Tom Howlett

2.3K posts

Tom Howlett banner
Tom Howlett

Tom Howlett

@leantomato

Product @sonarsource

Stroud UK Katılım Temmuz 2009
667 Takip Edilen890 Takipçiler
Sabitlenmiş Tweet
Tom Howlett
Tom Howlett@leantomato·
Present a good team with problems & they'll thrive on finding solutions. Ask them to implement your solution & they'll only find problems.
English
5
247
163
0
Tom Howlett retweetledi
Sonar
Sonar@SonarSource·
To strengthen the Guide, Verify, & Solve phases of the Agent Centric Development Cycle, we've strengthened our offering with: 🔷 Sonar Context Augmentation 🔷 SonarQube Agentic Analysis 🔷 SonarSweep 🔷 SonarQube Remediation Agent Read the news: sonarsource.com/company/press-…
English
0
1
4
304
Tom Howlett retweetledi
Sonar
Sonar@SonarSource·
Software architecture shouldn’t be a headache. SonarQube now enables architecture management directly in your dev workflow. Visualize your structure, define goals, and stop architectural drift before it compounds. 🚀 See how it works: sonarsource.com/solutions/arch…
English
0
1
0
201
Tom Howlett
Tom Howlett@leantomato·
“Overall, adopting tools like Codex is not just a technical but also a deep cultural change, with a lot of downstream implications to figure out.” - yes!
Greg Brockman@gdb

Software development is undergoing a renaissance in front of our eyes. If you haven't used the tools recently, you likely are underestimating what you're missing. Since December, there's been a step function improvement in what tools like Codex can do. Some great engineers at OpenAI yesterday told me that their job has fundamentally changed since December. Prior to then, they could use Codex for unit tests; now it writes essentially all the code and does a great deal of their operations and debugging. Not everyone has yet made that leap, but it's usually because of factors besides the capability of the model. Every company faces the same opportunity now, and navigating it well — just like with cloud computing or the Internet — requires careful thought. This post shares how OpenAI is currently approaching retooling our teams towards agentic software development. We're still learning and iterating, but here's how we're thinking about it right now: As a first step, by March 31st, we're aiming that: (1) For any technical task, the tool of first resort for humans is interacting with an agent rather than using an editor or terminal. (2) The default way humans utilize agents is explicitly evaluated as safe, but also productive enough that most workflows do not need additional permissions. In order to get there, here's what we recommended to the team a few weeks ago: 1. Take the time to try out the tools. The tools do sell themselves — many people have had amazing experiences with 5.2 in Codex, after having churned from codex web a few months ago. But many people are also so busy they haven't had a chance to try Codex yet or got stuck thinking "is there any way it could do X" rather than just trying. - Designate an "agents captain" for your team — the primary person responsible for thinking about how agents can be brought into the teams' workflow. - Share experiences or questions in a few designated internal channels - Take a day for a company-wide Codex hackathon 2. Create skills and AGENTS[.md]. - Create and maintain an AGENTS[.md] for any project you work on; update the AGENTS[.md] whenever the agent does something wrong or struggles with a task. - Write skills for anything that you get Codex to do, and commit it to the skills directory in a shared repository 3. Inventory and make accessible any internal tools. - Maintain a list of tools that your team relies on, and make sure someone takes point on making it agent-accessible (such as via a CLI or MCP server). 4. Structure codebases to be agent-first. With the models changing so fast, this is still somewhat untrodden ground, and will require some exploration. - Write tests which are quick to run, and create high-quality interfaces between components. 5. Say no to slop. Managing AI generated code at scale is an emerging problem, and will require new processes and conventions to keep code quality high - Ensure that some human is accountable for any code that gets merged. As a code reviewer, maintain at least the same bar as you would for human-written code, and make sure the author understands what they're submitting. 6. Work on basic infra. There's a lot of room for everyone to build basic infrastructure, which can be guided by internal user feedback. The core tools are getting a lot better and more usable, but there's a lot of infrastructure that currently go around the tools, such as observability, tracking not just the committed code but the agent trajectories that led to them, and central management of the tools that agents are able to use. Overall, adopting tools like Codex is not just a technical but also a deep cultural change, with a lot of downstream implications to figure out. We encourage every manager to drive this with their team, and to think through other action items — for example, per item 5 above, what else can prevent a lot of "functionally-correct but poorly-maintainable code" from creeping into codebases.

English
0
0
0
35
Tom Howlett retweetledi
Sonar
Sonar@SonarSource·
Bad data in = bad code out. 🤖 It's the Achilles' heel of AI code generation. That's why we're introducing SonarSweep™, our new service that optimizes and secures training data for coding LLMs.🧹🛡️ Read the announcement: bit.ly/478bDfK #CodeQuality #SonarSweep
Sonar tweet media
English
4
3
12
24.7K
Tom Howlett
Tom Howlett@leantomato·
@Rubberduck203 @GAnnCampbell @tottinge @BarretBlake What version were you using? We’re now updating (almost) all our rules as new versions of C# are being released. There was a bit of a backlog as we migrated to our new Semantic Execution Engine which is almost complete.
English
0
0
0
11
Chris McClellan
Chris McClellan@Rubberduck203·
@GAnnCampbell @tottinge @BarretBlake SonarQube’s impl for C# is hot garbage and will often prevent teams from upgrading their lang version because it lags by years. Just use editorconfig and /treatwarningsaserror.
English
2
0
0
13
Tom Howlett
Tom Howlett@leantomato·
@SonarQube @danroth27 Hi, If you message me I'll send you an email and we can set something up. Looking forward to discussing it :-)
English
1
0
1
29
SonarQube
SonarQube@SonarQube·
@danroth27 Thanks for the ping; we're actually talking about that right now! Our PM @leantomato is going to contact you
English
1
0
0
105
Tom Howlett retweetledi
SonarQube
SonarQube@SonarQube·
SonarQube 9.9 LTS is LIVE! 🚀 ✅ Faster PR analysis ✅ Secure development for Cloud Native apps ✅ Improved Android #TaintAnalysis precision ✅ Enhanced enterprise capabilities ✅ Integrations & UX improvements ✅ LOTS of new rules Full thread below 👇 #CleanCode
English
1
14
24
7.4K
Shreyas Doshi
Shreyas Doshi@shreyas·
What are some examples of tech companies that are doing >$50 million in revenue, with double digit YoY growth, and don't have a hiring freeze? Public / private doesn't matter, location doesn't matter.
English
372
177
1.8K
0
Tom Howlett
Tom Howlett@leantomato·
@tottinge @SonarQube @DaveSchinkel Yes! As a PM at @SonarSource it would be great to hear your ideas. 'Graduating levels of pickiness' often gets discussed and I'd love to hear your thoughts on groupings. Happy to set up a call if you are interested :-)
English
0
0
0
0
Tim Ottinger
Tim Ottinger@tottinge·
@SonarQube @DaveSchinkel You know, I think that we could establish a better partnership with the tool and technical coaches. The graduating levels of pickiness is a good example, maybe groupings in configuration. I don't want to make it complex, but wonder....
English
2
0
0
0
Tom Howlett retweetledi
Tim Ottinger
Tim Ottinger@tottinge·
"With Clean as You Code, your focus is always on New Code (code that has been added or changed according to your New Code definition) and making sure the code you write today is clean and safe." I like that SonarSource is publicizing this.
English
1
7
16
0
Bjego
Bjego@Bjego2·
@leantomato @SonarQube Thanks @leantomato - guess I need to update our pipeline decorator then - to have this applied to all pipelines automatically. Any idea when V5 is going to be released? Is it worth it to add the workaround - or will you release within the next 2 weeks?
English
1
0
0
0
Bjego
Bjego@Bjego2·
@SonarQube the #azuredevops plugin is again failing with lets encrypt certs after your version 4.23.1. Maybe you can add the node10 handler and make it version 5.0 - with no support for #tfs2017 ? So that users of azure devops can use the current certs from lets encrypt?
English
1
0
0
0
Tom Howlett retweetledi
Sonar
Sonar@SonarSource·
Find out how one of the world's leading manufacturers of automobiles and commercial vehicles has successfully added a strong security checkpoint to its DevOps tool chain by expanding @SonarQube and @SonarLint use to 500 developers. sonarsource.com/customers/stor…
Sonar tweet media
English
0
1
0
0
Ben Foster
Ben Foster@benfosterdev·
That "quick PR" that causes something to break in the build pipeline. Looks like the @SonarCloud .NET tool still doesn't support .NET 5.0?
Ben Foster tweet media
English
1
0
0
0
Paul "Slowcooker" E - He/Him
I've spent all day fighting with the SonarQube scanner for Azure DevOps with regards to self signed certs. I give up. I cannot get it to work
English
1
1
1
0