What a good incident channel looks like
The chat log is where the incident is actually run. Four conventions make it useful rather than a wall of noise.
#incidents
7 pieces tagged incidents,
from August 29, 2025 to August 29, 2026.
The postmortem that changes something
Most incident reviews produce a document and a ticket that never gets done. Here's the difference.
Cloudflare falls over because of a config file
A permissions change doubles the size of a generated feature file, which overflows a fixed-size buffer, which 500s a fifth of the web.
us-east-1 goes down and takes a large chunk of the internet with it
A DNS race condition in DynamoDB's automation cascades across dozens of AWS services. The lesson is about coupling, not DNS.
Shai-Hulud: npm gets a self-replicating worm
A payload that steals credentials and then uses them to publish itself into other packages. This is the escalation everyone predicted.
chalk and debug get compromised, and 2 billion weekly downloads flinch
A phishing email to a maintainer, eighteen packages, and a crypto-stealing payload in the browser.
The Nx compromise and the credential-stealing postinstall
A popular build tool's npm packages ship a payload that harvests tokens and pushes them to public repos.