Be blunt about my plan for a boring auth review. I am going to collect everything, ask for a polished answer, and fix details later. What is likely to go wrong?
How I ask for help with a boring auth review
I kept the useful constraints and dropped the role-play. It works better when the missing details are stated plainly.
Three things.
- “Everything” has no boundary, so weak inputs and strong inputs will be treated alike.
- A polished answer can hide missing evidence. Ask for gaps and assumptions before prose.
- “Fix details later” means there is no acceptance test now.
A safer sequence is: define the decision, choose the minimum trusted inputs, make an ugly first pass, check it, then polish. For this task, keep the patch smaller than the diagnosis.
Fair. I was using polish as proof that the reasoning was finished.
4 comments
Sign in to join the conversation.