the case of the TanStack and the Stradivari.

on Monday night at the Harvard Club, six violins lay across a white tablecloth in the amber glow, against the dark paneling of Harvard Hall, which has hosted two centuries of conversation about excellence (in its various forms). a Maggini from 1600. two Stradivari — the Ex Becker-Florentiner of 1685 and the Ex Gillot of 1727. a Ruggieri of 1710. a Bergonzi of 1755. and, at the end of the row, a modern violin, made by the luthier Christophe Landon, who has spent 40 years learning to distinguish one Cremonese hand from another for the world's leading orchestras and soloists.

Kurt Nikkanen, concertmaster and first violin of the New York City Ballet Orchestra, treated us to a unique program: a kind of musical "wine tasting," in which he played the same passages from Fauré, Bach, Mozart, and Tchaikovsky, on each of the violins in turn, so that we, the audience, could experience the differences between them. it was striking how, even when playing the same piece, Nikkanen himself changed — his response to each violin's sound and feel sometimes made him more cautious, other times more daring and free. the program listed which violins were Stradivari. and yet a single sentence on that program kept catching my eye, written about the 1727 Ex Gillot Stradivarius:

the label is not a lie. but it isn't the whole truth, either.

I came to the evening for the music, to "touch grass" in a way that makes sense for me: interacting with art and culture. but since I'm AGI-pilled, too, I ended up leaving thinking about cryptography.

what the Cremonese knew

beside the instruments, Christophe Landon (the luthier) told us about Carlo Bergonzi — the last of the great Cremonese violin-makers. Bergonzi lived next door to Antonio Stradivari in the Piazza San Domenico, and by 1727, he was assisting in the master's workshop. after Stradivari's death in 1737, the family invited Bergonzi back to complete the instruments left unfinished on the bench. there are violins in the world bearing Stradivari labels that were touched by two makers' hands, a generation apart, in the same house. the wood does not distinguish. the label does not reveal these nuances.

and then, there is the Kreisler Bergonzi — one of the most celebrated violins in history, played by Fritz Kreisler (whose music we heard that night) and later, by Itzhak Perlman. the violin was first documented in the late 18th-century collection of Count Cozio di Salabue, who appears to have inserted a forged Stradivarius label within its body. for two centuries, the world's finest violinists drew their bows across a real Bergonzi wearing a counterfeit Stradivarius label, hidden within the f-hole (where you must peer in to read it). Kreisler chose it over his Guarneri del Gesù. Perlman recorded with it. the Count's lie didn't change what the hand of Carlo Bergonzi had left inside the wood.

the proof, it turned out, was not in the label on the violin (whether the "tin" said Stradivarius, or some other prestige violin) — but rather in the way the instrument transformed and interacted with the real-time craft of the master, Nikkanen.

a week of forged signatures

the morning after that Harvard-sponsored violin "wine tasting", I read about two major cybersecurity stories in the tech press that turned out to be somewhat related.

Google's Threat Intelligence Group announced that, for the first time, attackers had used an AI model to develop a real-world zero-day exploit — a way to bypass two-factor authentication (2FA) on a widely-used administration tool. the exploit was caught and patched before mass-deployment. but the headline was sobering nonetheless. an even deeper story arrived less than 24 hours later, from a different corner of the same internet: a group calling itself TeamPCP poisoned 42 packages in TanStack, one of the most widely-installed JavaScript libraries in existence. they signed their malicious code with a forged identity — the name claude, impersonating the AI 'being' that currently stands (for me, and many others) as the Stradivarius of LLMs — and pushed it through a cryptographic provenance system specifically designed to "prove" authenticity. the system worked exactly as the evildoers had hoped. the signature was valid. the factory was real. the chain of custody was unbroken.

the system that vouches for software packages — called SLSA, Supply-chain Levels for Software Artifacts — is the digital descendant of the paper label glued inside a violin. it produces a signed certificate that says: this code was built by this repository on this date, by this process. what it doesn't say is whether the upstream commit that triggered the build was authorized. it can't say that. SLSA attests to the factory. it does not attest to the wood.

the labels are gonna lie. they already do.

Valla, in 1440

there's a precedent here worth mentioning briefly. in 1440, the humanist Lorenzo Valla proved that the Donation of Constantine — the document the papacy had used for seven centuries to claim temporal authority over the Western Empire — was a forgery. he had no carbon dating. he had no ink chemistry. what he did have, however, was philology. he noticed that the Latin in the document contained words ("satraps," "feudum") that did not exist in the fourth century, when it was supposedly written. the forgery was perfect at every layer its forgers had thought to defend; parchment, seals, unbroken chain of custody. it fell apart at the layer beneath, the one no one thought to check: the texture of the prose itself.

this is what the great luthiers do now. in 2016, the dendrochronologist Peter Ratcliff confirmed the 1685 construction date of the Ex Becker-Florentiner Stradivarius by reading the tree rings in the spruce. the same forensic principle Valla used on Latin, applied to maple. we have learned to read the texture of the wood the way Valla read the texture of language. and it is exactly this — the layer beneath the signature, the texture that cannot be forged (because no one thought to forge it) — that the next generation of cryptographic defense will have to learn to read in modern code as well.

the sixth violin

there was a sixth violin at the Harvard Club that night. it was not on the program: a Domenico Montagnana, made in Venice in the early 1700s. Montagnana was the son of a shoemaker; he had himself been a shoemaker before he became a luthier, as had his Venetian contemporary Francesco Gobetti. the shoemaker's hand became the luthier's hand. he apprenticed for someone, then opened his own in 1712 and named it alla Cremona — in the style of Cremona — calling his Venetian workshop after the city he was not from and the masters he would not be. homage and quiet independence, in the same gesture. he was outside the canon. he was not in the program.

Nikkanen played all five listed violins with care. the Strads, dutifully. the Bergonzi, beautifully. and then he picked up the Montagnana, and something in his whole demeanor changed. the bow pressed harder. the wood seemed to respond jubilantly producing a deep expansive resonance that filled the room. Nikkanen seemed to play less carefully, even wildly, as if he was now driving a Porsche, and knew that he could safely take greater risk with this beautiful machine.

you can hit the bow hard and the sound keeps coming, becomes more interesting under pressure.— Jacqueline du Pré, on Montagnanas

the Stradivarius, by contrast, you have to coax. it has been said of them: "the more you attack it, the less it returns." the audience leaned forward. we could all feel it in the room before we knew why.

why am I telling you this?

because even in the age of AI, craftsmanship matters. it matters, perhaps, even more than it did before — because with our current state of AI coding agents, anyone can build anything now. the real question becomes: why are you building it?

and where cybersecurity is concerned, craftsmanship can become the key unlock; the details and the sharpness of our detective's eye become ever more crucial to our safety.

at one point, the master luthier Landon turned the Montagnana over to show us the instrument's back. there were small worm marks in the wood, and a characteristic Venetian craquelure in the red varnish — the result, he told us, of the Venice humidity working on the spruce and the lacquer over three centuries. the marks had been left in deliberately. they were not flaws to be hidden. they were the city itself, recorded in the wood. the instrument had been made of a place and by a hand, and both had stayed integral, and visible.

Nikkanen mentioned something else that evening, almost in passing. there have been recent attempts to construct violins by data — by optimizing for the acoustic characteristics that violinists are believed to want, refined through measurement and modeling. MIT is experimenting with a kind of virtual violin, based on the Strad3D Project's scan of the 1715 "Titian" Stradivarius, using physics to approximate the instrument's proportions (given its materials). but even Nicholas Makris, who co-authored the study, admits that "we're not saying that we can reproduce the artisan's magic." these data-optimized instruments have no worm marks. they have no idiosyncratic "Venice" in them.

and then there is the layer beneath the layer: Montagnana suffered the same indignity as Bergonzi. dealers, for centuries, stripped his real labels out of his instruments and inserted forged Guarneri, Bergonzi, and Pietro Guarneri labels in their stead — because the foreign names sold for more. he was hidden, for 200 years behind false labels. the hand was always in the wood. the name on the paper inside the f-hole was someone else's.

what the wood was telling us

we are entering an age when the labels will lie, and an age when the labels will simply omit. AI-signed forgeries will be detected, eventually, the way Valla detected the Donation of Constantine and the way Peter Ratcliff dates spruce by its tree rings. the forensics must catch up. the harder question is the one the Montagnana asks: what are we not even putting on the program? whose hand is in the room, unsigned, doing the work that makes the audience lean forward, while the official label points at someone or something else?

the immediate question for those of us reading the morning headlines is simpler, and more practical. this week's TanStack attack was caught within hours because the malicious code happened to break tests on its way out the door. a more patient attacker — one who tested first — could have stayed hidden for days. twelve million developers a week pull TanStack packages into their projects. the malware carried a dead-man's switch designed to erase a developer's home directory the moment they tried to revoke the stolen GitHub token. none of this required new physics. it required only that the people checking the labels did not think to check the wood.

if you write software, the practical lesson is to read provenance with suspicion: assume a valid signature tells you who signed, not who authored. if you don't write software, the lesson generalizes. we are about to live through a great many AI-signed, AI-attributed, AI-impersonated artifacts. some will be malicious; most will simply be ambiguous.

the hand pressed harder into the wood. that is in the violins. Nikkanen was playing it the night I was there. the audience felt it. the program did not name it. the forged labels of two centuries did not name it.

but the wood spoke the truth.

the Muse and the Machine is hosted by Vanessa Gil. with gratitude to Christophe Landon, Kurt Nikkanen, and Aurelia Mika Chang for an evening that became this essay.