zlacker

>>mattjh+(OP)
We estimated a single sprint to move from our plain text passwords. Easy! Add a new field in the db for secure pass, and one to force password update. Update the api to take the new fields into account...

It took 6 months. Why? Well it was a legacy app, and we learned that passwords were case insensitive because the customer sent a video of him entering his password that failed. On the video, we could see a sticky note on his monitor with the password written on it.

When we made all the necessary changes, the docker file failed to build. SRE accidentally deleted the deprecated image with PHP that had reached EOL.

Estimating is always fun.

>>firefo+qb1
Oof. Exactly. Simple things get complicated when you find out that there were unstated requirements, hidden booby traps, etc. And then there's random interrupts -- unrelated stuff that comes up and takes your time and focus. If you run a lean ship then interrupt management is critical, but ideally you can have a few people who are understood to take critical interrupts and thus their schedules will slip.