Gradual improvement • Make code self documenting • Instill confidence in changes • Develop for maintenance Goals of this talk *for some definition of "structure"The Cost of TestingWhether or not you write Many Tools Exist• Not everyone will use them • Not all code will work with them • They require maintenance too • Can be intrusive or leave artifacts in code • Not available on all platforms • Understand { SatPayloadT type; union { ActivationPayload activation; GenericBinaryPayload binary; DBAck database_ack; LocateRespPld locate_response; MailCheckPayload mail_check; PresetMessage preset; ReferencePointPayload

building software! 9So here’s the deal 10 ● You are hired as a programmer to perform some maintenance ○ The software is a very exciting screen saver software! ○ You’re going to get lots of $$$ to e. Managing specific types of data) ○ A Logger ■ (i.e. Log messages or errors in a centralized database) ○ A configuration manager ■ Hold global configuration value 36Singleton Pattern (3/3) ● Pattern: e. Managing specific types of data) ○ A Logger ■ (i.e. Log messages or errors in a centralized database) ○ A configuration manager ■ Hold global configuration values 37 This is the option we want

Vulnerability monitoring, prevention, and response •Review public CVE databases (e.g. GitHub Advisory Database) •Run static analysis + dynamic analysis tools (e.g. Address Sanitizer) on all code, including features X months 6 Require all libraries to move to package manager Enforce consistency, easier maintenance X months Example: moving from checked-in + manually linked libs to package managerSummary – 10

on.cc 11 3.2% 965Ki 0.6% 40.7Ki third_party/protobuf/src/google/protobuf/descriptor_database.cc 12 1.8% 549Ki 1.7% 114Ki src/bloaty.cc 13 100.0% 29.5Mi 100.0% 6.69Mi TOTAL60 assumptions about individual test inputs. Extensible Good tests are easy to change. Optimize for low maintenance cost. Single use-case test frameworks have the same cost as production code. Measure test coverage

resource is something that must be acquired and released after use • E.g., files, memory, locks, database transactions, communication channels, GUI connections, threads • Explicit release is error-prone US • So, the cost would be 550*5*$500,000 == ~$1,400,000,000 • Vs. ~$125,000,000 for normal maintenance and development • Roughly $1B added cost Stroustrup - C++ safety -CppCon - October 2023 58 For

guarantee the readability of the recipe. • test_package: The recipes must contain a test_package • Maintenance commitment: You will be the responsible to keep the recipe updated, fix issues etc., so a minimal class HelloConan(ConanFile): name = "Hello" version = "1.2.3" Usually this takes very little maintenance, and when the CMakeLists version is bumped, the conanfile.py version is bumped too. But if you SystemPackageTool() installer.install(pack_name) # Install the package, will update the package␣ ˓→database if pack_name isn't already installed On Windows, there is no standard package manager, however

guarantee the readability of the recipe. • test_package: The recipes must contain a test_package • Maintenance commitment: You will be the responsible to keep the recipe updated, fix issues etc., so a minimal class HelloConan(ConanFile): name = "Hello" version = "1.2.3" Usually this takes very little maintenance, and when the CMakeLists version is bumped, the conanfile.py version is bumped too. But if you SystemPackageTool() installer.install(pack_name) # Install the package, will update the package␣ ˓→database if pack_name isn't already installed On Windows, there is no standard package manager, however

guarantee the readability of the recipe. • test_package: The recipes must contain a test_package • Maintenance commitment: You will be the responsible to keep the recipe updated, fix issues etc., so a minimal class HelloConan(ConanFile): name = "Hello" version = "1.2.3" Usually this takes very little maintenance, and when the CMakeLists version is bumped, the conanfile.py version is bumped too. But if you SystemPackageTool() installer.install(pack_name) # Install the package, will update the package␣ ˓→database if pack_name isn't already installed On Windows, there is no standard package manager, however

guarantee the readability of the recipe. • test_package: The recipes must contain a test_package • Maintenance commitment: You will be the responsible to keep the recipe updated, fix issues etc., so a minimal class HelloConan(ConanFile): name = "Hello" version = "1.2.3" Usually this takes very little maintenance, and when the CMakeLists version is bumped, the conanfile.py version is bumped too. But if you SystemPackageTool() installer.install(pack_name) # Install the package, will update the package␣ ˓→database if pack_name isn't already installed On Windows, there is no standard package manager, however

guarantee the readability of the recipe. • test_package: The recipes must contain a test_package. • Maintenance commitment: You are responsible for keeping the recipe updated, fix issues etc., so be aware that class HelloConan(ConanFile): name = "Hello" version = "1.2.3" This usually requires very little maintenance, and when the CMakeLists version is bumped, so is the conanfile.py ver- sion. However, if you only SystemPackageTool() installer.install(pack_name) # Install the package, will update the package␣ ˓→database if pack_name isn't already installed On Windows, there is no standard package manager, however