绝非根因分析（root cause analysis）。复杂系统出故障的方式向来千奇百怪。如果你想进一步了解这套逻辑是怎么落地的，不妨读读佩罗的《常态事故》（Normal Accidents）、里森的《人类错误》（Human Error）……但你最终还是会回到莱维森的《构建更安全的世界》（Engineering a Safer World）上来。你可以在作者的个人主页免费下载：http://sunnyday.mit.edu/safer-world/index.html 有不少技术公司在每次重大故障（incident）中都会用上这类方法论，…
Not root cause analysis. Complex systems fail in complex ways. If you want to read more about how this is done, try Normal Accidents (Perrow), Human Error (Reason)... but you're going to land on Engineering a Safer World (Leveson) eventually. You can get a free copy from the author's web site: http://sunnyday.mit.edu/safer-world/index.html There are tech shops that use these sorts of techniques for every major incident,…
……系统。想象一下把 GnuPG 和高性能网络混在一起！砰的一声就炸了。我个人最推崇用来分析这类事故起因的思考工具，是莱维森在《构建更安全的世界》（Engineering a Safer World）里阐述的面向系统的框架。我记得 MIT Press 上有免费正文。如果你要负责一个行星级计算机系统的安全，就应该去读读它以及它的主要竞品著作。如果你真去读了，Akamai 的 Infosec……
…system. Imagine trying to mix GnuPG with high performance networking! Boom. My preferred tools for thinking about what causes accidents like this are Leveson's systems-oriented frameworks, explained in Engineering a Safer World. The text is available free from MIT Press, I believe. If you're responsible for the safety of a planetary computer system, you should read it and it's principal competitors. And if you do, Akamai Infosec…
OT（题外话）：你读过南希·莱维森（Nancy Leveson）[1] 的《构建更安全的世界》（Engineering a Safer World）[0] 吗？感觉你会感兴趣。我这周刚开始读，我妹这学期正好在 MIT 上她的课。接下来的几周我会死磕这本书，然后……
OT: Have you ever read Engineering a Safer World [0] by Nancy Leveson [1]? Seems like something that'd be of interest to you. Started on it this week, my sister is in her class this semester at MIT. I'll be tackling it over the next few weeks, and then…
The article's not silly. Leveson and Hamilton's works cover that explicitly. Start with Engineering a Safer World's Intent Specifications, move on to Safeware, and look at the attention that goes into writing the right TLA+ specs. Lists like "Government regulations, flaky hardware…" look a lot like the upper levels…
对于对安全工程感兴趣的人来说，莱维森的《构建更安全的世界》（Engineering a Safer World）[1] 相当出色。[1] https://mitpress.mit.edu/books/engineering-safer-world
Leveson's Engineering a Safer World[1] is excellent, for those interested in safety engineering. [1] https://mitpress.mit.edu/books/engineering-safer-world
……我们今天构建的系统复杂度之高，根本不可能安全运行，我们应该把它们全关了。（我有点夸张，但也只是夸张了一点点。）我喜欢的一本用来回应里森的书是南希·莱维森的《构建更安全的世界》（Engineering a Safer World，MIT Press 甚至有免费 PDF！https://mitpress.mit.edu/books/engineering-safer-world），它探讨的是：好吧，如果我们不想关停这些系统（比如互联网），那我们该怎样安全地运行它们，…
…level of complexity we're building today are impossible to run safely, and we should shut them all down. (I exaggerate, but only a little.) A book I like which responds to Reason's is Nancy Leveson's Engineering a Safer World (free PDF from the MIT Press, even! https://mitpress.mit.edu/books/engineering-safer-world) which says, okay, if we don't want to shut these systems (like the Internet) down, how can we run them safely,…
绝非根因分析（root cause analysis）。复杂系统出故障的方式向来千奇百怪。如果你想进一步了解这套逻辑是怎么落地的，不妨读读佩罗的《常态事故》（Normal Accidents）、里森的《人类错误》（Human Error）……但你最终还是会回到莱维森的《构建更安全的世界》（Engineering a Safer World）上来。你可以在作者的个人主页免费下载：http://sunnyday.mit.edu/safer-world/index.html 有不少技术公司在每次重大故障（incident）中都会用上这类方法论，…
Not root cause analysis. Complex systems fail in complex ways. If you want to read more about how this is done, try Normal Accidents (Perrow), Human Error (Reason)... but you're going to land on Engineering a Safer World (Leveson) eventually. You can get a free copy from the author's web site: http://sunnyday.mit.edu/safer-world/index.html There are tech shops that use these sorts of techniques for every major incident,…
……系统。想象一下把 GnuPG 和高性能网络混在一起！砰的一声就炸了。我个人最推崇用来分析这类事故起因的思考工具，是莱维森在《构建更安全的世界》（Engineering a Safer World）里阐述的面向系统的框架。我记得 MIT Press 上有免费正文。如果你要负责一个行星级计算机系统的安全，就应该去读读它以及它的主要竞品著作。如果你真去读了，Akamai 的 Infosec……
…system. Imagine trying to mix GnuPG with high performance networking! Boom. My preferred tools for thinking about what causes accidents like this are Leveson's systems-oriented frameworks, explained in Engineering a Safer World. The text is available free from MIT Press, I believe. If you're responsible for the safety of a planetary computer system, you should read it and it's principal competitors. And if you do, Akamai Infosec…
OT（题外话）：你读过南希·莱维森（Nancy Leveson）[1] 的《构建更安全的世界》（Engineering a Safer World）[0] 吗？感觉你会感兴趣。我这周刚开始读，我妹这学期正好在 MIT 上她的课。接下来的几周我会死磕这本书，然后……
OT: Have you ever read Engineering a Safer World [0] by Nancy Leveson [1]? Seems like something that'd be of interest to you. Started on it this week, my sister is in her class this semester at MIT. I'll be tackling it over the next few weeks, and then…
这篇文章并不蠢。莱维森和汉密尔顿的著作对这块有非常详尽的探讨。可以先从《构建更安全的世界》里的意图规范（Intent Specifications）看起，接着看《Safeware》，再去看看编写正确的 TLA+ 规范（specs）所花的心思。像“政府法规、不稳定的硬件……”这样的清单，看起来很像顶层……
The article's not silly. Leveson and Hamilton's works cover that explicitly. Start with Engineering a Safer World's Intent Specifications, move on to Safeware, and look at the attention that goes into writing the right TLA+ specs. Lists like "Government regulations, flaky hardware…" look a lot like the upper levels…
对于对安全工程感兴趣的人来说，莱维森的《构建更安全的世界》（Engineering a Safer World）[1] 相当出色。[1] https://mitpress.mit.edu/books/engineering-safer-world
Leveson's Engineering a Safer World[1] is excellent, for those interested in safety engineering. [1] https://mitpress.mit.edu/books/engineering-safer-world
……我们今天构建的系统复杂度之高，根本不可能安全运行，我们应该把它们全关了。（我有点夸张，但也只是夸张了一点点。）我喜欢的一本用来回应里森的书是南希·莱维森的《构建更安全的世界》（Engineering a Safer World，MIT Press 甚至有免费 PDF！https://mitpress.mit.edu/books/engineering-safer-world），它探讨的是：好吧，如果我们不想关停这些系统（比如互联网），那我们该怎样安全地运行它们，…
…level of complexity we're building today are impossible to run safely, and we should shut them all down. (I exaggerate, but only a little.) A book I like which responds to Reason's is Nancy Leveson's Engineering a Safer World (free PDF from the MIT Press, even! https://mitpress.mit.edu/books/engineering-safer-world) which says, okay, if we don't want to shut these systems (like the Internet) down, how can we run them safely,…