I've wondered about this. Anecdotally, the place I've worked with the best quality didn't do code review (maybe three "serious" user-visible bugs during the 8 years I was there, one of which was a fab issue that couldn't have been caught with any amount of code review).https://twitter.com/skamille/status/1169765800829435904 …
-
-
This no different from other fields, but we have this rhetoric around how well reasoned our practices are. But if that's true, why does it take decades for best practices to diffuse, just like every other field where practices are culturally inherited and obviously unoptimized?
-
Yes. Even stranger that code reviews went from rare to ubiquitous over the last 20 years with no evidence, when fuzzing did not despite tons of evidence.
- 4 more replies
New conversation -
-
-
Could it be that ~95% of devs today are using memory-safe languages? I like fuzzing, but it takes some rearchitecture to set up for, and I don't know that I'd believe it's worth it for something like JS, Java, Rust, or even Golang.
-
I don't see why fuzzing or randomized testing should only be used for memory-unsafe languages? The vast majority of bugs I've found with these techniques aren't memory safety bugs.
- 7 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.