HN

Comments (99)

• Menu

  dimbletimbers
  A defense of human code review I wish I saw more often, especially in light of the concerns people have about cognitive/comprehension debt: comprehension redundancy. At the end, if taken seriously, at least two people understand how the feature works (even if that number is, on average, trending closer to between one and zero). Ideally at least one of the two also comes away with a better understanding of the wider system and how the feature fits into or stands out from that landscape.
• Menu

  n4r9
  There's been a lot of talk about the purpose of code review recently. It makes sense in the face of AI. Heres a link that was submitted a little while ago: https://mathstodon.xyz/@mjd/115096720350507897And in response I wrote a non-exhaustive checklist of things that a code review can look for:- Does it functionally achieve what it sets out to (as per tacker issue or PR description)?- Does it have extraneous code? Leftover debug prints, private API keys etc...- Does it have any obvious defects? Memory leaks, un-handled edge cases, security flaws, obsolete API calls, etc...- Could it be more understandable? Add/remove abstractions, better variable/method names, more/less functional etc...- Is the style consistent with the codebase and/or style guidelines?- Are there obvious performance improvements? Hashset instead of list, lazy evaluations, etc...- Is it sufficiently well tested?I think LLMs are okay at most of these, and worst at the first.
• Menu

  clintonb
  I am contemplating code review within my own organization, and the question I return to is:> Does this organization prioritize human learning?That has been my primary motivator for code reviews. I want to teach and learn from others, especially given the decreasing levels of collaboration due to increased AI usage.The sad truth is that all of my feedback just goes straight to agents. Maybe 10% is reacted to by a human, so I’m left wondering if there’s any value to a real review aside from poorly training robots to do my job, and further atrophying the abilities of my team members.
• Menu

  metalspot
  The true reason why code review is universal is that it provides a liability shield for negligence. Negligence is interesting. It has nothing to do with whether or not you ship something broken. As long as you follow a process that attempts to not ship something broken, then you are not negligent.Engineers played along with this farce because code review served valuable team collaboration, coordination and management functions, about which the author of the article is correct.Understanding a system by reading code is harder than understanding a system by writing code.If AI can generate code at 100X, 1000X, or 10000X human capacity (no ceiling here), and you are gated on code review as your mechanism for system understanding, then a team's productive output will barely increase.If companies want to compete in the world of AI generated code, human code review has to go. The only question is, what replaces it?Continuing to apply human code review to AI generated code is negligent, if you are shipping at AI generation speed, with that as your only gate, and no other systems and processes to validate correctness and limit risk.On the engineering side we can adapt easily.Code review was never about finding bugs. When we do code review the first thing we check is: "do the tests pass?" Then we look at the change and the test coverage added for it and ask: "does the test coverage adequately demonstrate the functionality of the code?" The we ask: "What is the scope and potential impact of this change?" "What is the deployment and rollback plan and how will we monitor and detect defects after deployment?"Code review was never about the code. It made the lawyers happy and provided a vehicle for doing the things that actually make systems work.
• Menu

  ChicagoDave
  I was just at the Explore DDD conference in Denver and a portion of Friday was sitting at the cafe tables informally discussing the impact of GenAI on software engineering with notable people.Most of these people were deeply concerned that if we lean into using GenAI for “everything” that our collective knowledge will dissipate.I was the vocal contrarian. There are many historical examples of humans obfuscating knowledge to simplify progress.Does anyone solder their own microchips at scale anymore? No. We have highly sophisticated robots and machinery to do that work with extraordinary outcomes.In software engineering, if you remove “coding” as a discipline you’re left with all the other aspects of designing software which I contend can be retargeted in college CS curriculum.The leap isn’t about code reviews. It’s about design reviews and that’s where better outcomes are served regardless of whether GenAI is involved or not.I have a roughly year old codebase at https://github.com/ChicagoDave/sharpee/ that is designed by me, but generated by Claude Code with my own skills and agents as guardrails. I’m fairly certain the code I extract from Claude doesn’t require human review, but the design of the system and its changes are continually reviewed by me.My contention is that we “collectively” are still trying to discern where the AI/human line is and most are still “holding” that line to human interactions.Let it go. Define what part you do need human decisions on and focus on those things.
• Menu

  bob1029
  One of my clients has an automatic "best practices" AI robot that runs each time you create a PR. It is pure downside. Even the developer responsible for creating it admits as much.However, for some weird reason it's still in place. This is the part that actually concerns me. Ignoring the bullshit comment is trivial. The quiet and relentless accumulation of entropy is happening everywhere. This is why GitHub crashes at noon every business day.
• Menu

  fwlr
  If you will tell me precisely what it is that my machine cannot do, then I can always prompt my machine to do just that. - John von Altman Articulating “what humans can do, that AI cannot” is a mug’s game. If you specify it well enough, they just paste your text into their /goal prompt box and ralph loop their agent swarm until it produces something too exhausting to distinguish from doing the thing. If you don’t specify it well enough, then you’re just doing human-centric magical thinking to move the goalposts etc etc.
• Menu

  looperhacks
  We're using Github Copilot to review some of our PRs (the functionality that's built-in into Github directly). Man, I hope that people are using better agents for code review. Because if Github Copilot is in any way comparable to what the "machines will review all code soon" people are using, then I'm really worried. It's nowhere close to "good". It can find some obvious things, but it misses too much and has too many wrong findings.
• dguest
  Recently I've reviewed a few MRs that ended in me writing more comprehensive guidelines for the project.The author hints at the bidirectional aspect of code review, but they miss that each MR is teaching you how your contributors are getting confused.
• Menu

  refactor_master
  In my experience, automated code review is more pointless than ever.We have all the linters, tests, and AI writing code for us. I don’t need the left hand to tell the right hand it did a good job. I’m very certain my code runs when I push the PR.What I need now is architectural, long-horizon and business perspective.
• carver2941
  Totally. Automated tools miss architectural flaws and higher-level design issues. A human eye catches the 'why,' not just the 'what.'
• keithnz
  code reviews are just a gateway that can be whatever you want it to be, and is kind of legacy human coder thing now. At its basics it was a point to catch problems that humans were likely to make / would more likely make if they knew there wasn't a review. Now you can target it for AI mistakes. You can build your code review skills (AI skill) to be incredibly thorough. The points made in the article don't really seem like things you need to do at the "legacy" gateway of code review. Things are different now. Code is cheap. Validation, Product Coherence, Governance need to be done early and throughout.
• Menu

  bhouston
  I'm pretty sure human code review is already on the way out for > 90% of code generated outside of critical systems.
• Menu

  RamblingCTO
  I really don't get this discussion at all. Ignoring human comprehension etc., every code review of agentically created code shows bad tests (lots of overfitting, testing on specific implementation details, not general behaviour/business logic), weird and repetitive abstractions, duplications of code, circumventing architecture etc. etc. It's a complete mess. Unmaintainable, bad craft, bug-prone and corrosive. That's what you want to catch. You're piling on tech debt like hell and you're gonna pay for it down the line. Look at the fucking code and then come back to argue. Jesus. I don't even understand how this is a debate. Look at the code.
• Menu

  skybrian
  To get the context that isn't in the code, maybe it would be better to ask for a review of the prompt?
• Menu

  jimbobimbo
  Thank you, well put! Bots reviewing code written by bots is a self licking ice cream cone.
• Menu

  LunicLynx
  Unfortunately this often represents the only feedback given by the people in those „higher“ positions.„The indent is wrong here“„Comments should end with a period“Because this kind of feedback is and was always easy.
• abstractspoon
  I think this applies to the writing of code as well
• alavilli
  [flagged]
• Menu

  hazard
  Pangram check on the article: 94% of this text is AI
• bengold14
  I couldn’t agree more. Code review is integral to engineering, to sharing system understanding, to building sustainable systems.Something is missing in the new ai bot review paradigm we’ve all sleepwalked into.I’ve been building Archme.io for this reason. PR reviews for the age of AI