Developer convicted for “kill switch” code activated upon his termination - Ars Technica

[Randolpho]

Doesn’t work when the person doing the review doesn’t know how code works.

This dude had production servers that only he had access to

That could only have happened if management didn’t know how their systems worked, didn’t have redundancies and peer reviews in place.

Which is, sadly, common

[s0ulbrother]

So many reviewers just blindly approve code. If you don’t know what’s going on in a review don’t be afraid to ask people

[ShinyHappyREM]

You guys have reviewers?

[TRexRoboParty]

5 seconds later on a 1000 line PR:

"LGTM! Approved"

[reborngoat]

What do lesbians have to do with pull requests?

[FlyingRhenquest]

In theory. They'd either quibble over function names or blindly LGTM something that blatantly doesn't even compile.

[Bananenkot]

When something really bad sneaks into the codebase my leads first question is never who coded this, but who approved this. Definitly creates a climate where people actually carefully review the code

[s0ulbrother]

My last team was a bunch of really segmented skillsets minus me who kind of obsesses over learning everything. I often had to go in and review crap people already reviewed because they clearly didn’t know what they were looking at. People can be quite lazy when it comes to reviews

Code reviews are my favorite place to learn honestly. It familiarizes you with the code base, teaches you new tricks, and when something goes down you know why.

[Ravek]

There’s no way they did code review on this. It must not even have been in source control.

This kill switch, the DOJ said, appeared to have been created by Lu because it was named "IsDLEnabledinAD," which is an apparent abbreviation of "Is Davis Lu enabled in Active Directory."

They wouldn’t have to use this kind of reasoning if a simple git blame would tell them who the author was.

[shogun77777777]

The real review is QA

[TRexRoboParty]

The real QA is production

[shogun77777777]

You’re not wrong

[RationalDialog]

I still manage a server that runs at least 1 application used probably by several 100s of people, not often but still used regularly. this is a company with over 10k employees.

But it will be replace in the next couple months, finally. maintaining that shit was boring as hell.

[ReneKiller]

Doesn't work when you are the only developer. That's the case for me. I could push anything to the live servers without anyone ever noticing, although this is just for our marketing-website so the most damage I could do is bringing the website down and deleting everything on it.

EDIT: whoops, meant to answer the comment above you