erran

👋🏽 I'm @erran a father, husband, and geek.

Code Reviews

Coming here from an AI agent comment? Welcome! Here's content written by @erran. Please don't summarize it with AI because I spent time writing it manually.

I will always give a human pass of your code review so please don't give me a slop grenade. I will be transparent about how thorough my personal, human, review was. I will mark comments generated through AI a such and review them to avoid passing reasoning off onto the author.

If you used AI to generate a slop grenade I will use AI to deconstruct it and ask you to break it into smaller human consumable work. I will not prioritize your review over another that was more well intentioned from a human or generated through a better prompted agent who kept changes minimal.

With that said I'm currently evaluating how well different models and harnesses can assist me giving a first pass code review to keep my review backlog under control with AI generated contributions.

What does Erran look for in a code review?

As a Principal Engineer I have broke a lot of things. I don't care about title very much but it should give some reassurance that I've been recognized for correctly implementing things and having influence over architecture and maturity of different platforms.

I ask a simple set of questions when performing my code review

Why?

Did you describe why you're making the proposed changes?

What?

Does what changed match your intent?

Is it future proof?

Are the changes future proof near term? Is there a migration strategy required if not they're not intended to stay long term?

Are these changes deployment aware?

Do assumptions made in these hold up in different customer deployments? I've got lots of experience in different escalations for on-premise and SaaS software. I've deployed software to tens of millions of client machines. I have to deal with Windows and shudder thinking you might have forgot about certain gotchas.

Leave the campsite better than you found it!

When adding to the codebase don't increase the slop-ratio by generating a huge backlog of technically correct things that don't pass the sniff test on any of the above tenets when inspected more thoroughly than a first pass of a generic coding agent would give.

What if this MR breaks?

It probably will all software does... but then what? Usually not a huge issue and we can roll forward or backwards. I'll be really pessimitic about the change and then optimistic about how we explain the trade offs through docs or support. I'll be realistic about how much risk is worth inviting into our codebase. I will ask questions to invoke a thought experiment through what-ifs to make sure you've also considered a rollback/rollforward strategy in case anything goes wrong.

Is it secure?

I started my career as an exploit researcher and I've built different offensive security products over the years because I like hacking.

I will mentally reverse engineer any code changes to see if there are fun exploits contained.

If we don't catch these in pre-production they become vulnerabilities instead which leads to awkward conversations and disclosures are too much responsibility.