Skip to content
All papers

End-to-End Arguments in System Design

J. H. Saltzer, D. P. Reed, D. D. Clark1984ACM TOCS 1984

Read it on doi.org(opens in a new tab)

Why this one

Read this after A Mathematical Theory of Communication if you want the engineering consequence: moving bits is not the same as preserving meaning. The end to end argument says a lower layer can help, but it often cannot prove the property the application actually needs. A file transfer protocol cannot trust the disk, the memory, the gateway, and the remote program just because the network did a checksum. People misread this as “keep the network dumb” or “never put logic in infrastructure.” That is too simple. The paper is about placing responsibility where correctness can be observed, then deciding which lower layer optimizations are worth their cost. It will change how you think about retries, deduplication, encryption, transactions, and exactly once delivery. Worth your evening because it gives you a test for every reliability feature you are tempted to buy from the wrong abstraction.

What to take away

  • A lower layer checksum can reduce errors, but only the application can verify the whole file arrived correctly.
  • End to end correctness does not forbid middle layer help, it asks whether that help is complete or only a performance win.
  • Retries, duplicate suppression, and acknowledgments belong at the layer that can see the operation’s real success condition.

Reads with