THE USWNT WON THE WORLD CUP — back-to-back titles, 2-0 over the Netherlands, Rapinoe winning the Golden Boot AND the Golden Ball while carrying the equal-pay fight (#158) on her shoulders like it weighed nothing. The stadium chanted “EQUAL PAY” during the trophy ceremony. Four stars on the crest; the argument continues in court with the trophies as Exhibit A.
The office’s OTHER World Cup ended the way only cricket can be cruel: India’s semifinal against New Zealand, carried to the reserve day by rain, collapsed to 5-for-3 in the chase before Jadeja’s fury and Dhoni’s calm nearly stole it back — and then Guptill’s direct hit found Dhoni an inch short, and the floor went sev-1 silent. Everyone understood without saying it that we’d probably just watched his last ODI. Ten league wins meant nothing against one bad half-hour (#128’s variance sermon; #085’s out-of-distribution clause, in whites). It still hurts to type.
The engineering story of the fortnight was 27 minutes long: Cloudflare — the company fronting a huge slice of the internet — went GLOBALLY down on July 2nd, and the postmortem (published within days, exemplary as usual) revealed the cause as a single WAF rule containing a CATASTROPHICALLY BACKTRACKING REGEX that pinned every CPU on their edge, worldwide, simultaneously. The kicker with a lesson attached: WAF rules were exempt from staged rollout BY DESIGN — the emergency path for fast security response was the path with no canary, so the emergency path became the emergency (#123’s dropdown, #151’s certification-shortcut — the fast lane is always the crash lane). Their fix list (CPU budgets on rule engines, staged everything, faster kill switches) went straight into our own review checklist, because a regex that goes quadratic lives in EVERY codebase, mine included, probably in the log parser, waiting.
Also this fortnight: FaceApp’s aging filter went viral, followed 48 hours later by the viral panic about its Russian servers and photo permissions — the #147 10-Year-Challenge lesson speedrun: the same users, the same photos, the same shrug. Consent fatigue is the real vulnerability.
TIL: regex complexity classes — nested quantifiers turn matching exponential on adversarial input. (a+)+ is a fork bomb wearing a costume. Lint for it (there are tools!); the log parser confessed under interrogation, as predicted.