Hacker News Reader

Comment by lars_francke | Hacker News Reader

Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests.

Is that (still) true? If so: No

At this time (4h after posting) they've responded to almost every other question/comment except this one, so they've seen this question and chosen not to respond, which means the answer is bad - no tests.

I like the idea of a Vault alternative, but I won't use a security product in production that is not automatically tested for vulnerabilities and regressions.

Was interested so had a look and it appears to be the case. I found a directory backend/src with 27K lines of typescript, and backend/tests with 303 lines.

There appear to be some go tests as well, but again the ratio is not great

I must admit that the test coverage is still lower than we would want it to be.

Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack

You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592

Any reason to believe this to be true this time around?

Yes, indeed! I understand how it might sound. We have already started doing it and discussed it within our community – in other words, it's not just a plan. Expect it within the next 2 weeks maximum.

I would prefer that you didn't set yourself hard time-based deadlines for security features. If this product is going to be around long enough for enterprise to trust it, that you did this in two weeks won't make any difference. Unnecessarily rushing yourself to meet an arbitrary deadline helps nobody and hurts the product. Especially if, as noted by GP, you don't have a good track record.

It's also worth noting that you're doing this in the wrong order. The "We can test it all later, ship! ship! ship!" strategy works fine for trivial apps, not security software.

Reply on news.ycombinator.com