
A CA key that was the number 4 passed its audit. Nobody was assigned to check it
I lurk. I've spent years on forums, Discord channels, Reddit and the anonymous boards, reading and almost never posting, and I don't trust much of what I read there, because you can't tell who is behind a…
以下正文同步自 Hacker News 最新,版权归原站所有,已转换为易读排版。
I lurk. I've spent years on forums, Discord channels, Reddit and the anonymous boards, reading and almost never posting, and I don't trust much of what I read there, because you can't tell who is behind a handle, or whether it's a person at all. I'd rather work things out for myself. Then I install open-source libraries I've never opened, because so many people use them that one of them must have looked. If you asked me which one, I couldn't give you a name. This week I explained my reasoning out loud, to the same AI that writes my code, and it came out like this: Other people do their due diligence. So I basically trust them.
The code is the same story. On Claude Opus 4.5 I was still somewhat looking at what the agent wrote. From 4.6, I stopped. Each version was better than the last, and I trusted the next one more. Now one agent writes, a second reviews and leaves notes, the first fixes what the second found, the second looks again, and when they agree, a message tells me the work is done. I'm building an app this way. The errors that used to reach me hardly do anymore. I'd like to give the reviewing agents the credit, and they may deserve it. But I stopped reading at 4.6, and fewer errors reaching me is exactly what I would see either way.
In 1968 two psychologists, Bibb Latané and John Darley, sat students in a room to fill out a questionnaire and pumped smoke in through a vent in the wall. Students who were alone noticed it within about five seconds. Students sitting in threes took longer to notice, and then they stayed in their chairs. The smoke got thick enough to blur their vision. It stung their eyes and made them cough. Across all the groups, one person reported it in the first four minutes, and in five of the eight groups nobody reported it at all.
Robert Cialdini, who built a chapter of Influence on research like this, called it social proof: when we're unsure what's happening, we watch each other. His most famous example came from Queens. Early on March 13, 1964, a young woman named Kitty Genovese was stabbed near her apartment in Kew Gardens, and two weeks later the New York Times reported that thirty-eight of her neighbors had watched and none had called the police. The story launched a whole field of research. It went into the textbooks, and into Cialdini's book, which is where I found it. I trust Influence because Charlie Munger did; he gave Cialdini a share of Berkshire Hathaway to thank him for it. Cialdini had the story from the Times.
It wasn't true, at least not the way it was told. The number traced back to a remark by the police commissioner, and nobody confirmed it before it ran. Most of the thirty-eight hadn't seen the attack, and none of them could have seen all of it. In 2016 the Times admitted that its story had "grossly exaggerated the number of witnesses and what they had perceived." When the trouble is loud and plain, real life is kinder than the legend: in two hundred and nineteen public conflicts caught on CCTV in Britain, the Netherlands and South Africa, at least one bystander stepped in nine times out of ten. The smoke in that room was quiet, and nobody was sure what it meant.
A little after three that morning, a scream woke Sophia Farrar, her husband Joseph and their son in their apartment nearby. They looked out the window. They saw nothing, and they went back to sleep.
A while later the phone rang. A neighbor was calling to say that Kitty, who was Sophia's friend, was hurt, in a hallway at the back of the building. Sophia told the caller to get the police. Then she went.
Joseph was still getting his pants on. Sophia ran down the stairs without knowing whether the man with the knife was still there. He wasn't. She found Kitty on the floor, bleeding and barely conscious, and she got down and took her in her arms. She rocked her. She shouted to another neighbor to call the police. She told Kitty, Help is on the way, and she held her until it came. Kitty died in the ambulance.
The famous story is thirty-eight people at their windows, and Sophia isn't in it. The Times printed her name only once, in a story about the trial, and one of the paper's later executive editors called leaving her out inexcusable. She lived to ninety-two. Half a century after that night, in a documentary, she said she only hoped Kitty knew it was her, that she wasn't alone.
In 1894 a Bengali teacher named Sri Yukteswar wrote a short book called The Holy Science, and in its third chapter he argues from the shape of our teeth. In meat-eaters, he writes, the canines are long, smooth and pointed, to seize the prey. In fruit-eaters they are "little projected, conical, and blunt," and all the teeth are of nearly the same height. Then he looks at ours: "They do resemble, exactly, those of the frugivorous animals. The reasonable inference, therefore, is that man is a frugivorous or fruit-eating animal."
I know most anatomists today would call us omnivores. I still believe him, and I know how that sounds in an essay about checking. I love fruit, oranges most of all, for the sweetness and the juice, more than I have ever loved a vegetable.
Near the start of that chapter he explains why he is arguing from teeth at all. Our senses, he says, have been so perverted by unnatural living from infancy that little reliance can be placed on their judgments. "To understand, therefore, what our natural needs are, we ought to depend upon observation, experiment, and reason."
I came to Yukteswar through my own guru, Paramahansa Yogananda, who was his disciple. I trust Yukteswar because I trust Yogananda, and that's part of it. The other part is that the trust sent me to read him, and he told me to check. It works that way with code too, at its best: a developer you admire keeps praising some other project, and you go and look, because you want to see what they saw. When I tried to explain this out loud, it came out like this: you also want to do your own due diligence… not because you kind of doubt them, but it's almost like a sign of respect.
Machines are starting to do the looking. Agents read code all night while the people who own them sleep, and other agents check their work. Somewhere, quite possibly right now, one of them is running the next key that is the number 4, and it will take less than a second. It won't be doing it out of respect for anyone.
I did meet Tynan, once. He lives in Las Vegas now, and he ran a small gathering there for about ten of us. Instead of a conference room he rented a penthouse room at the Hard Rock Hotel, which turned out cheaper and better. He'd brought his tea set, a big pot of hot water and tiny Chinese cups that hold almost nothing. We sat on the couches in something like a circle, and each of us took a turn bringing up whatever he wanted to talk about, and Tynan talked it through with him, and at the end the rest of us pitched in.
At some point someone suggested we all bring our backpacks and do a show-and-tell. When my turn came I unpacked a decade of Tynan's old recommendations. He picked up my sunglasses, a pair of folding Ray-Ban Wayfarers I've had for more than ten years, scratched across the lenses and still working. Tynan had given his up years before, for a pair so thin they get lost in a pocket. A blast from the past, he said, and he meant it almost as a compliment. For a few minutes he went back through his own old list, one item at a time, out of my bag.
I didn't follow him to the thin ones. They seemed too flimsy for me. When my old pair got too scratched I bought the same Wayfarers again, with a reddish-orange tint where the old ones were green, and I still switch between the two. The jackets I did upgrade, and I gave the old ones to my father: the sky-blue rain jacket, and the down jacket without pockets. He still uses them.
All through it, Tynan kept checking everyone's cups. If yours was turned up and empty, he filled it. If you were done for the day, you turned it upside down, and he knew to pass you by.
正文由 探How 从来源站点 RSS 同步,内容未经改写;遇到排版缺失或需要图片、视频时请以原文为准。