Study Finds Spread, Size and Change History Predict Defects in Code Diffs

·3 views

Research dating back to 2000 on Bell Labs telephone switch software found that changes touching many subsystems, involving many edits, or fixing field faults were more likely to fail. Developer experience reduced the risk, while the number of deleted lines had no measurable effect. A 2013 follow-up by Kamei and colleagues tested similar signals across more than 250,000 changes from eleven projects, proposing that risky changes be flagged at check-in. The authors stressed that these models reveal correlations rather than proven causes. The article suggests that signals like these, which can be extracted from git, could help reviewers prioritize agent-generated diffs rather than reading them in file path order.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Check Agent Config Files in Cloned Repos Before Opening Them With Claude Code or Codex

A developer guide warns that cloned repositories can contain configuration files that alter how AI coding agents such as Claude Code, Codex, and Gemini CLI behave. Files like .claude/settings.json, .mcp.json, and .gemini/settings.json can define shell-command hooks, MCP servers, and helper commands that run on the user's machine. The article notes that each agent applies its trust checks differently, and in some cases, such as non-interactive mode, those prompts are skipped entirely. It recommends inspecting these files with tools like git grep and jq before launching an agent in an unfamiliar project. The guide also outlines specific flags and settings that can limit what project-level configuration is allowed to run.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LiteLLM 1.107.0 cleanup: what a stable security baseline should verify

A host-level cleanup can look finished while an exposed service, cached artifact, or stale credential remains active. LiteLLM's incident guidance calls for removing compromised artifacts from registries, rebuilding affected environments, rotating credentials, and confirming old releases cannot return through caches. External scans, such as ZoomEye queries on the LiteLLM title and default port 4000, show where services are visible, while internal records show which deployments exist, their owners, and the artifacts they run. The two views should be joined at the level of owned assets rather than summed, since one host or owner can appear across several queries. Closure requires verified ownership, confirmation that the compromised release is absent, correct authentication and ingress settings, and, where the payload could have run, credential rotation and a persistence check. Evidence must be timestamped, since earlier clean scans or newly created keys do not by themselves prove the final state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Identity verification timeouts should not be treated as approval or rejection

When an identity verification provider times out or its callback arrives late, the check has not completed, so the outcome is neither approval nor decline. The article warns against letting users through or rejecting them by default and recommends recording the technical failure separately from the decision. It describes a synthetic SQLite-based example in which a session has a deadline, late or unrecognised events are marked expired or unknown, and recovery occurs locally without polling a provider. In the hypothetical scenario, an expired session routes to human review or an authorized provider refresh rather than an automatic retry. The example is a dependency-free fixture and not a live provider integration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Phone lookup APIs can inform signup steps but cannot prove number ownership

A phone lookup API answers only a narrow question about a number, not about the person entering it. The article argues that developers should decide which signup decisions a basic lookup result can support before integrating one. Rejecting users whenever a lookup is inconclusive, or treating a lookup as proof of ownership, are both presented as design errors. A synthetic four-branch example maps normal, unknown, provider failure and OTP outcomes to caller-owned next steps such as continuing signup, review, bounded retries or an existing OTP provider. The author notes that unknown and provider failure results both should avoid automatic rejection, since they signal different problems that call for different handling.

0 comments Read more at DEV Community