答:
Resist the temptation to rewrite.

However, for new code, you could plan for what you know has already happened.  Write a retrieval mechanism that you can reuse through configuration.  Write a translation mechanism that you can reuse (maybe in a library that you can call with very little code).  Write a saving mechanism that can be called or configured.

At this point, you've written #21(+).  Now, the following ones can be handled with a tiny bit of code and configuration.  Yay!

(You may want to implement this in a service that handles multiple conversions, but weight the benefits of it versus the ability to separate errors in one module from the rest.)


问:
VB.Net vs C# debate
I've been in workplaces where, at the start of a project, the "Should we use VB.Net or C#" question has been raised.

Granted, it's probably less common to have to make that decision now than it was in the early days of .Net, particularly given the trend towards language convergence, but it can still be a heated debate.

So, between VB.Net and C#, Which language do you prefer and why?

答:
I prefer C#.

I started as VB.NET programmer but with passing of time it became obvious that quite a lot of new features are coming first to C# and then later to VB.NET (e.g. automatic property). And community surrounding C# is much more lively than VB.NETs one.

Additionally, if you intend to learn Java or similar language, C# is better starting point - syntax is almost same in all C-derived languages. Although this would not be tipping point for me since syntax is something you can learn quickly anyhow.

ContentLicense: CC BY-SA 2.5

Title: VB.Net vs C# debate


问:
Is it necessary to know and understand design patterns in order to be a professional programmer?

Possible Duplicate:

  Are design patterns really essential nowadays?

Is it necessary have a knowledge and understanding of design patterns for someone to be a professional programmer? Why?

答:
If you're a good programmer, you will find out yourself some of the design patterns, and later on notices that these constructions have a name.

So strictly no, but they can help you improve your object-oriented skills and they can help to communicate with fellow programmers.

ContentLicense: CC BY-SA 3.0


问:
Starting a coherent architecture in a legacy application
I have responsibility for a large Asp.Net based website. It is currently a website (not web application), some windows services and a number of class libraries.

The data layer uses a mixture of LLBLGEN  and Linq To LLBGen, as well as a number of instances of legacy inline SQL which have not been refactored.

There are some manager type implementations, but in many cases the application exhibits the Smart UI anti-pattern (i.e. too much business logic in code behind classes)

The site is reasonably high traffic, and performance is fine, but we are growing our development capability to a team of around 10, and increasingly it is clear we need an overarching layered design on top of the existing middleware.

My question is where to start? We have 10 years of code (some of it still really just migrated ASP Classic stuff), many different approaches, and styles.

Refactoring the entire code base is not realistic and, probably not desirable

I know this is not a novel situation, are there any useful ideas or concepts as to how to approach this problem?

答: The MOST important thing I saw when trying to deal with an old codebase is to NOT keep changing what you are shooting for. That is, figure out your desired architecture, then STICK WITH THAT PLAN! One of the big problems my last position had was that the codebase had several different ideas of what it should look like over time. Each time a new idea was tried, some of the code got converted, some didn't, and then someone else had a 'better' idea. It became increasingly incoherent over time and eventually was scrapped.</p>


问:
What could be some pitfalls in introducing a style guide and documentation generating software in a development team?
I'm considering using appledoc, a flavor of Doxygen for use in generating Objective-C code documentation, in order to create documentation for my company's iOS apps. The idea is that a server will generate the docs on a post-commit hook, then publish the documentation on an internal network.

Right now we have very little documentation of any kind, even comments in the code itself, so I'm expecting I will have to ask people to begin writing more documentation as they code. In this vein, I will also collaborate with my team in order to create a "style guide" for Objective-C code (like Google's), which will lay down some ground rules on how to write and document code.

What are some potential pitfalls in the above plan? Are style guides effective? I see the benefits in adopting a coding standard, but will developers find it restrictive? And do documentation projects such as this one work? And if not, why do they fail?

(I've posted on Stack Overflow a few times with moderate success, but this is my first time posting here. Please let me know if I could improve my question in any way. Thanks!)

答:
If you have the budget, I would hire a writer. We're called programming-writers and can take over ownership of the project. I am working with a Seattle-area company who is doing Android work and have similar issues. A style guide isn't a bad idea, but I would strongly recommend giving concrete examples of good docs. I would also tread lightly with feedback. Too much negative feedback will only discourage those who already are reticent to expose their less than exemplary writing skills.

doug


问:
Why is an array of characters called a String in Object Oriented languages?

Possible Duplicate:

  Etymology of “String”

I was talking to my non-technical wife about my workday and she was confused as to why I was talking about strings.  In her mind, a string is a piece of yarn or thread (I didn't tell her what I thought a thread was).

So it got me wondering...why do we use the vernacular "String" to mean "a character array"?

答:
We inherited from Mathematics (like a lot of things).

From my days as a student doing Maths (I remember it being though my memory is fuzzy).

It means an ordered sequence of elements. Where each element belongs to a finite set.


答:
A string is not an array of characters.

It is an array of codepoints. Codepoints are not characters. This is quite a complex topic, but the unfortunate fact is that "Array of characters" only works for Western Latin based scripts, and falls apart horrendously once you start dealing with more complex languages. If you're curious for more details, you can look into Unicode.

I believe that strings originated because a linked-list implementation would resemble pieces of string tied together to make the final product.

Title: Why is an array of characters called a String in Object Oriented languages?

Body:
Possible Duplicate:

  Etymology of “String”

I was talking to my non-technical wife about my workday and she was confused as to why I was talking about strings.  In her mind, a string is a piece of yarn or thread (I didn't tell her what I thought a thread was).

So it got me wondering...why do we use the vernacular "String" to mean "a character array"?


答:
From this definition (one of many) of string: a necklace consisting of a number of beads, pearls, or the like threaded or strung on a cord.

Or possibly from the verb to string: to connect in or as in a line; arrange in a series or succession: "She knows how to string words together."

Which is probably where Loki's mathematical use of the word arises, and both perfectly match DeadMG's clarification of what a text string really is.


答:
http://en.wikipedia.org/wiki/String

Generally, string is a flexible piece of rope or twine which is used
  to tie, bind, or hang other objects.

My guess is that the term was simply derived from this, because a sequential array of text just resembles it, including its typical uses. As others said, there are many more meanings to the term in regard to computer science:

http://en.wikipedia.org/wiki/String_%28computer_science%29

In computer programming, a string is traditionally a sequence of
  characters, either as a literal constant or as some kind of variable.
  The latter may allow its elements to be mutated and/or the length
  changed, or it may be fixed (after creation). A string is generally
  understood as a data type and is often implemented as a byte (or word)
  array that stores a sequence of elements, typically characters, using
  some character encoding. A string may also denote more general array
  data types and/or other sequential data types and structures; terms
  such as byte string, or more general, string of datatype, or
  datatype-string, are sometimes used to denote strings in which the
  stored data does not (necessarily) represent text.


问:
What's your favourite quote about programming?
What's your favourite quote about programming?

One quote per answer, and please check for duplicates before posting!

答: Crockford is the sole user of the super-strict equality operator (====), which either returns true or kicks you in the balls.

LastEditorDisplayName: Roger Pate


问:
In Scrum, what to do when story points and task hours don't roughly correlate?
Our development team is pretty new to the scrum process, so I would like to help refine our methods to make better use of it. In particular, I noticed that the correlation between story points and task hours is not very good. That is, we often have stories of lesser points decomposed into a total task hours greater than stories of higher points.

Now, I am aware that these are two separate estimation processes and that we should use the hours to estimate only the remaining work for a sprint while using the story points to compute a velocity and be able to predict the length of the release cycle or the amount of features we will be able to address. However, it seems to me that if sprint points and task hours don't correlate well, then we must be doing a bad job at estimating either one or both of these.

Since we only adjust the remaining work hours as opposed to recording the time spent, I can't easily tell if the problem is the initial task hour break-down or the story point estimates.

So, my question is whether we should deal with this and how? I can think of several ways to start dealing with this:

Record time spent in a task and use this information as feedback to help refine our estimation process by retrospectively identifying user stories which we under/over estimated. But I am not convinced that we want to record this information and I anticipate resistance to it.

At the planning phase, identify outliers after the task hour break-down process and look at these further. This way we could try to identify whether we misjudged the complexity of the story or if the task breakdown is missing some efforts or over-estimating the length of simple tasks. However, I'm afraid this would couple the two estimation efforts, which doesn't seem as the right thing to do either... This also assumes we would have decomposed all stories in the planning phase, otherwise we won't be able do much about stories which were misjudged.

Another method to approach this would be to try to independently incorporate methods to enhance the estimation process and raise the team consciousness about the importance of estimation. Then just keep monitoring the correlation between story points and initial task hour break-down as an indicator of how we are doing and whether we need to keep working at it. I'm inclined to think that this is the best approach, but less pro-active.

What is the best way to approach this issue and/or what other suggestions are there for enhancing the estimation process in this context?

答:
The important thing is to first of all understand whether you actually have a problem or not.

Story Points are used to determine how much your team can fit in a sprint

Task Hours are used to determine the health of a sprint

So, a priori there is no reason to worry about this. In practice though, on the first day of an iteration, both the task hours left and the story points are correlated to the whole sprint length—giving you a point which you can use to measure some form of correlation.

I would consider the following points:

Are you on track with the sprints? In other words, is your team committing to the right number of points (not too little, not too much)?

Is there any indication that one-iteration-worth of points is different or not correlated to one-iteration-worth of hours?

Points are less precise than hours by design. Are you simply witnessing a refinement?

Is your team simply not very good (yet) at estimating stories?

OwnerDisplayName: miguelf


问:
what is the object oriented counterpart to haskell / coq
I have detailed information on the latest developments in functional programming.

I think haskell is quite an advanced and high level programming language. With coq and agda this gets even more complex and advanced.

With "advanced" and "high level" I mean many distinct features, that can only be found in the respective languages.

Like for haskell

everything is pure and lazy per default

support for advanced concepts like GADTs, Monads, Functors, etc.

For coq / agda

a dependent type system

And both haskell and coq are used in academics, a good sign that they are 'state-of-the art'.

However I have no clue what comparable developments in object oriented programming are.

What are some of the latest developments in object oriented programming?

What would be a state-of-the-art OOP language counterpart to haskell / coq?

(I even search for advanced programming language on google, but I found mostly haskell related information. The only language I could think of is D 2.0. Scala is for me mainly a java compatible version of haskell.)

答:
I would say C# is probably a good language to loo at - it is a high level, general-purpose, managed, garbage-collected and object-oriented programming language.

The current version has generics, lambda expressions, built in parallelism constructs and more.

The next version is supposed to add asynchronous constructs.


答:
The concept of a "state-of-the-art" language is hard to define. One can consider only the syntax, the toolchain (i.e c++ is not recent, but has powerful compilers), the framework (c# and java are popular because of it).

I don't know coq, but it does not look like it is a general purpose language. The specifity of Haskell is its purity. So my answer is: smalltalk, a pure oop language.

http://en.wikipedia.org/wiki/Smalltalk

Title: what is the object oriented counterpart to haskell / coq

Body:
I have detailed information on the latest developments in functional programming.

I think haskell is quite an advanced and high level programming language. With coq and agda this gets even more complex and advanced.

With "advanced" and "high level" I mean many distinct features, that can only be found in the respective languages.

Like for haskell

everything is pure and lazy per default

support for advanced concepts like GADTs, Monads, Functors, etc.

For coq / agda

a dependent type system

And both haskell and coq are used in academics, a good sign that they are 'state-of-the art'.

However I have no clue what comparable developments in object oriented programming are.

What are some of the latest developments in object oriented programming?

What would be a state-of-the-art OOP language counterpart to haskell / coq?

(I even search for advanced programming language on google, but I found mostly haskell related information. The only language I could think of is D 2.0. Scala is for me mainly a java compatible version of haskell.)


答:
Subtyping (i.e., any static object-oriented type system) is so much more complex than any "flat" type system typical for the functional languages. It is nearly impossible to formalise it properly. For this reason, no surprise that we have not heard yet about, say, dependent object-oriented type systems.

Probably, a single early example of such an attempt would be this paper.


问:
Should I accept to write unsecure code if my employer requests me to do so?
My employer asked me to implement a feature that would require storing passwords in clear text in a database (or using an obscure encrypt/decrypt function stored in a binary, which is a bit better, but also insecure).

I replied that I was willing to implement such a feature, provided that customers were acknowledged of security implications when using it.

When discussing this problem with colleagues, someone told me that, as a software engineer, we are personally responsible (in the legal sense) for security problems that we introduce in our products. I looked into my contract, but did not found anything related to a similar case.

From a legal point of view, should I refuse to implement such a feature?
Is it true that my employer could take me to court if a customer experiences damage due to this feature, even if he was aware of security concerns as well?

EDIT: I understand this question can only be answered reliably from a lawyer. The same is true for licensing questions: people here give their understanding and their experience, sometimes after having consulted a lawyer, with no guarantee it applies in another jurisdiction. But licensing is explicitly accepted as a topic here, see What kind of questions can I ask here?. I believe other programmers may have the same issue, and other may have been confronted to this situation before, and may have consulted a lawyer for that.

答:
From a legal point of view, consult a lawyer. I'm not one, nor do we have any clue what jurisdiction or laws you live under which might help explain some things. But in any case consult a lawyer, would you trust an internet Q&A site with your personal, professional and financial future.

The general business advice is make sure you get your reservations down in writing and your employer's direct order to continue given the security concerns in writing. If things do go south and hit the fan you will have that to fall back on.

Another way around this would be to look deeper into the requirements -- you've shared the plan not the problem you are solving. There are more than one way to skin a cat, or handle password lookup requirements.


答:
I wouldn't worry about it - it's not like you're maliciously deciding yourself to put the insecure feature in and exploit it yourself later, or just put it in because you're negligent. The company wants this, someone has decided the trade off between development time and user expectations is acceptable (as usual) and so you should get on with it. If you are really worried about any comebacks, send your boss an email and keep the response. Once you've done that, as an employee, you're covered.

Sometimes there are reasons why this is acceptable - for example, I know of some very mission critical solutions that store plain text passwords, but the rest of the system is secured so that this doesn't become a problem. This system is on a separate network for example. If you don't know the rest of the story (a common situation in most companies) then you can reasonably expect that someone else has considered this. Similarly, if you have that email from your boss, you can expect that he knows what he's doing.

Incidentally... is this a product I (as a consumer) might use? If so.. what is it, so I can avoid it? :)

Title: Should I accept to write unsecure code if my employer requests me to do so?

Body:
My employer asked me to implement a feature that would require storing passwords in clear text in a database (or using an obscure encrypt/decrypt function stored in a binary, which is a bit better, but also insecure).

I replied that I was willing to implement such a feature, provided that customers were acknowledged of security implications when using it.

When discussing this problem with colleagues, someone told me that, as a software engineer, we are personally responsible (in the legal sense) for security problems that we introduce in our products. I looked into my contract, but did not found anything related to a similar case.

From a legal point of view, should I refuse to implement such a feature?
Is it true that my employer could take me to court if a customer experiences damage due to this feature, even if he was aware of security concerns as well?

EDIT: I understand this question can only be answered reliably from a lawyer. The same is true for licensing questions: people here give their understanding and their experience, sometimes after having consulted a lawyer, with no guarantee it applies in another jurisdiction. But licensing is explicitly accepted as a topic here, see What kind of questions can I ask here?. I believe other programmers may have the same issue, and other may have been confronted to this situation before, and may have consulted a lawyer for that.


答:
Your colleague is misguided, especially since you couldn't find anything on security responsibility in your contract.  Even if it did, you just got a conflicting order from management.

I think the only time you subject yourself to potential litigation is if you knowingly damage the product yourself, create your own time bomb, easter egg, etc.

On most cases, the company owns the software, so they get to enjoy the profits, but it also means they get to take on the risks, too, not the individual developer.

Personally, I would make sure management was aware of the issues with this security feature, so that it was documented beforehand, and just continue to do my work.

That being said, consult a lawyer, yada-yada-yada.


答: Whatever happens: Never write such code without having an email or other evidence showing clearly that you just followed the instructions of your employer.</p>


答:
Do we realize that numerous bugs are added by developers which does harm the customers during the live operations to equally great asset. We don't think they are intentional but it still is a result of some of our concrete work and still not to the mark. So the example you have made is not an isolated case, where developer's (or higher ups) decisions does affect the client.

Here is what i suggest:

First off, by all means - it is the company who is delivering the software to the other company. An individual is not given a direct credit (beyond applause within the team and paycheck at most) and ownership of the work. So while this is not a good thing as a part of our delivery, but you are not the criminal here - as long as decision is not yours.

As a professional programmer - you would clearly indicate the limitations of the code and dangers involved in how to maintain things as part of README file or documentation involved. If there is a requirements document - the suggested test report etc. should clearly mention the limitations.

In order to hold the true decision maker to be responsible- i would request the higher up to confirm their thinking in the email of any such documents.

Weigh the risk correctly. My data card software does store the password in plan text but that is not important. But the same is not acceptable if i am storing bank password or if it is access to database or server. So based on real risk, you must escalate the issue to higher up as much as possible.


问:
GPL in the workplace?
I once interviewed at a consulting company where it came up in the conversation that they use open source products (which is great, I've used Hibernate, JBoss, etc. extensively.)  One thing that did surprise me is that when I asked if they used GPL licensed OSS when writing applications for clients, they said "Sure, all the time!  As long as the client gets what they want and are happy."  Now, I'm no lawyer or big license buff, but I was under the impression that using GPL code (let's say some library that you include), then you are required to release the entire application under the same license.  When I pointed this out, I was given a quick response of, "Well, we give the clients all the source code when we're done, so that's really not an issue."

Not wanting to press the issue further (interviews aren't the place for arguments like that), I let it slide.  However, that still concerns me about that particular practice of the business.  What is the official word on GPL licensed code and how "open" does it need to be?  Do you have to publish it and say "My company used this library so here is the site where you can download our shopping and order fulfillment system application that we spend millions of dollars to build."?  In this situation, is the company right for using GPL code without the client's knowledge?  Is it enough to just "give them the source"?

答:
No, you are correct. Heres why:

Consider if we have an application under GPL. Now, then it can't be used by proprietary code.

If it was enough just to open source code that uses GPL, I could open source a project based on it as BSD.

Then proprietary software could use the GPL product.

Title: GPL in the workplace?


答:
What would I do? Wait for the retrospective, than speak openly with the team about this problem.

Figure out do we really need to track task hours? Aren't we able to estimate the average velocity and have a good guess at how much we should commit from a sprint to another? Because after all this is all that really matter.

Title: In Scrum, what to do when story points and task hours don't roughly correlate?

Body:
Our development team is pretty new to the scrum process, so I would like to help refine our methods to make better use of it. In particular, I noticed that the correlation between story points and task hours is not very good. That is, we often have stories of lesser points decomposed into a total task hours greater than stories of higher points.

Now, I am aware that these are two separate estimation processes and that we should use the hours to estimate only the remaining work for a sprint while using the story points to compute a velocity and be able to predict the length of the release cycle or the amount of features we will be able to address. However, it seems to me that if sprint points and task hours don't correlate well, then we must be doing a bad job at estimating either one or both of these.

Since we only adjust the remaining work hours as opposed to recording the time spent, I can't easily tell if the problem is the initial task hour break-down or the story point estimates.

So, my question is whether we should deal with this and how? I can think of several ways to start dealing with this:

Record time spent in a task and use this information as feedback to help refine our estimation process by retrospectively identifying user stories which we under/over estimated. But I am not convinced that we want to record this information and I anticipate resistance to it.

At the planning phase, identify outliers after the task hour break-down process and look at these further. This way we could try to identify whether we misjudged the complexity of the story or if the task breakdown is missing some efforts or over-estimating the length of simple tasks. However, I'm afraid this would couple the two estimation efforts, which doesn't seem as the right thing to do either... This also assumes we would have decomposed all stories in the planning phase, otherwise we won't be able do much about stories which were misjudged.

Another method to approach this would be to try to independently incorporate methods to enhance the estimation process and raise the team consciousness about the importance of estimation. Then just keep monitoring the correlation between story points and initial task hour break-down as an indicator of how we are doing and whether we need to keep working at it. I'm inclined to think that this is the best approach, but less pro-active.

What is the best way to approach this issue and/or what other suggestions are there for enhancing the estimation process in this context?


问:
What is exactly the meaning of "portability"?
I know very well that java is a portable language..and it is the byte-code that makes it portable..

However I've studied also that C is a portable language.
"The programs written in C are portable i.e. programs written for one type of computer or operating system can be run on another type of computer or operating system."

Then what is the difference between C portability and Java's portability?
can we say that C is also a portable language like java?
I know that java portability may be in terms of different application such as mac, PC, mobile phone..and C can't be used in such cases..But my question is still as how portability is different in both language?

Please clear my confusion.
Thanks in advance..

答:
The difference is that with c you usually(unless using something like LLVM) requires a recompile on new architectures, whereas java uses the same byte-code.

But I think you shouldn't say that a language is portable, but rather that a compiler is portable. It's easy to imagine a byte-code implementation of c which directly runs on different architectures, or a directly compiling version of java which needs a recompile on new architectures.

In practice portability is mainly about libraries. In particular portable GUIs are always problematic. And the the c standard doesn't contain anything related to it. Java on the other hand has GUI toolkits which work(to a certain degree) on many platforms. But making such GUIs feel native on all platforms is hard and usually requires additional work even with cross platform toolkits(and many GUI cross platform GUI toolkits feel foreign no matter how much work you put in).

And then there are many differences in platforms like the file naming schemes, path separators, multi-threading vs forking, conventions on where to store which files,... Most of them are hard to abstract away with cross platform libraries.

OwnerDisplayName: Laawanya

OwnerDisplayName: CodeInChaos


答:
Standard disclaimers apply: I am not a lawyer and neither are you.

GPL, at its core, is about protecting the rights of those using the program to obtain and use the source as well. It does not mandate that you publish the source of any program you write that uses GPL'd code, merely that if you publish such a program you must also provide the source.

I can write any number of apps for my personal use, pull in GPL'd code, and never give the source of any of this to anyone. I can write such apps for internal use by my company, and need only provide the source to those within my company who use the program (practically-speaking, I would have to do this anyway if they had any good reason to request it). If I write such a program for some other entity, I merely have to give them the code (and make it clear that the program is GPL-licensed) - if they go on to distribute it, they also must then make the source available, but I'm out of the picture.

So the only worry your consulting company might have is that they were failing to make their clients aware of the license the code they provided fell under. Actually, I lie - if they had negotiated a different license with their clients (client owns all rights to code...) then they could be in hot water over that as well... But this is true for any third-party code: unless it's public-domain, you must comply with the license, and must not re-license it unless that right has been granted you by the copyright holder.

Title: GPL in the workplace?

Body:
I once interviewed at a consulting company where it came up in the conversation that they use open source products (which is great, I've used Hibernate, JBoss, etc. extensively.)  One thing that did surprise me is that when I asked if they used GPL licensed OSS when writing applications for clients, they said "Sure, all the time!  As long as the client gets what they want and are happy."  Now, I'm no lawyer or big license buff, but I was under the impression that using GPL code (let's say some library that you include), then you are required to release the entire application under the same license.  When I pointed this out, I was given a quick response of, "Well, we give the clients all the source code when we're done, so that's really not an issue."

Not wanting to press the issue further (interviews aren't the place for arguments like that), I let it slide.  However, that still concerns me about that particular practice of the business.  What is the official word on GPL licensed code and how "open" does it need to be?  Do you have to publish it and say "My company used this library so here is the site where you can download our shopping and order fulfillment system application that we spend millions of dollars to build."?  In this situation, is the company right for using GPL code without the client's knowledge?  Is it enough to just "give them the source"?


答:
Java is object-compatible. You compile it on one patform and the resultant class files can run on any JVM.

C is source-portable. You can take your C source code and compile it on any ISO C compiler, provided you follow the rules - that means no using undefined or implementation defined behaviour or any non-standard features.

Title: What is exactly the meaning of "portability"?

Body:
I know very well that java is a portable language..and it is the byte-code that makes it portable..

However I've studied also that C is a portable language.
"The programs written in C are portable i.e. programs written for one type of computer or operating system can be run on another type of computer or operating system."

Then what is the difference between C portability and Java's portability?
can we say that C is also a portable language like java?
I know that java portability may be in terms of different application such as mac, PC, mobile phone..and C can't be used in such cases..But my question is still as how portability is different in both language?

Please clear my confusion.
Thanks in advance..


答:
C is a portable language, when is compared to Assembly language, which can only run in a single CPU architecture. In this sense, you can say that C is portable. Of course, for every architecture - CPU, you need a different compiler.

For Java on the other hand, you don't need a separate compiler. You need a Java runtime to be available.

OwnerDisplayName: kgiannakakis


答:
In C only the source code is portable, you have to recompile it on every target platform, given that a suitable C compiler exist.
Also, if you access any library or operating system function it must exist on any platform where you want to run your program on.

The big deal in java is, that the language itself brings a lot of standard libarary functions with it, so you rarely need access to the operating systems api.

OwnerDisplayName: codymanix


答:
Portability is a characteristic attributed to a computer program if it can be used in an operating systems other than the one in which it was created without requiring major rework.

Portability has usually meant some work when moving an application program to another operating system. Recently, the Java programming language and runtime environment has made it possible to have programs that run on any operating system that supports the Java standard (from Sun Microsystems) without any porting work. Java applets in the form of precompiled bytecode can be sent from a server program in one operating system to a client program (your Web browser) in another operating system without change.

Read more: http://wiki.answers.com/Q/What_is_portability#ixzz1EsuKJIEs

OwnerDisplayName: kamaci


答:
C is really not all that portable. With a bit of work you can port C code, but if you ever look into the source code of some multi-platform C, you almost always find an unreadable mishmash of #ifdefs.

I'd list some languages that are more portable than C, but the list would pretty much consist of every language in existence except Assembler.

Another good question to read over is Why is it difficult to write portable C programs?


答:
C source files can be compiled for different hardware architectures and for different operating system. The C language itself has no limitations. We can write and compile a c source file on linux, transfer the source file to a windows box and compile the same file over there with no compiler errors (assuming we have all header files and don't look at possible linking problems).

So yes, the c language is portable. But the compiler output obviously isn't, because it is machine code and only runs on one (family of) processor.


答:
"Portable" has multiple meanings with respect to C.

In one sense, it refers to the fact that C compilers can easily be implemented on a wide range of hardware, from micros (PCs) to mainframes.  The design of the language is fairly simple and compilers for it don't require lots of memory or processor power to run, at least compared to languages like Fortran, which used to be limited to larger minis and mainframes (remember, C is a product of the early 1970s, when micros were 8-bit and total system memory was measured in kilobytes).

In another sense, it means that C compiler implementations are similar enough such that source code written on one platform will compile and behave much the same way on other platforms (this is especially true with the development of the 1989 and 1999 ANSI/ISO standards).  However, the C language standards try to strike a balance between portability and ease of implementation, leaving some things to the compiler implementor.  Thus, not all source code is trivially portable between different systems.

Compiled C code is (typically) not byte-for-byte portable the way compiled Java code is1; C (typically) compiles to native machine code, whereas Java compiles to a byte code which is run from within the JVM.  You could not take a compiled executable from an x68 system and run it on a Sparc or MIPS system, for example.

I've heard that there are C compilers that generate Java byte code instead of native machine code, so in that case it's possible to write C code that winds up being byte-for-byte portable between JVMs.

OwnerDisplayName: John Bode


答:
With portability, it is not a matter of definition but more of degree.  Some languages and environments are more portable than others.

Background

In the days when computers were contrived, there were many processors and each had its own machine or assembly language.  Worse yet, there were no standards for equipment external to the processor such as core-memory and drum memory.  Thus most applications were tailored and optimized for one specific computing environment.  This is when the demand for portability began.

Users of computing machinery (a.k.a. corporations) wanted more computing power and would purchase computers from various manufacturers.  The Users also wanted their applications to work on the new computers;  either the computer supplier would have to create a similar application or the corporation would hire people to port the application's functionality to the new computer. This became expensive.

Focus On Portability

The thinkers in computer science started working on strategies to reduce the time required to port an application running on one manufacturer's computer (e.g. Honeywell) to another (e.g. IBM).  At the same time, the thinkers were becoming lazy and wanted more (machine) code written with less typing and effort.  Thus began high level languages.

High level languages focused more on abstract concepts and standardization than the machine language.  An application called a translator would convert the high level language to the specialized machine code.  This allowed an application to be ported to another platform without minimal changes to the high level source code.  In theory, for a new platform, only one translator would need to be written, then many applications (written in the high level language* could be executed on the new platform by running them through the translator.  Compilers, and interpreters are specializations of a translator.  Applications written in high level languages became more portable than those writing in machine language.  Examples:  COBOL, LISP, FORTRAN.

Portability and the Environment.

One of the keys to the languages' portability was to avoid or minimize things specific to the processor or environment that were not a part of theoretical computing.  Peripherals, such as display terminals, printers and external communications were not standard.  Some terminals had 132 character widths while others had 80.  A new group of thinkers emerged, developing standards for the environment around the processor.  They produced concepts such as ASCII, RS232, HPGL, SCSI, and etc.  The peripheral manufacturers started producing products according to these standards.  More people were happy.  Applications became more portable.

Updating the Languages for Portability.

Some thinkers looked at the old high level languages and decided they needed either updating or reinvention to keep up with the new standards.  One of these standards was graphics, which were used for GUIs.  By this time, core functionality of graphics was changing less and becoming standardized.  So the thinkers created new languages that would have standardized graphics capabilities (along with other features).  And again, when creating new languages, other features would be added.  The new languages also combined features for producing correct and robust code from the beginning (the language would reduce the possibilities for shooting one's foot).  Out of this era came languages such as Java, C++, C#, Perl, Python, Ruby, etc.

These new languages included tighter specifications for portability.  As long as the developer stayed within these bounds, the programs would build and execute on different platforms.  The more portable languages came up with a solution to the problem of different machine languages:  an intermediate executable language (i.e. byte code).  The translators would produce and executable in terms of this intermediate executable language.  Now applications only needed an interpreter for this intermediate executable language and they could run on a new platform.

Summary

Portability is often associated in degree rather than a hard coded definition.  Standardization goes in hand with portability.  The latest trend is to find ways of making an application's executable more portable across platforms, thus reducing development effort to port an application to new platforms.

When people talk about portability, feel free to question their definition as it applies to the source language or to the executable of the application.

OwnerDisplayName: Thomas Matthews


答:
Unless you perform your job in a wilfully damaging manner there is little legal downside to doing the tasks asked of you.  You will have a contract of employment that will state your liabilities, you can consult a lawyer on the technicalities.  Get written approval of the design decision on plaintext passwords if you really feel exposed.

I won't reveal which software it is until I'm sure this feature makes
  it in the final release. I still have hope we manage to inform
  customers in a way I find it acceptable.

A little more worrying is your quote about 'informing customers'.  If you damage your companies standing, reputation etc (a clause about which will be in your contract) then your company could sue you - and a 'whistleblower' defence might not help you when you need a reference or another job.

If you are unhappy about the implications of the security holes then brush up your resume and move on, but if it wasn't your decision and its not your company I can't see why this would be 'blamed' (legally) on you.


问:
What's the worst question you were ever asked at interview?
It doesn't have to be programming or software development related, but just asked during an interview for an IT related job.

I know some "left field" questions are meant to see how the candidate copes with unexpected and novel situations, but here I'm looking for a question that appeared to be completely unrelated to the job they were interviewing you for, or something that made you think "what useful information could they possibly get from my answer to that question?".

答: I was once asked if I had any food allergies.</p>


答:
what you can do to follow directions to store passwords in a recoverable format while still being impossible to retrieve if you have full access to the program is using asymmetric encryption

you encrypt the (salted as always) key with the public key stored in the binary

and when the passwords are needed in plain-text a human needs to provide the private key that is otherwise kept secure away from the server


问:
What is a 'good number' of exceptions to implement for my library?
I've always wondered how many different exception classes I should implement and throw for various pieces of my software. My particular development is usually C++/C#/Java related, but I believe this is a question for all languages.

I want to understand what is a good number of different exceptions to throw, and what the developer community expect of a good library.

The trade-offs I see include:

More exception classes can allow very fine grain levels of error handling for API users (prone to user configuration or data errors, or files not being found)

More exception classes allows error specific information to be embedded in the exception, rather than just a string message or error code

More exception classes can mean more code maintenance

More exception classes can mean the API is less approachable to users

The scenarios I wish to understand exception usage in include:

During 'configuration' stage, which might include loading files or setting parameters

During an 'operation' type phase where the library might be running tasks and doing some work, perhaps in another thread

Other patterns of error reporting without using exceptions, or less exceptions (as a comparison) might include:

Less exceptions, but embedding an error code that can be used as a lookup

Returning error codes and flags directly from functions (sometimes not possible from threads)

Implemented an event or callback system upon error (avoids stack unwinding)

As developers, what do you prefer to see?

If there are MANY exceptions, do you bother error handling them separately anyway?

Do you have a preference for error handling types depending on the stage of operation?

答:
I usually start with:

An exception class for argument bugs. E.g. "argument not allowed to be null", "argument must be positive", and so on. Java and C# have predefined classes for those; in C++ I usually create just one class, derived from std::exception.

An exception class for precondition bugs. Those are for more complex tests, like "index must be smaller than the size".

An exception class for assertion bugs. Those are for checking the state for constistency halfway methods. E.g. when iterating over a list to count elements that are negative, zero, or positive, at the end those three should add up to the size.

One base exception class for the library itself. At first, just throw this class. Only when the need arise, start adding sub-classes.

I prefer not to wrap exceptions, but I know that opinions differ on this point (and is very correlated to the language used). If you do wrap, you'll need additional wrapping exception classes.

As the classes for the first 3 cases are debugging aids, they are not intended to be handled by the code. Instead, they should be caught only by a top-level handler that displays the info such that the user can copy-paste it to the developer (or even better: press the "send report" button). So include info that is useful for the developer: file, function, line-number, and some message that clearly identifies which check failed.

As the first 3 cases are the same for each project, in C++ I usually just copy them from the previous project. Because many are doing exactly the same, the designers of C# and Java added standard classes for those cases to the standard library. [UPDATE:] For the lazy programmers: one class could be enough and with some luck your standard library already has a suitable exception class. I prefer to add info like filename and linenumber, which the default classes in C++ don't provide. [End update]

Depending on the library, the fourth case could have one class only, or could become a handfull of classes. I prefer the agile aproach to start simple, adding sub-classes when the need arise.

For a detailed argumentation about my fourth case, see Loki Astari's answer. I totally agree with his detailed answer.


问:
On the path to Enlightenment: Scheme, Common Lisp, Clojure?
A lot of people smarter than me keep writing about when you learn Lisp it makes you a better programmer because you "get it".

Maybe all I hear about Lisp(s) changing your life is just a big practical joke on the newbies, but I figure there's no harm in knowing more about the world, even if I find out I've been sent after a snipe or something.

I'd like to follow the SICP book, and or ANSI Common Lisp, but at the same time be studying a dialect and implementation that I could go on to use on personal projects.

SICP is focused on Scheme, so that's one big vote.
Paul Graham said that if he were to teach newbies he'd do it in Scheme, but it sounded like Scheme was still inferior to Common Lisp.
But then there's Clojure-- which I'm told is limited in ways, but more practical in others (JVM libraries).

It sounds like I could get through Scheme materials easier, achieve "real" enlightenment from CL, or come close enough with Clojure and be able to get more done with it in the long run.

How much of all of that is true?  When should I stop thinking about what to learn about and just go and learn about it?

答:
Maybe all I hear about Lisp(s) changing your life is just a big practical joke on the newbies

Absolutely not true, It isn't a joke.

With Lisp you are going to build any thing you want, even your own programming language.

You will be enlighten no matter what you pick whether it is CL, Scheme or Clojure.

I personally recommend that you learn Clojure since it is an active Lisp, a practical dialect that supports concurrent programming in an elegant way and it runs on the JVM (huge selling point).

ClojureScript brings Lisp to client side programming which is really a cool thing.

And by the way, SICP is available in Clojure.

Welcome aboard :)


答:
Your company should have taken out a form of professional indemnity insurance when they employed you. This should provide adequate legal protection for all its employees in case of anything going wrong with the software, or misuse of software or flaws being found in the software (such as unencrypted passwords).

As an employee you are supposed to do what they ask, and they are supposed to do what the client wants, as long as neither party are breaking the law, there is no problem, but if you do what the company wants, and then it is found to be not what the client wanted/required, then that is between them, and the professional indemnity insurance should cover you from any personal blame/liability.

IANAL, but i would take this up with the companies legal team, in addition to checking with your own lawyers.

PS, if you are seriously spooked by this, save all relevant emails in electronic & hard copy somewhere off-site if possible.


答:
As a consultant, I make a point of raising license issues early with my customer so that they can make an informed choice. If the best technology to apply to their problem is under GPL but they can't comply with the license, then I can't use it. In practice, this has had two effects.

First, many are happy to pay for a commercial product specifically to avoid this issue. This is especially common in the embedded systems world where compliance with GPL would effectively require publishing the complete hardware design and documenting how it all works to meet the spirit of the GPL which is an attempt to make it possible for an end user to change the product. While it is possible to to make products that are that open, it requires a great deal of commitment at all levels of the company. The larger problem is that many components of a design are documented to us by their makers under NDA and it is effectively impossible to create GPL compliant code that uses documentation released under NDA.

Second, we now have a preference for the MIT license and its many relatives (which make it clear that commercial use is acceptable) over the GPL at any revision. I haven't had any customer object to releasing bug fixes and improvements made back to the relevant product communities. Since the license is permissive, I can comply with my NDA obligations, keep my customer happy, and contribute to the relevant communities.

Title: GPL in the workplace?


答: If you want to start with SICP go with scheme, just because that is what the book teaches. Moving from Scheme to Clojure will be pretty easy.</p>

Title: On the path to Enlightenment: Scheme, Common Lisp, Clojure?

Body:
A lot of people smarter than me keep writing about when you learn Lisp it makes you a better programmer because you "get it".

Maybe all I hear about Lisp(s) changing your life is just a big practical joke on the newbies, but I figure there's no harm in knowing more about the world, even if I find out I've been sent after a snipe or something.

I'd like to follow the SICP book, and or ANSI Common Lisp, but at the same time be studying a dialect and implementation that I could go on to use on personal projects.

SICP is focused on Scheme, so that's one big vote.
Paul Graham said that if he were to teach newbies he'd do it in Scheme, but it sounded like Scheme was still inferior to Common Lisp.
But then there's Clojure-- which I'm told is limited in ways, but more practical in others (JVM libraries).

It sounds like I could get through Scheme materials easier, achieve "real" enlightenment from CL, or come close enough with Clojure and be able to get more done with it in the long run.

How much of all of that is true?  When should I stop thinking about what to learn about and just go and learn about it?


问:
How to store a simple DB "in the cloud"?
Even though the name is similar my question is not a dupe of the very fine question here:

Database in the cloud?

I've got a webserver (Java/Tomcat) running a webapp (which I wrote) on a dedicated server (which I fully configured myself) and I'd like to have it now use a small persistent DB.

I know how to install and configure a SQL DB like, say, PostgreSQL: I've already done it several times.  But this time I'd like to do something different.

The DB schema is very simple.  So simple that a spreadsheet is enough to store the data (a few columns and lots of rows).  It would only grow by about 2000 rows a day (and that requirement, seen the datasource, cannot change in the future). (*)

I don't want to install PostgreSQL nor any other DB on my dedicated server: I don't want to bother with backup/configuration/re-installation if I migrate/update the server etc. so I'd like to keep my dedicated server as simple as possible and store the DB somewhere "in the cloud".  By that I mean I'd like to have either Google or Amazon or someone else take care of the data (there's nothing confidential) and have an easy way to access it.

Ideally it should be free.

Here's what I'm thinking of at the moment:

every time new data comes in (from a fat client) I a) update a Google Doc spreadsheet using the Java API they provide and b) I warn my Java webapp that new data did arrive (about once every 10 minutes)

every time the Java webapp is launched and every time it gets notified that new data was in, it pulls data from the Google Doc spreadsheet using the Java API.

The advantage is that:

it's free

the Google Doc spreadsheet limits of 400 000 cells per document would allow me to have one spreadhseet per week (for example)

the DB is stored in Google's cloud, making it highly unlikely that I'd lose it

I can easily visualize my data from wherever I'd be: I can simply log on to Google Docs an open the spreadsheet

And of course I can still do my own daily or weekly backup of the data (offline onsite and online onsite for example).

I don't see any particularly hard technical issues here but I'm wondering what would the other options be?

How would you go about storing a very simple DB "in the cloud"?

(*) Should the requirement change later on, I could always move on to a "real" DB that I'd install on my server but as of now I'm really after having my data in the cloud

答:
Read Write Web has a pretty recent summary of some good options for cloud based data providers. Exactly which one is really a tactical matter based on the nature of your data more than anything else.

As you note, any choice you do make still requires a backup method for saftey's sake. Even Amazon and Google go down from time to time.


问:
May I give a single class multiple responsibilities if only one will ever be reusable?
To the extent that I understand the Single Responsibility Principle, a SINGLE class must only have one responsibility.

We use this so that we can reuse other functionalities in other classes and not affect the whole class.

My question is: what if the entity has only one purpose that really interacts with the system, and that purpose won't change? Do you have to separate the implementations of your methods into another class and just instantiate those from your entity class?

Or to put it another way... Is it ok to break the SRP if you know those functions will not be reusable in the future? Or is it better to assume that we do not know if the functionalities of these methods will be reusable or not, and so just abstract them to other classes?

答:
Your assumption that you might know that functions won't be reused is incorrect. You cannot know who will want to use your classes or how they'll want to use them. Therefore you should always assume that your class will be used by someone else in the future and stick to good design principles.

If nothing else when you revisit the code in 18 months time you'll be able to work out what you were attempting to do when you wrote the code in the first place.

OwnerDisplayName: lnluis


答:
It sounds like I could get through Scheme materials easier, achieve
  "real" enlightenment from CL, or come close enough with Clojure and be
  able to get more done with it in the long run.

Don't expect miracles. Working in a language like Scheme will expand your horizons and probably teach you quite a bit about how programs are executed, but it's not an express ticket to the Sphere of Infinite Consciousness.

When should I stop thinking about what to learn about and just go and
  learn about it?

About 7 seconds after you finish reading this answer.


答:
Unit tests can be considered as reusing a class.

Therefore, SRP improves testability.

Title: May I give a single class multiple responsibilities if only one will ever be reusable?

Body:
To the extent that I understand the Single Responsibility Principle, a SINGLE class must only have one responsibility.

We use this so that we can reuse other functionalities in other classes and not affect the whole class.

My question is: what if the entity has only one purpose that really interacts with the system, and that purpose won't change? Do you have to separate the implementations of your methods into another class and just instantiate those from your entity class?

Or to put it another way... Is it ok to break the SRP if you know those functions will not be reusable in the future? Or is it better to assume that we do not know if the functionalities of these methods will be reusable or not, and so just abstract them to other classes?


答:
I keep it simple.

A library has a base exception type extended from std:::runtime_error (that's from C++ apply as appropriate to other languages). This exception takes a message string so we can log; every throw point has a unique message (usually with a unique ID).

That's about it.

Note 1: In the situations where somebody catching the exception can fix the exceptions and re-start the action. I will add derived exceptions for things that can be potentially uniquely be fixed at a remote location. But this is very very rare (Remember the catcher is unlikely to be close to the throw point thus fixing the problem is going to be hard (but everything is dependent on situation)).

Note 2: Sometimes the library is so simple it is not worth giving it its own exception and std::runtime_error will do. It is only important to have an exception if the ability to distinguish it from std::runtime_error can give the user enough information to do something with it.

Note 3: Within a class I usually prefer error codes (but these will never escape across the public API of my class).

Looking at your trade offs:

The trade-offs I see include:

More exception classes can allow very fine grain levels of error handling for API users (prone to user configuration or data errors, or files not being found)

Do more exceptions really give you finer grain control? The question becomes can the catching code really fix the error based on the exception. I am sure there are situations like that and in these cases you should have another exception. But all the exceptions you have listed above the only useful correction is to generate a big warning and stop the application.

More exception classes allows error specific information to be embedded in the exception, rather than just a string message or error code

This is great reason for using exceptions. But the information must be useful to the person who is caching it. Can they use the information to perform some corrective action? If the object is internal to your library and can not be used to influence any of the API then the information is useless. You need to be very specific that the information thrown has a useful value to the person that can catch it. The person catching it is usually outside your public API so tailor your information so that it can be used with things in your public API.

If all they can do is log the exception then it is best to just throw an error message rather than lots of data. As the catcher will usually build an error message with the data. If you build the error message then it will be consistent across all catchers, if you allow the catcher to build the error message you could get the same error reported differently depending on who is calling and catching.

Less exceptions, but embedding an error code that can be used as a lookup

You have to determine weather the error code can be used meaningfully. If it can then you should have its own exception. Otherwise your users now need to implement switch statements inside there catch (which defeats the whole point of having catch automatically handle stuff).

If it can't then why not use an error message in the exception (no need to split the code and the message it makes it a pain to look up).

Returning error codes and flags directly from functions (sometimes not possible from threads)

Returning error codes is great internally. It allows you to fix bugs there and then and you have to make sure you fix all error codes and account for them. But leaking them across your public API is a bad idea. The problem is that programmers often forget to check for error states (at least with an exception an unchecked error will force the application to quit an un-handled error will generally corrupt all your data).

Implemented an event or callback system upon error (avoids stack unwinding)

This method is often used in conjunction with other error handling mechanism (not as an alternative). Think of your windows program. A user initiates an action by selecting a menu item. This generates an action on the event queue. The event queue eventually assigns a thread to handle the action. The thread is supposed to handle the action and eventually return to the thread pool and await another task. Here an exception must be caught at the base by the thread tasked with the job. The result of catching the exception will usually result in an event being generated for the main loop which will eventually result in an error message being displayed to the user.

But unless you can continue in the face of the exception the stack is going to unwind (for the thread at least).

Title: What is a 'good number' of exceptions to implement for my library?

Body:
I've always wondered how many different exception classes I should implement and throw for various pieces of my software. My particular development is usually C++/C#/Java related, but I believe this is a question for all languages.

I want to understand what is a good number of different exceptions to throw, and what the developer community expect of a good library.

The trade-offs I see include:

More exception classes can allow very fine grain levels of error handling for API users (prone to user configuration or data errors, or files not being found)

More exception classes allows error specific information to be embedded in the exception, rather than just a string message or error code

More exception classes can mean more code maintenance

More exception classes can mean the API is less approachable to users

The scenarios I wish to understand exception usage in include:

During 'configuration' stage, which might include loading files or setting parameters

During an 'operation' type phase where the library might be running tasks and doing some work, perhaps in another thread

Other patterns of error reporting without using exceptions, or less exceptions (as a comparison) might include:

Less exceptions, but embedding an error code that can be used as a lookup

Returning error codes and flags directly from functions (sometimes not possible from threads)

Implemented an event or callback system upon error (avoids stack unwinding)

As developers, what do you prefer to see?

If there are MANY exceptions, do you bother error handling them separately anyway?

Do you have a preference for error handling types depending on the stage of operation?


答:
Open source does not necessarily mean free.

IANAL either, but generally speaking the requirement for GPL is to provide the source code for your project.  You can certainly sell a product to someone else.  However, I believe that you cannot prevent them from giving it away.  That is probably what makes most GPL'd software free, as in beer.  I'm fairly certain that you do not have to publish your code to world+dog just because it is GPL'd.

From the preamble to v3 of the GPL (emphasis my own):

The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.

(source)

In this situation, is the company right for using GPL code without the client's knowledge? Is it enough to just "give them the source"?

This is a slightly different question.  If the client has some expectation and that expectation is dictated in a contract, the company may have an issue.  Otherwise, it is up to them to determine how best to do the job.  However, they are supposed to include a notice in the source code regarding the license.  I am uncertain if they must disclose this to their client in any other way.

Title: GPL in the workplace?


答:
One formulation of the SRP is: Every class should only have one reason to change.

The reason behind this is, that requirements are almost certain to change at some point in the future - probably the least convenient one.

When you use one class to implement two separate functionalities, you are risking to run into a situation, where the requirements for either functionality change and the two requirement sets as well as your design decision to not keep their implementation apart can no longer be reconciled. That's the last call for applying SRP and refactoring the one class into two (or more), before you start bending your code around a design flaw.

But seriously, just get it right the first time. All the time you waste speculating on whether it's safe to violate SRP based on your prognosis on future requirement changes (which is something programmers really just suck at), use it to create two classes. It's a trivial thing to do, that most IDEs will even do for you.


问:
Why can't we get anything done?
I work on a small team, in a medium-sized company, most of which isn't involved in software development. I'm the newest and least-experienced developer and had no professional or academic background in software before starting, but I'm quite pleased with how respected my input is and am grateful for being taken seriously at such an early stage in my career.

Still, I feel like I should be doing more with this generous amount of airtime. As a team, we seem to have trouble getting things done. I'd like to be able to suggest something to improve the situation, and I think I'd be listened to if it was a good idea, but I'm at a loss for what to suggest.

Things I can identify as being issues include:

Specification of the tasks at hand is sparse. This is partly because management is a bottleneck and we don't have the money or people to commit to working out detailed requirements as much as we'd like. It's also partly because the software we're developing is investigative and the precise method isn't clear until it's demonstrated and used to determine its effectiveness.

The Lead Dev is very fond of what he calls 'prototyping' to the point that he's lately started insisting that everything is 'prototyped', which to the rest of us looks like writing bad code and giving it to the modellers to play with. It isn't clear what he expects to come out of this exercise in many cases. The 'actual' implementation then suffers because of his insistence that good practice takes too much time from the prototyping. I haven't even begun to be able to untangle this twisted logic and I'm not sure I want to try.

The modellers are expected to tell us everything about the desired methodology in precise detail, and it's taken on absolute trust that what they come out with is theoretically flawless. This is hardly ever true, but no action is taken to rectify this situation. Nobody on the modelling side raises any concerns in a structured way that is likely to be acted upon, nor do they seek guidance in applying best practices. Nothing is done about their passivity either.

I've tried to push TDD in the team before, but found it difficult as it's new to me and while those with oversight of my work were willing to tolerate it, no enthusiasm has been forthcoming from anyone else. I can't justify the amount of time I spend wallowing and not finishing features, so the idea has - for the moment - been abandoned. I'm concerned it won't be picked up again, because nobody likes to be told how to do their job.

We now have a continuous integration server, but it's mostly only being used to run multiple-hour regression tests. It's been left open that it ought to be running full-coverage unit and integration tests as well, but at the moment nobody writes them.

Every time I raise the issue of quality with the lead dev, I get an answer to the effect of 'Testing feature A is straightforward, feature B is much more important to the user but too difficult to test, therefore we shouldn't test feature A'. Once again I've made no headway in trying to untangle this logic.

....phew. When I phrase it like that, it looks much worse than I thought. I suppose, as it turns out, this is a cry for help.

答:
Let me play devil's advocate for a moment:

Specification of the tasks at hand is sparse... The Lead Dev is very
  fond of what he calls 'prototyping'

The lead dev is fond of prototyping because specifications are sparse.  This is probably a good thing; this is how iterative shops work.

The modellers are expected to tell us everything about the desired
  methodology in precise detail

This won't work in an iterative shop.  The very nature of iterative development is that requirements are often incomplete.  The iterations are what is needed to flesh out the requirements.

I've tried to push TDD in the team before, but found it difficult as
  it's new to me

This won't work either; you need to understand the technology before you can evangelize it.  Further, in an iterative shop with scant requirements, TDD may be too much overhead.  It's better to encourage adequate unit testing coverage.

We now have a continuous integration server, but it's mostly only
  being used to run multiple-hour regression tests.

That may be appropriate in a small, iterative shop.

Every time I raise the issue of quality with the lead dev, I get an
  answer to the effect of 'Testing feature A is straightforward, feature
  B is much more important to the user but too difficult to test,
  therefore we shouldn't test feature A'

It sounds like your shop has some fairly tight time constraints; like it or not, you are bound by those constraints.

It also sounds like you came from a part of the software industry that values doing things "the right way" over getting things to the market first.  There's nothing wrong with that (it's admirable, in fact), except that the first to market with a buggy piece of software is often the winner.  It's not fair, but that's how it is.

Title: Why can't we get anything done?


问:
What's your strongest opinion against functional programming?
Functional programming is one of the oldest programming paradigms. However it isn't used much in the industry compared to more popular paradigms. But it have largely been emphasized in academia.

What's your strongest opinion against functional programming?

答: FP is cool in academia because it is cool to write nice short programs, while ignoring performance.  There isn't some conspiracy against it in real world. Also for example implementing some stuff(radix sort for example) seems like total pain in FP. Oh and generated code is IMHExperience sloooooooooooooooooooow.</p>


问:
Monitor Process
I have some previous posts talking about how to use python to "do something" when a record is inserted or deleted into a postgres database. I finally decided on going with a message queue to handle the "jobs"(beanstalkd). I have everything setup and running with another python process that watches the queue and "does stuff". I am not really a "systems" guy so I am not sure what is a good way to go about monitoring the process to make sure if it fails or dies that it restarts and sends a notification. Google gave some good ideas but I thought asking here I could get some suggestions from people that I am sure have had to do something similar.

The process is critical to the system and it just needs to always work and if its not working then it needs to be addressed and other parts of the system "paused" until the problem is fixed.

My thoughts were to just have a cronscript run every minute or two that checks to see if the process is running. If not it restarts it. Another script (or maybe just another function of the first) would be to monitor the jobs and if the jobs waiting to be processed hit a specific threshold to also flag that there is a major problem.

Specifics about process...
The process updates the orders in a legacy system with the qty's of items that are shipped or back ordered from our warehouse. SO if these things are not done then when the order is invoiced it will have incorrect qtys and the people involved wouldn't have a good way to spot this unless they are checking each line. I thought I might also have a flag on the order that says "yes i have been touched" and if its hasn't to just notify the invoice agent.

This same method is going to be used for updating orders with shipping information based on when orders are shipped from UPS Worldship.

I don't know, i think i have a handle on this but it just feels "kludgy".

答:
You can wait() for beanstalkd's pid; if it exits (cleanly or otherwise), wait() will return you the exit code, and you will be able to restart the process imemdiately.

Beanstalkd persists its queue (if you specity -b), so beanstalkd process crashing time to time (if ever) probably is not an issue. But your postgress trigger will not be able to push the data to beanstalkd queue at that moment. For this reason, I'd use a separate queue table in postgres. Transactions append records to this table. A periodic (say, once a second) process checks this table, pushes the data to beanstalkd and only removes it from queue table if beanstalkd reliably accepted the data.

With this setup, the worst case you'll have is data not being sent entirely timely to the system that beanstalkd supplies it to. Other parts of system will not need to actually pause, because once everything is in palce again, the backlog of messages will be cleared eventually.

Title: Monitor Process


答:
They don't really collerate well because as you said, they are used for different purposes.

With time, your team will do better estimates and you'll get more accurate velocity per story point.

My comments about your solutions:

Record time spent in a task and use this information as feedback to help refine our estimation process by retrospectively identifying user stories which we under/over estimated.

Velocity was designed to adjust developer's estimation against reality. When properly used, velocity will "adjust" those uncertainties in 3 or 4 sprints on average.

At the planning phase, identify outliers after the task hour break-down process and look at these further. This way we could try to identify whether we misjudged the complexity of the story or if the task breakdown is missing some efforts or over-estimating the length of simple tasks.

Again "misjudge" is adjusted with time and experience gained from sprint to sprint.

Another method to approach this would be to try to independently incorporate methods to enhance the estimation process and raise the team consciousness about the importance of estimation. Then just keep monitoring the correlation between story points and initial task hour break-down as an indicator of how we are doing and whether we need to keep working at it.

That is done with time too. Planning poker sessions will become more and more productive with experience.


答:
I'm going to focus on the prototyping here

the major issue with prototypes is that they are meant as proof of concept

however if you can't build further on the prototype and need to rebuild the final product from scratch you might as well not have build the prototype and you have wasted your time building it

my advise to your team is to get some quality and flexibility in those prototypes. I know it's not possible to create perfect stuff first time but try to remain extensible for future requirements

Title: Why can't we get anything done?

Body:
I work on a small team, in a medium-sized company, most of which isn't involved in software development. I'm the newest and least-experienced developer and had no professional or academic background in software before starting, but I'm quite pleased with how respected my input is and am grateful for being taken seriously at such an early stage in my career.

Still, I feel like I should be doing more with this generous amount of airtime. As a team, we seem to have trouble getting things done. I'd like to be able to suggest something to improve the situation, and I think I'd be listened to if it was a good idea, but I'm at a loss for what to suggest.

Things I can identify as being issues include:

Specification of the tasks at hand is sparse. This is partly because management is a bottleneck and we don't have the money or people to commit to working out detailed requirements as much as we'd like. It's also partly because the software we're developing is investigative and the precise method isn't clear until it's demonstrated and used to determine its effectiveness.

The Lead Dev is very fond of what he calls 'prototyping' to the point that he's lately started insisting that everything is 'prototyped', which to the rest of us looks like writing bad code and giving it to the modellers to play with. It isn't clear what he expects to come out of this exercise in many cases. The 'actual' implementation then suffers because of his insistence that good practice takes too much time from the prototyping. I haven't even begun to be able to untangle this twisted logic and I'm not sure I want to try.

The modellers are expected to tell us everything about the desired methodology in precise detail, and it's taken on absolute trust that what they come out with is theoretically flawless. This is hardly ever true, but no action is taken to rectify this situation. Nobody on the modelling side raises any concerns in a structured way that is likely to be acted upon, nor do they seek guidance in applying best practices. Nothing is done about their passivity either.

I've tried to push TDD in the team before, but found it difficult as it's new to me and while those with oversight of my work were willing to tolerate it, no enthusiasm has been forthcoming from anyone else. I can't justify the amount of time I spend wallowing and not finishing features, so the idea has - for the moment - been abandoned. I'm concerned it won't be picked up again, because nobody likes to be told how to do their job.

We now have a continuous integration server, but it's mostly only being used to run multiple-hour regression tests. It's been left open that it ought to be running full-coverage unit and integration tests as well, but at the moment nobody writes them.

Every time I raise the issue of quality with the lead dev, I get an answer to the effect of 'Testing feature A is straightforward, feature B is much more important to the user but too difficult to test, therefore we shouldn't test feature A'. Once again I've made no headway in trying to untangle this logic.

....phew. When I phrase it like that, it looks much worse than I thought. I suppose, as it turns out, this is a cry for help.


问:
VB.Net vs C# debate
I've been in workplaces where, at the start of a project, the "Should we use VB.Net or C#" question has been raised.

Granted, it's probably less common to have to make that decision now than it was in the early days of .Net, particularly given the trend towards language convergence, but it can still be a heated debate.

So, between VB.Net and C#, Which language do you prefer and why?

答:
I came to .NET from C and C++ (with a bit of Java, Ada and Pascal thrown in) so C# was the natural progression for me.

If a job came along that required VB.NET I certainly wouldn't turn it down.

Title: VB.Net vs C# debate


答:
These are good answers.
I can only add that "trying to communicate" is at best an iffy proposition.
Changes in the way an organization works do not come about quickly.
When it happens it's often like a tide, where momentum builds from below and from above.
So you'll be happier if you keep your expectations low and either wait for your chance to say how things will be done or look forward to working with another organization.</p>

Title: Why can't we get anything done?


答:
Have you identified someone at the company who "gets it" if so, latch on to this guy and learn as much as possible from him. If not, bide your time, start learning and growing on your own (join an Open Source project or start up your own project), and look for a place that can foster your growth.

The worst thing that can happen is you stay there and learn how to do things the wrong way. Yes, there should be some pragmatism taken, but a truly skilled team can do things the right way and still be on time with a quality product. It sounds like your current team does not have what it takes and you should start looking for a new one.

Title: Why can't we get anything done?


问:
Best practice regarding security in mobile applications
A friend asked me recently about mobile applications and the security surrounding them. As he wishes to make a mobile app that would handle very secure information such as credit card numbers, I was starting to wonder about the issue of security surrounding these devices. Does it seem reasonable to store sensitive information inside of a mobile app? I wonder this because I have seen dex to class to java decompilers online and I imagine that on any mobile device there is no guarentee that the data in the secure locations is as secure as they would like you to believe.

But, I'm not an expert on these things; I feel like I'm a stranger when it comes to the wonderful world of security. So that's why I ask you this, what is the best way to securely store the data? Is it feasible to securely store credit card information/passwords/etc on a mobile device? If so, what methods should one take in order to assure the users that the best possible measures were taken to securely store their information. If not, what is a good alternative to store all that sensitive information? Even then, with the stories in the news about user data stored in web sites being compromised what measures should be taken to ensure that the data stored there is also secure?

答:
Don't hardcode sensitive information in your app's code.  If you do, it will be trivial for someone to extract it through reverse engineering.  Never hardcode passwords, private keys, etc.

It is reasonable to store sensitive information like credit card numbers or most passwords on application-private storage.  For instance, on Android, use application-private storage.  Don't store it on the SD card; any other app with the SD card permission (i.e., almost all apps) could read it.

If you are storing a user's password to some existing web service (e.g., their Google password), look for authorization and authentication schemes that don't require you to ask for and store their password.  For instance, many Google services support OAuth, and you can use it to avoid asking for and storing the user's Google password (see also here).

If you are talking about storing highly-sensitive information, such as an online banking or Paypal password, I would think twice.  Those situations require special care, and you'll probably want to ask a separate question about them if you are in that situation.

If you ever transmit this information over a network, or if you store it to the cloud, make sure to encrypt properly.  I suggest using either SSL/TLS (for network communications) or the OpenPGP file format (for data at rest).  Keep in mind that many smartphone users are often connected via open Wifi, which is insecure and highly vulnerable to eavesdropping -- so encryption is especially important in the mobile setting.


问:
VPN or TLSv1 for securing a programs protocol from field device to mainframe
I am working on a product that requires devices to exists anywhere in the world hooked up to the internet though cell modems or on WLAN lines which communicates to a server(s) that exists elsewhere in the world.

When deigning the networking portion of the program i cant figure what the best option is for securing the communication between the server and end device.

From my searches iv'e come up with two options.

Option 1: Using a host to host vpn connection between the two devices.

Pros: VPN software seems to be well tested and does not require extra programming for the network protocol. The IT department is more comfortable with it because of using software that is already tested and they comfortable with vpn.

Cons: Since my end devices are linux on OMAP platforms cross compiling the vpn software if not already done could be tricky. Dealing with firewalls and routers behind the end devices network. Setup of the connection can be tricky.

Option 2: Implementing the TLSv1 protocol in my program to deal with the encryption.

Pros: Does not require extra software to be running on the device. Only relies on the encryption libraries as a dependency. Don't have to worry about dealing with nats and firewalls because the protocol will only require one tcp port to be open.

Cons: Extra coding to the network software. IT is skeptical because our program is responsible for securing the protocol.

FYI: For implementing the TLSv1 i would use http://www.gnu.org/software/gnutls/

答:
The primary tradeoff is in who has responsibility for ensuring security.

If you rely upon a VPN, then the responsibility is on the ops folks to ensure they have set up a VPN.  If they forget or misconfigure the VPN, then you will be silently insecure, but probably no one will notice, because the app will keep working.

If you embed end-to-end encryption into your application (e.g., using SSL/TLS), then security is automatic.  There is nothing to forget and less potential for configuration errors; you may be able to arrange for the security to be on by default, or at least for the software to refuse to start if it cannot negotiate a secure encrypted connection.  However, this approach probably requires more effort to code.

I would decide based upon how many installations of your system you plan to make.  If you will have only one installation, and your ops folks are willing to take on the extra burden of setting up and maintaining the VPN, and have set up appropriate processes/checklists to detect configuration errors, then the VPN approach will probably be simpler and cheaper, so that's what I'd use.  If you have many installations, then I would recommend implementing it in your software: you'll do it once, and it'll save everyone who installs the software from having to individually deal with the VPN; and the resulting security will be more reliable, because there is less risk of configuration errors.


答:
You can't realistically hope to protect data from someone who has physical possession of the device. There are APIs that can do that in principle, such as the keychain on iOS and the application private data on Android (or the keychain in recent versions), but these don't resist to jailbreaking. And even on Apple devices, with Apple's efforts to make jailbreaking difficult, a new hole is discovered regularly and most new devices are jailbroken in a matter of weeks.

Apart from people in physical possession (i.e. the user, his entourage and mobile phone thieves), the other party that you need to be careful of is other applications. Users typically install many special-purpose applications of dubious origin (there's basically no vetting on the Android market, not much on the Apple Store, and users can install applications from other places). Here, your best bet is to use the platform's recommended per-application storage, and tell users to keep their devices up-to-date. Unfortunately, that's often not feasible with Android. Using standard APIs has a double economic advantage: it'll be the OS maker who'll bear the brunt of the blame when a security hole is discovered, and you won't waste resources developing your own mechanism (which in all likelihood won't be more secure anyway).

The best way to keep data confidential is not to store it at all, and indeed not to handle it at all. If you can store all data such as credit cards on the server side, it's better; the server side can in principle be secured. Then the weakest link will be the user's password on your server, which he probably stores on the device, because typing a password each time you log on to a web site on a mobile phone is not a realistic user experience.

Note that if you're a merchant handling credit card data, you're supposed to comply with PCI DSS.

Some recommended reading on Security Stack Exchange:

Are the iPhone “connect the dots” passwords secure? (not much)

Android API/development security pitfalls

Encryption on mobile phone - myth? (always encrypt data in transit, typically with SSL/TLS)

Protect application from being modified (you can, to some extent, but it's hard)

Title: Best practice regarding security in mobile applications

Body:
A friend asked me recently about mobile applications and the security surrounding them. As he wishes to make a mobile app that would handle very secure information such as credit card numbers, I was starting to wonder about the issue of security surrounding these devices. Does it seem reasonable to store sensitive information inside of a mobile app? I wonder this because I have seen dex to class to java decompilers online and I imagine that on any mobile device there is no guarentee that the data in the secure locations is as secure as they would like you to believe.

But, I'm not an expert on these things; I feel like I'm a stranger when it comes to the wonderful world of security. So that's why I ask you this, what is the best way to securely store the data? Is it feasible to securely store credit card information/passwords/etc on a mobile device? If so, what methods should one take in order to assure the users that the best possible measures were taken to securely store their information. If not, what is a good alternative to store all that sensitive information? Even then, with the stories in the news about user data stored in web sites being compromised what measures should be taken to ensure that the data stored there is also secure?


答:
Time for a new job.  Forget implementing this.  It's time to move.  If they are willing to be so cavalier and deceitful with this, they won't be afraid to throw you under the bus either.

Additionally, don't be afraid once your gone to anonymously contact one of the many groups that point out security holes in peoples software.  This is a disaster waiting to happen.  There is absolutely no sound reason to store these. Did your boss give you a reason?  Do they want to login as the users?  Do they want to make it easier to retrieve passwords?  Unless you get an answer to one of these above that you can address more securely, then it's time to move on.  When you leave, it would be best to not tell them why.


问:
University teaches DOS-style C++, how to deal with it
I had been programming for many years but wanted a diploma to make myself more employable. Having already been through university once, I didn't choose a full 5 year computer science major but a shorter, more practically-oriented software engineering program.

I expected that it might focus more on concrete skills than on theory, but still had this idea that universities and professors like things to be correct, formal, academic. It's still science, right? Wrong - I was surprised by how sloppy many IT courses were.

In an introductory course on C++ we were tested on clichés like "why are globals bad" and "why are constants good", after just writing 1-2 programs. Random anecdotes without proper context. Handouts contained system(pause/cls), getch and headers like conio.h and iodos.h. One of the tasks was to print "ASCII characters" from 32 to 255, with a screenshot showing such a table printed using the Windows-1252 code page, but without mentioning encoding at all.

Question: when a university/professor seems to be using inferior and/or outdated tools and methods, and the content being taught is borderline incorrect, how do you deal with it constructively and respectfully, if at all?

Some answers point out that you should look beyond the programming since it is just a tool for learning about topics such as data structures and algorithms. I agree with this idea, but in this case there wasn't really any such plan behind the poor style. Most courses would simply teach another "tool" without much background theory or any "big picture". It often felt like they were quickly put together just for the sake of offering such a course.

I stuck with it and finally graduated. Quality remained pretty low throughout (with a few great exceptions), and several other students have been complaining about it. As expected I have learned much more from personal projects and part-time jobs than from school, however the process of finishing school and the label "software student" seem mysteriously useful in themselves!

答:
I think there may be some confusion about what and why you're studying.

It appears as though you are studying an introductory computer science program. This is aimed at people with minimal experience who are learning the basics on how computers work at a low level.

It also appears that you are a semi-serious or professional programmer. You have been programming for 10 years, and are comfortable in 3 languages. It sounds like you know what you're doing at least enough to work as part of a team.  Do you feel out of place in this course? Do the other students have a similar level of experience or skill as you do?

What are you intending to get out of this course?

Are you just after that 'piece of paper'?  If this is the case then don't stop trying to get a job while you study. Apply for jobs, tell them you're a competent programmer and you're studying because you need the piece of paper to get a job. If they hire you then consider dropping out - once you have a professional job then you really don't need that piece of paper anymore. Accept a lower than normal wage, because it's better to be paid to learn (on the job) than to pay to learn at school - and you'll learn faster, too. After a year or two you'll be mostly up to speed, and then you can ask for a decent pay raise or you can go find yourself a another job because you'll have experience.

Or are you trying to learn something? Then stop judging your professor. Like a memorable high school teacher used to say 'SIT DOWN, AND SHUT UP.' It's almost guaranteed that the professor has immeasurably more experience and knowledge than you do and you could learn an awful lot from him. If he's going too slow for you then try to get credit for these introductory courses based on your prior learning and experience.

But are you in the right course? You could also learn a lot from the literature professor, or a history professor... not particularly relevant. Perhaps you don't want 'computer science' but instead want more practical, 'real world' skills. Try 'software engineering'. Look at other institutions for a more focused course.

Just like when you start a new job, a class or course of study can be very hard to review from the outside. You seem to be in a course that isn't giving you what you expect. Reconsider your options.

OwnerDisplayName: gaidal