Bad Shortcuts Anti-Patterns — Interview Q&A¶

Category: Development Anti-Patterns → Bad Shortcuts — convenience taken now, paid back many times later. Covers (collectively): Copy-Paste Programming · Magic Numbers / Strings · Hard Coding · Cargo Cult Programming · Pokémon Exception Handling · Stringly-Typed Programming

A bank of 65+ interview questions and answers spanning recognition, the everyday countermove, the trap each fix hides, and the runtime/observability/config-strategy implications. Each answer models the reasoning a strong candidate gives — including the trade-offs. Use the <details> toggles to self-quiz: read the question, answer out loud, then expand.

Table of Contents¶

1. Fundamentals / Junior
2. Intermediate / Middle
3. Senior — Codebase-Scale Strategy & Root Causes
4. Professional / Deep — Performance, Observability, Config & Secrets
5. Code-Reading — Name the Anti-Pattern
6. Curveballs
7. Rapid-Fire / One-Liners
8. How to Talk About Anti-Patterns in Interviews
9. Summary
10. Related Topics

Fundamentals / Junior¶

Definitions, recognition, and the "why is it bad" reasoning.

Q1. Name the six bad-shortcut anti-patterns and give a one-line cost for each.

Q2. What's the difference between a code smell and an anti-pattern, using one of these as an example?

Q3. Why are bad shortcuts a problem if the code "works"?

Q4. What exactly is a "magic number," and what's the minimal fix?

Q5. Why is hard-coding a credential into source worse than hard-coding a URL?

Q6. Where does the name "Pokémon Exception Handling" come from, and what does the code look like?

try:
    result = risky()
except:        # bare except catches everything — even KeyboardInterrupt
    pass

try { chargeCard(order); saveOrder(order); }
catch (Exception e) { /* silence */ }

Q7. What does "stringly-typed" mean, and how is it different from a magic string?

Q8. Why is except: pass worse than letting the program crash?

Q9. Give the smell test for each of the six. One line each.

Q10. What is cargo cult programming, and why is the name apt?

Q11. A teammate says "we should never duplicate any code, ever — DRY!" Why is that too strong?

Q12. Is a String always the wrong type for a status field?

Intermediate / Middle¶

When it creeps in, what to do instead, and the trade-offs.

Q13. Nobody wants duplicated code — so when does copy-paste actually creep in?

Q14. What is the "Rule of Three" and why three?

Q15. Give a concrete example of coincidental duplication you should NOT DRY.

def validate_username(s):   # usernames: 3–20 chars
    return 3 <= len(s) <= 20

def validate_password(s):   # passwords: 3–20 chars today, will become 8–64 soon
    return 3 <= len(s) <= 20

Q16. Where should a named constant live — and what's the trap?

Q17. Walk through the configuration spectrum — what goes where?

Q18. A credential was committed last month and removed in the next commit. Are we safe? What must you do?

Q19. How do you turn a Pokémon catch into a deliberate error strategy?

Q20. Is catching and rethrowing always fine?

Q21. Beyond enums — what else does "make illegal states unrepresentable" cover?

Q22. When is a magic number actually OK to leave as a literal?

Q23. Why can over-configuration be as harmful as hard-coding?

Q24. Which of these six are mechanically detectable, and with what tooling?

Q25. What review questions surface each shortcut while the change is still small?

Senior — Codebase-Scale Strategy & Root Causes¶

Eliminating these at scale, organizational forces, and when not to fix them.

Q26. How do you decide between a shared library and accepting duplication across services?

Q27. Sandi Metz says "duplication is far cheaper than the wrong abstraction." Unpack that.

Q28. What organizational forces breed these shortcuts? It's not just careless developers.

Q29. Design an error-handling architecture for a service so Pokémon handling can't take root.

Q30. You join a team where status is a string compared by literal in 200 places. How do you migrate to an enum safely?

Q31. When should you not fix a bad shortcut?

Q32. Can over-correcting Stringly-Typed create a different anti-pattern?

Q33. How do you eliminate hard-coded config across a large codebase without a risky big-bang?

Q34. How does cargo cult scale from pasted snippets to pasted architecture?

Q35. A teammate argues "duplicated code is fine, the compiler/CPU doesn't care." How do you respond?

Q36. How do you prioritize which shortcuts to pay down when the codebase is full of them?

Professional / Deep — Performance, Observability, Config & Secrets¶

Runtime, memory, observability, and config/secrets strategy.

Q37. Why might duplicated code actually run faster than the DRY version?

Q38. Do magic numbers have any runtime cost, or is it purely readability?

Q39. How does Pokémon exception handling sabotage observability specifically?

Q40. Design a secrets-management strategy for a service from scratch.

Q41. What's the difference between configuration and feature flags, and when does each become an anti-pattern?

Q42. How can a stringly-typed design hurt performance, not just correctness?

Q43. Copy-paste vs. a shared dependency: what are the operational trade-offs at deploy time?

Q44. What does "fail fast vs. fail safe" mean as a deliberate design axis, with examples?

Q45. Why doesn't moving secrets to a checked-in config file fix the secrets problem?

Code-Reading — Name the Anti-Pattern¶

You're shown a snippet; identify the anti-pattern(s) and state the fix.

Q46. Which anti-pattern, and what's the fix?

try:
    n = int(request.args["count"])
    items = fetch(n)
    render(items)
except:
    pass

try:
    n = int(request.args["count"])
except (KeyError, ValueError):
    return bad_request("count must be an integer")
items = fetch(n)          # a fetch/render bug now propagates to the boundary handler, logged with a trace
render(items)

Q47. Which anti-pattern(s), and what's the fix?

if (user.getStatus().equals("3") && user.getRole().equals("ADMIN")) {
    grantAccess(user, 86400);
}

enum Status { ACTIVE, PENDING, SUSPENDED }
enum Role   { ADMIN, EDITOR, VIEWER }
static final Duration ACCESS_TTL = Duration.ofDays(1);

if (user.getStatus() == Status.SUSPENDED && user.getRole() == Role.ADMIN) {
    grantAccess(user, ACCESS_TTL);
}

Q48. Which anti-pattern, and what's the fix?

func connect() *sql.DB {
    db, _ := sql.Open("postgres", "postgres://admin:S3cr3t@10.0.0.5:5432/prod")
    return db
}

func connect() (*sql.DB, error) {
    dsn := os.Getenv("DATABASE_URL")   // injected per environment; secret never in source
    if dsn == "" {
        return nil, errors.New("DATABASE_URL not set")
    }
    return sql.Open("postgres", dsn)
}

Q49. Which anti-pattern, and what's the fix?

def total_member(items):
    subtotal = sum(i.price for i in items)
    shipping = 0 if subtotal > 100 else 9.99
    return subtotal * 0.9 + shipping

def total_guest(items):
    subtotal = sum(i.price for i in items)
    shipping = 0 if subtotal > 100 else 9.99   # copied
    return subtotal + shipping

FREE_SHIPPING_THRESHOLD = 100
STANDARD_SHIPPING = 9.99

def shipping_for(subtotal):
    return 0 if subtotal > FREE_SHIPPING_THRESHOLD else STANDARD_SHIPPING

def total(items, member):
    subtotal = sum(i.price for i in items)
    return subtotal * (0.9 if member else 1.0) + shipping_for(subtotal)

Q50. This Python was pasted from a blog. Which anti-pattern, and what's suspicious?

import pandas as pd
def load(path):
    df = pd.read_csv(path)
    df = df.copy()                       # ?
    df = df.reset_index().reset_index()  # ?
    return df

def load(path):
    return pd.read_csv(path)

Q51. Which anti-pattern, and what's the fix?

func sendInvite(from string, to string) { /* ... */ }

sendInvite(userEmail, inviterID)   // oops — args swapped, compiles fine

type Email  string
type UserID string

func sendInvite(from UserID, to Email) { /* ... */ }

sendInvite(userEmail, inviterID)  // now a COMPILE error: types don't match

Q52. Which anti-pattern, and why is the "fix" in the comment wrong?

try {
    process(order);
} catch (Exception e) {
    throw new RuntimeException("processing failed");  // "we rethrow, so it's fine"
}

try {
    process(order);
} catch (PaymentDeclinedException e) {
    throw new OrderFailedException("payment declined for order " + order.id(), e); // cause preserved
}
// a bug (NPE) is NOT caught here — it propagates to the boundary handler loudly

Curveballs¶

The questions designed to catch glib answers.

Q53. "Is all duplication bad?"

Q54. "A teammate committed a secret then removed it the next commit. Are we safe?"

Q55. "When is a magic number OK?"

Q56. "When is using String for a status field acceptable?"

Q57. "Is catching and rethrowing always fine?"

Q58. "Why might duplicated code be faster than DRY code?"

Q59. "We use a Constants.java file with all our constants in one place — isn't that good DRY?"

Q60. "Our config makes everything tunable so we never have to redeploy — isn't maximum flexibility good?"

Rapid-Fire / One-Liners¶

Crisp answers; what an interviewer wants in one or two sentences.

Q61. One-line cure for each of the six?

Q62. The phrase that signals coincidental duplication?

Q63. The fastest tell of cargo cult code?

Q64. One sentence: what do you do the instant you learn a secret was committed?

Q65. Magic string vs. stringly-typed in one line?

Q66. The one rule that ties all six together?

Q67. Why do these anti-patterns cluster?

Q68. Two golden rules for fixing them?

How to Talk About Anti-Patterns in Interviews¶

A few habits separate a strong answer from a textbook recital:

• Lead with the cost, not the label. Don't just say "that's a magic number." Say why it hurts — "nobody can tell what it means, and if it's duplicated it'll silently drift." Interviewers want the reasoning, not the vocabulary.
• Always name the trap in the fix. Senior signal is knowing the over-applied failure mode: over-DRYing coincidental duplication, Soft Coding from over-configuration, over-catching that re-creates Pokémon one call at a time, over-typing ceremony. "It depends, and here's on what" beats absolutism.
• Treat secrets as a category apart. Be unambiguous that a committed secret means rotate now and that source control is durable — this is the one shortcut whose cost is irreversible, and getting it wrong is an instant red flag.
• Separate runtime cost from change-cost. Most of these are maintainability problems, not performance ones — and being able to say "duplication can even be faster, but that's not why we DRY" shows depth.
• Distinguish "I'd fix this" from "I'd fix it now." Knowing when not to (open sets, stable low-churn code, before the Rule of Three) is a stronger signal than reflexively cleaning everything.
• Tie it to observability/config when asked to go deep. Swallowed exceptions break logs/metrics/traces; config strategy spans the constant→config→env→secrets-manager spectrum. These show you've operated systems, not just read books.
• Use a concrete example. "We had a stringly-typed status compared in 200 places; here's how we migrated it to an enum behind a boundary mapping" lands far harder than a definition.

Summary¶

• The six bad-shortcut anti-patterns trade a small convenience now for a recurring cost later: Copy-Paste (duplicated bugs), Magic Numbers/Strings (unexplained literals), Hard Coding (unmovable code + leaked secrets), Cargo Cult (unjustifiable lines), Pokémon Exceptions (invisible failures), and Stringly-Typed (compiler-blind types).
• Recognition is the junior bar; the middle bar is knowing when each creeps in, the cheap countermove, and the trap each fix hides (over-DRY, over-config, over-catch, over-type); the senior bar is codebase-scale strategy (shared-lib vs. duplication, error architecture, config/enum migrations) and organizational root causes; the professional bar is the performance, observability, and config/secrets consequences.
• The strongest answers lead with cost and reasoning, name trade-offs, separate runtime cost from change-cost, and treat a committed secret as an immediate rotation, not a removed line.
• The recurring curveball insight: all duplication isn't bad (coincidental), some magic numbers are fine (self-evident), some strings are right (open sets), and rethrowing must preserve the cause. Judgment, not reflex.

Related Topics¶

• junior.md — what each shortcut looks like and why it's bad.
• middle.md — when each creeps in, the countermove, and the trap in each fix.
• senior.md — eliminating these at codebase scale: shared-library trade-offs, config strategy, error-handling architecture, type-driven design.
• professional.md — performance, observability, and config/secrets implications.
• tasks.md · find-bug.md · optimize.md — practice the diagnosis and cleanup.
• Clean Code → Error Handling — the cure for Pokémon exception handling.
• Clean Code → Meaningful Names — naming away magic values.
• DRY Principle — and Sandi Metz's "wrong abstraction" counterpoint.
• Secrets Management — handling credentials safely.
• Over-Engineering — Soft Coding and Speculative Generality, the over-applied versions of these fixes.
• Bad Structure — the sibling category; its interview.md shares this format.