审核 29k 行 Drupal 代码需要多长时间？
一位客户询问需要多长时间来审核他的 29k 行长的 Drupal 模块的安全性。有谁知道至少我应该给他什么大概？他主要关心的是文件加密和用户权限。
A client is asking how long does it take to audit the security of his Drupal module that is 29k lines long. Does anyone know at least what ballpark I should give him? His main concerns are file encryption and user permission.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，没有任何线索:-)
但是，无论您选择什么值，我可以建议一件事吗？
监控您的进度！告诉您的客户，您的初步估计是（例如）二十九个工作日，但这取决于您无法控制的许多因素。
告诉他们您计划通过提供每日进度快照来降低预算超支的风险：
如果运行率远低于您的估计，请允许他们随时停止运行。
这种基本的项目管理/报告应该让他们相信您知道自己在做什么，并将大大减少他们的暴露程度，直到他们对接受您感到更加放心。
就上面的最后一点而言，您可能需要考虑给他们一个范围（例如估计值的+/-5%），但不要太聪明地根据您最好和最差的日子来计算出最好和最坏的情况迄今为止。平均的力量在于它可以为您提供“最佳”猜测，而无需过多处理数字。
Nope, not a damn clue :-)
However, whatever value you choose, may I suggest one thing?
Monitor your progress! Tell your client that your initial estimate is (for example) twenty-nine working days but that it depends on a great many factors outside your control.
Tell them you plan to mitigate risks of budget overrun by providing a daily snapshot of progress:
Allow them to pull the plug at any time if the run rate is well below what you estimated.
This basic project management/reporting should give them the confidence that you know what you're doing, and will minimise their exposure considerably, to the point where they'll feel a lot more comfortable about taking you on.
Just on that last bullet point above, you may want to consider giving them a range (say +/-5% of the estimate), but don't get too clever about working out best and worst case based on your best and worst days to date. The power of averaging is that it gives you a "best" guess without having to fiddle too much with figures.
我见过的典型估计是，开发人员每小时可以审查 100-150 行代码。这是一个非常粗略的估计，并且会根据代码的性质和审查的彻底性而有很大差异。另外，如果你可以每周 5 天、每天 8 小时连续审查代码，那么你就很不人道，也很了不起；对于我们其他人来说，我们需要改变活动来清理大脑。
Typical estimates I've seen are that you can expect a developer to review 100-150 lines of code per hour. This is a very rough estimate, and it will vary greatly depending upon the nature of the code and the thoroughness of the review. Also, if you can review code for 8 hours a day, 5 days a week, straight, you're inhuman and amazing; for the rest of us, we need a change of activity to clear the brain.