Stack Overflow's status blog posts outage notices and postmortems for Stack Overflow and the Stack Exchange network.
HN commenters check it during outages, and note it is sometimes down or out of date when Stack Overflow has problems.
It's a thing: https://en.wikipedia.org/wiki/ReDoS
And it really happens. StackOverflow had a ~30 minute outage a couple years ago because of it: http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016
One of the key points here is that it's not always obvious from looking at a regex whether it will exhibit catastrophic backtracking (at least, to an untrained eye). Even more insidious, catastrophic backtracking may only happen on certain inputs, which means that tests won't necessarily track it either. Therefore, desiring a performance guarantee here is certainly not "strange."
The bottom line is that the various implementation strategies for regex engines have trade offs. On Internet forums, it's popular to "proclaim" for one side or the other. The backtracking advocates like to believe that catastrophic cases never happen or are easily avoided and the linear time advocates like to believe that so long as matching doesn't take exponential time, then it will be fast enough. :-)
Indeed. To support backreferences, "regex" libraries are forced to use algorithms that can be very slow in the worst case.
The sad thing is that the libraries use the same algorithms even if the expression doesn't contain backreferences. A while ago, Stack Overflow had a brief outage because of regular expression performance, although the expression that caused it didn't even use backreferences or other non-regular features:
http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016
In contrast, Google Code Search - when it still existed - supported regular expression searches over world's public codebases. One key ingredient making this possible was to only use proper regular expressions:
https://swtch.com/~rsc/regexp/regexp4.html
http://davidvgalbraith.com/how-i-fixed-atom/
http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016
https://swtch.com/~rsc/regexp/regexp3.html
The difference isn't academical. It has huge practical implications, from software that is just annoyingly slow to DoS attacks.
People need to understand that. And stop using non-regular regexes (or better yet: regex in general) in production code. It increases world-suck.
$&%^ maybe they have been hacked!!!! OMG!!!
Being a little more serious. They have actually had some sort of outage as described on there website. http://stackstatus.net/post/85902805739/stack-exchange-primary-data-center-offline-may-16th Stackexchange network status updates are on there twitter feed. https://twitter.com/StackStatus
Thanks for adding. As a related aside, someone who read the post pointed me in the direction of http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016. Apparently Stack Overflow had a 34 minute outage this past year due to user input that resulted in backtracking. What's crazy is how innocent the regex seemed, too.
DoS with regex is a thing: https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
StackOverflow had a similar case a while back:
https://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016