Every system here sat between an organisation and a person who could not see inside it. That asymmetry is the whole ethical content of the work.

The person on the other end of the outage is a person.

Not a user, not a seat, not a row. When a deploy goes wrong somebody misses a payment, a diagnosis, a flight. The abstraction is a convenience for us and it is not available to them.

Incentives beat intentions, every time, without exception.

Goodhart's law is the mechanism behind two of the three greedy cases below: a measure became a target and then stopped measuring anything. Nobody at Wells Fargo woke up planning fraud. They woke up with a quota. Goodhart's law

"I implemented the spec" has never been a defence.

Somebody wrote the defeat device at Volkswagen. Somebody reviewed it. The engineering was excellent and that is precisely the problem: skill applied without a stopping condition is just a faster way to arrive somewhere bad.

Blame the system, then actually change it.

A blameless postmortem that produces no diff is theatre with better manners. The point of removing blame is to make the truth cheap enough to say out loud, not to make the finding optional. postmortems