201–210 of 238 posts
https://www.pullrequest.com/images/figures/reviewers/screeni...
From a customer perspective, and if it's really true they probably will have to lower their standards to serve you too.
I understand NDAs are a thing, but I still don't think I'm too comfortable with the idea of letting a bunch of third-party people look at a bunch of my internal information. And I understand this is targeting startups a lot more than large established companies. But to me that's even more concerning because as a startup you're really trying to move fast and hoping someone doesn't beat you to the punch, and you're han…
My limited experience is that access to your code is really not that valuable to competitors. Code might be valuable to hackers wishing to targeting you, presuming your business is a valuable target.
Earlier quoted context omitted.
I'm one of those reviewers, and I agree with you about the talent. Not speaking about myself, but the people I've gotten to know and also the ones I have referred. Each PR gets two reviewers from pullrequest.com, and we get to see each others' comments. One will catch stuff the other misses, and we usually support each other. It's most fascinating when we disagree on something, which so far has always led to a high-q…
You do this on the side of your dayjob for extra income?
I have performed reviews on pullrequest.com, and lack of context tends not to be an issue. Code review is an interactive process, where questions can be posed to the PR authors, and PR reviewers have access to search the codebase. Customer success at pullrequest.com also provide context for the repo and organization working practices, attached at the top of PR descriptions, to help reviewers with context and to know…
SAST, or Static Application Security Testing
DAST, or Dynamic Application Security Testing
https://www.softwaresecured.com/what-do-sast-dast-iast-and-r...
This post has a number of what look like astroturf advertising comments.
Earlier quoted context omitted.
I definitely get what you're saying here, but I think if I was given the choice between an internal reviewer that might glaze over some bad practices, or an external reviewer who will miss stuff like "oh be careful calling that code, there's gotcha X, Y, and Z that you need to think about", I'd take the former every time.
It’s usually possible to see if a certain piece of code allows gotchas or not. Global variables, implicit dependencies, undocumented apis or magic strings to give a few examples. If you have many such, then getting a reviewer calling out those bad practices is even more valuable. Even more valuable that they are external, because often many such smell-patterns are stuck due to some political stalemate or cargo-cult w…
Earlier quoted context omitted.
Having done more than a few PR reviews and code security reviews for their platform as an Android/Kotlin dev, I've found that the opposite problem is more common. A lot of organizations suffer from insular thinking and their own team often comments LGTM even if there's something glaring. Writing reviews as an outsider, there's something freeing about knowing that you can review honestly and professionally and not ove…
I think the point is internal and external code reviews are two different beasts - no harm in getting an external kicking to improve the coding practices. However, with nobody having skin in the game to get external code reviews into the codebase, they will largely be ignored as “nice but we have work to do”. How could a product like this (I think I’ve seen a few) solve that human nature problem?
Could be an interesting way to make it work and try make a higher/more valuable company from this, i.e. the CRAAS company could keep the bounties if not fixed after say 6 months...
This post has a number of what look like astroturf advertising comments.
“Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.” - see https://news.ycombinator.com/newsguidelines.html
As a PullRequest reviewer, I think many on this thread are missing the forest for the trees. First, I think many here may be viewing Code Review as a Service from their frame of reference: from unicorn start ups, FAANG tech companies, prestigious universities, etc. Many of the companies that we help aren't coming from this world. They're small startups, looking for technical guidance. They're entrepreneurs who need t…
Earlier quoted context omitted.
That was my initial reaction too, but then I thought "using such a service might encourage the code-based to be external-reviewer friendly?". That is, instead of all the shared history/context that internal reviewers have, make all that as explicit as possible, ideally in the code, or at least in good code comments. Would also go a long way to avoid the "bus factor" (or more commmon: the "sudden-quit factor").
No one has to die or quit. You could just hire a new dev who doesn't have to wait for someone to explain the relevant parts of the godzilla object.
