CSC 2045 Code Review Week 04

<p>Off-by-one errors in loops (C)</p> Signup and view all the answers

<p>A procedure to test code and expected outputs (B)</p> Signup and view all the answers

<p>Fallibility of human reviewers (D)</p> Signup and view all the answers

<p>Subtle problems derived from design issues (A)</p> Signup and view all the answers

<p>To identify coding defects for later removal (D)</p> Signup and view all the answers

<p>Identifies bugs with less effort than traditional testing (D)</p> Signup and view all the answers

<p>Establishing clear objectives and areas to focus on (B)</p> Signup and view all the answers

<p>To improve code quality and promote learning (D)</p> Signup and view all the answers

<p>With each small work unit ready for review (A)</p> Signup and view all the answers

<p>Create new code during the review (D)</p> Signup and view all the answers

<p>It can provide context and risk assessments. (A)</p> Signup and view all the answers

<p>They lack education on software weaknesses. (C)</p> Signup and view all the answers

<p>It helps authors catch important issues and think critically about their changes. (B)</p> Signup and view all the answers

<p>Addressing larger structural or logical problems before minor issues. (B)</p> Signup and view all the answers

<p>It directs reviewers to the most impactful issues in the code. (A)</p> Signup and view all the answers

<p>To guide the search for serious vulnerabilities (D)</p> Signup and view all the answers

<p>Conversations with developers and architects (B)</p> Signup and view all the answers

<p>By treating them as partners in the review process (B)</p> Signup and view all the answers

<p>Documentation is often out of date and inadequate (B)</p> Signup and view all the answers

<p>To confirm that security controls are functioning adequately (D)</p> Signup and view all the answers

<p>To work on feedback until all parties are satisfied (A)</p> Signup and view all the answers

<p>The code authors and the code reviewers (D)</p> Signup and view all the answers

<p>To add two large numbers represented as strings (D)</p> Signup and view all the answers

<p>The sum of all numbers read from the file (A)</p> Signup and view all the answers

<p>It holds values that need to be added to the next digit (B)</p> Signup and view all the answers

<p>The program will throw a runtime error and terminate (D)</p> Signup and view all the answers

<p>The loop reads data until the end-of-file marker is reached (D)</p> Signup and view all the answers

Problems introduced during software implementation. They are usually easier to find and fix.

Problems that occur at a deeper level in the software design. They're more subtle and difficult to spot.

The process of reviewing source code to identify potential coding issues. It involves someone other than the original coder looking for defects.

The main reason to perform code review is to find and fix potential coding issues early in the development cycle.

It is recommended and often done to catch issues early in the development cycle. This approach finds defects more easily and expeditiously, often in less time and resources compared to testing.

A common code review technique involving a structured approach to finding defects in code. It often involves a checklist or guidelines to ensure a thorough review.

Code review can help educate developers about common security mistakes and vulnerabilities. This helps developers improve their security knowledge and awareness.

Code review is a beneficial practice that involves a thorough examination of source code to identify potential issues and defects. It's a collaborative approach with multiple perspectives, and helps to improve code quality.

A list of common coding practices and potential issues to look for during a code review.

Prioritizing which code to review based on its security risk and potential impact.

A type of testing that focuses on verifying the functionality of individual components of a program.

A detailed plan outlining how to test a piece of code, including inputs, expected outputs, and test procedures.

A debugging tool in C++ that asserts a condition. If the condition is false, it prints an error message and aborts the program.

The process of integrating code review into the software development lifecycle.

Providing feedback on code reviews can motivate students to provide more detailed and helpful reviews, and also helps them learn from their mistakes.

Allowing students to resubmit their work after receiving feedback encourages them to apply the feedback and improve their code.

Students who receive feedback on their reviews learn how to give effective feedback and understand the importance of constructive criticism.

Students reviewing code can inadvertently plagiarize good ideas. To minimize this, assign different, open-ended projects.

The process of inspecting source code to identify potential issues and improve code quality.

A quick, informal review where one developer asks another to look over their code.

The practice of reviewing code when a smaller unit of work is completed, such as daily or weekly.

The step in code review where the reviewer carefully examines the code for issues such as bugs, security vulnerabilities, and coding style violations.

The final step where the reviewer provides feedback to the developer, pointing out potential improvements and suggesting changes.

The cost of identifying security vulnerabilities during code review is significantly lower compared to dealing with them later in the development lifecycle.

Code review can be a powerful tool for teaching developers best practices and raising their awareness about security weaknesses.

Due to the complex nature of software, it is often difficult to distinguish between secure and insecure code, which can lead to buyers not being willing to pay more for secure software.

The ability to develop new technologies has outpaced our ability to secure them, leading to an increase in vulnerabilities in modern software.

This includes running through the same code review checklist yourself before sharing your code with others, catching potential issues early.

A structured analysis of an application's security risks, identifying vulnerabilities and potential attack vectors. It considers the application's business purpose, threat agents, their motivations, and potential attacks.

Gathering information about the application's purpose, critical business impacts, threat agents, and potential attacks to create a comprehensive threat model.

A collaborative approach where reviewers work alongside developers, business representatives, and other stakeholders to identify and address security issues in the code.

Building trust with development teams by acting as advisors rather than auditors, fostering a culture of collaboration and shared responsibility for security.

Integrating security reviews early in the development lifecycle, ideally during the design phase, to proactively address potential security concerns.

Providing detailed and constructive feedback on a code change to help the author improve their code.

The developer presenting their code for review, open to feedback and willing to address any issues or suggestions raised by the reviewer.

Challenges that can hinder productive code reviews due to factors such as unclear requirements, inadequate communication, or inconsistent standards.

A function that reverses a string and stores it in an integer array.

A function that adds two large numbers represented as strings.

A loop that reads numbers from a file and adds them to a running total using the add2Nums function.

A function that adds two arrays of digits, handling carry-over.

A loop that extracts digits from the result array and constructs the final answer string.