3 ms·
> How at this point code review not entirely automated? There is no automated way to check intention. I can write perfectly correct code which also drops the d
by shusson 7y ago
> How at this point code review not entirely automated?
There is no automated way to check intention. I can write perfectly correct code which also drops the database.
- antpls 7y agoIn this case, wouldn't you use some kind of permission/security groups/roles at the db level or firewalls that would block such intents? Wouldn't it be possible to add an automatic linter pass that does "grep DROP" on the source code? Even unusually things such as code obfuscation can be automatically detected to some extent. An automated way sounds more fair, robust and scalable. To me, there is something in human code review that is not engineering, it's all about judging people (unless the code review is fully anonymous for both side)
- shusson 7y agoDropping the db just an extreme example. There are infinite ways a developer can use tools correctly but build wrong things. Don't get me wrong, automating things is great, but you're never going to replace code reviews. Unless you have some crazy advanced AI that can interpret requirements and detect incorrect implementations. But at that point I would imagine the crazy advanced AI might as well be creating the implementation in the first place...