Skip to main content

The Like-Live Paradox

I was recently struck by a glaring difference between how I and a programmer prepared for testing. Unlike the majority of the testing I am involved in, this particular testing 'phase' had to be scheduled in advance and we couldn't "just do it". This also meant we had more time to prepare and plan than we typically do.

This 'waiting period' had its uses. We had time to create tools that might be useful and check the configuration of the systems we would be testing. The team, familiar with the concepts of exploratory testing, were comfortable with an approach that meant we did not spend the majority of the time pre-scripting tests [be they coded or in a spreadsheet etc]. We did however build a high-level checklist of areas to test and used this to drive our program of tools and configuration checking/fixing/building.

The key difference I observed was the absolute nature of the programmers comparisons between our test systems and our live-production systems. As a tester, I was used to the usual concerns of how test systems differ to production systems. Testers, me included, often go through great pains to obtain and maintain 'like-live' test systems.

The absolute nature of their concerns, seemed to swing from faith to despair. If a particular configuration did not appear like 'live' then few conclusions might be drawn from any future results. And conversely, If some other setup did match the 'live' system, then great confidence could be ascribed to a particular result.

While they may indeed be correct (we won't know until the changes are live and have been exercised there). It was the absolute nature of their views that surprised me. As a tester I tend to be more circumspect. I don't expect my tests to be exactly representative of future live failure scenarios. I realised I see the problem more grey-scale rather than black & white. While I strive to create test systems that are like-live, I am often happy with just knowing the differences.

I also realised that I had often deliberately tried to make my systems less like-live. I often contrived to create un-realistic situations that could have illuminated behaviour that I might not otherwise of seen. After all, I am trying to disprove an assumption or hypothesis. Such an assumption would probably have been based on previously-observed behaviour. Unless I can create previously un-observed behaviour, I am unlikely to see problems with the assumption.

To cause the system to exhibit some strange new behaviour, I frequently need what is often referred to as 'unrealistic' inputs.But while these inputs may seem unrealistic to us at the development/test-time, it could be we have just not been around long enough to see the issue arise. Much like the Turkey in Nassim Taleb's "The Black Swan", realistic is being fed well every day. Until the turkey finds-out that it is "Thanks Giving" and its outlook is somewhat bleaker .

We might wish that we create perfect tests or "experiments", and only vary one item at a time, the reality is a little more human. Our tests and apparatus are always flawed. A bug may only be visible because of un-intended human error or a 'difference' from how things were meant to be. In fact this is quite likely the case, as homogenous cleanly built test systems will have been 'used' in a particular manner many times before our tests. Any glaring bugs in the 'happy path' are likely to of been discovered already.

For example, once while testing a network connection time-out, we uncovered a serious issue - by mistakenly trying to configure the system to talk to the wrong server. The new time-out configuration had worked fine when the remote server had been 'down'. But when the remote server didn't exist at all, and the system could not even locate a path to it on the network, the time-out was ignored. Unless we had mistakenly misconfigured the software, we may never have found this issue. This tester led process by which we realised that our solution was too narrowly focused, helped the team to expand their solution to fit many wider failure scenarios.

I've developed a learned-trust of the differences, knowing both the benefits and perils of un-live-like systems. This sort of depth of experience with uncertainty is another area where testers can improve a teams ability to handle the practical problems of software development. We can add depth and qualification to the information testing delivers, helping our businesses weigh the relative merit of the data. Further to this we can suggest how we might improve the accuracy of the information we deliver, without resorting to absolutes.

Comments

Popular posts from this blog

Betting in Testing

“I’ve completed my testing of this feature, and I think it's ready to ship” “Are you willing to bet on that?” No, Don't worry, I’m not going to list various ways you could test the feature better or things you might have forgotten. Instead, I recommend you to ask yourself that question next time you believe you are finished.  Why? It might cause you to analyse your belief more critically. We arrive at a decision usually by means of a mixture of emotion, convention and reason. Considering the question of whether the feature and the app are good enough as a bet is likely to make you use a more evidence-based approach. Testing is gambling with your time to find information about the app. Why do I think I am done here? Would I bet money/reputation on it? I have a checklist stuck to one of my screens, that I read and contemplate when I get to this point. When you have considered the options, you may decide to check some more things or ship the app

Test Engineers, counsel for... all of the above!

Sometimes people discuss test engineers and QA as if they were a sort of police force, patrolling the streets of code looking for offences and offenders. While I can see the parallels, the investigation, checking the veracity of claims and a belief that we are making things safer. The simile soon falls down. But testers are not on the other side of the problem, we work alongside core developers, we often write code and follow all the same procedures (pull requests, planning, requirements analysis etc) they do. We also have the same goals, the delivery of working software that fulfills the team’s/company's goals and avoids harm. "A few good men" a great courtroom drama, all about finding the truth. Software quality, whatever that means for you and your company is helped by Test Engineers. Test Engineers approach the problem from another vantage point. We are the lawyers (& their investigators) in the court-room, sifting the evidence, questioning the facts and viewing t

XSS and Open Redirect on Telegraph.co.uk Authentication pages

I recently found a couple of security issues with the Telegraph.co.uk website. The site contained an Open redirect as well as an XSS vulnerability. These issues were in the authentication section of the website, https://auth.telegraph.co.uk/ . The flaws could provide an easy means to phish customer details and passwords from unsuspecting users. I informed the telegraph's technical management, as part of a responsible disclosure process. The telegraph management forwarded the issue report and thanked me the same day. (12th May 2014) The fix went live between the 11th and 14th of July, 2 months after the issue was reported. The details: The code served via auth.telegraph.co.uk appeared to have 2 vulnerabilities, an open redirect and a reflected Cross Site Scripting (XSS) vulnerability. Both types of vulnerabilty are in the OWASP Top 10 and can be used to manipulate and phish users of a website. As well has potentially hijack a user's session. Compromised URLs, that exp