also, see what happened last week when Cloudflare pushed out a bad configuration without trying it on a subset