4 ms·
How is this code not covered by a unit test? I'll admit I don't think of myself as great at unit testing, but the first thing I do when writing one for a new t
by arielweisberg 13y ago
How is this code not covered by a unit test?
I'll admit I don't think of myself as great at unit testing, but the first thing I do when writing one for a new tool or class is use a code coverage tool to look for uncovered lines and once I have written a few basic behavioral tests I write tests to exercise and validate the output of the uncovered lines.
This ensures that the tests I write to cover the public API don't miss catching internal behaviors that require more subtlety to uncover.
- llimllib 13y ago> How is this code not covered by a unit test? ...or an integration test. or a functional test. When you write an SSL lib, I suspect that at some point you ought to test that it checks f%^&ing certificates :/
- sneak 13y agoNegligence or malice. My theory is that Apple is spread too thin. Kayak.com reproducibly crashed MobileSafari the day iOS7 shipped, and brand new iPad minis regularly kernel panic and reboot. It wasn't always like this.
- andrewflnr 13y agoHmm, not just my Nexus 7, then. Fortunately that's not very frequent.
- gsnedders 13y agoThe standard of testing for all SSL/TLS libraries is atrocious, it's not even like SecureTransport is notably worse than most others… :'( Someone badly needs to sit down and write — preferably a black-box, so it can be used for all — testsuite for SSL/TLS.
- marcan42 13y agoAn integration test wouldn't catch this one. You need a specific malicious SSL server (presents a valid certificate, uses ephemeral mode, does not present a valid signature proving that it owns the private key). The code does validate certificates, otherwise this would've been caught ages ago by anyone trying an invalid cert. Unit tests would've caught this, though.
- brown9-2 13y agoWell, as the article says: A test case could have caught this, but it's difficult because it's so deep into the handshake. One needs to write a completely separate TLS stack, with lots of options for sending invalid handshakes.
- joering2 13y agoSomething one would have reasonably expected after second biggest company in the world (NASDAQ, Fortune 50), and first in the IT sector. The entire OS is damn too huge piece of software for Apple not to test intesively to a fanatic stretch. Since all the NSA revelation and the proven extent to which US government lied and continues to lie to its people about all data gathering, I fail to categorize such a simple but yet brilliant overlook as a mistake.
- thrownaway2424 13y agoSo you need a mock peer, whoop-de-fuckin-do. Seems like one of these security weenies could sit down and write a test for once. By the way the test coverage in OpenSSL is piss-poor as well.
- emmett 13y agoThe kind of abusive comments you've been leaving on this thread are not really welcome on HN. Please stop.