Why Security Defects Go Unnoticed During Code Reviews? [pdf]
Code reviews have become a social thing, and bagging on someone with a litany of issues in front of a group is never acceptable behavior. If they&#x27;ve done ten things wrong, you have to pick 3 of them and let the rest go, or decide to kick them out of the group entirely.<p>There was a period for me when I &#x27;solved&#x27; this code review problem the way many of us solved class participation in grade school - it&#x27;s not a competition, it&#x27;s a learning environment. It doesn&#x27;t matter to the class if you know the answer, but it&#x27;s really awkward if nobody knows the answer. So you say the answer in your head, wait to see if anybody else volunteers that information, and then put your hand up if they don&#x27;t. Or you count to five. (I suspect based on hands and grades, at least a couple of my classmates knew all the answers but were too shy to say anything, and this also appears to be true in code reviews.)<p>Code reviews are typically but not always asynchronous, so you can choose to wait for someone else to point out the obvious stuff and then just mention the things nobody else saw. The danger there is if an argument starts about one of these issues and distracts from others. Like a real conversation, you can run out of time for it before the issue you cared about gets sufficient airtime.