Shibboleth Developers

["Scott Cantor" <>]

> I am sure there are some people who are in a rush to deploy 
> something just to see that it works, and they may not be 
> satisfied with a clean room test.
> The rest of us want to test something to make sure that it 
> doesn't fail, and that requires a controlled environment.

First of all, when people throw up an echo responder against an InQueue test
site, that's hardly something you have to wait for all these tests to want
to do.

Secondly, and more importantly, you're in the minority. That's just a fact,
bemoan it, whatever, but it's true.

I consider myself "practically conscientious", in the sense that I try and
do whatever I think is due diligence up to a point, but even I draw the line
at doing more testing (i.e. much of any) than what my university performs on
many of its mission critical systems. Every environment has its own rules.
And many have none.

It's a little hard to satisfy both views at the same time, but I think we've
done a reasonable job by using InQueue (hopefully to eventually morph into a
clearer testbed) as a usable resource in the default config. Taking that out
would be a huge mistake.

But since nobody really seems to be arguing for that, I don't know what the
problem here is. What is it about the defaults that are apparently so awful?

-- Scott