This shouldn't have happened: A vulnerability postmortem

Re:This shouldn't have happened: A vulnerability postmortem by bluejekyll on Wednesday December 01, 2021 @03:59PM (#29409056)

Ah, brings to mind one of my favorite Dijsktra quotes, "Program testing can be used to show the presence of bugs, but never to show their absence!"

I've never understood that to mean that he wasn't in favor of automated testing, only that it's got its limits. In this case, they now know a test case that was missing.

[ Parent | on HN ]

Re:This shouldn't have happened: A vulnerability postmortem by bialpio on Wednesday December 01, 2021 @07:27PM (#29411010)

Yup, in my previous gig we had an approach that if there is a bug in the code that the tests didn't catch, it's actually 2 bugs: a product and a test issue. Similarly, if a dev needed to have access to the live debugging session to diagnose the issue, it meant there was yet another bug (to improve debuggability of the product). It was quite nice, taught me a lot.

[ Parent | on HN ]

Re:This shouldn't have happened: A vulnerability postmortem by davedx on Thursday December 02, 2021 @04:28AM (#29414137)

Indeed. This is why I find 100% unit test coverage can actually be harmful: it gives you an illusion of safety.

[ Parent | on HN ]