3 ms·

I don’t think is really at all clear. Whether it’s word press plugins, or a few thousand JS or Python modules you install with npm/pip, the market has moved in

I don’t think is really at all clear. Whether it’s word press plugins, or a few thousand JS or Python modules you install with npm/pip, the market has moved into this direction because it is the most efficient. The problem is 100% in testing which is something most places slack of at because people joining, if they do write tests at all, only test their additions to the codebase. It isn’t just Wordpress, either, I think that testing of large scale interconnected software is not yet a solved problem and whomever can devise a system that eliminates all the vulnerability types we’ve seen exploited over the last few years will become very rich.

harikb 5y ago
Testing, while required, is an orthogonal problem. I haven’t seen a “test” in any ecosystem that can detect a malware
- MeinBlutIstBlau 5y ago
- edgyquant 5y ago
  Yeah exactly, that’s my point. We haven’t been developing and using a ton of test types we could realistically do now given the proper incentives. At some point, with more and more data being accumulated and more and more services being brought online, we will have to start adding more foolproof tests suites as it it’s reaching a point where it’s not just company reputation but national security that we’re risking.
- onion2k 5y ago
  You don't test for malware. You test to make sure the attack vector that's used to install malware is closed to attackers. For example, if you have an upload feature your tests should check that your file type filtering actually works, that things in your upload directory aren't executable, that you can't upload to the path of an existing file, and so on. You should build with security in mind, and test that the code you wrote does what you think it should do, and that it doesn't do things it shouldn't do.
IncRnd 5y ago
> I think that testing of large scale interconnected software... That's not the issue with WordPress plugins, which generally suffer from unknown provenance and suspect security-posture.

harikb 5y ago

Testing, while required, is an orthogonal problem. I haven’t seen a “test” in any ecosystem that can detect a malware

MeinBlutIstBlau 5y ago
edgyquant 5y ago
Yeah exactly, that’s my point. We haven’t been developing and using a ton of test types we could realistically do now given the proper incentives. At some point, with more and more data being accumulated and more and more services being brought online, we will have to start adding more foolproof tests suites as it it’s reaching a point where it’s not just company reputation but national security that we’re risking.
onion2k 5y ago
You don't test for malware. You test to make sure the attack vector that's used to install malware is closed to attackers. For example, if you have an upload feature your tests should check that your file type filtering actually works, that things in your upload directory aren't executable, that you can't upload to the path of an existing file, and so on. You should build with security in mind, and test that the code you wrote does what you think it should do, and that it doesn't do things it shouldn't do.

IncRnd 5y ago

> I think that testing of large scale interconnected software... That's not the issue with WordPress plugins, which generally suffer from unknown provenance and suspect security-posture.