News for hackers. Stuff that matters.
Re:Learnings from 5 years of tech startup code audits by jacquesm on Thursday May 26, 2022 @04:31AM (#31516026)
That's a very interesting set of findings. What is important to realize when reading this that it is a case of survivorship bias. The startups that were audited were obviously still alive, and any that suffered from such flaws that they were fatal had most likely already left the pool.

In 15 years of doing technical due diligence (200+ jobs) I have yet to come across a company where the tech was what eventually killed them. But business case problems, for instance being unaware of the true cost of fielding a product and losing money on every transaction are extremely common. Improper cost allocation, product market mismatch, wishful thinking, founder conflicts, founder-investor conflicts, relying on non-existent technology while faking it for the time being and so on have all killed quite a few companies.

Tech can be fixed, and if everything else is working fine there will be budget to do so. These other issues usually can't be fixed, no matter what the budget.

Re:Learnings from 5 years of tech startup code audits by izacus on Thursday May 26, 2022 @06:01AM (#31516517)
I've found that slowdown from tech debt killed as many companies as any other issue. It's usually caused by business owners constantly pivoting, but being too slow on the pivot and too slow to bring customer wishes to fruition (due to poor technical decisions and tech debt) is probably one of the top 5 reasons for dead companies I've seen.
Re:Learnings from 5 years of tech startup code audits by jacquesm on Thursday May 26, 2022 @06:34AM (#31516737)
That's a good point, tech debt can be a killer. But the more common pattern that I've seen is that companies that accumulate tech debt but that are doing well commercially eventually gather enough funds to address the tech debt, the companies that try to get the tech 'perfect' the first time out of the gate lose a lot more time, and so run a much larger chance of dying. The optimum is to allow for some tech debt to accumulate but to address it periodically, either by simply abandoning those parts by doing small, local rewrite (never the whole thing all at once, that is bound to fail spectacularly) or by having time marked out for refactoring.

The teams that drown in tech debt tend to have roadmaps that are strictly customer facing work, that can get you very far but in the end you'll stagnate in ways that are not easy to fix, technical work related to doing things right once you know exactly what you need pays off.

Re:Learnings from 5 years of tech startup code audits by bcrosby95 on Thursday May 26, 2022 @11:16AM (#31519371)
Maybe once you get to that stage it doesn't really matter. Maybe if you're going for a billion dollar earth shaking idea, it doesn't really matter.

However, I've worked for a small company for quite a while now. We've had several successful projects and several failures.

In my experience, technical debt taken too early can easily double the time it takes you to find out if a project is a dud. That matters to us.

My general rule is: push off technical debt as late as you can. Aways leave code slightly better than you found it. Fix problems as you recognize them.

I think a big mistake developers make is thinking "make code better" should be on some roadmap. You should be making code better every time you touch it. Nothing about writing a new feature says that you have to integrate it in the sloppiest way possible.

Re:Learnings from 5 years of tech startup code audits by jimbokun on Thursday May 26, 2022 @01:35PM (#31521165)
> I think a big mistake developers make is thinking "make code better" should be on some roadmap. You should be making code better every time you touch it. Nothing about writing a new feature says that you have to integrate it in the sloppiest way possible.

I vehemently agree.

One of my first jobs was working for a mathematician at a bank, who could code well enough to compute his mathematical ideas, but not a software engineer so hired me to do more of the coding for his team.

He would say "Jim, just get this done but don't spend time making it fancy." In other words, don't spend time refactoring or cleaning up the code, expressed in his own words.

I would say "sure" and then proceed to refactor and clean up the code as I went. It took less time than it would have to write the code "ugly" then deal with the accumulated tech debt, and I finished everything on time so he was happy.

Re:Learnings from 5 years of tech startup code audits by bombcar on Thursday May 26, 2022 @11:53AM (#31519876)
Even just #commenting on weirdness you discovered while working on tech-debt code can be invaluable; a little note on the two hours you spent on it could save days later when trying to figure out why something isn't working. Sometimes the problems can't be fixed right then, but you can mark them so later when it does break you have a hint as to what is going wrong.
Re:Learnings from 5 years of tech startup code audits by JamesBarney on Thursday May 26, 2022 @01:10PM (#31520857)
What are the technical debt issues you've run into that've crippled your development velocity?
Re:Learnings from 5 years of tech startup code audits by jorangreef on Friday May 27, 2022 @03:51AM (#31527083)
Technical debt has the second order effect of crippling morale.
Re:Learnings from 5 years of tech startup code audits by jakey_bakey on Thursday May 26, 2022 @07:49AM (#31517191)
Exactly this. People forget that the point of the metaphor is that debt is a tool you use to grow faster.

Credit card debt (e.g. sloppy code and test-free critical backend processes) is pretty bad and should be paid down ASAP.

Mortgage debt (e.g. no UI tests on the front-end) is quite safe and you can kick the can down the road.

Re:Learnings from 5 years of tech startup code audits by azemetre on Thursday May 26, 2022 @01:16PM (#31520935)
In my experience when you don't design and deliver code with testing or accessibility in mind, you end rewriting entire components. This all drastically adds to the end costs. Most leadership thinks this is "efficient" but it's not really. If you do it correct the first time you can consistently deliver features throughout the entire year rather than having to take several months to quickly duct tape everything from falling apart.

I never liked the "debt" metaphor. If a housing developer neglected to build a proper foundation, would you call that "debt?" I feel like it's very similar, it's bad metaphor for a concept that has very little to do with finance.

Re:Learnings from 5 years of tech startup code audits by p_l on Thursday May 26, 2022 @06:46AM (#31516804)
That's missing the case where the tech debt results in lowered commercial performance, as things necessary to keep customers happy enough to provide the cash flow are getting harder and harder.
Re:Learnings from 5 years of tech startup code audits by jghn on Thursday May 26, 2022 @07:43AM (#31517156)
They’re saying that in their experience this isn’t nearly as common as it is typically portrayed.
Re:Learnings from 5 years of tech startup code audits by nickcox on Thursday May 26, 2022 @07:59AM (#31517256)
> They’re saying that in their experience this isn’t nearly as common as it is typically portrayed.

How would you know if the poor commercial performance was due to tech debt or not though? It's the intangibility of tech debt that makes it so insidious.

Re:Learnings from 5 years of tech startup code audits by jghn on Thursday May 26, 2022 @12:00PM (#31519961)
Can't speak for the person I was citing. But I think I get what they're saying.

My personal experience has been that tech debt is more often caused by business level decisions and not engineering decisions. Deadline on this contract is next week so let's ship what we got and worry about it later. Hey, good news everyone we just pivoted 180 degrees so let's try to salvage what we've got.

So yes it very well might be that a mountain of tech debt was the final nail in the coffin. But why was that tech debt there in the first place? I was understanding the GP as saying they saw business decisions leading to poor engineering instead of engineering just doing dumb things on their own. I've seen plenty of examples of the latter but a lot more of the former in my travels.

Re:Learnings from 5 years of tech startup code audits by fullstackchris on Thursday May 26, 2022 @08:39AM (#31517574)
The double challenge here is doing this all whilst essentially keeping it in the background out of any customer sight. Even if you know exactly what you need after a while from a business perspective, you still need to reimplement it in a way that doesn't cause your product / service / platform to lose customers. I find this always to be an extreme challenge. It's a bit of a treadmill too: doing it this way (without causing breaking changes) certainly takes longer too. So it all piles up into a big messy stack of work :)
Re:Learnings from 5 years of tech startup code audits by nonameiguess on Thursday May 26, 2022 @02:05PM (#31521549)
I feel like the biggest problem from a business strategy perspective is all we have are these personal opinions and gut feels. Even this article mentions having done 20 code audits, but presents nothing but qualitative findings. Ideally, some business school out there would be embedding researchers in randomly selected startups to know for sure how often you fail because of tech debt versus failing because of worrying too much about tech debt. That's an empirical question, yet all we get are informed expert opinions, but no auditable, reproducible research evidence. It's all so unscientific.

Not to say you're wrong, but we have no real way of even deciding. All I can do is lean on my own experience, but I've seen nowhere near every product team out there and the ones I have seen are nothing close to randomly sampled or blinded.

Re:Learnings from 5 years of tech startup code audits by theptip on Thursday May 26, 2022 @01:42PM (#31521252)
It’s one of those systemic health type things. It’s really hard to die of tech debt on its own, but if you move slower, you’ll die more often from other shocks.

Another way of thinking about it is that you have N months of runway, and based on your velocity you can pull off a pivot in M months, and the more tech debt, the more time it will take to successfully pivot. If you don’t have a full pivot worth of runway remaining, and you need to pivot, you die. (Of course this oversimplifies by holding pivot magnitude equal but hopefully this illustrates the point.)

I do agree that away from the margin, companies that are incredibly successful can afford to punt harder on tech debt. I suppose “know thyself” might be useful advice here; it’s probably not good advice for the median startup to ignore tech debt completely IMO.

I think the main point though is to optimize for agility; tech debt can let you move faster in the short and even medium term, so sometimes it’s right to tactically take on some debt. But not so much that you get bogged down later; make sure you carve out time to fix the stuff that starts to be painful.

Re:Learnings from 5 years of tech startup code audits by phphphphp on Thursday May 26, 2022 @07:16AM (#31517004)
I’m not sure I agree. Technical debt is a symptom, it’s the consequence of bad management that leads to working on the wrong things.

If you’re running a startup and haven’t yet found your feet in terms of a product offering, and you’re building your product(s) in such a way that technical debt builds up through continuously layering half-baked on half-baked, it’s indicative that you’re not actually pivoting and not actually evolving, you’re just adding new half-baked ideas to a half-baked system… and being able to do that at twice the speed isn’t going to address the real problem: half-baked ideas don’t make a product, whether that’s 10 half-baked ideas or 100.

My experience is that any company in which evolution/experiments/pivoting is constrained within the boundaries of what already exists because of the sunk cost fallacy has made a grave error at a leadership level, not at a code level. If you can’t validate something without mashing more code into your system, that’s the problem to address.

I’ve seen companies with horrendous tech debt die, and you could certainly frame their death as being a consequence of the tech debt (“if they had just got the perfect system…”) but that assumes the perfect system would somehow prevent them from making the mistakes that got them there in the first place. It wouldn’t. The technical debt is an expression of their mistakes, not the cause. You could dump the perfect system at their feet and they’d be surrounded by garbage again a few years from now.

Re:Learnings from 5 years of tech startup code audits by icedchai on Thursday May 26, 2022 @09:46AM (#31518267)
I worked at a company that was mired in tech debt. At least 4 different UI frameworks were in use, one of which was totally not supported. Multiple versions of the app were left accessible, with links from the new to the old, because the new version was not feature complete. "Feature flags" were expressed in at least 3 different ways. It was a nightmare to figure out if something was on or off, and why. The back end was based on a non supported language version, with several old, deprecated third-party packages as a result. The company appeared organized, superficially, but at the lower levels of implementation it was a total dumpster fire.

They were constantly "pivoting", but leaving the old junk around.

Re:Learnings from 5 years of tech startup code audits by redisman on Thursday May 26, 2022 @11:55AM (#31519908)
There’s tech debt and then there’s poor engineering leadership. There’s no valid reason for a startup looking for market fit to switch frameworks or feature flags multiple times unless you’re just being clueless and looking for silver bullets. Just pick a few “boring” technologies and you’ll be perfectly capable of building anything “web” for at least a decade without messing around .
Re:Learnings from 5 years of tech startup code audits by icedchai on Thursday May 26, 2022 @12:44PM (#31520522)
You are right, but there's always folks pushing for a "better" framework, even if the same old boring stuff works. If one of them is fairly vocal and a little bit persuasive, a new project will start using it... on and on it goes.
Re:Learnings from 5 years of tech startup code audits by goto11 on Thursday May 26, 2022 @10:03AM (#31518452)
Technical debt is a sensible strategy when you are a startup aiming for growth. If you become successful, you can hire enough developers to pay back the depth in due time. If you fail, the debt doesn't matter.

Take Facebook: They build an empire on PHP. Now they have built some clever compilers on top on PHP in order to make it safe and performant without breaking their existing piles of legacy code. Overall this is probably ridiculously inefficient compared to just using a safe and performant platform from the beginning. But using PHP in the beginning allowed them to move fast in the critical growth phase.

Re:Learnings from 5 years of tech startup code audits by phphphphp on Thursday May 26, 2022 @10:35AM (#31518825)
I really struggle with the analogy of technical debt as equivalent to financial debt. The analogy works great in theory, but it doesn't translate to the real world. The technical decisions we make today will influence the decisions we make tomorrow, and the decisions we make tomorrow will influence the decisions we make next week... and so the system we have a year from now will be layers and layers of deeply interwoven technical debt that you can't just have your accountant pay off at the click of a button.

If we're married to the financial debt analogy, then technical debt has compounding interest like a payday loan... and payday loans are typically used in very distressed circumstances, and are very dangerous. There's appropriate times to take a payday loan, and there's appropriate times to take on technical debt, but it has to be handled with great care and be an immediate wake up call to address the underlying cause.

Re:Learnings from 5 years of tech startup code audits by letitbeirie on Thursday May 26, 2022 @11:49AM (#31519834)
Some tech debt behaves like a payday loan with usurious compounding interest.

The more insidious kind behaves more like a completely unhedged call option - fine, until it very suddenly isn't.

Re:Learnings from 5 years of tech startup code audits by goto11 on Thursday May 26, 2022 @10:46AM (#31518978)
Yeah, compounding interest is part of the metaphor. As long as you grow faster than the compounding interests, you are good. If the options for a startup is the keep growing or die, then taking on technical debt is reasonable.

Of course it is different for a steady-state company or organization. You need to keep technical dept at a manageable level.

Re:Learnings from 5 years of tech startup code audits by icedchai on Thursday May 26, 2022 @10:16AM (#31518604)
The developers you hire may hate you for it, though. And won't stick around. That'll create churn that creates even more debt.
Re:Learnings from 5 years of tech startup code audits by goto11 on Thursday May 26, 2022 @10:39AM (#31518881)
Does Facebook have problems recruiting?
Re:Learnings from 5 years of tech startup code audits by icedchai on Thursday May 26, 2022 @11:31AM (#31519598)
I think all companies are having problems recruiting in the current environment. FB for a myriad of reasons.
Re:Learnings from 5 years of tech startup code audits by Tabular-Iceberg on Thursday May 26, 2022 @06:38PM (#31524130)
>If you become successful, you can hire enough developers to pay back the depth in due time.

How many successful companies actually do this?

At one point in my career I transitioned from a startup to one that had been acquired some 12 years before, and found it to be even more chaotic than the startup. Instead of playing a frantic game of whack-a-mole with all the pivots and feature ideas of the founders, you had a few dozen teams playing whack-a-mole with the pet projects of their respective product managers who were trying to make a name for themselves. Which was much worse because you had to coordinate with every other of those teams, and of course work with all the integrations with the parent company.

Charitably speaking, maybe these older successful companies are bad simply because the field of software engineering was still too immature when they came about, and today's startups will actually pay back their debt when they become successful in the future. Sure, we have better tools now than then, but we still don't have a static analysis tool that can determine if we built the right or wrong thing for an ever changing market.

Re:Learnings from 5 years of tech startup code audits by quickthrower2 on Thursday May 26, 2022 @10:26AM (#31518708)
Sounds like a version of the mythical man month. Throwing 100 or 1000 developers at it will not reduce tech debt alone. It is probably harder to eliminate debt with more developers.
Re:Learnings from 5 years of tech startup code audits by randomdata on Thursday May 26, 2022 @10:32AM (#31518787)
I have not found working on the wrong things to be problematic so long as you take the time to eliminate the wrong things once they have established themselves as being wrong.

Not taking time is, at heart, where tech debt is born. That can manifest debt across all areas of the development process. Pressure to not take time can certainly come from management, but I have also witnessed on numerous occasions the reverse, where management asks developers to slow down and take the time to do the work well; sometimes to no avail.

Either way, your underlying thesis is quite true that given the perfect system an imperfect team will quickly reintroduce said problems into the system. This is why many software companies have become hyper-picky (even before the tech crash) about hiring. They want to try and avoid building a team that wants to shortcut that time.

Re:Learnings from 5 years of tech startup code audits by JamesBarney on Thursday May 26, 2022 @01:09PM (#31520846)
What killed them was they never found PMF. Eventually the tech debt slowed them down so they couldn't take as many swings at finding PMF.

But in the counterfactual if they'd tried really hard to avoid tech debt that would have slowed them down at the beginning, not to mention there are plenty of organizations that will write very complex abstract code to avoid tech debt, and end up making the code base incredibly painful to work with. So overall did get they get less swings?

I've worked on a lot of old code bases and the biggest issues I've run into, issues that crippled development velocity, were 95% boneheaded decisions and overengineering. And never the types of code quality issues someone like Uncle Bob talks about in Clean Code.

Re:Learnings from 5 years of tech startup code audits by spdionis on Thursday May 26, 2022 @06:44AM (#31516798)
Well, why are those companies pivoting so often in the first place? Isn't the root cause probably in GP's list?
Re:Learnings from 5 years of tech startup code audits by new_stranger on Thursday May 26, 2022 @12:07PM (#31520052)
And keeping 100% of all features instead of removing the least-used features as you add new ones to keep tech debt from growing indefinitely and reaching a point where new features take months to ship.
Re:Learnings from 5 years of tech startup code audits by brainzap on Thursday May 26, 2022 @06:29AM (#31516697)
we need data on this
Re:Learnings from 5 years of tech startup code audits by trivialsoup on Thursday May 26, 2022 @09:50AM (#31518306)
> What is important to realize when reading this that it is a case of survivorship bias.

This is totally true, but taken too seriously it leads to inability to learn anything from almost any information whatsoever. What’s more, whatever you do (whether you take the advice of those who have gone before or not), you will not be able to decide whether you made good decisions or merely “survived”.

How does one proceed when anything can be survivorship bias and determining cause and effect for large scale operations like running a business is essentially impossible.

(When I say “anything can be survivorship bias” I specifically mean that no matter the cohort you cannot decide whether you’ve accidentally excluded unknown failures, and hence you have no assurance of the actual strength of any analysis you do).

Re:Learnings from 5 years of tech startup code audits by leroman on Thursday May 26, 2022 @11:37AM (#31519666)
> In 15 years of doing technical due diligence (200+ jobs) I have yet to come across a company where the tech was what eventually killed them.

Not my experience..

What does a “tech failure” look like? Do the servers catch fire? Is the web site down? Maybe people are unable to login to their stations?

Hi-tech business is “Tech”, so the failure of the business is in fact the tech failing. More specifically, the business was unable to direct the tech to solve real problems and solve them well enough.. New hires took too long to onboard.. Engineers were only superficially productive.. Communication between the stake holders and engineers was lacking.. etc.. etc..

Take note that in all scenarios above “work” is being done, “progress” is being made.. ceremonies are everywhere and success is seemingly around the corner.. Or is it?

It’s just very hard to see these issues, they are hidden under layers of meetings, firings, hiring, pivots, milestones with little progress in actual business value.

Re:Learnings from 5 years of tech startup code audits by marginalia_nu on Thursday May 26, 2022 @09:20PM (#31525149)
I think the harder you scrutinize the distinction between a tech problem and a business problem, the harder it becomes to find it.

When there appears to be such a distinction, that's usually a manifestation of something like Conway's law, a symptom that there exists an unhealthy organizational divide between business and technology.

Re:Learnings from 5 years of tech startup code audits by leroman on Friday May 27, 2022 @06:02PM (#31535441)
I suppose that is my point, sayings such as "I haven't seen a single start-up failing due to tech" is not possible to defend..
Re:Learnings from 5 years of tech startup code audits by jackblemming on Thursday May 26, 2022 @04:56AM (#31516161)
>relying on non-existent technology while faking it for the time being and so on have all killed quite a few companies

This doesn’t count as a tech problem?

Re:Learnings from 5 years of tech startup code audits by jacquesm on Thursday May 26, 2022 @05:13AM (#31516251)
Obviously not, it's a problem to decide to fake non-existing tech but more of a management decision than a problem with the technology itself, there is an infinite number of things that don't exist, no matter how much you want them to exist and if you are not capable of coming up with a working solution and rely on the world around you to move fast enough to bail you out then I would say that is a psychological problem more than anything else.

A common theme right now is 'AAI', using people to fake an AI that may not come into being at all, let alone before your runway (inevitably) runs out.

Re:Learnings from 5 years of tech startup code audits by lozenge on Thursday May 26, 2022 @05:54AM (#31516479)
I saw one "secretary AI" that schedules meetings over email in your calendar. Just cc it to start using it (once you signed up). The idea seemingly being, fake it with low cost outsourcing to prove there's a demand for this and then make it.

The developers you'd hire to make it an actual AI and the developers you'd hire to make it a Mechanical Turk are very different skill sets.

Re:Learnings from 5 years of tech startup code audits by stonemetal12 on Thursday May 26, 2022 @12:25PM (#31520295)
I wouldn't count Theranos' failure a tech problem. I would consider it a fraud problem.
Re:Learnings from 5 years of tech startup code audits by pphysch on Thursday May 26, 2022 @12:44PM (#31520524)
I'd hazard a guess that many cases of startup fraud start out as good-faith delusions of grandeur, and only pivot to bad-faith fraud when the founders realize it's the only option to keep the lights on. Because the product results aren't there.

That is, plan A is Stripe, plan B is Theranos.

Re:Learnings from 5 years of tech startup code audits by jacquesm on Friday May 27, 2022 @05:04AM (#31527489)
You may well be on to something here. But I've seen a couple where plan A was Theranos.
Re:Learnings from 5 years of tech startup code audits by mathattack on Thursday May 26, 2022 @10:36AM (#31518843)
I was in a startup that failed in part due to tech issues. The AI model just didn’t work. There were a lot of other problems but if the tech worked, they could have easily gotten paying customers.
Re:Learnings from 5 years of tech startup code audits by rr808 on Thursday May 26, 2022 @11:24AM (#31519494)
> yet to come across a company where the tech was what eventually killed them

I would think that a poor quality product, or one not as good as competitors would be a big killer. Google, Facebook, Amazon have amazingly superior products. I think you're missing something.

Re:Learnings from 5 years of tech startup code audits by aiisjustanif on Thursday May 26, 2022 @07:35AM (#31517116)
> In 15 years of doing technical due diligence (200+ jobs) I have yet to come across a company where the tech was what eventually killed them.

How about the cases where it caused fines due to failed security compliance that didn’t help the situation. Thinking fintech companies especially.

Re:Learnings from 5 years of tech startup code audits by jacquesm on Friday May 27, 2022 @05:12AM (#31527533)
I've yet to come across a company killed by fines, are there any examples of those? If anything I think the fines are still much too light.
Re:Learnings from 5 years of tech startup code audits by lupire on Thursday May 26, 2022 @10:14AM (#31518578)
The fines are trivial in the US.
Re:Learnings from 5 years of tech startup code audits by thewarrior on Thursday May 26, 2022 @06:02AM (#31516528)
Interesting. Have you written more about this somewhere ? If not you should.
Re:Learnings from 5 years of tech startup code audits by jacquesm on Friday May 27, 2022 @05:13AM (#31527540)
Never really thought about it, I'm typically under NDA but in aggregate I could probably do something with this without breaking those NDAs.