News for hackers. Stuff that matters.
Re:No code reviews by default by mpweiher on Wednesday January 05, 2022 @02:15AM (#29806095)
> I want my code peer reviewed

TFA:

> Engineers [..] request reviews when they think it's necessary.

Problemo solved.

Re:No code reviews by default by ahtihn on Wednesday January 05, 2022 @03:14AM (#29806441)
If code reviews aren't an expected part of the development process and there's pressure on delivering, it won't happen.
Re:No code reviews by default by Ntrails on Wednesday January 05, 2022 @05:24AM (#29807345)
I don't believe that to be true. I believe the expected outcome is that people will still want code reviews on anything vaguely complex as insurance against fuckups. "Shit, WE missed something" is a nicer place to be than "I was sure I was perfect and I'm actually an idiot".

It does however mean you don't sit around waiting for someone to approve a three line delete PR that you know is safe. The "Rubber Stamp" review is a thing and it does waste time.

Re:No code reviews by default by btschaegg on Wednesday January 05, 2022 @06:19AM (#29807675)
Since I am currently working in an environment that resembles GP's premise, I have to say that I find this take to be way too optimistic.

I'd be exactly in the boat you describe (and actually: I've yet to see a situation where someone reviewing my code did not lead to improvements). But: If I want my code reviewed, I have to actually fight for it. Since everybody's workload is too high, even the willing often simply don't have the time.

From higher up, at our place, there's no one that actively opposes code review as a practice, but they don't seem to get that it requires investment (i.e. time), either. That means that if management refuses to change their ways of planning or explicitly enshrine reviews as priority tasks, it simply won't happen except for maybe the gnarliest cases.

And that's from a perspective of the change's author being willing and proactive. I work with individuals that produce very questionable code at times. And I'm not talking style here: Code in 2021 that still is prone to SQL injection at every turn. Methods that are hundreds of lines long with a gigantic cyclomatic complexity that no one (including the author) will ever really understand. Method names like "process" and "process2". And so on.

Needless to say, those programmers will never push for their changes to be reviewed. The rest of the team simply discovers them after they blow up (which they do regularly) and we're debugging.

Now, these people are luckily a tiny minority (which at least makes this somewhat bearable), but I over and over again would wish for someone with more authority to show that they're interested in the matter. Which a policy on code review would do -- if only as a signal. Yes, we want to check each other's code. Yes, we want collaboration. Yes, that's more important than some arbitrary deadline for minor feature X. Yes, we expect our programmers to be professionals.

Another symptom of such an environment also is the fact that everyone is the king of their particular hill. No one every familiarizes themselves with another person's code unless they really have to. By now, I've jumped to insisting that every change on a critical component I'll ever make will be done through pair programming, and so far, at least that seemed to stick. But again -- that only happens if both parties involved actively fight for it instead of everybody understanding that this is just an expected part of work.

Re:No code reviews by default by jolux on Wednesday January 05, 2022 @10:57AM (#29810535)
This is a fantastic comment, thank you for writing it. I especially appreciate the explanation of how management decisions produce engineering practices.
Re:No code reviews by default by Ntrails on Thursday January 06, 2022 @12:40PM (#29826759)
I appreciate the context and the different point of view! I live in a bubble of how I perceive my coworkers (and indeed myself), alongside the culture of my employer where "getting it right is more important than getting it out"

Was interesting to hear your experiences and maybe update my expectations of workplaces somewhat

Re:No code reviews by default by btschaegg on Thursday January 06, 2022 @05:35PM (#29831468)
Thanks for your response :)

> [...] alongside the culture of my employer [...]

I think you've hit the nail on the head here. As many others have said in different HN posts, culture is hard to change. And I would also understand the argument that one can also enforce culture changes with policies; my hope up to now simply has always been that engineers could "overrule" some artificial time limits in favor of more collaboration by referencing such a policy.

I guess if you're starting from a context where code reviewing practices "just work", introducing explicit policies also can't improve much, anyway. On that note: If you happen to know a good heuristic to detect such cultures during interviews or the like, I would be extremely interested :)

Re:No code reviews by default by jksmith on Wednesday January 05, 2022 @12:02PM (#29811575)
This is where properly done scrum shines, provided the nature of the work lends itself to greenfield work (cycle time of one iteration). Good scrum is a dysfunction surfacing machine, so if you have a good system of risk management in place, the team can address in a constructive way. For all the scrum haters out there, come up with some system that codifies certainty, stability, and quality before your leadership starts pointing fingers.
Re:No code reviews by default by healsjnr1 on Wednesday January 05, 2022 @04:30PM (#29815214)
> If code reviews aren't an expected part of the development process and there's pressure on delivering, it won't happen.

This hits at the heart of why I strongly agree with this post and think PRs and code reviews are ultimately destructive.

Reviews are going to get dropped _regardless_ of whether they are in the process or not. Pressure makes code reviews and quality worse, not better.

More than that, the need to "appear" to review is going to slow things down and can cause an exponential back up. I saw this happen about a mouth ago: 3 day release cycle got bogged down and then took _3 weeks_ to get a single release out.

Process goes out the window when pressure hits. You are then operating in foreign environment at the most critical point and your safety net of useless.

Your safety net when things need to go fast should be highly automated fast build and deploy, coupled with great test coverage, from unit to end to end.

The only exception might be if you work in highly regulated field where you legal required to have a very low Mean Time To Failure. In that case things move slow unless you are very well resources.

Otherwise (ie the majority of products) focus that effort on having a very low Mean Time to Resolve. If you absolutely need some form of quality assurance, Pair. Do continuous PRs and knowledge sharing rather than out of context after the fact reviews.

Re:No code reviews by default by gunapologist99 on Wednesday January 05, 2022 @10:40AM (#29810317)
This sounds similar to the peer review process in publishing. Typically, getting other people to actually agree to voluntarily review your work is indeed a significant hurdle if the requested paper/book/chapter/white paper/code review is lengthy.

There is an easy way to resolve this:

     Request peer review for SMALLER chunks of code.
Git makes this exceptionally easy -- it's certainly far easier than reviewing a large document with Word track changes!
Re:No code reviews by default by ahtihn on Wednesday January 05, 2022 @12:13PM (#29811741)
The problem is that small changes are barely worth reviewing. Also a series of small changes can obfuscate the larger context of all those changes.

Each small change on its own might make sense and be ok to a reviewer, but if you step back and look at the series of changes together there might be some issues that could have been noticed.

Re:No code reviews by default by mpweiher on Wednesday January 05, 2022 @05:09AM (#29807233)
Fix that.
Re:No code reviews by default by alkonaut on Wednesday January 05, 2022 @03:03AM (#29806373)
Sure. But if you read my previous message this relies on people being comfortable asking. I am but not of my colleagues are. The formal process would let them use the benefit that I can use when I think it’s necessary.
Re:No code reviews by default by mpweiher on Wednesday January 05, 2022 @05:08AM (#29807223)
> people being comfortable asking. I am but not [all] of my colleagues are.

Then that's what you need to fix.

Re:No code reviews by default by alkonaut on Wednesday January 05, 2022 @06:09AM (#29807612)
Yes. And formal processes are 10x easier pthan magically “adding trust” or “confidence” or “seniority”.
Re:No code reviews by default by pbalau on Wednesday January 05, 2022 @02:58AM (#29806338)
Good engineers will ask for code review. Most engineers won't.
Re:No code reviews by default by mpweiher on Wednesday January 05, 2022 @05:09AM (#29807231)
> Good engineers will ask for code review

...when they need it. Actually, really good engineers will ask to pair when they need it. Review is a distant second.

Re:No code reviews by default by btschaegg on Wednesday January 05, 2022 @06:37AM (#29807785)
> Review is a distant second.

I agree with you there, but I'm also sure that one reason for this is that many people still see reviews as the task that only happens after everything else.

I'm convinced there's a lot of useful middle ground to be had if reviews aren't just "here's 500 LOC, please review", but maybe more… staged.

Say: Rummage around in the code a bit for yourself (ask questions if you have to), come up with a strategy of solving your problem, and submit that for review. Not in code, but maybe using markdown, preudocode, small diagrams or the like. In person (i.e. via screenshare nowadays). And if the other party doesn't find obvious holes in your strategy, then go implementing it.

I remember an interview with some Linux kernel maintainer that mentioned the same effect -- people submitting a gigantic patch for something that will simply never be merged. And all that would have been necessary to avoid this wasted work was an e-mail asking if the maintainers are at all interested in the change.