Test Automation
Property-based testing and model checking are two of the most powerful tools in a test engineer's toolkit, and most teams use neither. The teams that do use them tend to use only one, treating them as alternatives. But they solve different problems and work best together. This post
Test Automation
Since its launch in 2016, Google's OSS-Fuzz program has found over 10,000 vulnerabilities and bugs in more than 1,000 open source projects. It runs fuzzing continuously, 24 hours a day, across billions of CPU-core-hours of compute. When it finds a crash, it automatically files an issue,
Test Automation
The most realistic test data you will ever have is the traffic that hits your production service right now. Real users make requests with edge-case inputs, unusual character sets, unexpected header combinations, and query patterns that no test author would ever think to write. GoReplay (gor) is an open-source tool
Test Automation
Twitter's engineering team faced a problem that scales with complexity: every time they deployed a new version of a service, they needed to verify it produced the same responses as the old version across the enormous variety of real-world requests that hit their platform. Writing test cases manually
Test Automation
Dark launch is the practice of running a new version of a service in production — receiving real requests, doing real work — while still serving responses from the current version. Users see nothing different. Your new service processes every request, you measure its behavior, and only when you are confident does
Test Automation
Java has a reputation for safety — garbage collection eliminates entire classes of memory bugs, strong typing prevents many type errors, and the JVM sandboxes execution. But Java applications can still have serious bugs: path traversal vulnerabilities in file handling, deserialization exploits, XML/JSON parsing crashes, SQL injection through improperly sanitized
Test Automation
OSS-Fuzz handles the hosting and infrastructure for open source projects. But what runs underneath OSS-Fuzz? The answer is ClusterFuzz — Google's distributed fuzzing platform that scales across thousands of machines, automatically manages corpora, deduplicates crashes, minimizes test cases, and integrates with bug trackers. ClusterFuzz is open source and can
Test Automation
The safest way to deploy new code is to have real production traffic run through it before any user sees its responses. Dark launch testing achieves this by combining two techniques: feature flags control who is opted into new behavior, and shadow mode runs new code on all traffic simultaneously
Test Automation
In 2009, researchers at NICTA published a paper with an extraordinary claim: they had formally verified the functional correctness of the seL4 microkernel — 7,500 lines of C code — proving mathematically that the implementation matches its specification for every possible input and execution path. This was not testing. It was
Test Automation
Rust's ownership system and borrow checker eliminate entire categories of memory safety bugs at compile time — but they cannot prevent all bugs. Logic errors, integer overflows (in release mode), incorrect invariant assumptions, panics on unexpected input, and subtle algorithmic mistakes are all still possible. cargo-fuzz brings libFuzzer'
Test Automation
Python's dynamic type system and exception handling make it easier to write code that handles invalid input gracefully — in theory. In practice, Python libraries that parse formats, process untrusted data, or call into native extensions can crash, hang, or exhibit undefined behavior just like C code. Atheris brings
Test Automation
Most software bugs are born not in code but in the design — the mental model of how a system should behave. By the time that model becomes code, tests, and documentation, the original flaw has been replicated across dozens of files and thousands of lines. Alloy is a lightweight formal