In this blog post I take a look at how well GitHub, GitLab and Bitbucket support reviewers in finding malicious code changes in pull requests.

TL;DR: you could adopt good programming practices like “don’t shadow mutable state” and “put constants first in a comparison” or you can pay us money so we show you obscure attempts to exploit your bad programming in code review … maybe …

snowe
mod
link
fedilink
159M

Website really struggled on mobile. Anytime I swipe to view the longer code lines in the code blocks it would open the sidebar. Very annoying.

Had no trouble here on mobile.

thank you for letting us know? :)

yeah I also hated it

deleted by creator

hh93
link
fedilink
39M

Very interesting read

monk
link
fedilink
449M

Homoglyphs? Invisible text? Bidirectional text? Just highlight every line that goes beyond ASCII with yellow warning colors and require to vet it. Maybe make localization data an exception.

@arthur@lemmy.zip
link
fedilink
English
19M

Or the non-ascii character itself.

monk
link
fedilink
39M

Doesn’t work if it’s invisible.

what about a box around it?

Actual
link
fedilink
English
59M

Very simple solution actually. Here I was thinking we’d need AI to solve it.

People would call that solution AI these days. If it has at least one if statement then they call it AI

@slacktoid@lemmy.ml
link
fedilink
English
39M

We say we have AI to get VC funding

@cbarrick@lemmy.world
link
fedilink
English
119M

This doesn’t work for code bases written in non-English languages. Especially east asian languages.

Any line containing an identifier that is also a word would be highlighted.

More and more programming languages are supporting unicode identifiers for this use case.

@mrkite@programming.dev
link
fedilink
English
99M

So it won’t work for 0.0001% of all github projects.

@cbarrick@lemmy.world
link
fedilink
English
19M

I know right.

It’s wild that an American company primarily doing business in the West would have a bias towards English.

I’d suggest to have the occasional look at the “most popular repos” ranking. It’s about 50% Chinese.

Super-interesting sometimes as it shows completely different tech trends.

deleted by creator

monk
link
fedilink
39M

Yeah, just don’t. Allowing to code in anything other than English is a disservice, plain and simple.

Inb4, I’m not being US-centric, Latin ain’t even my native alphabet.

Create a post

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



  • 1 user online
  • 1 user / day
  • 1 user / week
  • 1 user / month
  • 1.11K users / 6 months
  • 1 subscriber
  • 1.21K Posts
  • 17.8K Comments
  • Modlog