In my experience code review is often about the logic rather than the code itself. For example do you really need to copy the whole user object just to read their username? Can’t you just pass the username in as a string instead? Static validation and test suites should already of eliminated any code errors. If you show up to a code review and the code doesn’t compile, you’re going to have a bad time. Stuff like calculating the same distance between two objects multiple times should be called out in code review, maybe extract that into a function. Reaching out to a database to get the same value repeatedly should be called out, maybe store it as a local variable.
One time I was reviewing some code which interfaces with an external third party piece of hardware which the api required the serial number for licensing. The programmer hard coded the serial number into the code. If we swapped it due to hardware malfunction we would need to update the software. If we got a second one we would need to maintain two code bases. This should be in a configuration file or something. Ai will not catch that. Static testing won’t catch this. Test suites running on the piece of hardware we had, wouldn’t catch this. Only a human reviewer would.
Ai will not catch that. Static testing won’t catch this. Test suites running on the piece of hardware we had, wouldn’t catch this. Only a human reviewer would.
This explains a lot of lsecurity issues in the last few years.
In my experience code review is often about the logic rather than the code itself. For example do you really need to copy the whole user object just to read their username? Can’t you just pass the username in as a string instead? Static validation and test suites should already of eliminated any code errors. If you show up to a code review and the code doesn’t compile, you’re going to have a bad time. Stuff like calculating the same distance between two objects multiple times should be called out in code review, maybe extract that into a function. Reaching out to a database to get the same value repeatedly should be called out, maybe store it as a local variable.
One time I was reviewing some code which interfaces with an external third party piece of hardware which the api required the serial number for licensing. The programmer hard coded the serial number into the code. If we swapped it due to hardware malfunction we would need to update the software. If we got a second one we would need to maintain two code bases. This should be in a configuration file or something. Ai will not catch that. Static testing won’t catch this. Test suites running on the piece of hardware we had, wouldn’t catch this. Only a human reviewer would.
This explains a lot of lsecurity issues in the last few years.
Also, can’t compilers catch that and complain?
Well basically it’s just a ‘magic number’. If you ban all of those many programs will either break or at minimum suffer sever performance degradation.
Not ban, warn about fixed string assigned to variable. Ok, guess that would be hard to distinguish on compiler level.