Mind of Bigyellow

Injection:  在输入中加入代码，直接进入系统 Broken Authentication and Session Management: 利用Session  管理的问题，比如登出，密码管理，超时，remember me等等里面的漏洞来进入其他用户的账户。 Cross Site Scripting：将恶意代码发给多个用户，一旦有一个用户疏忽，就会被侵入。之后此用户和网页之间的数据交换，cookie等就有可能被暴露。  Haker --> Create Page Victim --> Visit page   Victim --> Get inject script Hacker --> Do bad thing on victim behalf Insecure Direct Object References：没有权限的用户可能访问某些需要权限才能访问的对象。特别是某些文件目录，侵入者可以猜测目录结构，然后进入一个应该保护但是没有被保护的目录 Application Security Misconfiguration：某些不必要也不安全的组件被放在网页上面，比如一些内部用的调试组件，侵入者可以通过这些组件绕过认证的过程。  Sensitive Data Exposure: 需要被加密的数据没有被加密储存或者传递，或者使用低级别的加密技术 Missing Function Level Access Control：某些函数或者控件只能被认证用户使用，但是因缺少保护，侵入者可以找到这些漏洞。 Cross-Site Request Forgery：用户访问网页的时候，现访问侵入者的主机，此主机在用户的请求后面注入恶意代码在发给用户真正要访问的服务器。  Using Components with known vulnerabilities: 开发的时候没有注意使用的库可能是已知的有问题的。使用这种库，就容易出现问题。 Unvalidated Redirects and Forwards: 网站经常会将用户重新定向。 如果定向设计的有缺陷，侵入者可以加入一些参数，引诱用户点击以后被重定向到他们希望的网页。 

Functional test for new development: Divide to two stage: i) Early test: test in each team's isolated dev env. those envs are regularly sync.ed. Release test: each test analyst will be responsible for several test plan, which covered one or more new feature/requirement. So test analyst is a role, plan the test, design the test, execute the test, and report the test. ii) Automation test for regression test:  A lot of automation test (UI and Unit) as gate checking. Other test: Performance. Performance test. Problem or challenge: 1. Each team/test analyst works alone, find error in their own domain. Cross domain error sometimes not caught. 2. The strict release date and predefine feature(most likely are promised to customer)somehow restrict the Agile development. 1. script failure, hardware failure, network failed, and the dependencies, database failure, or system crash due to ...... etc 1. I should not only test the CR, also think the theory behind it. 2. Figu...

Q: More Asset Management team seeking nontraditional investment in nowadays, what is the opportunity to me A: Instrument Type added, and the infomation of Insrument type will be added. Q: How to deal with the support to different version. A: After 5.6, install the agent in testtemp folder, and no need to remove the agent from default folder. . Q: Also think about test as service, what I should change my behaviour. A: Test as service is mainly to know what you custemer needs. Interview the stakehold what they want, and design the test for them. No quite same as the work we do here. Q: How to perform release test and cr test, figure out a good way to do that. Get project information -> Write strategy -> Script the test. Relase test should not only test the CR, also test the requirement, not only the functional, should I consider the non functional, or higher level test. Use script is good for simplify the labor work, but also make the test to always use the predifine s...

1. 为什么联系汇率 优质资产国家，为了保证汇率稳定不上升保证出口。  2. 联系汇率的压力 欧元资产 烂 ->;  欧元进入本国 购买优质资产  -> 本国货币紧俏 -> 本国货币汇率上升 -> 维持稳定 -> 央行加印本国货币 -> 买入市场欧元 ->  欧元外汇储备增加  ->  本国资产泡沫化 -> 欧元贬值  -> 外汇储备资产贬值   3. 阻止热钱 1.  放开汇率，会对本国出口造成影响 2.  降低存款利率，减小热钱的兴趣 Question  为什么  QE ->导致避险资金涌入  参考: 1. 而瑞士央行要履行瑞士法郎对欧元汇率不得低于1.20的承诺，就不得不大量买入流入国内的欧元“热钱”，成为市场上唯一的欧元对瑞士法郎汇率“多头”。 2. 这样的汇率保卫战已使瑞士央行不堪重负，目前瑞士外汇储备占GDP比重已经从2011的30%左右一跃升至如今的70%以上。面对资产泡沫风险加剧、瑞士法郎被严重低估的前景，瑞士央行出此“食言”之举也不难理解。至少现在瑞士法郎迅速摆脱了被低估的风险。 3. 彭博援引Rabobank策略师Emile Cardon称，瑞士央行放弃欧元/瑞郎汇率下限，可能是因为了解到在欧洲央行实施QE后，再买汇以阻止瑞郎升值的代价会越来越高。

You buy pension from pension company, pension company use your money buy bonds from credit, and  credit use your money to lend to you, After all, you pay interest to credit, credit use your interest to pay pension company, and pension company use your interest to pay your pension interest.

在论坛上看了太多中医的东西，我就自己写写我自己的看法吧， 中医，太笼统了，粗分一下，有中医诊断和中医治疗 中医是从经验发展出来的一门技术，中医诊断，基本就是靠猜。基本靠不住。日常常见的小病估计还凑合，可以听听，略微严重点的病就算了。 中医治疗，粗分成药物治疗和物理治疗把， 药物治疗，和诊断一样，非常常见的小病，也许可以一试，很多方子都是一些验方。说它完全没效果也是不对的。大部分的方子还是少碰为好。 物理治疗，这个估计是中医可取的地方。针灸和按摩也都是经验科学，其实就是通过刺激身体里面的神经来进行治疗，虽然讲不清楚原理，但是有时候也确实有用，而且这个副作用也小。

you can be a lot more of who you already are.. life is short, do not waste time to correct your deficiencies, develop your strength instead.

测试的战略可以让工程师从繁琐的小型测试里面解脱，注视到他们之前可能忽略的盲点，进行更全面测试，和测试平台开发。

Where can you think to construct the test strategy 每次设计之前都需要仔细的设计Test Strategy Test Strategy和其他的都一样，需要训练才能熟练，如果开始就能写好，说明你还不会。  when a person is too focus on one thing he may lost focus on other thing, and lost the overview. Hence, test from more angle is better than test deep under the condition of limited resource.  Test Strategy is a tool to communication, and improve the cooperation . Test Misson has to be answered, WHY do we test this product. Test strategy is a tool to design test, which collect the information -> model and -> convert the model to test . it is not the same thing as test plan.  Use different kind of test technique, can be different in terms of test effort,  Test strategy best to used for the test designer that need communicate their test to Management and test executor.  Q: How deep the strategy should be , I believe the bigger the project/product, the deeper strategy needed...

http://shar.es/13Wy7N Don't we know everything there is to know about testing? The response from pretty well everyone who knows anything about testing is 'certainly not'. I am proposing a New Model because I believe that the testing world is getting shaken up quite dramatically. The current confused state of affairs [1,2] could mean that some testers...read more → This message was sent using ShareThis ( http://www.sharethis.com )

Test without  solid information:  Michael botton的speach和飞利浦的那个讲座的特点类似， 基本都是Herustic 的延伸，基本都是说在没有足够信息的情况的，应该怎么去思考， Michael更多的是启发式的， 飞利浦的那个基本上是用一个例子来讲该怎么办, 在只有一个open protocol的情况下怎么来进行， 这个和我的framework测试有些类似， 但是resource和重视程度是不一样的。  Quadrant need! live oracle Not only test product, test the idea of product.. Create a mission • What is the (business) strategy? • What are the interests of stakeholders? • What is the tester(s) mission? Possible Actions Documentation study • Gathering best practices •  Risk analysis •  Propose test strategy •  Determine requirements • Current test approach as starting point • Keep business involved • Implementation But that's for a big project.. Test Pattern Discovery Find a good probe Nature Verbs : Name your actions: Put your hands inside the system, not only the direct input, secret operation, env setting etc.. Cut the Middleman: Short operation is easier to...

The rate just means how much the product of company related to my own work, not the rate to the quality of their product or service.. TestTool Review www.grid-tools.com   *** DataMaker, and Fast data Maker : Generate the test data using tree like structure  www.agile-designer.com    *** Test case design tool..  www.smartbear.com/    *** QA complete : TM, + Test Complete + Defect management, + requirement Management Test Complete Ready API: API Test: Mock model,  Functional and Performance, Security Scan,  www.qa-cube.com    ** Test reporting tool, for test manager. www.tricentis.com   *** Tosca as a Service: a cloud based TM/Test tool www.froglogic.com   * Squish: GUI automated tool Squish Coco: Code coverage tool  www.neotys.com  * Load and performance test tool Neosence: Monitoring tool..   www.easit.com  *** Test Engine: Test data tool , ...

The idea of QA Test Plan is okay, but the bad tool jeopardize the users.  The tool is really bad at manageing the testcase. and it is not heuristic to design testcase. .  The test stretery is bad too. no way to track the error related to the plan . The QA plan try to make them together to a single file make the things worse. Especially try to find a way to do it for whole company, thats very bad without using any commercial tool . The solution maybe split the test case/strategy design and test report/track/management, 

use formula to predict is better than experts manual work, more low efficient, more better anybody creates a simple formula to grade the financial product.

why experts fail to make right estimation ,not because what they thought, because how they thought, it is same point in personal mba.

Kahneman said wemen has better performance than man in investment..because man more tend to do things follow their useless thought.. .so it is time to shift the task now..

Q: Macro test vs micro test a.k.a the coverage for the whole product like V model coverage v.s specific bug hunting A: Test as wide as possible is more preferable than test as deep as possible, which have higher return of invest. Test deep is good to when there are resource. 

Diversity may be one of the crucial thing in the team.

智能手机已经进入了，快7个年头了把，不过现在要找一个合适的手机，实在太难了。。。。。 作为曾经手机的研发人员，我对手机里面还是比较了解，而且我其实要求不高，既不打游戏也没有媒体要求，很多手机都貌似可以用，平常就是用一些通讯，地图，照相和生活家居Apps。时不时的有双卡使用的要求，就这么点，就是没有一个完美的手机可以用啊。 从操作设计理念上说，WP是我最欣赏的，有限的开放应该是嵌入式系统的一个不错的选择，可以MS和Nokia这几年在WP的发展上几乎没有任何贡献，WP的App实在是太少，特别是一些硬件厂商，根本就不提供WP的辅助Apps，在智能家居上差的太远了。WS在推动生态环境上做的太有限，应该更开放一些，把做Apps的门槛降低一些，无论从技术上还是从经济上都要更开放一些，没有必要强行使用Windows 自己的Market，可以考虑让开发人员更自由的开发Apps，就像Windows软件一样。当然也可以略加限制， 比如如果不进Market, 能做的功能有限制，安装的路径，运行的权限也有限制，但是吸引更多的Apps开发人员进来。很多小软件其实不难，但是如果门槛太高，大家也就失去了做软件的兴趣。最后WP不但Apps少，可以选得硬件也没有几个啊。实在有些失望。 IOS当然是设计的最好的，Iphone也确实领先于其他一些，不过我这种反封闭的人，尤其没法接受不能用自己的外接卡，必须要用Itune这种东西，也没有用双卡的机会，iPhone out 最后就是Android，虽然一直都用的Android，但是Android是我最不喜欢的一个系统，各种地方都太过于凌乱，就算比较好的Google Play里面，软件也有各种不兼容的现象出现，各种重启的现象也有。量虽然多，但是经常遇到各种不能用，看着肥肉就是不能吃啊。最后，因为某国管事的和某公司管事的谈不来，虽然某国Android硬件做的风生水起，配置和价格都深得我意，但是被阉割的系统拿到外边来就没法愉快的使用啊。还好，自己也算是工程出身，费电时间还能凑合用，但是智能手机都到这个年头了，还没有一个能愉快使用的手机，也算是手机业发展的问题了。。

现场看了一场C罗的比赛， 整场踢得很臭，不过最后还是他解决了问题。 最近几年梅罗之争一直就纷纷扰扰，双方粉丝隔空骂战。虽然两位外星人都不是我最喜欢的菜，但是还是要说C罗的踢法和我对未来足球的设想是一样的，。梅西虽然很多地方要强于C罗，但是，如果能有11个C罗，这个球队就太完美了。身材高大，体魄强壮，技术出色，速度快，灵活性好，弹跳能力强，可以胜任任何位置踢球，这才是未来全面足球的代表。这种球员，既可以打出tik-tack，也可以打暴风骤雨。 现在离这个目标最近的，勒娘和瓜娘下面的德军，目标很好，可惜，德军的技术，灵活性，速度都有些差距。足球离完美还有很大差距呢。。