Root Cause Analysis

The Cloudflare Outage Looked Exactly Like an Attack

At 11:20 UTC on 18 November 2025, Cloudflare's core network started failing. Within minutes X, ChatGPT, Spotify and Canva were returning errors, and a decent slice of the internet stopped working. Inside Cloudflare, the first theory was a hyper-…

The Investigation Starts Before the Alert Does

Watch the first two minutes of any investigation and you will notice that almost none of it is investigation. An alert fires for a service. Before anybody can reason about what went wrong, somebody has to establish what the service even is. Which clus…

Six Questions, One Window

The thing nobody warns you about with your first few incidents isn't the pressure. It's the tab count. You start with an alert. By minute four you've got Grafana open, a terminal running kubectl , your CI system in another tab, GitHub in…

Debugging Is Mostly Confirmation Bias With a Terminal

Watch how an investigation actually begins. An alert fires. Somebody in the channel says "I bet it's the database." Within ninety seconds four people are looking at database metrics, somebody is checking connection pool saturation, and a…

Load More
That is All