Live data from Hacker News

No code reviews by default

raycast.com

211–220 of 315 posts

Re: No code reviews by default

#211
> Pull requests discourage trust.

Good. You shouldn't trust my code until it's been reviewed. I don't even trust my own code until its been reviewed! I've gotten much better with time specifically because of the things I've learned from reviews, but having another pair of eyes on my code still frequently uncovers things I overlooked while in the weeds.

> Pull requests don't prevent bugs.

This is just wrong. It doesn't prevent all bugs, but nothing does. Reviews, testing, static analysis, requirements, proofs - they're all designed to improve confidence in software. They all work to varying degrees, but none of them are perfect.

> Pull requests slow down.

Good. This is a feature. If a change is big enough that it takes significant time for another qualified engineer to review, there's a high chance that an issue will be uncovered. At the very least, it ensures another engineer is familiar with the changes.

If reviews drag on because engineers don't treat them as high priority, then that's a culture problem - not a problem with reviews.

Re: No code reviews by default

#212
post #42

Earlier quoted context omitted.

Sure, I mostly meant automated processes. They won't always save you from yourself but doing blue-green, having an extensive test suite, etc, are all things that will help reduce the risk of a bad deployment.

Yeah exactly, code review isn't a good place to catch actual bugs. Humans are terrible at catching bugs consistently... Humans probably introduced those bugs in the first place. It's also an exceedingly poor use of human time, which costs a heck of a lot more than machine time. We really should be relying on automated systems to catch bugs for the most part, and leave code review for what it's good for: making sure a…

> code review isn't a good place to catch actual bugs.

Disagree, but it's also a good place to be ensuring that the system is evolving in a way that is reasonable and consistent — or that it is unreasonable and inconsistent for good reasons.

Re: No code reviews by default

#213
I think the underlying problem with this debate is a widespread failure to understand the purpose and practicality of reviews. Actually I see this pattern repeated with many other practices in our field : tests for example. It's a kind of mass delusion, imho.

Yes having human #2 look at whatever code human #1 wrote with the goal of improving it and catching errors, is in the abstract a good idea.

But _requiring_ all code to be reviewed before merge to main, while allocating no real resources to that activity, while also expecting high velocity of development, is magical thinking.

It typically leads to "software engineering theater". Code reviews look to be happening, but for the most part they're not. And worse: some things don't get fixed because the participants see review as an obstacle unworthy of their energy to surmount. Some great features don't get developed because the engineer with some spare creativity perceives that their weekend efforts may be for naught due to ensnarement in review webs.

I think the author is on the right track by at least refusing to enter into the delusion, and rejecting the magical thinking.

Re: No code reviews by default

#214
OP is mentioning their side of the story for what they did. I feel people are going overboard with their emotions. Few points

As OP says, team members could ask for review if they do not have confidence in what they are changing. But code reviews usually makes everyone wiser - domain context, design thinking etc., So we need to find other channels to ensure that.

Few Questions:

1. Do we have data on how many bugs do we fix at review stage?

2. How many times we blindly approve based on our "trust" with our colleagues? Biases definitely play a major role in reviews.

3. What happens if one engineer quits with others not having any context? So we cannot say Code Review is not needed for every team. It may work for some.

4. How many PRs we merge using our admin rights without getting any peer review (because of delays or getting attention from our peers)?

Re: No code reviews by default

#215

> Pull requests don't prevent bugs. I remember once I was giving a talk on code review and I said that code review doesn't prevent bugs and people were shaking their heads. Everyone hangs on to this one thing, but if you look at the majority of pull requests that have been approved you'll see a lack of comments about pontential bugs. Also, if you do see a comment about bugs they'll often be disregarded. This drives m…

It sounds like your company has a shitty culture. I've never had issues with code reviews in the companies I worked at. One company was particularly rigorous, where we had to print it ou on paper, and a room of engineers would go over things line by line. But that also had the best engineered software I had seen in my career. Any issues of style should be in the style guide. Anything not in the style guide can be ign…

> Any issues of style should be in the style guide. Anything not in the style guide can be ignored. Or the style guide should be updated.

I find that there are two components of style:

- Formatting

- Clean abstractions, modularization... everything else that goes into making you a great (not just passable) programmer

Formatting should be handled by tools like others have said. For everything else I have the options:

- Turn the style guide into a book which no one will ready anyway

- Ask them to read an actual book but it isn't practical in the scope of a PR, and even after reading the ideas take a while to digest

- Attempt to mentor the employee via the PR, often appearing pedantic because it's hard for a novice to appreciate what they don't know.

- Code that passes CI is working code - screw everything else!

I take the mentoring route whenever it's presented to me but have generally found that some other team members (especially as they get older) have no interest in best practice and become annoyed by the code review process. If the mentee has persistence it tends to work out but moreso over 6mth-1yr timeframes. For mentees without the patience we drop the code review and keep them in areas of the code base where they can't do too much damage.

I guess what I'm trying to say is that our culture is willing to bend the processes to fit individual's strengths, and overall our workplace is pretty happy/chill. Maybe the engineering quality takes a hit but I can definitely sympathize with where the OP is coming from.

Re: No code reviews by default

#216

Earlier quoted context omitted.

> test it quickly Yes, in your scenario the lack of testing stands out as the major opportunity for improvement. If a bug is so important that it's mentioned in a performance review, then it's important enough that there should be tests that would have caught it. Automated preferably, or manual if necessary. And everyone involved with the software, from you on up and sideways, should be calling for this testing. It's…

There actually were unit tests for it, there was just an edge case I didn’t think to test that caused things to crash, which caused a cascading error.

Edge cases and cascading failures are things that code reviews should be focusing on, as that’s a place where more brains is better than one, rather than the usual “does the code match the formatting and naming conventions”.

Re: No code reviews by default

#219
post #14

Earlier quoted context omitted.

If something hit production and caused a major fuck-up because there was no peer review process, then in all the places I've worked at the first action item in the post-mortem would be "we should introduce peer review." Otherwise someone would ask how we could ensure it wouldn't happen again, and no one would be able to say "because we trust them," and leave it at that. It would sound more like "I trust you will neve…

It's the same in the financial sector, you can't just push code without a review. However, the review process is far from perfect and can create a false sense of security. To review a piece of code, that code should ideally be small in scope. For larger pieces it's rather common that the reviewer don't have enough time to do a good job. If there were better incentives for doing a review, then it would greatly improve…

I've had a lot of trouble getting people to do proper reviews. A minimum to me is that you actually compile and execute the code in some way to check its sane. Better would be the reviewer actually adds to the test suite for the code to prove their expectations of how it works.

In almost all cases it's very hard to get people to look outside the web browser for the diffs. Diffs show you something, but never the whole context.

The other problem I've found is stamping down on style arguments: they have no place in code reviews, and a lot of the time you get a round of "please change this variable to be named something else" - which might be valid, but raises the question of why the reviewer didn't do it, and more often leaves a weird authority gap - I have no power to just reject such a request because I think it's invalid, nor does the business have anyway to resolve the issue. In fact if there's a dispute at all, very rarely is there any process for bringing in a third party to mediate or break the stalemate (which is hilarious in some ways since everyone by now should realize 2-party systems can't achieve consensus).

Code reviews are very, very cargo-culty and I've not seen them ever include a thorough design: people give up on the very near edge cases, and so the whole system falls apart because it's just a hurdle to get through and not a collaborative or constructive process.

Re: No code reviews by default

#220
post #141

The problem is not with code reviews but with how adversarial they have become. Instead of making the best attempt to comprehend and embrace the author's style and intention and finding compelling arguments for the question "why this code is probably fine and should be merged as-is?" people nit on all kinds of stuff, mostly highly subjective. Along the way they don't actually catch that many problems or bugs but inst…

> The problem is not with code reviews but with how ... they have become. Perhaps "banal" is the word you are meant to use. There's a saying about that a 10 line PR will get 10 comments, but a 1000 line PR will get a "looks good!". Of course this is not really what is happening. A 10 line PR can be completely unintelligible and a 1000 line PR might be a joy to read. Once the code base has become a ball of mud, no one…

> Once the code base has become a ball of mud, no one really bothers to review anything properly

This is the standard code review experience I've had across companies I've worked at. It's just theatre, bad and irritating theatre.

Post reply on HN