Developer Shares Study Notes on Software QA and Quality Management Principles

·2 views

A developer with a freelance testing background is documenting key takeaways from a university course on software quality assurance to help fellow students. The course reshaped their understanding of QA, revealing it as a broad, strategic discipline that extends well beyond manual testing. Quality Management (QM) encompasses all organised efforts to improve product quality across the entire Software Development Life Cycle, not just the codebase. A core insight from the course is that defects introduced early in development become significantly more costly to fix the later they are discovered. The quality cost model, which divides expenditure into error prevention and error correction categories, helps organisations budget effectively for software quality.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

F-Droid 2.0 Launches Days Before Google Enforces Android Sideloading Rules

F-Droid released version 2.0 on September 24, 2025, just six days before Google begins enforcing developer identity verification for app installations on certified Android devices starting September 30. The rebuilt client features a Kotlin and Jetpack Compose codebase, improved search, combinable filters, and default auto-updates, and underwent an independent security audit after over a year of development. Google's new rule requires all sideloaded apps on certified devices to be tied to a verified developer's signing key, with initial enforcement in Brazil, Indonesia, Singapore, and Thailand before a planned global rollout in 2027. The policy creates a structural challenge for F-Droid, which builds apps from source and signs roughly 85% of its catalog with its own key rather than the original developer's key. Reproducible builds are considered the clearest solution, as they would allow F-Droid to distribute developer-signed APKs, but coverage remains only partial today.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 59 privacy-first browser tools in vanilla JS with zero dependencies

A developer has publicly launched Antigravity Tools, a collection of 59 free, browser-based utilities built entirely in vanilla JavaScript with no external dependencies, backend servers, or analytics. The project was motivated by privacy concerns with popular online tools, such as JWT decoders and regex testers, which can log user data on remote servers. All operations run locally in the user's browser using native APIs including Web Crypto, Canvas, Web Audio, and IndexedDB. The toolkit covers a wide range of developer needs, including JWT inspection, RSA key generation, JSON formatting, cURL conversion, regex testing, and AI prompt utilities. The tools are freely accessible at antigravitytools.app, with the developer sharing technical learnings from the build process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why SaaS Businesses Should Re-Validate VAT Numbers at Every Subscription Renewal

A VAT ID verified at the time of purchase only confirms validity on that specific date, not on future invoice dates. Under EU VAT rules, each subscription renewal constitutes a new supply, meaning businesses must hold valid evidence of a customer's VAT status for each individual invoice. A customer's VAT registration can lapse, be suspended, or change between renewals without any notification to the supplier. Hooking into a billing provider's renewal event to re-check VAT IDs just before each invoice is generated helps close this compliance gap. While no EU regulation mandates a specific re-validation frequency, aligning checks with the billing cycle is a practical, low-cost approach recommended in consultation with a tax adviser.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Safety-Test an AI Agent's SAP Integration Before Going Live

Before connecting an AI agent to SAP via Model Context Protocol (MCP), security and access controls must be validated beyond simple connectivity checks. Developers are advised to test denied scenarios—such as out-of-scope data requests, expired sessions, and unauthorized operations—as formal acceptance criteria, not afterthoughts. Each test should change only one condition at a time and record the principal, target system, scope, and outcome to confirm that authorization decisions are enforced server-side, not just hidden from the interface. Write operations require additional scrutiny, including testing that post-approval changes invalidate prior approvals and that timeouts are reconciled against actual downstream outcomes. MCP authorization is explicitly noted as a complement to—not a replacement for—SAP's own roles and authorization objects.

0 comments Read more at DEV Community