99 comments

[ 0.21 ms ] story [ 185 ms ] thread
No thanks. This smells like a new way to do more work I don’t want to do and at the same time gain a reputation for working for carrots.
Has anyone had a positive experience with Code Guru? All I've seen so far is that it's _very_ expensive, and provides the sort of feedback I expect from open-source linters and static-analyzers, and without any understanding of how appropriate those recommendations might be in context. I've only really seen it for Python though, maybe it's better for other languages?
I didn't use Code Guru, but looked into Snyk Code. It gives much more and better tips, especially for security related things.
Better to start with defining the problem that you are solving and whether or not you need to solve it before even delving into that particular rabbit hole. ROI on analysis is usually fairly low unless you’re in a regulated industry or the product is cheap or free.
The profiler is very good as part of your CI automation, you can alert on regressions and such.
We had similar experience! We tried CodeGuru Reviewer on one of our Python codebases (around 71 KLOC) and abandoned it after a week.

The feedback was indeed similar to what standard linters and static analyzers can provide with more noise. I have no doubt they can improve their recommendations as they get more feedback and analyze more codebases, but we were not interested to pay to contribute.

We have had much more success with https://deepsource.io/ , which found real bugs and we generally agree with their recommendations. We are currently evaluating whether or not we will include this service as part of our process.

Deepsource is rule-based, but my understanding is that they are starting to use ML to rank recommendations.

How did it compare with more “traditional” code analysis linters like Coverity or Semmle?
kind of cool how they just "Created" a market place out of nowhere with their huge aws offerings.

I can see this as a future repository challenging stack overflow, and with automation, challenging other CI pipelines, and then as someone else mentioned these magic carrots could be used as hackerrank/linkedin/hiring.

That's only true if people start to use it, which for sure isn't a given with the current incentives. Also, there is 100% no way this challenges S.O. in any way
> magic carrots could be used as hackerrank/linkedin/hiring

Please god no. We have enough terrible hiring practices as it is, we don't need to make every other tech company a sweatshop like Amazon is.

Sounds like free training for AWS CodeGuru. And the rewards aren't that great.

What's the incentive for people to actually do this?

> and customers pay only for their use of Amazon CodeGuru

Doesn't even sound free.

I'm struggling to find a compelling reason why someone would participate in this?

Looking at https://aws.amazon.com/bugbust/ the prizes are yet more corporate trash that don't need to exist ("AWS BugBust Varsity Jacket" okay ), and they have a pricing page so it's not even free.

All this tells me is that Amazon doesn't value your time

>the prizes are yet more corporate trash that don't need to exist

What I can't wrap my head around is that the top of the FAQ says that 1 Point has an estimated Dollar Equivalent of $769, and for 100 Points you get a t-shirt. As a "prize" in exchange for saving $76,900 I'd be expecting a car at the low-end...

It might be that work worth the equivalent of $769 is required to get a point?
Right - they're saying that if the work of a point is worth $769 to a company, then that's the amount they should get paid as a developer.

Even if Amazon took a $269 cut from each point, I'd expect to get paid $50k for doing 100 points. But instead you yet a $12 t-shirt.

do you not fix bugs in the course of your job anyway? it’s your employer who should be paying you, amazon is just giving you a t shirt for using their software
The $769 is referring to the estimated money saved by fixing bugs, rather than the trade in value of the points.

> For information on how points are awarded, see the Official Rules. Actual savings may vary.

Section 5 of the official rules document states approximate retail value of the prizes as; reInvent:$4000, Resin Trophy:$60, Hooded Sweatshirt:$27, tshirt:$12

https://d1.awsstatic.com/product-marketing/bugbust/AWS_BugBu...

That's exactly my point - Amazon have given that figure as their estimated savings, so either that's an insanely overinflated figure, or my point stands and if you save one of their clients several tens of thousands of dollars they'll give you a "prize" of a tshirt. They probably spent more money producing that video than they will pay for all the t-shirts they'll give out.

$77,000 for a t-shirt. $1,500,000 for a jacket. If you're saving somebody that much money who cares whether Amazon gives you a t-shirt? So either have prizes comensurate with the alleged savings involved or don't insult people with such low value prizes.

I think you misunderstand, you fix your own code not somebody else's. The BugBust is basically them advertising trying out their new CodeGuru analysis tools for free and sending some prizes to the ones that use it the most.
> trying out their new CodeGuru analysis tools for free

I for sure did not get that impression; where did you see they're offering free analysis?

The pricing/FAQ/Sign up page on the actual BugBust site linked all tell you. E.g. from the pricing tab:

> When you create your first AWS BugBust event, all costs incurred by the underlying usage of Amazon CodeGuru Reviewer and Amazon CodeGuru Profiler are free of charge for 30 days per AWS account.

> they have a pricing page so it's not even free

BugBust itself is free. You pay for usage as per normal for CodeGuru Reviewer and CodeGuru Profiler (after the 30 day free trial of BugBust and 90 day free trial of Profiler).

Not sure if you have to use CodeGuru with BugBust, they don't clarify.

>(after the 30 day free trial of BugBust and 90 day free trial of Profiler).

So it's not free, dev time is expensive and has a lot more value than their proprietary service usage time—so they're coming out on top whilst charging people for it.

They say this service "utilizes" CodeGuru, so I'm betting it cannot be used without CodeGuru.
Reminds me of a former Atlassian-based t-shirt reward for setting up the entire suite of Atlassian products (here be dragons or some logo like that). Glad to see there are many others who value their time and are not content to be treated like children in exchange for their time and effort.
Half-OT: What do you use for JavaScript/TypeScript? (CodeGuru only works for Java and Python)

I looked into Snyk Code, but it's mad expensive.

For those who are wondering the rewards aren’t worth it… this is not Amazon asking for oss contribution to their AWS source code. This is for private companies to offer bug fest to their own employees / target audience.

> customers can set up private AWS BugBust virtual events

Why should the jacket be sponsored by Amazon? I don’t get it.

Why would they need AWS to do so? Engineers in companies don't know every line of code in their product - many of them are siloed in their own teams.

A team can easily just dedicate an hour or two a week and do their own bug bash, right?

This pairs it with the AWS bug finding AI tools to automate the bug bash overhead. I.E. Finding bugs, assigning point values, keeping track of point values, etc.
But thus way the labor is free™.
When I read the announcement, I thought they were donating the use of CodeGuru to projects (which I presumed would be limited to open source ones) to (1) improve the code hygiene of the world (2) gather more data for their machine learning models (3) publicity for CodeGuru

But as best I can tell, this is the worst of all worlds: I have to already have an AWS account to both create the competition and also to point CodeGuru at the repos, then I have to pay for running CodeGuru on any potential PRs, but then also separately create a BugSnag account seemingly just for this stunt. And in the end I ... get Internet points on my BugSnag account?

I fail to see how anyone but AWS benefits from this, unless a participant happens to be one of the top competitors who accumulated enough Internet points to get a free trip to re:Invent

(comment deleted)
Quite frankly I've never seen people use AWS offerings for CI pipelines, I wonder if other products (Code* family) are any good - can anyone comment on them? I've only used CodeCommit once during a hackathon, and it seemed rather basic.
CodeDeploy fails in horrible ways and the maintainers are somewhat unresponsive. I don't use it anymore but am still subscribed to some issues which apparently weren't fixed for years...
I have. Their offerings are even less impressive than many of the popular SaaS CI servers, which themselves are usually (and incredibly!) inferior to Jenkins - except they maintain themselves due to all the cloud whatnot
From my experience the products work fine, but they much more complex than they need to be (and than competing products are). They have a lot of weird constraints that make it hard to be really productive.

That said, when you've setup a build/pipeline, it mostly just works as it should.

I have used CodeDeploy/Codepipeline/Codebuild over several years. Overall they work well but there can be edge cases or gotchas that show up on occasion depending what you are trying to do.

I also prefer externalizing the CI/CD process with Jenkins or Spinnaker-based setups.

I'm going to chime in and say the only benefit we got from CodeDeploy was its cost was folded into our AWS account. We didn't have to go through the hassle of explaining why we need "yet another <$100/month expense" from a different company.

I appreciate this is a bad reason to recommend a service, and am not defending it. Just explaining why we wound up using it.

The service itself is not horrible, but like every other AWS service, I felt like I was definitely not in the target market: some easily implemented feature was left out and the configuration space easily allowed you to specify things that weren't covered in the (very) thin documentation and seemed to behave unexpectedly.

Many SaaS companies offer the ability to pay for themselves via the AWS marketplace so you can have everything under one EDP / bill (though AWS takes a little cut in this case).
Unfortunately surprisingly poor in quality!

You can get much better results almost anywhere else.

I think you mean BugBust, not BugSnag.
Yes, sorry, I was on my phone :-(
The companies that put up the contest benefits. For a lot of people at a lot of companies, a trip to re:invent is a huge prize. If your job is to fix bugs anyway, now your company just incentivized you to do it more and in your off time to win that prize.

Also, the bug buster benefits if they get up high on the leaderboard, because job recruiters will most likely use the leaderboard for lead gen. If you're looking to make a job move, moving up on the leaderboard will help.

> Also, the bug buster benefits if they get up high on the leaderboard, because job recruiters will most likely use the leaderboard for lead gen. If you're looking to make a job move, moving up on the leaderboard will help.

I already get plenty of recruiting inbound without having to donate my time to fix bugs for Internet Points.

What you're saying is that this is a worthy use of time for people because they'll maybe move up in the leaderboards which then might lead recruiters to reach out to them.

And after all that, you have to do a phone screen, technical phone interview, a full-day onsite, plus whatever other hoops you'll be made to jump through to change jobs.

Yeah, no. Hard pass. Seems like a huge waste of developers' time.

> I already get plenty of recruiting inbound without having to donate my time to fix bugs for Internet Points.

You're not the target audience.

And also, you wouldn't be donating your time. The whole point is that a company puts up a contest for their own employees, who are presumably getting paid to participate.

the target audience are people stupid enough to work for amazon for free. Amazon, fuck you pay me.
So by participating in this, a company is making their own employees more attractive to recruiters?
No the company is getting some extra structure to their bug bash with some prizes provided by Amazon, as well as being able to recruit other people by pointing out how good their current people are (because they are on the leaderboard).
Everything about this seems like a sketch out of The Office (if they were a software company).
How are you employed if you won't fix bugs. These types of devs are so annoying to be around. Crank out weird esoteric hard to read code using every weird meta feature / reflections / introspections they can. Then "hard pass" on fixing bugs as a waste of time.

You do realize most developers are asked to fix bugs anyways, regardless of any silly competition?

Their pitch to Organizations is that

1) They may be able to help you save money 2) They may make it more fun / easier to solve bugs.

Pitch to developers - they'll give you some perks for doing your job.

Note that I also think it's lame because I don't think code guru is that good and don't care about re"invent

Unless I'm completely misunderstanding how this works, this isn't "give you some perks for doing your job." It's getting perks for doing your job, for someone who isn't paying you. And that's what the problem is.

If you want me to fix your bugs, pay me for it. Don't do this gamification nonsense.

Edit: apparently I did misunderstand how this works. It seems like the "Bugbusters" are just a company's normal developers. It still seems kinda dumb, but not as exploitative as I initially thought.

They're marketing page isn't super clear, but it's adding structure for a company's existing bug bashes. You set up a bug hung for your own developers on your own code.
Then why in the world make Internet Widgets, Pty users create yet another login on some random .aws property that (as very best I can tell) does not support any kind of SSO auth that an outside organization would use: GitHub/GitLab, IAM/Cognito nor OIDC/SAML
Yeah, they are just trying to get devs to try their tooling. If tool was amazing, this would be great. But it's hardly the big exploitation people are describing here though it's a bit true that bug fixing is less fun for some and so is often ignored.

That said, other providers of this type of tooling might take some ideas from something like this.

> How are you employed if you won't fix bugs. These types of devs are so annoying to be around. Crank out weird esoteric hard to read code using every weird meta feature / reflections / introspections they can. Then "hard pass" on fixing bugs as a waste of time.

You misread pretty much everything I wrote. My original comment wasn't an explanation for why fixing bugs in general is a "waste of time". My opinion is that uploading your code to this service that uses ML to automatically generate bugs for your team to do a bug bash on is a waste of time.

Our bug backlog has hundreds, if not thousands, of bugs already. We don't need to rely on ML to tell us what to fix.

We have real issues that customers are facing that need immediate attention. This is just a total distraction and a waste of time.

Why bug leaderboard is important? Don't I have few ways already to showcase my profile?

1. Stackoverflow to show my expertise

2. Any Open source contribution that shows up in my github profile

> We will pay you with exposure...
> The companies that put up the contest benefits

> if you’re looking to make a job move,…

Why would companies allow their best developers to be poached? Unless of course there’s a way for companies to keep their developer scores private…

The risk to the company is pretty low that their employee would show up on a global leaderboard. And even if they do, they can give them a raise or other benefits. It helps them determine the market rate for their employee.
> The risk to the company is pretty low that their employee would show up on a global leaderboard.

This invalidates your other point that it benefits developers. Why would a dev sink countless hours for a “very low” chance at being on the global leaderboard and hence moving jobs.

You can’t simultaneously posit it’s good for both companies and developers.

> This invalidates your other point that it benefits developers.

Not at all. The company undervalues their employee and sees little risk in them showing up on the board, and the employee overvalues their skill, thinking that showing up on the leaderboard is a shoo-in. Maybe the employer is right, maybe the employee is right, or maybe both or neither is right.

Also, the employee does it because they get paid to hunt bugs regardless. It just helps the company by putting a structure around what they are already doing.

> the employee overvalues their skill, thinking that showing up on the leaderboard is a shoo-in. Maybe the employer is right, maybe the employee is right,

Come on, this is just being coy — you and I both know this is a terrible deal for employees — as you write earlier, there’s a very low chance that a random dev will appear on the global leaderboard. What’s more, the best devs won’t even play this game, so it’s left for juniors and people trying to “prove themselves” to trample over each other for peanuts.

Not to single you out, but I wish influential tech folks like you would speak up more about the cynical exploitation that’s going on here in plain sight.

I'm not sure where the exploitation is. The developers are already getting paid to fix bugs. Now they have some structure and added incentives.
The structure already exists. It’s called your bug tracker. By building tools to gamify this process, it’s clearly incentivizing devs to put in more hours. I have no doubt that the global leaderboard will consist of devs that would’ve clocked 100s of hours above their regular hours. For very little benefit to the employee.

Let me put it you this way - would an engineer at Netflix ever “play this game” to win ? Would employees at Netflix even put up with something like this? If not, why would you think employees at random tech co should?

> would an engineer at Netflix ever “play this game” to win ?

I think you're missing the point. The leaderboard is an extra bonus. The main thing is squashing bugs you were already squashing. But yes, there are definitely engineers at Netflix who would play this to "win", just for the love of the game.

But let me relate another similar story -- when Amazon released the Deepracer, they added a leaderboard. All around the world, people got paid by their employers to compete. I think the first winner worked for Samsung and was paid her full time salary just to compete on Deepracer. They saw it as a point of pride that one of their employees was on the leaderboard, with enough value to pay her to work on it full time. I'm pretty sure that is what they are going for here with the global leaderboard. Everyone wins in that situation. The company gets to brag about having the best bug squasher, the employee gets to get paid for squashing bugs, and Amazon gets publicity.

You didn’t address whether engineers at Netflix would put up with this.

> I'm pretty sure that is what they are going for here with the global leaderboard

Sorry, I’m confused. This seems like a change in your position? Earlier you argued the intent is for employees to be able to showcase their skill to recruiters… you also responded to someone else who said they already have recruiter attention with “you are not their intended audience”

> paid her full time salary just to compete on Deepracer

Wait, are you seriously comparing a global competition in cutting edge tech to squashing bugs … in your own codebase? Come on.. there’s no comparison. If anything, a company would be semi embarrassed that they have so many bugs in their pre existing codebase.

I’m asking you in good faith. Why the contortions to defend such a product? I see from your profile that you are an investor and advisor. I would seriously try pushing this product to your companies and see how they react. If they do adopt it, run an anonymous survey of the devs .. then I would love to see you argue with a straight face that it “benefits developers”

> Sorry, I’m confused. This seems like a change in your position?

There is a benefit to both employees and employers. Being on the leaderboard benefits the employee because it raises their profile. Having an employee on the leaderboard, as an employer, also raises the company's profile. It's like how companies send people to conferences to talk. It benefits the employee by raising their profile but also benefits the company.

> I’m asking you in good faith. Why the contortions to defend such a product?

I'm not really making contortions. This product is aimed at large enterprises. It's not aimed at startups (so I would never suggest it for any company I invest in) and it's not aimed at companies that are already well known (FAANG). It's aimed at the 1000s of other large enterprises out there who want to incentivize their employees with some prizes to do a job they're hopefully already doing while also possibly raising the company profile a bit by having people show up on the leaderboard.

But it definitely solves a problem for it's target audience, which you don't seem to be a part of. I am not their target audience either. But I see the value to their target audience.

> I'm not really making contortions

I would politely disagree — in any case the thread is there for all to judge.

If you sincerely believe that this is a product that should exist and will positively impact everyone involved, I can only hope you’re right [0]. In the end it’s all up to your conscience, but I do wish our leaders in tech were a bit more sensitive to seeing the broader picture.

[0]: pour one out for all the naive devs that will no doubt sink 100s of hours to be on the leaderboard for little benefit to them.

> For a lot of people at a lot of companies, a trip to re:invent is a huge prize

Only for cheapo companies. Companies should (and do) _pay_ their devs to attend re:invent. I get your point though. For naive devs, it’s like getting to go to a concert. But it’s quite cynical for AWS to exploit this

> Also, the bug buster benefits if they get up high on the leaderboard

There is literally another story on the front page [1] about such "leaderboards" and what happens when people game them to move up.

I would not advise anyone to participate in such a contest, it sounds more like a race to the bottom while providing valuable training data to AWS for free.

-------------------------------------------------

[1] https://news.ycombinator.com/item?id=27629366

That has nothing to do with this though. The global leaderboard is for fixing bugs in your own company.
One part I'm still not 100% clear about after looking at the site and even your comment. Would people be running CodeGuru against their own internal AWS code, or against existing public open source Github projects, and sending PRs separately from AWS?
I didn't set it up beyond creating a skeleton "Event", cause I have zero interest in paying real money to kick the tires on this, but as I understand it one would add existing repos to their AWS Code* tooling, at which point machine learning awesomeness takes place and it surfaces findings (inside those AWS CodeWhatever APIs, having nothing to do with BugBust)

If those findings are imported into a BugBust Event [which is defined by the tuple of (start date, end date, scoring, and repos in scope)], then one can (invite|publish) a link to the BugBust Event and at the end date the participant who fixed the in-scope issues with the highest point values claims the cited prizes. Further (again, AIUI), at the end of the *AWS* event, the BugBust account who has the most *overall* points wins a re:Invent trip

I don't believe AWS gets into the business of monitoring the PRs, only observing the CodeWhatever outcomes -- if CodeWhatever found an issue, time elapses, and the CodeWhatever sees the issue is fixed, then BugBust will look up the category of said issue, multiply it by the assigned score in any Events it is associated to, and award the Internet points to any Event participant it knows about

Work for us for free! If we like the fix you made MAYBE we will pay you! Yay!
Maybe a little off-topic.

You wanna solve or avoid millions bugs? Instead of hiring people capable of memorizing how to invert binary trees and similar bs, companies when interviewing and hiring should focus on real hands-on experience, should value developers who empower and demostrate best practices and good code craftsmanship.

Ask candidates to write and review real production code.

It is just unbelievable how low is set the bar when it comes to writing high quality code even at so called FAANG. You can just imagine how bad it gets for any other random company out there.

> You can just imagine how bad it gets for any other random company out there.

Or how surprisingly solid developers can be at non FAANG places. Not everyone aspires to work at Amazon.

Ask candidates to write and review real production code.

Presumably you pay candidates for this, right, if we're talking about "real production code" and valuing developers?

There are companies that pay for your interview work, I think DuckDuckGo is one of them.
it does not take much, I usually ask candidates on-site, to review real production PR. I would also keep around pieces of real production code and ask the candidate to either fill in additional/missing functionalities, or ask them what changes/tests if any they would implement and why.

Basically testing real day-to-day job. If you were to work in this company and you were given this task, how would you approach it?

You can easily tell which people care, strive for good practices and who have high quality standards vs the ones who tend to just hack things together.

It worked well for me, and never regretted any hiring.

I would also keep around pieces of real production code and ask the candidate to either fill in additional/missing functionalities

So as opposed to a boilerplate test or asking developers to solve a challenge with a few lines of code and discuss their thoughts on it, they're asked to look at real production code that is in use, opine on it, and add/change functionality to it?

Can I re-ask my question if I've read you properly and understood: presumably you pay people for this right?

I ask because in my mind, solving a coding challenge or talking about something hypothetical/conceptual probably isn't too much different than solving a problem on actual code the company uses from a technical standpoint in as much as they both require effort on my part to think about the problem and bang out a solution...

... but in terms of time spent interviewing and evaluating employers, I'd feel less comfortable contributing anything to production code without the guarantee that the company wont just take the work and implement it, and then later say they hired someone else/went another direction or just decided not to hire at all.

Which has happened.

it is trivial code, but in the context of a real code base. I would never ask a candidate to solve a "hard" problem that no one in the company wasn't able to solve. Just an example: in the context of a spring application, I would ask to add a new api, from the controller all the way down to the database. And of course, I'd gauge the interview according to the experience of the candidate and knowledge of a specific framework etc. They are free to lookup the documentation. Really simulating what would happen if the candidate were to get hired.

I mean either that, or you are back at the : implement a linked list, invert binary tree, check palindrome string and similar bs.

LOL. Developers are so gullible. It would be cute if it weren’t so tragic. They’re giving out t shirts and jackets for 10s of thousands of $ worth of work and we’re lapping it up. Vogels openly said it helps AWS customers reduce “costs”, he’s not even trying to hide it
Most of the comments are completely dunking on Amazon for this, though.
when you dunk 100 times you get a free tshirt!
It’s the meme of the “rise and grind guy”. They believe there’s some magical reward for “hard work” built into the universe. Tragic really is the word.
I can't read this and the video is unwatchable. Are they saying they want a bunch of people to fix static linter warnings in python code? Who's code? Your code? Open source code? Amazon's code?
Are participants necessarily working for the companies sponsoring BugBust events?
I looked for the compelling point of this and go to the point where I could win an expenses paid trip (doesn't say "all expenses" fwiw) to AWS Reinvent and was really unmotivated to read further. Feels like a scammy way to get free engineering work.
if you work at amzn and you don't fix 1 million bugs you lose your pto? I would simply write 1 million bugs then revert them?
Given how amazon has eroded trust with things like Sidewalk, why would I give them free time to improve CodeGuru and fix bugs?

Amazon has been openly adversarial to businesses, including software companies, so what goodwill are they banking on?

This is so hard to understand. It seems like a service to create fixatons or bug bashing events in you org, but they also say it's a global competition (?)

I fail to understand the value of this. Seems to me like they want you to use and pay for CodeGuru, which will tell you shit about your codebase. Then you can import those issues into some sort of campaign inside this BugBust thing so you can create competitions and as you do it you compete with other teams around the world from other companies(?)

If that's what it is, then this sounds like an idea created in a vacuum, with no customer input at all. I fail to see any value on this.

Maybe it's for product managers that see 'low productivity' and are trying any sort of program or incentive to increase productivity/output...
"Pay us to train our ML systems that will ultimately put you out of a job!"
I don't get it. It's for your company yet it's global? Is it like Mechanical Turk for fixing software bugs?