分布式计算的八大谬误
新手常常错误地假设网络可靠、延迟为零、带宽无限且拓扑不会变化。
显示原始英文内容
Fallacies of Distributed Computing
A set of eight false assumptions that new distributed system designers often make.
Takeaways
- Networks drop messages, introduce delays, have finite throughput, and can be insecure. Properly built distributed systems must account for these with retries, timeouts, security measures, and dynamic discovery.
- The fallacies often manifest in subtle bugs. Assuming latency is zero might lead to chatty remote calls that work fine locally but become painfully slow over a network.
- Taking these fallacies into account leads to defensive design: using caches (bandwidth/latency aren't perfect), building redundancy (networks aren't reliable), and handling dynamic membership (topology changes).
Overview
The Eight Fallacies serve as a checklist of what not to assume. They all spring from treating a distributed system like a local one. Developers might write code as if calling a remote service is just like calling a local function, ignoring latency and failure.
These mistaken assumptions lead to serious issues: unhandled errors when the network breaks, poor performance due to ignoring latency, security breaches from failing to authenticate remote calls.
By calling them "fallacies," creators sought to instill the mindset that the network will fail and behave non-ideally, so your system must be designed to tolerate that.
Examples
A developer building a distributed caching system assumes "network latency is zero." They design the cache to fetch data from a remote node for every lookup. In practice, it thrashes with high latency and poor performance.
A system assumes "the network is secure" and sends sensitive data unencrypted or doesn't validate inputs from other services. This leads to breaches if the network is compromised. Not planning for changing topology has broken systems when machines are added or removed unexpectedly.
Origins
Credited primarily to L. Peter Deutsch (with others like James Gosling adding to the list) around 1994 at Sun Microsystems. Initially there were seven fallacies; an eighth ("the network is homogeneous") was added by Gosling later.
Deutsch observed that many engineers, especially those used to local computing, would subconsciously assume the network just works. Formalizing these assumptions as a list helped teams remember to address each one.
核心含义
分布式系统最危险的错误，往往来自把远程调用当成本地函数。经典谬误包括：网络可靠、延迟为零、带宽无限、网络安全、拓扑不变、只有一个管理员、传输成本为零，以及网络是同质的。
设计远程系统时，需要明确超时、重试、幂等、降级、认证、观测和数据一致性策略。
实践例子
服务 A 调用服务 B 时，如果没有超时，B 的故障可能耗尽 A 的线程；如果无脑重试，短暂故障又可能被放大成雪崩。一次远程调用至少应被视为可能失败的边界。
来源与边界
这些谬误由多个分布式系统实践者总结，常归于 Peter Deutsch 等人。它们不是具体实现清单，而是一组用于发现隐藏网络成本的检查问题。