All Eight Fallacies and Their Implications

In the previous pages, we examined four foundational fallacies: network reliability, latency, bandwidth, and security. These are the most commonly discussed because they cause the most visible failures. But Peter Deutsch's original seven fallacies (plus James Gosling's eighth) form a complete framework for understanding distributed systems pitfalls.

This page introduces the remaining four fallacies and then synthesizes all eight into a unified mental model for designing robust distributed systems.

The topology fallacy assumes that the network's physical and logical structure remains static. In reality, network topology is in constant flux.

What goes wrong when you assume static topology:

• Hardcoded IP addresses — Service moves, clients break
• Cached DNS beyond TTL — Stale resolution prevents reaching new endpoints
• Assumptions about co-location — 'These services are on the same rack' becomes false after migration
• Firewall rules by IP — Legitimate traffic blocked after IP change
• Path-dependent load balancing — Consistent hashing assumes stable node set

Architectural implications:

• Use service discovery (Consul, Kubernetes DNS) instead of hardcoded addresses
• Implement health checks to detect topology changes
• Design for graceful membership changes in distributed protocols
• Use connection pooling with refresh to adapt to endpoint changes
• Prefer relative locations (same AZ, different region) over absolute addresses

The administrator fallacy assumes that a single entity controls the entire network and can coordinate changes uniformly. Modern systems span multiple administrative domains with different policies, priorities, and capabilities.

What goes wrong with single-admin assumptions:

• Coordinated upgrades — You can't schedule downtime across domains you don't control
• Consistent policies — Different security standards across partners
• Synchronized changes — Independent maintenance windows cause unexpected interactions
• Shared responsibility gaps — Everyone assumes someone else handles a concern
• Vendor lock-in blindness — Assuming you can change providers without friction

Architectural implications:

• Design for external dependencies failing independently
• Implement vendor abstraction layers for portability
• Plan backup strategies for critical third-party services
• Use contracts and SLAs to set expectations across domains
• Build multi-vendor resilience where possible
• Accept that coordinated global changes are often impossible

The transport cost fallacy assumes that moving data over the network is free. We touched on bandwidth costs earlier, but transport cost encompasses more than just data transfer fees.

Case study: The hidden cost of microservices

A monolith making in-process function calls has near-zero communication cost. Breaking it into microservices introduces:

• Serialization cost for every call (JSON/Protobuf encoding)
• Network latency (even same-rack has sub-millisecond cost)
• Connection management overhead
• Retry and timeout logic
• Service mesh sidecar proxies (Envoy adds ~1ms per hop, CPU overhead)
• Observability infrastructure (distributed tracing, log aggregation)

For high-frequency, low-latency operations, these costs can exceed the original processing time. The boundary between services should be chosen with transport cost in mind.

Architectural implications:

• Batch operations where possible to amortize overhead
• Choose service boundaries wisely — high-frequency communication within services, not across
• Use efficient serialization (gRPC/Protobuf vs REST/JSON)
• Consider compute-storage colocation for data-intensive workloads
• Cache aggressively to eliminate repeated transfers
• Monitor and attribute costs per service and operation

The homogeneity fallacy assumes that all parts of the network have the same characteristics, use the same protocols, and behave the same way. Real networks are heterogeneous patchworks of different technologies, configurations, and capabilities.

What goes wrong with homogeneity assumptions:

• Path MTU discovery failures — Packets too large for some path segments get dropped
• Protocol feature assumptions — Assuming all clients support HTTP/2 push or WebSockets
• Timeout inconsistencies — Your 30s timeout vs their 10s connection limit
• Connection behavior variations — Some networks aggressively close idle connections
• Certificate compatibility — Older clients don't support newer TLS or certificates
• Regional internet restrictions — Great Firewall of China, regional geoblocking

Architectural implications:

• Test across diverse network conditions — Use tools like Toxiproxy, Charles Proxy, or real devices on various networks
• Support protocol fallbacks — HTTP/3 → HTTP/2 → HTTP/1.1 graceful degradation
• Handle MTU issues — Avoid hardcoding, let path MTU discovery work
• Plan for regional differences — Different CDN pops, local regulations, network characteristics
• Abstract network dependencies — Service mesh or abstraction layer isolates application from network details

The eight fallacies aren't independent—they interact and compound. Understanding them as a system helps you anticipate second-order effects in your designs.

Example: A multi-region outage scenario

Consider a system deployed across three regions. When the primary region fails:

1. Fallacy 1 (Reliability): Network partition isolates primary
2. Fallacy 5 (Topology): Failover changes traffic routing entirely
3. Fallacy 2 (Latency): Users now route through distant secondary, latency increases
4. Fallacy 3 (Bandwidth): Secondary region absorbs all traffic, bandwidth saturates
5. Fallacy 6 (Administrator): Cloud provider's failover, not yours to control
6. Fallacy 7 (Transport cost): Cross-region traffic fees skyrocket
7. Fallacy 8 (Homogeneity): Secondary region has different network characteristics
8. Fallacy 4 (Security): New network paths need new firewall rules

A system designed with only one fallacy in mind would fail when the others manifest simultaneously—which they will during any significant incident.

Knowing the fallacies, we can invert them into architectural principles. A system that addresses all eight fallacies embodies network-aware design.

Let's apply fallacy-aware thinking to a concrete system design scenario: designing a global e-commerce order processing system.