3 ms·
People already barely reviewed code, most of it was imported libraries.
by vasco 5mo ago
People already barely reviewed code, most of it was imported libraries.
- seanw444 5mo agoThe assumption used to be that you respected the library enough and believed it was well reviewed and architected by the maintainer(s). But now even that's unreliable because libraries are being slopified at an unreviewable pace too.
- jatora 5mo agoIt's weird that you think humans weren't slopifying code until LLM's came along. At least now they are implementing tests and CI and far more documentation, updating API versions, etc. OOMs above the amount they did before. I'd also wager that far more % of code gets more coverage of review, via prompting AI to do it, than it did before. Most PR's pass as long as they A. pass checks, B. dont introduce regressions, C. fix a bug or implement a feature. People talk about this era of humans reviewing code with nostalgia... but that never existed at scale.
- bossyTeacher 5mo ago> The assumption used to be that you respected the library enough and believed it was well reviewed and architected by the maintainer(s). Let us be honest, for your average dev, the assumption was that the number of github stars, npm/nuget downloads was a god proxy for quality.
- embedding-shape 5mo ago> The assumption used to be that you respected the library enough and believed it was well reviewed and architected by the maintainer I don't know many serious software engineers who'd take that approach, the convention was always to actually open up the code, evaluate the quality, see if they seem to know what they're doing, then chose the libraries you know works and could be adjusted to fit whatever you wanted it. At least for professional development inside companies, not a single library would be included unless you at least reviewed that the top-level dependency you pull in actually had code worth pulling in in the first place. And this approach just as well today as it used to, you literally have to spend like 3-5 minutes browsing the code, evaluate the abstractions they've built and then say "Yes, looks good enough to try to use" or "Clearly these people just hacked this together as fast as they could".
- giancarlostoro 5mo agoPeople seem to have rosy glasses about how great and vetted code was before AI coding took off the way it has, it was not great.
- king_geedorah 5mo agoI’d say the increased scrutiny has merely exposed the difference in care between the different groups in the industry. Seems to explain pretty well why both sides are equally confounded by the other’s expectations.
- almostdeadguy 5mo agoPeople keep saying this like it’s some meaningful point, but the reality is many people in different projects have a shared need for that code to work correctly, and there is a social proof involved in used open source libraries. That is why people look at downloads and dependent projects as heuristics of stability and correctness. That is not the case with (and cannot be obtained with) code authored by generative AI.
- vasco 5mo agoYes it can, the code will be ran and you will have the proof that it ran well. Or it won't run well and you'll re-do it. Same as with some imported library.
- almostdeadguy 5mo agoRunning your code once or even dozens of times is not proof of correctness, see decades of software engineering practices around testing. I'm sorry, but all you guys pretending like you don't have to review code now are going to get seriously burned by this. I also have to ask: do you think you provide any value to your company?
- port11 5mo agoWhich people? I’ve never worked at a place where reviews weren’t taken seriously. For small changes a cursory glance, sure, but anything medium-sized meant checkout+local test. If anything we’d spend too much time on code reviews or pair programming?