3 ms·

Should we also look at final code assuming the programmer and their code reviewers lack basic competence? Or do we assume they made a best effort given their ab

Should we also look at final code assuming the programmer and their code reviewers lack basic competence? Or do we assume they made a best effort given their abilities and may have still made mistakes? I believe the latter, and the rule I mentioned also leads to that assumption. Otherwise, why read the studies at all? But that's not what people here do. > missing major details on how the corrections/controls were made I also make an assumption that some corrections/controls are so obvious within their field of study that they aren't worth documenting - that it's only "average joe" readers who assume they aren't being done. It is, in a way, akin to asking why programmers didn't document how their JWT is secured.

dekhn 4y ago
I don't compare software engineers and scientists by the same metrics. The important thing about a code review request is that it contains everything required for me to reproduce the effects of the code change in my own hands. Science does not require that- instead, the methods is typically the "least descriptive and helpful representation of what was done" (especially in the case of very complex biological experiments) and can't be reproduced with nontrivial effort. BTW I've definitely gone into code reviews assuming the programmer lacks basic competence and been right. Other times, I've had to rollback other people's code (or stop a rollout) because an ostensibly genius programmer who made a change (and got a review from a starry-eyed junior) wasn't using their basic competence or testing their change at all.
eurasiantiger 4y ago
Bad example. While the tokens themselves can only be secured in a handful of ways, JWT auth implementation is notoriously tricky. Even the official docs of some well known packages promote insecure practices such as storing tokens in browser localStorage.

dekhn 4y ago

I don't compare software engineers and scientists by the same metrics. The important thing about a code review request is that it contains everything required for me to reproduce the effects of the code change in my own hands. Science does not require that- instead, the methods is typically the "least descriptive and helpful representation of what was done" (especially in the case of very complex biological experiments) and can't be reproduced with nontrivial effort. BTW I've definitely gone into code reviews assuming the programmer lacks basic competence and been right. Other times, I've had to rollback other people's code (or stop a rollout) because an ostensibly genius programmer who made a change (and got a review from a starry-eyed junior) wasn't using their basic competence or testing their change at all.

eurasiantiger 4y ago

Bad example. While the tokens themselves can only be secured in a handful of ways, JWT auth implementation is notoriously tricky. Even the official docs of some well known packages promote insecure practices such as storing tokens in browser localStorage.