Incident reviews are fairly rare, interesting to read, and have significant historical value. This all argues in favor of a dedicated tag for them that can be used as an ad-hoc historical archive.
Incident reviews are fairly rare, interesting to read, and have significant historical value. This all argues in favor of a dedicated tag for them that can be used as an ad-hoc historical archive.
I love the idea!
If you’ll forgive some bikeshedding, would calling it
post-mortembe better? When I first saw the title of this post, I thought it was going to be about some sort of argument-inciting event (which would normally be off-topic for lobsters, right?)Unless the tag is also to be used for posts regarding notable current outages, etc, in which case
incidentmakes more sense.I think I like “incident” better than “post-mortem”, if only because it’s a bit broader (i.e. I think technical post-mortem posts would appropriately fall under the hypothetical tag of “incident”). I think being able to distinguish between regular news and interesting technical work done as a consequence of that news is valuable, though, so +1
I tend to prefer
retrospectivesrather thanpost-mortem. The death analogy really isn’t necessary here.Even though I think that post-mortem is widespread and accepted terminology (especially in, say, gamedev circles), I like the slightly broader tag of
retrospectiveas well–it feels like a tag we could use to denote a more general lessons-learned sort of submission.I think the spirit of what we’re trying to categorize are posts that cover specialized, targeted, technical responses to events (security breaches, production application failures caused by programming errors, etc). This is very different from, say, the retrospectives that a software team using the Agile methodology may hold to address problems that may have come up during their last sprint (don’t bikeshed this, I know Agile doesn’t have a patent on retrospectives or whatever, it’s just an example)
So, for the sake of clarity, I think “incident” would be a better tag than “retrospective” (or “post-mortem” for that matter), because it sends a clear message to Lobsters users that an event occurred that warranted a response, and subsequently produced the technical material being posted.
Sure!
As long as @pushcx gives us some tag, I’m not going to bikeshed.
“Retrospective” more naturally applies to what we use the “historical” tag for now, so this might be confusing.
For this very narrow proposed case – where we’re looking for overviews of security incidents – we should probably pick a specific term. The justification for this tag (that it’s historically important & needs more exposure) goes away if we broaden it to include other kinds of postmortems (let alone other kinds of retrospectives), or if we invite users to misinterpret the purpose of the tag with a too-vague description of its purpose (which functionally results in the same thing, modulo pushcx going and deleting submissions).
+1 for the idea but -1 for calling it post-mortem; incident or PIR/incident-review would be better
I wish “after action report” was in general circulation. Not seriously proposing it, it would only be more confusing. I just think there are good reasons to dislike “postmortem”.
Post-mortems are interesting in general, & I’d personally be more interested in reading the content of a dedicated project post-mortem tag. But I agree that incident reports themselves are more historically important and have lower visibility. Post-mortems should probably be spun out into a different request tbh.
Oh, like outage post-mortems?
I second this, good idea.
(could you dig up some example stories from the past to flesh out the tag request?)
Search for “postmortem”:
https://lobste.rs/s/tp7yzn/nanomsg_postmortem_other_stories
https://lobste.rs/s/gknr2c/postmortem_for_july_27_outage_joyent
https://lobste.rs/s/xyo6wt/gce_incident_16007
https://lobste.rs/s/ufutsg/postmortem_server_compromised_due
https://lobste.rs/s/qxjoxk/stack_exchange_outage_postmortem_july_20
https://lobste.rs/s/c4ikul/let_s_encrypt_ocsp_issuance_outage
https://lobste.rs/s/3xhypm/2018_04_13_outage_postmortem
(Aggregation) https://lobste.rs/s/nujiwh/kubernetes_failure_stories
(Research paper) https://lobste.rs/s/z94cxo/network_is_reliable_informal_survey_real
Search for “outage”:
https://lobste.rs/s/tELHK8/tarsnap_outage_post_mortem
https://lobste.rs/s/bqptwh/july_galileo_outage_what_happened_why
https://lobste.rs/s/u2tilp/postmortem_database_outage_january_31
https://lobste.rs/s/xbl6uc/cloudflare_outage_on_july_17_2020
https://lobste.rs/s/zaj1ja/postmortem_for_outage_us_east_1_blog
https://lobste.rs/s/4q8slz/circleci_postmortem_second_16_hour
And of course the post linked to from the original posting.
Thank you for spending cycles on that!
I think that makes a really compelling case for @pushcx et al. to consider.
I think so too. I don’t see this as fitting in very well with any of the existing tags, and it feels very in the Lobsters spirit to me.
These are all outages. “Post-mortem” and “incident” don’t adequately express that it’s network/infra related imo. Maybe “services” covers these, though quite broad too.
I would definitely appreciate this.
Right now, the best archive of past incidents I’m aware of is in the SRE Weekly newsletter. Which is lovely and I’m a happy subscriber! But being a newsletter, doesn’t allow for discussion — so I would love to see Lobsters make more room for this.