alt Hacker NewsOh, hi Gecko! Wild to see you in writing again.
Anyway, I was the first Fog Creek employee on site at 55 broadway (one of our founders got their first, and two peer1 employees were also on site) and also part of the first wave of the "bucket brigade". Another dozen of us showed up over the coming hours as we assessed and fixed things.
The media coverage on this was never super accurate-- we were carrying (and later, relaying) 5 gallon covered plastic buckets (like the home depot buckets with sealed lids) up to the landing where the generator was to top up its reserve tank. At one point SquareSpace (who was also running exclusively out of this DC) hired a group of muscle to bring a 55 gallon drum up, but that wasn't us.
I don't view this as lionizing failure, though I can see your perspective. Across our products (then FogBugz, Kiln, Trello) we had different backup strategies in play, but we were definitely putting a lot of eggs in the local-datacenter-that-claimed-to-have-resilient-power basket. Kiln in particular had decided to use SANs for data resilience, and that proved particularly troublesome for trying to find a workaround once the storm hit-- FogBugz on the other hand was able to spin up an EC2 version and start a slow-but-would-have-worked-eventually migration (and we even had an employee hit the road for us-east-1 location with a bunch of encrypted backups so that we could get a fast data restore online), and Trello fast-tracked-and-completed its local-to-cloud migration. While it was true that the DC had a backup generator, the fuel tanks for the generator being in the basement and becoming unavailable was not part of their resiliency plan. I don't fault us for not catching that.
...although I did have to later write the dreaded "I'm sorry, we've been hacked" blog post as a direct consequence of us not properly deprovisioning a "temporary" AWS credential that we created during that sprint. I will fault us for not catching that.
Shortly after Sandy, I switched my role from core dev on FogBugz over to DevOps, and I built out the backup and restore resiliency we had been missing. It wouldn't have kept us online during Sandy, though.
It was dangerous, and a couple folks slipped and fell. That's not a good thing and I won't celebrate that. Many employees opted out of the bucket brigade for family, safety, or personal reasons. I threw out all the clothes I wore that week as they reeked of diesel... not great.
I wouldn't wish that experience on anyone, but having come through it with fortune and no slip-and-falls, I still think about:
- Walking around FiDi post storm and seeing the flooded tunnels, clogged with cars that had been washed into them from the street parking.
- Dropping off big armfuls of coffee and bagels in the lobby for the building work crews. The folks who were essentially dredging out the basement and getting the building back online did much harder work than us.
- Going shopping for aquarium supplies in order to best jerry-rig the pump that our founder has repurposed from the office fish tank in order to transfer diesel from the drums on the curb into our 5g buckets.
Something that kept me going was that I knew that one of our FogBugz customers was the emergency response service in Haiti, and they got absolutely walloped by the storm. They were using FogBugz to coordinate relief, so there wasn't any way I was going to let FogBugz go offline if I could help it. Turns out that meant climbing a lot of stairs.
Replies
I mean this with love, but dude, you put your health (short term and long term) at risk over a web app? I think you need to reassess your life priorities. You work so that you can live and enjoy life. You don’t live just to be a worker.
There is no reason that they couldn’t have had more than 1 DC when Sandy hit.
> Across our products (then FogBugz, Kiln, Trello) we had different backup strategies in play, but we were definitely putting a lot of eggs in the local-datacenter-that-claimed-to-have-resilient-power basket. Kiln in particular had decided to use SANs for data resilience, and that proved particularly troublesome for trying to find a workaround once the storm hit-- FogBugz on the other hand was able to spin up an EC2 version and start a slow-but-would-have-worked-eventually migration
The issue that I remember was that we had so many SQL Server databases that it was impossible to keep anything vaguely approaching a sane backup strategy; SQL Server just isn't designed to handle as many as we had. (I in fact remember talking to a famous SQL Server consultant [edit: this was likely Brent Ozar] we were using who said "that won't work," and then I or someone else was tasked with talking to a SQL Server dev at Microsoft about it and they ALSO said that it couldn't work, and when I brought this up, I was told that Microsoft was wrong. IIRC, the implication was that it would take an extremely long time (many days) to restore, and that the snapshots would likely be days old. I don't think any of that contradicts your memory about the very a slow restore going on, but might add some color.
(Likewise, Kiln supported multiple backend instances and had admin commands to copy and move repos between them, so it the SAN had specifically been the issue, we had workarounds that would've been fine with whatever EBS was up to those days. But I remember the databases being the blocker.)