Moving Beyond Copy Paste Coding

Or how not to Stack Overflow your way through your career

When is a developer considered a senior developer? I asked this of a friend a few weeks ago when a related topic bubbled up on Twitter.

His answer was surprising:

“You become a senior developer when you use Stack Overflow and stop caring about it.”

I remember when I was first picking up Ruby on Rails, I was regularly on Stack Overflow. A year later and I was still using Stack Overflow every day. I was looking up some of the same dumb syntax stuff I could not remember, but I was also looking up more complex questions. I guess you can consider that progress.

It has been over a year since I was with Stack Overflow leading the APAC region. Now I am with AWS working with startups in the same part of the world. In fact, one of the people I work with on the Developer Advocate team is a top user on Stack Overflow. How did he become a 0.01% user? By answering “amazon-web-services” questions, and with over 106K questions under that tag, there are plenty of opportunities to gain lots of reputation points.

There is often a sense of imposter syndrome even after years of coding and experience. The cycles of technology move so fast, that even technologies that we were once familiar with can feel completely foreign when picking it up years later. Even code that we wrote just a few months back can seem mystifying to us.

Our coping mechanism has been to lean more and more on online resources to find answers and save ourselves from our ignorance. Scott Hanselman received this message from an overseas developer several years back:

“I don't know what is the answer I am googler or I am developer.”

In a fun swipe at the state of software development these days, there was a joke about the IEEE renaming the field of computer programming to “Googling Stack Overflow”. Taking this thought to the next logical step leads us to an army of Full Stack Overflow Engineers.

By some estimates, our brains are capable of storing over one quadrillion bytes of information. So why do we still cannot seem to remember how to exit VI or recall what the “-->” operator does in C++? Because as great the potential capacity of our grey matter, it also has to sort and prioritize that vast amount of information, more of which gets added every single day.

We should not feel so bad then about our Stack Overflow Driven Developer ways then. The real professional growth as developers comes more in our ability to turn intangible ideas into logic that to solve real problems, entertain us, or provide pleasant distractions. Wasting brain cycles on obscure sorting algorithms is for pointless whiteboard coding sessions when interviewing.

Should we be somewhat concerned though that our skills in coding are so reliant on how well we can Google? It is all in the perspective of what are end results is when we access our second brains. If we really cannot remember a way of doing something, but we know that the syntax is somewhere, that is makes sense. If you are looking for ideas on how to implement something, researching over approaches is a legitimate path.

The more common reason we Google Stack Overflow however is we really just want to copy code and move on. Perhaps there is a tight deadline. Maybe the code is mostly boring, non-critical plumbing work. Then there are the cases that someone already wrote the code you need. It looks so good, has a ton of upvotes, and the comments are highly supportive. Why not use that code instead of reinventing the wheel?

This is when we get into problem areas in our programming efforts. It is easy to go into cut and paste mode. Not understanding the provenance of code, the reasoning for the decisions made in the code, or the risks and implications of using the code can lead to unexpected issues.

In an analysis of Android apps by IT security researchers a few years ago, the results showed:

“15.4% of the 1.3 million Android applications analyzed in the study contained security-related code snippets from Stack Overflow. Out of these 97.9% contained at least one insecure code snippet”

Not every instance where this code is used will be a critical security risk. However what if this was a mobile bank application holding personally identifiable information? Would this be an issue if the software enabled a backdoor to stealing passwords? There are so many ways in which code you do not know could go wrong.

You might respond that open source is also used without anyone raising concerns. The key difference is that open source is publicly maintained and monitored. Code on crowd sourced developer sites and forums is not. The other different is that open source has readily started licensing terms governing its use and distribution.

That is the issue of code on sites like Stack Overflow. The site may govern the code under Creative Commons, but you have no idea where the person posting code for an answer may have pulled the code from originally. Another group of researchers looked into licensing of code snippets in 399 Android apps, finding 1,279 cases of potential license violations.

A startup founder or bank CTO would be right to be worried about the security, reputational, and operational hazards of copied code. When I was reviewing apps by startups I was working with a decade ago, I would find all sorts of sloppy engineering work, including code snippets lifted straight from coding books. This even happens on a regular basis in large enterprises, such as the case of a developer at Nissan that got caught using code from Stack Overflow verbatim.


The worst outcome of our copy and paste coding ways however is the impact on learning and developing the skills of future generations. The technology is getting more complex and iterating at faster cycles. For junior developers are looking to become senior developers, understanding the context behind code is going to be even more important.

Perhaps then the partial answer to the question of when someone becomes a senior developer is just that, the ability to read and understand code. That level of skill can only come when you dig in deep enough to ask the questions of code you work with. Can you see the implications, dependencies, and risks, or at least figure out steps to answer those unknowns? That is type of skill that will define the better developers from the average ones.

The good thing is that better tools are now available to help bolster those skills. Tools that map dependencies, read code, draw inferences and insight from code, and automatically create documentation from scratch are starting to become available now. This is the next step towards slowly nudging our industry from legions of copy paste coders to confident builders.

How often have you found yourself relying on code from Stack Overflow? Did outside code snippets ever pose an issue with production code and systems your team managed?

Leave a comment

Community Update

I had a great conversation on building communities in the fireside chat last week. I also learned a few things about the world of Corporate VC for The Startup Show, a new program I am heading up at AWS. Please do subscribe to the YouTube channel and looking forward to hosting many more episodes on all things startup soon!

My next two events are focused heavily on the topic of developer communities, so hope you can check out one of the top sessions coming up:

Stack 2020 - Building Internal Developer Communities - Tuesday, December 1 at 9:55 PM EST - this is a conference hosted by GovTech Singapore with some all-star speakers, I will be giving a short talk on building developer communities.

YOW! Conference - Launching an Internal Developer Community - Monday, December 7 at 8:20 PM EST - overall this is one of my favorite developer conferences with many excellent speakers that I am honored to be included in, where I will talk about launching and scaling thriving internal developer communities.