News for hackers. Stuff that matters.
Re:Controversial Programming Opinions (2012) by whack on Friday December 04, 2020 @11:30AM (#25304207)
> “What’s your most controversial programming opinion?” ... What follows are twenty of the highest voted answers

By definition, the highest voted answers are also the least controversial. "Anti-establishment" and "populist" maybe. Unpopular? Certainly not.

My controversial opinion is that most software tests should be integration tests that use randomized inputs. I doubt I'll get very many upvotes for that idea.

Re:Controversial Programming Opinions (2012) by gregmac on Friday December 04, 2020 @11:58AM (#25304678)
> My controversial opinion is that most software tests should be integration tests that use randomized inputs. I doubt I'll get very many upvotes for that idea.

Probably not, but largely because you used the word "randomized". One of the most annoying things to deal with in a CI workflow is flaky tests (where something unchanged will randomly fail, or re-running will result in a different outcome).

The most common way I've seen this happen is with an external dependency like using a database server or calling a 3rd party API. The failure is usually temporary (eg: timeout) and so it's a false negative. This trains developers to do a lazy workaround: re-run the build until it passes.

True "randomized" data has the possibility that you get all kinds of flaky tests, but that they cause false positives: the failures are legitimate, passing is not.

Pseudo-randomized [1] data is a different story (see: fuzzing [2]), because you still have predictable tests -- the difference is a human doesn't have to think up thousands of test cases. I'd say it's also important to add specific test cases when you do find a specific type of failure, just to be sure that always gets tested.

I think if you call it "pseudo-random" or "fuzz testing" you'll find it's much less controversial.

[1] https://en.wikipedia.org/wiki/Pseudorandomness

[2] https://en.wikipedia.org/wiki/Fuzzing

Re:Controversial Programming Opinions (2012) by loup-vaillant on Friday December 04, 2020 @12:40PM (#25305302)
> One of the most annoying things to deal with in a CI workflow is flaky tests (where something unchanged will randomly fail, or re-running will result in a different outcome).

Just records the input whenever the test fails, and have an option to re-run a test, with those inputs. The tests are still flaky but it doesn't matter if we can reproduce the results.

You don't even have to record all inputs. You could just use a random seed, and record the seed at each run. Test become deterministic again simply by fixing the seed (typically to a value that caused the previous run to fail).

Re:Controversial Programming Opinions (2012) by gregmac on Saturday December 05, 2020 @10:38PM (#25320807)
Using a seed with the "random" is exactly how you get to pseudo-random, which gives the same sequence everytime, and is absolutely fine for tests.

If you want to have the build (test) result feedback to save the input, that's an ok goal but I think it's hard to pull off: now you have your build making commits to source control (causing another build), or you have test data stored somewhere else not in source (when really, it should be part of source).

Re:Controversial Programming Opinions (2012) by whack on Friday December 04, 2020 @12:46PM (#25305390)
I'm not intimately familiar with "fuzzing" techniques, and by "randomized inputs", I am indeed referring to tests that could be flaky in the presence of bugs. Organizational discipline is indeed needed here, in order to not ignore the occasional flaky failure, and to investigate the cause of the flaky error. I believe the benefits outweigh the drawbacks.

Here's a link that talks about the above in more detail - https://software.rajivprab.com/2019/04/28/rethinking-softwar...

Re:Controversial Programming Opinions (2012) by josephg on Friday December 04, 2020 @04:03PM (#25307945)
I use fuzzers extensively in software I write. I find it quite enjoyably humbling how quickly a newly minted fuzzer finds bugs.

I use a seeded random number generator. During development I seed it randomly. When crashes happen I output both the seed and iteration so I can hardcode that seed and reproduce the problem. And then in the CI I’ll often fix the seed so the test suite is stable.

But it’s also good practice to run fuzzers outside the context of a CI. You want your CI tests to be fast and stable. Fuzzer tests can also be slow and thorough. Foundationdb has dedicated hardware that runs their fuzzer 24/7 and spits out any errors it finds. If that fuzzer finds problems it doesn’t break the build. But someone will take a look, reproduce the problem, hopefully convert the bug into a unit test and fix the issue.

Re:Controversial Programming Opinions (2012) by karmakaze on Friday December 04, 2020 @02:34PM (#25306639)
This is completely fine, have a separate test set for these not in the deploy pipeline which is about preventing regressions not finding bugs that were previously missed.
Re:Controversial Programming Opinions (2012) by thiht on Saturday December 05, 2020 @12:08PM (#25316134)
Agree, this is the way to go.

On a separate note, if the fuzzy tests find something wrong, the data should definitely be integrated in the stable test suite to ensure non regression.

Re:Controversial Programming Opinions (2012) by matfil on Saturday December 05, 2020 @08:17AM (#25314320)
One of the most annoying things to deal with in a CI workflow is flaky tests

I guess another controversial opinion: this is a problem with the idea of CI (or at least how we work with it and what we expect to get out of it), rather than the idea of randomized tests.

Re:Controversial Programming Opinions (2012) by gregmac on Saturday December 05, 2020 @10:45PM (#25320835)
In what way? My personal expectation of CI is predictable, repeatable builds, that give me some assurance the software is working as designed. I also like that it forces everything to be scripted: no "only Bob knows how to build the release file."

Flaky tests are an indicator of poor code: maybe it's your actual code, maybe it's a bug in the test code, or maybe it's external dependency + lack of error handling in the test code but there's a problem somewhere.

Re:Controversial Programming Opinions (2012) by matfil on Sunday December 06, 2020 @06:45AM (#25322906)
The presence of bugs doesn't necessarily indicate useless software. If tests are failing (or flaky...), that's probably something to look at at some point, but that doesn't necessarily mean it's the highest priority to look at. In most places where CI gets deployed -- at least in commercial environments -- there seems to be a goal of making test failures a non-maskable interrupt.

I did admit this was controversial! But it fits in with a more general view that there are a lot of tools which make good servants but poor masters. Auto-builders are a good thing, partly because (as you say) they can help to clarify what is required to make a build, and partly because (especially for dependency-heavy software, which seems to be the norm nowadays) they can help catch things quickly when the dependencies shift beneath you. Making them a hard gate on releases seems a little too close to making the tooling your master, though.

(Somewhat separately, I also worry about CI acts as a hiding place for complexity. Sometimes it reaches that point where nobody knows how to make a build without the CI tool any more. Then local testing and debugging becomes difficult.)

Re:Controversial Programming Opinions (2012) by gregmac on Sunday December 06, 2020 @04:08PM (#25326650)
You have a good point. I think the danger comes from the potential for abuse. Once you ship software that has failing tests, you've established a precident and are likely to face pressure to do so again even when the tests are more critical. That's why I'd resist that, at least. My experience is if there's a real problem and later everything in production is on fire, no one cares about the caveats or risks you pointed out.

I do also agree that CI can hide complexity, but that's true of any tool as well as non-CI builds. Compared to a human running things, it's at least somewhat self-documenting due to being scripted.

Re:Controversial Programming Opinions (2012) by dang on Friday December 04, 2020 @02:22PM (#25306509)
> By definition, the highest voted answers are also the least controversial

That's not correct because it leaves out motivation to vote. Imagine a controversial question where, say, 1/3 of the population feels super strongly and is likeliest to vote on it. Their view will shoot to the top. Then the other 2/3 will go "wtf is wrong with this community".

Re:Controversial Programming Opinions (2012) by pjc50 on Friday December 04, 2020 @11:44AM (#25304437)
> most software tests should be integration tests that use randomized inputs.

Good for fuzzing, bad for determining whether the output is what you expected it to be, because finding out what the output should be is .. the reason you wrote the software.

I've seen this done with an automated spec translation tool that produced an unoptimised but correct H264 decoder and set of reference inputs to achieve coverage of the actual target decoder.

Re:Controversial Programming Opinions (2012) by loup-vaillant on Friday December 04, 2020 @12:45PM (#25305387)
> Good for fuzzing, bad for determining whether the output is what you expected it to be, because finding out what the output should be is .. the reason you wrote the software.

The solution for this is property based tests. Outputs almost never have maximum entropy. They have invariants, and they're related to the inputs in various ways.

Trivial example: authenticated encryption. The input is some random text, some random key, and some random nonce. The result is a message. One property to check is the fact that the message can successfully be decrypted with the same key, and the resulting plaintext will be the same as the random text from the beginning. Another property is that any message that is not the message you computed will fail to decrypt (assuming you pretend not to know the key when as you corrupt the message). Testing (crudely) that you can detect forgeries (or at least accidental corruptions).

Re:Controversial Programming Opinions (2012) by wolco2 on Friday December 04, 2020 @11:43AM (#25304417)
That's more popular than you think.

If you said php is a pretty good language and I enjoy working with it you may get a lot of closet php developers upvoting you.

A real unpopular opinion is testing is not worth the effort.

Re:Controversial Programming Opinions (2012) by SiempreViernes on Friday December 04, 2020 @11:47AM (#25304478)
Yeah, it doesn't really read like a list of programmer flame-bait which I think is ultimately what the title implied.

I mean consider this example of a "controversial opinion":

> Print statements are a valid way to debug code.

I'd place this about as controversial as "functions with many arguments are an ok choice".

The fact that there is neither a statement about the proper indexing of arrays or which programming language to never use is clear evidence this list isn't about controversial topics.

Re:Controversial Programming Opinions (2012) by iab on Friday December 04, 2020 @12:07PM (#25304825)
I prefer functions with no inputs, quite honestly . No outputs either. Also no internal logic. To hell with variables as well.
Re:Controversial Programming Opinions (2012) by hazeii on Friday December 04, 2020 @03:29PM (#25307402)
Back in the day, compiling a Fortran program that didn't do any input or output would get you a "Program is trivial" message (and nothing else).
Re:Controversial Programming Opinions (2012) by Igelau on Friday December 04, 2020 @12:29PM (#25305143)
Excerpt from The Heart Sutra, a TL;DR translation for Programmers
Re:Controversial Programming Opinions (2012) by sidlls on Friday December 04, 2020 @03:56PM (#25307829)
It depends on the context I think. Library code (most library code anyway) should have unit tests covering the public api at minimum. Unit tests might also be a good idea for interpreted/highly dynamic languages like Python, if only because you need to implement something like a compiler’s checks on signatures and arguments by hand in order to keep non trivial applications sane.

But generally I’m with you. Unit testing is overused and often makes code harder to read maintain and build on. That’s aside from it not providing information most unit test advocates think it provides.

Re:Controversial Programming Opinions (2012) by Sodaware on Friday December 04, 2020 @11:41AM (#25304371)
A bit like how /r/unpopularopinion on Reddit ends up being full of popular sentiments.
Re:Controversial Programming Opinions (2012) by whimsicalism on Friday December 04, 2020 @11:45AM (#25304452)
> A bit like how /r/unpopularopinion on Reddit ends up being full of popular* sentiments.

*racist

Re:Controversial Programming Opinions (2012) by galangalalgol on Friday December 04, 2020 @04:41PM (#25308476)
Yeah, I vehemently agree with every single opinion listed. I would add that comments aren't just extra, they are often outright lies.