Ops

The install instructions for rustup, Homebrew, nvm, Docker, most Kubernetes tooling, most observability agents, and thousands of smaller projects share a single opening line: 1curl -sSL https://example.com/install.sh | sudo bash Most operators run it. Most operators know, dimly, that they probably shouldn’t. This series is about what “probably shouldn’t” actually means, and about a workflow that gives you the convenience of a one-liner without the trust-me-bro leap of faith. NIS2 · Article 21(2)(d) Supply-chain security. Regulators expect controls over software acquisition — unverified curl | bash is exactly the failure mode Article 21(2)(d) was written about. What can actually go wrong Four failure modes, ordered by realism. None of them are hypothetical. ...

Before you write anything, know what you’re writing. Four document types cover most IT operations. Each answers a different question. Confusing them — writing a policy when you needed an SOP, or promoting an SOP into a policy because it sounds more serious — produces documents nobody uses and audit findings nobody expected. The four types, in one sentence each Policy — the rule. Answers what is expected, and why. Standard — the requirement that makes the rule measurable. Answers what must be achieved. Procedure (SOP) — the steps. Answers how to do the thing. Work instruction — the granular detail inside a step. Answers exactly how to do that one action. They stack: ...

Most outages that hurt aren’t caused by missing technology. They’re caused by missing documentation. A server dies at 2 a.m. and the on-call engineer has never seen the system before. An auditor asks for evidence that patches ship inside the remediation window; you have no record. Someone leaves and six months of tribal knowledge walks with them. Every one of those failures was on your risk register — you just never wrote it down. ...