Re:Evaluation of five password managers
by callalex on Saturday December 22, 2018 @01:30AM
(#18739303)
That tells me that their testing is either extremely excellent , or extremely nonexistent. Rumors seem to point towards the latter, which is concerning for security software.
[ Parent
| on HN ]
Re:Evaluation of five password managers
by cassianoleal on Saturday December 22, 2018 @07:18AM
(#18740267)
I don't know about the rumours, but "a few days" is a long time to test a bug fix.
It should ideally take from a few seconds to a few minutes. That's not extremely excellent, it's just good practice.
More than that and it hints towards heavy reliance on manual testing, and that's something I'd be worried about.
EDIT: Despite the parent comment's misguided logic, it seems his/her fears are actually in the right place.
An issue was opened about 6 weeks ago asking where the tests are and it received zero responses from the maintainers: https://github.com/bitwarden/core/issues/399
It was a cosmetic, not a security-critical bug, so there's really no reason why it needed to be released right away.
Also "a few days" was just a guess. I noticed that it was a problem, then I noticed a few days later that the fix had been release. I don't actually know exactly how long it took to release the fix after it was committed.
Re:Evaluation of five password managers
by halfastack on Sunday December 23, 2018 @01:55PM
(#18747669)
For enterprise software, a couple days is indeed strange. For OSS, it's standard in good communities I'd say. When I filed bug fixes against Tomcat, I often had fix within that day (though it was released only during the typical release schedule of Tomcat)