The most consequential engineering document of the fortnight wasn’t a paper or a postmortem — it was a personal blog post. Susan Fowler, an engineer, published “Reflecting on One Very, Very Strange Year at Uber”: calm, precise, receipts-grade documentation of harassment reported and buried, HR processes that protected the wrong people, and a culture rotting from its incentives. It detonated. Uber launched an external investigation within days; the industry’s whisper networks went loud; and every eng leadership team I know — including ours, forty people, no excuses — is asking “could that happen here and would we know?” The technical-adjacent lesson: she wrote it like an incident report — timeline, evidence, escalation paths, systemic analysis over villain-hunting — and THAT is why it couldn’t be dismissed. Documentation is power. It always was.
In infrastructure news, a twofer of “trust nothing”: Google announced the first practical SHA-1 COLLISION (“SHAttered” — two different PDFs, same hash; the deprecation clock just became a fire alarm), and Cloudflare disclosed “Cloudbleed” — a parser bug that sprayed random customers’ memory (cookies! passwords!) into cached pages across the web. Their disclosure was forensic-grade and fast, which is the only good version of that terrible day.
TIL: hash lifecycle management — we grepped for SHA-1 assumptions and found four, one in the cert stack, three in “temporary” scripts from 2014. Nothing so permanent (#081). Migrations begin Monday.