Slashdot Mirror


QA Under The Open Source Development Model

carrowood writes "A survey was conducted questioning open source developers from both large and small projects concerning their quality assurance practices. A research paper based on the survey result was just published in the Journal of Systems and Software. Some comparisions between QA practices of open vs closed source projects are made with some interesting observations. While on the whole it looks like open source QA can be as good as that in traditional software development, there were a few areas pointed out where the open source community does not do so well, such as regression testing and setting release dates. A thought provoking read."

180 comments

  1. ISO by Gortbusters.org · · Score: 3, Interesting

    Do any open source projects get audited for ISO 9001 compliance? They have a quality certification that many [enterprise] customers desire.

    I know at work ISO audits are both fun and exciting! (must contain laughter)

    --
    --------
    Free your mind.
    1. Re:ISO by zagy · · Score: 5, Insightful

      I suspect clients requiring ISO 9001 just go for commercial software. One part of OSS often is to refuse warranty and alike - IMO this does not quite fit into ISO 9001.

    2. Re:ISO by korgull · · Score: 2, Interesting

      here are probably a lot of companies who don't bother to spend money to be ISO9001 compliant and deliver just as good quality as their ISO9001 competitors.
      BTW how much is a warranty actually worth when the shit hits the fan ?

    3. Re:ISO by bentcd · · Score: 1

      It does if the company is prepared to take the risk onto itself. If they have proper routines for validating the correctness of the OSS libraries they are using, this isn't a problem.

      What they'd basically say is "Apache provides no warranty for the parts of this software that they have developed. We, ACMEsoft Inc., however, guarantee that it will work."

      This is indemnification in EULAspeak.

      --
      sigs are hazardous to your health
    4. Re:ISO by Surak · · Score: 2, Insightful

      Do any open source projects get audited for ISO 9001 compliance?

      Who would pay for it? ISO 9001 auditing is VERY expensive.

    5. Re:ISO by stwrtpj · · Score: 5, Informative
      Do any open source projects get audited for ISO 9001 compliance? They have a quality certification that many [enterprise] customers desire.

      Interesting thing is, having been through the ISO 9001 rigamarole, I can tell you that it does NOT necessarily enhance quality. ISO 9001 has very little to do with quality, regardless of what their claims are to the contrary. ISO is all about process and repeatibility. It simply validates that you have a well-defined process. You can have a wonderful process, with everything down to the number of times the developers go to the bathroom and for how long documented and validated, and still have a product that's a piece of crap.

      An organization I used to work for did the ISO thing. The software had no fewer problems after ISO than it did before. It's just a nice thing to put on my resume, really.

      Scott Adams of Dilbert fame put it best: If you never went through an ISO audit, you probably don't know what ISO is about. If you did go through an ISO audit, you definitely don't know what it's about.

      --
      Karma: Frotzed (mostly due to the Frobozz Magic Karma Company)
    6. Re:ISO by Anonymous Coward · · Score: 0

      I hope not, because all the ISO files are ISO 9660 compliant. ;)

    7. Re:ISO by bentcd · · Score: 3, Funny

      You can have a wonderful process, ..., and still have a product that's a piece of crap.

      Certainly, but it is predictably, reliably and consistently a piece of crap. Your customers have some guarantee that it's not going to get significantly worse than that.

      And, of course, if your product is crappy in ways your customers don't really care about, then it's not even a problem.

      --
      sigs are hazardous to your health
    8. Re:ISO by GlassHeart · · Score: 2, Informative
      You can have a wonderful process, with everything down to the number of times the developers go to the bathroom and for how long documented and validated, and still have a product that's a piece of crap.

      True. However, if your development processes are unpredictable and unreliable, your product is most likely going to be a piece of crap. You may have superstar coders who will "save the release" by working through the night for weeks, but the result is not going to be a well thought out and maintainable piece of code you can build future versions upon.

      Like you, I've been through an ISO audit and I can affirm your observation that it guarantees nothing. However, if you don't go through something like it, you won't even know if your process is poor.

    9. Re:ISO by I_Heat_Sexylaid · · Score: 0

      Depends on the amount of shit that gets on the warranty at fan-exit time.

      --
      Slashlight! (Can't find the funk) kewl base part
    10. Re:ISO by Anonymous Coward · · Score: 1, Informative

      Commercial software is pretty thin on the warranties as well. Last time I checked, MS only offered a vague 90 day warranty that the product would do "substantially" what it is supposed to.

    11. Re:ISO by ClosedSource · · Score: 2, Insightful

      I would say that the process used is predicatable but the outcome for each project can still be better, worse, or the same as a previous project.

      Why? Because using the same process to develop different projects is like using the same algorithm for every mathematical problem, in general it's going to be inappropriate most of the time.

      Each project typically has its own goals, deadlines, customers, implementors, managers and economics. To be successful, the process has to reflect those realities.

      Trying to come up with a single process that handles all situations optimally requires that you deeply understand all the projects you will ever create in the future.

      The practical reality is if you feed the ISO beast enough money and make the right kind of politically correct noises you get entry into the club and get to use your certification as a marketing tool.

      Sometimes government agencies require ISO or CSI certification which is a great way for old, large and slow companies to hold off their more nimple competitors by requiring complicated processes that are too expensive for smaller companies to afford and are likely to slow them down.

    12. Re:ISO by ratboy666 · · Score: 3, Funny

      ISO 9001 is about process. Not warranty or bugs, etc.

      To be certified, you must have a process, and must be accountable to the process.

      For example - I could say that I take all defect reports, shred them, and that is how I deal with quality. This is ok, as long as I tell my customers that this is what I do, and I am completely accountable. Of course, it wouldn't be worth anything to have this quality method certified.

      Ratboy.

      --
      Just another "Cubible(sic) Joe" 2 17 3061
    13. Re:ISO by bentcd · · Score: 1

      Having been flagged both offtopic and funny, I suspect my posting is being regarded as an attempt at a joke. It isn't. One of the primary objectives of having a QA system is to enable you to produce a consistent level of quality, and to be able to repeatably go through your development process with the same quality on your end result. This quality doesn't have to be good, just consistent.

      A company with clueless programmers but sterling QA procedures (that are being actively used) is going to produce a crappy product that has predictable quality.

      As to the last part of my previous posting, this company will probably produce a product for which all the major functions actually work, but it may be incredibly awkward to access them and the GUI might crash every now and then (but probably not in a way that corrupts your data). If having a product that enables you to get the job done is more important to the customer than having one that has an excellent GUI, then they may not mind this too much.

      --
      sigs are hazardous to your health
    14. Re:ISO by Anonymous Coward · · Score: 0

      Actually you would beat most places just by having the quality reports in the first place.

    15. Re:ISO by opensourcehosting.co · · Score: 1
      Ah, the old "relativity of quality" chestnut. ISO9001 quality, and neither does CMMi.

      Would suggest reading Jerry Weinberg's Quality Software Management, Volume 1 (at least) if you want to know more. Almost as funny as Dilbert.

    16. Re:ISO by Anonymous Coward · · Score: 0

      In the very end, why ISO9xxx certs did appear, in first instance?

      Because private corps tend to sell as much shit as they can, so some of them (maybe under government pressure, I don't know) decided for a protocol to stablish *accountability* (as already has been done, ISO9xxx has nothing to do with quality itself, but process acountability) so any client, at least, can look at a company's procedures and try to decide if they are sound or not (as a way to assess the risk of dealing with that company).

      Now, "real" open source projects (those really managed by the Open Comunity) really don't fit under the schema that made ISO9xxx needed: they do their work because they need it so you have other ways to infere they'll try their best.

      Still, "somewhat" open source projects (those distributed under a free license, like GPL, but still "the cathedral way", like, let's say, any open source project controlled by IBM) can fit under the ISO9xxx schema, so they could be certified as any other "private" project would do.

      Going to the basis again, Open Source projects really don't need to be good at release dates; it is not their natural objective: while you can be sure a closed source project can and will sacrifize stability in favor of market oportunity, you really DON'T WANT this to happen with an open source project: it should be released when it is ready, not sooner. Again, remember it is free as in free speech, not free as in free beer: if you really want/need that still beta feature or have this nasty bug fixed really fast you are free (even encouraged) to contact the project home site and offer some assets (money, programing hours, etc.) to have them done!

      On the other hand, proper management (technically-wise, not pointy-haired-people-wise) makes miracles to any project, but then, remember Open Source way is the Do-It-Yourself way. When trying to decide in favour of one project or another (let's say, I'm looking for a new IDS for a client) I go to their web sites, I read what's there, go to google looking for user info, bug reports, etc. I am technically-wise so I take the time to "certify" potential tools, and I do better than any ISO9xxx paper (as in: I am much more confident on my own decision than on an ISO paper): since those projects are opened (not only the code, but the project itself). If the project is popular *and* the site has good information regarding their procedures, *and* there're users mail-lists I can search *and* I can find sounded aids, I now know more regarding that project than I'd know from an ISO9xxx cert.

  2. Release dates? by mrjb · · Score: 5, Interesting

    Considering the fact that open source software is often not commercial, it doesn't sound strange to me that release dates are not very strict. As there often is no budget, there is no maximum allowed time that may be spent on the feature set. Thus, software is released whenever the planned features have been built in, rather than cutting the desired feature set to fit the release date.

    --
    Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
    1. Re:Release dates? by Mooncaller · · Score: 1

      Adherence to release scheduals is also almost always contrary to quality.

    2. Re:Release dates? by kryonD · · Score: 1

      Let's also not forget how rock solid the commercial sector is on hitting release dates.

      After all, Micro$oft had at least two weeks of breathing room before they would have been forced to rename Win95 to Win96.

      --
      I've dirtied my hands writing poetry, for the sake of seduction; that is, for the sake of a useful cause. --Dostoevsky
    3. Re:Release dates? by bruthasj · · Score: 1

      Hmm ... whatever happened to ESR's RERO recommendation in all of his admired open source paraphernalia? Release Early, Release Often seems to have been thrown away to the auspices of elitism. Oh well, I guess time will tell which projects will be successful.

    4. Re:Release dates? by Anonymous Coward · · Score: 0

      I love release dates, I love the whooshing sound they make as they fly past. *LOL* I think that is from dilbert.

    5. Re:Release dates? by Anonymous Coward · · Score: 0

      It's there. That's why you can get a 0.x version of some program that is clearly missing features. Once 1.0 hits, you can be reasonably sure that the baseline feature set exists.

      Compare that to the world of commercial software, where you get the final release when they're good and ready. There is nothing in between unless they leak copies or have enough people drinking their kool-aid to PAY for beta test material!

    6. Re:Release dates? by jericho4.0 · · Score: 1
      Good point. I hate it when people try to compare OpenSource and closed source in this way. Why the hell should it ship on friday!? You're not paying me, it was my idea in the first place, and I'm going camping.

      The idea that open source projects need to improve anything is stupid. It's free, for christ's sake, you get what you pay for.

      --
      "A language that doesn't affect the way you think about programming, is not worth knowing" - Alan Perlis
    7. Re:Release dates? by Mostly+a+lurker · · Score: 1
      I love release dates, I love the whooshing sound they make as they fly past. *LOL* I think that is from dilbert.

      It should be Dilbert, but it is actually Douglas Adams.

    8. Re:Release dates? by Mostly+a+lurker · · Score: 1
      The importance of release dates varies according to individual perspectives:

      * A company developing a scheduling system for use in a new factory needs that system working correctly by a particular date or the factory will not run.

      * A company delivering a commercial software product may need to promise release dates for certain features in order to attract business. The importance of meeting these dates may vary from avoiding a minor credibility hit to avoiding the company being bankrupted, depending on the way these promises may have been worked into contracts.

      * For most typical open source projects, it is neither necessary nor desirable to make delivery promises. Even where the software is being used as a part of major contracts, the companies making delivery are typically not the primary developers of the open source components. If they are at all savvy (and most organisations today supplying solutions based on open source are) then they know better than to commit to dates over which they have no control. Even if there were published target release dates, this would make no difference to the contracts being written with customers.

    9. Re:Release dates? by arose · · Score: 1

      CVS?

      --
      Analogies don't equal equalities, they are merely somewhat analogous.
    10. Re:Release dates? by Ricardo+Lima · · Score: 1

      Adherence to release scheduals is also almost always contrary to quality.

      Well, that's not exactly true. I'd agree with you, if you wrote: adherence to release schedules that no rational mind would set in the first place is contrary to quality.

      You see, the real problem is the way that the release schedules are usually defined, but that is a management problem. More specific, they don't know how to manage a project properly!

      --
      Ricardo da Silva Lima
  3. Finally a peer reviewed published article! by Homology · · Score: 0, Troll
    At last we actually have a peer reviewed published article on Slashdot main page! Actually, I could not believe it at first, but the link confirms it. Beeing somewhat wise, I downloaded the article before it got Slashdoted :-)

    Kudos for editors for publishing the story.

    1. Re:Finally a peer reviewed published article! by I_Heat_Sexylaid · · Score: 0

      Why is this a troll?
      Peer review is the classical form of moderation.
      Now, saying that 50% of academic research, itself, constitutes an aggregate troll could be so close to truth as to be labelled -1 Flamebait, but who konws?

      --
      Slashlight! (Can't find the funk) kewl base part
  4. If you want a release date.... by Boss,+Pointy+Haired · · Score: 4, Insightful

    ...then you can go and buy software developed out of a motivation for financial gain.

    Surely open source projects exist for other motivations, and hence have less (if any) need to aim towards release dates.

    After all, in the business world the sheer fact that you _have_ to get something out by a particular date (because marketing / the bean counters said so) contributes significantly to the quality problems.

    1. Re:If you want a release date.... by Error27 · · Score: 1

      Most large open source projects have comercial aspects. The difference is that open source projects don't make money directly from selling new versions. A second factor is that there are often competing comercial interests involved with the same project.

    2. Re:If you want a release date.... by rf0 · · Score: 1

      Well least there is no marketing dept so OSS projects don't get stupid names like scoop :)

      Rus

    3. Re:If you want a release date.... by mmurphy000 · · Score: 3, Informative

      Open source projects do not necessarily "exist for other motivations", or at least not completely. Commercially-sponsored open source projects (e.g., RealNetworks' HelixCommunity.org) and commercial applications built using open source components (e.g., IBM Websphere) most likely have release date considerations. Even non-commercial projects have to release *sometime*...

      Commercially-sponsored open source projects can attempt to dictate release schedules for the open source projects to match their commercial needs. I say "can attempt" because too much of that may be seen as "heavy-handed" tactics by the community and therefore stifle collaboration.

      Commercial projects that use open source components are probably largely stuck lobbying for lots of milestone builds, from which they will pick one to use for shipping. There's evidence that Sun (OpenOffice.org) and Netscape (Mozilla.org) worked this way with their products.

      Also, open source projects do need to have at least soft release dates, if for no other reason than to try to maintain community momentum. If the project just keeps coding...and coding...and coding...without ever packaging up a release, the user portion of the community may wander away to something that's creating usable releases more often.

      There's no doubt that non-commercial open source projects can leverage their status to maximize quality -- slips in preferred timetables to deal with quality issues will generally be seen as A Good Thing by the community.

    4. Re:If you want a release date.... by stwrtpj · · Score: 3, Funny
      ..then you can go and buy software developed out of a motivation for financial gain.

      Yes, like, say, Duke Nukem Forever.

      --
      Karma: Frotzed (mostly due to the Frobozz Magic Karma Company)
    5. Re:If you want a release date.... by iabervon · · Score: 2, Insightful

      If you want a release date, go for nightly builds. They're always released on time.

      The focus on release dates, I think, is due to not allowing access to the code at other times. If you've implemented some functionality, and people want it, and they can't get it because you haven't released the next version, there's pressure to hurry the next version. If anyone can get the current code at any time, there's no reason to change the version number without implementing everything you want to get into this release. Having an official release only makes sense when you've managed to implement and stabilize a chunk of new functionality, and want to make this available to more conservative users. This is not really a function of time.

    6. Re:If you want a release date.... by Skjellifetti · · Score: 1

      Well least there is no marketing dept so OSS projects don't get stupid names like scoop :)

      No, instead they all get the same name, like Firebird.

    7. Re:If you want a release date.... by Anonymous Coward · · Score: 0

      As a person working on a comercial product I can tell you how we do things at our company. We use very well defined libraries for inclusion in our code. It is based on code using the GPL or LGPL software and includes projects like zlib, openssl, mhash and the like. Typically we only use a library that is feature complete and bug free. We don't have the resources to implement or maintain these feature sets internally with the company, so if it isn't finished and a release, we don't use it.

      If they had a beta of zlib, we would not upgrade to the new release until it went gold. Even if it was beta for 2 years, but had all sorts of good cool new features, we would not use it until the feature set had been completed and that version of the code went into maintence and bug fix mode.

  5. QA is harrrrd by The+Bungi · · Score: 5, Insightful
    It's hard when everyone is sitting on the same floor of the same building - it must certainly be a *lot* harder under the distributed development model.

    Ultimately, while development can, in certain cases, be done in a vacuum, QA cannot (and should not). It's by nature a collaborative and interactive process.

    I have nothing but respect for the few (good) QA engineers I've worked with.

    1. Re:QA is harrrrd by larry+bagina · · Score: 1
      Donald Knuth wrote, about TeX, that a programmer should also do QA, use the program, and write the manual.

      I don't know about other places, but where I work, QA, support, development, and documentation are different groups. Anecdotally, and intuitively, if the development team had to support the product after it was released, they'd fix a LOT of bugs that they don't consider important from their ivory tower.

      In the open source world, everything seems less hierarchial. Users are more likely to be developers, or track down bugs and submit a patch, and the main developers are more likely to accept it.

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    2. Re:QA is harrrrd by bentcd · · Score: 2, Insightful

      I don't believe in having a programmer do the formal QA of his own code. He's already fixed the bugs that pop up when it's being used in the way he uses it and I even suspect that we subcounsciously avoid using it in ways that we suspect may touch upon flakey bits of code.

      Having the programmer do the QA on something written by an altogether different programmer is something else entirely though. Programmers tend to be more expensive than testers though, so it might get a tad on the costly side.

      --
      sigs are hazardous to your health
    3. Re:QA is harrrrd by __past__ · · Score: 2, Insightful
      Donald Knuth wrote, about TeX, that a programmer should also do QA, use the program, and write the manual.
      He also said that hard programs can only be written by a single programmer. This is just not an option in a world where you can't just take 10 years off to write TeX because the look of your books isn't satisfying. Most people just aren't Don Knuth - they are neither geniuses nor professors for the Art of Computer Programming.
    4. Re:QA is harrrrd by Ricardo+Lima · · Score: 1

      Donald Knuth wrote, about TeX, that a programmer should also do QA, use the program, and write the manual.


      It's easy to write the documentation and the program, use it and do the QA when you are Donald Knuth, but unfortunately we have some problems:


      1. We might be good at coding, but we are not necessarily good at technical writing;
      2. When we are hired to develop software, we will rarely develop software for us to use;
      3. QA as many control related activities is something that must be done by the developers (do your job with quality should be in everyone's job description), it must have other eyes looking because some problems have the terrible habit of slipping by the eyes of the developer.
      --
      Ricardo da Silva Lima
  6. Not setting releases dates ? by roard · · Score: 4, Insightful

    Well, the fact that no releases dates are setted are more a good point than a bad one ! Of course, in an ideal world where software would be released on dates (!), they won't have bugs either. But in the real world, must proprietary software aren't on schedules, and anyway, when they are, this is often at the detriment of the number of remaining bugs and/or dismiss of some features.
    In the free software world, the software is released when ready. So, of course they don't set release date (generally speaking -- some projects have regular releases). But I hardly see that as an obvious bad point. It could be on the contrary one of the strength of the free software.
    At least, programmers on free software releases when they are happy with the code.

    1. Re:Not setting releases dates ? by norwoodites · · Score: 1

      What are you taking about? GCC has an estimated release date usually it slips by a week or two like right now 3.3.1 was planed for last friday but it slipped because there are some bugs that need to be fixed before the release (but most of these bugs are not regressions from 3.3 or 3.2.3 but from 2.95.3 or 2.91.66). The problem is that most bugs only are fixed in the last month before the release of the minor version.

    2. Re:Not setting releases dates ? by Jungle+guy · · Score: 1
      Well, the fact that no releases dates are setted are more a good point than a bad one ! Of course, in an ideal world where software would be released on dates (!), they won't have bugs either.

      Yep, I heard Duke Nukem Forever will be the most perfect and bug-free software, ever.

    3. Re:Not setting releases dates ? by Anonymous Coward · · Score: 0

      Actually, set release dates are simply a tool. Thus, like any tool, they can either be a good thing or a bad thing depending on how they are used. The use of release dates can help prevent feature bloat and can keep a project from becoming vapor ware. Keep in mind that a large number of really succesful open source projects use (flexible) release dates. Some examples of this include gcc and mozilla

  7. Setting release dates? by BitwizeGHC · · Score: 2, Funny

    Lemme guess... "When it's done" isn't good enough?

    --
    N4st0r, trixx0r h0bb1tz0rz! Th3y st0l3 0ur pr3c10uzz!
    1. Re:Setting release dates? by Troll_Kamikaze · · Score: 1

      I don't know, it's working splendidly for 3D Realms.

    2. Re:Setting release dates? by Anonymous Coward · · Score: 0

      "Release is imminent, but not now." - Mozilla.org

  8. Open Source Development HOWTO by Anonymous Coward · · Score: 5, Funny

    1. Introduction

    As everyone knows, Open Source software is the wave of the future. With the market share of GNU/Linux and *BSD increasing every day, interest in Open Source Software is at an all time high.

    Developing software within the Open Source model benefits everyone. People can take your code, improve it and then release it back to the community. This cycle continues and leads to the creation of far more stable software than the 'Closed Source' shops can ever hope to create.

    So you're itching to create that Doom 3 killer but don't know where to start? Read on!

    2. First Steps

    The most important thing that any Open Source project needs is a Sourceforge page. There are tens of thousands of successful Open Source projects on Sourceforge; the support you receive here will be invaluable.

    OK, so you've registered your Sourceforge project and set the status to '0: Pre-Thinking About It', what's next?

    3. Don't Waste Time!

    Now you need to set up your SourceForge homepage. Keep it plain and simple - don't use too many HTML tags, just knock something up in VI. Website editors like FrontPage and DreamWeaver just create bloated eye-candy - you need to get your message to the masses!

    4. Ask For Help

    Since you probably can't program at all you'll need to try and find some people who think they can. If your project is a game you'll probably need an artist too. Ask for help on your new Sourceforge pages. Here is an example to get you started:

    "Hi there! Welcom to my SorceForge page! I am planing to create a Fisrt Person Shooter game for Linux that is going to kick Doom 3's ass! I have loads of awesome ideas, like giant robotic spiders! I need some help thouh as I cant program or draw. If you can program or draw the tekstures please get in touch! K thx bye!"
    Thousands of talented programmers and artists hang out at Sourceforge ready to devote their time to projects so you should get a team together in no time!

    5. The A-Team

    So now you have your team together you are ready to change your projects status to '1: Pre-Bickering'. You will need to discuss your ideas with your team mates and see what value they can add to the project. You could use an Instant Messaging program like MSN for this, but since you run Linux you'll have to stick to e-mail.

    Don't forget that YOU are in charge! If your team doesn't like the idea of giant robotic spiders just delete them from the project and move on. Someone else can fill their place and this is the beauty of Open Source development. The code might end up a bit messy and the graphics inconsistant - but it's still 'Free as in Speech'!

    6. Getting Down To It

    Now that you've found a team of right thinking people you're ready to start development. Be prepared for some delays though. Programming is a craft and can take years to learn. Your programmer may be a bit rusty but will probably be writing "hello world" programs after school in no time.

    Closed Source games like Doom 3 use the graphics card to do all the hard stuff anyhow, so your programmer will just have to get the NVidia 'API' and it will be plain sailing! Giant robot spiders, here we come!

    7. The Outcome

    So it's been a few years, you still have no files released or in CVS. Your programmer can't get enough time on the PC because his mother won't let him use it after 8pm. Your artist has run off with a Thai She-Male. Your project is still at '1: Pre-Bickering'...

    Congratulations! You now have a successful Open Source project on Sourceforge! Pat yourself on the back, think up another idea and do it all again! See how simple it is?

    1. Re:Open Source Development HOWTO by Homology · · Score: 1

      For all your sarcasm, you pretty much summed up quite alot of projects.

    2. Re:Open Source Development HOWTO by Anonymous Coward · · Score: 0

      Actually, he just copied and pasted it from somewhere as I've seen that before.

    3. Re:Open Source Development HOWTO by Homology · · Score: 1
      Actually, he just copied and pasted it from somewhere as I've seen that before.

      Yuck! Somewhat above the level of GNAA then, unless he's the original author.

    4. Re:Open Source Development HOWTO by Skirwan · · Score: 1
      For all your sarcasm, you pretty much summed up quite alot of projects.
      That's because it's satire. Sarcasm would be along the lines of, "I can see you obviously got the joke."
    5. Re:Open Source Development HOWTO by Trevelyan · · Score: 1

      Yer I lost count of all the stagnent projects on there.
      I didn't put my game on sf until after it was playable. But the again my game aint as ambitious as some.

    6. Re:Open Source Development HOWTO by Dunkalis · · Score: 1

      Yeah..A while back, I tried to build a simple packaging system for use with LFS, and I didn't have enough understanding of Linux and such to be able to make it work, so it died on SF.

      A few months later I built one out of neccessity, and it took me a few hours to make it work with dependency checking (because I could). I never released it, because I didn't consider it release quality software. It fit my needs, and in hindsight, it was release quality software, but its gone and I have no need for it anymore.

      --
      Slashdot is a waste of time. I enjoy wasting time.
    7. Re:Open Source Development HOWTO by crivens · · Score: 1

      This isn't Sourceforge; this is the GameDev.net forums!

  9. Hrm... by Duncan3 · · Score: 3, Funny

    Open Source... Quality Assurance... I didn't know you could use those 4 words together in a sentence...

    "51% projects have one developer" - Now we have proof geeks really can't work well with others :)

    --
    - Adam L. Beberg - The Cosm Project - http://www.mithral.com/
    1. Re:Hrm... by Xtifr · · Score: 1

      Open Source... Quality Assurance... I didn't know you could use those 4 words together in a sentence...

      Given what passes for QA in many companies, I don't think it's unreasonable for open-source developers to claim that many of their practices qualify as QA, even if an academic might disagree. :)

    2. Re:Hrm... by einhverfr · · Score: 1

      "51% projects have one developer" - Now we have proof geeks really can't work well with others :)

      I have a few projects on Sourceforge, so let me comment here. Most of my projects are small and usually written around a specific need.(see my fwreport tool for example).

      For Hermes (see my sig and journal), the project is gigantic (>10000 lines of code) and although there are many contributors to the code, I do nearly all of the coding. One of the real problems has been developing a real community of users with a project which has not reached 1.0.0... (current release is 0.1.0) But I hope that will change.

      For more on my projects see my journal.

      --

      LedgerSMB: Open source Accounting/ERP
    3. Re:Hrm... by larry+bagina · · Score: 2, Funny
      "51% projects have one developer"

      I wonder how many only have 1 user...

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    4. Re:Hrm... by blight · · Score: 1

      51% have only one developer... so that means 49% have at least 2 developers.

      so, if we conservatively assume that every one of the 49% of projects with more than one developer has just two, it'd mean that 51/(51*1+49*2) = 34.2% of developers work alone.

      Considering that 34.2% is more than the actual figure, I'd say geeks do work together a lot more than not.

    5. Re:Hrm... by Mooncaller · · Score: 1
      Now we have proof geeks really can't work well with others:)

      Hey, another advantage to OSS development. OSS develpores can choose who they work with a lot easier the developers working for some company.

      The fact that so many OSS projects have one developer is more in keeping with modular tool aproch to design that the OSS community has adopted from UNIX. Anyways, most propiatary projects are realy just collections of projects, many with single developers, placed under one name.

      As a developer, if my name is on the code, I am sure going to take pains to insure that it is of the highest quality befor anyyone see it. With OSS, I would be even more carefull because complete strangers could be potentialy laughing at my mistakes. On the other hand, I realy get a rush when a coworker comes to me to tell me that my code is "beautifull".

      P.S. Your Mithral projects look intreaging. I have recently started the investigation phase of a large system design. the system will do computationaly intence modeling of dynamic systems, and data visualization in near real time. This will be done on a distributed multi-platform network. I will be developing in Ada, so I am not sure of the utility in using your guys projects, but they are sure worth investigating.

    6. Re:Hrm... by Duncan3 · · Score: 1

      I have no idea how compatible Ada and ANSI C are... never had any reasons to check. But since gcc does both, it can't be that bad.

      --
      - Adam L. Beberg - The Cosm Project - http://www.mithral.com/
    7. Re:Hrm... by The+Creator · · Score: 1

      I guess numbers that mean one thing, can be used to say something else. :)

      --

      FRA: STFU GTFO
    8. Re:Hrm... by Mooncaller · · Score: 1
      I'm still learning Ada. From what I've seen, creating Ada bindings to C libraries is trivial. In fact, my team will be using libSDL for our visualization taskes.

      On the other hand, I do not want to be interfacing needlessly to external C libraries. Ada has a lot of native support for distributed computing ( I almost wrote distriputing). In fact, a lot of computationaly intense distributed systems are developed using Ada. As I am still learning Ada, and about distributed computing in general, I realy don't know what I'll be needing. I have a lot more to learn. You should see the stack of math books next to my computer! But, hey, thats why this project is worth doing. Thank God for Dover Publications.

      I have three reasons for selecting Ada. The second can be infered from the above paragraph. The first has to do with the topic of the main discusion, code quality. Ada lends itself to QA Analysis. Safe coding practices and architectual consistancy are easier to enforce in Ada then other languages. Ada syntax is clean, and the language itself very safe. A large number of the bugs found in modern software would not have existed if the code was writen in Ada instead of C. My third reason is probably more about taste then anything else. I jsut do not like the way OOP has been implemented in C++.

  10. hmmm..... by Xtifr · · Score: 4, Insightful

    In my many years of experience, I have to say that regression testing is not as common in proprietary software development as it should be (and frequently not as common as claimed). Furthermore, while I don't want to say that regression testing is less important for Libre Software, I will say that I think it's probably more important for proprietary software, where the programmers are writing for a paycheck, rather than for pride, and are frequently under intense deadline pressure (which in turn, frequently leads to testing/QA of all types being skimped).

    As for no release dates, anyone who doesn't recognise that as an advantage of Libre Software simply lacks any clue about the process. Sure, there are downsides, but nothing's perfect. Free, reliable, on-time, pick any two. :)

    1. Re:hmmm..... by Homology · · Score: 1
      It's also my experience as a proprietary software developer that QA varies wildy, even internally in the company. This is not just a developer issue; we need managment on our side. If the managment sees QA as just "money bloat", we've got a problem.

      As for regression/unit testing : unless the software arcitecture supporting this, it will not be done. Quite simply because it's time consuming, and changing the arcithecture might very well be too costly. However, there are Open Source tools available, like for C++ test lib. Similar tools excists for Java, based on ideas from one of The Gang of Four in Design Patterns.

    2. Re:hmmm..... by deranged+unix+nut · · Score: 2, Insightful

      I only have three years of professional software testing experience, and the company that I work for seems to be good about running regression tests every week, sometimes every day and even though there are deadline pressures they do let testing drive the release schedule.

      I have chatted with testers at other companies who have disasterous process and for which testing isn't taken seriously, so it isn't universal.

      I would venture to say that software quality is only as good as the people in charge of it's development and their commitment to quality.

    3. Re:hmmm..... by Mostly+a+lurker · · Score: 1
      Free, reliable, on-time, pick any two. :)

      Reliable, on-time, pick one IMHO :)

  11. Re:only one developer by lakeland · · Score: 2, Funny

    Or that the itches they're scratching are quite personal ;-)

  12. If your not trying to sell it... by Faith_Healer · · Score: 3, Insightful

    When I release code I realy dont care about getting any certifications and accridations linked to it. I write code to be usefull not to be noticed. You use open source at your own risk, and the beauty of it is if you dont like it you can just change it. Why would you need a quality assurance process in place for open source. If its open and its quality people will use it. If it doesnt work then people will just blow it off. Does any one else share in my oppinion?

    --
    Faith_Healer -- The antethsis to almost everything, and the worlds worst speller.
    1. Re:If your not trying to sell it... by bentcd · · Score: 1

      If you have no quality assurance, then people can't expect your code to retain its quality even if it's kick-ass today. So you risk suckering people into investing into tie-in with your code only to screw them over later when you decided it was time to "rewrite everything" and it turns out afterwards that nothing works anymore.

      --
      sigs are hazardous to your health
    2. Re:If your not trying to sell it... by Homology · · Score: 1

      Go check out OpenBSD for a second opinion.

    3. Re:If your not trying to sell it... by Anonymous Coward · · Score: 0

      If enough people adopt that attitude, and a high percentage of OSS is unusable crap because it's never been tested, then it becomes a waste of time to look for OSS solutions to your problems.

      Most people don't want software just to play with software; that's just for Linux geeks. Most people want software to solve a problem that's blocking them from some other goal. If they have to divert lots of effort from their real goal to mucking about with dreck, then the real cost of OSS becomes huge.

      Most people are also not programmers. The "ah, fix it yerself" attitude is just silly. Even among programmers, damn few people actually go study the source for every program they use. Programmers, too, have another task to fulfill, which probably isn't code-inspecting some tool they're using.

    4. Re:If your not trying to sell it... by Drakonian · · Score: 1

      Can't say I do - if it's not tested, it's broken.

      --
      Random is the New Order.
    5. Re:If your not trying to sell it... by bryane · · Score: 1

      I have to disagree. I think it is this attitude, reflected in some (most?) comments here, that will marginalize open software.

      If open source is to compete with closed source, we must approach it with an expectation that it should work for most people most of the time. The phrase "use at your own risk" is required for legal reasons; it should not be a crutch we use to explain away our own disinterest in doing the final 25% of the work - the QA.

    6. Re:If your not trying to sell it... by Anonymous Coward · · Score: 0

      25%?!
      Where I work the figure is closer to 50%, true i do work in the defense software industry, 25% seems a little low though.

  13. Release Dates ????? by Anonymous Coward · · Score: 0, Interesting

    Well, that's easy to understand. Commercial products are generally released to a schedule, whereas open source is released to a standard.

    For example, anyone with half a clue in the IT profession is aware that you NEVER NEVER NEVER take on board a x.0 release of any Microsoft product - you ALWAYS ALWAYS ALWAYS wait for the first service pack as the release date was set by marketing types who wanted profile over quality. Even if the product is buggy people get their bonuses, and people talk about the product (no such thing as bad publicity).

    Open source products are typically released by people who don't want to spend large amounts of time answering emails from users about problems, and madly fixing bugs that slipped through.

    It's like back in the old days when if a vendor released a product, andthe product had problems, they fixed the problems for free rather than just make you wait for the next release and buy it. Yes kids, that did in fact happen.

    1. Re:Release Dates ????? by Anonymous Coward · · Score: 0

      For example, anyone with half a clue in the IT profession is aware that you NEVER NEVER NEVER take on board a x.0 release of any Microsoft product

      Likewise with any Linux kernel released around Thanksgiving.

    2. Re:Release Dates ????? by Anonymous Coward · · Score: 0

      For example, anyone with half a clue in the IT profession is aware that you NEVER NEVER NEVER take on board a x.0 release of any Microsoft product

      You should NEVER NEVER NEVER take on board a 0.x open source product either, but 95% of OSS projects will never see 1.0. Even though most OSS software is now in the 2.x or 3.x stages, there is still some major 0.x software around, like sodipodi, mplayer, bluefish, epiphany and mozillabird.

    3. Re:Release Dates ????? by Anonymous Coward · · Score: 0

      "Even though most OSS software is now in the 2.x or 3.x stages, there is still some major 0.x software around, like sodipodi, mplayer, bluefish, epiphany and mozillabird."

      Well, in the case of mplayer, I think that's just because the developers are deathly afraid of releasing 1.0 in case of some vast tidal wave of bitching and abandonment in the event of doing so, even though mplayer works just fine.

      But the looping feature still has a fecking massive memory bug in it.

    4. Re:Release Dates ????? by Anonymous Coward · · Score: 1, Insightful

      For example, anyone with half a clue in the IT profession is aware that you NEVER NEVER NEVER take on board a x.0 release of any Microsoft product

      ..while those with 1/1 clue complete their internal tests and then decides whether to deploy or not?

      Sure, there are bugs in any "x.0" release, and not just from Microsoft. Still, every company has its own IT environment, and in many cases even a first release may be stable enough -- YMMV, each one has to decide for themselves.

      Also, you have to compare the risk of an "early" deployment with the potential benefits that you'll get with the upgrade, such as better performance, security, new features or whatever.

      Mattias

    5. Re:Release Dates ????? by Anonymous Coward · · Score: 0

      Many OSS developers have an eternal fear of the magic number 1.0, so you'll see 0.952.14 releases. This is simply because most OSS coders never have a final featureset, so the dont know what 1.0 is when they get there. Ah well, their loss.

  14. Free Doctoral Thesis by PaddyM · · Score: 2, Interesting

    I skimmed the article. I'm not sure what they were trying to prove. Release dates didn't jump out at me. As a software engineer, I don't see what release dates by you. Regression testing is obviously missing.

    BUT HERE's the free idea. Maybe someone (aka doctoral candidate) could prove that because Free software is used by ALL possible users in whatever way they are going to use it within, say 4 months, that it doesn't matter if there's some obscure bug, in say, the Intellivision drivers for Linux, because no one uses those. I.e., software has an astronomical amount of states, any 1 of which could be broken, but after all (5 billion people) actually use the software, all HUMANLY possible states are VERIFIED.

    1. Re:Free Doctoral Thesis by Xtifr · · Score: 3, Insightful

      Free software is not used by "ALL possible users", it's used by interested users. The size of the user-base varies greatly from project to project. And no, speaking from experience, I can assure you that not all bugs are found w/in 4 months. Subtle timing or edge-case bugs can lurk for years before leaping out to destroy someone's critical data. (And this is true with both proprietary and libre software.)

      One thing this study didn't seem to look at though, was the size of the user-base of the projects studied (of course, this is a hard thing to measure, but interesting). I think it would be useful to see what sorts of correlations (if any) there are between QA practices of a project, size of the user-base (popularity), and the overall quality of a project. Can a large user-base help make up for poor QA practices, or is a project with better QA more likely to attract users due to its higher reliability? Do users even care about quality and reliability, or do they just say they do? Interesting questions for which I don't have answers.

    2. Re:Free Doctoral Thesis by Homology · · Score: 1
      Sorry to say, but you dont have a clue what you are talking about.

      For the moderators, I've actually published work in peer reviewed journals, and I stand by my above comment. He still got no clue, and it's not flamebait.

    3. Re:Free Doctoral Thesis by dubious9 · · Score: 1

      When stating that someone doesn't know what they are talking about, usually you point out which points were wrong and say why they were wrong instead of just putting up some bullshit and a sentence that states that, of course, you know what you are talking about.

      Baseless acusations and dubious credibility will get you modded down quite quickly here. I suggest next time you back up your statement with some counterexamples or other evidence.

      --
      Why, o why must the sky fall when I've learned to fly?
    4. Re:Free Doctoral Thesis by Homology · · Score: 1
      I suggest next time you back up your statement with some counterexamples or other evidence.

      The article pointed in the main post could very well be part of a PhD thesis : It defines the scope of the problem under investigation, defines the terms used, describes the scientific methods/tools used and how it was carried out, discusses the results obtained, put the results in a context of a theory, and draw conclusions. The article may be reproduced/disproved by other researchers. Note that the article is peer reviewed and published, meaning that some anonymous experts have actually studied it.

      If you are going to apply for some PhD grant you better have a clearly and presicely formulated subject, along with how you intend to investigate it. Contrast this with :

      BUT HERE's the free idea. Maybe someone (aka doctoral candidate) could prove that because Free software is used by ALL possible users in whatever way they are going to use it within, say 4 months, that it doesn't matter if there's some obscure bug, in say, the Intellivision drivers for Linux, because no one uses those. I.e., software has an astronomical amount of states, any 1 of which could be broken, but after all (5 billion people) actually use the software, all HUMANLY possible states are VERIFIED.

      Still baseless and dobious?

    5. Re:Free Doctoral Thesis by deranged+unix+nut · · Score: 2, Insightful

      And no, speaking from experience, I can assure you that not all bugs are found w/in 4 months. Subtle timing or edge-case bugs can lurk for years before leaping out to destroy someone's critical data. (And this is true with both proprietary and libre software.)

      I'll second that! I have been responsible for, and paid to test a reasonably large administration tool for the last three years. This product was developed and tested for at least 4 years prior to my employment. Even after 4 years of someone else actively testing it, and another 3 years of active testing, I am *STILL* finding new bugs in scenarios that I hadn't previously considered.

      I have been noticing a rather disturbing trend:
      First, a new feature or large code change is introduced.
      Second, I spend at least as much time developing a test plan and doing an initial test pass as the developer spent coding the change, and frequently up to 5 times as long. I probably find 40 percent of the bugs in this pass, and when I am finished, all of the major scenarios that I can initially think about work correctly.
      Third, I spend another block of time writing automated tests while the developer fixes some of the lower priority bugs. I might find another 5 percent of the bugs in this stage.
      Fourth, I work on some other area of testing for a while, and then I hit this feature again looking for test holes and I find another 5 percent.
      Fifth, I repeat this loop of looking for test holes and discuss the features with other testers, do testcase reviews, etc. and find another 20 percent of the bugs over a period of months.
      Sixth, sometime later the developer mentions what seems to be an innocuous little bit of information, that turns out to be a critical omission in the spec and I find another 15 percent of the bugs.

      At this point, it is several months later and we have only found 85 percent of the bugs.

      Ten percent of the remaining bugs will be found by co-workers, beta testers and customers.

      The final five percent, might not be found for a number of years even with heavy testing.

      Even with years of time, every possible combination of inputs in every possible configuration and every possible usage scenario is not possible to test. For the program that I happen to test, this works out to be in the range of 10^85 unique tests. In order to test every possible input, I'd be testing until after the sun burns out and this program isn't that big.

      Fortunately, equivalence classes bring this down very significantly, and I can complete a test pass in about 40 days. The danger is in incorrently assuming that a set of values all belong to an equivalence class.

    6. Re:Free Doctoral Thesis by Anonymous Coward · · Score: 0

      I think you're on to something here. Go track down any project that has a bunch of drivers. This could be something like the Linux kernel, but it doesn't have to be. There are lots of userspace programs that support different things - digital cameras, scanners, portable MP3 players, and so on.

      Now look at what happens when something changes that breaks some of the drivers. I bet you will find that some of them are not maintained, and are eventually thrown out. What has happened is that the original developer is no longer staying current, or perhaps they got rid of the hardware too.

      In this case, the lack of complaints can sometimes be used to see who's actually depending on a piece of code. Either they are staying with an older version, or they no longer need the hardware to work.

    7. Re:Free Doctoral Thesis by Anonymous Coward · · Score: 0

      So that's what it takes to get a Ph.D?

      How boring. And to think someone would hire you because you did that research instead of learning or doing something useful.

    8. Re:Free Doctoral Thesis by dubious9 · · Score: 1

      Uhg... you're actually critiquing his post in comparision to an actual doctoral thesis? Come on now. He said it was an idea to pursue, not a fully structured and reviewed base of work. I though you were going to critique his idea and not the way in which he presented it. Christ, it's a post on freakin' Slashdot.

      His wording is awkward, and has some misconceptions, but I think it would be an interesting topic to study bugs/user or study the relative stability of software used by lots of people as compared to few, or the actual cost of bugs when compared to the whole user population.

      Maybe it's not enough content for a thesis, and certainly not the most elequent prose (i know my posts rarely are), and perhaps the idea is a little naive at first glance. But to say that he has no idea what he is talking about, just because it wasn't a formal presentation? That's why you got modded down.

      Still baseless and [sic] dobious?

      Yes, you still haven't directly contrasted any of his ideas other than that his statement didn't fit the guidelines of an actual PhD level thesis, which he probably had no intention of doing in the first place. That's why he called it an idea.

      --
      Why, o why must the sky fall when I've learned to fly?
    9. Re:Free Doctoral Thesis by Skjellifetti · · Score: 1

      That's how all PhD theses get started. Sure, by the time you are ready to apply for a grant or get your committee's approval for the topic, the idea is a little better stated, but this guy just needs training in how to get there, not a bitchslap that makes him forever afraid of trying on new ideas for size.

  15. Site is /.ed -- Abstract by Anonymous Coward · · Score: 2, Informative

    Quality assurance under the open source development model

    Luyin Zhao, Sebastian Elbaum.

    The open source development model has defied traditional software development practices by generating widely accepted
    products (e.g., Linux, Apache, Perl) while following unconventional principles such as the distribution of free source code and
    massive user participation. Those achievements have initiated and supported many declarations about the potential ofthe open
    source model to accelerate the development of reliable software. However, the pronouncements in favor or against this model have
    been usually argumentative, lacking of empirical evidence to support either position. Our work uses a survey to overcome those
    limitations. The study explores how software quality assurance is performed under the open source model, how it differs from more
    traditional software development models, and whether some of those differences could translate into practical advantages given the
    right circumstances. The findings indicate that open source has certainly introduced a new dimension in large-scale distributed
    software development. However, we also discovered that the potential of open source might not be exploitable under all scenarios.
    Furthermore, we found that many of the open source quality assurance activities are still evolving.

    Copyright 2002 Elsevier Science Inc. All rights reserved.

    Keywords: Software development models; Open source; Quality assurance; Survey

  16. No Deadlines does not mean No Pressure by Commykilla · · Score: 5, Informative

    All the comments so far have been arguing that "no set release date means more QA". From my experience with open source software, this is complete crap. In many cases, commercially used open source software is developed by organizations such as Red Hat and IBM who, we hope, have significant QA teams and resources.

    But, for the projects contributed by individuals, with a single or small group of developers -- who wants to do testing? Everybody wants to be a developer, and the more new features, the more bang, the more people will be drawn to the program, so more often than not new features and frequent releases rather than testing are the focus. Most of the time, you can guess from the sheer frequency of builds with new features that QA is not being taken into account. This system works great for projects that enthusiasts use -- individuals request new features, play with the product, and in return, report bugs. This does not work for companies of any size who expect software to work properly right out of the box, where the "feedback loop" of reporting bugs is a last resort.

    Open source programmers and commercial programmers alike are under pressure to release early and release often. And in both the open source world and the commercial world, there are groups that excel at QA and groups that don't take QA seriously enough.

    --
    Communism was just a red herring.
    1. Re:No Deadlines does not mean No Pressure by Malcontent · · Score: 1

      "who wants to do testing? Everybody wants to be a developer, and the more new features, the more bang, the more people will be drawn to the program, so more often than not new features and frequent releases rather than testing are the focus."

      There is a solution to this problem.

      1) Stop using C. Use object oriented languages and languages that offer garbage collection. You will immediately reduce bugs by 80%

      2) Make code more literate. Use pre and post conditions, demand that all contributors use lots of asserts. Make liberal use of interfaces.

      3) Designate a few people as architects of the project. These people should do nothing but write and design interfaces and maybe write class stubs with pre and post conditions and have the rest of the team complete the classes.

      4) Unit testing, unit testing, unit testing.

      The idea is to minimize the need for QA as much as possible.

      --

      War is necrophilia.

    2. Re:No Deadlines does not mean No Pressure by Nevyn · · Score: 1
      1) Stop using C. Use object oriented languages and languages that offer garbage collection. You will immediately reduce bugs by 80%

      That number looks like you pulled it from somewhere the Sun don't shine. I guess it's possible that you remove 80% of the simple bugs in your code, but even then I'd find that number hard to swallow. And if you introduct simple things like a string API I'm not going to believe a number anywhere near 80%.

      2) Make code more literate. Use pre and post conditions, demand that all contributors use lots of asserts. Make liberal use of interfaces

      "literate" code is often the wrong approach, when I want to say things well in English I don't write the same thing in Japanese next to it ... I just spend time writing it well in English.

      assert()'s are nice as are the assert()s called pre/post conditions. Interfaces in the Java sense I doubt buy you much from a lower bug count POV.

      3) Designate a few people as architects of the project. These people should do nothing but write and design interfaces and maybe write class stubs with pre and post conditions and have the rest of the team complete the classes.

      Even if you assume that people can easily take these roles (Ie. someone not doing any implementation knows what the interfaces should be ... err yeh right, not). It's just not going to happen in the OpenSource world IMO, implementing someone's very good spec. isn't much fun ... implementing one less than that gets much less so.

      4) Unit testing, unit testing, unit testing.

      Duh, testing helps reduce bugs .. I'm shocked. A bunch of projects do this now, some have a large "make check" pass ... and some don't, sure. But for instance I know a bunch of the samba people have private win32 labs to do regression testing, I'd be supprised if that wasn't similar for the apache/etc. people.

      --
      ustr: Managed string API with ave. 44% overhead over strdup(), for 0-20B
    3. Re:No Deadlines does not mean No Pressure by mcrbids · · Score: 1

      This system works great for projects that enthusiasts use -- individuals request new features, play with the product, and in return, report bugs. This does not work for companies of any size who expect software to work properly right out of the box, where the "feedback loop" of reporting bugs is a last resort.

      Most mature OSS projects have a "stable" tree, and a "development" tree. The company that wants something that "works right out of the box" uses the "stable" tree, the guy who wants new feature X uses the "development" tree.

      Pretty simple, no?

      Unless, of course, you're surfing SourceForge for a project with a number below 0.1.0....

      Some of my open-source projects are very heavily tested in high-capacity commercial environments - and are given version numbers > 1.0.

      Others never make it past 0.1 - which is what I'd call "it kinda works and demonstrates the point".

      But let me bring the point to a head:

      Can you name a single instance of software used by a company YOU have been involved in used that had bugs that caused problems?

      Tell us all about it... I'd love to hear!

      --
      I have no problem with your religion until you decide it's reason to deprive others of the truth.
    4. Re:No Deadlines does not mean No Pressure by Malcontent · · Score: 2, Interesting

      " That number looks like you pulled it from somewhere the Sun don't shine. "

      It's a guess. An approximation. I did not do any reasearch and arrive at that answer. But a simple look at any bugtrack should back me up. Most errors are due to memory leakage, buffer overflows and other artifacts of C programming.

      " "literate" code is often the wrong approach, when I want to say things well in English I don't write the same thing in Japanese next to it ... I just spend time writing it well in English."

      Literate programming means writing well in code. It means much more then comments and I urge you to some research into it.

      "Interfaces in the Java sense I doubt buy you much from a lower bug count POV."

      Interfaces force a strong contract. They make it harder to break the program.

      "It's just not going to happen in the OpenSource world IMO, implementing someone's very good spec. isn't much fun ... implementing one less than that gets much less so."

      In that case then open source programs will continue to suffer from too many bugs.

      " Duh, testing helps reduce bugs .. I'm shocked."

      Unit testing is different from regression testing and pre-release QA. By insisting on unit testing you will deliver cleaner code to the QA team.

      --

      War is necrophilia.

    5. Re:No Deadlines does not mean No Pressure by Anonymous Coward · · Score: 0

      Even if you assume that people can easily take these roles (Ie. someone not doing any implementation knows what the interfaces should be ... err yeh right, not).

      If you document your API's then it is quite easy for someone not involved in the implementation of those API's to review them. I'm not sure about the original suggestion of having "architects" though, that sounds like a sure fire way to introduce a disconnect between what you need, and what you actually get.

      The project I am working on is currently going through the process of defining and documenting our final API's. We will rubber stamp the final design as "1.0" and then review all of the current code against it, reworking where needed until the design & the implementation match. With a defined, stable API we can write automated test cases and regression test it quickly in every build.

    6. Re:No Deadlines does not mean No Pressure by scons · · Score: 1

      In many cases, commercially used open source software is developed by organizations such as Red Hat and IBM who, we hope, have significant QA teams and resources.

      In fact, I'd argue that in most cases, the QA is the primary added value of a commercially-backed open source offering.

      Monta Vista, for example, test their embedded Linux system on upwards of 80 (last I heard) combinations of compilation platform + cross-compiler + execution environment. Yes, they contribute a great deal of code and give back a lot to the Linux community. But as someone who has to back the decision to go with Monta Vista for our product, the QA is more valuble to me. If they stopped hacking the kernel themselves and kept their test process, the releases would come more slowly but I could still sleep at night using their product. But if they cut the QA and kept just the coders, I'd have to seriously question the viability of basing our product on them in the future.

      Similar argument for the desk top: the real value of a commercial distro to me is the time I save not having to test the individual packages and get them to interoperate by hand.

    7. Re:No Deadlines does not mean No Pressure by Nevyn · · Score: 1
      But a simple look at any bugtrack should back me up. Most errors are due to memory leakage, buffer overflows and other artifacts of C programming.

      Bugtrack will almost certainly tell you that buffer overflows are a large source of security bugs but this doesn't back you up at all, as there are a lot of good C string APIs and using one that stops buffer overflows is trivial.

      Literate programming means writing well in code. It means much more then comments and I urge you to some research into it.

      I'm well aware of what literate programing is, and it is little more than writing everything twice. It makes the actual code very hard to read IMO, due to copious amounts of "coments".

      While you could argue that TeX is "perfect", the debian network interface code is much less useful than the Red Hat version and changing it was much harder.

      In that case then open source programs will continue to suffer from too many bugs.

      In your opinion, in my opinion having the people who implement the code design the code makes for a much better result.

      --
      ustr: Managed string API with ave. 44% overhead over strdup(), for 0-20B
    8. Re:No Deadlines does not mean No Pressure by Malcontent · · Score: 1

      "are a lot of good C string APIs and using one that stops buffer overflows is trivial."

      And yet almost nobody uses them. Why? Maybe because they have a steep learning curve, maybe it's because they have performance penalties associated with them. Even if you were to use a string library you'd still have to roll your own garbage collection and overrun protection. Why bother? There are many languages which do all of that for you so that you can concentrate on other things. It makes no sense to keep using C and piling on other libraries when you can simply use Java, cyclone, eiffel, python or anything else for that matter.

      " In your opinion, in my opinion having the people who implement the code design the code makes for a much better result."

      You are entitled to your opinion of course. I disagree. It's virtually impossible for one person to do everything. People have to learn to work in teams if you want to accomplish big goals. Sometimes that means doing crud work.

      --

      War is necrophilia.

  17. cvs update by korgull · · Score: 1

    and I have my new release.

    When does any commercial project match that ?

    I hope cvs won't ask me for a credit card number in the future....

  18. release dates by bataras · · Score: 1

    >>such as regression testing and setting release dates

    Scheduling (Release dates) have nothing to do with QA. A schedule is a separate leg of the stool upon which a project sits; quality, scope and cost being the others.

    1. Re:release dates by Anonymous Coward · · Score: 0
      Scheduling (Release dates) have nothing to do with QA. A schedule is a separate leg of the stool upon which a project sits; quality, scope and cost being the others.
      ...Unless you work in a Dilbertian office. Then schedules and QA (or lack thereof) go together.
      I work for a software company where the QA people play ping-pong up to about two weeks before the software HAS to go gold because the coders are (still) up all night writing code because the requirements docs were a month late... and so on and so forth.

      THAT is how stupid bugs that should have been caught in the first round of QA get missed... Nobody has time to document the annoyances when your boss reduces the QA rounds from three to one. All of the sudden, our customers are all screaming that our new major release is crapola, and I'm doing 60-hour weeks to keep up with the new bugs as they flow in. Of course, I'm "Just a QA Guy" so I can't actually fix the dumb bugs I see.

      How many hours did you work today (Sunday)? I did 8.

      Yes, my resume is posted. My schedule makes interviewing without arousing suspicion difficult, but I'm getting creative.
  19. Don't ship it until it works by tjstork · · Score: 1

    Release dates for open source projects are more honest. They say beta or alpha when they really mean beta or alpha, and they say release when it actually works.

    Most proprietary software fails for reasons that manufacturing failed in the 1980s. Top down, hieararchical processes simply do not work. You need to have cross functional teams, have a quality culture that allows developers to take risks and the initiative, and interact directly with requirements. Most of today's processes simply don't do that, preferring instead to build software in the same way that GM used to build cars. We get buggy bloated software that is unreliable for the same reason that we used to get buggy bloated cars that are unreliable, because the process that builds them stink!

    --
    This is my sig.
    1. Re:Don't ship it until it works by stwrtpj · · Score: 1
      Release dates for open source projects are more honest. They say beta or alpha when they really mean beta or alpha, and they say release when it actually works.

      For commercial projects, its interesting to see what happens when you really REALLY make the projects adhere to schedule or don't release. I am now in my second organization where the group I work in has cracked down hard on release schedules. The bottom line was: you release on time, and according to established process, or you don't release. In other words, there are limited windows in which you're allowed to release and if you can't meet the window, you're out and you can't release until the next window.

      Know what happens? The first set of release windows, half the projects drop out because they can't meet the window. Next time around, maybe about a quarter drop out. The others learned how to set more realistic targets and better assess the time and effort it takes to do the features they commit to.

      OSS takes the other approach. They leave the deadline open ended and concentrate instead on what they really want to get done with the release regardless of how long it takes to get everything to work.

      It's hard to say which is better than the other. Both has pros and cons. The former method above means more reliable release schedules, which helps IT plan their time for upgrades and potential downtimes, but you can lose functionality committed by overenthusiastic design and/or marketing. The latter means you get everything you want but have to wait longer for it.

      --
      Karma: Frotzed (mostly due to the Frobozz Magic Karma Company)
  20. Add this one too by Anonymous Coward · · Score: 0

    4a. Pretend to be a supporter of OSS

    You can always play it the Linus & co way, and get suckers to write code for you. Then you get all the credits, become a diva, and what you only have to give back to the community is fuck all. Is very simple, and quite frankly the potential is there.

  21. Forgot to add notes about QA by einhverfr · · Score: 1

    The way I handle QA usually is to write, test and release the code myself and then request feedback from the user community. QA is not just about bug testing, but it is also about making sure that the program actually enables people to get their work done. So usually, I release beta then rc then final but request feedback at every point regarding general usability.

    Also maintaining a roadmap is also essential, but it should be flexible based on user feedback.

    Ideally one of the strengths of OSS is that it provides for more contact between developers and users. This changes the dynamics of QA and hopefully will result in better, more productive software.

    --

    LedgerSMB: Open source Accounting/ERP
  22. Flexible release dates are a feature by pHaze · · Score: 1, Interesting

    Look at a company like MySQL AB vs. Microsoft. MySQL 4's release dates slipped and slipped, and when questioned, Monty responded that the software will be ready when it's ready. A company like Microsoft is driven by the marketing team. They set a launch date, and bugs or no bugs, the software will be launched with maximum fanfare on that date.

    I think it's obvious which practice delivers the most stable software.

    1. Re:Flexible release dates are a feature by Anonymous Coward · · Score: 0

      I think it's obvious which practice delivers the most stable software.

      Agreed. Unfortunately, it's also obvious which practice (usually) grabs most of the market.

  23. OSS QA will always be two-faced. by Dthoma · · Score: 4, Insightful

    The open source development model allows tremendous flexibility, allowing members of a development team to be dropped or added at a moment's notice. With the source readily available, one can become familiar with a project's code before applying to be given access to the CVS or equivalent repository. Gradual accretion may produce code in a style not unlike that of James A. A. Joyce's Ulysses manuscripts, but, like James A. A. Joyce, all of the core developers can easily jump from point to point in the code and comprehend the necessary sections and the C/PHP/Python/Java equivalent of their allusions.

    Unfortunately, as a result of this decentralised development system, commercial QA, support and RHQ are not as readily available. I'm a middle manager and my company has had a double-sided experience with the MySQL AB organization. They produce a fine product which is perfect for a medium sized corporation such as the one I work for (which shall remain nameless). MySQL worked very well for us, but unfortunately at one point we started receiving segmentation faults when there were more than 30 connections or if a query was greater than 2,048 characters in length. We have reported these bugs to MySQL AB but they have not yet fixed them in their latest gamma/production release. However, they have been very polite and are always willing to cooperate with us; even if small portions of the code are not yet fixable and have escaped the relatively poor QA of the EOD, their TOS have always been reasonable and our MD has always been able to CWT regarding the slight problems and BS our way around them.

    --

    Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".

    1. Re:OSS QA will always be two-faced. by Homology · · Score: 1
      Why not try out PostgreSQL? Perhaps you have some conditions not best met by MySQL.

      For our product (on Windows, alas) we use Mimer SQL that is available on several platforms. Granted, they are closed source, but runs on several platforms, and a trial version (up to 10 concurrent connections) are freely downloadable.

    2. Re:OSS QA will always be two-faced. by Dthoma · · Score: 1

      Actually, I'm just trolling.

      --

      Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".

    3. Re:OSS QA will always be two-faced. by Homology · · Score: 1
      Actually, I'm just trolling.

      Actually, you are less trolling than you might think.

    4. Re:OSS QA will always be two-faced. by Dthoma · · Score: 1

      Maybe I should've used more abbreviations in the last few sentences. I would've thought that using the abbreviation "BS" in that context would've given me away, but no!

      --

      Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".

    5. Re:OSS QA will always be two-faced. by Homology · · Score: 1
      Maybe I should've used more abbreviations in the last few sentences. I would've thought that using the abbreviation "BS" in that context would've given me away, but no!

      MySQL on OpenBSD 3.3_STABLE has some issues (related to threads) that are fixed in CURRENT. The problem was frequent crashing of MySQL.

      Sometimes trolls are right.

    6. Re:OSS QA will always be two-faced. by Dthoma · · Score: 1

      "Sometimes trolls are right."

      I'd rather be King Lear as opposed to his fool.

      Hmmph. Maybe I should just post messages calling the MySQL developers 'fagosexuals' or something similar.

      --

      Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".

    7. Re:OSS QA will always be two-faced. by Homology · · Score: 1
      I do understand your disappointment at discovering that your trolling was not trolling at all, but quite a reasonable post in light of MySQL crash problems on OpenBSD 3.3_STABLE ;-)

      Hmmph. Maybe I should just post messages calling the MySQL developers 'fagosexuals' or something similar.

      I hold posts of that type in total contempt, along with GNAA posts. Trolls just to annoy are just that, very briefly annoying, and then quickly forgotten. Good trolls with a provokative (and informed) kernel of truth may trigger quite many interesting and useful posts.

      I'd rather be King Lear as opposed to his fool.

      You might want to reconsider :

      (About the fool) He is the most intelligent and insightful character in the play and provides simple and clear reasoning for a one sighted King.
    8. Re:OSS QA will always be two-faced. by Dthoma · · Score: 1
      "I do understand your disappointment at discovering that your trolling was not trolling at all, but quite a reasonable post in light of MySQL crash problems on OpenBSD 3.3_STABLE ;-)"

      I suppose I'll have to become even more subtly incendiary and make some more outlandish statements. Maybe make some vague references to a controversial and topical subject.


      "You might want to reconsider :


      (About the fool) He is the most intelligent and insightful [emphasis mine] character in the play and provides simple and clear reasoning for a one sighted King."



      +5, Insightful is the holy grail of all trolls, and I suppose I did achieve it with the minimum of effort. Though ideally I would provide a labyrinth of jumbled and inflammatory concepts as opposed to "simple and clear reasoning".

      I guess I'll just sleep on it and see if I can come up with a more effective yet equally pernicious troll next time. Oh, well. Good night.
      --

      Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".

    9. Re:OSS QA will always be two-faced. by Homology · · Score: 1

      He, he, goodnight.

    10. Re:OSS QA will always be two-faced. by Anonymous Coward · · Score: 0

      a thoughtful thread with hardly any speling errors on slashdot... weird. good night to you two.

  24. OSS QA will always be arduous to implement. by Dthoma · · Score: 1

    The open source development model gives tremendous flexibility and leeway for various methodologies such as XP or the more traditional but cumbersome waterfall method, allowing members of a development team to be dropped or added at a moment's notice. With the source readily available, one can become familiar with a project's code before applying to be given access to the CVS or equivalent repository. Gradual accretion may produce code in a style not unlike that of James A. A. Joyce's Ulysses manuscripts, but, like James A. A. Joyce, all of the core developers can easily jump from point to point in the code and comprehend the necessary sections and the C/PHP/Python/Java equivalent of their programmative allusions.

    Unfortunately, as a result of this decentralised development system and the reduced usage of traditional ways of programming large-scale projects like WM and RDP due to the geographic dispersion of developers, commercial QA, support and RHQ are not as readily available. I'm a middle manager and my company has had a double-sided experience with the MySQL AB organization. They produce a fine product which is perfect for a medium sized corporation such as the one I work for (which shall remain nameless). MySQL worked very well for us, but unfortunately at one point we started receiving segmentation faults and other similar insidious faults (such as KPs and the like) when there were more than 30 connections to multiple database servers or if a query was greater than 2,048 characters in length. We appreciate that these difficulties can be hard to track down and correct and so our engineers have reported these bugs to MySQL AB but they have not yet fixed them in their latest gamma/production release. However, they have been very polite and are always willing to cooperate with us; even if small portions of the code are not yet fixable and have escaped the relatively poor QA of the EOD, their TOS have always been reasonable and our MD has always been able to CWT regarding the slight problems and make our way around them.

    --

    Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".

  25. Say what? by curtlewis · · Score: 3, Informative

    Since when does QA set the release date in open OR closed software? Certainly not with any company I've worked for.

    The role of QA is, unfortunately for the state of software, rapidly diminishing. Open Source has only rarely done QA in a professional manner due to it's very nature. And in closed source in today's economy something has to give between time, money and quality. We all know it's not going to be money and time to market is viewed as the all-important element, leaving one thing to suffer.

    I have literally worked for a startup where it was essentially "It boots? SHIP IT NOW!" That's how sad it is with respect to professional development these days.

    These days the only people that care about Quality are the customer and QA.

  26. Not Open Source at all by kenneth_martens · · Score: 2, Insightful

    I'm tired of all this talk about open source development vs. closed source development. That's not the issue here.

    It doesn't matter so much whether the source is open or closed as it does who is in charge of the project. Any company could use standard software development methods to produce open source software. Similarly, any company could hire developers all over the world, and have them work together on a project without ever having met.

    It's not an open vs. closed thing, and it has little to do with licensing. It just happens that most companies use standard development techniques and don't release as open source.

  27. Re:It its quality then explain this. by SamBC · · Score: 1
    This is true, not troll.

    If it is true, then you haven't done your homework very well. File dialog is purely aesthetic, and there are many in use. PCI modem support is hard to reverse engineer for software modems - PCI true hardware modems will Just Work. As with windows there is a choice of screensavers... need I go on?

    That said, you do mention a couple of issues which are valid for the novice user and limit the uptake of Open Source environments on the consumer desktop.
  28. Sorry for the repost. by Dthoma · · Score: 1

    I unintentionally duplicated this comment because my browser was taking too long to post the comment in the first place and I stop/reloaded.

    --

    Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".

  29. Distributed algorithm benefits Freenet again by andyo · · Score: 1

    What I find interesting about this algorithm is that it is applied individually by each node; there seems to be no need for nodes to share data over some complicated protocol as in many distributed systems. Yet (I think we can believe Clarke) this change improves response time through the system as a whole. It's a validation of the basic Freenet model of systems acting alone but providing a service greater than the sum of its parts.

    1. Re:Distributed algorithm benefits Freenet again by andyo · · Score: 1

      Sorry, I lost track of where I was. This post was meant to go under a different story.

  30. testing by redacedude · · Score: 1

    There are excellent tools for development and version control (gcc/make/kdevelop/cvs). What about testing? My first thoughts were shell and/or "expect". What do others use? (I know it's a broad question... but was curious what others use.)

    1. Re:testing by Anonymous Coward · · Score: 0

      A good place to get your feet wet is with Sun's ADL.
      ADL is an awesome framework for unit and regression testing. It is free, too.

  31. No surprise to QA folks by Anonymous Coward · · Score: 5, Insightful
    QA is a weak point of OSS. Over the years I've occasionally tested OSS to check out what seemed to be inflated claims of quality. Everything I've tested so far has more or less failed to pass muster. The biggest failures are in complexity metrics such as the Halstead or McCabe tests. I don't mean marginal failures or borderline cases. I'm talking huge blowouts. Nothing seems to be immune, from nasm to the OpenBSD ftpd. And fixing the problem is usually so simple--decompose a complex function or procedure into several simpler ones.

    Other areas of problems are attributable to slovenly or "don't give a damn" attitudes--unused variables, unreachable code, "magic number" constants, and so on. Ignoring values returned by a function are very common. Maybe it is acceptable with a library function, but why return a value if you aren't going to use it? It's better to make the function into a procedure by returning void. On a more theoretical level, the use of weak typing even when the language allows for tighter specification of variables. Strong typing is designed to prevent such oddities and inadvertently multiplying a color by date.

    However, in the end it all comes back to complexity. And that is where the biggest improvement in OSS quality can be obtained.

    1. Re:No surprise to QA folks by Anonymous Coward · · Score: 0

      Where can I get tools to measure these complexity metrics for C code?

    2. Re:No surprise to QA folks by Anonymous Coward · · Score: 0
      I don't have a lot of familiarity with the freeware tools, and I've primarily used my company's in-house stuff. Before I point you to a resource for freeware tools, let me provide some explanation that will help you.

      Perhaps the most useful measure of complexity are the "cyclomatic complexity" tests which primarily measures decision points in a function. Before you use automated tools, you should do a google search and learn how to do it with pencil and paper so that you have an idea of what is being measured. If you can count, you'll have no problem. It's easy!

      The automated tools are essentially specialized parsers. Now, the problem with the freeware versions is that they were not designed for use with GNU extensions to the C language. What happens is that they will choke on GCC header files. To get around this, you have to use the C preprocessor to define away all of the troublesome GNU extensions. This is best done with a wrapper script for whatever tool you chose to use. You will have to pass null definitions to the preprocessor to do this, like

      gcc -E -D__attribute__()= -D__gnu_foo=

      There are a lot of different aspects of complexity which can be measured, but the cyclomatic metric is perhaps the most useful because it directly relates to human psychology and the ability of the human mind to handle a lot of details. The McCabe and Halstead metrics are best for these measurements.

      A McCabe complexity number of 10 indicates a function at the edge of acceptable complexity. When you find a function with a McCabe number above 20 you are finding a function which almost surely has hidden bugs. When you find a function with a McCabe number above 30 or so, it is considered unmaintainable. In OSS projects I've seen some functions with McCabe numbers of 80, 90, 100 and higher. When you see functions like this, sirens, alarms, and red flashing lights should go off. It is a certainly that no one really understands a procedure of that complexity level. And I mean no one including the author of the function himself.

      This brings up another point. If you are looking for a free software project to work on, first do a complexity analysis. If it has procedures with high complexity numbers of 50 or higher, steer clear of that project because you will be wasting your time. It will take a lot of study to come up to speed on that kind of software. In fact you may never get up to speed on such projects because they are internally incomprehensible. These are the kinds of projects which would benefit most from a rewrite from scratch.

      There are other measures of complexity such as lines of code, ratios of comments to lines of code, and so on. These measures should not be your first line of attack in fighting complexity. They are useful measures, but only after you have cyclomatic complexity under control.

      Now for pointers to the tools. You can find some listed in the Usenet comp.compilers catalog of compilers which is published regularly in that news group. Look for words like "McCabe" or "Halstead" or "cyclomatic". A fellow named Chris Lott has maintained an online resource of software metrics tools; see C.M. Lott's Metrics Depository Ideally, GCC should include McCabe and Halstead metrics as a built-in. But I get a feeling that a lot of the GNU cowboys think that they are too rough and tough for sissy stuff like software metrics. Heck, it took them years to accept ANSI C and function prototypes. I can still hear the bitching.

      SPECIAL MESSAGE TO CRACKERS: Looking for loopholes in software to exploit? Complexity analysis is a wonderful way to discover software ripe for exploitation. Find software with very high complexity numbers; choose a critical function with high complexity and decompose it (this will be brain torture).

      As you decompose the function, if it can be decomposed, into a collection of simpler ones, you will discover how the software

  32. 8. Profit! by TeknoHog · · Score: 1

    How could you miss such an obvious stage?

    --
    Escher was the first MC and Giger invented the HR department.
  33. hm more intertesting stuff by linuxislandsucks · · Score: 1

    why is is that IBM open source proejcts have more regression testing than SUn's own?

    Inquiring minds want to know :)

    --
    Don't Tread on OpenSource
  34. Why comercial software has release dates by bluGill · · Score: 1

    Comercial software has relase dates for one reason: money. If they don't release it at the right time they don't make money. Release too soon and you get a reputation for bugs. (beta programs help relase earlier, but you still can't do them too soon). Release too late and someone else will beat you in.

    However it is more complex. I've worked with projects targeted at telecoms. Back then they had a lab, and nothing was put into production until they bought a bunch of them, and it was in the lab for 3 months while THEY tested it. However you couldn't get something into the lab anytime you were ready. They opened the door for a short time every 3 months. Miss the day where they bring something in, and you wait 6 months before they will make a major order. Release on that day, and they would normally buy in 3 months. Once you were in the lab you could provide bug fixes under the claim "We never saw that in our testing..." so you had to relase a product on their schedual no matter what. If you didn't, someone else did, and 3 months latter they get the order, and unless they screw up baddly you may never even get into the lab.

    Open source doesn't care about your scedual, it cares about good. So we have release when it is ready. Thats why freeBSD announced a schedual ship of ONE year, and once the extra year was up released a 5.0 version and called beta quality and recomended you not use it for anytime important. Of course smaller projects are not so good, but then they don't have as many users who care either.

  35. Amen! by wowbagger · · Score: 3, Interesting

    I like to make this point about ISO-9000: if they are not now ISO-9000 certified, McDonalds could be in about five minutes - they have a proceedure for everything. Does this mean that McD's good is "good quality"?

    IF you have a proceedure, AND IF that proceedure included required analysis of failures, AND IF that proceedure requires improvements to the proceedures to correct the failures, THEN you MIGHT begin to approach quality over time.

    However, far too many company's ISO proceedures fail to require analysis and actively discourage improvement to the proceedures ("You want to change the proceedure! OK, here's a ton of paperwork to fill out, and you will have to get the signatures of fourteen people who would rather not sign anything other than their own paychecks. Have Fun!").

    ISO is really just a big peer-pressure MLM scam the way it is run now.

    And yes, the company I work for is ISO 9001 qualified.

  36. Neil Peart is the guy from Rush you ass goblin by Anonymous Coward · · Score: 0

    Before you get your fucking balls in a tangle know this: Neil Peart is the fucking drummer from Rush so close your fucking penis moistener ok fuckio.

  37. Tools are not always the answer by Anonymous Coward · · Score: 0

    The tool you use should depend on what system you are testing. If it's windows software then 'expect' is probably not quite much help! Neither would it help if your programming in KDE ( or Gnome before anyone has a go.)

    The main problem with any tool, is that the results of a test need to be known precisely for it to work. This may sound a strange thing to say but consider the following.

    If you are developing a system that uses a well designed protocol, eg errrmmmm lets say http ( no comments about how well it's design, just go with the flow ). Then you can be quite sure that if you stuff x down one side of the protocol then y will be returned. In this case, you should be able to automate the testing from the word go.

    but ....

    If your developing a user interface for Windo... I mean KDE, then its for more difficult to determine what the exact result of a test will be. After all, just how wide will the developer make a text box! Most tools will flag an error if a componant is only slightly different size. There is also the problem that there are bugs which usualy only happen through silly use, eg double clicking rather than single clicking. And thats not even addressing the times when a screen design just doesn't work well for a user.

    The point I'm making is that there is no single solution. And even if you have an automated tool, then it may only be of use once the product is stable and in a regression test phase.

    8 years of testing ( and no, I don't secretly want to be a developer ) has taught me that the best tool, is someone sitting there using the system, and doing what users do - i.e. stupid things.

  38. GNOME by asobala · · Score: 3, Informative

    http://mail.gnome.org/archives/gnome-hackers/200 2-June/msg00041.html is the historically significant mail for GNOME in the post-2.0 era.

    We're sticking to 6-month releases (in fact, 2.2 hit the streets after 5 months since the first bit of time was bugfixing 2.0). The advantages to having time-based releases are if the features aren't ready, they wait while the bugs from the finished stuff are removed and the new features released. This is instead of adding more features, making the software (presumably) buggier and buggier, which would make the release QA much harder and more painful.

    6 month releases means that a feature that misses a given release will not have long to wait before it can be in the main development branch again.

    So far, it's working.

    Andrew Sobala, GNOME QA dude, variable hacker, and release team member

  39. OSS & developpment rules by chrysalis · · Score: 1

    " there were a few areas pointed out where the open source community does not do so well, such as regression testing and setting release dates."

    It really depends. Setting release dates is not mandatory for an opensource project. Those projects are not made by a company for a customer requiring a specific deadline. OSS projects are mostly made during spare time. So the most reasonnable release dates are "when the code will be completed".

    Regression tests are another story, but it really depends on projects and how they are managed.

    For instance OpenBSD has very strict release dates. Every 6 months. And this schedule has always been respected.

    OpenBSD also always introduces regression tests for new commands or new features implemented in existing commands. Have a look at the /usr/src/regress/ directory. The tests are numerous and extensive.

    --
    {{.sig}}
  40. process and repeatibility is everything by Kunta+Kinte · · Score: 1
    ...well it's a lot, at least.

    ISO is all about process and repeatibility. It simply validates that you have a well-defined process. You can have a wonderful process, with everything down to the number of times the developers go to the bathroom and for how long documented and validated, and still have a product that's a piece of crap.

    Process is the heart of engineering. There is at least one thing that links civil engineers to electrical engineers to software engineers, it's process. In science to, there's that little matter of reproducibility of results. Having a well defined process is the only way to get there.

    I'd argue that if you don't have process, you're hacking. Which is not always a bad thing, but not many people would bet the company, their livelihood on hacking out code.

    The company has to be able to adapt to losing a key programmer or manager. Maybe your company has a few guys who really know what they're doing. What guarauntee do you have that the project can survice they living.

    --
    Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
    1. Re:process and repeatibility is everything by Anonymous Coward · · Score: 0

      Programming isn't engineering and it isn't manufacturing. Pretending it is and creating voluminous documentation that turns into monuments rarely bearing any resemblance to the final product is a monumental waste of time. It gives managers a way to "track" something they can neither understand nor control.

      Yes, design is important but ISO stifles good design rather than fosters it.

    2. Re:process and repeatibility is everything by ClosedSource · · Score: 1

      So what's the standard electrical engineer's process? I suspect it varies a lot more then you might think.

      It's interesting that despite the fact that software engineering is always compared unfavorably with Electrical and Civil engineering, there has been far more work done on formal processes in software engineering than in the other branches combined.

      I suspect the reason is that SW engineering is a much broader discipline in a practical sense than the others. In a sense, the other disciplines are subsets of SW Engineering since the laws of those disciplines are often incorporated into code. SWE has displaced EE as the primary generic problem solving space (forgive the lingo).

  41. release dates can be impt. to customer by Anonymous Coward · · Score: 0

    While I would always prefer a quality product released late to a buggy one released on time, some customers do depend on reliable release dates. If a customer has a release date for a big package like Oracle, or Solaris, or whatever, they can schedule the appropriate upgrades or testing periods, or whatever their IT policy dictates.

  42. OK, I'll go along with that... by inode_buddha · · Score: 1

    WARNING: Linux-specific stuff ahead

    Currently, AA and AC are cool for regression testing. Its nothing like what the "Big Boys" (read: well-funded corporations) do, but its a far cry from the pre-2.x days.

    We could all help out with that, via well-written bug-reports, questions, etc. Just make sure its an actual bug and not a vendor quirk. Make sure those reports go to the right people, too - use the LKML as a last resort. (Speaking from experience).

    As far as release management goes, it's *still* up to Linus. Not that, I've ever had a problem with that, it's *his* project, after all. If I'm feeling lazy, I'll just wait till the big vendors pick it up.

    --
    C|N>K
  43. Debian and the three legged stool. by qtp · · Score: 1

    A schedule is a separate leg of the stool upon which a project sits; quality, scope and cost

    Knowing that a proper stool only requires three legs, the Debian project decided to throw the schedule in the bin.

    --
    Read, L
  44. And the bass player from primux by Anonymous Coward · · Score: 0

    If you are going to make the ultimate band the bass player better be that fucker from Primus or the band is not the ultimate.

    The singer? Man, the dude from led zepellin. He can actually sing n shit not like the scrubs from these 90s shitstain bands.

  45. Release dates for Internet IT software maybe! by ratfynk · · Score: 1
    There is also the problem of outdating firmware code that make customers buy updates! There are a number of inventory data base MS software companies that use a five year dev cycle to ensure that customers will be forced to upgrade. There is usually logic bomb like life cycles in the firmware to client software. One of the most common tricks is inventory scanning equipement that will only work with an updated software release. This happens to companies like wharehousing, and shipping firms to cite one example.

    When the company goes to buy repacement hardware it is no longer available for the old software. Because the hardware companies are in cahoots with the software companies, forced upgrades become possible, and now have become standard business practice in computerised warehousing software.

    This was why IBM was so great, they really did try to take in the needs of the customer first and made hardware manufactures ensure backward compatibility. With the introduction of MS style get rich quick philosophy to hardware, firmware, and software the business customer has become a thing to be milked not a valued resource.

    --
    OH THE SHAME I fell off the wagon and use sigs again!
  46. Formal QA is a bit much, too by msobkow · · Score: 1

    I do as much formal QA as I'm required to by client sites. Sometimes that means unit and regression test frameworks, sometimes it just means making it "good enough" for daily use.

    Regardless of the reasons for the formal QA, you won't find too many people who actually enjoy doing it. It's a necessary part of doing a good job, like documentation. But as with anything that requires tedious, painstaking detail, it's hardly something I want to do with my free time.

    And there is the crux of it: my free time. I see no reason someone can't take a branch of a project and apply formal QA processes if they need or want to, but it's another thing to ask people to stop having fun programming, and treat their hobby as a job. It's not. It's relaxation. It's entertainment. It's a thought provoking challeng. It is not going through endless checklists of test cases to see if you broke something.

    --
    I do not fail; I succeed at finding out what does not work.
  47. Microsoft does (yes, actually) by CrystalFalcon · · Score: 1

    Since when does QA set the release date in open OR closed software? Certainly not with any company I've worked for.

    I've worked for Microsoft, where QA literally decided the ship date. If it wasn't ready to ship, then it wasn't ready to ship.

    (which, of course, provokes flames from the Slashdot crowds as Microsoft never can stick to a release date. Consistency is not a feature of Slashdot...)

    1. Re:Microsoft does (yes, actually) by Anonymous Coward · · Score: 0

      which, of course, provokes flames from the Slashdot crowds as Microsoft never can stick to a release date. Consistency is not a feature of Slashdot...

      Maybe that is something to do with the fact that Slashdot is composed of thousands of individuals with different viewpoints, rather than some large single being that posts under tens of thousands of different names?

  48. ISO 9001 et al. by hughk · · Score: 2, Interesting
    I have worked before in QA, my wife works for a QA Certification Company. The meaning of ISO 9001 and its successors (15442, I think), and it is just about having a documented process so the 'customer' doesn't have any false expectations about what the 'supplier' is producing (be it a car, a lump of plastic or a computer program).

    I don't know of ISOed OS software, but I am aware of organisations that have gone through a quality audit who use open source software. The main issue is having a test and internal release procedure, so you don't, for example, roll out Perl 5.8.1 without ensuring that your users are aware that their old version is being replaced. You *don't* need to get Larry Wall's personal inprimateur on the package, you just need to have a documented procedure.

    In this way, security and QA are very much related. Zero security and no quality checks are fine, as long as those people using the system are aware of this and agree.

    --
    See my journal, I write things there
    1. Re:ISO 9001 et al. by Anonymous Coward · · Score: 1, Insightful

      Translation:

      It's really just a shiny bullet point for PHBs that the ISO is selling.

  49. Mod Parent Down! troll && dupicate posting by nietsch · · Score: 1

    might even be a winghing pommie.

    --
    This space is intentionally staring blankly at you
  50. Use Aegis if you want reliable code! by nietsch · · Score: 1

    From the website:

    Aegis is a transaction-based software configuration management system. It provides a framework within which a team of developers may work on many changes to a program independently, and Aegis coordinates integrating these changes back into the master source of the program, with as little disruption as possible.

    Aegis enforces a development process which requires that change sets ``work'' before they may be integrated into the project baseline. Works includes requiring that change sets build successfully, and (optionally) that they include and pass tests. It also ensures that code reviews have been performed.

    Needless to say it is not very popular because you have less to debug with it and save time for doing other things

    --
    This space is intentionally staring blankly at you
  51. Re:YOU FAIL IT! by Anonymous Coward · · Score: 0

    YUO is teh geenious!

  52. Regression tests just aren't part of the objective by slank · · Score: 2, Insightful

    In my experience, most (not all, of course) Open Source projects aren't concerned with backward compatibility outside of the scope of the project itself. Regression testing in OSS is folded into the bug testing.

    That's one of the downsides of OSS. The biggest example: When you upgrade your libc, you have to recompile all of your dependent apps. One thing Windows and Solaris have going for them is that you can run a 5 year old binary on the newest version of the OS and it will almost always work.

    It's a big burden on the development team to provide support for old interfaces, but this sort of thing is where OSS has a long way to go. It gets really expensive for individual persons/companies to support (bugfix, etc.) packages that are a few revisions old.

  53. QA or Testing? by gosand · · Score: 1
    So are we referring to the software testing side of QA? You see, depending on the size and maturity of your organization, and if you have some kind of maturity rating (ISO, CMM, etc), QA can be very different things.

    QA (for those who don't know) stands for Quality Assurance. For many small companies, that means testing. Is bigger companies, it means lots of different testing, such as installation, integration, subsystem, system, performance, load, stress, regression, automated, etc. When you get to those companies with the CMM rating (and possibly ISO, I am not sure) QA is not about testing, that is for the test group. QA is about making sure that processes are followed, metrics are collected, entry and exit criteria are met between phases, etc.

    For the last 10 years I have been in different companies that had these different ideas of what QA is all about. From the article, I will assume that it is referring to testing, because it talks about OSS. I actually asked an "ask Slashdot" question similar to what this article addresses last year. It got rejected. I am guessing that the OSS community knows little about real Quality Assurance. It relies mainly on the expertise of the developer, their stake in the software, and the "many eyes" of the end users. It seems to work OK for some projects, but not for all.

    I am currently working for a company that does software for hospitals. I can now better understand why the OSS model does not fit every software solution. One of the things we do in QA/Testing here is verify the requirements. For all of you OSS people with cocked heads and puzzled looks on your faces, requirements are what you get from your customer that define what they want/need the software to do. Requirements analysts go over them, refine them, create more of them. A whole team of people inspect them, then we create test cases for them while development designs the system around them. When we get the code, we test it against the requirements. In theory, if everything is good, then it meets the customer expectations. Oh, unless they have changed their minds, or a different customer has a different idea of how it should work. (not what it should do, but HOW it should do it)

    OK, [/rant].

    I think that software QA will be around for a while, because proprietary software will be around for a while. As it should be. I don't think it is OSS or nothing. At least I hope not, I make my living doing QA. And QA isn't just for the rejects of the software development pool, I have a BS-CS, and have chosen to do this field. If your management looks at QA as non-important and puts new developers there just to get them "up to speed", then you have a whole different set of problems.

    --

    My beliefs do not require that you agree with them.

  54. My company is moving towards a short release cycle by Anonymous Coward · · Score: 0

    Where the core team each adds a new feature and fixes all crash/data loss and the most severe bugs the first week of each month, and then releases at the end of the month. Then the next month we do the same.

    Having 11 short development cycles in a year will really help get new features to the apps team in a shorter period of time.

    Plus having the features added in isolation really helps find new bugs that we added with the feature.

    Open source people might want to consider a new release after each new feature or after each new set of related features.

    It is relativitly easy to have a list of all the features you want to add, a dependency list of how the features relate to each other, and the current months feature that is to be implemented.

    Then you write the new test cases, run the tests and make sure the old tests pass and the new tests fail, then you add the feature and keep running the test cases until all the test cases pass.

  55. You can't test in quality by Anonymous Coward · · Score: 0

    Quality needs to be built in up front. Most OSS projects will fail to do this, but this anomaly of software development isn't confined to OSS. Most commercial software will fail to do this as well.

    However, in software development methods that try to test in quality, the most effective method for reducing defects is the code review, and this is definately a major strength of OSS. The conclusion drawn from this would be that OSS has a high QA coefficient.

  56. Regression testing by hawkfish · · Score: 1

    I would think that OS projects could greatly benefit from automated regressions testing, probably even more so than commercial projects. OS projects can have problems with both the quantity and quality (meaning no disrespect - I'm referring to the level of familiarity with the code base) of personnel available at any given time. So for example, if a submitted patch can be run against an automated test suite by the submitter, it can take some validation load off the core development team. Likewise, if the core developers must run similar tests before checkin, it takes some load off the QA team (as The Pragmatic Programmer put it, "A human should find a bugs only once.").

    It even has benefits for the longevity of the project as such tests are part of the doucmentation of the project and would assist a new development team that took over a project that had been abandonded.

    --
    You will not drink with us, but you would taste our steel? - Walter Matthau, The Pirates
  57. Wrong - Not money, just management by Anonymous Coward · · Score: 0

    If they don't release it at the right time they don't make money.

    Wrong. Try to find a direct correlation between release dates and money, and with very few exceptions you will find none. The exceptions are mainly in those areas where consumer spending patterns are seasonal, and expecially the Xmas shopping effect. A game that misses an expected Xmas release slot when it has been hyped up for several months previously could make a substantial loss instead of a profit. However, this applies to very few other types of software.

    Except in a few exceptional cases as above, there is only one motivating force for particular release dates: management wanting to manage, and inevitably putting quality last after manpower and other resource issues. The key observation here is that management invariably continues to apply its release-date worldview even when there are NO date-sensitive items on the PERT chart that constrain development time. It's in their genes.

    As a contractor, I've seen it in dozens of companies. It's just management bollocks and nothing else, in at least 95% of the cases on projects I've worked on. (I've never worked in the games industry though.)