1
00:00:00,180 --> 00:00:04,780
Is it a common thing to write tests against your Dogwood policy that do bad things to

2
00:00:04,780 --> 00:00:09,860
make sure that it can't do the bad things? That is an excellent idea. I do think it should

3
00:00:09,860 --> 00:00:13,120
be a common thing. I wouldn't say most people think about it that way.

4
00:00:15,060 --> 00:00:19,420
I've spent a lot of time working with TLA +, for example, and one of the things that

5
00:00:19,420 --> 00:00:24,020
I find super useful is writing tests that I know are going to fail and writing buggy

6
00:00:24,020 --> 00:00:28,200
versions of the program that should have the bugs found by the specification.

7
00:00:29,160 --> 00:00:33,520
And I think that would be good practice in something like this, is writing those kind

8
00:00:33,520 --> 00:00:39,600
of negative cases. And one set of tools that's really interesting is

9
00:00:41,440 --> 00:00:42,780
you could imagine

10
00:00:44,180 --> 00:00:49,120
property -guided fuzzers that could generate lots and lots and lots of those kinds of

11
00:00:49,120 --> 00:00:50,620
tests to test your programs.

12
00:00:51,560 --> 00:00:52,680
Test your Dogwood programs.

13
00:00:55,460 --> 00:00:58,500
But yeah, negative tests. They're good for authorization, for sure.

14
00:00:59,560 --> 00:01:02,240
I wouldn't say that's common, but I would say it's a good idea.