2 ms·

IME unfound bugs tend to cluster in specific areas where testers didn't realize that they needed to look. Once the tester is aware of where they need to look fo

IME unfound bugs tend to cluster in specific areas where testers didn't realize that they needed to look. Once the tester is aware of where they need to look for them then they quickly evaporate. This method requires that a tester is looking for bugs randomly and is as likely to cover any realistic use case as any other use. In practice I find that's almost never true.

klodolph 8y ago
That's a good point, and it's doubly true when you are looking for security vulnerabilities. If your bugs affect user experience, then a rarely encountered bug is not much of a problem. If your bugs are security vulnerabilities, then the bugs may be equally exploitable regardless of how rare they are to encounter.