Senior Engineers Use Code Reviews to Question Design, Not Just Hunt Bugs

·1 views

A widely discussed piece from the DEV Community argues that the highest-value code review skill is questioning whether a change belongs in a codebase at all, not merely whether it works correctly. Research from Microsoft found that only 14% of review comments address defects, while 29% focus on code improvements like readability and maintainability. A separate Microsoft study concluded that at least 50% of review feedback concerns long-term maintainability rather than bug detection. Google's analysis of nine million code changes similarly found that reviews primarily serve to transfer knowledge, uphold codebase integrity, and establish team norms. The article contends that senior reviewers add the most value by evaluating a change within its broader system context, catching structurally misplaced logic that may look correct in isolation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Web Share API brings native OS share sheet to browsers with minimal code

The Web Share API, accessed via navigator.share(), allows web pages to trigger the same native share sheet that mobile apps use, requiring just a few lines of JavaScript. A developer implemented the feature on Forgemage.net, a marketplace for the game Dofus, to let users easily share item requests with others. The API has two key requirements: the page must be served over HTTPS, and the share call must be triggered directly within a user gesture, with no intervening network requests or the browser will reject it. Developers must also ensure shared URLs are absolute rather than relative, as relative paths are meaningless outside the context of a specific host. Fallback handling covers browsers that lack support and cases where the user dismisses the share sheet, making the feature straightforward to implement progressively.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Blameless Postmortem Template Helps Web Agencies Learn From Incidents Without Blame

A blameless postmortem is a structured process that examines how systems, tools, processes, and context combined to cause an incident, rather than assigning personal fault. Published on DEV Community, the template is designed for small web agencies and is intended to be completed in a focused 45–60 minute meeting with a concise written document. The approach separates technical learning from HR, legal, or disciplinary processes, while still requiring clear ownership of corrective actions. Teams are guided to build timelines from evidence, review detection and response quality, and produce a small set of specific actions with assigned owners and due dates. The template also defines common postmortem triggers, such as customer-visible downtime, data loss, emergency rollbacks, and repeated or near-miss incidents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GPU Has Two Parts: Why VRAM, Not Cores, Determines If Your Model Loads

A GPU card consists of two distinct components: processing cores that perform calculations, and VRAM (video memory) that stores data — a distinction that confuses many engineers new to AI infrastructure. When a large language model is deployed, its weights are loaded into VRAM, not into the cores themselves. The cores continuously stream data from VRAM to perform each calculation, which is why language models generate text word by word rather than all at once. On AWS EC2 instances, the prominently listed system RAM figure is irrelevant to model loading — only the GPU's VRAM capacity determines whether a model fits. For example, a g6.4xlarge instance lists 64 GiB of system RAM but only 24 GB of VRAM on its NVIDIA L4 GPU, and AWS does not display VRAM directly on its EC2 pricing page, requiring a separate cross-reference.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds nightly AI agent attack system, finds gaps in Google's own tools

A developer created an automated security tool called Crucible that stress-tests AI agents for prompt injection and other vulnerabilities by running adversarial attacks every night at 3am UTC. The system plants detection tripwires in each agent's environment rather than relying on the AI itself to report whether it was compromised. Testing revealed that Google's Model Armor guardrail layer failed to block attacks that succeeded at baseline, including an injection hidden inside a scanned invoice image. Crucible was also pointed at Google's official sample customer-service agent, where a normal-sounding customer message bypassed a guarded discount-approval tool after an explicit rejection. The developer reported the finding to Google's Bug Hunters program, which escalated and closed it as 'Infeasible,' citing the sample-code scope of the repository.

0 comments Read more at DEV Community