1. 139

Incident reviews are fairly rare, interesting to read, and have significant historical value. This all argues in favor of a dedicated tag for them that can be used as an ad-hoc historical archive.

    1. 33

      I love the idea!

      If you’ll forgive some bikeshedding, would calling it post-mortem be better? When I first saw the title of this post, I thought it was going to be about some sort of argument-inciting event (which would normally be off-topic for lobsters, right?)

      Unless the tag is also to be used for posts regarding notable current outages, etc, in which case incident makes more sense.

      1. 21

        I think I like “incident” better than “post-mortem”, if only because it’s a bit broader (i.e. I think technical post-mortem posts would appropriately fall under the hypothetical tag of “incident”). I think being able to distinguish between regular news and interesting technical work done as a consequence of that news is valuable, though, so +1

      2. 12

        I tend to prefer retrospectives rather than post-mortem. The death analogy really isn’t necessary here.

        1. 3

          Even though I think that post-mortem is widespread and accepted terminology (especially in, say, gamedev circles), I like the slightly broader tag of retrospective as well–it feels like a tag we could use to denote a more general lessons-learned sort of submission.

          1. 5

            I think the spirit of what we’re trying to categorize are posts that cover specialized, targeted, technical responses to events (security breaches, production application failures caused by programming errors, etc). This is very different from, say, the retrospectives that a software team using the Agile methodology may hold to address problems that may have come up during their last sprint (don’t bikeshed this, I know Agile doesn’t have a patent on retrospectives or whatever, it’s just an example)

            So, for the sake of clarity, I think “incident” would be a better tag than “retrospective” (or “post-mortem” for that matter), because it sends a clear message to Lobsters users that an event occurred that warranted a response, and subsequently produced the technical material being posted.

            1. 2


              As long as @pushcx gives us some tag, I’m not going to bikeshed.

          2. 2

            “Retrospective” more naturally applies to what we use the “historical” tag for now, so this might be confusing.

            For this very narrow proposed case – where we’re looking for overviews of security incidents – we should probably pick a specific term. The justification for this tag (that it’s historically important & needs more exposure) goes away if we broaden it to include other kinds of postmortems (let alone other kinds of retrospectives), or if we invite users to misinterpret the purpose of the tag with a too-vague description of its purpose (which functionally results in the same thing, modulo pushcx going and deleting submissions).

      3. 8

        +1 for the idea but -1 for calling it post-mortem; incident or PIR/incident-review would be better

      4. 3

        I wish “after action report” was in general circulation. Not seriously proposing it, it would only be more confusing. I just think there are good reasons to dislike “postmortem”.

      5. 3

        Post-mortems are interesting in general, & I’d personally be more interested in reading the content of a dedicated project post-mortem tag. But I agree that incident reports themselves are more historically important and have lower visibility. Post-mortems should probably be spun out into a different request tbh.

    2. 17

      Oh, like outage post-mortems?

      I second this, good idea.

      (could you dig up some example stories from the past to flesh out the tag request?)

        1. 4

          Thank you for spending cycles on that!

          I think that makes a really compelling case for @pushcx et al. to consider.

          1. 3

            I think so too. I don’t see this as fitting in very well with any of the existing tags, and it feels very in the Lobsters spirit to me.

        2. 1

          These are all outages. “Post-mortem” and “incident” don’t adequately express that it’s network/infra related imo. Maybe “services” covers these, though quite broad too.

    3. 6

      I would definitely appreciate this.

      Right now, the best archive of past incidents I’m aware of is in the SRE Weekly newsletter. Which is lovely and I’m a happy subscriber! But being a newsletter, doesn’t allow for discussion — so I would love to see Lobsters make more room for this.

    4. [Comment from banned user removed]