Comparison
Kill switchvsReversibility
Kill switch
the new code path was on fire and you turned it off with a flag instead of a rollback.
A pre-built control that disables a feature or dependency without a deploy. It converts a bad change from an incident measured in deploy cycles into one measured in seconds, which is why risky launches ship with one. The catch is that a kill switch nobody has exercised is a guess: it needs to be tested in production before it is needed, because the moment you need it is the worst moment to discover it does not work.
Full entry →Reversibility
you shipped it because you knew exactly how you would undo it, not because you were sure.
How cheaply a change can be undone, treated as a design property in its own right. It is what lets a team move fast without being reckless: high reversibility means being wrong is survivable, so decisions can be made with less information. Most of modern delivery practice — flags, canaries, small batches, backward-compatible migrations — is the pursuit of this one property, and framing it that way makes the practices arguable rather than ceremonial.
Full entry →