News for hackers. Stuff that matters.
Re:Stranger Strings: An exploitable flaw in SQLite by pfdietz on Wednesday October 26, 2022 @01:20PM (#33346702)
It's not a matter of watching a deployment, it's a matter of having separate testing modes used in appropriate ways. Rapid tests should catch most bugs in CI, but more laborious tests could catch other bugs that would escape CI.

Personally, there's a free software effort where my contribution is running tens of millions of randomized property-based tests each day and registering bugs when failures occur. This supplements and complements the fast tests that all must pass before changes are merged to master.

Re:Stranger Strings: An exploitable flaw in SQLite by taeric on Wednesday October 26, 2022 @08:13PM (#33351373)
Apologies, I meant my point to be tangential. I agree with your general point. Our deployment pipelines go from build to prod though. With a general cadence on my current team of less than an hour. 6ish minutes to that is not a concern.

Even when I was on teams where the general cadence of getting changes out all the way to prod was on the order of a week, we still had changes getting to our beta environments in less than an hour. And that was on a team that wanted mutation testing, so we had it.

Edit: So my point was team mates that were worried about the 6 minutes added by mutation testing there, were the ones that would commit and then constantly refresh the page so that they could "approve" a change as it goes out. I pushed for all approvals to be automated, so there was nothing for them to watch.