Conversations about this old chestnut (see also certification, whether testers should be able to code, testing as art vs science etc) tend to be around whether or not finding issues can be classed as breaking the software or merely as exposing existing flaws. But probably even those who sit at the yeah-smash-it! end of the spectrum would admit that they've found a bug or two that didn't cause the software to perform the dying fly and maybe even agree that, occasionally, finding the esoteric corner case with a severe outcome may not be as useful as finding half a dozen minor UX issues that improves product workflow for a core user story without changing the basic capabilities or robustness of the software.
Even as a young buck (although to be honest I wasn't that young when I started in testing and I doubt even my wife would have called me a buck) I don't know whether I ever had the attitude that I was breaking the product. These days I increasingly feel during testing that I'm inviting the software to show me how it responds to my requests, rather than challenging it to cope with what I can throw at it. That's not to say that I don't test to stress some feature, or that an all-out assault is never appropriate, but that my mindset is more likely to be one of creating scenarios where the product can demonstrate its (lack of) correctness, usability, responsiveness, performance, reliability or whatever factors I'm interested in.
Does this make a difference? I think that it can and here's a couple of reasons why:
Testing is an activity of which only a part involves some kind of interaction with the system under test but it's an activity in which every part is some kind of communication, direct or indirect, with some another participant in the development or use of the software. When you're probing some aspect of functionality you're talking to the developer via the code or a product owner via the spec or user stories. When you find an issue, the way you conceive your task, the kind of dialogue you're having with the other person or people, can carry over into your reports. Compare, for example two headline reports for the same problem:
- I loaded every large document from the scratch disk into the system at once to see what would happen and it crapped out pathetically with a useless error message.
- While investigating how the system performed under stress I loaded a collection of large documents simultaneously. The server failed and the error message was unhelpful in diagnosing the cause.
Of course, it doesn't have to follow that the wrecking approach results in ranting reports, but it's putting the writer in a place where those kinds of words come out more naturally. Some kinds of testing, particularly to do with exploits, do fit with an belligerent, deliberately malicious attitude - security being an obvious one - but even there I feel like the scenario is what needs to be aggressive, not the tester implementing it.
In your interactions with other stakeholders you should probably, for the sake of credibility, try not to give the impression that the only thing the team is concerned with is whether or not they can stuff their favourite Gutenberg text into every text field in the SUT. Simple changes of emphasis such as replacing breaking with exercising or broadening out to exploring can make a big difference.
When generating test ideas a shift in focus from attack to invitation may cause reprioritisation, may provoke thoughts of tests in different areas. Sure, you still have to look for functional correctness and error handling and the like, but you should also be thinking about the goals of the consumers of this feature, how you can put the product to work on them, around them, how the product helps and hinders you in achieving those goals.
Feel differently? What's the key thing here for you?
Image: http://flic.kr/p/71GAu2
Great post. I've been testing software since the 1980s (eek!) and while it used to be more fun to try to overwhelm the system and get spectacular crashes, it's not really all that useful to my customers (by which I mean the developers and project managers). If I had to do a triple lutz jump whilst (and at the same time) firing a chicken from a cannon to get the crash, they just don't care because the risk is so low.
ReplyDeleteIf, however, I can diplomatically point out that Canadian postal codes do not have five characters, then I will get more help doing my job. I'll file the triple lutz crash, of course, but I won't inflate the risk of it just because it was darn FUN to find.