答:
Start Ups want the shiny. Whatever the shiny is: RoR, Groovy, Grails, OOP w/ PHP, Foobar, Wibble, Narf, etc.

Enterprise wants stable, reliable and scalable: Java and .NET fit that bill (when done correctly).

Current gig: Financial Services. Platform: ColdFusion (essentially a Java Tag Library) and Java.

Previous gigs:

Education Testing Services - ColdFusion

High Risk Insurance - ColdFusion and Java

401k - ColdFusion and Java

Travel - Java w/ internal ColdFusion apps

Securities - ColdFusion (pre-Java version)

These are all high-volume, high-security sites. No one at any of these companies ever considered PHP, some looked at RoR and saw too many issues. The 401k company had a sister company running a .NET application with competent developers, the app just kept crashing every week. They finally converted it to Java and gained stability.

The only people that look down on Java are those who have no or little actual experience with it or have been involved with poor implementations and are now gun shy. They see the shiny and figure if all the cool kids are using it, why not me?


问:
Languages to complement C++
I primarily work in C++.  My question is, for a C++ developer, what languages are beneficial to learn, from a job-profile point of view.  For example, I see a lot of work combining C++ and Php these days.  Conversely, I don't see a lot of work combining Ruby and C++ (unfortunately).

Of course, learning another language is beneficial regardless of whether it compliments a language.

答:
I think PHP compliments C++ nicely. In both cases, you're scraping the bottom of the barrel of languages, but PHP has so many annoyances that it makes C++ look like a diamond in comparison.

As far as languages that complement C++, I'm not sure.

ContentLicense: CC BY-SA 2.5

Title: Languages to complement C++

ContentLicense: CC BY-SA 3.0


问:
Why isn't Java used for modern web application development?
As a professional Java programmer, I've been trying to understand - why the hate toward Java for modern web applications?

I've noticed a trend that out of modern day web startups, a relatively small percentage of them appears to be using Java (compared to Java's overall popularity).  When I've asked a few about this, I've typically received a response like, "I hate Java with a passion."  But no one really seems to be able to give a definitive answer.

I've also heard this same web startup community refer negatively to Java developers - more or less implying that they are slow, not creative, old.

As a result, I've spent time working to pick up Ruby/Rails, basically to find out what I'm missing.  But I can't help thinking to myself, "I could do this much faster if I were using Java," primarily due to my relative experience levels.

But also because I haven't seen anything critical "missing" from Java, preventing me from building the same application.

Which brings me to my question(s):

Why is Java not being used in modern web applications?

Is it a weakness of the language?

Is it an unfair stereotype of Java because it's been around so long (it's been unfairly associated with its older technologies, and doesn't receive recognition for its "modern" capabilities)?

Is the negative stereotype of Java developers too strong? (Java is just no longer "cool")

Are applications written in other languages really faster to build, easier to maintain, and do they perform better?

Is Java only used by big companies who are too slow to adapt to a new language?

答:
Java has been positioned in the recent years to be "enterprise". Which is on the other side of the spectrum of what a startup needs. In web application development you need 4 things - painless database access, great string manipulation, syntax sugar and rapid iterative process to make the numerous little changes your app requires.

Performance,scalability and stability are a bit lower on the priority list.

Also Java is very unfun language to code in. It got the revolutionary ability to use string in a switch statement just yesterday. And javascript is very hackerish language so after developing your frontend you feel very constraint when you return to java.

So I suppose these are the reasons webstartups avoid java.


问:
What's the difference between an API and an SDK?
I was looking through various APIs and SDKs, when I realized that I couldn't really tell the difference between something called an API and something called an SDK.

Both of them are, conceptually, a way for your program to interface with and control the resources provided by another piece of software, whether that other software is a web service, an end-user app, an OS service or daemon, or a kernel device driver.

So, what is the semantic difference between an SDK and an API?

答:
I would like to compare this way.

If you are a Developer using Microsoft Tools:

API = Microsoft.Net Framework Vs SDK = Visual Studio

If you are a Developer using Java:

API = Java RunTime Vs SDK = Any tool that would provide the Development Kit (JDK)

I guess an SDK would necessarily have to rely on a corresponding API - there is no SDK without an API.


答: Depends how you define "modern web application development".  If you are talking startup, fast turnaround websites, you will need to consider languages and frameworks designed for that purpose.  If you are looking for stable, scalable, enterprise level web development, you look for languages and frameworks that support those ideals.  In my book, those are two very different goals.  RoR, Groovy, etc., are good for the first and Java is more appropriate, in general, for the latter.</p>

Title: Why isn't Java used for modern web application development?

Body:
As a professional Java programmer, I've been trying to understand - why the hate toward Java for modern web applications?

I've noticed a trend that out of modern day web startups, a relatively small percentage of them appears to be using Java (compared to Java's overall popularity).  When I've asked a few about this, I've typically received a response like, "I hate Java with a passion."  But no one really seems to be able to give a definitive answer.

I've also heard this same web startup community refer negatively to Java developers - more or less implying that they are slow, not creative, old.

As a result, I've spent time working to pick up Ruby/Rails, basically to find out what I'm missing.  But I can't help thinking to myself, "I could do this much faster if I were using Java," primarily due to my relative experience levels.

But also because I haven't seen anything critical "missing" from Java, preventing me from building the same application.

Which brings me to my question(s):

Why is Java not being used in modern web applications?

Is it a weakness of the language?

Is it an unfair stereotype of Java because it's been around so long (it's been unfairly associated with its older technologies, and doesn't receive recognition for its "modern" capabilities)?

Is the negative stereotype of Java developers too strong? (Java is just no longer "cool")

Are applications written in other languages really faster to build, easier to maintain, and do they perform better?

Is Java only used by big companies who are too slow to adapt to a new language?


问:
Is there a minimum team size required to see a benefit from Agile?
I work at a company that has repeatedly cut the sizes of its development team, to the point that previous 10-man teams are now down to one developer per product (and a couple of testers shared between 5 products).  We used to be fairly process heavy, having been a spin off from a larger company, and inherited its multi-stage waterfall process.

It has come down from the executive team that we are not releasing software fast enough, and that this is likely the fault of the process (which may be a contributor, although the 90% loss of manpower probably didn't help).  There has been a push for us to move to an Agile process to avoid spending time writing design documents, etc.

I guess I'm just curious as to whether a switch to Agile will help with single-person teams.  It was my understanding that a lot of the benefits come from higher visibility and more communication between team members, but I know what I'm doing and so does my manager.  I already do TDD since we have no one to test the product anyway.

TL;DR version: I guess what I'm really asking is, can you implement Agile with single-person 'teams', and do you see any benefits from it, or is it usually something that's more effective for larger teams?

答: If you want to limit documentation, I'd focus on that if this is holding you back. Documenation is just a piece of agile and it doesn't sound like there is anyone at your firm that is going to know how to implement it. This could delay your code release in the short-term because of training, buy-in, adjusting, etc. The powers that be will just toss it out and look for the next great panacea for production delays after a 90% layoff. </p>


答:
To add just a bit to what's already been said, I think a lot of it has to do with how fast you can go from nothing (literally) to a functional web application.

If all you have today is an idea, going from where you are now to writing your web application is almost as easy as falling down, whether you choose a hosting provider or your own infrastructure (like an EC2 image).  Choosing Java, in my experience, is usually more work, and often costs more too.

Additionally, if you go with Linux and PHP/Python/Ruby, the tools and the platform are complimentary and designed to support each other.  With Java, sometimes it seems the two worlds (OS and Java) sometimes don't seem to be working in harmony with each other.


答:
Your main problem is not "going agile", but documentation. This article on Agile/Lean documentation by Scott Ambler would probably be an interesting read for you and your coworkers.

Agile is not about not documenting. You still document, it's just that you choose what and how you are going to document in order to maximize value while minimizing the time spent on creating it. You still capture requirements, carry out design, document your implementation decisions, and have full tracability throughout the lifecycle as needed, but only to the extent that the project needs. Not capturing key project information and decisions is a sure way to have a project fail.

For a fun little bonus, here's my take on agile for individuals:

The agile methodologies are designed for teams. Scrum usually needs around 3-9 developers along with a Product Owner and Scrum Master (and the Product Owner and Scrum Master should not be the same person). Extreme Programming often calls for 4-7 people.

The reason is that a number of commonly used practices in the mainstream agile methodologies don't scale down to a single developer. A prime example of this is the emphasis on pair programming and code reviews in XP - you really can't do this with a solo developer.

A single developer can be agile, but it will have to be a tailored process. Most agile methods call for some combination of continuous integration, unit testing, test-driven development, refactoring, KISS and YAGNI principles, and so on. Many of these have become "best practices", even on more plan-driven methodologies. There's no reason why a solo developer can't take advantage of some of them, as long as they don't interfere with producing and delivering software.

Title: Is there a minimum team size required to see a benefit from Agile?

Body:
I work at a company that has repeatedly cut the sizes of its development team, to the point that previous 10-man teams are now down to one developer per product (and a couple of testers shared between 5 products).  We used to be fairly process heavy, having been a spin off from a larger company, and inherited its multi-stage waterfall process.

It has come down from the executive team that we are not releasing software fast enough, and that this is likely the fault of the process (which may be a contributor, although the 90% loss of manpower probably didn't help).  There has been a push for us to move to an Agile process to avoid spending time writing design documents, etc.

I guess I'm just curious as to whether a switch to Agile will help with single-person teams.  It was my understanding that a lot of the benefits come from higher visibility and more communication between team members, but I know what I'm doing and so does my manager.  I already do TDD since we have no one to test the product anyway.

TL;DR version: I guess what I'm really asking is, can you implement Agile with single-person 'teams', and do you see any benefits from it, or is it usually something that's more effective for larger teams?


答:
Check out https://groups.google.com/forum/#!forum/solo-scrum

and https://stackoverflow.com/questions/829497/agile-methods-specifically-taylored-to-working-solo

Update:

The first link is to the Solo Scrum Google Group.  The most obvious benefit talked about here is using time-boxed sprints to manage scope and determine project velocity--both very good things.

The second link is to a previous discussion on Stackoverflow, which might indicate this is a duplicate question, but I thought it would be more useful to link to it.  It in turn links to http://c2.com/xp/ExtremeProgrammingForOne.html which has a lot of links and info about doing XP solo (sans pair programming).

ContentLicense: CC BY-SA 4.0


问:
Why does the Lisp community prefer to accumulate all the parentheses at the end of the function?
Why does the Lisp community prefer to accumulate all the parentheses at the end of the function:

```<code>(defn defer-expensive [cheap expensive]
  (if-let [good-enough (force cheap)]
    good-enough
    (force expensive)))
</code>```

Why not employ a convention like C or Java?

Well ok, Lisp is much more older than those languages, but I'm talking about the contemporary Lispers.

```<code>(defn defer-expensive [cheap expensive]
  (if-let [good-enough (force cheap)]
    good-enough
    (force expensive)
  )
)
</code>```

Note: Code snippet is from the book "The Joy of Clojure".

答: The code is much more compact then. Movement in the editor is by s-expressions anyway, so you don't need that space for editing. Code is read mostly by structure and sentences - not by following delimiters.</p>


问:
Wrapping my mind around prefix notation?
I'm reading about LISP.

I understand how prefix notation works at a certain level, but I was wondering if there are any tricks to making it intuitive.

答:
Many languages use a mix of prefix, infix and even postfix.

Lisp just uses only prefix - by default. If sin(x) is intuitive from mathematics, then (sin x) is not far away. If move(dog,home) is a traditional procedure call, then in Lisp it is just (move dog home).

Lisp does not make any exception for mathematics and treats +, -, * and others like ordinary function calls.


问:
Should I be wary of signing a non-disclosure agreement with someone I just met?
1/22/12 update in case you were puzzled as to why I haven't accepted an answer: Pretty much all of the answers make the obvious point that working for him would have been silly, but none of them seemed to answer the question.

tl;dr: Some guy I just met says he wants me to join his company. Before he shows me what they do, he wants me to sign a non-disclosure agreement. Is this weird?

I'm traveling right now. Someone who saw me coding seemed to think I was smart or something and started talking with me. He explained that he owns a software company, told me a bit about what it does and told me that he was looking for a programmer who would work for a stake in the company. He explained that the company's product is being developed rather secretly, so he couldn't tell me much. But he did tell enough about the product to convince me that he's not completely making this up, which is a decent baseline.

He suggested that he show me more of what he's been working on and, after seeing that, I decide whether I want to join. Because of the secrecy behind the product, he wants me to sign a non-disclosure agreement before we talk.

I'm obviously somewhat skeptical because of the random nature by which we met.

In the short term, I'm wondering if I should be wary of signing such an agreement. He said it would be easier to show me the product in person rather than over the internet, and I'm leaving town tomorrow, so I'd have to figure this out by tomorrow. If I decide to talk with him, I could decide later whether I trust that it's worth spending any time on this company.

The concept of being able to avoid telling a secret seems strange to me for the same reason that things like certain aspects of copyright seem strange. Should I be wary of signing a non-disclosure agreement? Is this common practice?

I don't know the details of the agreement of which he was thinking, (If I end up meeting with him, I'll of course read over the agreement before I decide whether to sign it.) so I could consider alternatives according to the aspects of the agreement. Or I could just consider the case of an especially harsh agreement.

This question seems vaguely related.
Do we need a non-disclosure agreement (NDA)?

Thanks

答:
You should exercise extreme caution.  There are several red flags already:

Sign an NDA before you even have the vaguest hint what an idea is.  As someone else pointed out, ideas are a dime a dozen.  The concept of an application isn't what an NDA is meant to cover, and anyone who thinks it is typically has a harebrained idea in the first place that would be easy for somebody else to take and run with.

"Stake in the company" is only worth as much as the income they generate, and at this point it sounds like that's $0.  Never work for equity unless you are a close friend/family member of the person offering equity, and even then it's a red flag.  If the idea was really as amazing as it's made out to be, there should be a "war chest" either from the founders' own money or from VC backers to make some kind of salary package, even if it's lower than the norm.  In short, salary + equity = okay depending on circumstances.  Equity only when you're just "some guy" to the founder = Run away as fast as you can.


答: Lots of agile practices pay off for teams > 0. Source control and frictionless development, for example, and such will always pay off no matter how small the team is.</p>


答: I think it is used alot more than you'd think -- the use is just below the waterline. There are many, many ruby on rails wrappers around thick, fancy java services. Especially when you start dealing with anything approaching big data . . .</p>


答:
Coming from a one man team (though hopefully not for long).

I strive to acheive Agile for myself in a sense that I intend for their to be more developers than just myself for future projects.  I write up a high level WBS, I create user stories, tasks under user stories, test cases, and keep good track of projects in a way that my manager can look at and understand.  It can be a little cumbersome because I "just know" in my head where I am at but I take the time to do it anyway purely to stay diligent for the mythical future team that has been promised to me but hasn't occurred yet.  I would like to think that I am trailblazing good processes for the people who will come after me.

Documentation I do in small amounts and that is mostly flow diagrams and use case diagrams but generally nothing low level unless there is something really complicated or important about it that I don't want to forget.  I also do deployment diagrams for the benefit of future people when they have to throw up a new environment for "training" or the like.

I am teaching myself TDD slowly but I haven't perfected it yet, it is an extremely tough to do in the pure sense for legacy applications without refactoring large and risky swaths of functionality.  Complicated new functionality I still struggle with but I still aim for 100% coverage which is the end game of TDD after all.  I may not take the best path to get there though.

It can definitely be done, but out of necessity mostly.


答:
In a recent interview with, Joseph Snarr, a technical lead for google plus explained how the application uses Java Servlets for the back end and JavaScript on the front end.

So to answer your question Java is still used for very modern web development. Just not for the start-ups that have been getting so much press recently.

I think the reason that a lot of the start-ups are using other technologies is because theyre sexier and have a more publicized an open source push behind them.


问:
Naming conventions and organization of packages
I've been programming in Java, C#, Python and AS3 most of the time and in all of these languages there are packages (or something like that). The problem I found is with the naming convention, or even with the organization of the packages. I need someone to tell me WHY is this:

com.company.app.type.Object or org.authorname.project.type.Object

better than this:

app.feature.Object or app.module.Object

Another example:

Why this:

```<code>com
 +--company
     +--app
         +--events
         |   |--FeatureOneEventA
         |   |--FeatureOneEventB
         |   |--FeatureOneEventC
         |   |--FeatureTwoEventA
         |   |--FeatureTwoEventB
         |
         +--models
         |   |--FeatureOne
         |   |--FeatureTwo
         |
         +--services
             |--FeatureOneServiceA
             |--FeatureTwoServiceA
             |--FeatureTwoServiceB
</code>```

Is "better" than this:

```<code> company
  +--app
      +--feature
          +--one
          |   |--Model
          |   |
          |   +--events
          |   |   |--EventA
          |   |   |--EventB
          |   |   |--EventC
          |   |
          |   +--services
          |       |--ServiceA
          |
          +--two
              |--Model
              |
              +--events
              |   |--EventA
              |   |--EventB
              |
              +--services
                  |--ServiceA
                  |--ServiceB
</code>```

In the first one you have all organized by "types of objects", but the "features" are all mixed, but in the second one, the organization is by "feature" and each one has their own objects; so, you can see one feature well separated from another.

So, can anyone tell me why a lot of companies and programmers prefer the first?

答:
The reason to have your reverse domain name as the beginning of a package name is to reduce the possibility of naming conflicts. This is especially important if you are writing a library or a framework. So that explains why "com" and "org" are in there.

Other then that, everyone is different and chooses their package structure differently. One reason option 1 might be better is if there is no real destinction between features or they have a lot of code that crosses over. With that, option 2 might make more sense if features really are mutually exclusive in some manner.

Also, I bet option 1 is generally the way most projects start, and then nobody ever changes it (or cares to) after. I wouldn't be surprised if a lot of companys don't put a lot of thought into their package structure anyway.


答: Well the first is by pure convention. In the Java spec, packages are recommended to be named as the reverse of your company's domain name since that would ensure uniqueness. That's the reason Java packages are named that way.  C++ and C#, and therefore .NET, follow the namespace convention which has been around for years. I don't think any of these ways are inherently better than any other way, that is just the way the languages evolved.</p>

Title: Naming conventions and organization of packages

Body:
I've been programming in Java, C#, Python and AS3 most of the time and in all of these languages there are packages (or something like that). The problem I found is with the naming convention, or even with the organization of the packages. I need someone to tell me WHY is this:

com.company.app.type.Object or org.authorname.project.type.Object

better than this:

app.feature.Object or app.module.Object

Another example:

Why this:

```<code>com
 +--company
     +--app
         +--events
         |   |--FeatureOneEventA
         |   |--FeatureOneEventB
         |   |--FeatureOneEventC
         |   |--FeatureTwoEventA
         |   |--FeatureTwoEventB
         |
         +--models
         |   |--FeatureOne
         |   |--FeatureTwo
         |
         +--services
             |--FeatureOneServiceA
             |--FeatureTwoServiceA
             |--FeatureTwoServiceB
</code>```

Is "better" than this:

```<code> company
  +--app
      +--feature
          +--one
          |   |--Model
          |   |
          |   +--events
          |   |   |--EventA
          |   |   |--EventB
          |   |   |--EventC
          |   |
          |   +--services
          |       |--ServiceA
          |
          +--two
              |--Model
              |
              +--events
              |   |--EventA
              |   |--EventB
              |
              +--services
                  |--ServiceA
                  |--ServiceB
</code>```

In the first one you have all organized by "types of objects", but the "features" are all mixed, but in the second one, the organization is by "feature" and each one has their own objects; so, you can see one feature well separated from another.

So, can anyone tell me why a lot of companies and programmers prefer the first?


问:
Am I Over-Engineering If I Consider User's Intentional Wrongdoing?
Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code?

To clarify, I'm exposing a simple JSON RESTful service like this:

```<code>GET /items - to retrieve list of user's items
PUT /items/id - to modify an item
POST /items - to add a new item
</code>```

The service itself is not meant to be used trough a browser, but only from third party applications, controlled by the user (like phone apps, desktop app, etc.). Also, the service itself should be stateless (i.e. session-less).

The authentication is done with Basic Authentication over SSL.

I'm talking about one possible "harmful" behavior like this:

The user enters the GET url in a browser (no reason but...).
The browser asks for Basic Auth, process it, and stores the auth for the current browsing session.
Without closing the browser, the user visits malicious web site, which has a malicious CSRF/XSRF javascript which makes a POST to our service.

The above scenario is highly unlikely, and I know that from a business perspective I should not worry too much. But for the sake of improving the situation, do you think that if the username/password are required in the JSON POST data as well, will help?

Or should I drop Basic Auth altogether, get rid of the GET, and use only POST/PUT with authorization information in them? As the information retrieved trough GET can be also sensitive.

On the other side, does using custom headers considered pure REST implementation? I can drop the Basic Auth, and use custom headers. That way, at least CSRF attack from a browser can be avoided, and the applications which use the service will set the username/password in custom heather. Bad for this approach is, that now the service can not be consumed from a browser.

答:
If the code is established and maintained, edge cases should be looked at and dealt with on a case-by-case basis.

FIXING DUE TO SOME ERRORS ON MY PART:

GET should still be used as part of a proper RESTful service, the authentication needs to still be there in any case.  What I was trying to surmise was that for security purposes GET is much the same as POST but post does its work without putting the information in an address bar, which tends to be the big security difference (and why I dislike GET), but as posted by @Lee,

```<code>GET requests are used to retrieve resources, and PUT/POST are used to add/update
resources so it would be completely against expectations for a RESTful API to use
PUT/POST to get data.
</code>```

Since this will be used by third-party applications one should follow good practices for a RESTful service so that the end implementer won't be confused on this part.

Body:
If the code is established and maintained, edge cases should be looked at and dealt with on a case-by-case basis.

FIXING DUE TO SOME ERRORS ON MY PART:

GET should still be used as part of a proper RESTful service, the authentication needs to still be there in any case.  What I was trying to surmise was that for security purposes GET is much the same as POST but post does its work without putting the information in an address bar, which tends to be the big security difference (and why I dislike GET), but as posted by @Lee,

GET requests are used to retrieve resources, and PUT/POST are used to add/update
resources so it would be completely against expectations for a RESTful API to use
PUT/POST to get data.

Since this will be used by third-party applications one should follow good practices for a RESTful service so that the end implementer won't be confused on this part.


答:
Never trust anything. Every request is an attack. Every user is a hacker. If you develop with this mindset, your application will be much more secure, stable, and less likely to be hijacked by a malicious user. All it takes is one clever person to find a way around your security for you to be in serious trouble with your data (one of your most valuable resources).

If you've identified a security hole in your application, do everything you think you need to do to plug the gap. Your API, especially, should be the most untrusting piece of software in existence. I would require the credentials and go with Post requests.

Title: Am I Over-Engineering If I Consider User's Intentional Wrongdoing?

Body:
Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code?

To clarify, I'm exposing a simple JSON RESTful service like this:

```<code>GET /items - to retrieve list of user's items
PUT /items/id - to modify an item
POST /items - to add a new item
</code>```

The service itself is not meant to be used trough a browser, but only from third party applications, controlled by the user (like phone apps, desktop app, etc.). Also, the service itself should be stateless (i.e. session-less).

The authentication is done with Basic Authentication over SSL.

I'm talking about one possible "harmful" behavior like this:

The user enters the GET url in a browser (no reason but...).
The browser asks for Basic Auth, process it, and stores the auth for the current browsing session.
Without closing the browser, the user visits malicious web site, which has a malicious CSRF/XSRF javascript which makes a POST to our service.

The above scenario is highly unlikely, and I know that from a business perspective I should not worry too much. But for the sake of improving the situation, do you think that if the username/password are required in the JSON POST data as well, will help?

Or should I drop Basic Auth altogether, get rid of the GET, and use only POST/PUT with authorization information in them? As the information retrieved trough GET can be also sensitive.

On the other side, does using custom headers considered pure REST implementation? I can drop the Basic Auth, and use custom headers. That way, at least CSRF attack from a browser can be avoided, and the applications which use the service will set the username/password in custom heather. Bad for this approach is, that now the service can not be consumed from a browser.


问:
Examples of permission-based authorization systems in .NET?
I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (preferably with code samples) and perhaps a list of pros/cons for each method.

I've seen examples using simple dictionaries, custom attributes, claims-based authorization, and custom frameworks, but I can't find a simple explanation of when to use one over another and what the pros/cons are to using each method. (I'm sure there's other ways than the ones I've listed...)

I have never done anything complex with permissions/authorization before, so all of this seems a little overwhelming to me, and I'm having trouble figuring out what what is useful information that I can use and what isn't.

What I DO know is that this is for a Windows environment using C#/WPF and WCF services. Some permission checks are done on the WCF service and some on the client. Some are business rules, some are authorization checks, and others are UI-related (such as what forms a user can see). They can be very generic like boolean or numeric values, or they can be more complex such as a range of values or a list of database items to be checked/unchecked.

Permissions can be set on the group-level, user-level, branch-level, or a custom level, so I do not want to use role-based authorization. Users can be in multiple groups, and users with the appropriate authorization are in charge of creating/maintaining these groups. It is not uncommon for new groups to be created, so they can't be hard-coded.

答: We had UI-level authorization implemented at the control level. We had the authorization control level details for each view stored in the database. During run time the base class was doing the heavy lifting in deciding which user could see/ use which control on the rendered form. We had a constraint of not using any third-party library...</p>


答:
one

the minimum team size is one

Agile is a collection of principles and practices, which you choose to tailor the work-flow. If you're a one-man show, you choose what works for you.

XP/TDD works beautifully for one-man teams. And you get to skip the potentially time-wasting practices of daily stand-up meetings and pair programming.


问:
How do I deal with a slow and undedicated colleague in the team?
I have been working on a new project. The project works like this: The end user can access a webapp using a link and he can add multiple systems on his network and manage that particular systems details. My part involves the front end and the webserver, which is done in python. My python actually communicates with another project which is entirely done in c & c++. The c/c++ project is the main app which does all the functionality. My python sends the user request to it and displays the response from it to the user.

I am very familiar with my work and I will finish it soon. Since that's not much work in it. And I am a person who loves to work. I spends most of the time in office and only go home when I feel sleepy.

The c/c++ app is managed by another colleague who has 5+ year experience and can do things much faster than me, but he never does it. May be he doesn't like to do it. His app crashes often when my python communicate with it or returns wrong values. It's full of bugs. Since my app depends on it, I am having a hard time building it. Instead of fixing the bugs, he asks me to slow down my work. He asks me to tell manager that my work needs a lot of time. He is asking me to fool the manager and even forcing me to work slowly like him.

During project meeting, when manager asks him about the bugs he says that he fixed everything and it works fine. Since he is my colleague, I couldn't tell anything to the manager. I obviously need to have a good relationship with my colleagues more than my manager, since most of the time we will be with our colleagues, not with the manager.

I am not able to tell the manager anything regarding this, since if manager asks him why, then he may think I complained about him to the manager. And he keeps on lying in the meeting. And since he fixes the bug slowly, it even slows down my work. Now I thought of working on the front-end part of my app  and finishing it off so that in the mean time he can make his project stable. Now he is asking me to tell the manager that my front end part require a lot of work and I may need more and more time, simply so that he can drag the project down. And the sad thing is our actual manager has gone to the US, so we have a temporary manager and this guy doesn't know about the project much, so the c,c++ just fools him.

Can anyone suggest me how I deal with this?
I wanted to finish off the project soon. How can I make him work even by maintaining a good relationship with him?

Responses to comments:

If he's really deliberately misleading the company, you should report him to management.

I am new to this company and the other guy has been there for many years. And I have just started knowing my colleagues. If I directly go and complaint him, I don't think so I can make good relationship with my other colleagues. Even he has the power to mislead them. I am not telling he is a bad guy, he can do the work, but he is not doing it.

Doesn't your company have any kind of bug tracking system ?

Here actual bug tracking system isn't there. The company tries to finish off the project as soon as possible and gives it to the QA. And then fixes the bugs reported by QA.

This is why companies should give employees stock / options or some sort of ownership. That way you can literally tell the guy "You are costing me monetary growth... don't you want to make money also?".

The company has the stock options they have given me a 2500 share, mostly he too would have got some more.

Seniority does deserve some benefit of a doubt. You really need to speak to him first and try to understand the problem. He may be out of his depth, you may be able to help him, there could easily be variables you are unaware of. It may be hard now, but you could easily make the situation a lot worse by jumping the gun.

I even does it, first his app wasn't handling multiple requests at a time, he was using a queue to handle the requests I sent to him. I even suggested to him some of my ideas on it. He said he already had these ideas, and will be executing them. His explanations was: "Everything require certain time to do and this is a project which may need two years to complete and we are asked to finish it in two months". I used to have a hard time coding during first few weeks because of this bug. But now he fixed it. But he is using a single queue for a user requests and that is now slowing down the app, since it processes one request at a time.

What is QA doing this whole time? Why aren't they reporting/confirming the status of the project(s)?

The manager is the person who decides when to give to the QA. As of now it has not yet given to QA. He said we should give it by this month end.

答:
Ask for some else to help you both in integration testing. The person shall be able to say where the issue occurs. As temptar pointed out i wonder why there is not even an excel to track the issues! since there is no tracking, its like every time th other guy is escaping in saying everything is fine as of now! it doesnt work out that way! </p>

<p>Its your module if you need to get it done you need to raise the Red flag on whats causing the delay on ur side. Experience in MERE Years has nothing to do, its just the knowledge and thats what your manager should be insisting on. As said even i feel there is a poor management of project happening here. </p>

Body:
Ask for some else to help you both in integration testing. The person shall be able to say where the issue occurs. As temptar pointed out i wonder why there is not even an excel to track the issues! since there is no tracking, its like every time th other guy is escaping in saying everything is fine as of now! it doesnt work out that way!

Its your module if you need to get it done you need to raise the Red flag on whats causing the delay on ur side. Experience in MERE Years has nothing to do, its just the knowledge and thats what your manager should be insisting on. As said even i feel there is a poor management of project happening here.


问:
Using grammars to extract bibliographic citations
My task lays in the area of text mining / labelling, more particular extraction of bibliographic citations (references) from the plain text, as shown here:

Basically, for the input text the algorithm should recognize:

The beginning and end of citation

Journal name, title, author, issue, volume, pages

This task was already approached in e.g. Citation Parsing Using Maximum Entropy and Repairs (Ng Yong Kiat, 2005), which demonstrated that CRF models deal better then MEMM or pattern-based approaches. Currently there are two projects, that do the job:

ParsCit, a Perl program build on the top of CRF++ project

Grobid – Java module, also based on CRF++

While the results of mentioned approaches are already known (and are very good), I was given a task to do the same but using the context-free grammars. Indeed, the information looks to be very structured but I am not sure if this approach can outperform CRF on sensitivity, at least I hope it can beat it on accuracy.

My idea is the following:

Define the fixed grammar rules for already known types:

YEAR → (19|20)\d\d | \d\d\d\d

PAGE → \d{1,3}\-\d{1,3} | e\d{1,3}

ISSUE → \d{1,3}

It is possible to infer from training set the probabilities of rule alternatives e.g.:

PAGE → \d{1,3}\-\d{1,3} with P=0.8 | e\d{1,3} with P=0.2

From the pre-annotated training set generate the high-level rules (all chars between non-terminals are terminals):

CITATION → AUTHORS, JOURNALTITLE, ISSUE, PAGES, YEAR | AUTHORS, BOOKTITLE, VOLUME, CHAPTER, CHAPTERTITLE, EDITORS, PUBLISHER, PUBPLACE | ...

CITATIONS → CITATION | CITATIONS; CITATION | CITATIONS; and CITATION

The problematic places are:

AUTHORS: There is no fixed rule for them, but one can write a function, that can score that the given text looks like an author. Also the list of possible (English) surnames is not so huge, but if I create the thousands of rules it will slow down the grammar parser. Let's say for authors we have some scoring function, that for given input returns a number [0 .. 1] reflecting how the input really looks like an author. The grammar parser should feed all possible variants for AUTHORS and stop on one with a best score.

JOURNALTITLE: The same story. There is obviously no general rule to define it. There is a list of all journals, but then comes also the subproblem of abbreviation: Ann. NY Acad. Sci. = Ann N.Y. Academy Sci = Annals of the New York Academy of Science. Again, we can define a scoring function for that; in worst case the function can measure the distance between input sting and all known journal titles using Damerau–Levenshtein algorithm.

The text like "Vol", "Chapter", "edited by" can be very useful as terminators prefixing the corresponding values (and thus reducing the ambiguity of the grammar), but can they be identified and learned automatically?

The same for terminators before and after citation, which can be very useful (perhaps will speedup the parsing):

SUPERCITATION → ( CITATIONS ) | ( see, e.g., CITATION ) | see, for example,  CITATION | described in, e.g., CITATION | is disclosed by CITATION

Does it make sense to "hardcode" them or try to learn them?

The "noise" text between citations: how to deal with it?

The goal of the lexical analysis is perhaps not to find the most probable parse tree, but also to maximise AUTHORS and JOURNALTITLE functions.

Can somebody advise me:

If SCFG is the right way to approach the problem? If yes, how is it possible to adapt this approach to create a parse tree based on probabilities and also on scoring functions?

Are there any other relative works / articles?

Are there any libraries that can help in chunking the text (written in a way that can be applied also for e.g. Chinese text)? I have found some monsters like UIMA, Mallet, MinorThird... I wonder about your personal experience when using them for the task like above.

Thank in advance for any reply.

答: One of the starting points you should look at is Proper Noun recognition and Tokenization. One of the well known papers is this one, and also a lot of new submissions into ACM have dealt with this problem. This will help with in-line citations.</p>


答:
My team and I are currently developing a greenfield web application in Java 6 + Stripes.  Within the last year I also worked on another greenfield web application using Java 6 + Stapler (a somewhat unknown web framework developed by Kohsuke Kawaguchi of Hudson/Jenkins fame).

Java is absolutely used for modern web development.  Certainly it doesn't have the "sexy" appeal of Ruby or other dynamic languages, but I'm far from convinced that dynamic languages are a good thing once a project starts to scale.

Modern Java app servers are very competitive with ASP.NET in terms of performance, and both are orders of magnitude faster than any dynamic language VM I know of.

Don't get me wrong... I'm not saying Java is always the best choice (not remotely!) -- but neither is it always a wrong or "outdated" choice.


答:
This really depends on whether there's buy-in from the business side, or just a new thing for management to blame on development (which kind of sounds like the situation, based on the 90% reduction in team sizes). The higher visibility and more communication between team members doesn't just mean between developers. It's important for the business side to see where your time goes, and be setting the correct priorities.

We've seen a huge increase in trust between the business and IT sides of our company, because each team now has a Product Owner that takes part in the daily stand-ups, and they see where our time goes, and they're the ones making the decisions about what we work on next. Instead of the managers getting constantly bombarded with requests, and then development getting blamed when things slip through the cracks or there's not enough time in the day to get everything done, it's now the Product Owners who are responsible for setting the priorities, and making the decisions about what gets included in a sprint.

So, if there's a commitment from Product Owners who are going to be involved in the process, then yes, the Agile process can be very effective even for a team of one. But if this is just another way to make the developers into scapegoats, then Agile will fail for everyone.


答:
The frameworks for doing Java web development have quite a bit of learning curve, they're often overkill for what you need, and much of the indirection required to make things work is just...painful...to work with.

I used to work for a company that did Spring/Java development, and I found the framework cumbersome at best. I don't have a lot of pleasant things to say about Spring's framework, except I had a friend who used to do Struts development and he thought Struts was even worse. The web-framework is nothing like doing desktop applications or mobile (eg: android) applications, and has a lot of very abstract ideas that take some time to really grasp (though, certainly, that gives you a lot of power and capability if you're a pro and doing something really complex like an enterprise grade app). I love programming java for mobile or desktop devices, but java for web-apps? Not so much.

I haven't done any programming personally in Ruby/Rails, but my friend who used to do Struts is now doing Ruby web programming and testifies that things that are difficult to do in Java web programming require a lot less code and complexity to achieve in Ruby. There's certainly a learning curve to the different syntax and language rules, but for prototyping apps, it has an advantages in terms of how much code is required to achieve a desired result. As others have mentioned, scalability is an issue to consider as well, and one of the reasons more mature apps are not seen as frequently in more hip languages.


问:
Should CMS be coupled with presentation?
There seems to be a growing trend for CMS systems to manage not only data capture and workflow, but to be an end-to-end product that manages presentation and end user content (like comments/forums). I thought it was a pretty ridiculous, but it seems like this approach is gaining more and more traction. It seems to me that the two concepts should be completely orthogonal. The CMS needs to either publish content to database or XML repo or expose an API (RESTful or otherwise) and remain agnostic to presentation. I'm sure there are some efficiencies in coupling, but at the expense of lock-in and inflexibility.

I guess my question is, should I go with the flow or is this something I should keep fighting against?

答:
My question to you is what constitutes a website?  If some company wants to have forums accessible off their main site, should this be in a separate system or should it be in the same system as the code that makes the web pages?  As for comments, this is much more likely to be coupled on some level along with various desired analytic data that may be desired such as if there are consistencies in the comments or user feedback given on the site.

Do you know of companies using a CMS in this way?  Would you consider Word-press to be a CMS?  I'd argue that you should be aware of why something may work and why it wouldn't work so that you can make a good argument either way.  I'd imagine small companies may not want to implement 2 systems if there is one that can do both would be an example of why it may be good for a CMS to do both though larger companies may want to do things differently.


问:
source code check in / validation best practices
I am looking for best practices that big organizations follow for code check-in and validations.

Currently we follow these steps,
- Developer writes code
- Developer do some initial tests
- Code is awaiting validation now
- Technical lead reviews the code (possible bugs, see if coding convention is followed etc)
- Once approved by technical lead, the code goes in QA state
- Once QA approves the code is checked in into the trunk.

We are now moving to a new project and I was looking for some best practices that would ease the process. We have custom made software that maintains the code status.

Thanks,
Ali

答:
It seems like bad practice to me that there are no check-ins until the code is production ready. I would have a production branch and only cut over to it when the code has gone through all of those steps. my version of your process would be something like this:

Developer writes code, checks it in.

Does initial testing, checks in fixes

Code gets reviewed, suggested changes (if any) are checked in.

Reviewed by QA, any changes/fixes here are checked in.

Code is cut over to the main branch, ready to go run free in the wild.

In your example, it sounds like a check in would only be made once every few days, where checking in is something you should be doing multiple times a day.


答:
The code should always be in source control. The new code can be committed to a branch, reviews, changes, improvements are done there.

QA can be build from the branch.

AFter final approval, merge to trunk.

Title: source code check in / validation best practices

Body:
I am looking for best practices that big organizations follow for code check-in and validations.

Currently we follow these steps,
- Developer writes code
- Developer do some initial tests
- Code is awaiting validation now
- Technical lead reviews the code (possible bugs, see if coding convention is followed etc)
- Once approved by technical lead, the code goes in QA state
- Once QA approves the code is checked in into the trunk.

We are now moving to a new project and I was looking for some best practices that would ease the process. We have custom made software that maintains the code status.

Thanks,
Ali


问:
Effectiveness of "what is your greatest strength/weakness" interview questions
As someone who is now finding himself on the other end of the interview table, I'm wondering how useful these questions are from an employer's perspective. Some of my coworkers think they're good because you can see "how they respond," but I'm not convinced it tells you anything useful, for several reasons:

It's not a very comfortable question and can lead people to twist their answers, even if not on purpose

People may not fully know their greatest strengths or weaknesses (i.e. judge them by their peers)

Explaining what a strength is isn't as good as showing it

I still don't know any more about the candidate afterwards

The rationale of my coworkers is that it can help weed out people that give ridiculous responses, like one guy that said his greatest strength was "his intellect" or people that try to turn the weakness question into a strength like "I work too hard." But I think there's more effective ways to determine such things. If you want to see if someone's smart, ask them technical questions. If you want to see if someone is productive, look at their work history. If you want to see how someone reacts under stress or change, ask them how they've dealt with it and ask for concrete examples.

What are people's thoughts on these questions, from the perspective of an interviewer? What do they really tell you about a candidate, and what are better alternatives? How do I convince my colleagues of this?

答:
Not very.

Any question for which a good percentage of candidates will have a canned response is of limited value, since you're often not getting the real them.  Everyone and their cousin has heard of "what is your greatest weakness."

The answer encourages lying: honest people will describe a fault and end up looking bad, while less honest people will spin a strength as a fault and look good.

The question is so dated that, in my opinion, it reflects poorly on your company to ask it.


答:
I'd agree that code should be checked in as often as possible, but don't allow check ins that would break the build. Continuous integration is a very good tool to use as well IMO. Requiring all checkins pass the build process and unit tests (and even test coverage if possible) is a good way to ensure that people aren't just throwing stuff over the wall.

Prototypes and other long-running features should go into separate branches as needed and could have less strict rules.


答:
Over-engineering? Not at all. Anti-XSRF measures are a necessary part of any secure web application or service. It may or may not be “highly unlikely” that someone will choose to attack you, but that doesn't make your software less insecure.

Systems have commonly been attacked using XSRF, and though the results are less immediately-obviously bad than SQL-injection or XSS, they're quite bad enough to compromise all user-interactable features.

That does mean you can't have a “pure” RESTful interface where the only parameters are the properties of the call itself. You must include something in the request that an attacker couldn't guess. That could be the username-password pair, but that's far from the only possible choice. You could have username together with token generated from a salted hash of the password. You could have tokens issued by the service itself at authentication time (which could be remembered in the session, or verified cryptographically).

should I get rid of the GET

No, GET requests are used for read-requests that have no active writing operation (they are “idempotent”). It's only write operations that require XSRF protection.


问:
How far can I push refactoring without changing external behavior?
According to Martin Fowler, code refactoring is (emphasis mine):

Refactoring is a disciplined technique for restructuring an existing body of code, altering its internal structure without changing its external behavior. Its heart is a series of small behavior preserving transformations. Each transformation (called a 'refactoring') does little, but a sequence of transformations can produce a significant restructuring. Since each refactoring is small, it's less likely to go wrong. The system is also kept fully working after each small refactoring, reducing the chances that a system can get seriously broken during the restructuring.

What is "external behaviour" in this context? For example, if I apply move method refactoring and move some method to other class, it looks like I change external behaviour, doesn't it?

So, I'm interested in figuring out at what point does a change stop being a refactor and becomes something more. The term "refactoring" may be misused for larger changes: is there a different word for it?

Update. A lot of interesting answers about interface, but wouldn't move method refactoring change the interface?

答: if you talk about factoring numbers, then you're describing the group of integers that when multiplied together equal the starting number.  If we take this definition for factoring, and apply it to the programming term refactor, then refactoring would be breaking a program down into the smallest logical units, such that when they are ran as a program, produce the same output (given the same input) as the original program.</p>


问:
How can you measure your own daily contributions?
I've recently finished the The Three Signs of a Miserable Job by Patrick Lencioni and one of his core ideas is that you need to have some form of measurement.

I have a pretty standard internal developer job where I work on new tools and do some support/bug fixes for past tools I have written.

For purely personal fulfillment reasons, what things would you measure on a daily basis?  (This is not a report to managers and not something to game, just something to help me mark progress).

The goal is to find things that measure not just productivity, but how good of a job you are doing (so a customer service person might record positive interactions in addition to number of calls taken).

My stab at this would be to measure two things every day: support requests opened/closed and number of checkins to source control.

I understand if this gets closed, but once again this isn't a question about management, its about personal development as a programmer/software developer.

答:
I think you've got the right idea, number of check-ins to source control is the way I'd do it.  Each check-in is a significant unit of program refinement.  Of course that only works when you only check-in fully developed program updates/fixes, but that's the way it should be done anyway.  If I was measuring then this might help me stick to that rule, too.

Closed issue reports is another good measuring stick, I fully agree with that one, too.  Again, it might help remind me to enter bug reports in a "if I don't log this defect before I fix it then I won't be measuring my own progress correctly today" way.

Both values should be easy to collect and graph.  I can almost see the spreadsheet now...  8 )


答:
I agree with the others that only a single check in is not very good.  You should check in all the time, unfortunately "Enterprise" VCS seem to make it difficult to check in, which is near-suicide as far as I can tell. Major integration hassles invariably result.

One thing I would add: do a "diff" on the code in version control, and the code about-to-be-checked-in. At the very least, seeing the diff will let you write more cogent check-in comments.  Doing a "diff" before check-in can prevent you from overwriting someone else's changes, or other horrible mistakes.


答:
It comes down to costs and trends. The Web 2.0 Startup is created by an under 30 visionary who has more talent than money (I'm generalizing of course but this is what you'll see "on average"). He is going to use a language he is familiar with because he's doing the programming (along with maybe a few friends). He's most likely a self-taught programmer.

Java has been targeted as an enterprise environment (by Java, I mean the language, the framework, and the standards). There are a bunch of expensive tools that the IBM's, Oracles, and BEA's of the world want to sell enterprises.

The steps to become proficient with Java are complex and/or expensive. I know the landscape is changing there but is it too little too late?

After the startup gains traction comes the growth. Recruiting talented developers is difficult. Most "become a programmer in six weeks" programs teach Java (or .NET) and the market is saturated with "six week programmers" (oddly enough I've seen developers with resumes saying 7 years experience that still show the knowledge of a six week programmer). Using a non-mainstream non-"enterprisey" environment can be a natural filter for six week programmers. It takes dedication and personal investment to learn a Ruby or Scala outside of a job requirement. This is the biggest indicator to me of potential for a candidate.

Knowledge comes with experience but a dedicated / passionate programmer will gain knowledge more rapidly (on average) than someone without that dedication / passion. Just like a kid who loves playing guitar will become better more quickly than a kid taking lessons because his dad made him.


问:
Languages to complement C++
I primarily work in C++.  My question is, for a C++ developer, what languages are beneficial to learn, from a job-profile point of view.  For example, I see a lot of work combining C++ and Php these days.  Conversely, I don't see a lot of work combining Ruby and C++ (unfortunately).

Of course, learning another language is beneficial regardless of whether it compliments a language.

答: Python is often used in combination with C++ for file manipulation (and c++ code generation) and embedded scripting.</p>

Title: Languages to complement C++


问:
Why isn't Java used for modern web application development?
As a professional Java programmer, I've been trying to understand - why the hate toward Java for modern web applications?

I've noticed a trend that out of modern day web startups, a relatively small percentage of them appears to be using Java (compared to Java's overall popularity).  When I've asked a few about this, I've typically received a response like, "I hate Java with a passion."  But no one really seems to be able to give a definitive answer.

I've also heard this same web startup community refer negatively to Java developers - more or less implying that they are slow, not creative, old.

As a result, I've spent time working to pick up Ruby/Rails, basically to find out what I'm missing.  But I can't help thinking to myself, "I could do this much faster if I were using Java," primarily due to my relative experience levels.

But also because I haven't seen anything critical "missing" from Java, preventing me from building the same application.

Which brings me to my question(s):

Why is Java not being used in modern web applications?

Is it a weakness of the language?

Is it an unfair stereotype of Java because it's been around so long (it's been unfairly associated with its older technologies, and doesn't receive recognition for its "modern" capabilities)?

Is the negative stereotype of Java developers too strong? (Java is just no longer "cool")

Are applications written in other languages really faster to build, easier to maintain, and do they perform better?

Is Java only used by big companies who are too slow to adapt to a new language?

答:
Java is too complicated. I do a ton of PHP work and it's just easier and faster for most situations. The ability to just SSH into a server open a php file make changes save and be done is great. The few Java apps I've worked on have always required a restart for the simplest change. (not saying it's always the case just what I've delt with). Additionally PHP hosting is cheap and readily available.

I also think what you have at least with PHP is a lot of developers who like me started off 14/15 years ago with static HTML. As things progressed we started adding PHP to our sites because it was easy, simple, and affordable. Over the years the language has grown and has expanded it's abilities way beyond it's humble beginnings and now tries hard to be what I think is a lot of things it's really not.

On the flip side most PHP devs I know see Java as this giant overly complex 800lb gorilla, almost like getting out the 18 wheeler semi truck to drive down to the grocery store and get a loaf of bread.

I've tried to learn Java, my first impressions where that it was very long winded and carpal tunnel inducing. Additionally starting off it left me with a lot of questions that probably seem easy to a Java veteran. OpenJDK, or Sun? Tomcat, or Glassfish, or? Plus it seems every intro to Java book starts you out writing code for the command line. I think most people these days find that a snooze fest.


问:
Evaluating third-party libraries
At our company, we frequently use third-party libraries and frameworks in our products. Often, we are faced with the task of evaluating one or more libraries that full fill similar requirements (in a specific case we had to choose between some encryption libraries).
We often do a simple prototype to try to figure out, if the library somehow works for us. However, often the prototypes get really complex and when we are at a point where we figure out, that the library is not suited for our purposes, lots of time was spend, that we could have used to write the desired functionality ourselves.

My question would be, do you have or practice any guidelines when it comes to evaluating third-party libraries? More specifically, do you have something like a maximum time that will be spend on prototypes and do you have general requirements for libraries you use (license issues, support, documentation, ...)?

答:
Speaking only for myself (and having done dozens of these):

If it's closed-source, it's not worth my company's time.

If the open-source license would cause even slightly raised eyebrows in Legal, it's not worth my company's time.  LGPL is fine, Apache is fine, MIT is fine, GPL (any version) is not.

If the documentation doesn't include at minimum full interface docs, a quicky tutorial, and a FAQ, it's not worth my company's time.

If the library requires me to build it before I can use it, it's not worth my company's time.

If the library doesn't appear to have a google-detectable user community, it's not worth my company's time.

If the library vendor won't publish a roadmap or open up their issue-tracking system (even read-only), those are bad sign, but not immediate downchecks unless all the other candidates do better.

That cuts out the deadwood.  Once we're there, it's time to design the bake-off.  A useful bake-off shall have a fixed time-scale, a fixed set of evaluation criteria, and a fixed feature set, all of which should be written down.  All of the features in the feature set should be tied to an evaluation criterion (ideally exactly one of the evaluation criteria).  For longer bake-offs (particularly those with >2 candidates), there should be a checkpoint.  At the checkpoint, all of the candidates should be examined to see if any one of them completely is completely dominated on all evaluation criteria.  Any candidate so dominated (or even almost completely dominated) should be dropped mid-way through the bakeoff.

This all sounds fussy, but the alternative appears to be endless evaluation criteria that go off into the weeds until the original business justification for the technology is obsolete or dropped through sheer exhaustion.

Title: Evaluating third-party libraries


问:
Should UTF-16 be considered harmful?
I'm going to ask what is probably quite a controversial question: "Should one of the most
popular encodings, UTF-16, be considered harmful?"

Why do I ask this question?

How many programmers are aware of the fact that UTF-16 is actually a variable length encoding? By this I mean that there are code points that, represented as surrogate pairs, take more than one element.

I know; lots of applications, frameworks and APIs use UTF-16, such as Java's String, C#'s String, Win32 APIs, Qt GUI libraries, the ICU Unicode library, etc.  However, with all of that, there are lots of basic bugs in the processing of characters out of BMP (characters that should be encoded using two UTF-16 elements).

For example, try to edit one of these characters:

𝄞 (U+1D11E) MUSICAL SYMBOL G CLEF

𝕥 (U+1D565) MATHEMATICAL DOUBLE-STRUCK SMALL T

𝟶 (U+1D7F6) MATHEMATICAL MONOSPACE DIGIT ZERO

𠂊 (U+2008A) Han Character

You may miss some, depending on what fonts you have installed.  These characters are all outside of the BMP (Basic Multilingual Plane).  If you cannot see these characters, you can also try looking at them in the Unicode Character reference.

For example, try to create file names in Windows that include these characters; try to delete these characters with a "backspace" to see how they behave in different applications that use UTF-16. I did some tests and the results are quite bad:

Opera has problem with editing them (delete required 2 presses on backspace)

Notepad can't deal with them correctly (delete required 2 presses on backspace)

File names editing in Window dialogs in broken (delete required 2 presses on backspace)

All QT3 applications can't deal with them - show two empty squares instead of one symbol.

Python encodes such characters incorrectly when used directly u'X'!=unicode('X','utf-16') on some platforms when X in character outside of BMP.

Python 2.5 unicodedata fails to get properties on such characters when python compiled with UTF-16 Unicode strings.

StackOverflow seems to remove these characters from the text if edited directly in as Unicode characters (these characters are shown using HTML Unicode escapes).

WinForms TextBox may generate invalid string when limited with MaxLength.

It seems that such bugs are extremely easy to find in many applications that use UTF-16.

So... Do you think that UTF-16 should be considered harmful?

答:
I would suggest that thinking UTF-16 might be considered harmful says that you need to gain a greater understanding of unicode.

Since I've been downvoted for presenting my opinion on a subjective question, let me elaborate.  What exactly is it that bothers you about UTF-16?  Would you prefer if everything was encoded in UTF-8? UTF-7? Or how about UCS-4?  Of course certain applications are not designed to handle everysingle character code out there - but they are necessary, especially in today's global information domain, for communication between international boundaries.

But really, if you feel UTF-16 should be considered harmful because it's confusing or can be improperly implemented (unicode certainly can be), then what method of character encoding would be considered non-harmful?

EDIT: To clarify: Why consider improper implementations of a standard a reflection of the quality of the standard itself?  As others have subsequently noted, merely because an application uses a tool inappropriately, does not mean that the tool itself is defective.  If that were the case, we could probably say things like "var keyword considered harmful", or "threading considered harmful".  I think the question confuses the quality and nature of the standard with the difficulties many programmers have in implementing and using it properly, which I feel stem more from their lack of understanding how unicode works, rather than unicode itself.

OwnerDisplayName: Artyom

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: patjbs


答:
There is nothing wrong with Utf-16 encoding. But languages that treat the 16-bit units as characters should probably be considered badly designed. Having a type named 'char' which does not always represent a character is pretty confusing. Since most developers will expect a char type to represent a code point or character, much code will probably break when exposed to characters beyound BMP.

Note however that even using utf-32 does not mean that each 32-bit code point will always represent a character. Due to combining characters, an actual character may consist of several code points. Unicode is never trivial.

BTW. There is probably the same class of bugs with platforms and applications which expect characters to be 8-bit, which are fed Utf-8.

Title: Should UTF-16 be considered harmful?

Body:
I'm going to ask what is probably quite a controversial question: "Should one of the most
popular encodings, UTF-16, be considered harmful?"

Why do I ask this question?

How many programmers are aware of the fact that UTF-16 is actually a variable length encoding? By this I mean that there are code points that, represented as surrogate pairs, take more than one element.

I know; lots of applications, frameworks and APIs use UTF-16, such as Java's String, C#'s String, Win32 APIs, Qt GUI libraries, the ICU Unicode library, etc.  However, with all of that, there are lots of basic bugs in the processing of characters out of BMP (characters that should be encoded using two UTF-16 elements).

For example, try to edit one of these characters:

𝄞 (U+1D11E) MUSICAL SYMBOL G CLEF

𝕥 (U+1D565) MATHEMATICAL DOUBLE-STRUCK SMALL T

𝟶 (U+1D7F6) MATHEMATICAL MONOSPACE DIGIT ZERO

𠂊 (U+2008A) Han Character

You may miss some, depending on what fonts you have installed.  These characters are all outside of the BMP (Basic Multilingual Plane).  If you cannot see these characters, you can also try looking at them in the Unicode Character reference.

For example, try to create file names in Windows that include these characters; try to delete these characters with a "backspace" to see how they behave in different applications that use UTF-16. I did some tests and the results are quite bad:

Opera has problem with editing them (delete required 2 presses on backspace)

Notepad can't deal with them correctly (delete required 2 presses on backspace)

File names editing in Window dialogs in broken (delete required 2 presses on backspace)

All QT3 applications can't deal with them - show two empty squares instead of one symbol.

Python encodes such characters incorrectly when used directly u'X'!=unicode('X','utf-16') on some platforms when X in character outside of BMP.

Python 2.5 unicodedata fails to get properties on such characters when python compiled with UTF-16 Unicode strings.

StackOverflow seems to remove these characters from the text if edited directly in as Unicode characters (these characters are shown using HTML Unicode escapes).

WinForms TextBox may generate invalid string when limited with MaxLength.

It seems that such bugs are extremely easy to find in many applications that use UTF-16.

So... Do you think that UTF-16 should be considered harmful?

OwnerDisplayName: JacquesB


答:
Well, there is an encoding that uses fixed-size symbols. I certainly mean UTF-32. But 4 bytes for each symbol is too much of wasted space, why would we use it in everyday situations?

To my mind, most problems appear from the fact that some software fell behind the Unicode standard, but were not quick to correct the situation. Opera, Windows, Python, Qt - all of them appeared before UTF-16 became widely known or even came into existence. I can confirm, though, that in Opera, Windows Explorer, and Notepad there are no problems with characters outside BMP anymore (at least on my PC). But anyway, if programs don't recognise surrogate pairs, then they don't use UTF-16. Whatever problems arise from dealing with such programs, they have nothing to do with UTF-16 itself.

However, I think that the problems of legacy software with only BMP support are somewhat exaggerated. Characters outside BMP are encountered only in very specific cases and areas. According to the Unicode official FAQ, "even in East Asian text, the incidence of surrogate pairs should be well less than 1% of all text storage on average". Of course, characters outside BMP shouldn't be neglected because a program is not Unicode-conformant otherwise, but most programs are not intended for working with texts containing such characters. That's why if they don't support it, it is unpleasant, but not a catastrophy.

Now let's consider the alternative. If UTF-16 didn't exist, then we wouldn't have an encoding which is well-suited for non-ASCII text, and all the software created for UCS-2 would have to be completely redesigned to remain Unicode-compliant. The latter most likely would only slow Unicode adoption. Also we wouldn't have been able to maintain compability with text in UCS-2 like UTF-8 does in relation to ASCII.

Now, putting aside all the legacy issues, what are the arguments against the encoding itself? I really doubt that developers nowadays don't know that UTF-16 is variable length, it is written everywhere strarting with Wikipedia. UTF-16 is much less difficult to parse than UTF-8, if someone pointed out complexity as a possible problem. Also it is wrong to think that it is easy to mess up with determining the string length only in UTF-16. If you use UTF-8 or UTF-32, you still should be aware that one Unicode code point doesn't necessarily mean one character. Other than that, I don't think that there's anything substantial against the encoding.

Therefore I don't think the encoding itself should be considered harmful. UTF-16 is a compromise between simplicity and compactness, and there's no harm in using what is needed where it is needed. In some cases you need to remain compatible with ASCII and you need UTF-8, in some cases you want to work with work with Han ideographs and conserve space using UTF-16, in some cases you  need universal representations of characters usign a fixed-length encoding. Use what's more appropriate, just do it properly.

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: Malcolm


答: My personal choice is to always use UTF-8.  It's the standard on Linux for nearly everything.  It's backwards compatible with many legacy apps.  There is a very minimal overhead in terms of extra space used for non-latin characters vs the other UTF formats, and there is a significant savings in space for latin characters.  On the web, latin languages reign supreme, and I think they will for the foreseeable future.  And to address one of the main arguments in the original post: nearly every programmer is aware that UTF-8 will sometimes have multi-byte characters in it.  Not everyone deals with this correctly, but they are usually aware, which is more than can be said for UTF-16.  But, of course, you need to choose the one most appropriate for your application.  That's why there's more than one in the first place.</p>

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: rmeador


问:
How to retain student/intern programmers?
We have a small team in our department and typically employ 1-3 students/interns.  The problem we have is retention.  We like to hire a student that will stick around as part of the team for more than just a summer quarter.  The problem is though the last 4 students we hired, up front we discussed this with them and they all ended up leaving earlier than we would have liked.

The relationships all ended in a good fashion, the students either obtained teaching assistant or research positions within the university, or went on to bigger and better things.  This is all understandable and we do not hold it against them for doing what is best for them.

But my perspective is different as I worked within our department for 2 years during undergraduate at which point I was brought on full time upon graduation.

How can we retain students?  We give them hardware they need/want, we provide them with problems to solve in anyway they see fit (within reason).  All in all to me this type of job for a student programmer is so flexible and awesome I cannot see how anyone would want to leave.

Thoughts ?

答:
You have to cover some basic programming concepts to make sure they stayed awake during classes - algorithms, data structures, etc. I'd also want to hear IN DETAIL about some of the programming assignments they have done. I always find it interesting when a potetial employee can not tell me much about the programming assignment that was a major part of their grade.

Next would be trying to figure out if they had reasoning skills. Can they break a problem down into manageable pieces? I really don't care if they get a logic question correct as long as they can tell me the approach they would use (and of course the approach seems appropriate.)


答: UTF-16 is the best compromise between handling and space and that's why most major platforms (Win32, Java, .NET) use it for internal representation of strings.</p>

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: Nemanja Trifunovic


答:
Years of Windows internationalization work especially in East Asian languages might have corrupted me, but I lean toward UTF-16 for internal-to-the-program representations of strings, and UTF-8 for network or file storage of plaintext-like documents. UTF-16 can usually be processed faster on Windows, though, so that's the primary benefit of using UTF-16 in Windows.

Making the leap to UTF-16 dramatically improved the adequacy of average products handling international text. There are only a few narrow cases when the surrogate pairs need to be considered (deletions, insertions, and line breaking, basically) and the average-case is mostly straight pass-through. And unlike earlier encodings like JIS variants, UTF-16 limits surrogate pairs to a very narrow range, so the check is really quick and works forward and backward.

Granted, it's roughly as quick in correctly-encoded UTF-8, too. But there's also many broken UTF-8 applications that incorrectly encode surrogate pairs as two UTF-8 sequences. So UTF-8 doesn't guarantee salvation either.

IE handles surrogate pairs reasonably well since 2000 or so, even though it typically is converting them from UTF-8 pages to an internal UTF-16 representation; I'm fairly sure Firefox has got it right too, so I don't really care what Opera does.

UTF-32 (aka UCS4) is pointless for most applications since it's so space-demanding, so it's pretty much a nonstarter.

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: JasonTrue


答:
There is a simple rule of thumb on what Unicode Transformation Form (UTF) to use:
 - utf-8 for storage and comunication
 - utf-16 for data processing
 - you might go with utf-32 if most of the platform API you use is utf-32 (common in the UNIX world).

Most systems today use utf-16 (Windows, Mac OS, Java, .NET, ICU, Qt).
Also see this document: http://unicode.org/notes/tn12/

Back to "UTF-16 as harmful", I would say: definitely not.

People who are afraid of surrogates (thinking that they transform Unicode into a variable-length encoding) don't understand the other (way bigger) complexities that make mapping between characters and a Unicode code point very complex: combining characters, ligatures, variation selectors, control characters, etc.

Just read this series here http://www.siao2.com/2009/06/29/9800913.aspx and see how UTF-16 becomes an easy problem.

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: Mihai Nita


答:
This is an old answer.

  See UTF-8 Everywhere for the latest updates.

Opinion: Yes, UTF-16 should be considered harmful. The very reason it exists is because some time ago there used to be a misguided belief that widechar is going to be what UCS-4 now is.

Despite the "anglo-centrism" of UTF-8, it should be considered the only useful encoding for text. One can argue that source codes of programs, web pages and XML files, OS file names and other computer-to-computer text interfaces should never have existed. But when they do, text is not only for human readers.

On the other hand, UTF-8 overhead is a small price to pay while it has significant advantages. Advantages such as compatibility with unaware code that just passes strings with char*. This is a great thing. There're few useful characters which are SHORTER in UTF-16 than they are in UTF-8.

I believe that all other encodings will die eventually. This involves that MS-Windows, Java, ICU, python stop using it as their favorite. After long research and discussions, the development conventions at my company ban using UTF-16 anywhere except OS API calls, and this despite importance of performance in our applications and the fact that we use Windows. Conversion functions were developed to convert always-assumed-UTF8 std::strings to native UTF-16, which Windows itself does not support properly.

To people who say "use what needed where it is needed", I say: there's a huge advantage to using the same encoding everywhere, and I see no sufficient reason to do otherwise. In particular, I think adding wchar_t to C++ was a mistake, and so are the Unicode additions to C++0x. What must be demanded from STL implementations though is that every std::string or char* parameter would be considered unicode-compatible.

I am also against the "use what you want" approach. I see no reason for such liberty. There's enough confusion on the subject of text, resulting in all this broken software. Having above said, I am convinced that programmers must finally reach consensus on UTF-8 as one proper way. (I come from a non-ascii-speaking country and grew up on Windows, so I'd be last expected to attack UTF-16 based on religious grounds).

I'd like to share more information on how I do text on Windows, and what I recommend to everyone else for compile-time checked unicode correctness, ease of use and better multi-platformness of the code. The suggestion substantially differs from what is usually recommended as the proper way of using Unicode on windows. Yet, in depth research of these recommendations resulted in the same conclusion. So here goes:

Do not use wchar_t or std::wstring in any place other than adjacent point to APIs accepting UTF-16.

Don't use _T("") or L"" UTF-16 literals (These should IMO be taken out of the standard, as a part of UTF-16 deprecation).

Don't use types, functions or their derivatives that are sensitive to the _UNICODE constant, such as LPTSTR or CreateWindow().

Yet, _UNICODE always defined, to avoid passing char* strings to WinAPI getting silently compiled

std::strings and char* anywhere in program are considered UTF-8 (if not said otherwise)

All my strings are std::string, though you can pass char* or string literal to convert(const std::string &).

only use Win32 functions that accept widechars (LPWSTR). Never those which accept LPTSTR or LPSTR. Pass parameters this way:

```<code>::SetWindowTextW(Utils::convert(someStdString or "string litteral").c_str())
</code>```

(The policy uses conversion functions below.)

With MFC strings:

```<code>CString someoneElse; // something that arrived from MFC. Converted as soon as possible, before passing any further away from the API call:

std::string s = str(boost::format("Hello %s\n") % Convert(someoneElse));
AfxMessageBox(MfcUtils::Convert(s), _T("Error"), MB_OK);
</code>```

Working with files, filenames and fstream on Windows:

Never pass std::string or const char* filename arguments to fstream family. MSVC STL does not support UTF-8 arguments, but has a non-standard extension which should be used as follows:

Convert std::string arguments to std::wstring with Utils::Convert:

```<code>std::ifstream ifs(Utils::Convert("hello"),
                  std::ios_base::in |
                  std::ios_base::binary);
</code>```

We'll have to manually remove the convert, when MSVC's attitude to fstream changes.

This code is not multi-platform and may have to be changed manually in the future

See fstream unicode research/discussion case 4215 for more info.

Never produce text output files with non-UTF8 content

Avoid using fopen() for RAII/OOD reasons. If necessary, use _wfopen() and WinAPI conventions above.

```<code>// For interface to win32 API functions
std::string convert(const std::wstring& str, unsigned int codePage /*= CP_UTF8*/)
{
    // Ask me for implementation..
    ...
}

std::wstring convert(const std::string& str, unsigned int codePage /*= CP_UTF8*/)
{
    // Ask me for implementation..
    ...
}

// Interface to MFC
std::string convert(const CString &mfcString)
{
#ifdef UNICODE
    return Utils::convert(std::wstring(mfcString.GetString()));
#else
    return mfcString.GetString();   // This branch is deprecated.
#endif
}

CString convert(const std::string &s)
{
#ifdef UNICODE
    return CString(Utils::convert(s).c_str());
#else
    Exceptions::Assert(false, "Unicode policy violation. See W569"); // This branch is deprecated as it does not support unicode
    return s.c_str();
#endif
}
</code>```

Title: Should UTF-16 be considered harmful?

Body:
This is an old answer.

  See UTF-8 Everywhere for the latest updates.

Opinion: Yes, UTF-16 should be considered harmful. The very reason it exists is because some time ago there used to be a misguided belief that widechar is going to be what UCS-4 now is.

Despite the "anglo-centrism" of UTF-8, it should be considered the only useful encoding for text. One can argue that source codes of programs, web pages and XML files, OS file names and other computer-to-computer text interfaces should never have existed. But when they do, text is not only for human readers.

On the other hand, UTF-8 overhead is a small price to pay while it has significant advantages. Advantages such as compatibility with unaware code that just passes strings with char*. This is a great thing. There're few useful characters which are SHORTER in UTF-16 than they are in UTF-8.

I believe that all other encodings will die eventually. This involves that MS-Windows, Java, ICU, python stop using it as their favorite. After long research and discussions, the development conventions at my company ban using UTF-16 anywhere except OS API calls, and this despite importance of performance in our applications and the fact that we use Windows. Conversion functions were developed to convert always-assumed-UTF8 std::strings to native UTF-16, which Windows itself does not support properly.

To people who say "use what needed where it is needed", I say: there's a huge advantage to using the same encoding everywhere, and I see no sufficient reason to do otherwise. In particular, I think adding wchar_t to C++ was a mistake, and so are the Unicode additions to C++0x. What must be demanded from STL implementations though is that every std::string or char* parameter would be considered unicode-compatible.

I am also against the "use what you want" approach. I see no reason for such liberty. There's enough confusion on the subject of text, resulting in all this broken software. Having above said, I am convinced that programmers must finally reach consensus on UTF-8 as one proper way. (I come from a non-ascii-speaking country and grew up on Windows, so I'd be last expected to attack UTF-16 based on religious grounds).

I'd like to share more information on how I do text on Windows, and what I recommend to everyone else for compile-time checked unicode correctness, ease of use and better multi-platformness of the code. The suggestion substantially differs from what is usually recommended as the proper way of using Unicode on windows. Yet, in depth research of these recommendations resulted in the same conclusion. So here goes:

Do not use wchar_t or std::wstring in any place other than adjacent point to APIs accepting UTF-16.

Don't use _T("") or L"" UTF-16 literals (These should IMO be taken out of the standard, as a part of UTF-16 deprecation).

Don't use types, functions or their derivatives that are sensitive to the _UNICODE constant, such as LPTSTR or CreateWindow().

Yet, _UNICODE always defined, to avoid passing char* strings to WinAPI getting silently compiled

std::strings and char* anywhere in program are considered UTF-8 (if not said otherwise)

All my strings are std::string, though you can pass char* or string literal to convert(const std::string &).

only use Win32 functions that accept widechars (LPWSTR). Never those which accept LPTSTR or LPSTR. Pass parameters this way:

::SetWindowTextW(Utils::convert(someStdString or "string litteral").c_str())

(The policy uses conversion functions below.)

With MFC strings:

CString someoneElse; // something that arrived from MFC. Converted as soon as possible, before passing any further away from the API call:

std::string s = str(boost::format("Hello %s\n") % Convert(someoneElse));
AfxMessageBox(MfcUtils::Convert(s), _T("Error"), MB_OK);

Working with files, filenames and fstream on Windows:

Never pass std::string or const char* filename arguments to fstream family. MSVC STL does not support UTF-8 arguments, but has a non-standard extension which should be used as follows:

Convert std::string arguments to std::wstring with Utils::Convert:

std::ifstream ifs(Utils::Convert("hello"),
                  std::ios_base::in |
                  std::ios_base::binary);

We'll have to manually remove the convert, when MSVC's attitude to fstream changes.

This code is not multi-platform and may have to be changed manually in the future

See fstream unicode research/discussion case 4215 for more info.

Never produce text output files with non-UTF8 content

Avoid using fopen() for RAII/OOD reasons. If necessary, use _wfopen() and WinAPI conventions above.

// For interface to win32 API functions
std::string convert(const std::wstring& str, unsigned int codePage /*= CP_UTF8*/)
{
    // Ask me for implementation..
    ...
}

std::wstring convert(const std::string& str, unsigned int codePage /*= CP_UTF8*/)
{
    // Ask me for implementation..
    ...
}

// Interface to MFC
std::string convert(const CString &mfcString)
{
#ifdef UNICODE
    return Utils::convert(std::wstring(mfcString.GetString()));
#else
    return mfcString.GetString();   // This branch is deprecated.
#endif
}

CString convert(const std::string &s)
{
#ifdef UNICODE
    return CString(Utils::convert(s).c_str());
#else
    Exceptions::Assert(false, "Unicode policy violation. See W569"); // This branch is deprecated as it does not support unicode
    return s.c_str();
#endif
}

OwnerDisplayName: Pavel Radzivilovsky


答:
UTF-16? definitely harmful. Just my grain of salt here, but there are exactly three acceptable encodings for text in a program:

ASCII: when dealing with low level things (eg: microcontrollers) that can't
afford anything better

UTF8: storage in fixed-width media such as files

integer codepoints ("CP"?): an array of the largest integers that are convenient
for your programming language and platform (decays to ASCII in the limit of low
resorces). Should be int32 on older computers and int64 on anything with 64-bit
addressing.

Obviously interfaces to legacy code use what encoding is needed to make the old
code work right.

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: David X


答:
Unicode codepoints are not characters!  Sometimes they are not even glyphs (visual forms).

Some examples:

Roman numeral codepoints like "ⅲ".  (A single character that looks like "iii".)

Accented characters like "á", which can be represented as either a single combined character "\u00e1" or a character and separated diacritic "\u0061\u0301".

Characters like Greek lowercase sigma, which have different forms for middle ("σ") and end ("ς") of word positions, but which should be considered synonyms for search.

Unicode discretionary hyphen U+00AD, which might or might not be visually displayed, depending on context, and which is ignored for semantic search.

The only ways to get Unicode editing right is to use a library written by an expert, or become an expert and write one yourself.  If you are just counting codepoints, you are living in a state of sin.

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: Daniel Newby


答:
UTF-8 is definitely the way to go, possibly accompanied by UTF-32 for internal use in algorithms that need high performance random access (but that ignores combining chars).

Both UTF-16 and UTF-32 (as well as their LE/BE variants) suffer of endianess issues, so they should never be used externally.

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: Tronic


答:
I wouldn't necessarily say that UTF-16 is harmful.  It's not elegant, but it serves its purpose of backwards compatibility with UCS-2, just like GB18030 does with GB2312, and UTF-8 does with ASCII.

But making a fundamental change to the structure of Unicode in midstream, after Microsoft and Sun had built huge APIs around 16-bit characters, was harmful.  The failure to spread awareness of the change was more harmful.

Title: Should UTF-16 be considered harmful?


答: It does depend a little upon the platforms you are supporting, but if Windows is a platform, learning C# and the related techologies should keep you employeed for some time.</p>

Title: Languages to complement C++

Body:
I primarily work in C++.  My question is, for a C++ developer, what languages are beneficial to learn, from a job-profile point of view.  For example, I see a lot of work combining C++ and Php these days.  Conversely, I don't see a lot of work combining Ruby and C++ (unfortunately).

Of course, learning another language is beneficial regardless of whether it compliments a language.


答:
Someone said UCS4 and UTF-32 were same.  No so, but I know what you mean.  One of them is an encoding of the other, though.  I wish they'd thought to specify endianness from the first so we wouldn't have the endianess battle fought out here too.  Couldn't they have seen that coming?  At least UTF-8 is the same everywhere (unless someone is following the original spec with 6-bytes).

If you use UTF-16 you have to include handling for multibyte chars.  You can't go to the Nth character by indexing 2N into a byte array.  You have to walk it, or have character indices.  Otherwise you've written a bug.

The current draft spec of C++ says that UTF-32 and UTF-16 can have little-endian, big-endian, and unspecified variants.  Really?  If Unicode had specified that everyone had to do little-endian from the beginning then it would have all been simpler. (I would have been fine with big-endian as well.)  Instead, some people implemented it one way, some the other, and now we're stuck with silliness for nothing.  Sometimes it's embarrassing to be a software engineer.

Title: Should UTF-16 be considered harmful?

OwnerDisplayName: Patrick Horgan