End-to-End Arguments in System Design
J. H. Saltzer, D. P. Reed, D. D. Clark1984ACM TOCS 1984
Read it on doi.org(opens in a new tab)Why this one
Read this after A Mathematical Theory of Communication if you want the engineering consequence: moving bits is not the same as preserving meaning. The end to end argument says a lower layer can help, but it often cannot prove the property the application actually needs. A file transfer protocol cannot trust the disk, the memory, the gateway, and the remote program just because the network did a checksum. People misread this as “keep the network dumb” or “never put logic in infrastructure.” That is too simple. The paper is about placing responsibility where correctness can be observed, then deciding which lower layer optimizations are worth their cost. It will change how you think about retries, deduplication, encryption, transactions, and exactly once delivery. Worth your evening because it gives you a test for every reliability feature you are tempted to buy from the wrong abstraction.
What to take away
- A lower layer checksum can reduce errors, but only the application can verify the whole file arrived correctly.
- End to end correctness does not forbid middle layer help, it asks whether that help is complete or only a performance win.
- Retries, duplicate suppression, and acknowledgments belong at the layer that can see the operation’s real success condition.
Reads with
- A Mathematical Theory of Communication
it supplies the channel model this turns into an abstraction boundary rule
- Congestion Avoidance and Control
shows the end to end principle bending when the network must protect itself
- Dynamo: Amazon's Highly Available Key-value Store
pushes conflict resolution upward because only the application can know intent