Hacker News Reader

Comment by debacle | Hacker News Reader

I can write you code that will pass all static analysis tests with full code coverage and complete dependency injection that still makes you taste your lunch in the back of your throat. I think any good programmer could.

> forgetting that the reviewer just skimmed it over to get it out of their queue.

There's a difference between cargo cult code reviews and an actual, formal code review.

View on HN

There is a ~9 year old buffer overflow vulnerability in sendmail (crackaddr) that no static analyzer can identify even today (and they are specifically targeting it as a test case).

And what exactly is wrong with the code that passes all the tests and works? Its aesthetics offend you? Should the first priority of code be to work to just work?

Beauty is only a nice-to-have feature. If the pretty way is about as fast to produce as the "lunch in the back of your throat" model, sure lets go pretty. But if it's going to cost me 50% of my developer's time, I'll take the quick and dirty every time.

It's not so much about "beauty", but long-term maintainability of code makes development faster in the long run and reduces the murder rate within your dev team.

The wrong part here is in "passes all the tests and works" assumption. In my experience, static analysis, unit tests and reviews all help minimize errors (amongst their other benefits), ideally you'd make use of all three.

> I'll take the quick and dirty every time.

This is gonna start biting you in the ass after a few years.

You can write unmaintainable code that is still testable and passes static analysis tests.

Reply on news.ycombinator.com