check. Adding other flags complicates usability and increases the likelihood of making errors. Please reopen if more sophisticated behavior is needed for test scenarios.

Sign in to add a comment