Comment by eterm | Hacker News Reader

Comment by eterm | Hacker News Reader

Parent Full thread

I absolutely trust my co-workers to not be overly pedantic and opinionated.

If they were, I would raise it with my line manager and try to get the issue fed back to them.

What kind of workplace do you not trust your coleagues to be reasonable?

I don't trust myself nor anyone to not make mistakes or have blind-spots that pull requests and code review helps catch.

Here's an example from today of an issue caught code review, that could have been a bug that easily slipped through testing only to become a hard debug issue months or years later:

"You're assuming the order here, but it should be set explicitly".

Caught by the reviewer, and easily fixed in seconds.

But that could have been a really expensive bug to fix later.

And it wasn't really through a lack of competence, just an oversight because the data wasn't necessarily sorted at that point.

And the gating helps enforce and audit that code is reviewed, that everyone can go back and read the reviews to understand the journey the code went through. If there's later a bug in that area, there are now two different people I can know to ask first about that code.

Making code review optional is a good way to get it waved through with little oversight.

Having the people who okay the request share responsibility for fixing that code is a good way to motivate better code reviews as well as share knowledge.

Why would a coworker want to block your progress? Maybe I've never worked anywhere toxic enough to understand.

> What kind of workplace do you not trust your colleagues to be reasonable?

This reads a bit weird so I'm interpreting it as "what kind of workplace causes you to not trust your colleagues to be reasonable?"

Lots. There are many places where developers will play outright power games in order to posture and preserve their position. The PR is a big spot where this can shine through in black/white. As a manager, I really have to police GitHub/GitLab/Bitbucket to ensure that this isn't happening.

I've had juniors, equals, and seniors hold up months worth of work for arbitrary reasons, purposefully pushing past deadlines. Some even admit to it behind closed doors/in meetings. Toxic work places surely exist.

---

To be clear, I am 100% in support of peer reviewed work as a SWE (PR's, external auditing, etc)... I'm just expressing that I've experienced the check/balances of peer reviewed work weaponized, typically to feign importance or as an unfair attempt to advance someone's career. I feel like it's just the human condition that some people will just take advantage.

> There are many places where developers will play outright power games in order to posture and preserve their position.

Isn't that a strong signal that the culture is bad?

Maybe not of the entire company, but at least of the team that's happening in.

> Isn't that a strong signal that the culture is bad?

It can be - but it is also isolated to pockets/individuals within a company which doesn't necessarily define the culture.

> Maybe not of the entire company

Absolutely agree, and that's not well captured in my comment on second read. It can be at the company level, at the team level, and all the way down to the individual level - obviously in any configuration/mix. Sometimes it's not on the company that they had a hypothetical bad hire as long as they take corrective action, just to give an example.

> Making code review optional is a good way to get it waved through with little oversight.

Me: "Code review is fine and necessary."

How did you turn "necessary" into "optional"?

This seems to be just more evidence that for some reason, some people can't seem to imagine code review without pull requests. Maybe you have to be older, and worked before git and GitHub existed? I don't know.

Let me spell it out more clearly: a pull request is when the reviewer can reject your commit and force you to meet the reviewer's demands. Whereas you can have mandatory code review without pull requests, where the mandate is just that someone has to examine your commit and comment on it.

> Why would a coworker want to block your progress? Maybe I've never worked anywhere toxic enough to understand.

Have you... heard of large corporations? ;-)

this isn't about pull requests at all. this is about gating, done via sending patches via email, or branch pulling, or some other mechanism.

You seem to be against the concept of someone having the ability to veto your submission, and that is indeed what most people think of the purpose of code review is. If it doesn't pass muster, it doesn't get merged into the main branch.

> this isn't about pull requests at all. this is about gating

I know. My original comment said, "The author keeps equating code review with pull requests and gated check-ins."

> You seem to be against the concept of someone having the ability to veto your submission

Correct.

> that is indeed what most people think of the purpose of code review is.

I don't know about "most" people, but the people who think that are wrong. :-)

> If it doesn't pass muster

According to whom, is the question.

Answer is simple: according to people who would be suffering from bad code.

I've had seen code reviews done by people who are not working on the code in question and never will, and this is dysfunctional and should never happen. If that's your case then I am sorry and yes, make code-review optional, non-blocking or even better cancel them all together.

But the proper code review is done by your peers working on the same part of code. When I put a blocking comment saying "this function called GetFoo now deletes database, submits payment and returns Bar, please rename it to match its function" this is not done because I read too much books and have weird ideas... This comment was written because I know that next week I will be adding new features and debugging production failures and having bad code will actually impede my progress.

Of course people may disagree what "good" is, so there should be some way to resolve conflicts. I've seen teams with very strong technical leader who had the final word. Or the one place which had "review meetings" for author/reviewer disagreements which anyone could attend and which would vote on resolutions. Either way, make sure you have a wiki page or something where you can write down what you decide on (for example: "no review defect should complain about punctuation in comments"), so that the same questions don't come up again and again.

(Btw, if you have problems with other people reviewing your code, this is where microservices shine. You have your own repo and service, they have their own repo and service. No one touches other's code and thus has no grounds to impose code review. Just make sure to have good monitoring solution so that if main app falls down you know who's service to blame.)

> Answer is simple: according to people who would be suffering from bad code.

The users?

> But the proper code review is done by your peers working on the same part of code.

Of course. However, that's tangential to the issue of code vetoes.

> Of course people may disagree what "good" is, so there should be some way to resolve conflicts. I've seen teams with very strong technical leader who had the final word.

That's fine, but many conflicts can be avoided by not having vetoes in the first place. If the coder refuses to fix code that the reviewer considers not shippable, then they can go to the manager to resolve the conflict. The manager always has a veto, but otherwise there's no reason for coworkers to have a veto over each other.

> if you have problems with other people reviewing your code

I don't.

um... what do you mean "not having vetoes in the first place"?

Author opens a PR. Reviewer starts reviewing. The pull request merging should be blocked until review is done, if anything to prevent mistakes. As review progresses, there is a comment which author refuses to fix. Since all parties must mark review as "complete", the PR is blocked cannot be merged until the comment can be resolved. Author and reviewer go to manager, which decides on one way or another. The manager's resolution is applied -- either reviewer resolves the comment, or author rewrites PR to fix the defect.

Was there any "veto" applied? It is not like there is a button labeled "veto" during review process, it is just that some comments take longer to resolve some others.

Or is your ideal system when reviews are non-binding and author can press "merge" button at any time despite having open review comments? In this case it is pretty horrible for reviewers - code review is a very hard job and I would be pretty disheartened if the author just walks away instead of resolving discussions. I think if your review is like that, you might as well just code reviews altogether as it is a total waste of time.

> Author opens a PR.

Going back to what I said in an earlier comment:

"This seems to be just more evidence that for some reason, some people can't seem to imagine code review without pull requests. Maybe you have to be older, and worked before git and GitHub existed? I don't know.

Let me spell it out more clearly: a pull request is when the reviewer can reject your commit and force you to meet the reviewer's demands. Whereas you can have mandatory code review without pull requests, where the mandate is just that someone has to examine your commit and comment on it."

So let's start over:

1) Author commits to a branch.

2) Someone else reviews that commit and gives feedback.

3) If necessary, as determined by author based on the feedback, author modifies code.

This is an async process. There's no blocking.

Ah, I worked in a place like this. We had a lightweight Fagan inspection process (with 4 roles and all that stuff) and some scripts we wrote to ensure each commit was either reviewed or explicitly skipped.

It was OK - definitely better than nothing, but with its own problems. Biggest defects were the worst - lets say someone made a new library function and inspection found out that function should not exist at all. By the time it's time to make a fix, code might already be used. The latency was not so great -- to save time, we often requested a review of entire patch series so the time from the first commit to the first comment was pretty long.

Later on for business reasons we had to stop working on that codebase and start all new code from scratch. Everyone on the team voted to switch to "pull review + code review before commit" and we never looked back.

Thinking back about this, the main reason to use post-inspection was that the tooling sucked. Back then we had SVN and branches were super heavy, the easiest way to share code was to email files around, and combining yours and someone else's unpublished changed was arcane process which could easily lead to data loss. Additionally, all sort of tooling, like advanced tests and staging environment required code on master. So making merge quick and easy was the only solution.

Luckily by the time we started again git was around (but not github, and we self-hosted everything anyway), so we improved the tooling itself. Turns out having lightweight branches is great! And being able to tell a colleague "PTAL at my branch" is also great! And we improved tooling so we could push any branch to staging or run extended tests on any commit! And we can review the code and fix it before having entire company use it! So the fact that a PR might take a day or two to land was not a big deal at all.

If you are still on the post-commit reviews, take a look at your processes. The new features are great, and you might be missing out on them.

(This assumes a medium sized team. If it's just 2 people working on a codebase, the benefits are much less and costs are relatively bigger)

Reply on news.ycombinator.com