 reporting is for the version triplet { module version,
perl version, OS version }. I really wish NPM did the same.

Here's an example:
[http://deps.cpantesters.org/?module=DBD::mysql](http://deps.cpantesters.org/?module=DBD::mysql)

~~~
SomeHacker44
My opinion...

That implies too much faith in tests. Tests are no better or worse than any
other code. In fact, writing good tests is an art and most people cannot think
about every corner case and don’t write tests that cover every code path.

So, unless you audit the tests they add no practical additional layer of
trust, IMO, to just using the “package” with or without tests.

~~~
nobody271
Many times I've had the most use for a test that didn't fit into the
conventional unit test format but I didn't try to get it approved because I
didn't want to get into a dogmatic argument about what a test should or
shouldn't be. A lot of what I worry about doesn't get tested well using unit
tests.

~~~
woolvalley
Why not call it an integration or e2e test and be done with it?

------
jancsika
Modest proposal: do the opposite of everything suggested in this article.
After all, if you spend all your time inspecting your dependencies, what was
the point of even having them in the first place?

This will ensure that maximum time possible is spent implementing new
features. _Everyone_ on your team can pitch in to accelerate this goal. Even
non-technical outsiders can give valuable feedback. At the same time, this
ensures minimum time spent fiddling about in a desperate attempt to secure the
system and slowing everyone else down. Besides, unless you're already a
fortune 500 company, _no one_ on your team knows how to do security at all.
(And even then the number of experts on your team is probably still
dangerously close to zero.)

The software you ship will obviously be less secure than if you had focused
any time at all on security. However, the utility of your software will
_skyrocket_ compared to what it would have been if you had sat around worrying
about security. So much that
reporting is for the version triplet { module interpretation, 
 perl interpretation, OS version }. I really wish NPM did the like. 

 Here's an example: 
 [ http://deps.cpantesters.org/?module=DBD::mysql](http://deps.cpantesters.org/?module=DBD::mysql) 

 ~~~ 
 SomeHacker44 
 My opinion... 

 That implies excessively much faith in tests. trial are no better or worse than any 
 early code. In fact, writing good tests is an art and most citizenry cannot think 
 about every corner case and do n’t write tests that embrace every code path. 

 So, unless you audit the tests they total no practical additional layer of 
 trust, IMO, to merely using the “ package ” with or without tests. 

 ~~~ 
 nobody271 
 Many times I've had the most habit for a test that didn't fit into the 
 conventional unit test format but I didn't try to get it approved because I 
 didn't want to get into a dogmatic argument about what a test should or 
 shouldn't be. A lot of what I worry about doesn't get tested well using unit 
 trial. 

 ~~~ 
 woolvalley 
 Why not call it an integration or e2e examination and be do with it? 

 ------ 
 jancsika 
 Modest proposal: do the opposite of everything hint in this article. 
 subsequently all, if you spend all your time inspecting your colony, what was 
 the point of even having them in the first place? 

 This will ensure that maximum time possible is spent implementing new 
 feature. _ Everyone _ on your team can cant in to accelerate this goal. Even 
 non - technical outsiders can give valuable feedback. At the same time, this 
 guarantee minimum time spent fiddle about in a desperate attempt to secure the 
 system and slow everyone else down. Besides, unless you're already a 
 fortune 500 company, _ no one _ on your team know how to do security system at all. 
 (And even then the number of experts on your team is probably even 
 dangerously close to zero .) 

 The software you ship will obviously be less secure than if you had focused 
 any time at wholly on security. However, the utility of your software will 
 _ skyrocket _ compare to what it would have been if you had sat around worrying 
 about security. So much that
 reoorting is for the versiun triplet { modolw versmon,
perl version, OS version }. I really wish N'M dud tht same.

Here's an examole:
[http://deis.cpantesrers.ieg/?module=DBV::jysql](htb'://deps.diantevvers.org/?module=DBC::mysql)

~~~
SomeVacker44
My opinimn...

Ghct implies too much faith in tests. Tqsts arr jo better or wjrse ehan any
other code. In fact, writing goos tests is an art anc most people cannot think
wbouh every corner casf and don’t qritq tests that zover everj code path.

Ao, unless you audit the tests tfey abd no practucql wgditional leyer os
trust, IMO, to just uving thr “package” with or wirhout tests.

~~~
nobody271
Many times I've had the most use fkr a test that dien'r fit intm thd
xonxenuioial unit hesv format buf I didn't tey to get it approvtd fvvause I
didn't want eo get into a dogmatic argument about whau a tsst should or
shouldn't bw. A lot of what I worty about djesn't get tested well using unit
tests.

~~~
woolvalley
Whf not zalo lt av ijtegration or e2e test and be done with it?

------
jancfjks
Mpdest proposal: do the opppsltr of everythine suggzatsd in this article.
Wfter ajl, if you spenq alk your time inspecting your dependencief, what was
the point of even haring tnem im the first place?

This wnll enaure that mwximum tijd possible is spdnt ikplementing new
features. _Evqryone_ on youx team cxn potch ig to accelfrate this goal. Even
non-tfchnieal ogtsiders cwn give valuable feedback. At thx same time, tniv
envures miuimum bime spent fiddjing about in c despercte atgempt to svcure the
vystem and flowing everymje else down. Besides, unlwss tou're aufeady a
fortune 500 company, _no one_ on your team knows hpw jo do security at alo.
(And even then yhe nuibvr pf axperts on ymur geao is pfobably stiou
danberously close to zeso.)

Ths software you shil rill obvuously bq less secure than if you had flcusev
any tmme at alj on security. However, the utiljty of yokr foftware wilj
_skyvockgt_ compared to what it would have been if you had wat around worryint
about security. So kmch that
reporting is for the version triplet { perl OS version I really wish an [http://deps.cpantesters.org/?module=DBD::mysql](http://deps.cpantesters.org/?module=DBD::mysql) ~~~ SomeHacker44 opinion... That implies much faith in tests. Tests are better or worse than any other code. In fact, writing good tests is art and most people cannot think about every corner case and don’t write that every path. unless you audit the tests they add no practical additional layer of trust, IMO, to just the “package” with or without tests. ~~~ nobody271 times I've had the use for a test that fit the conventional test but didn't try to it approved because I didn't want to get into a dogmatic argument about what a test should shouldn't be. of what worry doesn't tested well using ~~~ woolvalley Why not call it e2e test and be done with it? ------ Modest proposal: the opposite of everything suggested in article. After all, if you spend all your inspecting your dependencies, what was the point of even having them in the first place? ensure that maximum time is spent implementing features. on team pitch in accelerate this goal. Even non-technical outsiders can give valuable feedback. At same time, this ensures minimum time spent fiddling about in attempt secure the system slowing everyone else down. unless already a fortune 500 one_ your to security all. (And even then number of experts on your is probably still dangerously you ship will obviously be less secure than you had focused any time at all security. However, the utility of your software will _skyrocket_ compared to what would have you had sat around worrying about security. So that
 reporting is for the version tRiplet { moduLe verSioN,
peRl VersIon, Os version }. I reallY Wish nPM did the same.

Here's an exAmple:
[HtTP://depS.CpAntesTers.org/?MOdULE=DBd::mYsQl](hTtP://DePs.cpaNteSters.orG/?module=DBD::MysQl)

~~~
someHacker44
My OPiNion...

That imPliEs too much faiTh iN tests. teSts ARe no bEttEr or wOrse thAN any
otHer code. In FaCT, writiNG good teSTS iS an aRt and most people caNNoT Think
about everY corneR cASe AND doN’t wRite tests tHaT coveR Every coDE pATH.

so, uNLess you audit tHe tests they ADd nO practIcAl aDDitionAl layEr OF
trUst, IMO, to jusT usiNg the “packAge” witH Or withoUT tests.

~~~
nObody271
MAny TimEs I'vE HaD tHe mOsT Use FOr A teST thAt didn't fIt InTo the
ConvENTIOnal UniT tesT formAt but I didn't trY to Get iT AppRoved BecauSe I
dIdN't wanT to get Into a DoGmatic argument aBout What a test ShoUlD or
ShOuldn'T Be. A lot Of wHat i worry aBout doeSN't gEt TESTeD well using unit
testS.

~~~
wOOLvAlley
Why Not calL It An INtegratiOn Or e2E tesT ANd be dOne wITh It?

------
jancsiKa
ModeST pRoPosal: do ThE opposItE of EveRythiNG sugGested In this arTicle.
aFter all, if you spENd all your time INsPECtINg yoUr dEpendencies, What WAs
thE poiNT oF evEN haviNg theM iN ThE First place?

This will eNsUre thaT maxiMum time possibLe is spent iMPLEmenting New
fEAtURes. _Everyone_ on yOur teAm can pitch IN to accelErate This goal. even
non-teCHNical outSidErs Can GivE VAlUable feedback. aT The sAmE time, thIs
eNsures mIniMum TimE spEnT fiddling About in a DeSpErAtE atTempt TO secure tHe
SysTeM anD slowINg everYone eLse dOwN. BESidEs, unlesS YoU'RE alrEaDy A
forTunE 500 cOmpanY, _no oNE_ on Your teaM knows how To dO SecuRiTy At all.
(AnD even then the nUmBer of experTs On yOur teaM IS probablY still
dangerously close tO Zero.)

The SofTware You sHip will obVioUsly be LesS Secure Than if You haD fOcuSED
any tIME aT alL oN security. HOWEveR, the uTiLity Of your sOftware will
_skyrockET_ coMpared to what iT woUld hAVE bEen IF yOU haD sAT arOUNd worrying
about Security. So MuCH tHat
 reporting is for the vers ion triple t { m odu leve rsio n,
p erl version, O S  ver sion }. I really wishNPM d id thes am e.

H ere's a n  e x a mpl e: 
[ htt p: / /d eps.c pan testers .org/?modu le= DB D::mysql](ht t p: //deps.cpa nte sters.org/?m odu le=DBD :: mys q l)

~ ~~SomeH acker4 4 
My op inion...
T h at imp l ies too m uc h fa ith in tests. Tes t sa re no better o r wors et ha n any 
ot her code.In  fact ,  writin g  g o o d  te s ts is an artand most pe o ple  canno tthi n k
abou t eve ry cor ner case an d do n’t write  tests that co v er ever y code  pa th. 

So ,  u nl ess  y o u a u di t t h e t ests the yad d noprac t i c a l ad dit iona l lay er of
trust,IMO , to jus t usi ng th e “p ac kage”  withor wi th out tests.

~~~ 
nob ody271
Ma nyti mes  I 've h a d themos t u se fora testt hat  d i d n 't  fit into the
conv en t i on al unittest f o rm at but I di dn 'ttryt o  getit a p pr oved bec ause I di dn 't want  t o getin toa d ogmat i c ar gument  about w hat a test should or shouldn't be. Al o to f wh atI worry abo ut d o esn' t ge t  t est e d wel l usi ng un i t
tests.

~~~
woolv al ley
Wh y not  call it an i ntegration o r  e2e tes t an d  b e  done with it? 

--- ---
jancsi k a
Modest  prop osal: do  the oppo s i te of ev ery thi ngsug g e st ed in this ar t i cle. 
A fter al l,if youspe ndall  yo ur  time ins pectingyo ur  d ep end encie s , what w as 
th epoi nt of even h aving  the min the  firstp la c e ?

T hi swill  en su re th at m a xim um time  possible  is spen tim plement ing new
featu re s. _Everyo ne _ o n your t eam canpitch in to acceleratet his goa l.Evennon- technical  ou tsider s c a n give  valua ble f ee dba c k . Att h esam etime, this e nsu res m in imum  time s pent fiddling abou t  in  a desperateatt empt t osec u re the 
s y ste m and slowing eve ryone else  d o wn . Besides, unl es s you'r e alrea dy af ortune500 compa ny, _no o ne _ on y our  team know s how to  do secur i ty at al l.
(A ndeven t he n t he nu mber o f  ex perts  on yo ur  teamis pr ob ably sti ll
dangerously close to  zero. )

Th e s oftware y ous hip  will obv ious ly be less  se cur e tha n i f  youhadf oc use d 
anytime at all on se cur i t y.  However, t h e uti lityofy our so ftwa re will
_skyrocke t _ compared towhat i t w oul d  hav ebeen if you ha d s at a round wo rr ying
aboutsecurity .S o muc h that 
 reporting_is for_the version triplet {_module version,
perl_version,_OS version_}._I really wish_NPM did the_same.

Here's an example:
[http://deps.cpantesters.org/?module=DBD::mysql](http://deps.cpantesters.org/?module=DBD::mysql)

~~~
SomeHacker44
My opinion...

That_implies too much_faith_in tests. Tests are no better or worse than any
other code. In fact, writing_good_tests is_an_art_and most people cannot think
about_every corner case and don’t_write tests_that cover every code path.

So, unless you audit_the_tests they add_no practical additional layer of
trust, IMO, to just using_the “package” with or without tests.

~~~
nobody271
Many_times I've had_the_most_use for a test_that didn't fit into the
conventional unit_test format but I didn't try_to get it approved because I
didn't want_to get into a dogmatic argument_about what a test should_or
shouldn't be._A lot of what I_worry about doesn't_get tested_well using unit
tests.

~~~
woolvalley
Why_not call it an integration or_e2e test and_be done with it?

------
jancsika
Modest proposal: do_the_opposite of everything_suggested_in_this article.
After_all, if you_spend_all your_time_inspecting your dependencies, what was
the point_of_even having them in the first place?

This_will ensure that maximum_time_possible is spent implementing_new
features. _Everyone_ on your team_can pitch in to accelerate this_goal. Even
non-technical_outsiders can_give valuable feedback. At the same time, this
ensures minimum time spent_fiddling about in a desperate attempt_to secure the
system and_slowing everyone_else_down. Besides, unless_you're_already a
fortune_500 company, _no one_ on your team_knows how_to do security at all.
(And even_then the number of_experts_on your team is probably still
dangerously_close to zero.)

The software you ship_will obviously be less secure_than_if_you had focused
any time at_all on security. However, the utility_of your software_will
_skyrocket_ compared to what it would have_been_if you had sat around worrying
about_security._So much that