What quality metrics do we need to make packages quality visible?

  • I don’t think that you can replace model based testing with fuzzying.
  • You have to customize data generators for most packages anyway to get reasonable data I guess. (You don’t want to evaluate a lot of false positives in a manual manner.)
  • As far as I know all fuzzy testing tools in the source code level consider the classes, functions, etc. as black box. (In best case they provide state-based fuzzying as well which may be of value in case you have e.g. classes with internal state.). However you could combine it with dynamic analysis which would make it in overall white box testing. That seems be done quite often…