from Hacker News

Code Reviews Are Not Effective at Finding Bugs

by mgreene on 7/23/24, 5:01 PM with 7 comments

  • by kstenerud on 7/23/24, 5:31 PM

    If your code review approvals are taking days, you're doing it wrong. That's not a system problem; it's a culture problem (your company doesn't factor in review time as part of a developer's job), and possibly a signaling problem (the person isn't aware that you're waiting on them).

    You can also open up PRs that merge into another PR it depends upon. Once the bottleneck PR gets merged to main, your dependent PRs get rerouted to be PRs that go to main.

    Then comes the issue of deciding what kind of change should be considered trivial enough to not require code review before merging, and who will make that call on a per-change basis. Number of lines is not a good enough metric, because not all lines can cause the same potential damage.

  • by alex_lav on 7/23/24, 5:04 PM

    While I agree, a company making a post that is a subtle advertisement for their software is probably the least trustworthy source for pretty much any take.

  • by taylodl on 7/23/24, 6:13 PM

    The purpose of Code Reviews is not to find bugs. The purpose of code reviews is:

    - Verify unit tests have been created, have passed, and have sufficient coverage

    - Ensure the code addresses requirements/bugs

    - Ensure adherence to coding guidelines (I don't like coding guidelines, but most teams do)

    - Ensure documentation is present, if needed/required

    A code review should not take long, and the purpose is not to find bugs.

  • by pavel_lishin on 7/23/24, 5:30 PM

    > Code review should still happen here, just independent of approval.

    If code review is not necessary for approval, then for most engineering teams, it will simply never happen.

  • by mgreene on 7/23/24, 5:01 PM

    Building upon Microsoft's earlier analysis (https://pdfs.semanticscholar.org/c079/0dc547c56ca48b78bc418b...), our data, which is composed through an objective risk measure, confirms similar findings about code review efficacy w/r/t finding bugs.