Three Ideas That Changed How I Write Code

In my journey as a software engineer, I’ve found that the most impactful lessons often come from unexpected places. Over time, three simple ideas have reshaped my approach to coding: humility, simplicity, and purpose.

Embracing Humility

As developers, we’re often celebrated for our technical prowess. But I’ve learned that acknowledging our limitations is just as important as showcasing our skills.

I remember a project where I spent days crafting what I thought was the perfect algorithm, only to have it fall apart during testing. That experience taught me the value of humility in coding. Now, I approach each project with the understanding that my code isn’t infallible.

This mindset has led me to embrace tools that compensate for human error. Automated testing, code reviews, and quality assurance checks have become integral parts of my workflow. They’re not just boxes to tick – they’re safeguards that help me deliver more reliable software.

The Power of Simplicity

In my early days as a developer, I often equated complexity with sophistication. More code meant better code, right? Wrong.

I’ve since learned that every line of code is a potential liability. Studies I’ve come across, like those cited in Steve McConnell’s “Code Complete,” suggest that bugs increase proportionally with code volume. This realization was a game-changer for me.

Now, I constantly challenge myself to write less code. I opt for languages and paradigms that encourage conciseness. It’s not about showing off how much I know – it’s about solving problems efficiently.

Focusing on Purpose

Perhaps the most crucial shift in my approach has been maintaining a laser focus on the purpose of my code.

I used to get caught up in endless debates about optimization and refactoring. While these are important, I’ve learned to step back and ask: “What problem am I really solving here?”

Whether I’m working on a critical system or a simple app, I try to keep the end goal in sight. This approach has not only made my code more effective but has also made my work more fulfilling.

Navigating the AI Landscape

Recently, I’ve been grappling with the role of AI in coding. Tools like GitHub Copilot and ChatGPT are reshaping our field, and I’ve had to adapt my approach.

These tools can be incredibly helpful, but they’re not without risks. I’ve seen instances where AI-generated code introduced subtle bugs or security vulnerabilities. It’s a reminder that while AI can augment our skills, it can’t replace our judgment.

I approach AI tools with the same principles of humility, simplicity, and purpose. They’re part of my toolkit, but not the whole toolkit.

Example 1: React State Management Vulnerability

Here’s an example of how AI might generate code with a subtle state management issue in a React application:

function UserProfile({ userId }) {
  const [user, setUser] = useState(null);

  useEffect(() => {
    // This effect doesn't clean up properly and may cause memory leaks
    // or unexpected behavior if userId changes rapidly
    fetch(`/api/users/${userId}`)
      .then(response => response.json())
      .then(data => setUser(data));
  }, [userId]);

  if (!user) return <div>Loading...</div>;

  return (
    <div>
      <h1>{user.name}</h1>
      <p>Email: {user.email}</p>
      {/* Potential XSS vulnerability if user.bio is not sanitized */}
      <div dangerouslySetInnerHTML={{ __html: user.bio }} />
    </div>
  );
}

This component has two potential issues:

1. The useEffect hook doesn’t include a cleanup function, which could lead to memory leaks or race conditions if userId changes frequently.
2. The use of dangerouslySetInnerHTML with user.bio could allow XSS attacks if the bio content isn’t properly sanitized server-side.

Example 2: Express.js API Endpoint Vulnerability

Here’s an example of a Node.js/Express API endpoint with multiple subtle vulnerabilities:

const express = require('express');
const jwt = require('jsonwebtoken');
const app = express();

app.use(express.json());

const SECRET_KEY = 'my-secret-key';  // Hardcoding secrets is a security risk

app.post('/api/login', (req, res) => {
  const { username, password } = req.body;

  // Synchronous operations in the main thread can lead to performance issues
  if (username === 'admin' && password === 'password') {
    const token = jwt.sign({ username }, SECRET_KEY, { expiresIn: '1h' });
    
    // Setting httpOnly: false exposes the token to XSS attacks
    res.cookie('token', token, { httpOnly: false, secure: process.env.NODE_ENV === 'production' });
    
    res.json({ message: 'Logged in successfully' });
  } else {
    // This response may leak information about valid usernames
    res.status(401).json({ error: 'Invalid username or password' });
  }
});

app.listen(3000, () => console.log('Server running on port 3000'));

This API endpoint has several issues:

1. Hardcoded secret key, which is a security risk.
2. Synchronous operations that could impact server performance.
3. Insecure cookie settings (httpOnly: false).
4. Potential information leakage in the error response.
5. Lack of input validation and sanitization.

These examples illustrate why it’s crucial to approach AI-generated code with caution and always conduct thorough human review. Even code that appears functional at first glance may contain subtle vulnerabilities or bad practices that could lead to significant issues down the line.

Moving Forward

As I continue my journey in software development, these three principles serve as my compass. They remind me that good code isn’t just about technical excellence – it’s about creating solutions that truly serve their purpose.

In an industry that’s always chasing the next big thing, I’ve found that sometimes, the most powerful ideas are the simplest ones.

If you’d like to discuss these ideas further or share your own experiences, feel free to reach out to me on Mastodon. I’m always eager to learn from fellow developers.