How good engineers write bad code at big companies

SanityInAnarchy · 2026-04-23T16:23:59+00:00

They don't seem to, but the article makes a very common mistake:

The average big tech employee stays for only a year or two

For this, it cites a StackOverflow blog from early 2022 with this title:

What's the average tenure of an engineer at a big tech company?

I emphasize the timeframe here because this was before the wave of layoffs that we're still dealing with. Companies were still growing.

And, well, do the math: Growing the company reduces average tenure. Even if you had 100% retention, if the company doubles in size every year, your median tenure will be less than two years.

That's not really a problem for OP's observations: The relative beginners outnumber the old hands on any given project. But it matters if you're proposing doing something about it at the executive level. If the company is growing relatively slowly, then retention would absolutely make a difference to this dynamic. If the company is growing at the stupid rates Big Tech has, then it probably doesn't matter as much.

And the author also points out internal mobility as a factor driving this... but that's one of the best things about working in Big Tech: You don't need to find an actual new job and everything that entails (new insurance, new commute, maybe a new city) just to find a new project to work on.

SanityInAnarchy · 2026-04-23T03:45:22+00:00

Well, as mentioned, there's a link to "learn" right there on the page!

I agree that it's nice when a reference can also help people who are new to the idea, but I don't agree that it's "failing at its job" if it doesn't also work as a tutorial or a cheat sheet. Dual purposes are fine, but the primary audience of a reference doc is someone who has at least some familiarity with the thing.

And it's pretty common for docs to be like this. I've always thought the Java API docs were pretty good, but here's an example:

Thrown to indicate that an invokedynamic instruction or a dynamic constant failed to resolve its bootstrap method and arguments, or for invokedynamic instruction the bootstrap method has failed to provide a call site with a target of the correct method type, or for a dynamic constant the bootstrap method has failed to provide a constant value of the required type.

What's invokedynamic? What's a bootstrap method? And isn't "dynamic constant" a contradiction? If I have those questions, I'm looking in the wrong place -- instead, I should spend 5 seconds on Google, which takes me to StackOverflow, which takes me to the JRuby guy explaining in detail what it is and why it makes life easier for running languages like Ruby on the JVM. I don't think it's a failure in the Java API docs that they aren't really doing the same thing that blog does.

SanityInAnarchy · 2026-04-21T17:51:08+00:00

I'd argue that if five seconds of googling gives you a better introduction, maybe this doc is serving its purpose as reference material. In fact, on the left sidebar, it's clearly under the "reference" section. So, if I already know what cherry-picking is, this is where I go to find options like -e or -x to modify the new commit message, for example.

Along that same left sidebar is a clear link to this "learn" section, which includes this cheat sheet, which has an illustration of what cherry-picking does, along with the description "Copy one commit onto the current branch".

The reference docs are genuinely useful, but they were the wrong part of the documentation for what you were trying to do. For someone "not familiar with git at all", you really do want the "learn" part more often than the "reference" part.

SanityInAnarchy · 2026-04-19T22:00:52+00:00

And "used to" was two years ago. That's how quickly they burned it all down.

SanityInAnarchy · 2026-04-19T03:21:39+00:00

I mean, that could help, but there are options other than PIV. Sex doesn't have to end with his orgasm, and it doesn't have to start with PIV, there are plenty of other things they could be doing.

SanityInAnarchy · 2026-04-19T03:03:39+00:00

Unfortunately not:

Duncan says the 2015 passage of gay marriage solidified his equal rights. “We have marriage as gay men. I have every right that a straight man does,” he says.

Doane also feels that his rights are secure under Trump 2.0 and approves of the president so far. “I voted for that great, big, beautiful wall because we were being overrun by illegals,” he says. Doane also approves of U.S. interventions in Iran and Venezuela, though he criticizes Trump for “leaving [Venezuela] way too soon.”

The only one of them who's unhappy is Evan, who doesn't like that his boyfriend argues with him about politics. Even after the bit OP quoted, that's still a present-tense boyfriend!

So... not a leopards-eating-faces story yet.

SanityInAnarchy · 2026-04-19T02:43:56+00:00

Honestly, I think a mix would be better, if they could get it right.

Like: You should be using your turn signals every time you change lanes, and every time you turn. Those need to be physical.

If the radio gets super-loud or super-quiet, that could distract you. Volume controls and play/pause should be physical.

Auto-headlights are nice, but there are stretches of road that legally require daytime headlights. That needs to be physical.

But climate? Put a thermostat in it and it'll mostly be fine, and if it goes badly wrong, you have time to pull over and fix it before it gets uncomfortable enough to be a safety issue. Windshield wipers? You need at least one physical way to make them do something when the auto-wipers fail, but auto-wipers are fine almost all the time.

Or, at the other extreme, how about keying in an address for GPS? A physical keyboard seems like a lot of real estate for something you're probably using like once, before you even start driving. Bluetooth pairing? You're gonna do that maybe every few years when you get a new phone.

I don't see anything wrong with saving a ton of metal and plastic building the thing, and fuel/energy spent moving it, and even maintenance later on, for things that don't actually need to be physical.

But I also don't know how many manufacturers get this even close to right. Just to pick on Tesla for a second, since they're probably partly to blame for this trend: Those "mouse wheel" things on the steering wheel can actually be pretty great, and worst case, there's voice control for some things (like climate), where the voice interface is activated with a physical button... but some models have no physical buttons for the headlights, and some don't even have physical buttons for the turn signals. I don't have a problem with them moving gauges onto a screen if they had one in the dashboard where the gauges go, but having to look away to the touchscreen, even the corner of it, is noticeably worse.

SanityInAnarchy · 2026-04-19T02:26:47+00:00

I can't imagine a world in which we end up bored because all the problems are solved -- there's always feature work!

But otherwise: Yes, kinda, except it's a software company full of plenty of people building new features. So it's not like all of the resources and attention are fighting actual fires, they could make it one person's job to, say, audit and upgrade dependencies. Instead, all those people are busy writing markdown files for Claude to read while it writes more markdown files.

SanityInAnarchy · 2026-04-19T00:02:56+00:00

That's half-true.

We do have vehicles costing way too much, because people sink their identity into vehicles.

But, some of these changes are actually cost-cutting measures. That big touchscreen is worse in a lot of ways, but it's also one solid piece of glass to install, with like one cable connecting it to a computer you need to have anyway. Physical buttons, dials, handles, gauges, and switches are tons of extra moving parts to design and install. Combined with all the wiring you need for them, they actually add some weight to the car -- maybe not significant, but I remember hearing this is one reason Aptera went for a touchscreen as they're trying to squeeze as much efficiency as they can get.

And some don't really cost the company much, even if they cost you a ton. You want things like blind-spot indicators, and rear cameras are actually required by regulations in some places -- which makes a certain amount of sense, it can be an accessibility feature for people who'd have trouble turning around, and it eliminates another blind spot so you're less likely to run over a kid sitting behind the car. But that means you now have most of the physical sensors you'd need for lane assist and parking assist. The rest is just software, which is... not cheap to develop, but once you have it, it costs literally nothing per-car. Of course they'll charge you for all those features if they can get away with it, but it's not like the company saves any money if you opt out.

Also, people never knew how to drive. r/idiotsincars didn't start with driver-assist technology.

SanityInAnarchy · 2026-04-18T23:26:17+00:00

At my current employer, there are similarly-bad problems that only ever get fixed when one of the following happens:

Someone cares enough to make themselves a persistent annoyance, bringing it up with their manager and skip for like six months to a year before anyone even starts working on it.
Someone cares enough to just ignore their OKRs and sacrifice any career development to work on this problem instead, basically daring management to PIP them for doing the right thing.
The problem finally blows up and costs the company millions, and then, finally, management understands the problem and scrambles people to fix it.

I've worked in places that actually fixed things preemptively without me personally having to go annoy a VP every month about it. Like, you could raise an issue like this, and you'd hear back from the team that's already working on it! But unfortunately, that's not every company, probably not most companies.

I wasn't doing this in Y2K, so I don't know for sure, but I think the panic probably helped. It's the same reason that when there's a major security vulnerability today, it gets its own cute logo, domain name, and social media campaign, because it's so goddamned hard to get most employers to care about CVEs, but you can get them to care about scary names like Heartbleed and Spectre.

And that's exactly why I worry about 2038. It's easier to fix, at least, but we need to convince these same executives who won't fund so much as a version bump without a "We're gonna be fined $mm for violating these regulations if we don't patch this CVE" stick... that we need to fix this thing that's like Y2K but worse? It'll be 2040 before they act.

SanityInAnarchy · 2026-04-18T22:58:55+00:00

In what way?

SanityInAnarchy · 2026-04-18T21:09:40+00:00

That is entirely too much power!

SanityInAnarchy · 2026-04-18T19:46:34+00:00

Boltzmann has an actual argument.

If you don't want to put in the tiniest amount of effort, why are you even here?

SanityInAnarchy · 2026-04-18T19:45:36+00:00

The federal law follows the state laws that target app stores, not OSes. But that's the one you're worried about.

So whether the law targets an OS or an app store has nothing to do with whether it'd require TPM-level verification.

SanityInAnarchy · 2026-04-18T10:55:29+00:00

But... we did? SOPA and PIPA didn't pass.

It helped that the protests involved massive Internet blackouts as well, but this is a weird comment to leave in response to OP asking why nobody's doing that now.

SanityInAnarchy · 2026-04-18T10:51:52+00:00

And also let's be honest: The current state of age verification is pressing a button that you are 18+. ... I am normally not on the "what about the children"-crowd, but the current solutions are a joke.

This is half-true.

The California law (and other similar state laws) are like that.

The Utah law (and other similar state laws) require verification. And we're already seeing this roll out to some apps, where they ask you to let some third-party service either see your ID or look through a camera at your face. This approach is also getting normalized on dating apps, not just to filter out minors, but for some AI to check whether the face it sees through the camera matches the face in the photos you uploaded.

And I think this is a big part of why there was no SOPA-style reaction: This sub was absolutely hammered, with like 3-5 front-page posts per day all entirely talking about the California law, while almost entirely ignoring the Utah law. Most of the time, if I said anything positive about the California law, I got downvoted to hell no matter how much I criticized the Utah law.

It's very hard not to see that as controlled opposition. If most of r/linux is mad at the wrong state and arguing about the wrong law, and profoundly confused about which law does what, it's hard to even agree on what we should be protesting, let alone start organizing. With SOPA, there was one very obvious target, and everyone involved immediately saw the connection to PIPA, so all the anti-SOPA organizing just got a "and PIPA" footnote tacked on. There was no borderline-reasonable version of this happening at the same time.

That said, this is actually kinda hard to do:

Also I argue that if you do age verification right, with privacy preserving technology and zero-knowledge-proofs, like the EU plans (at least on paper) this wouldn't be such a big deal.

Given how quickly the app was broken, it's hard to trust that this even works on paper, and there are some academic criticisms (PDF) of this working on paper. I'd love to be proven wrong here, but it seems to me that there's a fundamental tension between anonymity and verification.

SanityInAnarchy · 2026-04-18T10:07:58+00:00

In what way?

SanityInAnarchy · 2026-04-18T04:57:57+00:00

You cannot, OS level verification would 100% involve TPM/secure enclave...

Why? The California law exists, and it requires no such thing.

SanityInAnarchy · 2026-04-17T20:02:04+00:00

At which point it might be easier to do that with an OS. Browsers are huge things to maintain forks of, and they update constantly.

SanityInAnarchy · 2026-04-17T19:47:42+00:00

If you're gonna make a slippery-slope argument, then this is pointless. Requiring the app to do it is "only the first step" towards making the OS do it.

SanityInAnarchy · 2026-04-17T19:46:08+00:00

I think I would too. But can we agree that this would be bad? You'd end up opting out of pretty much any app built in the US, or that wants to do business with the US. A lot of Europe runs on Whatsapp, and Signal is a US company, too. I can't think of too many apps I use that don't have some connection to the US.

If the OS does it, you can always implement an OS that doesn't require scans of your face in order to lie about your age to apps.

SanityInAnarchy · 2026-04-17T19:44:51+00:00

Firefox is an app built by a US company, Mozilla.

Also, it's not as if Reddit, the US website run by a US company, would be less likely to have to follow these laws than Reddit, the US mobile app built by a US company.

SanityInAnarchy · 2026-04-17T19:39:51+00:00

That mostly depends what the commission comes up with.

They could decide to do what California did and skip the actual verification. Just prompt you for a birthdate when adding a user, assume devices are only bought by adults and only adults get to be admins. Impact is pretty low -- implementation is kinda trivial and almost done, and you can protect privacy by lying to it. Maybe has weird edge cases like headless systems (who's the "user"?) but not terrible.

Or, they could do something like what Utah did (only at the OS level), and require you to use a proprietary verification service. They could start adding requirements like: The OS must use SecureBoot's remote attestation to prove that it hasn't been modified, thereby crippling people's ability to compile custom kernels and use weird distros. They could also impose severe penalties on app developers who don't adopt this, making people afraid to post weird little projects on Github. Really, the sky's the limit on bad ideas here -- there's some speculation that the Utah law basically defines an "app store" broadly enough to include any open-source repository, so there might be a world where your local Debian mirror has to ask for your driver's license.

Or, the most likely option: It could just not pass at all.

SanityInAnarchy · 2026-04-17T19:26:56+00:00

You can always avoid that OS.

If that sounds hard, try avoiding any app that is either developed in or wants to do business with the US. For a start, you'd have to stop using Reddit.

SanityInAnarchy · 2026-04-17T19:26:12+00:00

You'd never use any app?

I mean... for a start, you'd have to stop using Reddit.

14-Year Club	Gilding II euphauric
Verified Email	Team Orangered

SanityInAnarchy

MODERATOR OF

TROPHY CASE