The Shape of the System

Every behaviour you ship, even the ones you never meant to promise, becomes somebody's load-bearing wall.

A retrospective that ends in a document has produced a story.

An unreproducible report is a rumour with a timestamp.

Put six reviewers on one enormous change and you do not get six reviews.

You do not have to understand a bug to find it.

Stop asking who made the mistake.

The bug your angriest customer is emailing about and the bug wrecking the most lives are almost never the same bug.

You can build every house on the street to code and still hand someone a neighbourhood that seizes the first time everyone leaves at once.

The job of a code review was never to find your bugs.

One lock is not security.

Your test suite is a museum of bugs you have already killed.

A good design makes the right thing the easy thing and the dangerous thing take visible effort, so a tired person falls into doing it right.

You do not have a failover.

Every shiny new database is a promise to learn, at three in the morning, exactly how it breaks.

The rule that let everything on the internet talk to everything is the same rule that means nothing can ever be cleaned up.

The most reliable systems in the world stopped trying not to fall over, and got very good at standing back up.

Past a certain point a system does not slow down, it falls off a cliff, and the only kindness left is to refuse work you cannot finish.

Two machines, two clocks, and a question about order that physics says you are not allowed to ask.

Your most dangerous attacker never gets a key.

Everybody has a backup.

The ugly working system you want to delete is a scar map of every wound it has survived, and you are about to throw the map away.

Two functions can match to the last character and still be two different things.

Types and tests guard the ground inside the compiler; past its edge, the only thing between you and disaster is a process someone bothered to build.

Every value that crosses into your code arrives wearing a disguise, and the dangerous ones are dressed impeccably.

Every resource you open is a promise to close it, and the bill for a broken promise always arrives at the worst possible hour.