FoundationDB Alum Wilson Launches Startup to Automate Test Creation

Autonomous Testing and the Future of Software Development - Will Wilson — The Linux Foundation

The Linux Foundation

Because developers cannot mentally trace the complex failure states they fail to code around, software engineering must transition from manual test authoring to autonomous machine generation.

AI-assisted summary of Autonomous Testing and the Future of Software Development - Will Wilson — original source. Check the original for full context.

Source published:

Key ideas

  • While industry analysts estimate testing accounts for roughly 30% of software development effort, real-world friction—including triage, downstream library mitigations, and outage fallout—pushes the true cost past 50% of developer time, squandering trillions globally. (4:52)
  • The software industry conflates automated test execution via CI/CD with automated testing, masking the reality that test creation remains an entirely manual, painstakingly human bottleneck ripe for disruption. (14:05)
  • Branch coverage yields a false sense of security in distributed systems, failing to catch critical concurrency and timing defects across an execution history search space bounded mathematically by 256 raised to the power of input bytes. (10:44)
  • Autonomous testing leverages cloud elasticity and embarrassing parallelism to compress 'bug latency'—the time between writing a defect and detecting it—from months to seconds, dramatically reducing remediation costs. (27:17)

Detailed notes

## Background Published on YouTube by The Linux Foundation on December 20, 2018, this presentation features former FoundationDB engineer Will Wilson discussing the trajectory of software verification. No show notes or description were provided on the original video page.

## TL;DR Will Wilson argues that software engineering is still in its primitive infancy, where flawed, fragile testing practices currently squander over half of developer productivity. He proposes shifting from traditional automated test execution to 'autonomous testing'—systems that automatically synthesize and explore test cases, inspired by FoundationDB's deterministic simulation methods. Despite the immense challenges of searching vast execution state spaces and designing proper test oracles, Wilson asserts that autonomous testing dramatically compresses bug latency and catches catastrophic edge cases humans cannot fathom. He concludes by announcing a new venture co-founded with Dave Scherer to make autonomous testing turnkey and universally adoptable across the industry.

## Atmosphere & style The presentation carries a dryly humorous, conversational, and intellectually ambitious tone, kicking off with comedic running gags about historical technology charts before diving into rigorous technical critique. Wilson blends developer commiseration with genuine visionary optimism, treating audience members like fellow pioneers navigating the early frontiers of computing. The session feels both grounded and inspiring, moving effortlessly from the day-to-day misery of flaky CI runs into an energizing manifesto on radically transforming how software is verified.

## Bulletin - [04:52](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=292s) While industry analysts estimate testing accounts for roughly 30% of software development effort, real-world friction—including triage, downstream library mitigations, and outage fallout—pushes the true cost past 50% of developer time, squandering trillions globally. - [14:05](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=845s) The software industry conflates automated test execution via CI/CD with automated testing, masking the reality that test creation remains an entirely manual, painstakingly human bottleneck ripe for disruption. - [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) Branch coverage yields a false sense of security in distributed systems, failing to catch critical concurrency and timing defects across an execution history search space bounded mathematically by 256 raised to the power of input bytes. - [27:17](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1637s) Autonomous testing leverages cloud elasticity and embarrassing parallelism to compress 'bug latency'—the time between writing a defect and detecting it—from months to seconds, dramatically reducing remediation costs.

## Key takeaways - [00:00](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=0s) Moore's law does not demonstrate computing exceptionalism; steep exponential gains reflect early primitive baselines, mirroring historical curves seen in textile spinning, steam engines, and synthetic diamonds. - [00:00](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=0s) Because software engineering has not yet plateaued along a traditional logistic curve, present-day developers have the opportunity to drive radical transformations across foundational practices. - [03:18](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=198s) The most fertile ground for transformative engineering breakthroughs lies where daily workflows are most painful, making software testing the prime target. - [04:52](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=292s) Real-world testing overhead routinely exceeds 50% of engineering time once developers account for writing suites, debugging regressions, working around upstream library bugs, and firefighting outages. - [07:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=464s) Non-deterministic, flaky test suites induce alert fatigue and cynicism, training teams to dismiss failures until catastrophic defects slip into production. - [07:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=464s) Fragile tests over-specify incidental implementation details such as animation durations or tick rates rather than meaningful system invariants, causing tests to fail open or be disabled. - [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) A fundamental human cognitive paradox limits testing: if developers possessed the foresight to anticipate every edge case and concurrency interleaving required for complete test suites, they would write bug-free code initially. - [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) High branch coverage cannot guarantee reliability in distributed systems or Turing-complete software because it fails to capture process execution ordering and asynchronous timing bugs. - [14:05](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=845s) Autonomous testing fundamentally redefines quality assurance by automating the generation of test cases rather than merely automating the execution of human-scripted tests. - [16:13](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=973s) Dismissing automated testing via the Turing halting problem is invalid; software verification tools do not need to be infallible oracles, but merely need to outperform human debugging capability. - [19:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1194s) Finding software defects requires navigating an astronomically vast state space of 256 raised to the power of received input bytes, demanding intelligent generative systems over naive random fuzzing. - [21:07](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1267s) Autonomous simulation testing historically required systems to be architected from day one as deterministic pure functions fed by a pseudo-random seed, presenting severe hurdles for legacy codebases. - [23:46](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1426s) Autonomous testing systems require sophisticated test oracles capable of validating complex transactional guarantees and system invariants beyond simple crashes or inline assertions. - [24:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1494s) Machine-driven test generation and human-authored tests are orthogonal and complementary: humans verify expected workflows, while algorithmic testing probes unintuitive edge cases. - [27:17](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1637s) The cost and cognitive burden of fixing bugs scale exponentially with time, making the embarrassingly parallel execution of autonomous testing vital for keeping bug latency near zero. - [29:49](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1789s) Autonomous testing represents a potential epochal leap on par with high-level compilers, poised to relegate manual test authoring to specialized, rare edge cases.

## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=0s) Moore’s Law and the Illusion of Computing Exceptionalism

Will Wilson introduces himself by noting that he worked at FoundationDB back in “the ancient mists of time” and is now working on something different, setting the stage for a talk on the future of software development. As someone tasked with giving a big-picture talk at a tech conference, he jokes that he is contractually obligated to begin with a slide depicting Moore’s law. Wilson advances to a slide displaying an exponential curve running up and to the right, labeling the axes as years and clock speed, only to double-check his notes in mock confusion. The graph is actually tracking historical productivity in weaving and spinning. He tries a second slide featuring a steep logarithmic scale, joking that this one must surely be Moore’s law, only to discover it illustrates steam engine efficiency over time. On his third attempt, showing a graph spanning the exact decades during which Moore’s law operated, the audience is left guessing before Wilson reveals it plots the industrial synthesis of diamonds.

```mermaid flowchart TD accTitle: Technology Growth Trajectory accDescr: Diagram contrasting early primitive exponential growth with the mature logistic curve flattening.

subgraph EarlyStage ["Early Historical Stage"] A["Primitive Baseline Technology"] -->|"Rapid iteration & low-hanging fruit"| B["Exponential Growth Phase"] end

subgraph MatureStage ["Mature Plateau Stage"] B -->|"Physical & practical limits"| C["Logistic Curve Flattening"] C --> D["Diminishing Marginal Returns"] end ```

Wilson uses this comedic sequence of historical charts to challenge a core piece of mythology common among software engineers: the idea that computing is uniquely exceptional in human history. Technologists often point to Moore’s law and ask where else humanity has ever witnessed exponential gains in baseline hardware capabilities. Wilson's point is that such explosive progress is found across nearly every technological domain in its infancy. As Wilson explains: “The reason is that exponential growth is really really easy when what you have is really really primitive and so the fact that we observe this Moore's Law relationship maybe still is actually not telling us that software is special it's telling us that software is early right it's telling us that we're at the beginning that we haven't trailed off yet into a logistic curve which is what usually happens in technology and I actually find this fact to be incredibly empowering right it means it means we we get the chance to be pioneers too it means those guys in the 60s and the 70s didn't have all the fun it means there's a lot more to do and I think one implication of this is it also means that we should be looking for the possibilities of radical transformations in software engineering right things that will completely change how what it means to be a software engineer what it means to write programs.”

- Moore’s law curves are mirrored historically in spinning and weaving output, steam engine thermal efficiency, and synthetic diamond production. - Exponential gains reflect primitive early baselines rather than something intrinsically unique to silicon or code. - Because computing has not yet flattened out into a standard logistic curve, present-day developers remain pioneers on a par with early practitioners from the 1960s and 1970s.

---

[03:18](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=198s) The Opportunity for Radical Transformation in Software Development

Being so early in the broader timeline of software engineering carries two massive implications. First, substantial low-hanging fruit still exists across the engineering landscape. Second, the vast majority of all software that human civilization will ever write has not been written yet. Any architectural, tooling, or process improvements established today will pay dividends over an extraordinarily long future time horizon. These factors justify taking a hard, foundational look at how software is constructed. Wilson notes that while there are many candidate fields for radical transformation—such as category theory yielding revolutionary programming languages, or drastic demographic and economic shifts altering who writes software—he chooses to bypass those topics entirely to focus squarely on testing.

To uncover where a radical transformation is most likely to happen, Wilson suggests a practical heuristic: identify where current engineering practices are the most painful, grueling, and inefficient. Software testing fits this description perfectly. As Wilson puts it: “And if you want to look for the potential for radical transformations one way of doing that one pretty good heuristic is to look at where things are currently the most absolutely awful and terrible and painstaking and brutal and I think testing kind of qualifies right.”

---

[04:52](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=292s) The Real Economic Toll of Testing and the FoundationDB Perspective

Industry analyst firms like Gartner or Forrester have published reports estimating that roughly 30% of all software development effort is consumed by testing and quality assurance. Wilson argues that this figure is an absurd underestimate once developers tally the full reality of their workdays. A true accounting includes writing tests, fixing the bugs caught by tests, triaging the bugs that tests missed, spending days mitigating defects in underlying third-party libraries and layers written by “those jerks” who refused to fix them, and cleaning up after production outages and customer-facing fallout. Wilson estimates that for himself and the average engineer, testing-related concerns eat up at least 50% of developer time.

```mermaid flowchart TD accTitle: Real Scope of Testing Overhead accDescr: Flowchart illustrating the full compounding costs of testing and software defects.

subgraph DirectCost ["Direct QA Activities"] A["Authoring Tests"] B["Fixing Test-Found Bugs"] end

subgraph IndirectCost ["Mitigation & Remediation"] C["Debugging Production Bugs (Missed by Tests)"] D["Compensating for Downstream Vendor & Layer Bugs"] E["Triage, Outages, and Economic Damage"] end

DirectCost --> F["Visible Effort: ~30% (Analyst Estimates)"] IndirectCost --> G["Total Real Effort: >= 50% Developer Time"] ```

Scaled across millions of software engineers worldwide, this friction represents trillions of dollars in squandered productivity. Wilson emphasizes that addressing this drag is the motivation for speaking at a FoundationDB gathering. Unlike the broader software ecosystem, FoundationDB had an unusually tranquil relationship with testing, where verifying software was not an all-consuming ordeal that drained developer morale. Rather than repeating familiar FoundationDB war stories—which colleagues like Evan and Ben had already presented—Wilson explains that his goal is to recontextualize FoundationDB's methods within a wider framework of testing philosophies. As Wilson asserts: “If you could take that and you could eliminate it or make it much more efficient much smaller fraction of what we do that would be a radical transformation of the software industry.”

- Analyst estimates place testing and QA at roughly 30% of development effort, but real-world overhead routinely exceeds 50%. - Compounding costs include downstream defect mitigation, undetected production defects, post-outage firefighting, and economic disruption. - Globally, developer time lost to testing friction amounts to trillions of dollars of potential output. - FoundationDB decoupled testing from developer misery, treating verification as an asset rather than a resource drain.

---

[07:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=464s) The Plagues of Modern Testing: Non-Determinism and Fragility

Wilson breaks down why the status quo of software testing is miserable, starting with the rampant issue of non-deterministic, flaky tests. The moment a test harness interacts with an external service or operates in an unisolated, noisy hardware environment, it begins failing intermittently—once every 100 runs, or once every 10,000 runs. This behavior destroys developer confidence: when a flaky test turns red, engineers cannot tell if their code broke or if the test is misbehaving. Developers fall into the dangerous habit of dismissing failures as known flakiness until an actual catastrophic bug slips through. While the FoundationDB engineering team made heroic efforts to claw back determinism via deterministic simulation, Wilson points out that the rest of the industry remains trapped in the dark ages, suffering from flaky test suites daily.

Beyond flakiness, Wilson highlights test fragility, where test suites inadvertently depend on arbitrary implementation details rather than meaningful invariants. He illustrates this using a 2D platformer game tested via recorded user keystrokes: holding the right arrow for 6.7 seconds, jumping for 3.2 seconds, and firing a weapon at an enemy. The test functions only until the slightest change occurs—such as tweaking a platform position, altering the physics tick rate, modifying input polling, or running the suite on a faster processor. The exact same vulnerability plagues UI testing and distributed systems verification, where minor early timing divergences derail the rest of the sequence into checking irrelevancies. As Wilson explains: “Another reason testing is terrible is that your tests are very very often fragile what do I mean by that I mean that your test comes to rely on properties of your system that are incidental in some way that are not the ones that you thought you were testing.” This persistent fragility breeds cynicism, leading teams to ignore test warnings—a pattern highlighted by a recent major outage post-mortem.

- Non-deterministic test suites undermine debugging confidence, creating alert fatigue where teams normalize and ignore failing runs. - FoundationDB avoided this via deterministic simulation, but most engineering teams lack deterministic execution environments. - Fragile tests over-specify incidental execution details (such as hardcoded sleep times, input durations, or strict timeline ordering) rather than system invariants. - Fragility appears across domains, from game physics and front-end UIs to distributed network traces, where small initial divergences cause tests to wander away from their intended assertions.

[10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) The Trap of False Confidence and the Limits of Human Foresight

To illustrate the danger of fragile test suites, Will Wilson shares an anecdote about a giant, unnamed company where a massive system outage occurred. In a cruel twist of irony, the exact code check-in that introduced the catastrophic bug also disabled the very test designed to catch it. The developer had disabled the test because it was notoriously fragile, routinely breaking with every single check-in. This highlights a highly insidious failure mode: tests can "fail open," continuing to pass after a code change but doing so for entirely different, unintended reasons. This creates a dangerous illusion of security, leaving teams with a false sense of confidence.

Even if developers manage to write tests that are neither flaky nor fragile, they are still highly unlikely to test the right scenarios. Wilson argues there is an analytical proof for this limitation. Humans write tests because our brains are remarkably bad at tracing every possible branch of control flow, anticipating how asynchronous threads might interleave, or predicting where and how a distributed algorithm might fail. However, this exact cognitive limitation means we are also incapable of writing the very tests needed to cover these complex scenarios.

Because of this paradox, traditional tests are useful for catching regressions but almost entirely useless for uncovering "unknown unknowns." Attempting to solve this with branch coverage metrics is a dead end. Even if a distributed system achieves 100% branch coverage, it remains vulnerable to timing bugs—such as whether a piece of code executes on Process A before or after Process B—which branch coverage completely misses. Similarly, achieving 100% branch coverage on a Turing-complete system, like a Python interpreter, still leaves an infinite mountain of untested, complex behaviors.

* **The Outage Anecdote:** A developer at a massive tech company disabled a critical test because it broke on every check-in, directly leading to a giant system outage. * **The Human Cognitive Limit:** “If we were smart enough or had the right kind of brains to write all the tests we needed to write, then we would have just written the code correctly in the first place.” * **The Coverage Illusion:** 100% branch coverage cannot guarantee the absence of bugs in distributed systems or Turing-complete software.

[14:05](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=845s) Redefining "Automated" Testing: The Shift to Autonomous Testing

The root of these testing failures is that what the industry calls "automated testing" is actually entirely manual. The only part we have automated is the absolute simplest step: running the tests via CI/CD tools like Jenkins. The tests themselves are still painstakingly, manually constructed by human beings. Wilson jokes that if any other industry employed armies of highly paid, intelligent professionals to perform such rote, repetitive, and predictable tasks without automation, venture capitalists would instantly declare it ripe for disruption. Yet, this remains the standard state of software engineering.

The true breakthrough at FoundationDB was not just their deterministic simulation engine, but a fundamental shift in philosophy. Instead of asking how to write individual tests for a new feature, the engineering team focused on building systems that could continuously generate new and interesting tests. Wilson defines this paradigm—the automated creation of tests, rather than just their automated execution—as "autonomous testing."

```mermaid flowchart TD accTitle: Manual vs Autonomous Testing Workflows accDescr: A comparison showing how traditional automated testing still relies on manual test creation, whereas autonomous testing automates both creation and execution. subgraph Traditional ["Traditional 'Automated' Testing"] A["Human Engineer"] -->|"Painstakingly writes"| B["Static Test Cases"] B -->|"Executed by"| C["CI/CD (e.g., Jenkins)"] end subgraph Autonomous ["Autonomous Testing"] D["Human Engineer"] -->|"Designs"| E["Test-Generating System"] E -->|"Continuously generates"| F["Infinite Dynamic Tests"] F -->|"Executed by"| G["Deterministic Simulator"] end ```

* **The Mindset Shift:** “Whenever we had a new piece of functionality, we didn't say, 'How can I write some tests to cover this?' It was more like, 'How can I write a system that will forever be generating new and interesting tests that will exercise this?'” * **The Definition of Autonomous Testing:** The automated creation of tests, distinguishing it from the mere automated execution of human-written tests.

[16:13](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=973s) Glimmerings of Autonomy and the Turing Objection

While FoundationDB's approach was comprehensive, primitive forms of autonomous testing exist across the industry if one knows where to look. Fuzzing is a classic example: instead of manually writing unit tests for a network parser, developers use a fuzzer to feed millions of random byte strings into the program to see if it crashes. Similarly, functional programming communities (particularly Haskell developers) pioneered property-based testing. In this approach, developers define a specification of a data structure's contract and guarantees, and the computer is tasked with finding counterexamples. This technique was used extensively to test the FoundationDB document layer, which Apple recently open-sourced.

Despite the clear benefits of autonomous testing, its widespread adoption is slow. When asking why the entire industry hasn't adopted these methods, Wilson notes he is bound by NDAs from describing just how bad things get when companies don't use them. He frequently encounters a weak, pseudo-intellectual objection: that the Turing halting theorem mathematically proves software can never test software.

Wilson dismisses this argument as a trivial impossibility result, comparing it to developers who claim the CAP theorem makes it impossible to build a good distributed database. He points out that computers do not need to be perfect Turing Oracles to debug software; they simply need to outperform humans.

* **Fuzzing as Autonomy:** A primitive but highly effective form of autonomous testing used to secure parsers against untrusted network inputs. * **Property-Based Testing:** A method where computers generate counterexamples to a defined specification, heavily utilized in testing FoundationDB's document layer. * **The Turing Objection:** “Humans debug software; humans are not mystical Turing Oracles—if humans can do it, then so can computers.”

[19:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1194s) The True Challenge: Navigating an Inconceivable State Space

While the Turing halting theorem is a poor excuse for avoiding autonomous testing, it is closely linked to a very real and incredibly difficult engineering challenge: the sheer scale of the state space. When trying to find a bug, a testing system is implicitly searching through the space of all possible execution histories.

The size of this search space is mathematically defined as 256 raised to the power of the number of bytes of input the program has ever received. This is an inconceivably vast space. A naive testing tool could wander randomly through a tiny, insignificant corner of this space for the entire lifetime of the universe and never find a single bug. The core challenge of autonomous testing is designing systems smart enough to navigate this infinite expanse and locate the highly specific, interesting execution paths where bugs actually hide in a very short amount of time.

* **The State Space Formula:** The size of the execution history space is $256^{N}$, where $N$ is the number of bytes of input the program has received. * **The Scale of the Problem:** “The size of that space is 256 raised to the power of the number of bytes of input your program has ever received—that is a mind-bogglingly large space, that is inconceivably vast.”

[021:07] The Pitfalls of Autonomous Testing: Tuning and Architectural Form

Tuning an autonomous testing system is an excruciatingly delicate task. At FoundationDB, an immense amount of effort went into balancing parameters—a responsibility largely shouldered by co-founder Evan. Wilson points out that getting bugs to surface requires carefully "buggifying" components and tweaking random number generators so that processes crash frequently enough to expose rare edge cases, but not so often that test runs can never make forward progress. This calibration requires an engineer with deep architectural understanding. If done improperly, the worst possible failure occurs: the tests report green, giving a false sense of security. As Wilson stresses: “And if you get it wrong the failure mode is your tests say everything's good that's a really really scary failure mode right you need some kind of side channel to tell you that no actually everything is not good hopefully that side channel is not your customers.”

Beyond the difficulty of tuning, a far steeper barrier to adoption is that nearly all autonomous testing methods require the target software to be built in a very specific architectural form. FoundationDB’s deterministic simulation works by corralling a massive, stateful, hairy distributed system into acting like a pure function fed by a single pseudo-random seed. That was only feasible because the team possessed tremendous foresight from day one. Wilson laments that most developers in the industry simply cannot do this: they are maintaining legacy codebases—what he quips is "some ginormous java monstrosity from the 1990s"—or face commercial pressure where they cannot afford to spend a full year building a custom simulator before writing their first line of product code. Until techniques can be retrofitted onto existing systems, autonomous testing will remain out of reach for most.

```mermaid flowchart TD accTitle: FoundationDB Deterministic Simulation Model accDescr: Diagram showing how a random seed is fed into a deterministic engine wrapping a distributed system to produce repeatable test outcomes.

subgraph Inputs ["Test Generation"] Seed["Random Seed"] Knobs["Tuned Failure Rates<br/>(Crash frequency, latency, drops)"] end

subgraph Core ["Deterministic Simulation Box"] Wrapper["FoundationDB Simulation Engine<br/>(Pure function abstraction)"] Workload["Workloads & State Machines"] Wrapper --- Workload end

subgraph Results ["Test Oracle Verification"] Asserts["Invariants & ACID Checks"] Green["Clean Run / Progress"] BugFound["Deterministic Failure Repro"] end

Seed --> Wrapper Knobs --> Wrapper Workload --> Asserts Asserts --> Green Asserts --> BugFound ```

[023:46] Test Oracles: Knowing When a Bug Has Occurred

Autonomous tests can execute millions of operations, but they are utterly useless if they cannot detect when an error has actually happened. Wilson classifies this as the problem of "test oracles." In simple software domains, this is straightforward: a crash, an out-of-memory error, or a triggered assertion immediately signals a bug. However, in more nuanced application domains, failure modes are subtle. In a graphical interface, for example, a bug might mean a border rendered five pixels too far to the right, or an entire window unexpectedly turned purple.

FoundationDB ran into this exact dilemma with database internals. High-level transactional guarantees and ACID invariants were far too complicated to capture with simple inline assertions. To verify correctness, the engineering team had to build dedicated testing workloads that initialized specific database invariants, ran randomized concurrent operations, and then exhaustively checked whether the invariant guarantees held intact at the end of the run.

[024:54] Why Use Autonomous Testing: Economics, Orthogonality, and Elasticity

Despite these formidable hurdles, Wilson argues that software teams should aggressively pursue autonomous testing. The primary argument is raw economics: computers are dramatically cheaper than human software engineers, especially those in the San Francisco Bay Area. Using machines to generate and run test variations allows a team to perform exponentially more testing than human-written scripts ever could.

Crucially, autonomous testing is not intended to replace handcrafted unit or integration suites. Humans and computers bring complementary perspectives to problem-solving. Human-written tests target common architectural expectations and workflows, whereas computers act as "total aliens" that easily wander into the dark, bizarre edge cases humans struggle to imagine. Pairing both produces a uniquely robust synthesis. Moreover, cloud infrastructure makes machine testing elastic and instantaneous:

- **Cost:** Compute instances cost pennies compared to the salaries of Bay Area software engineers. - **Complementary coverage:** Humans test expected code paths; machines explore counter-intuitive edge cases. - **Zero onboarding latency:** Unlike hiring, training, and feeding human developers, cloud instances can be booted and terminated on Amazon EC2 on demand.

[027:17] Compressing Bug Latency and Embarrassing Parallelism

The most compelling, yet subtle, argument for autonomous testing is reducing "bug latency"—the elapsed time between the introduction of a defect and its discovery. Wilson explains that the difficulty and cost of fixing a bug grow exponentially with the time that passes after it is written. If a pre-commit hook flags an issue immediately, the author still holds the entire mental model in their head and has the exact diff right in front of them, making the fix painless.

Wilson contrasts this ideal scenario with an operational nightmare: a developer introduces a subtle bug that slips past standard tests and ships into several releases; months later that developer leaves the company, and years down the road an on-call engineer receives an emergency midnight call from their largest production customer. Diagnosing whether a bug even exists in that scenario requires orders of magnitude more effort than fixing it on day one. Autonomous testing solves this because it is embarrassingly parallel: teams can burn a million CPU seconds across thousands of distributed cores in just a matter of seconds, driving discovery latency down to near zero. Wilson highlights the transformative effect: “It's going to repay you in money and productivity and frustration and everything so fast it's going to change your life it's going to change it's it's gonna qualitatively change the kinds of things your team can do.”

[029:49] The Future Vision: Building the Next Epochal Leap

Reflecting on the overarching problem, Wilson asks what it will take to make autonomous testing the universal standard for all software development. He compares the potential shift to the invention of the compiler—a monumental advancement after which writing raw machine code became restricted only to rare, exotic edge cases.

To bridge this gap and eliminate the friction of adopting simulation and fuzzing techniques, Wilson reveals that he and Dave Scherer have co-founded a new company. Their stated mission is to solve the adoption challenges, make autonomous testing turnkey for every developer, and revolutionize software reliability across the entire industry. As Wilson enthusiastically puts it: “Dave Scherer over there and I have recently started a company and our goal is to try and figure out the answer to this question and then thereby making autonomous testing super easy thereby making it universal thereby radically transforming the software industry thereby ushering in a new golden age of peace and prosperity for all mankind.” Although the venture is in its earliest stages, they have established a concrete technical roadmap to realize this vision and are looking to connect with interested engineers and collaborators.

[31:21](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1881s) Call for Collaborators, Early Customers, and Closing Remarks

Will Wilson concludes his presentation by extending an open invitation to anyone in the audience looking to collaborate or try out their approach. Specifically, he explains that they are actively searching for two categories of people: those interested in joining the team to work alongside them, and potential early customers facing particularly daunting quality assurance challenges. Elaborating on what kind of partner would be an ideal fit, Wilson describes them as “people who have really scary QA problems that they feel like they don't have a handle on and they think some of these techniques could maybe help because we have a prototype that might kind of work.”

Beyond formal business relationships or recruiting, Wilson expresses a genuine desire to connect with fellow enthusiasts in the broader software engineering community. He points out that deterministic simulation and autonomous testing remain relatively obscure concepts across the software industry, remarking: “I'm also just interested in talking to anybody who's into this stuff because this is still a really small niche world and not a lot of people think about this stuff and so if you do I would love to meet you.” Realizing that his session has run past its scheduled limit, he announces that he will not take questions from the stage, thanks the attendees, and concludes the talk to applause.

- Wilson is seeking both talent to join the initiative and early prospective customers dealing with critical, unmanageable QA issues. - The team has developed a working prototype testing these autonomous, simulation-based techniques. - Wilson highlights how niche this corner of testing and systems engineering currently is, encouraging anyone passionate about the subject to reach out.

## Notable quotes > [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) If we were smart enough or had the right kind of brains to write all the tests we needed to write, then we would have just written the code correctly in the first place. — Will Wilson

> [16:13](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=973s) Humans debug software; humans are not mystical Turing Oracles—if humans can do it, then so can computers. — Will Wilson

## Mentioned Will Wilson, FoundationDB, Moore's law, Gartner, Forrester, Jenkins, Haskell, Apple, Evan, Ben, Dave Scherer, Amazon EC2

[Source](https://www.youtube.com/watch?v=fFSPwJFXVlw)

中文简报

FoundationDB前成员Wilson创立新公司以实现测试编写自动化 由于开发者无法在大脑中穷尽其未能编写防御代码的复杂故障状态,软件工程必须从手动编写测试转向机器自主生成。 Will Wilson认为软件工程仍处于原始初级阶段,缺陷重重且脆弱的测试实践目前浪费了开发者一半以上的工作效率。受FoundationDB确定性模拟方法的启发,他提议从传统的自动化测试执行转向“自主测试”——即能够自动合成并探索测试用例的系统。尽管在庞大的执行状态空间中进行搜索并设计出恰当的测试预言机(test oracles)面临巨大挑战,但Wilson断言,自主测试能够大幅压缩缺陷延迟,并捕获人类无法想象的灾难性边缘情况。在总结中,他宣布与Dave Scherer共同创立了一家新企业,旨在让自主测试成为全行业即开即用且普遍可采用的方案。 尽管行业分析师估计测试约占软件开发工作量的30%,但现实中的摩擦——包括问题分类排查、下游依赖库缓解措施以及宕机后果——使真实成本推高至开发者时间的50%以上,在全球范围内造成数万亿美元的浪费。 (4:52) 软件行业将通过CI/CD进行的自动化测试执行与自动化测试本身混为一谈,掩盖了测试编写仍是纯人工且费时费力的人类瓶颈这一亟待颠覆的现实。 (14:05) 分支覆盖率在分布式系统中会带来虚假的安全感,无法在数学上受限于256的输入字节数次方的执行历史搜索空间中,捕获关键的并发和时序缺陷。 (10:44) 自主测试利用云端弹性和易并行性,将“缺陷延迟”(即写出缺陷到检测出缺陷之间的时间)从数月压缩至数秒,从而大幅降低修复成本。 (27:17)

Reading summary

Former FoundationDB engineer Will Wilson argues that conventional software testing wastes over half of developer productivity on fragile, human-authored test suites, and proposes shifting to 'autonomous testing' where systems continuously generate test cases to rapidly uncover obscure failure modes. The Compounding Overhead of Conventional Testing (4:52) While analyst firms estimate that testing and quality assurance consume roughly 30% of development effort, Wilson contends the true overhead exceeds 50% once developers factor in triaging uncaught bugs, mitigating third-party dependencies, and resolving production outages. Scaled globally, this friction absorbs trillions of dollars in engineering output. Wilson observes that conventional test suites exacerbate this cost through non-deterministic flakiness and fragility, where tests rely on incidental implementation details—such as timing delays or input polling—rather than invariant guarantees. Shifting from Automated Execution to Autonomous Generation (14:05) Wilson argues that what the industry labels 'automated testing' merely automates test execution through continuous integration runners, while test creation remains an entirely manual, repetitive human task. In contrast, 'autonomous testing' delegates the continuous generation of novel, complex test cases to software. While early forms exist in fuzzing and property-based testing, comprehensive autonomous systems like FoundationDB's deterministic simulator treat distributed architectures as pure functions driven by pseudo-random seeds. Wilson dismisses theoretical objections based on the Turing halting problem, noting that testing software does not require an omniscient Turing oracle—it only needs to exceed fallible human capabilities. State Space Navigation and Implementation Hurdles (19:54) The central technical challenge of autonomous testing lies in searching through an execution history space sized at 256 raised to the power of the number of input bytes. Navigating this vast space requires delicate parameter tuning; failure rates and randomized faults must be balanced so processes encounter rare edge cases without stalling forward progress. If tuned poorly, test suites can fail silently by reporting green runs while missing critical flaws. Additionally, autonomous frameworks require effective test oracles to identify subtle semantic errors, such as violated transactional invariants or graphical anomalies, which simple crash assertions miss. Wilson acknowledges that deterministic simulation has historically demanded that software be architected around determinism from inception, posing a severe adoption barrier for existing legacy codebases. Economic Asymmetry and Bug Latency Compression The core justification for autonomous testing rests on the economic disparity between cheap, elastic cloud compute and expensive engineering labor. Rather than replacing human testers, autonomous engines operate complementarily: human engineers verify expected operational workflows, while automated generators probe unconventional, alien edge cases. Furthermore, Wilson highlights that the cost of resolving defects increases exponentially over time. Traditional development allows subtle bugs to linger unnoticed across multiple releases, leaving downstream teams to diagnose legacy defects years later. Because autonomous test generation is embarrassingly parallel across distributed cores, teams can burn millions of CPU seconds in minutes, driving discovery latency down to near zero immediately after code is written. Wilson concludes that establishing autonomous testing as an industry standard could mirror the transformative impact of the compiler, though retrofitting simulation techniques onto legacy systems remains an unresolved practical challenge. To address this friction, Wilson and co-founder Dave Scherer have established an early-stage venture focused on building turnkey autonomous testing prototypes.

精炼阅读摘要

Will Wilson指出软件工程仍处于极其早期的发展阶段,而传统软件测试作为行业最大的效率黑洞消耗了过半的研发精力;行业必须从人工编写测试用例转向由机器自动生成并运行用例的“自主测试”,以从根本上降低缺陷潜伏期与系统验证成本。 软件工程早期特征与测试的真实成本 (4:52) 软件行业常将摩尔定律视为计算技术特异性的证据,但历史数据显示,纺织业产出、蒸汽机热效率以及人造金刚石在早期均经历过类似的指数级增长。Wilson认为,指数级增长往往源于起步基线极为原始,计算科学尚未收敛至经典技术的逻辑斯蒂平缓曲线。这意味着软件工程仍处于拓荒期,人类文明绝大多数软件尚未被编写,当下任何基础性工程改进都将在漫长时间跨度中释放复利。 寻找颠覆性技术变革的有效方法是聚焦当前最痛苦、低效的环节,而软件测试正是典型代表。分析机构如Gartner与Forrester通常估计测试与质量保证占研发工作量的30%左右,但Wilson认为这一评估严重低估。若纳入编写用例、排查漏测缺陷、规避底层第三方依赖漏洞、线上故障抢修以及客户公关损失,测试实际耗费了工程师50%以上的时间,在全球范围内造成了以数万亿美元计的生产力损失。 伪自动化现状与人类认知的固有局限 (10:44) 当前行业所谓的“自动化测试”本质上仍是手工劳动,因为工程团队仅仅实现了通过CI/CD工具运行用例这最简单的一步,测试用例本身依旧完全依赖人工编写。这种模式不仅面临测试不确定性(Flakiness)对调试信心的侵蚀,还饱受测试脆弱性(Fragility)的困扰——用例往往依赖时间延迟、界面位置等偶发实现细节而非系统不变量,极易在代码变更后失效或发生“伪通过”(fail open)。Wilson援引实际案例指出,大型科技公司的开发者曾因用例频繁误报而将其禁用,导致灾难性的线上故障直接漏网。 更为根本的瓶颈在于人类先验假设的认知局限。Wilson分析称,人类之所以依赖测试,是因为人脑无法预判复杂的异步线程交错和分布式故障分支;但这种认知缺陷同样意味着人类根本写不出覆盖这些极端场景的用例。盲目追求100%分支覆盖率在此类问题面前是徒劳的,它既无法识别分布式系统中的执行时序冲突,也无法穷尽图灵完备系统的复杂行为。 自主测试的核心理念与工程落地壁垒 (14:05) 为突破测试困境,Wilson将FoundationDB的核心实践提炼为“自主测试”(Autonomous Testing):工程团队不再孤立地针对新功能编写静态用例,而是设计能够永续自动生成新颖测试的生成系统。尽管业界已有模糊测试(Fuzzing)与基于属性的测试(Property-based Testing)等先例,但自主测试在大规模推广上面临严峻的工程壁垒。首先是搜索空间的爆炸,执行历史的可能状态空间高达256的N次方(N为输入字节数),随机测试极易在浩瀚空间中徒劳遍历。 其次是系统调优与架构限制。自主测试要求精密调节故障注入概率(如节点崩溃频率与网络丢包延迟),一旦调优失衡导致测试全部盲目通过,就会产生致命的虚假安全感。此外,现有技术高度依赖特定的系统架构——例如FoundationDB在立项之初就将分布式系统抽象为接受伪随机种子的纯函数以实现确定性仿真,这对于维护庞大遗留代码库的普通团队而言几乎难以事后改造;最后,复杂的ACID和事务不变量也给判定系统是否出错的“测试预言机”(Test Oracle)设计带来了极高难度。 机器经济学优势与缺陷潜伏期的极限压缩 尽管存在落地挑战,Wilson认为自主测试具备不可替代的经济与技术优势。从经济学角度看,云端计算实例的调用成本微乎其微,具备随开随用的弹性,远低于昂贵的软件工程师薪酬。同时,机器与人类的思维模式正交互补:人工用例专注于常规业务预期路径,而机器生成用例则像“外星人”一样可以肆意穿梭于人类难以想象的诡异边缘状态。 自主测试最核心的价值在于压缩“缺陷潜伏期”(Bug Latency)。缺陷修复的成本与难度随时间推移呈指数级飙升:若代码提交时即刻报错,作者凭借刚写完代码的记忆上下文便能迅速修复;一旦缺陷潜伏数月至数年并流向生产环境,排查与修复代价将呈数量级放大。借助易并行性(Embarrassingly Parallel),团队能在数秒内将数百万CPU秒的测试负荷分发至数千个云端计算核心上,在几秒内完成海量状态探索,将缺陷反馈延迟彻底压缩至近乎为零。 Wilson认为自主测试终将像高级语言编译器取代手写机器码一样重塑软件工业。为此,他与Dave Scherer创办了新公司,致力于降低确定性仿真与自主测试的技术门槛,并面向业界寻找面临复杂QA困境的早期合作团队与研发人才。

Detailed notes — zh

## Background 该视频由 The Linux Foundation 于 2018 年 12 月 20 日发布在 YouTube 平台上。视频记录了前 FoundationDB 核心成员 Will Wilson 发表的主题演讲,虽然官方未提供详细简介,但演讲聚焦于自主测试(Autonomous Testing)以及软件开发未来的变革方向。 ## TL;DR Will Wilson 在演讲中指出,软件行业仍处于极其原始的早期阶段,而占据工程师至少 50% 时间的测试与缺陷排查是当前最痛苦、效率最低的环节。针对人工手写测试在非确定性、脆弱性以及无法覆盖“未知缺陷”上的致命局限,他提出了“自主测试”范式,主张由机器自动、持续地生成测试用例。尽管面临调优陷阱、架构改造以及测试先知(Test Oracles)等现实阻碍,但借助机器算力成本的优势和极致的并行化能力,自主测试能将引入 Bug 到修复 Bug 之间的延迟压缩到极致,从而重塑软件工程的研发上限。 ## Atmosphere & style 整场演讲幽默风趣却又极具批判锋芒。Wilson 开场便用调侃摩尔定律的幻灯片段子打破技术傲慢,随后层层递进地展开严密剖析,将工程界忍受不稳定测试与手工编写测试的无奈揭露得淋漓尽致。现场氛围兼具反思与开拓精神,既有面对庞大状态搜索空间的工程严谨,又洋溢着如同见证“编译器诞生”般的理想主义激情。 ## Bulletin - [00:00](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=0s) 摩尔定律的指数增长并不代表软件业独一无二,反而证明软件行业仍处于发展极早期的原始阶段,蕴藏着巨大的工程变革与重构机会。 - [04:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=260s) 测试和缺陷处理吞噬了软件工程师 50% 以上的时间,但当前的“自动化测试”本质仍是昂贵人力在手工编写用例,全行业亟需向机器生成用例的“自主测试”转型。 - [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) 人类思维天然存在盲区,根本写不出能覆盖所有未知状态与时序交叉的测试;自主测试与人类测试形成互补,能专门围剿复杂的边缘缺陷。 - [27:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1640s) 修复 Bug 的代价与 Bug 存活的时间严格成正比;自主测试具备高度可并行特性,可借助海量算力将长达数年的缺陷发现延迟压缩至数秒。 ## Key takeaways - [00:00](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=0s) 摩尔定律的指数增长在历史上各项技术初生期极为常见,它揭示的现实是软件工程仍处极早期,未来代码量远超现在,因此基础工程工具改进享有极长回报周期。 - [04:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=260s) 写测试、修测试缺陷、修漏网缺陷及排查底层 Bug 消耗了开发者至少 50% 的精力,软件测试是全行业吞噬数万亿美元生产力且最痛苦的环节。 - [07:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=464s) 非确定性测试(Flaky Tests)破坏调试信心,导致团队麻木并习惯性忽略警报;脆弱测试(Fragile Tests)因绑定偶发实现,微小重构即造成测试失效或发散。 - [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) 代码改动后测试继续绿灯但已测不到目标(fail open),成为虚假安全感来源;更存在工程师因测试频繁挂掉而在提交致命 Bug 时顺手关闭测试的荒唐事故。 - [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) 人类写测试的逻辑悖论:人类大脑不擅长推演复杂分支与并发时序才写出 Bug,这同样决定了人类大脑无法写出覆盖这些未知盲区的测试用例,100% 分支覆盖率并不等于测完行为。 - [14:05](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=845s) 业界的“自动化测试”多为用 CI 脚本自动化执行测试,核心的用例构造仍是高昂人力的纯手工劳动;“自主测试(Autonomous Testing)”的核心范式是构建能够永续自动生成新测试的系统。 - [14:05](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=845s) 模糊测试(Fuzzing)与基于属性的测试(Property-based Testing)是自主测试的典型形态,FoundationDB 的 Document Layer 便深度运用了基于属性的测试。 - [17:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1074s) 拿停机问题否定软件测试软件是伪辩驳;自主测试面临的真正壁垒是执行历史的搜索空间过于庞大(256 的输入字节总数次方),必须精准命中高价值缺陷区域。 - [21:07](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1267s) 自主测试落地面临三大严峻壁垒:测试环境旋钮调优极其艰难且失败模式为静默全绿;现有遗留系统架构难以改造成确定性黑盒;复杂业务不变量的测试先知(Oracles)极难判定。 - [24:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1494s) 转向自主测试具备经济与认知双重必然性:机器算力远比湾区工程师便宜且支持弹性伸缩;人类擅长业务逻辑,异构的计算机则擅长发掘人类大脑难以推演的并发与边界缺陷。 - [27:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1640s) 修复缺陷的成本随着 Bug 存活时间呈指数级上升;现场拦截只需几分钟,数年后线上排查往往代价极其惨重且难以复现。 - [27:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1640s) 自主测试属于易并行问题,可借助阿姆达尔定律将单核运行 1,000,000 秒的测试分摊至百万核心并在数秒内完成,将缺陷发现延迟压缩到极致。 - [29:49](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1789s) 软件工程亟需迎来如同“编译器诞生”般的划时代飞跃,让手写测试像手写汇编指令一样仅在少数特例中出现;Will Wilson 与 Dave Scherer 创办新公司致力于降低自主测试门槛。 ## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=0s) 摩尔定律假象与早期软件时代 Will Wilson 在开场时幽默地提及自己早在“远古时期”就曾在 FoundationDB 工作,如今虽转向其他领域,但受邀在软件大会上发表关于宏观前景的演讲。他调侃称,做这种宏观演讲的人在合同上都“有义务”用一张展示摩尔定律(Moore's law)的幻灯片开头。现场的幻灯片翻页器出现了一点小故障,随后屏幕上出现了一条标准的指数上升曲线,横轴是年份,纵轴看起来像是时钟频率。然而他定睛一看,假装惊讶地发现放错了幻灯片:纵轴并不是时钟频率,也不是硬盘存储密度,而是“纺织生产力”(weaving and spinning productivity)。 换到下一张图,依然是熟悉的对数坐标纵轴和漂亮的指数增长曲线,结果显示这其实是“蒸汽机效率”(steam engine efficiency)的发展图;再试一次,横轴甚至是摩尔定律实际生效的年份区间,结果曲线记录的却是“工业金刚石”(industrial diamonds)的产量。 这一系列玩笑背后的核心观点是:整个软件及计算机行业往往有一种盲目的傲慢,误以为自身是人类历史上独一无二的技术奇迹。人们总是惊叹摩尔定律带来的底层硬件指数级飞跃,并追问人类历史上何曾有过类似的发展。然而事实上,这种指数增长在各项技术的诞生初期屡见不鲜: > “指数增长在一开始其实非常容易实现,因为那时你手头拥有的东西实在太原始了。”(“exponential growth is really really easy when what you have is really really primitive”) 因此,摩尔定律的存在并不能证明软件行业有多么特殊,它真正揭示的真相是:**软件行业仍处于极其原始的早期阶段**,整个行业还没有进入技术发展中必然会遭遇的逻辑斯蒂增长(S 型曲线)放缓阶段。认识到这一点并不让人沮丧,反而让人感到充满力量,因为这意味着今天的开发者同样能够成为拓荒者,六七十年代的前辈并未把所有的乐趣占尽。处于早期阶段意味着软件工程蕴藏着发生彻底变革(radical transformations)的巨大机遇:不仅有大量唾手可得的低垂果实(low-hanging fruit),而且未来要编写的代码体量将远远超过目前已写出的代码,此时做出的流程与工程改进将享有极其漫长的回报周期。 ### [04:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=260s) 寻找彻底变革的突破口:为何是测试? 在谈及软件工程未来的彻底变革时,Will Wilson 指出人们很容易联想到新编程语言,或是范畴论(Category Theory)等高深理论颠覆开发方式;抑或是从社会学和经济学角度探讨软件工程师群体构成的转变。但他选择避开这些话题,直奔“软件测试”(testing)。他提出了一个寻找重大变革机会的实用经验法则:**去观察当前软件开发中究竟哪一部分最糟糕、最痛苦、最费力不讨好,而测试完全符合这些特征。** 根据 Gartner 或 Forrester 等分析机构的报告,软件开发中有 30% 的精力花在测试或广义的 QA 上。Will Wilson 认为这个估算严重低估了现实: > “如果你把写测试的时间、修复测试发现的 Bug 的时间、修复测试没能发现的 Bug 的时间,以及为了绕过和缓解底层那些家伙没修的 Bug 所耗费的时间全加在一起……我们至少要花掉 50% 的时间,而且我觉得我并不是什么特例。”(“you add together the amount of time you spend writing tests the amount of time you spend fixing the bugs that your tests turn up the amount of time you spend fixing the bugs your tests don't turn up the amount of time you spend working around and dealing with and mitigating all the bugs in the layers below you that they haven't fixed those jerks all the time and effort that goes into dealing with the fallout of inadequate testing the outages the economic damage right like that's like we're talking at least 50% of my time and I don't think I'm extremely unusual”) 全世界的软件工程师在这个泥潭中耗费了以数万亿美元计的生产力。如果能够消除这种浪费或大幅提高测试效率,软件行业将迎来根本性的蜕变。FoundationDB 在行业内因其与众不同的测试哲学而闻名:测试在 FoundationDB 不是一种折磨,也没有吸干开发者的精力。Evan 和 Ben 等人在前面的分享中已经介绍过 FoundationDB 基于确定性模拟(deterministic simulation)的测试方案,因此 Will Wilson 并不打算重述细节,而是希望将 FoundationDB 的做法重新置于更广阔的测试范式中进行审视,探讨行业为何没有普遍采用这些方案,以及为何实际上必须采用。 ```mermaid flowchart TD accTitle: 测试中的时间消耗构成 accDescr: 展示开发者在日常测试及处理缺陷衍生问题时所耗费的时间分布流程 subgraph DirectWork["直接测试工作"] A["编写测试用例"] B["修复测试捕获的 Bug"] end subgraph IndirectWork["间接应对与缺陷代价"] C["排查测试遗漏的线上 Bug"] D["规避底层依赖未修复的缺陷"] E["处理故障停机与经济损失"] end DirectWork --> F["消耗开发精力"] IndirectWork --> F F --> G["占据开发者 50% 以上时间<br/>(吞噬数万亿美元生产力)"] ``` ### [07:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=464s) 测试的两大痼疾:不确定性与脆弱性 在展开新技术方案之前,演讲深入剖析了当今测试之所以令人痛苦的深层原因。第一个臭名昭著的根源是**非确定性(Non-determinism / Flaky Tests)**。一旦测试依赖外部服务,或者运行在存在轻微扰动的环境中,就会不可避免地出现每运行 100 次失败 1 次、或每 10,000 次失败 1 次的偶发故障。这种“不稳定测试”在维护上是彻头彻尾的噩梦:它彻底摧毁了调试时的信心,开发者修完代码也无法确定问题是否真正解决;更危险的是,长此以往团队会产生倦怠心理,一旦测试红屏,大家第一反应往往是“这只是个已知的不稳定测试罢了”,直接选择忽略,导致真实致命的隐患蒙混过关。尽管 FoundationDB 团队依靠确定性模拟测试技术夺回了测试的确定性,但放眼整个软件界,绝大多数团队仍然停留在忍受不稳定测试煎熬的“黑暗时代”。 第二个核心问题则是**测试的脆弱性(Fragility)**。脆弱的测试往往会在无意中依赖系统的次要偶然特征,而不是被测的核心逻辑。Wilson 以 2D 平台跳跃类游戏的测试为例:一种简单的测试思路是录制输入序列——按住右方向键 6.7 秒,接着按跳跃键 3.2 秒,然后射击敌人,最后断言某个结果。只要系统稍微改动任意一处细枝末节(微调关卡布局、调整物理引擎参数、改变输入采样率,甚至仅仅换一台性能不同的机器运行),该测试就会立即失败。类似的问题在 UI 自动化测试和分布式系统测试中极为普遍:在分布式系统测试中按固定顺序重放事件序列时,只要前半程发生微小的行为偏离,后续的测试轨迹就会彻底走偏,完全背离了原本设计的验证目标。这种脆弱性与非确定性一样,会演变成沉重的维护负担,最终诱使工程师对其视而不见,给生产环境埋下发生灾难性停机的隐患。 - **非确定性测试的危害**:破坏调试信心、无法确认 Bug 是否真正修复、催生忽略测试失败的恶习。 - **脆弱性测试的本质**:测试逻辑被底层偶发实现绑定,轻微代码重构或环境微调即导致测试完全失效与测试历史发散。 ### [10:44](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=644s) 脆弱测试的失效模式与人工编写测试的逻辑悖论 Will Wilson 首先举了一个匿名的业界真实案例:一家他不便透露名称的巨头公司,曾经发生过一次极其荒唐的大型事故——工程师提交的同一笔代码,不仅引入了引发全网严重宕机的大故障,还顺手关闭了本该提前警告他们这次事故的测试用例。而工程师之所以随手把测试关掉,是因为“大家都知道那个测试每次只要有人提交代码就会挂”。除了这种因为脆弱(fragile)而被弃用的情况,更隐蔽、更危险的失效模式是测试“完全失效却依然放行(fail open)”:你改动了某处代码,测试虽然还在绿灯通过,但它绿的原因已经和你以为的完全不一样了。测试变成了虚假安全感的来源,而业界对此基本上毫无招架之力。 ```mermaid flowchart TD accTitle: 测试盲区与认知悖论 accDescr: 解释人类思维盲区如何导致编写的代码存在漏洞,且同样导致编写的测试无法覆盖这些漏洞。 subgraph Limitations["人类思维局限"] A["无法穷尽所有控制流分支"] B["无法预料线程或异步交错顺序"] C["无法预判分布式算法故障点与形态"] end Limitations --> D["写出的业务代码必然含有隐蔽缺陷"] Limitations --> E["写出的测试用例同样存在盲区"] E --> F["测试沦为单纯的回归检测工具"] F --> G["对“未知的未知(Unknown Unknowns)”完全束手无策"] ``` 即便能写出既不脆弱也不忽闪(flaky)的测试,它也极大概率测不到正确的东西。Will Wilson 提出了一个近乎分析性证明的严谨论点:人类写测试的根本原因,在于人类的大脑天生极不擅长思考程序可能经历的所有控制流分支、线程交替执行的各种时序、或是分布式算法在执行过程中可能爆发的故障点及其表现形式。然而这一事实恰恰构成了一个死结:正因为人类的大脑有这个缺陷,人类也同样写不出能覆盖所有这些真实盲点的测试用例。“因为如果我们足够聪明、脑力足够强,能写出所有必须的测试,那我们一开始直接把业务代码写对不就行了吗?”因此,当前手写测试的宿命就是:它或许能抓到已知的倒退(regressions),但对于“未知的未知(unknown unknowns)”,它几乎彻底无能为力。 - 追求 100% 分支覆盖率(Branch Coverage)并不能解决问题:在分布式系统中,哪怕拿到了 100% 的分支覆盖率,只要代码在进程 A 上先于进程 B 执行就会触发 Bug,这个 Bug 依然会被完全漏掉。 - 即便是在单机环境(如编写一个 Python 解释器),拿到 100% 分支覆盖率也毫不意味着测完了所有有趣的行为,因为 Python 是图灵完备的语言,其背后有无穷无尽的有趣行为尚未被触及。 ### [14:05](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=845s) “自主测试”的提出与 FoundationDB 的设计哲学 Will Wilson 尖锐地指出,软件行业面临的所有测试难题,本质上都是因为“测试至今依然是一项完全纯手工的劳动”。业界目前所谓的“自动化测试”根本谈不上自动化,人们仅仅把其中最弱智的一步给自动化了——那就是自动执行测试脚本,绝大多数人眼里的自动化不过是挂个 Jenkins 在后台跑脚本而已。而在所有这些测试用例背后,全都是高薪雇来的聪明工程师,坐在工位上日复一日进行着极其繁重、机械、枯燥的手工编写工作。如果有任何其他行业充斥着大量高薪人才做着这种纯手工重复劳动,投资人和 VC 早就高呼“这个行业该被颠覆了”——软件工程本身恰恰就是这个亟待被颠覆的行业。 这正是当年 FoundationDB 最核心的秘密武器。外界往往以为 FoundationDB 的精髓只是确定性模拟(Deterministic Simulation),但更深层的差异在于思想范式的转变。FoundationDB 的工程文化从不问“我该怎么写几个测试来覆盖新功能”,而是思考“我该怎么写一个系统,让它能够源源不断、永久自动生成全新且有趣的测试来压测新功能”。为了把这种“自动生成测试”与单纯的“自动执行测试”区分开来,Will Wilson 将其正式定义为“自主测试(Autonomous Testing)”。 “针对一段新功能,我们不会去想‘我怎么写几个测试来覆盖它’,而是去想‘我怎么构建一个能够永远不断生成全新、有趣的测试来锻炼它的系统’。”——Will Wilson - **模糊测试(Fuzzing)**:这是自主测试的一种原始形态。比如写一个解析不可信网络字节流的解析器,如果只写几个单元测试,那解析器绝对千疮百孔;正确的做法是用 Fuzzer 灌入数以千万计的随机输入,观察程序是否会崩溃。 - **基于属性的测试(Property-based Testing)**:源自 Haskell 等函数式编程圈子。只要模块或数据结构拥有清晰的接口,工程师只需定义其契约与保证,让计算机自动去寻找打破这一契约的反例。 - FoundationDB 的 Document Layer(刚被苹果公司开源)在研发过程中,就极度广泛且详尽地使用了基于属性的测试。 ### [17:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1074s) 停机问题的谬论与自主测试面临的真实空间挑战 既然自主测试效果如此惊人,为什么全行业没有普及开来?Will Wilson 提到,他在职业生涯中经常听到一个极其糟糕的反驳借口:“图灵停机问题已经证明了软件永远不可能去测试软件”。反对此观点的人往往会给出这类辩驳:如果你的系统能查 Bug,那我就能写一个“当且仅当黎曼猜想为真时才会崩溃”的程序,逼得你的测试系统必须先解开整个数学界的所有难题才能测出 Bug。Wilson 认为这种说法非常荒唐,就像拿 CAP 定理来证明“世界上不可能做出优秀的分布式数据库”一样,是用毫无现实意义的理论不可能结果来转移焦点。人类从来就不是什么通晓一切的“图灵神谕(Turing Oracle)”,人类能够调试软件,计算机同样也可以做到。自动化工具不需要做到能在所有程序里找出每一个 Bug,只要它比人类更敏锐、比人类更快、比人类规模化能力更强,就足够了。 真正阻碍自主测试普及的,是一个与停机问题密切相关的、极度硬核的技术现实:自主探索的搜索空间庞大到了令人发指的地步。在寻找程序漏洞时,本质上是在探索该程序所有可能的执行历史空间。这个空间的大小,等同于 256 的“程序所接收过的输入字节总数”次方。在这个广袤到超出宇宙尺度的超大空间里,盲目漫游很可能在某个微不足道的角落耗尽整个宇宙的寿命都一无所获。如何在极短的时间内,精准命中这片广袤空间中最具价值、最容易引发问题的核心区域,正是自主测试领域最艰难、也最硬核的挑战。 ### [21:07](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1267s) 自主测试落地面临的三大残酷壁垒:调优陷阱、架构改造与测试先知 在自主测试技术真正落地时,许多团队往往会“触礁翻船”。Will Wilson 指出,在研发 FoundationDB 时,团队成员 Evan 投入了超乎寻常的心血去反复调试系统中的各种旋钮,对参数进行细致入微的调优。如果让进程崩溃得过于频繁,测试便寸步难行;但如果崩溃得不够多,又根本无法暴露出有价值的深层边界缺陷。这项工作不仅需要对底层系统有着极其深厚的理解,而且过程极为磨人。更可怕的是调优失误所带来的失败后果——当测试报告绿灯闪烁、显示一切安好时,系统可能早已千疮百孔。Will Wilson 强调:“And if you get it wrong, the failure mode is your tests say everything's good.” 这种静默失效是开发者的噩梦,团队只能寄希望于存在某种副通道来告知系统其实有问题,并且由衷祈祷这个“副通道”千万不要是自己的最终客户。 ```mermaid flowchart TD accTitle: 自主测试的核心障碍与失败链条 accDescr: 展示环境调优失误、遗留系统难以改造以及断言复杂度过高导致的系统隐性风险。 subgraph Knobs["旋钮调优失衡"] CrashHigh["崩溃过于频繁\n(系统停滞不前)"] CrashLow["崩溃频率过低\n(缺陷无法暴露)"] end subgraph Failure["致命失败模式"] SilentGreen["测试全部亮绿灯\n'Everything is good'"] CustomerBug["生产事故:客户成为报警副通道"] end CrashLow --> SilentGreen SilentGreen --> CustomerBug ``` 除了调优之难,更大的普及壁垒在于软件本身的组织形式。所有自主测试技术,无论具体实现方式有多大差异,都极度依赖被测软件具备契合测试的特定架构。FoundationDB 庞大的确定性模拟系统的本质,就是将一个极其繁杂、沉重且充满状态的分布式系统收拢成一个黑盒——它将系统伪装成一个纯函数,仅仅接受一个随机数种子作为输入即可完成推演。FoundationDB 之所以能做到这点,完全归功于团队初期令人惊叹的远见卓识。然而,现实中的绝大多数团队根本不具备这种奢侈的条件:他们要么在维护上世纪 90 年代遗留下来的 Java 庞然巨兽,要么在业务压力面前分秒必争。几乎没有工程团队会在开工写分布式数据库前,先耗费整整一年去编写一个确定性模拟器。只要这些测试技术依然无法在事后低成本地直接加装到现有软件上,它们的普适性就会受到极大的限制。 最后一项严峻阻碍则是所谓的“测试先知”(Test Oracles),即测试系统在自主触发海量行为后,究竟能否准确识别并汇报 Bug 的出现。如果软件的需求仅仅是不崩溃、不发生内存耗尽或不触发断言,那么判断异常相对简单;但如果在图形界面程序中,Bug 表现为“某个边框向右偏移了 5 个像素”或“屏幕突然变成了紫色”,检测难度就会呈指数级上升。即使在纯后台的 FoundationDB 中,复杂的 ACID 数据库不变量也远远不是一条简单的 `assert` 语句所能判定的。工程团队不得不专门设计出一整套专用的工作负载,先在模拟环境中构造出严苛的不变量条件,并在运行结束后全方位核验这些规则是否依然成立。 --- ### [24:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1494s) 机器替代与人机合成:为什么依然必须拥抱自主测试 尽管挑战重重,Will Wilson 仍坚信工程界必须全力转向自主测试,其首要且最显而易见的驱动力就是经济成本。在计算机与人力之间,机器的算力成本远比昂贵的软件工程师便宜得多,尤其是在旧金山湾区。让机器替代人工去编写和执行测试,不仅意味着测试的执行频次能够成千上万倍地增加,更重要的是能带来质的差异。面对有人质疑这是否意味着要把“精心打造的手工测试套件扔进垃圾桶”,Will Wilson 给予了坚决的否定:传统测试针对的是人类能够理解的业务逻辑,而计算机则是一个完全异质的“外星人”,它天然擅长发掘那些人类大脑极易忽略、极不擅长推演的阴暗边界条件。Will Wilson 评价道:“Humans will find some bugs, computers will find others, and this like beautiful synthesis of man and machine will come together and it's just it's awesome.” - **成本降维打击**:湾区软件工程师的薪资与云端算力相比极其高昂,将人力从密集编写重复用例中解放出来可带来巨大的经济效益。 - **人机认知互补**:人类负责编写符合业务预期逻辑的测试,自主算法作为完全异构的系统思维,专门围剿并发时序与非确定性深坑。 - **极致的弹性调度**:雇佣工程师需要漫长的招聘、培训周期,且人需要进食与睡眠;而云端服务器可以通过 API 随时按需租用并在几秒内关闭,满足测试算力从常态化水平到海量峰值的瞬间切换。 --- ### [27:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1640s) 缺陷延迟与并行化:将千万秒测试压缩进指尖之间 在自主测试的所有优势中,Will Wilson 认为最幽微但最震撼的力量在于对“缺陷发现延迟”(Latency)的压缩。这里的延迟指的并非单次测试运行耗时,而是“从引入一个 Bug 到测试真正把它逮住”所经历的时间跨度。修复缺陷所需的代价,几乎完全与该缺陷存活的时间成正比。Will Wilson 对比了两个截然不同的场景: ```mermaid flowchart LR accTitle: 两种 Bug 修复场景的延迟与代价对比 accDescr: 场景一对照场景二,展示延迟极低与延迟长达数年对排查成本造成的指数级恶化。 subgraph Scene1["场景一:零延迟反馈"] direction TB Commit["代码提交"] --> PreHook["Pre-submit Hook 拦截"] PreHook --> BrainState["上下文全在大脑中\n看着 Diff 几分钟修复"] end subgraph Scene2["场景二:高延迟恶梦"] direction TB Slip1["遗漏进发版"] --> Slip2["六个月后同事离职"] Slip2 --> Slip3["四年后深夜 On-call 报警"] Slip3 --> Disaster["耗费数月甚至无法复现"] end ``` 在场景一中,开发者刚刚敲完代码触发提交钩子(Pre-submit Hook),系统当场报警阻止提交。此时所有推理逻辑与上下文都完整保存在开发者的脑海里,眼前就是几行代码的 Git Diff,定位并修正它不过举手之劳。而在场景二中,缺陷逃过了单元测试与发版测试并随版本上线;六个月后引入该 Bug 的同事离职;四年之后,系统最大的核心生产客户在深更半夜打来报警电话。在后一种情况下,即使这只是一个原本由单行代码引起的错误,仅弄清楚“到底是不是 Bug”所耗费的成本与精力,都要比当初直接修复高出数个数量级。Will Wilson 总结道:“The amount of effort it takes to fix a bug is extremely strongly tied to how long it's been since that bug was caused.” 所幸自主测试本身属于“易并行问题”(Embarrassingly parallel problem)。得益于阿姆达尔定律在完全解耦场景下的理想表现,工程团队完全可以将原本需要单核运行 1,000,000 秒的测试任务,分散调度到 100 万个 CPU 核心上,在 1 秒或 5 秒钟内瞬间完成。只要团队愿意为算力买单,就能将引入 Bug 到修复 Bug 之间的延迟压缩到无限接近于零。这种研发节奏的跨越,不仅能在金钱、生产力和挫败感消除上给予团队数倍的回报,更能从质上彻底重塑一个技术团队的研发能力上限。 --- ### [29:49](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1789s) 探寻软件工程的“编译器时刻” 在演讲即将收尾之际,Will Wilson 重新抛出了开篇的核心命题:既然自主测试前景如此诱人,为什么整个软件行业至今仍未能让机器全面接管测试?尽管客观存在架构改造难、断言难等技术壁垒,但软件界究竟需要怎样的变革,才能迎来如同“编译器诞生”一般的划时代飞跃——使得手写测试如同手写汇编指令一样,只在极少数特殊、罕见的场景下才被考虑? 坦白承认自己目前也没有完整答案的 Will Wilson 透露,他与坐在台下的 Dave Scherer 已经联合创办了一家新公司,其唯一的核心使命就是攻克这一行业难题。他们希望通过降低自主测试的接入门槛,使其变得极其简单和无处不在,进而自嘲般地笑称要“以此彻底重塑软件工业,并为全人类迎来一个和平与繁荣的新黄金时代”。尽管项目仍处于非常早期的阶段,但他们已经勾勒出了一幅清晰的技术路线图,并当场向参会的同行与潜在伙伴抛出橄榄枝,期待共同推进这一软件工程范式的代际转移。 ### [31:21](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1881s) 寻求团队伙伴、早期客户与小众同行交流 在演讲的尾声,Will Wilson 向现场观众抛出了橄榄枝,说明团队目前正在积极寻找两类关键人群:一是可能对加入他们团队一同工作感兴趣的技术人才;二则是合适的早期客户(early customers)。针对后者,Will Wilson 形象且坦率地解释了他们的目标客户群体到底是什么样的人,正如他所描述的:“you know the latter being like people who have really scary QA problems that they feel like they don't have a handle on and they think some of these techniques could maybe help because we have a prototype that might kind of work”。他坦承团队目前已经构建出了一个“大致能够跑通”的测试原型,正需要这样棘手的实际业务场景来进行验证。 除了招聘与商业合作,Will Wilson 还由衷希望能与所有对该技术方向抱有热情的人建立联系。他感慨这种基于确定性虚拟化与软件仿真的自主测试目前依然处在一个极为狭窄的小众领域,业界极少有人会深入琢磨此类底层系统的可靠性难题。因此他真诚地表示:“this is still a really small niche world and not a lot of people think about this stuff and so if you do I would love to meet you”。最后,由于演讲时长限制,他笑着坦言自己已经严重超时,说道:“and I am definitely over time so I won't take questions thank you”,随即在全场观众的热烈掌声中结束了本次分享。 - **潜在早期客户画像**:遭遇极其棘手、失控且难以复现的复杂 QA 隐患,并希望通过确定性仿真和自主测试技术寻求破局方案的团队。 - **技术成熟度现状**:团队当前已打造出可供实际测试验证的原型系统(prototype)。 - **行业生态**:此类深度仿真与确定性测试技术在当时仍属于关注度极低、极具前沿探索属性的小众技术领域。 ## Notable quotes > [14:05](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=845s) 针对一段新功能,我们不会去想‘我怎么写几个测试来覆盖它’,而是去想‘我怎么构建一个能够永远不断生成全新、有趣的测试来锻炼它的系统’。 — Will Wilson > [27:20](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1640s) The amount of effort it takes to fix a bug is extremely strongly tied to how long it's been since that bug was caused. — Will Wilson > [24:54](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=1494s) Humans will find some bugs, computers will find others, and this like beautiful synthesis of man and machine will come together and it's just it's awesome. — Will Wilson > [00:00](https://www.youtube.com/watch?v=fFSPwJFXVlw&t=0s) exponential growth is really really easy when what you have is really really primitive — Will Wilson ## Mentioned Will Wilson, FoundationDB, Evan, Ben, Dave Scherer, Apple, Gartner, Forrester, Jenkins, Haskell, Python, Linux Foundation [Source](https://www.youtube.com/watch?v=fFSPwJFXVlw)

Source quotes

[14:05] Will Wilson: 针对一段新功能,我们不会去想‘我怎么写几个测试来覆盖它’,而是去想‘我怎么构建一个能够永远不断生成全新、有趣的测试来锻炼它的系统’。 [27:20] Will Wilson: The amount of effort it takes to fix a bug is extremely strongly tied to how long it's been since that bug was caused. [24:54] Will Wilson: Humans will find some bugs, computers will find others, and this like beautiful synthesis of man and machine will come together and it's just it's awesome. [0:00] Will Wilson: exponential growth is really really easy when what you have is really really primitive

Source quotes

[10:44] Will Wilson: If we were smart enough or had the right kind of brains to write all the tests we needed to write, then we would have just written the code correctly in the first place. [16:13] Will Wilson: Humans debug software; humans are not mystical Turing Oracles—if humans can do it, then so can computers.

Original transcript

[0:00] ah there we go thank you [0:04] sorry about that so yeah as Dave said my [0:09] name's will I worked at Foundation DB [0:11] way back in the ancient mists of time [0:14] and I'm now doing something a little bit [0:16] different I'm here to talk about the [0:19] future of software development what on [0:22] earth could I mean by that well as [0:25] somebody who is asked to give a [0:26] big-picture talk at a software [0:28] conference I believe I'm contractually [0:30] obligated to begin with a slide [0:32] depicting Moore's law and also my [0:37] pointer doesn't work okay there it is [0:39] Moore's law clearly you can see here [0:42] we've got years on the x-axis there and [0:45] we've got clock speed on the y-axis [0:46] right and as you can clearly see it's [0:49] going up and to the right kind of [0:50] exponentially and well hold on a second [0:54] you sure that's the did we get the right [0:56] slide is this is this the Moore's law is [0:59] that is that clock speed or is that is [1:02] that harddrive density or maybe oh my [1:04] goodness it's weaving and spinning [1:06] productivity that's I wasn't expecting [1:09] that that's that's really weird there [1:12] must have been some kind of mix-up okay [1:14] let's let's try this again okay oh yeah [1:16] yeah here we go [1:17] that's that's totally the Moore's Law [1:18] slide you've got that nice logarithmic [1:20] y-axis there you see that yeah that's uh [1:22] what it's steam engine efficiency what [1:27] what is going on here all right let's [1:29] let's try one more time okay all right [1:32] anybody want to guess what this one is [1:37] okay I'll give you a hint the x-axis [1:40] here is the actual years along which [1:43] Moore's Law actually did operate now all [1:48] right it's actually industrial diamonds [1:51] so why have I wasted your time with [1:55] three different graphs all of which are [1:57] not Moore's Law the reason is I think we [2:00] in the software industry or in the [2:02] computing industry more broadly have a [2:04] little bit of a tendency to think that [2:06] were special we think there were somehow [2:09] different from every other technological [2:12] endeavor that [2:13] mankind has engaged in and something [2:16] that people point out a lot is this [2:17] Moore's law thing people say where else [2:20] in human history has there ever been [2:22] this exponential increase in the [2:25] capabilities of the underlying hardware [2:26] of what we're doing and the answer as [2:29] I'm hope I've convinced you is actually [2:31] everywhere it's incredibly incredibly [2:33] common at first and the reason is that [2:37] exponential growth is really really easy [2:40] when what you have is really really [2:42] primitive and so the fact that we [2:45] observe this Moore's Law relationship [2:48] maybe still is actually not telling us [2:52] that software is special it's telling us [2:54] that software is early right it's [2:57] telling us that we're at the beginning [2:58] that we haven't trailed off yet into a [3:00] logistic curve which is what usually [3:02] happens in technology and I actually [3:04] find this fact to be incredibly [3:06] empowering right it means it means we we [3:10] get the chance to be pioneers too it [3:13] means those guys in the 60s and the 70s [3:14] didn't have all the fun it means there's [3:17] a lot more to do and I think one [3:19] implication of this is it also means [3:22] that we should be looking for the [3:24] possibilities of radical transformations [3:27] in software engineering right things [3:30] that will completely change how what it [3:33] means to be a software engineer what it [3:35] means to write programs there's a couple [3:37] reasons for this one is because we're [3:39] early in history and so therefore [3:41] there's still low-hanging fruit another [3:44] is that we're early in history and what [3:46] that means is that the vast majority of [3:48] software is not written yet it can be [3:51] written in the future which means that [3:52] if we make process improvements now they [3:55] have a very long time horizon over which [3:57] they can pay off I think both of those [3:59] facts argue in favor of us taking a [4:02] really serious and hard look and [4:04] re-examining what it is we do and so [4:07] that's meaning behind the title of my [4:09] talk the future of software engineering [4:10] I think the future is out there in front [4:13] of us we're not there yet but maybe [4:15] maybe we will help create it ok so right [4:20] so the future there's a lot of different [4:22] possible radical transformations I could [4:24] talk about right I could [4:26] about new programming languages and how [4:28] something from category theory is gonna [4:31] totally change how everybody does [4:33] everything might be true that would be a [4:35] radical transformation if it worked or I [4:37] could talk about the sociology and [4:40] economics of software how who becomes a [4:43] software engineer might be changing [4:45] drastically that could be a radical [4:47] transformation of the software industry [4:48] but I'm talking not going to talk about [4:50] either of those things instead I'm gonna [4:52] talk about testing yeah right because [4:56] why because if you want to look for the [4:59] potential for radical transformations [5:01] one way of doing that one pretty good [5:03] heuristic is to look at where things are [5:06] currently the most absolutely awful and [5:09] terrible and painstaking and brutal and [5:12] I think testing kind of qualifies right [5:14] I saw a report from some analysts it was [5:18] like Gartner forced or somebody they [5:22] estimated that 30% of all effort in [5:26] software development was spent on [5:29] testing or on QA more broadly and if [5:32] you're like me you hear that number and [5:34] you're like thirty percent that's way [5:37] way way too low right well I guess like [5:40] you add together the amount of time you [5:41] spend writing tests the amount of time [5:44] you spend fixing the bugs that your [5:46] tests turn up the amount of time you [5:48] spend fixing the bugs your tests don't [5:49] turn up the amount of time you spend [5:52] working around and dealing with and [5:54] mitigating all the bugs in the layers [5:56] below you that they haven't fixed those [5:59] jerks all the time and effort that goes [6:03] into dealing with the fallout of [6:04] inadequate testing the outages the [6:06] economic damage right like that's like [6:09] we're talking at least 50% of my time [6:12] and I don't think I'm extremely unusual [6:14] and you multiply that by a lot of [6:17] software engineers in the world we are [6:19] talking about trillions and trillions of [6:22] dollars of productivity going into this [6:26] if you could take that and you could [6:29] eliminate it or make it much more [6:32] efficient much smaller fraction of what [6:34] we do that would be a radical [6:36] transformation of the software industry [6:40] and so the reason that I'm giving this [6:42] talk at this particular conference is as [6:44] I think people are generally aware [6:46] foundation DB had a different [6:48] relationship with testing than many [6:50] products did testing for us was not an [6:53] ordeal it did not suck up in vast [6:56] quantities of developer energy so I'm [7:00] not actually gonna dive into this a [7:03] whole lot both because I think a lot of [7:05] people here already know how foundation [7:07] DB did testing Evan and Ben both covered [7:10] it and sort of gave you some information [7:12] about it instead what I'm gonna do is [7:14] I'm gonna try and take what we did at F [7:16] DB and recontextualize it I'm gonna try [7:20] and give you a different perspective on [7:22] it situate it as one technique within a [7:26] much broader class of approaches and you [7:30] know talk about why you should be using [7:31] them talk about why you might not be [7:33] using them talk about why no really you [7:35] actually should be using them and if I [7:38] have time then I will close with like [7:41] some slightly more speculative stuff [7:42] okay [7:44] but before I get to all that let's first [7:47] talk about why testing is so miserable [7:50] right now one reason that I think a lot [7:52] of people are very familiar with is that [7:54] your tests are usually non-deterministic [7:56] right as soon as your test relies on any [8:00] kind of external service or as soon as [8:02] you run it in a even slightly noisy [8:04] environment suddenly it fails one out of [8:06] every hundred times or one out of every [8:07] 10,000 times [8:08] either way it's a nightmare it's a [8:11] maintainability nightmare [8:13] it's a nightmare when you actually go to [8:15] try and debug something you don't have [8:17] confidence as to whether you've actually [8:18] fixed it or not if the test does fail [8:21] you're awfully tempted to say well [8:23] that's that's a known flaky test right [8:25] you ignore it and then it turns out no [8:28] actually it really was a problem um I [8:31] think people are also generally familiar [8:33] with the way that the foundation DB team [8:35] made heroic efforts to clawback this [8:39] property in our testing using a [8:41] technique called deterministic [8:42] simulation Evan touched on that briefly [8:45] there's tons of material online about it [8:47] as Dave said I gave a talk about it [8:49] years ago you can go read about that so [8:52] I'm not gonna talk about [8:53] but all that said I think we in this [8:57] room should be aware that most of the [9:00] world does not have this right most of [9:04] the world is still in the dark ages [9:05] can't do this and it's an ongoing source [9:08] of pain and suffering and it's really [9:10] bad okay but there are more reasons that [9:13] testing is terrible [9:15] another reason testing is terrible is [9:17] that your tests are very very often [9:19] fragile what do I mean by that I mean [9:21] that your test comes to rely on [9:24] properties of your system that are [9:26] incidental in some way that are not the [9:29] ones that you thought you were testing [9:30] so a really simple example of this is [9:33] suppose you're trying to test a computer [9:35] game all right like a 2d platforming [9:37] game one way you might do that is by [9:39] recording an input right so you say if I [9:42] hold down the right arrow for 6.7 [9:44] seconds and then I hit the jump key for [9:46] 3.2 seconds and then I shoot the bad guy [9:49] you know assert that bla happens and [9:52] that's a great test until you change [9:55] literally anything at all about your [9:57] program right you change the level [9:58] layout you change the physics engine you [10:00] change the input sampling rate you run [10:02] that test on a different computer it's [10:03] probably gonna fail this is not like [10:06] some weirdness about testing computer [10:08] games either this happens in all kinds [10:10] of testing domains it happens in UI [10:11] testing frequently it happens in [10:13] distributed systems testing right like [10:15] imagine you're trying to like play [10:17] forward some series of events and [10:19] something changes towards the beginning [10:22] right the two tests histories are gonna [10:24] diverge and you're gonna be off testing [10:26] some totally different thing than you [10:27] thought you were right so this is a [10:31] really bad problem like like the flaky [10:33] problem it's a maintainability nightmare [10:35] like the flaky problem you're very very [10:37] tempted to ignore the test because of [10:40] this I heard about a post-mortem [10:42] recently of some giant outage at some [10:44] giant company that his name I shall not [10:47] mention we're literally the same [10:50] check-in that caused the bug that caused [10:53] the giant outage [10:54] also disabled the test that would have [10:57] told them that they were about to have a [10:58] giant outage why because everybody knew [11:01] that test breaks every time you check [11:02] something in so I course right that's [11:06] really bad [11:07] even more insidious failure mode for [11:09] this by the way is sometimes your test [11:11] can fail open in the sense that you make [11:14] some change your test continues to pass [11:16] but it's now passing for a totally [11:19] different reason than you thought it was [11:20] passing right and so now it's a source [11:23] of false confidence and you yeah it's [11:26] it's really really bad and I don't think [11:29] people have a great answer to this [11:30] problem [11:31] okay but there's there's an even worse [11:33] one which is even if you somehow make [11:35] your test neither flaky nor fragile it's [11:38] probably not testing the right stuff I [11:41] think there's actually a really like a [11:43] deep reason behind this almost like an [11:46] analytic proof okay so it goes something [11:49] like this [11:49] the reason that people write tests is [11:51] because human beings are astonishingly [11:55] bad at thinking through all the possible [11:58] branches of control flow that a program [12:00] could take right we're astonishingly bad [12:03] at thinking through all the possible [12:05] orders in which two threads could [12:07] interleave or some other asynchronous [12:09] construct could interleave we're [12:10] astonishingly bad at thinking through [12:12] all the possible points in the execution [12:15] of a distributed algorithm we're a [12:16] failure might occur and what form that [12:18] failure might take but that very fact [12:22] right that's why we need tests but that [12:24] very fact means that we're unable to [12:26] write tests to cover all the things that [12:28] we actually need to cover right like [12:30] because if we could if we were smart [12:31] enough or had the right kind of brains [12:32] to write all the tests we needed to [12:34] write then we would have just written [12:36] the code correctly in the first place [12:38] right and so I think this is like really [12:42] scary and really true and the [12:44] implication is that tests can be useful [12:47] for turning up regressions but almost [12:50] completely useless for telling you about [12:53] unknown unknowns that's that's bad right [12:58] the latter is I think the more important [13:00] problem it's certainly the harder [13:01] problem and people try and fight against [13:04] this in a bunch of different ways people [13:05] people try and use coverage metrics to [13:08] fight against this which i think is a [13:09] nice idea but ultimately kind of useless [13:12] to like you know your distributed [13:15] systems people imagine that you have a [13:16] distributed system and your test suite [13:18] gives you 100% branch coverage [13:20] on it are you sure your system has no [13:24] bugs yeah obviously not right you could [13:29] have a bug that depended on whether some [13:31] code executed on process a before or [13:34] after it executes on process B you'd [13:36] have 100% branch coverage either way [13:37] this is not like a distributed systems [13:40] thing either right like imagine you were [13:43] writing a Python interpreter and you get [13:44] 100% branch coverage have you tested all [13:47] the interesting behavior and that Python [13:49] interpreter no Python is a [13:51] turing-complete language there's an [13:53] infinite mountain of interesting [13:54] behavior that you could continue to [13:56] exercise so branch coverage is a nice [13:58] idea but it doesn't actually solve this [14:01] problem at all um okay I actually think [14:05] that all of these problems are just [14:06] symptoms of a deeper underlying problem [14:10] the real problem and the real problem is [14:13] that testing is still totally manual [14:17] right what we call automated testing is [14:20] not automated in the slightest we've [14:22] automated the absolute dumbest part of [14:25] it which is executing the tests and [14:27] running them automated testing to most [14:29] people means having Jenkins run your [14:31] tests and you know that's that's nice [14:34] that's certainly better than not doing [14:36] that right having sitting there and like [14:37] typing who does that actually tons of [14:39] industries do that so yeah good good [14:43] start but still we have every one of [14:47] those tests is painstakingly manually [14:49] constructed by a human being in the [14:51] first place imagine if this were any [14:53] other industry right magic if I told you [14:55] that there's an industry out there where [14:58] you know scads of highly paid [15:00] intelligent people are sitting doing [15:02] mind-numbing rote repetitive predictable [15:05] tasks with with no automation right what [15:09] would you say what would your VC say [15:10] they would say that's an industry that's [15:12] ripe for disruption and you know welcome [15:15] ladies and gentlemen to software [15:16] engineering right for a disruption and I [15:19] think this is the real secret sauce [15:23] behind what foundation DB did it's not [15:26] so much just the deterministic [15:28] simulation although that was a very [15:30] important part of it it was that we [15:32] didn't go down this path [15:34] it's that whenever we had a new piece of [15:36] functionality we didn't say how can I [15:38] write some tests to cover this it was [15:41] more like how can I write a system that [15:43] will forever be generating new and [15:46] interesting tests that will exercise [15:48] this it's like it's a different it's a [15:50] shift of mindset it's a shift of [15:52] philosophy and it's such a big change [15:55] that I think it needs a new name and so [15:58] for the rest of this talk I'm gonna talk [16:00] about automated creation of tests in [16:02] addition to merely automated execution [16:05] of tests as autonomous testing which i [16:09] think is a is a better word for the [16:10] stuff and foundation DB is not like [16:13] totally special right if you know where [16:16] to look if you squint at the industry [16:18] you can see glimmerings of autonomous [16:20] testing everywhere actually a really [16:23] simple example is just fuzzing suppose [16:26] you're writing a parser that's parsing [16:28] some untrusted bytes from the network do [16:30] you sit there and say well I better [16:32] write some unit tests for this know like [16:34] if that's all you do your parser sucks I [16:37] assure you it's wrong like what you do [16:40] is you get a fuzzer to feed millions and [16:42] millions and millions of random strings [16:43] of input into it and see if any of them [16:45] cause it to crash [16:46] that's autonomous testing it's a [16:48] primitive form of autonomous testing [16:50] property based testing is an example [16:53] from a totally different side of the [16:55] software industry right this is signing [16:57] the functional programming people came [16:58] up with it's something that the Haskell [17:00] people I think came up with the idea [17:03] here is if you have a piece of your [17:04] program or a data structure or something [17:06] with a very easy to specify interface [17:09] what you can do is construct a [17:12] specification of its contract and its [17:14] guarantees and then you tell the [17:16] computer to sit there and try and come [17:18] up with counter examples to that [17:20] contract this is a form of autonomous [17:22] testing this is actually something that [17:23] was exhaustively used in the testing of [17:26] the foundation DB document layer which [17:28] as you heard was just open source Thank [17:30] You Apple right so like the like it's [17:33] not like at foundation DB we just had [17:35] one magical tool the simulation stuff [17:37] and we like hit everything with it it's [17:39] that everybody every engineer was [17:42] constantly there was a culture of [17:44] constantly thinking about how to take [17:47] testing problems and make them less [17:50] human involved and so the question that [17:54] I've been grappling with in my career [17:56] since leaving foundation DB is why [17:59] doesn't everybody do this all the time [18:01] right because I've seen how good things [18:05] are when you do it this way and I've [18:08] also seen but I'm prohibited by NDA from [18:10] telling you about how bad things can get [18:12] when you don't do it this way the answer [18:14] is really bad by the way so like so [18:17] serious like why isn't everybody in the [18:19] universe using this stuff it's like it's [18:21] a real conundrum and it turns out that [18:24] there are actually some really really [18:25] good reasons why people don't do this [18:28] stuff but before I tell you about the [18:30] good reasons I'm gonna tell you about a [18:32] really bad reason which is I hear this [18:35] with surprising regularity that the [18:37] turing halting theorem proves that [18:41] software can never test software yeah [18:43] that's right and you know it's it's it's [18:48] kind of true you can come to me and be [18:50] like will if your program can find bugs [18:52] then surely I can write a program which [18:54] will crash if and only if the Riemann [18:56] hypothesis is true and then in order to [18:58] tell me if it has a bug your program has [19:00] to solve all of math are you saying you [19:02] can do that and like you know fine like [19:06] that's that's true but that's correct [19:09] but to me this has a little bit of the [19:11] feel of people who say that the cap [19:13] theorem means you can't write a good [19:16] distributed database right it's like [19:18] it's like kind of an almost trivial [19:20] impossibility result which nevertheless [19:22] doesn't actually address the issue right [19:26] humans debug software humans are not [19:29] mystical Turing Oracle's like if humans [19:33] can do it then so can computers we just [19:35] and we don't need to be perfect right we [19:37] don't need to find every single bug in [19:38] every single program that could ever be [19:39] written which indeed the turing theorem [19:42] says you can't do all we have to do is [19:44] be better than humans or faster than [19:46] humans or more scalable than humans or [19:48] you know different from humans so i [19:51] think i think this is a dumb objection [19:53] that said i think it's actually really [19:56] closely tied to a smart objection [19:59] the same as maybe arguably true of the [20:01] cap theorem and the smart objection that [20:04] this is tied to is that it's insanely [20:06] difficult and that I think is true an [20:11] easy way to sort of think about how [20:13] difficult it is is just to imagine the [20:16] size of the space you're trying to [20:17] explore right so when you're trying to [20:20] find a bug in a program you are [20:21] implicitly trying to explore the space [20:23] of all possible execution histories your [20:26] program could have the size of that [20:28] space is 256 raised to the power of the [20:31] number of bytes of input your program [20:33] has ever received that is a mind [20:36] bogglingly large space that is [20:38] inconceivably vast right you could you [20:41] could stumble around in some tiny stupid [20:44] corner of that space for the entire [20:46] lifetime of the universe and never find [20:48] anything and yet I'm up here saying that [20:52] you can hit most of the interesting [20:55] parts of that space in a very small [20:57] amount of time how on earth can we do [21:00] that the answer is that's insanely [21:03] insanely hard and it's a challenge that [21:05] people trying to use autonomous testing [21:07] I think frequently like get shipwrecked [21:09] on an foundation DB we put an insane [21:12] amount of effort I should really say [21:14] Evan put an insane amount of effort into [21:16] into fighting this exact problem right [21:18] tweaking and tuning all the knobs bugga [21:21] fiying things to turn up bugs more often [21:24] tweaking the random number generators so [21:26] that you have processes crashing just [21:28] often enough to turn up interesting [21:30] behavior but not so often that you never [21:32] make any progress this is a this is a [21:35] really hard thing to do [21:37] it takes somebody with deep knowledge of [21:38] the system to do it it it's like it's [21:41] really draining and tough work and if [21:44] you get it wrong the failure mode is [21:47] your tests say everything's good [21:50] that's a really really scary failure [21:53] mode right you need some kind of side [21:55] channel to tell you that no actually [21:57] everything is not good hopefully that [22:00] side channel is not your customers so so [22:03] I think that's super scary the next [22:05] thing is like also super super scary and [22:07] I think it's probably an even bigger [22:09] barrier to adoption so all of the [22:12] autonomous testing techniques [22:13] listed and other ones besides which I [22:15] haven't listed all depend in some way [22:17] they're all a little different but in [22:18] some way they all depend on your [22:20] software being in the right form for [22:23] them to test them and you can think of [22:25] the whole foundation DB deterministic [22:27] simulation system as having the job of [22:30] wrangling a big hairy stateful [22:33] distributed system into that form right [22:36] like taking it and turning it into a box [22:38] that took an input which was a random [22:41] seed like pretending it was a pure [22:42] function so that we could do that kind [22:45] of thing the only reason that wasn't a [22:48] complete and utter debacle was that [22:51] foundation DB was constructed with [22:53] tremendous tremendous foresight to [22:55] enable that most people can't do that I [22:58] mean start with the fact that most [23:00] people aren't writing software from [23:01] scratch right most people are working on [23:04] some ginormous java monstrosity from the [23:07] 1990s even the people though who are [23:09] writing something from scratch rarely [23:12] have the foresight to say oh we're gonna [23:15] write a distributed database first we're [23:17] gonna spend a year writing a simulator [23:19] like who does that that takes that takes [23:22] a special kind of person to do that like [23:24] and you know a lot of people even if [23:27] they did have the inclination to do that [23:28] just wouldn't have the time right they [23:31] they need code now not in a year not in [23:33] two years so I think this is this is [23:36] like a huge huge problem and so long as [23:39] it's almost impossible to apply these [23:40] techniques after the fact it's gonna [23:43] greatly limit their their use okay and [23:46] the last thing here is what I'm calling [23:48] test Oracle's which is just a fancy way [23:50] of saying that you're you know even if [23:53] your test like turns up all the bugs in [23:55] the world it's useless if it doesn't [23:57] know when to alert you that it's found a [23:58] bug depending on the domain this can be [24:01] either really really challenging or [24:02] really really easy if you only care that [24:05] your program doesn't crash good good [24:07] news it's pretty easy to tell when a [24:08] program is crashed it's pretty easy as [24:10] hell when it's run out of memory it's [24:11] pretty easy to tell when an assert has [24:13] fired say but suppose you were working [24:16] on a graphical application you know [24:18] suppose that bugs come in the form this [24:21] border was five pixels too far to the [24:23] right or the bug is the screen [24:26] turned purple right you might need a [24:29] much more sophisticated system to tell [24:31] you when you've actually found a bug [24:33] this happened with foundation db2 there [24:36] were a database invariants acid [24:38] invariance which were too complex to [24:39] check with a simple assert statement and [24:41] so what we had to do was design entire [24:44] workloads dedicated to setting up those [24:46] invariants and then checking that they [24:47] were true still at the end so again [24:49] depending on your domain that can be [24:51] that can be a real challenge ok but [24:54] despite all that you should all still be [24:56] using these techniques and you should [24:58] this is this is what you should be doing [24:59] and there's a bunch of reasons some [25:01] obvious some not so obvious so first and [25:04] most obviously computers are cheaper [25:07] than people you might have heard this [25:09] there especially cheaper than software [25:11] engineers in the San Francisco Bay Area [25:14] so when you have computers writing your [25:17] tests instead of people writing your [25:19] tests you can write many many many more [25:22] tests and you will get a whole lot more [25:24] testing done and that will probably be [25:26] good almost more important than that [25:29] though is not just that you're gonna do [25:31] more testing it's that you're gonna do [25:33] different testing sometimes when I talk [25:36] about this stuff people asked me will [25:38] are you saying that I should like throw [25:39] away my my my lovingly crafted test [25:42] suite and just use your crazy computer [25:44] thing no don't do that right keep keep [25:47] your test suite that will find certain [25:49] kinds of bugs and the computers will [25:51] find other kinds of bugs because [25:53] computers and humans like human like [25:56] weren't yet we're all you know unique [25:58] and special snowflakes and different and [26:00] that's wonderful but we're all humans a [26:02] computer is a total alien all that stuff [26:05] I said before about stuff humans are bad [26:07] at thinking about computers are really [26:09] good at thinking about that stuff right [26:11] so humans will find some bugs computers [26:14] will find others and this like beautiful [26:15] synthesis of man and machine will come [26:18] together and it's just it's awesome [26:21] another cool thing about computers is [26:23] you can turn them on and off very easily [26:26] in fact I hear that you can even go to [26:28] Amazon and ask for a computer for a [26:30] limited amount of time and they will [26:32] turn it on and off for you this is this [26:35] is really great this is again something [26:36] that's a little bit different from human [26:37] beings if you want to hire more test [26:39] engineers or [26:40] software engineers that takes time you [26:42] cannot hire and fire them [26:43] instantaneously they take time to be [26:45] trained they have to sleep they have to [26:47] eat it's so annoying computers are not [26:51] like that if you want to do a medium [26:53] amount of testing or a small amount of [26:55] testing all the time and then a really [26:57] really really large amount of testing [26:58] all at once you can do that very easily [27:01] using autonomous testing that said [27:04] despite that I actually think that [27:07] that's not as important as people think [27:10] it is because I think that most of you [27:12] should be doing way more testing all the [27:15] time then you think you should be doing [27:17] and the reason has to do with the last [27:20] of these reasons here which I think [27:22] might be the most subtle which is [27:24] latency and by that I don't mean the [27:27] latency to running a single test I mean [27:30] the latency to running enough tests that [27:33] you find a single bug the reason is that [27:36] the amount of effort it takes to fix a [27:39] bug is extremely strongly tied to how [27:43] long it's been since that bug was caused [27:45] I think we all get this intuitively but [27:48] just a hammer the point home right two [27:49] situations one of them you know you're [27:52] writing some code and you go hit submit [27:55] to your repo and some pre submit hook [27:57] runs and it says blah like you have a [27:59] book you can't submit that right now [28:01] that's great that's so awesome you have [28:05] all the state of the problems still in [28:06] your head you have a literal diff in [28:08] front of you right you know probably the [28:10] bug is in one of those lines of code [28:12] this is about your best possible case [28:14] for finding and fixing that bug compared [28:17] to situation number two where your [28:19] friend causes a bug and it slips through [28:23] your testing and then it slips through [28:25] your release testing it into a release [28:26] and then some time goes by and slips [28:28] into your next release and then six more [28:30] months go by and your friend quits and [28:33] then four more years go by and you're on [28:35] call and your largest production [28:37] customer calls you in the middle of the [28:39] night and says hey something's not [28:42] working what what do you do I mean like [28:47] you're doomed right like it's it's gonna [28:49] be so bad even if that were literally [28:51] the [28:52] right the amount of effort that will go [28:56] into even determining if there was a bug [28:58] in the second case is going to be orders [29:01] of magnitude larger than it would have [29:03] been to just fix it in the first place [29:04] but the good news about testing or at [29:07] least about autonomous testing is it's [29:09] an embarrassingly parallel problem you [29:11] can get a million CPU seconds of testing [29:14] done in one second or five seconds I'm [29:16] does law you know by running it on a [29:19] million different CPU cores that's [29:22] really cool it means if you're willing [29:23] to spend the money you can drive down [29:25] the latency between causing bugs and [29:28] fixing bugs and that is going to repay [29:31] you in money and productivity and [29:33] frustration and everything so fast it's [29:38] going to change your life it's going to [29:40] change it's it's gonna qualitatively [29:42] change the kinds of things your team can [29:44] do yeah okay so I'm gonna wrap up now [29:49] I'm running out of time and I want to [29:52] wrap up by returning to that question I [29:54] raised before which is why don't we have [29:58] computers test all our software I mean I [30:02] know I told you the reasons right there [30:04] there were a ton of like really terrible [30:06] reasons but but seriously what would it [30:08] take what would it take to change that [30:10] like how how can we bring about the kind [30:12] of epochal transformation analogous to [30:16] the invention of the compiler where only [30:18] in really weird or exceptional [30:20] situations do you go back to doing it [30:22] the old way and the answer is I don't [30:25] actually know the answer to that [30:27] question but I'm currently trying to [30:29] figure it out so Dave share over there [30:33] and I have recently started a company [30:35] and our goal is to try and figure out [30:39] the answer to this question and then [30:41] thereby making autonomous testing super [30:44] easy thereby making it universal thereby [30:47] radically transforming the software [30:49] industry thereby assuring in a new [30:52] golden age of peace and prosperity for [30:54] all mankind it's it's pretty early days [30:58] yet it's really early days but we have a [31:03] vision and we have a technical roadmap [31:05] that we think you know has a decent [31:08] chance of getting us there okay [31:10] so there's a bunch of different you know [31:12] I would love to talk to you if you're [31:14] interested in any of the stuff I've [31:16] talked about here today there's two [31:18] kinds of people I'm especially [31:19] interested in talking to those would be [31:21] people who might be interested in coming [31:23] to work with us and people who might be [31:27] good early customers you know the latter [31:30] being like people who have really scary [31:32] QA problems that they feel like they [31:34] don't have a handle on and they think [31:35] some of these techniques could maybe [31:37] help because we have a prototype that [31:40] might kind of work but that said like [31:43] I'm also just interested in talking to [31:45] anybody who's into this stuff because [31:46] this is still a really small niche world [31:49] and not a lot of people think about this [31:51] stuff and so if you do I would love to [31:53] meet you [31:54] and I am definitely over time so I won't [31:56] take questions thank you [31:59] [Applause]