Cloudflare outage on November 18, 2025 post mortem

Post by burntsushi » Wed, Nov 26, 2025, 7:11 PM UTC

frumplestlatz wrote: post #931

burntsushi wrote: post #928

Earlier quoted context omitted.

> No, it's a principled position. Correct code doesn't `.unwrap()`, but code that hides failure cases -- or foists invariant enforcement onto programmers remembering not to screw up -- does. I don't think you understand what an internal runtime invariant is. Either way, I don't know of any widespread libraries (in any language) that follow this "principled" position. That makes it de facto extreme. > I've built and w…

> You use `unwrap()` when you know the failure cannot happen. That’s an invariant meant to be expressed by your type system — and it is. You’ve failed to model your invariants in your API — and thus the type system — if you ever reach a point where an engineer has to manually assess and assert whether “cannot” applies. You will get it wrong. That is bad code.

Post by tinfoil3843 » Thu, Nov 27, 2025, 3:09 PM UTC

eastdakota wrote: post #95

yen223 wrote: post #57

Earlier quoted context omitted.

I'm curious about how their internal policies work such that they are allowed to publish a post mortem this quickly, and with this much transparency. Any other large-ish company, there would be layers of "stakeholders" that will slow this process down. They will almost always never allow code to be published.

Well… we have a culture of transparency we take seriously. I spent 3 years in law school that many times over my career have seemed like wastes but days like today prove useful. I was in the triage video bridge call nearly the whole time. Spent some time after we got things under control talking to customers. Then went home. I’m currently in Lisbon at our EUHQ. I texted John Graham-Cumming, our former CTO and current…