4 ms·

I have performed reviews on pullrequest.com, and lack of context tends not to be an issue. Code review is an interactive process, where questions can be posed t

I have performed reviews on pullrequest.com, and lack of context tends not to be an issue. Code review is an interactive process, where questions can be posed to the PR authors, and PR reviewers have access to search the codebase. Customer success at pullrequest.com also provide context for the repo and organization working practices, attached at the top of PR descriptions, to help reviewers with context and to know what kinds of feedback are useful. Sast and Dast are still not sophisticated enough or widely used enough to be good enough. In-house senior and principal engineers often do not have the time to be on top of every repo and every PR in their organization, and need to outsource an extra pair of eyes. It is highly common that I am reviewing codebases that do not have any Sast or Dast, or have workarounds to silence the tools, resulting in bugs and security issues slipping through. It is very rare that I am able to approve PRs without comments, even after an internal review has taken place!

robocat 5y ago
> Sast and Dast SAST, or Static Application Security Testing DAST, or Dynamic Application Security Testing https://www.softwaresecured.com/what-do-sast-dast-iast-and-rasp-mean-to-developers/ https://www.softwaresecured.com/what-do-sast-dast-iast-and-r...
winterplace 5y ago
Hi Graham. Do you have an email address or a method of contact?
spmurrayzzz 5y ago
Just curious about the flavor of code you were reviewing. Can you elaborate a bit on that? Specifically - any software integrations with hardware? E.g. maybe a distributed cloud service that talks to on-prem firmware or similar (think IoT, cisco/juniper network gear, etc). There is a whole class of software that I can't imagine someone could come in blind to and offer any real value to necessitate the balance sheet exposure. But I'm very interested to hear if folks there have had to do this (yourself or others).
dm03514 5y ago
> Code review is an interactive process, where questions can be posed to the PR authors, and PR reviewers have access to search the codebase. I also performed reviews on pullrequest.com (~2+ years ago?). I firmly believe code reviews are an interactive and knowledge sharing process but was explicitly told NOT to ask questions during pull requests, but instead to make statements focusing on bugs and style. Based on the comments here, this def looks valuable to some of pullrequests.com customers. I believe this is more of a human acting as a safety net, or risk mitigation strategy, and loses the majority of the value that pull requests can provide to an organization.

robocat 5y ago

> Sast and Dast SAST, or Static Application Security Testing DAST, or Dynamic Application Security Testing https://www.softwaresecured.com/what-do-sast-dast-iast-and-rasp-mean-to-developers/ https://www.softwaresecured.com/what-do-sast-dast-iast-and-r...

winterplace 5y ago

Hi Graham. Do you have an email address or a method of contact?

spmurrayzzz 5y ago

Just curious about the flavor of code you were reviewing. Can you elaborate a bit on that? Specifically - any software integrations with hardware? E.g. maybe a distributed cloud service that talks to on-prem firmware or similar (think IoT, cisco/juniper network gear, etc). There is a whole class of software that I can't imagine someone could come in blind to and offer any real value to necessitate the balance sheet exposure. But I'm very interested to hear if folks there have had to do this (yourself or others).

dm03514 5y ago

> Code review is an interactive process, where questions can be posed to the PR authors, and PR reviewers have access to search the codebase. I also performed reviews on pullrequest.com (~2+ years ago?). I firmly believe code reviews are an interactive and knowledge sharing process but was explicitly told NOT to ask questions during pull requests, but instead to make statements focusing on bugs and style. Based on the comments here, this def looks valuable to some of pullrequests.com customers. I believe this is more of a human acting as a safety net, or risk mitigation strategy, and loses the majority of the value that pull requests can provide to an organization.