Full Disclosure – How not to write a Forms Authentication Process

Liggat Authentication Fail

This post will be a disclosure on how to not design and implement a login processes.

Ligatt Security and Gregory Evans the main man behind Ligatt has come under quite a bit of flack recently for doing things like alegedly making threats to other researchers and also for alleged plagiarism .

While all of this Internal Security Industry bickering is beyond me and this post.  I would not trust a company with protecting my data if they can’t even protect their own.

And with that said.  / Month Of Full Disclosure item 3 = Ligatt Security and how not to write an Authentication Process.

Text Version Here

Ligatt Authentication_ByPass

Show me where that PC is

Full Disclosure – Multiple XSS holes in 1-click Retweet/Share/Like WordPress Plugin

Month Of Full Disclosure

1-Click Retweet/Share/Like Lets users Retweet, Share and Like pages from your site back to their Twitter followers and Facebook friends with just one click. The user experience is similar to Facebook Like button but expanded to Twitter and Facebook Share.
The above WordPress Plugin has multiple Cross Site Scripting (XSS) Bugs due to the “fc” the “fs” and also the “fblname” Parameters not correclty sanitising data input

This was discovered in a routine security check on my own site, where up until yesterday I was like hundreds of other wordpress sites running the above plugin.

The plugin does not integrate whoely with the worpress blog and instead it calls home via an IFrame which is where the XSS hole exists.

Every site which has this plugin would therefore call the vunerable URL however that URL due to being an Iframe exists on the vendors site. (http://www.linksalpha.com)

This mitigates the risk of the WordPress Plugin against the site hosting it. However due to poularity of the plugin, it is deemed still to be a medium risk issue. Plus the fact that there may and most likely are other issues with the plugin which I have not taken the time to research.

See below for the disclosure.

Text Version Here

XSS vulnerability in Links Alpha WordPress Plugin
————————————-
Vulnerability ID: Month Of Full Disclosure = MOFD2
————————————
Product:    1-click Retweet/Share/Like
————————————-
Vendor:    Links Alpha ( http://wordpress.org/extend/plugins/1-click-retweetsharelike/stats/
or http://www.linksalpha.com/)
————————————-
Vulnerable Version:    2.0.1 Which is current version and Probably Prior Versions
————————————-
Vendor Notification:    03 August 2010
Public Disclosure:    03 August 2010
————————————-
Vulnerability Type:    XSS (Cross Site Scripting)
————————————-
Status:    Public Disclosure – Not Fixed, Vendor Alerted,
Awaiting Vendor Response
————————————-
Risk level:    Medium
————————————-
Credit:    Martin Hall – TheTestManager
Site = http://www.thetestmanager.com
twitter = @thetestmanager
Vulnerability Details:
There exists multiple XSS errors in 1-click Retweet/Share/Like WordPress Plugin.
————————————-
Potential Users Affected = minimum = ??? users
It’s a WordPress Plugin which is installed to sites on average 300-400 times a week
————————————-
Dork to find Vulnerable Sites (2)
inurl:http://www.linksalpha.com/social?link=
or
src=”http://www.linksalpha.com/social?link=
Because it loads on sites in an Iframe the dork is not straight forward.
————————————-
Sample URL
http://www.linksalpha.com/social?link=http%3A%2F%2Fsimplestrength.com%2F2010%2F06%2Fwarriors-come-out-to-play%2F&fc=28a2ttm–%22%3E%3Cscript%3Ealert%28%22TheTestManager.com-%20Month%20of%20Full%20disclosure%22%29%3C/script%3E&fs=arial&fblname=like
————————————-
Solution:
Currently I’m not aware of any vendor-supplied patches or other solutions.
If you are aware of more recent information related to this issue please notify me at: martin@hb-help.com

Users are recommended to use NoScript or other XSS mitigating software
Admins are adviced to keep an eye out for an update to the plugin.
(Although as the issues affects code on LinksAlpha Site they should be able to fix the issue without a WordPress Plugin Update)
————————————-
Other Miscellany Information
N/A

Full Disclosure – Multiple XSS holes in FuseTalk Forum Software

The Test Manager

***EDIT***

I received notification from FuseTalk that the below issues should now be fixed on their site. This should mean that patch should be rolled out to customer sites in the near future.

With this in mind I have agreed to their request to remove references to the names of their customers from my post.

***END EDIT***

Fuse Talk is a forum software widely used on the web.

Yesterday I found multiple XSS holes while browsing the ******* Forum site.

******* uses FuseTalk as it’s forum software.

Now there are a few strange things  here.

Firstly ******* is a security firm and you would have thought that they would have picked this up, or at least carried out a review of any software before adding it to their site.  The other strange issue is that the software vendor FuseTalk is not even running the latest version of the software on their own site.

Anyway see below for the disclosure.

Text Version Here

XSS vulnerability in FuseTalk Forums
————————————-
Vulnerability ID: Month Of Full Disclosure 1 = MOFD1
————————————
Product:    FuseTalk
————————————-
Vendor:    FuseTalk Inc

( http://www.fusetalk.com/Company/AboutFuseTalk/tabid/111/Default.aspx )
————————————-
Vulnerable Version:    4.0 Which is current version and Probably Prior Versions
————————————-
Vendor Notification:    02 August 2010
Public Disclosure:    02 August 2010
————————————-
Vulnerability Type:    XSS (Cross Site Scripting)
————————————-
Status:    Public Disclosure – Not Fixed, Vendor Alerted,
Awaiting Vendor Response
————————————-
Risk level:    Medium
————————————-
Credit:    Martin Hall – TheTestManager
Site = http://www.thetestmanager.com
twitter = @thetestmanager
Vulnerability Details:
There exists multiple XSS errors in FuseTalk Forums.
These errors exist even months/years after previous XSS HTML /SQL injection
errors were reported to FuseTalk.
It is time for a full and through source code review guys.
————————————-
Potential Users Affected = minimum = 250,000 users
******* = 5664 Users
FuseTalk forums = 11357 Users
*** = 103488 users
*** **** = 43767 users
******.com = 79718 users
**********.com = 31396 users
********.com = 23033 users
————————————-
Dork to find Vulnerable Sites (1)
fusetalk “users are registered”
Dork to find Vulnerable Sites (2)
© 1999-2010 FuseTalk Inc. All rights reserved.
————————————-
Sample URL’s
http://forums.fusetalk.com/usersearchresults.cfm?keyword=ttm–” ><script>alert(‘TheTestManager.com- Month of Full disclosure’)</script>&FT_ACTION=SearchUsers – (Tested in IE8)

http://supportforums.*******.com/categories.aspx?catid=76&FTVAR_SORT=date&FTVAR_SORTORDER=0017ttm-” style=x:expression(alert(“TheTestManager”)) ttm=” (Tested in IE7)

————————————-
Solution:
Currently I’m not aware of any vendor-supplied patches or other solutions.
If you are aware of more recent information related to this issue please notify me at: martin@hb-help.com

Users are recommended to use NoScript or other XSS mitigating software
Admins are advised to change forum software, or put pressure on FuseTalk to carry out a full source code review.
————————————-
Other Miscellany Information
http://www.fusetalk.com/ProductsServices/FuseTalk/WhosUsingFuseTalk/tabid/72/Default.aspx
Sample URL’s

And So it Begins. – August = Month of Full Disclosure

Month of Full Disclosure

As the main title of this post states, August 2010 will be a full disclosure month.

Normally within a month I may talk to around 20 or so organisations advising them of general bugs and security issues within their products or websites. The number varies as I do this as a hobby and not a full time job.

My main job is as a Systems Test Manager.

So I decided to see what happens if I take a month out from doing things the normal way of disclosing all issues to the site or software house first and only when fixes place advising the users.  So for August only I’ll be advising the public at the same time as advising the site / or software house involved.

All issues discovered before the month of August and any that are currently being discussed with sites or software houses are not included and will remain closed for public consumption until the issue is fixed and even then only if the company involves gives permission.

I doubt if any humdingers will come out but you never know

If any issues are found which could affect a very high number of users data at risk then I will revert to responsible disclosure, and give the vendor time to fix the issue.

Martin Hall

cybersecuritychallenge cipher – A How To

Cyber Challenge

This is the total walk through and it wasn’t easy.

(1) first go to the main challenge page and then grab the cypher

https://cybersecuritychallenge.org.uk/docs/cybersecuritychallenge.txt

Now from looking at the text you can see the obvious thing and that is it looks like a base64 encode. This can be seen in the fact that base64 encodes will end in an equal sign if the total bits of data cannot be equally converted from 34 bits to 32 bits.

So we grab the text and run it through a base64 converter.

http://www.opinionatedgeek.com/dotnet/tools/base64decode/

This then give us a raw .bin file

I recommend using a Hex file viewer, however I used EditPlus Text Editor as it was closer to hand.

I saw what looked like a file header

it had EXIF (which I know to usually mean camera files).

and more importantly I also saw JFIF which is the JPEG File Interchange Format (JFIF)

From here I guessed that I would firstly grab EXIF Tool to decode and potential EXIF data as I thought it would have a message hidden in the camera name or something similar.

There was no interesting info so I just changed the file extension to JPG and thought I would check what I had and then I saw the XKCD comic.

Personally my fave one is

Exploits of a Mum

however you one is

Total Time Start to Finish = 12 minutes.

**EDIT**

I was informed this morning that I was not quite there. I got a tweet from@Cyberchallenge stating that if I sent my email about the cipher to a certain email address then I had got it wrong.

So I thought back to the drawing board and lets look again at the image. Firstly look in a Hex Editor and I saw what I thought was a phone number. 01444.’9=82<.342 = 01444-982-342 well it would seem that I was on the wrong track as that number is not in service.

So I then loaded up another EXIF viewer and again nothing.

I then looked at the original image on the XKCS site and I noticed that it was a PNG and not a JPG, if it was just a case of getting the normal image when why change its extension and also why all the extra white space.

I then carried out a quick check on TINEYE. (which is a great tool). however this also gave nothing except it did let me compare other images out there against the one I had earlier decoded and my image was the only one with the morse code around the edge.

I then looked a little closer and thought it was binary. Also like the pits used when burning the lead in section of a protected DVD / CD.

I then read up on hiding binary in images. – Suggested reads are.

http://terpconnect.umd.edu/~minwu/public_paper/Jnl/0408binwmk_IEEEfinal_TMM.pdf

http://figment.cse.usf.edu/~sfefilat/data/papers/TuBCT9.10.pdf

http://www.springerlink.com/content/k28787j31153565m/

I then loaded up Paint.Net and began to play.

Firstly looking at the Histograms. If you move them around you’ll see that the boarder is a different layer than the rest of the image.

This then confirmed to me it was binary and all I had to do was to try and count the pixels to see where a binary code started and ended.

Paint.Net has a Pixel grid so I loaded this up and began to count.

White Pixels = Zero and Black Pixels = One

010000110111100101110010011011100110011001110010001000000111001101100010011110010111100101100010 and so on and so on

I then grabbed the text and loaded that into a binary to string converter and this gave me garbled text.  = Cyrnfr sbyyb in the example above.

I then used google to check the text and I found only one result and it was 2007 on a site called Perl Monks

This thread has some one attempting to decode a piece of text and it has one of our words. = Cyrnfr

It was suggested Rotr13, so again I read up on Rotr13 and its a simple encryption where the letters are rotated 13 chars . So this gave me Please follo (looks like please follow)

I now knew that i was right about the binary and all I had to do is to count the whole image and then rotate each of the letter 13 places.

This then gave me

Please follow this link: https://cybersecuritychallenge.org.uk/834jtp.html https://cybersecuritychallenge.org.uk/834jtp.html

Game Over -  ** at least that’s what I thought **

I visited the URL and got a new code !! – this one although easier actually took longer as it was custom code and I didn’t bother to code a parser (which I now wish I had done) so I had to decode it all by hand.

68edcdec4e2c8eae8d2c8e2dedcd6e04d2042fedae52ceac04ccedaecd8c042ccd8c046

cedad0e8dac8eac8c048e0dac044aa82889046c0d2c8d8daccdecacc5042bedae4e04e

e2dcd046ced8cac042d6e04046c2f4c664ea76e666cae4e268e2f456c0d088d8d66cde

cac6546c6a506e6a546062606c504a141a1410a8dac2c6eac04acad2c2d8d048e0d2d

6e046ced8cac048eed04edae4e048eac2cad042c8e04adac8c2d2c086c2f4cac4e6eac

6cae4e2d8e2f6c0d2c8d8daccdecacc5ed4eecc5ae6dc50429cc042fedae524eac048e

0dac04cc2d4e6e8e040eac4e6eedcd048eed048ced046eed85042ccd8c046c2ccd0

40e4eedceac042fedae04adacac8e048e0dac04ac8d2dec2d4c2d8d2d8e2f046c4e2d

8eac4e2d2c0405484e2d8e2d6e0d046c2d8e2d4faccd046cae4e4eaccd8e8d2f044ea

c6e2d8caccd8e042dcd048e0dac04aa692504eeac04ee2d8d8d044cac042dcd048ee

dae6c0d048eed042c8cce2d6eac040dedee048eed046c8d2c2dad042fedae4e040e4e

2d4facc504eaac8d8d048cedcdac042ccd8c04eceded8c048dae6c6d042dcd048e0da

c04682f4cac4e046aac6cae4e2d8e2f04680d2c8d8daccdecac046cedad0eac8e2d8e2

dedcd6e048e2c6d2dcdec040e8d2c6cac048e0d4eedaeec0dedae8e048e0dac044eac

6e8e04edcc048e0dac042fac2c4ec5

The part that gave the code away was that I figured it would start with a well done message so I counted the chars and looked for well done or other words like congratulations. (it was all hex so it wasn’t too hard)  I was right about the congrats message plus the fact that the spaces were easy to guess.  I still ended up with a few question marks but I still got to the bottom of it.

see below for the key and the cracked code.

04 = space
0D = H
0E = P
08 = a
26 = i?
2B = y?
2C = A
2D = I
2F = Y
4C = B
4E = R
4F = Z
52 = ‘
66 = e?
68 = C
6c = c
6D = k
6E = s
8C = D
8D = L
8E = T
AC = E
AD = M
AE = U
C5 = fullstop
CC = F
CD = N
CE = V
D2 = A
ea = W
EC = G
ED = O
EE = w

a7 =?
45 = ?
65 = ?
46 = ?
c6 = ?
A1 = ?
41 = ?

congratulations a youve found and completed the ???? challenge.
your pin code is  cyber?security?challenge???????????. ?????lease
email this code to our team to media@Cybersecuritychallenge.org.uk

F YOU’re The First Person to do so and can prove you meet the eligibility
criteria ? ? British citizen currently resident in the ??? we will be in
touch to advise how to claim your prize.

Well done and good luck in the Cyber Security Challenge Competitions taking
place throughout the rest of the year.

Tips and Tricks to landing your Dream Job in Testing or QA

Landing a Dream Job

I’ve recently been interviewing for a Lead Tester to join my Team and I’ve been a little dismayed about how unprepared some of the candidates are for interviews be they telephone interviews or face-to-face interviews.

So I’ve decided to put together a few little hints and tips to hopefully help candidates in the job market land their dream job.

• Firstly make sure you customise your CV for each job you apply for. Never send a generic CV to a company and expect it to be good enough. Look through the job specification and list of requirements and tailor your CV to match what they are looking for. Go through your past roles and pick out the parts of the role that matches what you think match the Job Specification.

• Now lets take a look at the cover letter. They do have a bearing on if you will get noticed and virtually all potential employers will look at your cover letter before they look at the CV so make it count. It needs to be about you on a personal level as the CV will tell them all they need to know on a professional level. Hopefully you’ll be like myself and have a real passion for testing if that’s the case then you need to make sure that it comes across in the cover letter.

• Do your homework on the person who you be looking at your details and also the department where you would like to work for. Doing your homework on the company alone is not enough. Anyone can visit the company website and read the blurb however you need the edge so research as much as possible and then use all of that research to let them know you’ve taken the time and effort to find out more than the average Joe about what they do.

• If the Company in question has a Careers or Job offers page or sub site then make sure you register and upload your details before sending in your CV. Not only does it show your interested, it will also show them that your serious about working for them and you are not just sending in your details to every company that comes along.

• If you go to a Careers Fair make sure you have your customises CV with you. It should be no more than 1 page of A-4 you may use both sides if you must however try and bullet point to one side. This CV version is just for the company staff member or Test Manager to see if they think they would like to know more.

• At a careers fair tell them about you and not about your CV they can read the CV however what your CV will not say is what type of person you are and what things excite you.

• Make your CV results oriented. It will mean more if you state  I did this and the positive result for the business was this, over I this this.

• Please show some emotion. You may not believe it, but it’s hard work interviewing all day. It makes it much easier on the both sides if the interviewer can see that the interviewee is excited about coming to work for their company.

• Remember not to be so nervous,  I always tell interviewees that an interview is a two way process and that they should be interviewing us to see if we match up to their ideals as well as us interviewing them to see if I think that they would be a good fit into my Testing Team.

• Keep a note of who you have applied to and if you had a Telephone interview then during the conversation make sure you note down any keyword which you think may be relevant. You can relate these back to the interviewers in a face to face interview.

• Look into Forer Effect Statements / NLP / Confirmation Bias and Subjective Statements. However before you attempt to use any of these techniques make sure you know what your doing as they can work against you if you do not know how to use them correctly. Once mastered you’ll find them indispensable not only in interviews, they can help out also in every day business.

• Look for yourself in a Search Engine and make sure that what you find is suitable. This means that if a potential employer Googled you, would they get a positive result or not?.

• Salery Negotiation – Make sure you know how much it would take for you to leave the place you are currently working and if asked never answer with an “Urmmm” or “I’m looking for something around” . Let them know how much you would like and have a reason why you think that you are worth that amount.

• The most import and last one is BE HONEST.

Good Luck

Martin Hall

Tags: cover letter, cv, dream job, employment, interview, job specification, qa, recruitment, telephone interview, Testing, tips and tricks

Fix – The selected file was generated by mysqldump and cannot be restored by this application.

MYSQL

How to fix the-selected-file-was-generated-by-mysqldump-and-cannot-be-restored-by-this-application error.

This post is here more of a reminder to myself. However I’m hoping that others will find it useful also.

I was testing out a piece of code which needed a new MYSQL InnoDB restored.

I had a slight issue ad when I attempted to restore the DB via the MySQL Administrator tool I got the following error message.

“The selected file was generated by mysqldump and cannot be restored by this application.”

This error is given usually when the Backup was taken via a batch job (or just a user who is using the command line).

Because of this the only way to restore the DB is again via the command line.

So carry out the following steps.

Firstly make sure that your .SQL backup file has the Database at the top

so it should read

Use DataBaseName;

then

find the MySQL.exe file, (this will usually be stored in the installation bin folder)

then run the following using the command line.

C:\Program Files\MySQL\MySQL Server 5.0\bin>mysql.exe -uusername -ppassword   < “C:\DB Backups\nameofbackupfile.sql”

The -uusername should be something like -uroot

and the -ppassword should be something like -psecret

Hope it helps.

Martin H

Verifying that the Text from a DataSource Exists in a WebTest Response VSTS

Visual Studio Webtest Logo

I use Visual Studio Team Testers Edition everyday at work and one of the things that seemed really strange to me was that Microsoft had missed so many tricks when they decided to release it.

Maybe they just decided to build in reasons for users to upgrade,  knowing that there will always be another version of VSTS around the corner.

One of the things which is sorely missing is the ability to verify HTML source code against a datasource. Sure you can load a data source and then verify what is returned on the page when that row of the data-source is called however there is no functionality to check that the value of the row that you have submitted is returned somewhere in the HTML source (known as the response in VSTS).

So as per usual when you need something doing then, do it yourself, and hence I wrote a small piece of code that looks at the source code and then checks the value of the datasource row to make sure that the item you are submitting is returned in the HTML response.

All the data is dynamic from your source so you can’t just hard code validation rules, as there could be thousands of rows.

For an example take a Google search test. Imagine I want to check that my datasource of 10,000 records is retuned on every response.

So if I search for “System Testers” as a parameter value

“Parameter Name = q” and

“Parameter Value = Google DataSource.Directory_03062010#csv.SearchParams”

In the above QueryString Parameter you can see

the Datasource is called  “Google DataSource”

the Actual FileName is “Directory_03062010″ (and it’s a CSV file)

the Column name is SearchParams

I’ve commented my code to make it easier to understand however if you need any help just ask.

Code Below.

/End Code.

The above script is in Visual Basic.Net and it should work for you and if you need any help in how to install and run it then either send an email or reply in the comments.

One last thing to mention is that the values from the data source are loaded in a fake Parameter Name (Just make one up) which will be ignored by the Website however it will show as a Context Name in the Visual Studio Web Test, so we are really just comparing two Context Names

Good Luck

Martin H

Testing Presentation (Why we need testers)

Why we need testers

As I promised in my last blog post, here is the presentation that I gave a couple of years back on why we need testers in development teams.

please note that everything about this presentation is rough as it was never meant to be publicly shown or distributed, it was created for a small in-house audience.

I’ve posted the headline text for the slide-show in this blog post and then link to the powerpoint file below. You’ll have to fluff out the main text as it’s only main headlines so I knew what text was coming for which slide.

DOWNLOAD THE POWERPOINT PRESENTATION

If you wish to make a similar presentation in the future you’ll have the slide-show above and the headline text below to refer to.

Text for the Slide-Show =

QA – Why we need Testing and Testers

2)      Jigsaw story or why developers shouldn’t test

3)      What is Quality and how to measure it?

Well we sometimes take quality to be subjective and we expect that others will know what we mean when we say that a product has quality.

But in an example of an car one user may say that the car has quality because of leather seats and air con – yet another may think otherwise and base the quality upon the engine specifications etc. However quality can universally be measured by the way a product meets its specifications.

If a finished product meets its design specs 100% then it can be argued that it is a quality product as it has been built exactly the way it was supposed to be built.

4)      BAD CODE = Creating poorly written code

Even after decades of advancement the software industry, the quality of software produced remains one of the biggest problems. This coding bad practice started mainly during the dot com boom as new start ups rushed to produce a working example of the “next big thing”, Even in today’s market we have a large focus on “time to market”, not only this but also the sheer growth and volume of software being developed, and the amount of amalgamated new technologies to absorb, it really is no surprise that software development houses still continue to face quality problems. There are two main sides to these quality problems: high defect rates and lack of code maintainability.

5)      ROI – Return on Investment

Speeding up Development time and less cost.

Almost every organisation in the world be they schools – governments or Nasdaq/FTSE100’s rely on software to help them with their daily processes. A vast majority will depend upon the software industry for product development, production, marketing, support, and services.

Spending on software development is very costly but there is a great way to partly reduce that cost and that it efficient testing processes. For example if there is going to be more that 3 iterations of software then it will usually be financially viable to start an automated regression testing process.

Better company image.

There can be nothing worse than using a piece of software and it crashing in front of a user. Especially if it does it in a messy way (losing data etc.)

Imagine buying a piece of software and having it fall over constantly because you put an apostrophe in a name field (O’Donnell for instance). This type of thing will happen on badly coded systems with SQL back ends (SQL Injection).

But with through testing the system should never fall over in front of the user and if it ever does the error should be captured and the user given a helpful message. With wide spread use of the internet its also possible to have automated bug reporting built into programs so that they not only provide the user a decent message and close correctly but they will also automatically report the bug to the software house with a small process tree list and provide the user with a defect ID.

This goes back to the car and idea of a quality product. If it does what it says on the tin then it should be OK.

But of course we can’t just test using this “on the tin” approach we have to try and break our product by first doing what it says “on the tin” (the design specifications) and then by doing everything else (lookup equivalence partitioning).

This can include buffer overflows.  Out of range integers – non syntax types – e.g. text in a date field etc.

6) But I said we need testers before I mentioned automated tools so can’t we use these test monkeys find these bugs?

Well the answer is NO –

Bugs are found during manual testing based on a testers desire to deliver quality product. Verification is conducted while the testers are operating the applications and comparing the actual results with the results they expect.  However, some bugs are still not detected with manual testing. Therefore, it is desirable to automate as many of the manual testing tasks as possible.

But these automated tools lack the common senses of a human being. Manual testers are still needed to test the high-risk areas of the products.

Test monkeys however do have a purpose and are often used in addition to human tests. Test monkeys are automated tools. Their testing actions are randomly performed without a user’s bias.

Benefits of them can be

1)      They will run and run until they crash a system (fuzzing being my favourite kind)

2)      They can be put on an old or slow system

3)      They don’t get bored or care if they GUI has changed.  (they can run test scenarios for days on end non-stop)

4)      Microsoft said that 20% of all its defects found were by using monkeys.

Not all automated tools are dumb monkeys in fact the majority of tools used are partly AI based.

7) The Perfect tester

What makes the perfect tester? In my opinion it’s the same hacker mentality of Steve Jobs, Steve Wokniak, Bill Klaxton and Bill Gates the old school hackers who helped to create the systems we use. They took a look at what systems existed (virtually everything back then was IBM or listed as IBM compatible) and wanted to change those systems by making them better.

It’s wanting to know how something works and wanting to see if you can beat it.

This beating it for me is finding a bug.

If any of the above is used in any presentations then I’d love to see/read your take on why software needs testers.

The Developer Jigsaw (or Why we need more testers)

The Testing Jigsaw

A couple of years ago I was asked to present a talk at a testing conference.

I did a whole presentation that I will post up to the blog in a week or two. The one part of the presentation that seemed to grab everyone’s attention was a story I told about the Developer / Testing Jigsaw.

I think the reason it was so widely accepted was because its given in the form of a story, and we all like a story right?

So if your all sitting comfortably then I’ll begin.

There was once a small boy and his father sitting down together one Sunday afternoon.  The father said to his son I have a small surprise for you. I’ve made you a little jigsaw puzzle, its of a tree with grass and sky as the background. Wow, said the little boy as his face lit up, can we do the jigsaw now please?.

Of course said the dad.

So the dad tipped out all of the pieces onto the mat and begun attempting to put the jigsaw together. The son asked his dad if he could help by looking at the picture on the box and advising his father on where he thought the pieces were meant to go.

However his father said “no need – I created this puzzle so I know exactly how it should go together”.

The father struggled on for another 3 hours and wasn’t really any closer to getting the puzzle finished. He then got in a mood and said that he gives up and some pieces must have got lost.

The son then took over and compared each piece to the box making sure that he was putting the pieces where they were meant to go.  He did the smart thing first by putting all of the corner pieces where he thought they should go.  He looked at the box once more and thought to himself that blue is the sky, the green is the grass and the brown is the tree.  So he separated the coloured pieces in 3 piles

He eventually finished the puzzle in about 45 minutes.

There is an obvious key to what is happening above in this  story.

The Son is the Tester

The box is the Functionality Specification Document.

The Dad is the Developer.

The jigsaw is the piece of software that has been developed

Yes developers can test code, in fact I encourage it (peer reviews of other developers code and Unit tests),  however they should not be the sole testers of code, especially if the code is written by them.  Going down that route is a recipe for disaster.

The son who had never seen the jigsaw before managed to finish it in a faster time than his father and also in a more methodical manner.

Testing is a mindset. It’s an art that I, and many others spend every day attempting to perfect.  Developers spend most of their day writing code, (also testing their code – Unit tests etc.)

I’m all for test driven development, however lets not forget that with specialisation comes speed and efficiency savings.