5 ms·

Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No

hereonout2 3y ago
Was interested so had a look and it appears to be the case. I found a directory backend/src with 27K lines of typescript, and backend/tests with 303 lines.
- steeleduncan 3y ago
  There appear to be some go tests as well, but again the ratio is not great
quacker 3y ago
At this time (4h after posting) they've responded to almost every other question/comment except this one, so they've seen this question and chosen not to respond, which means the answer is bad - no tests. I like the idea of a Vault alternative, but I won't use a security product in production that is not automatically tested for vulnerabilities and regressions.
vmatsiiako 3y ago
I must admit that the test coverage is still lower than we would want it to be. Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack https://infisical.com/slack
- iLoveOncall 3y ago
  You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592 https://news.ycombinator.com/item?id=34956592 Any reason to believe this to be true this time around?
  - vmatsiiako 3y ago
    Yes, indeed! I understand how it might sound. We have already started doing it and discussed it within our community – in other words, it's not just a plan. Expect it within the next 2 weeks maximum.
    - RadiozRadioz 3y ago
      I would prefer that you didn't set yourself hard time-based deadlines for security features. If this product is going to be around long enough for enterprise to trust it, that you did this in two weeks won't make any difference. Unnecessarily rushing yourself to meet an arbitrary deadline helps nobody and hurts the product. Especially if, as noted by GP, you don't have a good track record. It's also worth noting that you're doing this in the wrong order. The "We can test it all later, ship! ship! ship!" strategy works fine for trivial apps, not security software.

hereonout2 3y ago

Was interested so had a look and it appears to be the case. I found a directory backend/src with 27K lines of typescript, and backend/tests with 303 lines.

steeleduncan 3y ago
There appear to be some go tests as well, but again the ratio is not great

quacker 3y ago

At this time (4h after posting) they've responded to almost every other question/comment except this one, so they've seen this question and chosen not to respond, which means the answer is bad - no tests. I like the idea of a Vault alternative, but I won't use a security product in production that is not automatically tested for vulnerabilities and regressions.

vmatsiiako 3y ago

I must admit that the test coverage is still lower than we would want it to be. Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack https://infisical.com/slack

iLoveOncall 3y ago
You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592 https://news.ycombinator.com/item?id=34956592 Any reason to believe this to be true this time around?
- vmatsiiako 3y ago
  Yes, indeed! I understand how it might sound. We have already started doing it and discussed it within our community – in other words, it's not just a plan. Expect it within the next 2 weeks maximum.
  - RadiozRadioz 3y ago
    I would prefer that you didn't set yourself hard time-based deadlines for security features. If this product is going to be around long enough for enterprise to trust it, that you did this in two weeks won't make any difference. Unnecessarily rushing yourself to meet an arbitrary deadline helps nobody and hurts the product. Especially if, as noted by GP, you don't have a good track record. It's also worth noting that you're doing this in the wrong order. The "We can test it all later, ship! ship! ship!" strategy works fine for trivial apps, not security software.