SlideShare a Scribd company logo
Walking the Talk: Random
Exploration of a Chatbot API
James Thomas
British Computer Society 2022-11-16
@qahiccupps
www.associationforsoftwaretesting.org
@qahiccupps
www.ada.com
@qahiccupps
supported by
@qahiccupps
Project: Extract a Basic Chatbot API
@qahiccupps
@qahiccupps
The Task
Presentation-agnostic API.
Integration with text-based clients.
Turn-based medical assessment.
Short deadline.
@qahiccupps
Risks, Questions, Test Ideas
@qahiccupps
Covering the Assessment Space
Unintended consequences.
Discover edges and corners.
Exercise the API extensively.
@@qahiccupps
A Walker
@qahiccupps
The idea
Run unattended medical assessments.
Can be iterated and customised quickly.
Identify places for deeper inspection.
@qahiccupps
Start
“OK”
Random
Choose
randomly
Card
type?
More
turns?
Stop
yes
no
text
input
choice
The Simplest Thing That Could Possibly Work
@qahiccupps
“Welcome to
Ada.”
“What is your
name?”
“Which option,
A, B, or C?”
✅❌
@@qahiccupps
✅❌
✅❌
✅❌
✅❌
❓
❓
❓
❓
❓ ❓ ❓
Navigate Explore
Survey
Demonstration
@qahiccupps
Implementation
@qahiccupps
Configuration
@qahiccupps
Another
symptom
~1/5 turns
Detailed, Parsable Logs
@qahiccupps
Archive
config
Archive
state
Parallel
@qahiccupps
Long Assessments
500 Server Error ❌
❌
Back end
Back end
Back end
❌
@qahiccupps
Reflection
@qahiccupps
@qahiccupps
@qahiccupps
@qahiccupps
GREAT SHOT KID,
THAT WAS ONE
IN A MILLION
@qahiccupps
YEAH!
I TOOK A MILLION
SHOTS
Questions?
@qahiccupps
What Worked Well
Verbose logs.
Asserting generally and on fixes.
Randomisation for unknowns.
Configuration for directed exploration.
Toolkit (replay, parallel, analysis, …).
Question-driven development.
@qahiccupps
Code changes and dependencies.
Card identifiers.
Medical testing.
State.
No explicit model.
What Worked Well … and What was Challenging
References
Ada screenshots: https://www.uisources.com/explainer/ada-diagnosing-via-chat-bot
Wipotec: https://www.wipotec-ocs.com/en/product-inspection/
Microscope: https://londonlaboquip.com/product/microscope-binocular-biological-sc302
Messy lab: https://imgur.com/gallery/bQiK6
Dice: https://www.richardhughesjones.com/luck-randomness/dice-gif/
Altwalker: https://altom.gitlab.io/altwalker/altwalker/
Star Wars: https://www.starwars.com/video/one-in-a-million-shot
@qahiccupps

More Related Content

Similar to James_Thomas_Walk_The_Talk_BCS.pptx

When Support Calls
When Support CallsWhen Support Calls
When Support Calls
James Thomas
 
Leveling up your JavaScipt - DrupalJam 2017
Leveling up your JavaScipt - DrupalJam 2017Leveling up your JavaScipt - DrupalJam 2017
Leveling up your JavaScipt - DrupalJam 2017
Christian Heilmann
 
Travel Hacking 101: The ROI of Hackathons
Travel Hacking 101: The ROI of HackathonsTravel Hacking 101: The ROI of Hackathons
Travel Hacking 101: The ROI of Hackathons
Clickslide
 
CoffeeScript: The Good Parts
CoffeeScript: The Good PartsCoffeeScript: The Good Parts
CoffeeScript: The Good Parts
C4Media
 
AppSec Pipelines and Event based Security
AppSec Pipelines and Event based SecurityAppSec Pipelines and Event based Security
AppSec Pipelines and Event based Security
Matt Tesauro
 
JavaScript isn't evil.
JavaScript isn't evil.JavaScript isn't evil.
JavaScript isn't evil.
Christian Heilmann
 
WAPWG Clark defining capturing_web-based_if
WAPWG Clark defining capturing_web-based_ifWAPWG Clark defining capturing_web-based_if
WAPWG Clark defining capturing_web-based_if
Sara Day Thomson
 
Alejandro Saucedo Presentation on IWMC 2015
Alejandro Saucedo Presentation on IWMC 2015Alejandro Saucedo Presentation on IWMC 2015
Alejandro Saucedo Presentation on IWMC 2015
Iran Entrepreneurship Association
 
Coding a SaaS
Coding a SaaSCoding a SaaS
Coding a SaaS
Chris on Code
 
Leaping Forward: Finding The Future of Your API Docs
Leaping Forward: Finding The Future of Your API DocsLeaping Forward: Finding The Future of Your API Docs
Leaping Forward: Finding The Future of Your API Docs
Pronovix
 
Creating Your MVP (or Startup Validation Hacks)
Creating Your MVP (or Startup Validation Hacks)Creating Your MVP (or Startup Validation Hacks)
Creating Your MVP (or Startup Validation Hacks)
Abby Fichtner
 
Y Pipes Mashup Camp
Y Pipes Mashup CampY Pipes Mashup Camp
Y Pipes Mashup Camp
Jinho Jung
 
Seminar report on captcha
Seminar report on captchaSeminar report on captcha
Seminar report on captcha
kunalkiit
 

Similar to James_Thomas_Walk_The_Talk_BCS.pptx (13)

When Support Calls
When Support CallsWhen Support Calls
When Support Calls
 
Leveling up your JavaScipt - DrupalJam 2017
Leveling up your JavaScipt - DrupalJam 2017Leveling up your JavaScipt - DrupalJam 2017
Leveling up your JavaScipt - DrupalJam 2017
 
Travel Hacking 101: The ROI of Hackathons
Travel Hacking 101: The ROI of HackathonsTravel Hacking 101: The ROI of Hackathons
Travel Hacking 101: The ROI of Hackathons
 
CoffeeScript: The Good Parts
CoffeeScript: The Good PartsCoffeeScript: The Good Parts
CoffeeScript: The Good Parts
 
AppSec Pipelines and Event based Security
AppSec Pipelines and Event based SecurityAppSec Pipelines and Event based Security
AppSec Pipelines and Event based Security
 
JavaScript isn't evil.
JavaScript isn't evil.JavaScript isn't evil.
JavaScript isn't evil.
 
WAPWG Clark defining capturing_web-based_if
WAPWG Clark defining capturing_web-based_ifWAPWG Clark defining capturing_web-based_if
WAPWG Clark defining capturing_web-based_if
 
Alejandro Saucedo Presentation on IWMC 2015
Alejandro Saucedo Presentation on IWMC 2015Alejandro Saucedo Presentation on IWMC 2015
Alejandro Saucedo Presentation on IWMC 2015
 
Coding a SaaS
Coding a SaaSCoding a SaaS
Coding a SaaS
 
Leaping Forward: Finding The Future of Your API Docs
Leaping Forward: Finding The Future of Your API DocsLeaping Forward: Finding The Future of Your API Docs
Leaping Forward: Finding The Future of Your API Docs
 
Creating Your MVP (or Startup Validation Hacks)
Creating Your MVP (or Startup Validation Hacks)Creating Your MVP (or Startup Validation Hacks)
Creating Your MVP (or Startup Validation Hacks)
 
Y Pipes Mashup Camp
Y Pipes Mashup CampY Pipes Mashup Camp
Y Pipes Mashup Camp
 
Seminar report on captcha
Seminar report on captchaSeminar report on captcha
Seminar report on captcha
 

More from James Thomas

How to Test Anything
How to Test AnythingHow to Test Anything
How to Test Anything
James Thomas
 
We Don't Know?
We Don't Know?We Don't Know?
We Don't Know?
James Thomas
 
People problems
People problemsPeople problems
People problems
James Thomas
 
Testing vs Chicken
Testing vs ChickenTesting vs Chicken
Testing vs Chicken
James Thomas
 
James thomas
James thomasJames thomas
James thomas
James Thomas
 
Theoreticus Prime vs Praktikertron
Theoreticus Prime vs PraktikertronTheoreticus Prime vs Praktikertron
Theoreticus Prime vs Praktikertron
James Thomas
 
Testing All the Way Down, and Other Directions
Testing All the Way Down, and Other DirectionsTesting All the Way Down, and Other Directions
Testing All the Way Down, and Other Directions
James Thomas
 
What is What is Professional Testing?
What is What is Professional Testing?What is What is Professional Testing?
What is What is Professional Testing?
James Thomas
 
Bug-Free Software? Go For It!
Bug-Free Software? Go For It!Bug-Free Software? Go For It!
Bug-Free Software? Go For It!
James Thomas
 
Your Testing is a Joke
Your Testing is a JokeYour Testing is a Joke
Your Testing is a Joke
James Thomas
 
You're Having a Laugh
You're Having  a LaughYou're Having  a Laugh
You're Having a Laugh
James Thomas
 
It's Like That
It's Like ThatIt's Like That
It's Like That
James Thomas
 

More from James Thomas (12)

How to Test Anything
How to Test AnythingHow to Test Anything
How to Test Anything
 
We Don't Know?
We Don't Know?We Don't Know?
We Don't Know?
 
People problems
People problemsPeople problems
People problems
 
Testing vs Chicken
Testing vs ChickenTesting vs Chicken
Testing vs Chicken
 
James thomas
James thomasJames thomas
James thomas
 
Theoreticus Prime vs Praktikertron
Theoreticus Prime vs PraktikertronTheoreticus Prime vs Praktikertron
Theoreticus Prime vs Praktikertron
 
Testing All the Way Down, and Other Directions
Testing All the Way Down, and Other DirectionsTesting All the Way Down, and Other Directions
Testing All the Way Down, and Other Directions
 
What is What is Professional Testing?
What is What is Professional Testing?What is What is Professional Testing?
What is What is Professional Testing?
 
Bug-Free Software? Go For It!
Bug-Free Software? Go For It!Bug-Free Software? Go For It!
Bug-Free Software? Go For It!
 
Your Testing is a Joke
Your Testing is a JokeYour Testing is a Joke
Your Testing is a Joke
 
You're Having a Laugh
You're Having  a LaughYou're Having  a Laugh
You're Having a Laugh
 
It's Like That
It's Like ThatIt's Like That
It's Like That
 

Recently uploaded

Presentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of GermanyPresentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of Germany
innovationoecd
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
ControlCase
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
Adtran
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
Neo4j
 
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
名前 です男
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
DianaGray10
 
20240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 202420240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 2024
Matthew Sinclair
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Speck&Tech
 
Data structures and Algorithms in Python.pdf
Data structures and Algorithms in Python.pdfData structures and Algorithms in Python.pdf
Data structures and Algorithms in Python.pdf
TIPNGVN2
 
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 202420240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
Matthew Sinclair
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Neo4j
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
Kumud Singh
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
KatiaHIMEUR1
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
Zilliz
 
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practicesNational Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
Quotidiano Piemontese
 
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with SlackLet's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
shyamraj55
 
How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
Daiki Mogmet Ito
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
Uni Systems S.M.S.A.
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
James Anderson
 

Recently uploaded (20)

Presentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of GermanyPresentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of Germany
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
 
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
 
20240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 202420240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 2024
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
 
Data structures and Algorithms in Python.pdf
Data structures and Algorithms in Python.pdfData structures and Algorithms in Python.pdf
Data structures and Algorithms in Python.pdf
 
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 202420240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
 
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practicesNational Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
 
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with SlackLet's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
 
How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
 

James_Thomas_Walk_The_Talk_BCS.pptx

Editor's Notes

  1. **Navigating** Error handling Consistency of API E.g. Male only assessments - compromise test code to get a walking skeleton; POST vs GET, two similar but slightly different schemas in the API itself. These activities make me ask questions… what if I …? How about when? Could it possibly be that …? Problems with the walker and with the product. While automating I’m testing. Don’t be too quick to restrict to what you think the system wants. Can I get from start to finish? What assumptions are required? What workarounds are required? How might developers struggle here? … ** Checking** E.g. certain kinds of dialog turns have different properties to assert on - keys in DTO must be present, or in some kind of relationship. What can I assert specifically and generally? Where are the edge cases? (e.g. by general global assertions failing) What are the error cases? How valuable is it to check these things here? ** Exploring** When you explore you don’t know if you’ll find anything, and if you find something you won’t know whether it’s relevant, and if it’s relevant you won’t know whether it’s important. Code is a tool and a toolkit. Extend it to the next question you have. (Can I get to “call ambulance” outcomes? What would need to happen to do that? How could I avoid it?) Log paths and outcomes. Analyse outside the code for patterns (seen and missing) Don’t error check too heavily. Catch and investigate failures. (Expose assumptions) Check some positive cases by hand. Check failures by hand. Look for patterns. (Don’t have to catch all failures; TODO outcomes are fine because then you can filter them in later analysis.) Explore the data you produce. Replay for repeatability. Configuration to guide the direction of exploration. (Initially, I’d just hack the code) How can I take the extreme choice each time? How can I make the longest assessment? Can I run an assessment for ever? A toolkit to gather data … … for human analysis. Failures are targets. Patterns are indicators. …
  2. Parallel nothing clever - just run two or more copies!