Hacker News Reader

Trust, but verify. We're only human after all :-)

At $DAY_JOB we need approvals from peers due to industry regulation.

In my experience, US healthcare, that box can be checked at later stages, namely deployment to production. It's a choice to add it earlier.

If it is for checking a box, sure. If it is part of a process that aspires to deliver projects with quality and with somewhat predictable release dates, that seems way too late, imho.

And a great way to end up leaking customer data from a SQL injection or other error that could have easily been caught during a more piece-wise analysis and vetting of the related code nearer to time of writing.

Sadly it often is box checking, code review or not. I'm only stating that there is no requirement in US healthcare that I'm aware of that requires approvals before merging code. Maybe that's not true in other industries. But most regulatory frameworks that I'm aware of are flexible, ambiguous, on implementation details by design.

If you find that outcomes are the same by making approvals optional at that stage, then do so with accompanied justification.

Reply on news.ycombinator.com