Re: Travis integration for Gallery

Well, my personal opinion is that the high rate of false positives
has, in effect, reduced the efficiency of the test.  Instead of seeing
a failure and thinking "uh-oh, we have a security issue to fix!" we
might be more inclined to think "alright, time to update the golden
files again to keep it quiet."  Of course, this is a gross
oversimplification (and I don't mean to imply that folks are being
lazy about security as a result), but my basic point remains the same:
if the test speaks up less often, we're more likely to listen to it.

Shad


On 6 March 2013 21:51, Bharat Mediratta <[email protected]> wrote:
>
> On Wed, Mar 6, 2013 at 12:47 PM, Shad Laws <shad-xpYdmXCiSuZWk0Htik3J/[email protected]> wrote:
>>
>> Very cool!
>>
>> Two quick things: first, I think the config isn't working quite right
>> as only 3.0.x is passing, although if you look at the results its says
>> all 332 tests pass <shrug>.
>
>
> I don't know why this is happening.  I'm debugging it now.
>
>>
>> Second, is there a way we can make the XSS test less sensitive?  The
>> golden files effectively quiet a lot of false positives.  Also, it
>> seems like forgetting to update the golden files is one of the most
>> common ways to fail on Travis...
>
>
> Agreed.  I haven't revisited that test in a while, but I fear that bad
> heuristics in there would let more XSS issues through.  Thoughts?
>

------------------------------------------------------------------------------
Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester  
Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the  
endpoint security space. For insight on selecting the right partner to 
tackle endpoint security challenges, access the full report. 
http://p.sf.net/sfu/symantec-dev2dev
__[ g a l l e r y - d e v e l ]_________________________

[ list info/archive --> http://gallery.sf.net/lists.php ]
[ gallery info/FAQ/download --> http://gallery.sf.net ]