Just sat through a 90 minute “root cause analysis” meeting about why we missed a highly technical vulnerability that none of our developers spotted because they’re not black hat exploit specialists.

The conclusions of the meeting looked exactly like the paragraph I sent round before hand explaining why we probably shouldn’t bother with the meeting because we already knew what the root cause was.

We seem to spend endless time in meetings trying to achieve “continuous improvement” even though the problems we’re discussing are often way outside of our control. I think what might actually achieve a bit of improvement is if we didn’t waste so much of our time following a huge number of processes which use up so much time we don’t do that much work.