NDepend

Improve your .NET code quality with NDepend

Should You Aim for 100 Percent Test Coverage?

Test coverage serves as one of the great lightning rods in the world of software development. First, people ask whether it makes for a good metric at all. Then they ask, if you want to use it as a metric, should you go for 100 percent coverage? If not, what percentage should you go for? Maybe 42 percent, since that’s the meaning of life?

I don’t mean to trivialize an important discussion. But sometimes it strikes me that this one could use some trivializing. People dig in and draw battle lines over it, and counterproductive arguments often ensue. It’s strange how fixated people get on this.

I’ll provide my take on the matter here, after a while. But first, I’d like to offer a somewhat more philosophical look at the issue (hopefully without delving into overly abstract navel-gazing along the lines of “What even is a test, anyway, in the greater scheme of life?”)

What Does “Test Coverage” Measure?

First of all, let’s be very clear about what this metric measures. Many in the debate — particularly those on the “less is more” side of it — quickly point out that test coverage does not measure the quality of the tests. “You can have 100 percent coverage with completely worthless tests,” they’ll point out. And they’ll be completely right.

To someone casually consuming this metric, the percentage can easily mislead. After all, 100 percent coverage sounds an awful lot like 100 percent certainty. If you hired me to do some work on your car and I told you that I’d done my work “with 100 percent coverage,” what would you assume? I’m guessing you’d assume that I was 100 percent certain nothing would go wrong and that I invited you to be equally certain. Critics of the total coverage school of thought point to this misunderstanding as a reason not to pursue that level of test coverage. But personally, I just think it’s a reason to clarify definitions.

Continue reading Should You Aim for 100 Percent Test Coverage?

In Defense of Using Your Users as Software Testers

In most shops of any size, you’ll find a person that’s just a little too cynical. I’m a little cynical myself, and we programmers tend to skew that way. But this guy takes it one step further, often disparaging the company in ways that you think must be career-limiting. And they probably are, but that’s his problem.

Think hard, and some man or woman you’ve worked with will come to mind. Picture the person. Let’s call him Cynical Chad. Now, imagine Chad saying, “Testing? That’s what our users are for!” You’ve definitely heard someone say this at least once in your career.

This is an oh-so-clever way to imply that the company serially skimps on quality. Maybe they’re always running behind a too-ambitious schedule. Or perhaps they don’t like to spend the money on testing. I’m sure Chad would be happy to regale you with tales of project manager and QA incompetence. He’ll probably tell you about your own incompetence too, if you get a couple of beers in him.

But behind Chad’s casual maligning of your company lies a real phenomenon. With their backs against the wall, companies will toss things into production, hope for the best, and rely on users to find defects. If this didn’t happen with some regularity in the industry, it wouldn’t be fodder for Chad’s predictable jokes and complaints.

The Height of Unprofessionalism

Let’s now forget Chad. He’s probably off somewhere telling everyone how clueless the VPs are, anyway.

Most of the groups that you’ll work with as a software pro would recoil in horror at a deliberate strategy of using your users as testers. They work for months or years implementing the initial release and then subsequent features. The company spends millions on their salaries and on the software. So to toss it to the users and say “you find our mistakes” marks the height of unprofessionalism. It’s sloppy.

Your pride and your organization’s professional reputation call for something else. You build the software carefully, testing as you go. You put it through the paces, not just with unit and acceptance tests, but with a whole suite of smoke tests, load tests, stress tests and endurance tests. QA does exploratory testing. And then, with all of that complete, you test it all again.

Only after all of this do you release it to the wild, hoping that defects will be rare. The users receive a polished product of which you can be proud — not a rough draft to help you sort through.

Users as Testers Reconsidered

But before we simply accept that as the right answer and move on, let’s revisit the nature of these groups. As I mentioned, the company spends millions of dollars building this software. This involves hiring a team of experienced and proud professionals, among other things. Significant time, money, and company stake go into this effort.

If you earn a living as a salaried software developer, your career will involve moving from one group like this to another. In each of these situations, anything short of shipping a polished product smacks of failure. And in each of these situations, you’ll encounter a Chad, accusing the company of just such a failure.

But what about other situations? Should enlisting users as testers always mean a failure of due diligence? Well, no, I would argue. Sometimes it’s a perfectly sound business or life decision.

Continue reading In Defense of Using Your Users as Software Testers

How to Use NDepend’s Trend Charts

Imagine a scene for a moment. A year earlier, a corporate VP spun up a major software project for his organization. He brought a slew of his organization’s software developers into the project. But he also needed to add more staff in the form of contractors.

This strained the budget, so he cut a few corners in terms of team member experience. The VP reasoned that he could make up for this with strategic use of experienced architects up front. Those architects would prototype good patterns and make it so the less seasoned contractors could just kind of paint by numbers. The architects spent a few months doing just that and handed the work off to the contractors.

Fast forward to the present. Now a consultant sits in a nice office, explaining to a beleaguered VP how they got so far behind schedule. I can picture this scene quite easily because organizations hire me to be this consultant. I live this scene over and over again.
Continue reading How to Use NDepend’s Trend Charts

Fixing Your Tangled Dependency Graph

I’ve written before about making use of NDepend’s dependency graph. Well, indirectly, anyway. In that post, I talked about the phenomenon of actual software architecture not matching the pretty diagrams people draw in Visio. It reminds me of Helmuth von Moltke’s wisdom that no battle plan survives contact with the enemy.

Typically, architects conceive of wondrous, clean, and decoupled systems. Then they immortalize this pristine architecture in Visio. Naturally, print outs go up on the wall, and everyone knows what the system should look like. But somehow, it never actually winds up looking like that. Continue reading Fixing Your Tangled Dependency Graph

Why NDepend Uses Google’s Page Rank

I remember my early days of blogging as sort of a comedy of errors. Oh, don’t get me wrong. I don’t think those early posts were terrible, since I’d always written a lot. Rather, I knew very little about everything besides the writing. For example, I initially thought link spammers were just somewhat daft blog commenters. I stumbled through various mistakes and learned the art of blogging in fits and starts. This included my discovery of something called page rank.

Page rank had a relatively involved calculation, but that didn’t interest me at the time. Instead, I found myself dazzled by some gamification. Sites like this one would take your domain and a captcha as input and spit out a score from 0 to 10 as output. That simply, they turned my blogging world upside down. I now had a score to chase and a means of comparing myself against others. And I vaguely understood that getting more inbound links would increase my page rank score.

Of course, as an introvert, I struggle with outgoing self-promotion. Cold outreach to people to see if they’d link to me never seriously occurred to me. Instead, I reasoned that I would play the long game. Write enough posts, and the shares start to come. And then when the shares come, so too will the links. So I watched my page rank inch slowly upward over time.

The Decline of Page Rank

My page rank ticked upward until one day it didn’t anymore. Turns out, Google slowly killed it over the course of a number of years. Ten months passed between its penultimate update and its final one. So there I stood (metaphorically), waiting for a boost to my rank that would never come.

But why did Google kill page rank? Wouldn’t such an easily digestible construct continue to help people? Well, sort of. Unfortunately, it disproportionately helped the wrong sort of people.

The Google founders developed the concept during their time at Stanford. Conceptually, the page rank algorithm regards a link from site A to site B as a “vote” for site B, by site A. But not all pages get to “vote” equally. The higher a rank the page has, the more worthwhile its vote, creating a conceptual feedback loop.

On the surface, this sounds great, and, in many ways, it was. As you can imagine, a site with a ton of inbound links, like a government study or a news outlet, would accumulate a great deal of rank. Since employees would carefully curate such sites, you could put a lot of stock in a site to which they linked (and search engines did). So in theory, you have a democratized system in which the sites best regarded by the public had the best rank.

But in this theory, no link spammers existed. If you wanted good page rank, you could produce high quality, popular content. Or you could pay some shady outfit to carpet bomb blog comment sections with links to your site. Because of this fatal flaw, page rank eventually dwindled to obscurity.

A Useful Reappropriation of Page Rank

For clarity, understand that Google (probably) still uses some incarnation of this scheme. But they no longer update the easily consumed public version of it. They now use it as only one of many factors in what they display in response to searches. The heyday of comparing page rank scores for sites has come and gone. But that doesn’t mean we can’t use it elsewhere, and to great efficacy.

For instance, consider applying this to codebases. Instead of a situation where website A links to website B, imagine a situation where type A refers directly to type B. Now, imagine your codebase as a (hopefully acyclic) directed graph with edges and nodes. You start to have an interesting vehicle for reasoning about your codebase.

What would a high rank mean in this context? Well, relatively high rank for a type would mean that other types tended to refer to it at a high rate. Types with relatively low (or zero) rank would take no dependencies, existing at the edge of your code. And the types with the highest rank? These would be types used by other types with high rank.

Continue reading Why NDepend Uses Google’s Page Rank

Is There a Correct Way to Comment Your Code?

Given that I both consult and do a number of public things (like blogging), I field a lot of questions. As a result, the subject of code comments comes up from time to time. I’ll offer my take on the correct way to comment code. But remember that I am a consultant, so I always have a knee-jerk response to say that it depends.

Before we get to my take, though, let’s go watch programmers do what we love to do on subjects like this: argue angrily. On the subject of comments, programmers seem to fall roughly into two camps. These include the “clean code needs no comments” camp and the “professionalism means commenting” camp. To wit:

Chances are, if you need to comment then something needs to be refactored. If that which needs to be refactored is not under your control then the comment is warranted.

And then, on the other side:

If you’re seriously questioning the value of writing comments, then I’d have to include you in the group of “junior programmers,” too. Comments are absolutely crucial.

Thins would probably go downhill from there fast, except that people curate Stack Overflow against overt squabbling.

Splitting the Difference on Commenting

Whenever two sides entrench on a matter, diplomats of the community seek to find common ground. When it comes to code comments, this generally takes the form of adages about expressing the why in comments. For example, consider this pithy rule of thumb from the Stack Overflow thread.

Good programmers comment their code.

Great programmers tell you why a particular implementation was chosen.

Master programmers tell you why other implementations were not chosen.

Jeff Atwood has addressed this subject a few different times.

When you’ve rewritten, refactored, and rearchitected your code a dozen times to make it easy for your fellow developers to read and understand — when you can’t possibly imagine any conceivable way your code could be changed to become more straightforward and obvious — then, and only then, should you feel compelled to add a comment explaining what your code does.

…

Junior developers rely on comments to tell the story when they should be relying on the code to tell the story.

And so, as with any middle ground compromise, both entrenched sides have something to like (and hate). Thus, you might say that whatever consensus exists among programmers, it leans toward a “correct way” that involves commenting about why.

Continue reading Is There a Correct Way to Comment Your Code?

Are Code Rules Meant to Be Broken?

If you’ve never seen the movie Footloose, I can’t honestly say I recommend it. If your tastes run similarly to mine, you’ll find it somewhat over the top.

A boy from the big city moves to a quiet country town. Once there, he finds that the town council, filled with local curmudgeons, has outlawed rock music and dancing. So follows a predictable sequence of events as the boy tries to win his new town over and to convince them of the importance of free expression. You can probably hear his voice saying, “come on, Mr. Uptighterton, rules are made to be broken!”

Today, I’d like to explore a bit the theme of rules and breaking them. But I’ll move it from a boy teaching the people from American Gothic to dance and into the software development shop and to rules around a codebase.

Perhaps you’ve experienced something similarly, comically oppressive in your travels. A power mad architect with a crazy inheritance framework. A team lead that lectures endlessly about the finer points of Hungarian notation. Maybe you’ve wanted to grab your fellow team members by the shirt collars, shake them, and shout, “go on, leave the trailing underscore off the class field name!”

If so, then I sympathize and empathize. Soul crushing shops do exist, seeking to break the spirits of all working there. In such places, rule breaking might help if only to shake people out of learned helplessness and depression. But I’m going to examine some relatively normal situations and explore the role of rules for a software team.

Continue reading Are Code Rules Meant to Be Broken?

Things Everyone Forgets Before Committing Code

Committing code involves, in a dramatic sense, two universes colliding. Firstly, you have the universe of your own work and metaphorical workbench. You’ve worked for some amount of time on your code, hopefully in a state of flow. And secondly, you have the universe of the team’s communal work product. And so when you commit, you force these universes together by foisting your recent work on the team.

In bygone years, this created far more heartburn for the average team than it does today. Barbaric as it may seem, I can actually remember a time when some professional software developers didn’t use source control. A “commit” thus involved literally overwriting a file on a shared drive, obliterating all trace of the previous version. (Sometimes, you might create a backup copy of the folder). Here, your universe actually kind of ate the team’s communal universe.

More Frequent Commits, Fewer Problems

But, even in the earliest days of my career, lack of source control represented sloppy process. I remember installing the practice in situations that lacked it. But even with source control in place, people tended to go off and code in their own world for weeks or even months during feature development. Only when release time neared did they start to have what the industry affectionately calls “merge parties,” wherein the team would spend days or weeks sorting out all of the instances where their changes trampled one another’s.

In the interceding years, the industry has learned the wisdom of continuous integration (CI). CI builds on the premise, “if it hurts, do it more,” by encouraging frequent, lower stakes commits. These days, most teams commit on the order of hours, rather than weeks or months. This significantly lowers the onerousness of universes colliding.

But it doesn’t eliminate the problem altogether, even in teams that live the CI dream. No matter how frequently you do it and how sophisticated the workflows around modern source control, you still have the basic problem of putting your stuff into the team’s universe. And this comes with the metaphorical risk of leaving your tools laying around where someone can trip over them.

So today, let’s take a look at some of the most common things everyone forgets before committing code. And, for the purposes of the post, I’ll remain source control agnostic, with the parlance “commit” meaning generally to sync your files with the team’s.

Continue reading Things Everyone Forgets Before Committing Code

How to Evaluate Your Static Analysis Process

I often get inquiries from clients and prospects about setting up and operationalizing static analysis. This makes sense. After all, we live in a world short on time and with software developers in great demand. These clients always seem to have more to do than bandwidth allows. And static analysis effectively automates subtle but important considerations in software development.

Specifically, it automates peer review to a certain extent. The static analyzer acts as a non-judging, mute reviewer of sorts. It also stands in for a tiny bit of QA’s job, calling attention to possible issues before they leave the team’s environment. And, finally, it helps you out by acting as architect. Team members can learn from the tool’s guidance.

So, as I’ve said, receiving setup inquiries doesn’t surprise me. And I applaud these clients for pursuing this path of improvement.

What does surprise me, however, is how few organizations seem to ask another, related question. They rarely ask for feedback about the efficacy of their currently implemented process. Many organizations seem to consider static analysis implementation a checkbox kind of activity. Have you done it? Check. Good.

So today, I’ll talk about checking in on an existing static analysis implementation. How should you evaluate your static analysis process?

Continue reading How to Evaluate Your Static Analysis Process

Pulling Your Team Through a Project Crunch

Society dictates, for the most part, that childhood serves as a dress rehearsal for adulthood. Sure, we go to school and learn to read, write, and ‘rithmetic, but we also learn life lessons. And these lessons come during a time when we can learn mostly consequence-free.

During these formative years, pretty much all of us learn about procrastination. More specifically, we learn that procrastination feels great. But then, perhaps a week later, we learn that procrastination actually feels awful. Our young brains learn a lesson about trade-offs. Despair.com captures this with a delightfully cynical aphorism: “hard work often pays off after time, but laziness always pays off now.”

Continue reading Pulling Your Team Through a Project Crunch