The most consequential engineering document of the fortnight wasn’t a paper or a postmortem, it was a personal blog post. Susan Fowler, an engineer, published “Reflecting on One Very, Very Strange Year at Uber”: calm, precise, receipts-grade documentation of harassment reported and buried, HR processes that protected the wrong people, and a culture rotting from its incentives. It detonated. Uber launched an external investigation within days; the industry’s whisper networks went loud; and every eng leadership team I know (including ours, forty people, no excuses) is asking “could that happen here and would we know?” The technical-adjacent lesson: she wrote it like an incident report, with a timeline, evidence, escalation paths, and systemic analysis over villain-hunting, and that is why it couldn’t be dismissed. Documentation is power. It always was.
In infrastructure news, a twofer of “trust nothing”: Google announced the first practical SHA-1 collision (“SHAttered,” two different PDFs with the same hash, so the deprecation clock just became a fire alarm), and Cloudflare disclosed “Cloudbleed,” a parser bug that sprayed random customers’ memory (cookies, passwords) into cached pages across the web. Their disclosure was forensic-grade and fast, which is the only good version of that terrible day.
TIL: hash lifecycle management. We grepped for SHA-1 assumptions and found four, one in the cert stack, three in “temporary” scripts from 2014. Nothing so permanent. Migrations begin Monday.