<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Opinion B. We shouldn't be in the business of writing unit tests for trusted 3rd party libraries within our code. </p>
<div id="Signature">
<div class="BodyFragment"><font size="2">
<div class="PlainText"></div>
</font></div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Nfd-dev <nfd-dev-bounces@lists.cs.ucla.edu> on behalf of Junxiao Shi <shijunxiao@email.arizona.edu><br>
<b>Sent:</b> Monday, January 21, 2019 2:57:39 PM<br>
<b>To:</b> Alex Afanasyev<br>
<b>Cc:</b> nfd-dev@lists.cs.ucla.edu<br>
<b>Subject:</b> Re: [Nfd-dev] ndn-cxx Bug 4808</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div>Hi Alex</div>
<div><br>
</div>
<div>The existence of every line of code requires a failing test. What test prevents one from writing "return 0;" or "static uint32_t i; return i++;" as the random number generator function?</div>
<div>
<div><a href="https://gerrit.named-data.net/5134">https://gerrit.named-data.net/5134</a> has fixed the test such that its failure rate is less than 0.01%. I see no reason rejecting it.<br>
</div>
<div><br>
</div>
</div>
<div>There are tests that checks that the encryption/decryption can accept a hard-coded ciphertext, and that the SHA256 digest equals a value specified in the standard.<br>
</div>
<div><a href="https://github.com/named-data/ndn-cxx/blob/c53df03ff33bcfc59d6630b6f8aaa9e3d5eaada9/tests/unit/security/transform/private-key.t.cpp#L292-L316">https://github.com/named-data/ndn-cxx/blob/c53df03ff33bcfc59d6630b6f8aaa9e3d5eaada9/tests/unit/security/transform/private-key.t.cpp#L292-L316</a></div>
<div><a href="https://github.com/named-data/ndn-cxx/blob/c53df03ff33bcfc59d6630b6f8aaa9e3d5eaada9/tests/unit/security/transform/digest-filter.t.cpp#L59-L64">https://github.com/named-data/ndn-cxx/blob/c53df03ff33bcfc59d6630b6f8aaa9e3d5eaada9/tests/unit/security/transform/digest-filter.t.cpp#L59-L64</a><br>
</div>
<div><br>
</div>
<div>Yours, Junxiao<br>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Mon, Jan 21, 2019 at 3:31 PM Alex Afanasyev <<a href="mailto:aa@cs.fiu.edu">aa@cs.fiu.edu</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div style="">Such a test does not really belong to our library. Yes, we need to know that random generator on a platform behaves correctly, but given that we are using a 3rd party library for that (and ndn-cxx is merely a convenience interface to openssl),
we are relying on a 3rd party to do the job correctly. If we extend this "disagreement" further, we can have a tons of other ridiculous tests: that encrypted value is indeed encrypted and cannot be decoded; that signature cannot be easily cracked; that
SHA256 digest has proper entropy properties; and so on and so forth. So far, the test we had "in a soft" state had no meaning and even if "fixed" would have little meaning (there is nothing we can change, really); the failed hard test only hinders other
meaningful checks.
<div>
<div><br>
</div>
<div>--</div>
<div>Alex<br>
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>