The USWNT won the World Cup, back-to-back titles, 2-0 over the Netherlands, Rapinoe winning the Golden Boot and the Golden Ball while carrying the equal-pay fight on her shoulders like it weighed nothing. The stadium chanted “EQUAL PAY” during the trophy ceremony. Four stars on the crest; the argument continues in court with the trophies as Exhibit A.
The office’s other World Cup ended the way only cricket can be cruel: India’s semifinal against New Zealand, carried to the reserve day by rain, collapsed to 5-for-3 in the chase before Jadeja’s fury and Dhoni’s calm nearly stole it back, and then Guptill’s direct hit found Dhoni an inch short, and the floor went silent. Everyone understood without saying it that we’d probably just watched his last ODI. Ten league wins meant nothing against one bad half-hour (the variance sermon; the out-of-distribution clause, in whites). It still hurts to type.
The engineering story of the fortnight was 27 minutes long: Cloudflare, the company fronting a huge slice of the internet, went globally down on July 2nd, and the postmortem (published within days, exemplary as usual) revealed the cause as a single WAF rule containing a catastrophically backtracking regex that pinned every CPU on their edge, worldwide, simultaneously. The kicker with a lesson attached: WAF rules were exempt from staged rollout by design. The emergency path for fast security response was the path with no canary, so the emergency path became the emergency (the old dropdown lesson, the certification-shortcut lesson; the fast lane is always the crash lane). Their fix list (CPU budgets on rule engines, staged everything, faster kill switches) went straight into our own review checklist, because a regex that goes quadratic lives in every codebase, mine included, probably in the log parser, waiting.
Also this fortnight: FaceApp’s aging filter went viral, followed 48 hours later by the viral panic about its Russian servers and photo permissions, the 10-Year-Challenge lesson speedrun: the same users, the same photos, the same shrug. Consent fatigue is the real vulnerability.
TIL: regex complexity classes, nested quantifiers turn matching exponential on adversarial input. (a+)+ is a fork bomb wearing a costume. Lint for it (there are tools); the log parser confessed under interrogation, as predicted.