Property-Based Testing Caught a Security Bug I Never Would Have Found
Key topics
The debate rages on about the role of AI in writing blog posts after a developer discovered a security bug using property-based testing, sparking a lively discussion about the authenticity of the original article. Commenters skewered the post's verbose style, accusing the author of using AI to fluff up their content, with some sarcastically suggesting that AI can turn a 50-word post into a 2,000-word behemoth. Meanwhile, others defended the use of property-based testing, explaining that good implementations don't just generate random values, but instead skew distributions to highlight problematic cases, like the `__proto__` string in JavaScript. The conversation also touched on the prevalence of prototype pollution vulnerabilities, with many disagreeing that most web developers are aware of the risks.
Snapshot generated from the HN discussion
Discussion Activity
Active discussionFirst comment
8h
Peak period
12
15-18h
Avg / period
4.2
Based on 38 loaded comments
Key moments
- 01Story posted
Dec 18, 2025 at 6:40 PM EST
21 days ago
Step 01 - 02First comment
Dec 19, 2025 at 2:51 AM EST
8h after posting
Step 02 - 03Peak activity
12 comments in 15-18h
Hottest window of the conversation
Step 03 - 04Latest activity
Dec 20, 2025 at 9:30 PM EST
19 days ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
My take away is “don’t write your own input tests, use a library”. The rest is AI-slip
[1] https://www.exploringbinary.com/php-hangs-on-numeric-value-2...
[2] https://www.exploringbinary.com/java-hangs-when-converting-2...
What I've found surprising is that the __proto__ string is a fixed set from the strings sampling set. Whereas I'd have expected the function to return random strings in the range given.
But maybe that's my biased expectation being introduced to property-based testing with random values. It also feels like a stretch to call this a property-based test, because what is the property "setters and getters that work"? Cause I expect that from all my classes.
So what? This line of what-if reasoning is so annoying especially when it's analysis for a language like javascript. There's no vulnerability found here and most web developers are well aware of the risky parts of the language. This is almost as bad as all the insane false positives SAST scans dump on you.
Oh I'm just waiting to get dogpiled by people who want to tell me web devs are dumber than them and couldn't possibly be competent at anything.
I don't think this is true, and I think that's supported by the success of JavaScript: The Good Parts.
It would be unfair to characterise a lack of comprehensive knowledge of JavaScript foot-guns as general incompetence.
In my experience this really isn’t true. Most web developers I know are not familiar (enough) with prototype pollution.
By the way, this isn’t because they are “dumb”. It’s the tool’s fault, not the craftsman’s, in this case. Prototype pollution is complicated and surprising
Great LLM use case: Please explain to the box ticking person why these "insane false positives SAST" are false and / or of no consequence.
Do we?
More than that and you'll need nightly for now: https://docs.rs/ranged_integers/latest/ranged_integers/
[1] https://news.ycombinator.com/item?id=33155527