While I understand where your argument is coming from, it is important to ask the question: how many times a day is this piece of code executed on all computers worldwide?
Surely the chance of one person running into this bug is extremely small, but what about all the people on earth combined?
Nevertheless, I think we can classify this method of testing as some sort of hybrid between brute force testing and auditing; I don't think the authors are dismissing that claim this either, but are merely stating that there are ways to make very informed test cases without looking at the code.
Surely the chance of one person running into this bug is extremely small, but what about all the people on earth combined?
Nevertheless, I think we can classify this method of testing as some sort of hybrid between brute force testing and auditing; I don't think the authors are dismissing that claim this either, but are merely stating that there are ways to make very informed test cases without looking at the code.