SlideShare a Scribd company logo
1 of 65
Download to read offline
T
S
@pati_gallardo
Reading
Other People's Code
Patricia Aas
NDC Copenhagen 2019
T
S
@pati_gallardo
Patricia Aas - Consultant
T
S
Programmer, Application Security
Currently : T S
Previously : Vivaldi, Cisco Systems, Knowit, Opera Software
Master in Computer Science - main language Java
Pronouns: she/her
@pati_gallardo
- So… You Got Someone
Else’s Code?
- Before You Start
- 10 Techniques
- Receiving a new
contributor
@pati_gallardo
4
So… You Got Someone Else's Code?
@pati_gallardo
This is not a code
review
@pati_gallardo
6
If you approach other people's
code wanting to learn
You will learn
If you approach to criticize
You will criticize
@pati_gallardo
7
“Instead of condemning people,
let’s try to understand them.
Let’s try to figure out why they do what they do.
That’s a lot more profitable and intriguing than criticism;
and it breeds sympathy, tolerance and kindness.”
Dale Carnegie, How to Win Friends & Influence People
@pati_gallardo
8
You want these
people to like
you!
@pati_gallardo
9
Code is the
serialized version
of a
Mental Machine
@pati_gallardo
10
With someone else's code we are lacking
The Mental Machine
Instead what we are faced with is
Possibly hundreds or thousands of files
@pati_gallardo
11
Running code is not linear,
reading code cannot be
linear either.
Also it doesn’t scale
@pati_gallardo
12
I’ve seen some big codebases
Example: Vivaldi has 600,000 files
@pati_gallardo
13
- So… You Got Someone
Else’s Code?
- Before You Start
- 10 Techniques
- Receiving a new
contributor
@pati_gallardo
14
Before You Start (or getting started?)@pati_gallardo
Get the Code!
Source ControlRun tests
Put in debugger
Run application
Smart IDE
Build
Before you
start
@pati_gallardo
16
Motivation
1. Learn something
2. Make documentation
3. Teach others
@pati_gallardo
17
Code is like Balls of Yarn on the FLoor
It’s a mess.
How do you know where to begin?
Find an interesting end
Pull on it
@pati_gallardo
18
The Process
- Establish a vague outline
- Flesh it out in an iterative
process
- Take notes
- Draw things out
@pati_gallardo
19
- So… You Got Someone
Else’s Code?
- Before You Start
- 10 Techniques
- Receiving a new
contributor
@pati_gallardo
20
10 Techniques for
Reading Code
@pati_gallardo
21
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
1. “Grepping”@pati_gallardo
Grep for strings you
see
- in the GUI
- on the commandline
- in the logs
@pati_gallardo
24
1.“Grepping”
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
2. Where Is This Button?@pati_gallardo
- Grep for the button text
- Find the button
- Set a breakpoint on
onClick
- Click on the button
- Look at the stack
- Traverse up the widget
hierarchy@pati_gallardo
27
2. Where Is This Button?
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
@pati_gallardo
3. Following Inputs Events@pati_gallardo
Investigating Your GUI
framework
- Trace platform events
- Look at graphics output
- Find the platform
integration architecture
@pati_gallardo
30
3. Following Inputs Events
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
4. What Do The Tests Do?@pati_gallardo
Integration / System Tests
- How to run it
- Use Cases
- Write tests to drive the code
you’re looking at
- Write tests to examine your
assumptions
@pati_gallardo
33
4. What Do The Tests Do?
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
5. Refactoring@pati_gallardo
Refactoring is Opinionated
Don’t get attached
This is throw-away code
@pati_gallardo
36
5. Refactoring
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
6. Reading “main”@pati_gallardo
What drives execution
in this code?
- Mainloop & event handling
- Read top to bottom
- Take notes & draw
- Important objects/functions
- Watch for common types
- Recurse@pati_gallardo
39
6. Reading “main”
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
7. The Graphical Layout@pati_gallardo
Window Layout
- Find the Main Layout
- This is what changes the
window contents
- Maps often to Use Cases
- Find the (implicit) State
Machine
@pati_gallardo
42
7. The Graphical Layout
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
8. Runtime Investigation@pati_gallardo
Runtime Investigation
● Synchronous: Debugger is great!
● Asynchronous: Use log to learn where to break
● “Printf debugging”
● (Profiler)
@pati_gallardo
45
Rough Outline of Architectures
- Event driven : main loop, async, event handlers
- Request handling : one thread per request - mostly
synchronous
- Command line tool : mostly synchronous, takes input,
produces output
@pati_gallardo
46
- Use the debugger to
examine state and stacks
- Read the logs to see flow
- Use the tests to drive flow
- Add logging
- Add tests and assertions
- Add a feature
@pati_gallardo
47
8. Runtime Investigation
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
9. Reading A “Class”@pati_gallardo
- Which interfaces does it
implement?
- Who uses it and how?
- Public functions are the
“mains” of a class
(Getters don’t count)
@pati_gallardo
50
9. Reading A “Class”
1. Grepping
2. Where is this button?
3. Following input events
4. What do the tests do?
5. Refactoring
6. Reading “main”
7. The graphical layout
8. Runtime Investigation
9. Reading a class
10. Retelling or Rubber Ducking@pati_gallardo
10. Retelling or Rubber Ducking@pati_gallardo
Explain It To Someone
Write a (fictional) blog post
Write some documentation
Make an internal presentation
(Ducks aren't very motivating)
@pati_gallardo
53
10. Retelling or Rubber Ducking
It’s an Iterative Process@pati_gallardo
The Process
- Establish a vague outline
- Flesh it out in an iterative
process
- Take notes
- Draw things out
@pati_gallardo
55
- So… You Got Someone
Else’s Code?
- Before You Start
- 10 Techniques
- Receiving a new
contributor
@pati_gallardo
56
Receiving a new contributor
@pati_gallardo
57
Excellence@pati_gallardo
What is the predictor of team excellence?
Google's Project Aristotle concluded
Psychological Safety
@pati_gallardo
59
“The term is meant to suggest neither a careless sense of
permissiveness, nor an unrelentingly positive affect but,
rather, a sense of confidence that the team will not
embarrass, reject, or punish someone for speaking up.
This confidence stems from mutual respect and trust
among team members.”
Psychological Safety and Learning Behavior in Work, Amy Edmondson
@pati_gallardo
60
Comfort Learning
Apathy Anxiety
high
low
low high
Psychological
Safety
Motivation &
Accountability
Amy Edmondson
@pati_gallardo
61
Get into a
learning mode
@pati_gallardo
62
Great code should be personal
We want people to take pride
in their work
Style is individual
Learn to appreciate other
people's code
@pati_gallardo
63
T
S
P f .
Patricia Aas, T S
@pati_gallardo
T
S
@pati_gallardo

More Related Content

What's hot

Software Vulnerabilities in C and C++ (CppCon 2018)
Software Vulnerabilities in C and C++ (CppCon 2018)Software Vulnerabilities in C and C++ (CppCon 2018)
Software Vulnerabilities in C and C++ (CppCon 2018)Patricia Aas
 
Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Patricia Aas
 
The Anatomy of an Exploit (NDC TechTown 2019)
The Anatomy of an Exploit (NDC TechTown 2019)The Anatomy of an Exploit (NDC TechTown 2019)
The Anatomy of an Exploit (NDC TechTown 2019)Patricia Aas
 
The Anatomy of an Exploit (CPPP 2019)
The Anatomy of an Exploit (CPPP 2019)The Anatomy of an Exploit (CPPP 2019)
The Anatomy of an Exploit (CPPP 2019)Patricia Aas
 
Test code that will not slow you down
Test code that will not slow you downTest code that will not slow you down
Test code that will not slow you downKostadin Golev
 
GitGot: The Swiss Army Chainsaw of Git Repo Management
GitGot: The Swiss Army Chainsaw of Git Repo ManagementGitGot: The Swiss Army Chainsaw of Git Repo Management
GitGot: The Swiss Army Chainsaw of Git Repo ManagementJohn Anderson
 
The Anatomy of an Exploit
The Anatomy of an ExploitThe Anatomy of an Exploit
The Anatomy of an ExploitPatricia Aas
 
.Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 .Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 Amanda Rousseau
 
Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017Baruch Sadogursky
 
Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017Baruch Sadogursky
 
Searching for Multi-Fault Programs in Defects4J
Searching for Multi-Fault Programs in Defects4JSearching for Multi-Fault Programs in Defects4J
Searching for Multi-Fault Programs in Defects4JGabin An
 
The Death of Flaky Tests by Dave Haeffner
The Death of Flaky Tests by Dave HaeffnerThe Death of Flaky Tests by Dave Haeffner
The Death of Flaky Tests by Dave HaeffnerSauce Labs
 
What Can Reverse Engineering Do For You?
What Can Reverse Engineering Do For You?What Can Reverse Engineering Do For You?
What Can Reverse Engineering Do For You?Amanda Rousseau
 
Practical PowerShell Programming for Professional People
Practical PowerShell Programming for Professional PeoplePractical PowerShell Programming for Professional People
Practical PowerShell Programming for Professional PeopleBen Ten (0xA)
 

What's hot (19)

Software Vulnerabilities in C and C++ (CppCon 2018)
Software Vulnerabilities in C and C++ (CppCon 2018)Software Vulnerabilities in C and C++ (CppCon 2018)
Software Vulnerabilities in C and C++ (CppCon 2018)
 
Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020
 
The Anatomy of an Exploit (NDC TechTown 2019)
The Anatomy of an Exploit (NDC TechTown 2019)The Anatomy of an Exploit (NDC TechTown 2019)
The Anatomy of an Exploit (NDC TechTown 2019)
 
The Anatomy of an Exploit (CPPP 2019)
The Anatomy of an Exploit (CPPP 2019)The Anatomy of an Exploit (CPPP 2019)
The Anatomy of an Exploit (CPPP 2019)
 
Geb for browser automation
Geb for browser automationGeb for browser automation
Geb for browser automation
 
Test code that will not slow you down
Test code that will not slow you downTest code that will not slow you down
Test code that will not slow you down
 
GitGot: The Swiss Army Chainsaw of Git Repo Management
GitGot: The Swiss Army Chainsaw of Git Repo ManagementGitGot: The Swiss Army Chainsaw of Git Repo Management
GitGot: The Swiss Army Chainsaw of Git Repo Management
 
The Anatomy of an Exploit
The Anatomy of an ExploitThe Anatomy of an Exploit
The Anatomy of an Exploit
 
What is new in JUnit5
What is new in JUnit5What is new in JUnit5
What is new in JUnit5
 
JUnit 5
JUnit 5JUnit 5
JUnit 5
 
.Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017 .Net Hijacking to Defend PowerShell BSidesSF2017
.Net Hijacking to Defend PowerShell BSidesSF2017
 
Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at DevNexus 2017
 
Jenkins 20
Jenkins 20Jenkins 20
Jenkins 20
 
Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017
Java Puzzlers NG S02: Down the Rabbit Hole as presented at Devoxx US 2017
 
Searching for Multi-Fault Programs in Defects4J
Searching for Multi-Fault Programs in Defects4JSearching for Multi-Fault Programs in Defects4J
Searching for Multi-Fault Programs in Defects4J
 
The Death of Flaky Tests by Dave Haeffner
The Death of Flaky Tests by Dave HaeffnerThe Death of Flaky Tests by Dave Haeffner
The Death of Flaky Tests by Dave Haeffner
 
Agile mobile
Agile mobileAgile mobile
Agile mobile
 
What Can Reverse Engineering Do For You?
What Can Reverse Engineering Do For You?What Can Reverse Engineering Do For You?
What Can Reverse Engineering Do For You?
 
Practical PowerShell Programming for Professional People
Practical PowerShell Programming for Professional PeoplePractical PowerShell Programming for Professional People
Practical PowerShell Programming for Professional People
 

Similar to Reading Other Peoples Code (NDC Copenhagen 2019)

Make it Fixable (NDC Copenhagen 2018)
Make it Fixable (NDC Copenhagen 2018)Make it Fixable (NDC Copenhagen 2018)
Make it Fixable (NDC Copenhagen 2018)Patricia Aas
 
Make it Fixable (CppCon 2018)
Make it Fixable (CppCon 2018)Make it Fixable (CppCon 2018)
Make it Fixable (CppCon 2018)Patricia Aas
 
Make It Fixable, Living with Risk (NDC London 2018)
Make It Fixable, Living with Risk (NDC London 2018)Make It Fixable, Living with Risk (NDC London 2018)
Make It Fixable, Living with Risk (NDC London 2018)Patricia Aas
 
Make It Fixable (Sikkert NOK 2017)
Make It Fixable (Sikkert NOK 2017)Make It Fixable (Sikkert NOK 2017)
Make It Fixable (Sikkert NOK 2017)Patricia Aas
 
New Ideas for Old Code - Greach
New Ideas for Old Code - GreachNew Ideas for Old Code - Greach
New Ideas for Old Code - GreachHamletDRC
 
Refactoring developer habits
Refactoring developer habitsRefactoring developer habits
Refactoring developer habitsMani Sarkar
 
The future of testing in Pharo
The future of testing in PharoThe future of testing in Pharo
The future of testing in PharoJulienDelp
 
The future of testing in Pharo
The future of testing in PharoThe future of testing in Pharo
The future of testing in PharoPharo
 
DevSecOps for Developers: How To Start
DevSecOps for Developers: How To StartDevSecOps for Developers: How To Start
DevSecOps for Developers: How To StartPatricia Aas
 
Make it Fixable, Living with Risk (Paranoia 2017)
Make it Fixable, Living with Risk (Paranoia 2017)Make it Fixable, Living with Risk (Paranoia 2017)
Make it Fixable, Living with Risk (Paranoia 2017)Patricia Aas
 
Thinking hard about_python
Thinking hard about_pythonThinking hard about_python
Thinking hard about_pythonDaniel Greenfeld
 
How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018
How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018
How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018Mike Harris
 
Integration Testing With Cucumber How To Test Anything J A O O 2009
Integration Testing With  Cucumber    How To Test Anything    J A O O 2009Integration Testing With  Cucumber    How To Test Anything    J A O O 2009
Integration Testing With Cucumber How To Test Anything J A O O 2009Dr Nic Williams
 
Version Control in Machine Learning + AI (Stanford)
Version Control in Machine Learning + AI (Stanford)Version Control in Machine Learning + AI (Stanford)
Version Control in Machine Learning + AI (Stanford)Anand Sampat
 
DeepCare Chatbot - Generating answers to customers using a hybrid approach of...
DeepCare Chatbot - Generating answers to customers using a hybrid approach of...DeepCare Chatbot - Generating answers to customers using a hybrid approach of...
DeepCare Chatbot - Generating answers to customers using a hybrid approach of...Pascal van Kooten
 
Tooling around in the jdk
Tooling around in the jdkTooling around in the jdk
Tooling around in the jdkBrant Boehmann
 
Phd courselez1introtostata
Phd courselez1introtostataPhd courselez1introtostata
Phd courselez1introtostataMarco Delogu
 
Doing More with Less: Automated, High-Quality Content Generation
Doing More with Less: Automated, High-Quality Content GenerationDoing More with Less: Automated, High-Quality Content Generation
Doing More with Less: Automated, High-Quality Content GenerationHamlet Batista
 
You shouldneverdo
You shouldneverdoYou shouldneverdo
You shouldneverdodaniil3
 
Simple SAP Security Breach !!
Simple SAP Security Breach !!Simple SAP Security Breach !!
Simple SAP Security Breach !!SAPYard
 

Similar to Reading Other Peoples Code (NDC Copenhagen 2019) (20)

Make it Fixable (NDC Copenhagen 2018)
Make it Fixable (NDC Copenhagen 2018)Make it Fixable (NDC Copenhagen 2018)
Make it Fixable (NDC Copenhagen 2018)
 
Make it Fixable (CppCon 2018)
Make it Fixable (CppCon 2018)Make it Fixable (CppCon 2018)
Make it Fixable (CppCon 2018)
 
Make It Fixable, Living with Risk (NDC London 2018)
Make It Fixable, Living with Risk (NDC London 2018)Make It Fixable, Living with Risk (NDC London 2018)
Make It Fixable, Living with Risk (NDC London 2018)
 
Make It Fixable (Sikkert NOK 2017)
Make It Fixable (Sikkert NOK 2017)Make It Fixable (Sikkert NOK 2017)
Make It Fixable (Sikkert NOK 2017)
 
New Ideas for Old Code - Greach
New Ideas for Old Code - GreachNew Ideas for Old Code - Greach
New Ideas for Old Code - Greach
 
Refactoring developer habits
Refactoring developer habitsRefactoring developer habits
Refactoring developer habits
 
The future of testing in Pharo
The future of testing in PharoThe future of testing in Pharo
The future of testing in Pharo
 
The future of testing in Pharo
The future of testing in PharoThe future of testing in Pharo
The future of testing in Pharo
 
DevSecOps for Developers: How To Start
DevSecOps for Developers: How To StartDevSecOps for Developers: How To Start
DevSecOps for Developers: How To Start
 
Make it Fixable, Living with Risk (Paranoia 2017)
Make it Fixable, Living with Risk (Paranoia 2017)Make it Fixable, Living with Risk (Paranoia 2017)
Make it Fixable, Living with Risk (Paranoia 2017)
 
Thinking hard about_python
Thinking hard about_pythonThinking hard about_python
Thinking hard about_python
 
How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018
How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018
How I Learned to Stop Worrying and Love Legacy Code - Ox:Agile 2018
 
Integration Testing With Cucumber How To Test Anything J A O O 2009
Integration Testing With  Cucumber    How To Test Anything    J A O O 2009Integration Testing With  Cucumber    How To Test Anything    J A O O 2009
Integration Testing With Cucumber How To Test Anything J A O O 2009
 
Version Control in Machine Learning + AI (Stanford)
Version Control in Machine Learning + AI (Stanford)Version Control in Machine Learning + AI (Stanford)
Version Control in Machine Learning + AI (Stanford)
 
DeepCare Chatbot - Generating answers to customers using a hybrid approach of...
DeepCare Chatbot - Generating answers to customers using a hybrid approach of...DeepCare Chatbot - Generating answers to customers using a hybrid approach of...
DeepCare Chatbot - Generating answers to customers using a hybrid approach of...
 
Tooling around in the jdk
Tooling around in the jdkTooling around in the jdk
Tooling around in the jdk
 
Phd courselez1introtostata
Phd courselez1introtostataPhd courselez1introtostata
Phd courselez1introtostata
 
Doing More with Less: Automated, High-Quality Content Generation
Doing More with Less: Automated, High-Quality Content GenerationDoing More with Less: Automated, High-Quality Content Generation
Doing More with Less: Automated, High-Quality Content Generation
 
You shouldneverdo
You shouldneverdoYou shouldneverdo
You shouldneverdo
 
Simple SAP Security Breach !!
Simple SAP Security Breach !!Simple SAP Security Breach !!
Simple SAP Security Breach !!
 

More from Patricia Aas

NDC TechTown 2023_ Return Oriented Programming an introduction.pdf
NDC TechTown 2023_ Return Oriented Programming an introduction.pdfNDC TechTown 2023_ Return Oriented Programming an introduction.pdf
NDC TechTown 2023_ Return Oriented Programming an introduction.pdfPatricia Aas
 
Return Oriented Programming, an introduction
Return Oriented Programming, an introductionReturn Oriented Programming, an introduction
Return Oriented Programming, an introductionPatricia Aas
 
I can't work like this (KDE Academy Keynote 2021)
I can't work like this (KDE Academy Keynote 2021)I can't work like this (KDE Academy Keynote 2021)
I can't work like this (KDE Academy Keynote 2021)Patricia Aas
 
Dependency Management in C++ (NDC TechTown 2021)
Dependency Management in C++ (NDC TechTown 2021)Dependency Management in C++ (NDC TechTown 2021)
Dependency Management in C++ (NDC TechTown 2021)Patricia Aas
 
Introduction to Memory Exploitation (Meeting C++ 2021)
Introduction to Memory Exploitation (Meeting C++ 2021)Introduction to Memory Exploitation (Meeting C++ 2021)
Introduction to Memory Exploitation (Meeting C++ 2021)Patricia Aas
 
Classic Vulnerabilities (MUCplusplus2022).pdf
Classic Vulnerabilities (MUCplusplus2022).pdfClassic Vulnerabilities (MUCplusplus2022).pdf
Classic Vulnerabilities (MUCplusplus2022).pdfPatricia Aas
 
Classic Vulnerabilities (ACCU Keynote 2022)
Classic Vulnerabilities (ACCU Keynote 2022)Classic Vulnerabilities (ACCU Keynote 2022)
Classic Vulnerabilities (ACCU Keynote 2022)Patricia Aas
 
Introduction to Memory Exploitation (CppEurope 2021)
Introduction to Memory Exploitation (CppEurope 2021)Introduction to Memory Exploitation (CppEurope 2021)
Introduction to Memory Exploitation (CppEurope 2021)Patricia Aas
 
Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Patricia Aas
 
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)Patricia Aas
 
The Anatomy of an Exploit (NDC TechTown 2019))
The Anatomy of an Exploit (NDC TechTown 2019))The Anatomy of an Exploit (NDC TechTown 2019))
The Anatomy of an Exploit (NDC TechTown 2019))Patricia Aas
 
Elections, Trust and Critical Infrastructure (NDC TechTown)
Elections, Trust and Critical Infrastructure (NDC TechTown)Elections, Trust and Critical Infrastructure (NDC TechTown)
Elections, Trust and Critical Infrastructure (NDC TechTown)Patricia Aas
 
Survival Tips for Women in Tech (JavaZone 2019)
Survival Tips for Women in Tech (JavaZone 2019) Survival Tips for Women in Tech (JavaZone 2019)
Survival Tips for Women in Tech (JavaZone 2019) Patricia Aas
 
Embedded Ethics (EuroBSDcon 2019)
Embedded Ethics (EuroBSDcon 2019)Embedded Ethics (EuroBSDcon 2019)
Embedded Ethics (EuroBSDcon 2019)Patricia Aas
 
Chromium Sandbox on Linux (NDC Security 2019)
Chromium Sandbox on Linux (NDC Security 2019)Chromium Sandbox on Linux (NDC Security 2019)
Chromium Sandbox on Linux (NDC Security 2019)Patricia Aas
 
Keynote: Deconstructing Privilege (C++ on Sea 2019)
Keynote: Deconstructing Privilege (C++ on Sea 2019)Keynote: Deconstructing Privilege (C++ on Sea 2019)
Keynote: Deconstructing Privilege (C++ on Sea 2019)Patricia Aas
 
Why Is Election Security So Hard? (Paranoia 2019)
Why Is Election Security So Hard? (Paranoia 2019) Why Is Election Security So Hard? (Paranoia 2019)
Why Is Election Security So Hard? (Paranoia 2019) Patricia Aas
 
6 DevSecOps Hacks (femtech 2019)
6 DevSecOps Hacks (femtech 2019)6 DevSecOps Hacks (femtech 2019)
6 DevSecOps Hacks (femtech 2019)Patricia Aas
 
C++ is like JavaScript
C++ is like JavaScriptC++ is like JavaScript
C++ is like JavaScriptPatricia Aas
 

More from Patricia Aas (20)

NDC TechTown 2023_ Return Oriented Programming an introduction.pdf
NDC TechTown 2023_ Return Oriented Programming an introduction.pdfNDC TechTown 2023_ Return Oriented Programming an introduction.pdf
NDC TechTown 2023_ Return Oriented Programming an introduction.pdf
 
Telling a story
Telling a storyTelling a story
Telling a story
 
Return Oriented Programming, an introduction
Return Oriented Programming, an introductionReturn Oriented Programming, an introduction
Return Oriented Programming, an introduction
 
I can't work like this (KDE Academy Keynote 2021)
I can't work like this (KDE Academy Keynote 2021)I can't work like this (KDE Academy Keynote 2021)
I can't work like this (KDE Academy Keynote 2021)
 
Dependency Management in C++ (NDC TechTown 2021)
Dependency Management in C++ (NDC TechTown 2021)Dependency Management in C++ (NDC TechTown 2021)
Dependency Management in C++ (NDC TechTown 2021)
 
Introduction to Memory Exploitation (Meeting C++ 2021)
Introduction to Memory Exploitation (Meeting C++ 2021)Introduction to Memory Exploitation (Meeting C++ 2021)
Introduction to Memory Exploitation (Meeting C++ 2021)
 
Classic Vulnerabilities (MUCplusplus2022).pdf
Classic Vulnerabilities (MUCplusplus2022).pdfClassic Vulnerabilities (MUCplusplus2022).pdf
Classic Vulnerabilities (MUCplusplus2022).pdf
 
Classic Vulnerabilities (ACCU Keynote 2022)
Classic Vulnerabilities (ACCU Keynote 2022)Classic Vulnerabilities (ACCU Keynote 2022)
Classic Vulnerabilities (ACCU Keynote 2022)
 
Introduction to Memory Exploitation (CppEurope 2021)
Introduction to Memory Exploitation (CppEurope 2021)Introduction to Memory Exploitation (CppEurope 2021)
Introduction to Memory Exploitation (CppEurope 2021)
 
Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020
 
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
 
The Anatomy of an Exploit (NDC TechTown 2019))
The Anatomy of an Exploit (NDC TechTown 2019))The Anatomy of an Exploit (NDC TechTown 2019))
The Anatomy of an Exploit (NDC TechTown 2019))
 
Elections, Trust and Critical Infrastructure (NDC TechTown)
Elections, Trust and Critical Infrastructure (NDC TechTown)Elections, Trust and Critical Infrastructure (NDC TechTown)
Elections, Trust and Critical Infrastructure (NDC TechTown)
 
Survival Tips for Women in Tech (JavaZone 2019)
Survival Tips for Women in Tech (JavaZone 2019) Survival Tips for Women in Tech (JavaZone 2019)
Survival Tips for Women in Tech (JavaZone 2019)
 
Embedded Ethics (EuroBSDcon 2019)
Embedded Ethics (EuroBSDcon 2019)Embedded Ethics (EuroBSDcon 2019)
Embedded Ethics (EuroBSDcon 2019)
 
Chromium Sandbox on Linux (NDC Security 2019)
Chromium Sandbox on Linux (NDC Security 2019)Chromium Sandbox on Linux (NDC Security 2019)
Chromium Sandbox on Linux (NDC Security 2019)
 
Keynote: Deconstructing Privilege (C++ on Sea 2019)
Keynote: Deconstructing Privilege (C++ on Sea 2019)Keynote: Deconstructing Privilege (C++ on Sea 2019)
Keynote: Deconstructing Privilege (C++ on Sea 2019)
 
Why Is Election Security So Hard? (Paranoia 2019)
Why Is Election Security So Hard? (Paranoia 2019) Why Is Election Security So Hard? (Paranoia 2019)
Why Is Election Security So Hard? (Paranoia 2019)
 
6 DevSecOps Hacks (femtech 2019)
6 DevSecOps Hacks (femtech 2019)6 DevSecOps Hacks (femtech 2019)
6 DevSecOps Hacks (femtech 2019)
 
C++ is like JavaScript
C++ is like JavaScriptC++ is like JavaScript
C++ is like JavaScript
 

Recently uploaded

Leveraging AI for Mobile App Testing on Real Devices | Applitools + Kobiton
Leveraging AI for Mobile App Testing on Real Devices | Applitools + KobitonLeveraging AI for Mobile App Testing on Real Devices | Applitools + Kobiton
Leveraging AI for Mobile App Testing on Real Devices | Applitools + KobitonApplitools
 
2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shards2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shardsChristopher Curtin
 
Keeping your build tool updated in a multi repository world
Keeping your build tool updated in a multi repository worldKeeping your build tool updated in a multi repository world
Keeping your build tool updated in a multi repository worldRoberto Pérez Alcolea
 
Strategies for using alternative queries to mitigate zero results
Strategies for using alternative queries to mitigate zero resultsStrategies for using alternative queries to mitigate zero results
Strategies for using alternative queries to mitigate zero resultsJean Silva
 
Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...
Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...
Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...OnePlan Solutions
 
Osi security architecture in network.pptx
Osi security architecture in network.pptxOsi security architecture in network.pptx
Osi security architecture in network.pptxVinzoCenzo
 
SensoDat: Simulation-based Sensor Dataset of Self-driving Cars
SensoDat: Simulation-based Sensor Dataset of Self-driving CarsSensoDat: Simulation-based Sensor Dataset of Self-driving Cars
SensoDat: Simulation-based Sensor Dataset of Self-driving CarsChristian Birchler
 
Powering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsPowering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsSafe Software
 
Salesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZSalesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZABSYZ Inc
 
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdfEnhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdfRTS corp
 
Introduction to Firebase Workshop Slides
Introduction to Firebase Workshop SlidesIntroduction to Firebase Workshop Slides
Introduction to Firebase Workshop Slidesvaideheekore1
 
Large Language Models for Test Case Evolution and Repair
Large Language Models for Test Case Evolution and RepairLarge Language Models for Test Case Evolution and Repair
Large Language Models for Test Case Evolution and RepairLionel Briand
 
Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...
Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...
Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...confluent
 
Machine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringMachine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringHironori Washizaki
 
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Angel Borroy López
 
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdfExploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdfkalichargn70th171
 
OpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full Recording
OpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full RecordingOpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full Recording
OpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full RecordingShane Coughlan
 
VictoriaMetrics Anomaly Detection Updates: Q1 2024
VictoriaMetrics Anomaly Detection Updates: Q1 2024VictoriaMetrics Anomaly Detection Updates: Q1 2024
VictoriaMetrics Anomaly Detection Updates: Q1 2024VictoriaMetrics
 
SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?Alexandre Beguel
 
A healthy diet for your Java application Devoxx France.pdf
A healthy diet for your Java application Devoxx France.pdfA healthy diet for your Java application Devoxx France.pdf
A healthy diet for your Java application Devoxx France.pdfMarharyta Nedzelska
 

Recently uploaded (20)

Leveraging AI for Mobile App Testing on Real Devices | Applitools + Kobiton
Leveraging AI for Mobile App Testing on Real Devices | Applitools + KobitonLeveraging AI for Mobile App Testing on Real Devices | Applitools + Kobiton
Leveraging AI for Mobile App Testing on Real Devices | Applitools + Kobiton
 
2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shards2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shards
 
Keeping your build tool updated in a multi repository world
Keeping your build tool updated in a multi repository worldKeeping your build tool updated in a multi repository world
Keeping your build tool updated in a multi repository world
 
Strategies for using alternative queries to mitigate zero results
Strategies for using alternative queries to mitigate zero resultsStrategies for using alternative queries to mitigate zero results
Strategies for using alternative queries to mitigate zero results
 
Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...
Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...
Revolutionizing the Digital Transformation Office - Leveraging OnePlan’s AI a...
 
Osi security architecture in network.pptx
Osi security architecture in network.pptxOsi security architecture in network.pptx
Osi security architecture in network.pptx
 
SensoDat: Simulation-based Sensor Dataset of Self-driving Cars
SensoDat: Simulation-based Sensor Dataset of Self-driving CarsSensoDat: Simulation-based Sensor Dataset of Self-driving Cars
SensoDat: Simulation-based Sensor Dataset of Self-driving Cars
 
Powering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsPowering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data Streams
 
Salesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZSalesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZ
 
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdfEnhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
 
Introduction to Firebase Workshop Slides
Introduction to Firebase Workshop SlidesIntroduction to Firebase Workshop Slides
Introduction to Firebase Workshop Slides
 
Large Language Models for Test Case Evolution and Repair
Large Language Models for Test Case Evolution and RepairLarge Language Models for Test Case Evolution and Repair
Large Language Models for Test Case Evolution and Repair
 
Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...
Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...
Catch the Wave: SAP Event-Driven and Data Streaming for the Intelligence Ente...
 
Machine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringMachine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their Engineering
 
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
 
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdfExploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
 
OpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full Recording
OpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full RecordingOpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full Recording
OpenChain Education Work Group Monthly Meeting - 2024-04-10 - Full Recording
 
VictoriaMetrics Anomaly Detection Updates: Q1 2024
VictoriaMetrics Anomaly Detection Updates: Q1 2024VictoriaMetrics Anomaly Detection Updates: Q1 2024
VictoriaMetrics Anomaly Detection Updates: Q1 2024
 
SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?
 
A healthy diet for your Java application Devoxx France.pdf
A healthy diet for your Java application Devoxx France.pdfA healthy diet for your Java application Devoxx France.pdf
A healthy diet for your Java application Devoxx France.pdf
 

Reading Other Peoples Code (NDC Copenhagen 2019)

  • 2. Reading Other People's Code Patricia Aas NDC Copenhagen 2019 T S @pati_gallardo
  • 3. Patricia Aas - Consultant T S Programmer, Application Security Currently : T S Previously : Vivaldi, Cisco Systems, Knowit, Opera Software Master in Computer Science - main language Java Pronouns: she/her @pati_gallardo
  • 4. - So… You Got Someone Else’s Code? - Before You Start - 10 Techniques - Receiving a new contributor @pati_gallardo 4
  • 5. So… You Got Someone Else's Code? @pati_gallardo
  • 6. This is not a code review @pati_gallardo 6
  • 7. If you approach other people's code wanting to learn You will learn If you approach to criticize You will criticize @pati_gallardo 7
  • 8. “Instead of condemning people, let’s try to understand them. Let’s try to figure out why they do what they do. That’s a lot more profitable and intriguing than criticism; and it breeds sympathy, tolerance and kindness.” Dale Carnegie, How to Win Friends & Influence People @pati_gallardo 8
  • 9. You want these people to like you! @pati_gallardo 9
  • 10. Code is the serialized version of a Mental Machine @pati_gallardo 10
  • 11. With someone else's code we are lacking The Mental Machine Instead what we are faced with is Possibly hundreds or thousands of files @pati_gallardo 11
  • 12. Running code is not linear, reading code cannot be linear either. Also it doesn’t scale @pati_gallardo 12
  • 13. I’ve seen some big codebases Example: Vivaldi has 600,000 files @pati_gallardo 13
  • 14. - So… You Got Someone Else’s Code? - Before You Start - 10 Techniques - Receiving a new contributor @pati_gallardo 14
  • 15. Before You Start (or getting started?)@pati_gallardo
  • 16. Get the Code! Source ControlRun tests Put in debugger Run application Smart IDE Build Before you start @pati_gallardo 16
  • 17. Motivation 1. Learn something 2. Make documentation 3. Teach others @pati_gallardo 17
  • 18. Code is like Balls of Yarn on the FLoor It’s a mess. How do you know where to begin? Find an interesting end Pull on it @pati_gallardo 18
  • 19. The Process - Establish a vague outline - Flesh it out in an iterative process - Take notes - Draw things out @pati_gallardo 19
  • 20. - So… You Got Someone Else’s Code? - Before You Start - 10 Techniques - Receiving a new contributor @pati_gallardo 20
  • 21. 10 Techniques for Reading Code @pati_gallardo 21
  • 22. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 24. Grep for strings you see - in the GUI - on the commandline - in the logs @pati_gallardo 24 1.“Grepping”
  • 25. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 26. 2. Where Is This Button?@pati_gallardo
  • 27. - Grep for the button text - Find the button - Set a breakpoint on onClick - Click on the button - Look at the stack - Traverse up the widget hierarchy@pati_gallardo 27 2. Where Is This Button?
  • 28. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 29. @pati_gallardo 3. Following Inputs Events@pati_gallardo
  • 30. Investigating Your GUI framework - Trace platform events - Look at graphics output - Find the platform integration architecture @pati_gallardo 30 3. Following Inputs Events
  • 31. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 32. 4. What Do The Tests Do?@pati_gallardo
  • 33. Integration / System Tests - How to run it - Use Cases - Write tests to drive the code you’re looking at - Write tests to examine your assumptions @pati_gallardo 33 4. What Do The Tests Do?
  • 34. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 36. Refactoring is Opinionated Don’t get attached This is throw-away code @pati_gallardo 36 5. Refactoring
  • 37. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 39. What drives execution in this code? - Mainloop & event handling - Read top to bottom - Take notes & draw - Important objects/functions - Watch for common types - Recurse@pati_gallardo 39 6. Reading “main”
  • 40. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 41. 7. The Graphical Layout@pati_gallardo
  • 42. Window Layout - Find the Main Layout - This is what changes the window contents - Maps often to Use Cases - Find the (implicit) State Machine @pati_gallardo 42 7. The Graphical Layout
  • 43. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 45. Runtime Investigation ● Synchronous: Debugger is great! ● Asynchronous: Use log to learn where to break ● “Printf debugging” ● (Profiler) @pati_gallardo 45
  • 46. Rough Outline of Architectures - Event driven : main loop, async, event handlers - Request handling : one thread per request - mostly synchronous - Command line tool : mostly synchronous, takes input, produces output @pati_gallardo 46
  • 47. - Use the debugger to examine state and stacks - Read the logs to see flow - Use the tests to drive flow - Add logging - Add tests and assertions - Add a feature @pati_gallardo 47 8. Runtime Investigation
  • 48. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 49. 9. Reading A “Class”@pati_gallardo
  • 50. - Which interfaces does it implement? - Who uses it and how? - Public functions are the “mains” of a class (Getters don’t count) @pati_gallardo 50 9. Reading A “Class”
  • 51. 1. Grepping 2. Where is this button? 3. Following input events 4. What do the tests do? 5. Refactoring 6. Reading “main” 7. The graphical layout 8. Runtime Investigation 9. Reading a class 10. Retelling or Rubber Ducking@pati_gallardo
  • 52. 10. Retelling or Rubber Ducking@pati_gallardo
  • 53. Explain It To Someone Write a (fictional) blog post Write some documentation Make an internal presentation (Ducks aren't very motivating) @pati_gallardo 53 10. Retelling or Rubber Ducking
  • 54. It’s an Iterative Process@pati_gallardo
  • 55. The Process - Establish a vague outline - Flesh it out in an iterative process - Take notes - Draw things out @pati_gallardo 55
  • 56. - So… You Got Someone Else’s Code? - Before You Start - 10 Techniques - Receiving a new contributor @pati_gallardo 56
  • 57. Receiving a new contributor @pati_gallardo 57
  • 59. What is the predictor of team excellence? Google's Project Aristotle concluded Psychological Safety @pati_gallardo 59
  • 60. “The term is meant to suggest neither a careless sense of permissiveness, nor an unrelentingly positive affect but, rather, a sense of confidence that the team will not embarrass, reject, or punish someone for speaking up. This confidence stems from mutual respect and trust among team members.” Psychological Safety and Learning Behavior in Work, Amy Edmondson @pati_gallardo 60
  • 61. Comfort Learning Apathy Anxiety high low low high Psychological Safety Motivation & Accountability Amy Edmondson @pati_gallardo 61
  • 62. Get into a learning mode @pati_gallardo 62
  • 63. Great code should be personal We want people to take pride in their work Style is individual Learn to appreciate other people's code @pati_gallardo 63
  • 64. T S P f . Patricia Aas, T S @pati_gallardo