问:
The suffix Exception on exceptions in java
Specifying a suffix of Exception on exception classes feels like a code smell to me (Redundant information - the rest of the name implies an error state and it inherits from Exception). However, it also seems that everyone does it and it seems to be good practice.

I am looking to understand why this is good practice.

I have already seen and read the question why do exceptions usually have the suffix exception in the class name

The question is for PHP and while the responses are probably valid for Java. Are there any other arguments or is it really as simple as explicitly differentiating them?

If we take the examples from the previous question - could there really be classes in java with the name FileNoFound that is not an exception? If there could be, does it warrant suffixing it with Exception ?

Looking at a quick hierarchy in eclipse of Exception, sure enough, the vast majority of them do have the suffix of exception, but there are a few exceptions. javassist is an example of a library that seems to have a few exceptions without the suffix - e.g. BadByteCode, BadHttpRequest etc.

BouncyCastle is another lib with exceptions like CompileError

I've googled around a bit as well with little info on the subject.

答:
I think exceptions (and errors, and theoretically other Throwables) are different from things like interfaces or enums (which usually ain't used as suffix): They have usually a very clear and limited purpose, they are used with specialized language constructs (try, catch, throw, throws) and follow special rules (e.g. checked vs unchecked exceptions, no generics). In a way they are not just classes that happen to be used as exceptions, but an exception mechanism which is implemented by the means of classes.

So if you dealing with an exception and don't recognize it as such, usually something is deeply wrong (which is again not the case for things like enums or interfaces). So I think these differences to "normal" classes are big enough to call for a visual clue.


答:
Landei's answer is a good one, but there's also the grammatical answer.  Class names should be nouns.  What is an "OutOfMemory"?  What is a "FileNotFound"?  If you think of "Exception" as the noun, then the descriptor is the adjective specifying it.  It's not just any Exception, it's a FileNotFoundException.  You shouldn't need to catch an OutOfMemory any more than you'd go to the store to buy a "blue".

This also shows up if you read your code as a sentence: "Try doing ..., and catch OutOfMemory Exceptions"

ContentLicense: CC BY-SA 3.0

Title: The suffix Exception on exceptions in java

Body:
Specifying a suffix of Exception on exception classes feels like a code smell to me (Redundant information - the rest of the name implies an error state and it inherits from Exception). However, it also seems that everyone does it and it seems to be good practice.

I am looking to understand why this is good practice.

I have already seen and read the question why do exceptions usually have the suffix exception in the class name

The question is for PHP and while the responses are probably valid for Java. Are there any other arguments or is it really as simple as explicitly differentiating them?

If we take the examples from the previous question - could there really be classes in java with the name FileNoFound that is not an exception? If there could be, does it warrant suffixing it with Exception ?

Looking at a quick hierarchy in eclipse of Exception, sure enough, the vast majority of them do have the suffix of exception, but there are a few exceptions. javassist is an example of a library that seems to have a few exceptions without the suffix - e.g. BadByteCode, BadHttpRequest etc.

BouncyCastle is another lib with exceptions like CompileError

I've googled around a bit as well with little info on the subject.


问:
I need advice developing a sensitive data transfer/storage/encryption system
I got closed on SO and told to post this here as it's about general application design as opposed to specific code.

Intro

I'm currently working on a project which involves the daily extraction of data (pharmacy records) from a VisualFox Pro database, and uploading some of it to a WordPress site, where clients of the pharmacy can securely view it. I would like some advice in terms of the general methodology of my software - I am able to code it, but need to know if I'm going the right way about it. I'm writing both the PC software (in C#/.NET 4.5) and the PHP WordPress plugin. (It doesn't matter much that it's in WordPress, the actual code for this will pretty much run separately).

Question 1: Encryption

The current process for encrypting the data server-side I plan to use is based on this article. Summarised, it advocates encrypting each separate user's data asymmetrically with their own public key, stored on the server. The private key to decrypt this data is then itself encrypted symmetrically using the user's password, and stored. This way, even if the database is stolen, the user's password hash needs to be broken, and even then the process needs to be repeated for every user's data.

The only weakness, pointed out by the author himself, and the main point of my question, is the fact that while the user is logged in, the decrypted key is stored in session storage. The way the article suggests to deal with it is to just limit the time the user is logged in. I thought a better solution would be to store that key in a short-lived secure cookie (of course the whole process is happening over HTTPS). That way, if the attacker has control of the user's computer and can read their cookies, they can probably just keylog their password and log in, no need to steal the database, while even if the attacker gains access to the server, they cannot decrypt the HTTPS traffic (or can they? I'm not sure.)

Should I use secure cookies or session storage to temporarily store the decrypted key?

Question 2: Storage

The second thing I still want to work out is how to store the data - this is more of an efficiency problem. Since every user has their own key for encryption, it follows that records for every user must be stored separately. I don't know if I should store a "block" of data for every user, containing encrypted JSON with an array of objects representing records, or whether I should store records in a table with the actual data structure, and encrypt each data field separately with the key.

I am leaning towards storing the data as one block - it seems to me to be more efficient to decrypt one big block of data at a time, than perhaps several thousands separate fields. Also, even if I stored the data in its proper structure, I still wouldn't be able to use MySQL's WHERE, ORDERBY etc, since the data would all be BLOBs.

Should I store the data as a big block per user, or separated into the different fields?

Question 3: Transfer

I extract the data from the DBF file, and essentially make a "diff", whereby I compare the current extracted data from the last day's data, and only upload the blocks of the users that have changed (I can't only upload the records, as I probably will end up storing the users' data in blocks). I also include "delete" instructions for users which have been deleted. This is as there are hundreds of thousands records in the database, totalling over 200mb, and the size increases every day.

My current plan is to write all this data to a JSON file, gzip it and upload it to the server. My question is, how do I do that while ensuring the security of the data? Naturally, the upload will happen over HTTPS, and I have an API password in place to only allow authorised uploads, but my main concern is how to protect the data if the server is compromised. I don't want the attacker to just grab the JSON file from the server while it's being processed. One idea I had was to get the server to send me a list of public keys for the users, and perform the encryption in my software, before the upload. It seems to me like that's the only way of protecting that data. I could encrypt the whole JSON file, perhaps with an API key or a special password, but that's moot if the attacker can just access the decrypted file as it's being processed on the server. Is that a good solution?

Should I encrypt the data individually client-side, or is there a way to securely transfer it to the server and encrypt it there?

Thanks in advance for any answers, I'd love to hear from someone who's dealt with problems like this before.

Matt

EDIT: I'm pretty decided on 1 and 2 - thanks @Morons. I'll use secure cookies and store data in blocks. My main question is now question 3, would love to get some input on that.

答:
Honestly if you are are storing the data in encrypted blocks what do you need DB for?
(You are right is saying that if you encrypt the entire record it can't be queried in any way)

I would encrypt the File locally in VFP, the upload it encrypted (using the users password), one file per user. I wouldn't even deal with Diffs, I would just upload the entire data set every day. (If data sizes permit)

The have the Word Press access and Decryption that file directly. (Think of the File as the  Code Block)

I don't understand what you are trying to do with the cookies, are you going to time out the cookie while the user is logged in? Then the user will looses all access to his data while he is logged in..


答:
I hope this isn't too blunt, but the task you are undertaking here is extremely difficult, and the odds of you getting it right are slim. Security flaws are most of the time caused by mistakes in implementation, not in the underlying technologies. In order to make a system like the one you've described secure, you have to use the correct tools and the correct methodology  and account for all of the edge cases or the security of the entire system will be compromised.

That's not really a helpful answer though, is it? When you are building a system like you are building the question you should be asking shouldn't be "How do I do this?" It should instead be "What is the way I can do this that relies the least on myself?" The answer to that question is to use tried and tested systems wherever possible, and to roll your own solutions only as a last resort.

To answer your first point about encryption, it doesn't make sense to worry too much about securing a key in memory of the server. If an attacker has enough access to a machine to read your keys out of memory, you are totally and completely hosed and any solutions that you have coded up aren't going to help much any way. In other words, favor securing data at rest and data that is moving over the internet, since that is where most attacks are going to occur.

As far as storing the data goes, I don't see any reason why asymmetric crypto needs to be involved here. I would use something like PBKDF2 to derive a key directly from the user's password, then encrypt the data and store the encrypted blob in a database. I would recommend a database over a flat file because managing a folder full of flat files is tedious at the best of times. Databases may not show any solid benifits in speed or security over flat files, but they come with many other features such as pooled connections and they also make backing up data much easier than flat files. Use the simplest system you can to minimize your attack surface, and use thoroughly tested open source tools whenever possible. If you can find a way to use GPG for the encryption and key derivation part of things, I would recommend it.

As far as transfer goes, I believe that you are thinking about things the wrong way. Don't do any encryption client side. Browser javascript is not suitable for cryptography, as explained in this article. So long as you make sure that you use TLS/SSL for all connections to your site, you shouldn't need to worry about transmitting data unencrypted. For an example of why it is hard to do client side encryption, do some googling about the security of MegaUpload's successor, MEGA.

Finally, I wouldn't trust any one dude you get an answer from on the internet, including myself. I would do a lot of research about this sort of thing before committing to a solution. Also, I might recommend asking this question over at the IT Security Stack Exchange.

-- EDIT --

Somehow, I totally missed the fact that there are three parts to your system, the client (browser), the server (database), and the connector that imports data from the VisualFox Database. This actually makes the whole system a lot more complex, because there are essentially three parties that need to share a secret, instead of two. What I would recommend is not to encrypt the data based on the users password, but to instead encrypt it based on some server password. I'm having a little bit of trouble thinking of a good way to describe this process, so I'll give you an example workflow instead.

Server Side

Admin starts server.

During start up, server code asks for a password.

Server uses PBKDF2 to derive a key which is stored only in memory.

Server spawns a thread that will poll the VirtualFox Pro server every X (days/hours/minutes) for updated data.

Server enters loop awaiting requests from browser clients.

Updating database

Main Server's child thread requests an update of data from the Virtual Fox Pro server.

VirtualFox Pro server dumps a report containing data for client's with modified entries.

VirtualFox Pro server opens secure connection to main server (ssh, sftp, etc) and transmits zipped data.

One by one, the main server uses the PBKDF2 derived key that is stored in memory to decrypt blobs stored in a database, update them with new data, reencrypt them, and store them back into the database. This process should all happen in-memory.

Browser client connects

Main server receives https request from client.

Main server uses some third party authentication framework to check clients credentials. This framework should use bcrypt to hash passwords and only store the hashes on the file system.

If the authentication framework positively identifies a user, the main server will decrypt the user's blob using the PBKDF2 derived key in memory and send the data to the user.

When the user's authentication cookie expires, the main server will stop using the PBKDF2 derived key to decrypt data, and will instead prompt the user to re-authenticate.

This model is more in line with how traditional websites work (which means that you can rely on third party, bug tested frameworks), but data is encrypted/decrypted in memory before touching the database. Ideally, you could use GPG or some other keystore for managing the encryption keys on the main server as well.

Title: I need advice developing a sensitive data transfer/storage/encryption system

Body:
I got closed on SO and told to post this here as it's about general application design as opposed to specific code.

Intro

I'm currently working on a project which involves the daily extraction of data (pharmacy records) from a VisualFox Pro database, and uploading some of it to a WordPress site, where clients of the pharmacy can securely view it. I would like some advice in terms of the general methodology of my software - I am able to code it, but need to know if I'm going the right way about it. I'm writing both the PC software (in C#/.NET 4.5) and the PHP WordPress plugin. (It doesn't matter much that it's in WordPress, the actual code for this will pretty much run separately).

Question 1: Encryption

The current process for encrypting the data server-side I plan to use is based on this article. Summarised, it advocates encrypting each separate user's data asymmetrically with their own public key, stored on the server. The private key to decrypt this data is then itself encrypted symmetrically using the user's password, and stored. This way, even if the database is stolen, the user's password hash needs to be broken, and even then the process needs to be repeated for every user's data.

The only weakness, pointed out by the author himself, and the main point of my question, is the fact that while the user is logged in, the decrypted key is stored in session storage. The way the article suggests to deal with it is to just limit the time the user is logged in. I thought a better solution would be to store that key in a short-lived secure cookie (of course the whole process is happening over HTTPS). That way, if the attacker has control of the user's computer and can read their cookies, they can probably just keylog their password and log in, no need to steal the database, while even if the attacker gains access to the server, they cannot decrypt the HTTPS traffic (or can they? I'm not sure.)

Should I use secure cookies or session storage to temporarily store the decrypted key?

Question 2: Storage

The second thing I still want to work out is how to store the data - this is more of an efficiency problem. Since every user has their own key for encryption, it follows that records for every user must be stored separately. I don't know if I should store a "block" of data for every user, containing encrypted JSON with an array of objects representing records, or whether I should store records in a table with the actual data structure, and encrypt each data field separately with the key.

I am leaning towards storing the data as one block - it seems to me to be more efficient to decrypt one big block of data at a time, than perhaps several thousands separate fields. Also, even if I stored the data in its proper structure, I still wouldn't be able to use MySQL's WHERE, ORDERBY etc, since the data would all be BLOBs.

Should I store the data as a big block per user, or separated into the different fields?

Question 3: Transfer

I extract the data from the DBF file, and essentially make a "diff", whereby I compare the current extracted data from the last day's data, and only upload the blocks of the users that have changed (I can't only upload the records, as I probably will end up storing the users' data in blocks). I also include "delete" instructions for users which have been deleted. This is as there are hundreds of thousands records in the database, totalling over 200mb, and the size increases every day.

My current plan is to write all this data to a JSON file, gzip it and upload it to the server. My question is, how do I do that while ensuring the security of the data? Naturally, the upload will happen over HTTPS, and I have an API password in place to only allow authorised uploads, but my main concern is how to protect the data if the server is compromised. I don't want the attacker to just grab the JSON file from the server while it's being processed. One idea I had was to get the server to send me a list of public keys for the users, and perform the encryption in my software, before the upload. It seems to me like that's the only way of protecting that data. I could encrypt the whole JSON file, perhaps with an API key or a special password, but that's moot if the attacker can just access the decrypted file as it's being processed on the server. Is that a good solution?

Should I encrypt the data individually client-side, or is there a way to securely transfer it to the server and encrypt it there?

Thanks in advance for any answers, I'd love to hear from someone who's dealt with problems like this before.

Matt

EDIT: I'm pretty decided on 1 and 2 - thanks @Morons. I'll use secure cookies and store data in blocks. My main question is now question 3, would love to get some input on that.


问:
spotting graph cycles - simple explanation
could some please help me understand how to find cycles in graphs in laymans terms?

I have read other questions, such as This one and also some of the wikipedia pages, but they seem to descend rather quickly into mathematical jargon.

I have a model of the graph in java, modelling nodes, and 'in' and 'out' edges - and the model knows nodes only connected in one direction, this allows me to find the leaf nodes as a starting point, my plan was to walk back up the graph from each of these leaf nodes, for each "walk", keeping a list of all the other nodes I've found on my route. If I see something already in the list at any point, I'll know I've found a cycle in the graph. This however feels a little simplistic.

I'm sure this is a solved problem, it would just be nice if it could be explained in simple terms.

-ace

答:
The simplest way I can think of to explain spotting graph cycles in layman's terms, is something like this:

First, I assume you know the basics of what a graph is, and what nodes and edges are.  This example assumes that you have a graph in which all edges are one-way only.

Create your graph, and select one node as the starting point.

Create a container object of some sort (a list or hash would work best).  Call it "Visited".

Create a second container object (a queue would be ideal here) and call it "Open".

Add the starting node to the Open list.

Repeat while the Open list is not empty:

Remove the first item from Open and call it Current

If Current exists in Visited, you have a cycle.

If not, add Current to Visited, and then add all nodes that Current can reach from its outbound edges to Open.

If Open ends up empty and no cycles have been detected, then you don't have any cycles. (At least not in the reachable set originating from the starting point, which is not necessarily the entirety of your graph if you have islands in your graph.)


问:
Fixing a push to the wrong branch
I committed and pushed some changes to the wrong branch. I found a way to fix it, but it seems overly complicated. Is this really the easiest way?

on the branch that you made your changes, type hg parent

run hg diff -r <parent> -r <with_changes> > patch.diff

hg up <proper_branch>

hg import --no-commit patch.diff

hg ci -m 'committing changes to proper branch'

hg up <bad_branch>

hg parent to find previous changeset on this branch that is good

hg ci --close-branch -m 'closing bad branch'

hg up <last_good_changeset>

add a space or other minor change

hg ci -m 'making tip'

hg push

Something to that effect anyway. I did it in a slightly different order; I made the good changeset the tip again, and had to do a force commit because it creates a new head, then had to run

```<code>hg heads `hg branch`
</code>```

To find the bad branch again, then close it. Now it still shows the bad changeset as the "tip" because I closed it after I "re-tipped" the good branch, but when updating to that branch, I guess it takes the most recent non-closed head?

Seems like quite a ridiculous process to fix such a simple mistake.

Is there any easier way to do this? Why not?

答:
Is there any easier way to do this?

Yes. hg help rebase: rebase changeset to the new correct parent and push

PS: you have to enable Rebase extension before using command

Title: Fixing a push to the wrong branch


问:
Which approach to follow for developing applications targeting multiple platforms?
For applications targeting multiple platforms, I see mainly two development approaches-

Go for some JAVA-like development platform. Have one code solution and let the intermediate runtime handle different platforms. If something goes wrong in any platform, tweak the code a bit. But keep it same for all.

Make modular code separating core logic and UI. Develop separate UIs for respective platforms which will be calling same core libraries. Build the application separately for each of the target platforms.

So, which one to follow? I know, the answer will start with "It depends". But I want to hear your opinions on these approaches and the factors to be considered to choose any of them.

答:
Do a proof of concept first.

If it's a reasonably complex application, nailing out a proof of concept is going to give you an idea of what language features you need and what areas you're going to need to leverage framework or third-party libraries.

The language features and libraries you need are going to determine what language you'll end up choosing (and thus, how you'll go about approaching cross-platform support)

ContentLicense: CC BY-SA 2.5


问:
How important is understanding the coding behind sorts?
First off, if this is in the wrong place I apologise. I wasn't too sure on which of the Stack Exchange sites to ask it.

I am studying Software Development at university, on a one year conversion course. My main programming language is Java. We have just finished studying searches and sorts. Focussing on the latter in particular, I had a hard time working through the intricacy of the code. Some, like an insertion sort, were obvious enough. Others, like the merge sort, I found extremely tricky to get my head around. I understand totally how they work, I just wouldn't want to implement my own.

I've been told most programmers don't create their own sorts/searches as the built in methods in Java are more reliable and generally faster. However, it's considered good practice to know these sorts.

When I look at a sort like the merge sort, or binary sort, I think to myself that I could never have come up with such solutions. They are too intricate and complicated.

This brings me to my question. Do most programmers use sorts like people use simple Maths formulae, e.g. the area of a triangle or circle, where you apply it almost mesmerically? As a programmer would you put any real effort into trying to develop new, or more efficient sorts? Or if you knew a sort was needed would you simply know which was better through the bigOh notation and then just copy and paste the same thing in, without ever really thinking about the coding behind it?

Note: if this question is not fit for Q&A (I did look at the FAQ and I think it is), please advise me where I could post. Thank you.

答:
Usually you don't have to understand all aspects of the actual implementation of a specific language/library/environment. It is also not a common task to implement those manually as implementations for any environment exist.

By learning the concepts of different search algorithms is a key part of any computer science curriculum, though.  By this students learn many fundamental techniques for any algorithm and algorithm comparison. One also learns different approaches which can be used for other algorithms, too.

Looking at this from a practical purpose: Sorting is a common operation. Knowing sort algorithms helps to pick the best choice at hand. Even though the Java designers have made a good choice for general purpose (I'm, not deep into Java but think they have different implementations and pick one depending on the case ...) but if you know your data you probably might pick a better algorithm.


问:
Apache License and patents
I am trying to understand how Apache License affects patents. In regards to the Apache website http://www.apache.org/licenses/LICENSE-2.0 section 3, am I right to say for the first part that it is saying the licensee is allowed to do pretty much anything with the patent?

In the latter part, is it saying that if a licensor decides to sue someone who is infringing over their patent they will lose all their patents or is it talking about the licensee?

答:
The first part of Section 3 states that all contributors give you, the user, the right to use the software under whatever software patents are in effect, without any further obligations (including license fees).  This applies both individually, where the contributor personally owns a software patent, and collectively, where a combination of contributed works is considered protected by part or all of a patent.

The second part of Section 3 states that, if you, the user of the software, bring suit against anyone who has a patent claim to all or part of the software, your license (and therefore your right to use the software in the manner described in the license) terminates automatically.

Collectively, these two clauses are intended to give you and the project contributors protection against patent problems, by  making such protection a condition of contributing to the project or using the software.

Title: Apache License and patents


答: To be honest, I've been a software developer for more than 30 years and haven't had to write a sort function in at least 20 years. Yes, it's important to understand how they work, but frankly, I can't remember the last time I actually used a sort explicitly, it's generally implicitly done by the libraries or backend you are using.</p>

Title: How important is understanding the coding behind sorts?

Body:
First off, if this is in the wrong place I apologise. I wasn't too sure on which of the Stack Exchange sites to ask it.

I am studying Software Development at university, on a one year conversion course. My main programming language is Java. We have just finished studying searches and sorts. Focussing on the latter in particular, I had a hard time working through the intricacy of the code. Some, like an insertion sort, were obvious enough. Others, like the merge sort, I found extremely tricky to get my head around. I understand totally how they work, I just wouldn't want to implement my own.

I've been told most programmers don't create their own sorts/searches as the built in methods in Java are more reliable and generally faster. However, it's considered good practice to know these sorts.

When I look at a sort like the merge sort, or binary sort, I think to myself that I could never have come up with such solutions. They are too intricate and complicated.

This brings me to my question. Do most programmers use sorts like people use simple Maths formulae, e.g. the area of a triangle or circle, where you apply it almost mesmerically? As a programmer would you put any real effort into trying to develop new, or more efficient sorts? Or if you knew a sort was needed would you simply know which was better through the bigOh notation and then just copy and paste the same thing in, without ever really thinking about the coding behind it?

Note: if this question is not fit for Q&A (I did look at the FAQ and I think it is), please advise me where I could post. Thank you.


问:
When would using a scripting language within a larger program be useful?
I have heard of several situations of people using say, JavaScript or Python (or something), inside a program written in C#. When would using a language like JavaScript to do something in a C# program be better then just doing it in C#? </p>

答: When you have behavior that you don't want to have to recompile the program in order to change. This is exactly why so many games use Lua as a scripting/modding language.</p>


问:
Will the Apache License or the GPL License protect my trademarks?
I'm trying to see if these two open source licenses give protection of trademarks to the originator. I have read both licenses but they only seem to talk about their own trademark i.e. 'Apache'. </p>

答:
In general, trademark protection is a separate issue from software distribution.  Your trademarks are supposed to be already protected under a wide range of circumstances, regardless of any licenses you might use to distribute software or otherwise sell product.

That said, trademark and copyright protection are often re-affirmed in software licenses.  Section 6 in the Apache license does this; it states:

This License does not grant permission to use the trade names,
  trademarks, service marks, or product names of the Licensor, except as
  required for reasonable and customary use in describing the origin of
  the Work and reproducing the content of the NOTICE file.


答:
This technique can be used to implement core logic that is easily portable between different language environments. For example, I have a calculator simulator where all the internal calculator logic is implemented in 100% JavaScript. The user interface code is of course different for each platform:

Web browser (JavaScript)

iOS (Objective-C)

Windows (C++ with Qt)

Mac OS X (C++ with Qt)

Java Swing (Java)

With this arrangement, making versions of my program for different operating environments, and especially keeping them up to date, is much simpler.

Title: When would using a scripting language within a larger program be useful?

Body: I have heard of several situations of people using say, JavaScript or Python (or something), inside a program written in C#. When would using a language like JavaScript to do something in a C# program be better then just doing it in C#? </p>


答: Folks obsess about sorting algorthims for the wrong reasons. The value of understanding mergesort or any other sort isn't simply being able to write your own sort function. Rather it's that sorts provide readily understandable examples of entire classes of algorithms. Mergesort and quicksort are both examples of a general approach called 'divide and conquer'. You probably will never need to re-write mergesort, but if you understand mergesort you have a much better chance of recognizing when a 'divide and conquer' approach can be used to solve problems you do face.


答:
While I've never had to implement a standard sort outside of school, what does come up occasionally are situations where I need an algorithm that is just different enough that I can't use a standard one.  In those situations, I have to figure out the best standard algorithm to start with, and modify it to suit my needs.

For example, I'm currently writing a calculator as a hobby project.  To handle operator precedence, I'm using the Shunting-yard algorithm, but all the implementations I could find assume that the entire expression is available when you start running the algorithm, whereas I need to be able to sort of "pause" in the middle of the algorithm while the user is still in the process of punching buttons.  Not a huge deviation from the standard implementation, but different enough that I had to have a really good understanding of how and why it works.

So, don't stress out about algorithms being difficult, but don't blow off the lessons either.  It will get easier with time.


问:
A better workflow between designer and developer on iOS XIB files development
We're working on an iOS project and right now, and whenever the designer has some feedback about fonts, colors, positions of elements, what images should go where etc., I have to go back and go through each little detail and make sure it's fixed.

I'm thinking there's got to be a better way to do this, where the designer could somehow be directly involved in the application's design.

The first idea I got is to create a global plist (or a per-XIB plist) which contains the details of the different elements (size, font, title color, background image etc.) and just let the designer fill that in, and have a special class that looks over the plist and sets the properties accordingly. If I have the time I might implement this.

Is there some other method of working that saves the developer all that nit-picking designing time?

edit: Or maybe is there some way to do iOS development similar to how CSS works with HTML?

答:
If you are using XIB or Storyboard for development, give the designer access to that and let them modify the UI from there. This is the way we have handled this situation in one of our projects. This is useful, if you dont have much custom UI components and most of them can be set from XIB or Storyboard.

In order for this to work, you have to give access to the SVN location or the location where you have saving the version of your code, so that they can pick it and modify the same.


问:
Should programmers talk with customers / users according to MSF / agile methods?
I've just read two statements that seem to be very different:

Des Weiteren ist mangelnde Kommunikation zwischen Programmierern und Nutzern eine nicht zu vernachlässigende Quelle von unzureichenden Produkten.

Translated:

A lack of communication between programmers and users is a source of poor [software] products.

Source: de.wikipedia.org

I think I have read something similar in CHAOS report of Standish Group.

And

Insbesondere bei der Rolle Development ist Kontakt zum Kunden oder zu den Benutzern nach Meinung des MSF geradezu zu unterbinden.

Translated:

According to MSF, especially the role "Development" should not have contact to the customer or to the user.

Source: msdn.microsoft.com

This also makes sense, because as a programmer I want to have happy end users. So the user likes to have a new feature, I'll try to implement it. This could lead to feature creep.

If I understand it correctly, MSF (Microsoft Solution Framework) tries to avoid this problem by a role that has contact to the customer (this is the product manager, the user experience role and maybe the testing role, isn't it?) and only one role that has contact to the development role (the program manager).

Question 1: How do agile methods deal with the problem of feature creep? I read that the developers should have very strong contact with customers in agile methods and that one of the main problems in using scrum is to persuade the customer to get involved in the process.

Does in SCRUM only the Product Owner have contact with the user / customer? Isn't this a problem, as the programmer might see different problems than the Product Owner?

Question 2: Who does the requirements engineering in agile methods and MSF?

Question 3: Do you validate in MSF / agile methods if your product does what the customer wants and the user needs before shipping it? How do you do it?

答:
This is from an agile point of view

1. Feature Creep
Feature creep in an of itself is not a problem and is in-fact encouraged in agile. The customer should be able to request new features as they occur. The scope should be able to change, and dealing with that change is a main tenant of agile.

Where is does become a problem is if the team has committed to a set of work (ie a scrum sprint) and the requirements change. Hopefully by the time the planning meeting is over the feature is well defined and can be committed to and hopefully won't change in the next 2 weeks. Before the planning meeting the feature should be allowed to change as much as they want.

My view is that the team should be able to absorb a little change during the itteration. If it's just additional work on top of the feature, add it to the backlog. If it no longer makes sense to do the feature, either fit it in or remove the feature all together. If the feature is already done, add the change to the backlog. What ever you do, don't implement a feature that is no longer required. In any case, the Product Owner should be involved as they are the ones who have to "accept" a feature as it's done

A way of limiting scope change is to write good user stories. A good user story clearly states what a feature is about. It is also small (ie < ~2 days of work), so it needs to drastically change for it to have an impact.

2. Requirements Gathering
Agile tends to be pretty quiet on who does the requirements gathering. It could be the Product Owner, developers, BAs or the end users. What is important is that there is a single backlog (program of work) and that it is prioritized by a single person (the product owner). The product owner can get input from others and organise it using any method they like, but the buck needs to stop with him/her.

3. Validation
If you are using an iterative method (eg scrum), the validation is usually done at the end of iteration presentation.
If you are using a continuous method (eg kanban), the validation is done continuously. The task is not done until it is validated.
I usually get my team to regularly pull in the right people and go through the feature with them.

An alternative is to just ship the feature and adjust it based on feedback. You can only do this if you shipping software often (daily->fortnightly).


答:
Real world examples would include:-

Most web browsers which will support embedded JavaScript.

Microsoft Office Suite -- Excel Word etc. all support embedded VBA scripts.

Many network routers include script APIs, in a variety of languages TCL, Perl , Lua.

Many embedded devices are implemented using a very small set of core C functions which are glued together using a scripting language such as Lua. So you have a set of small, fast C functions which interact with the hardware, and, most of the control logic in a flexible, easy to amend scripting langauge.


问:
How bad would it be to obtain a lock on every object?
Imagine a hypothetical programming environment that is largely like Java or .NET, i.e. object-oriented, garbage-collected, etc., but with one small change:

Every time you call a method on an object, a lock is obtained so that no two threads can execute methods on the same object at the same time. The lock is relinquished when the method returns.

The lock is also temporarily relinquished when you call Thread.Join (this is just to prevent certain kinds of deadlock situations).

How severe would the performance impact of that really be? How badly would this interfere with concurrency? Are there any algorithms/programs that it would be impossible to parallelise in this kind of environment?

In my previously posted question, a link was given to this page about the GIL in CPython which claims severe performance and concurrency problems with this. However, it also states that this environment uses reference counting and the increment/decrement of that reference count is an operation that obtains such a lock. Let's not assume that; .NET's GC is mark-and-sweep, not reference-counted.

答:
You would almost certainly ending up single threading everything, because any attempt to multithread would end up in deadlock!

The GIL in Python avoids deadlocks by having a single lock on a single object, a deadlock is simply impossible if only one object is locked.

As soon as you have locks on two or more objects a dead lock situation is possible. A lock on every object would make a deadlock a near certainty.


答:
tl;dr: The impact will depend on how the locks are implemented and how much concurrent access you actually have in your program. This solves SOME concurrency problems, but not all of them, so it doesn't absolve you from understanding and thinking about what's going on in your program.

If we assume a fast-when-uncontested lock implementation, then the impact mostly depends on how much cross-thread interaction you actually have. I don't know about you, but most of my concurrent programming ends up being 'feed values to the other thread' and 'consume values from the other thread' sorts of things - the points of interaction tend to be very narrow.

Off-hand I tend to think it won't be worth the overhead in most cases. You may be thinking that it will save all sorts of cross-thread havoc, but it only solves a portion of the cross-thread interaction difficulties.

If you go with this model, then you have to make sure that ANYTHING you want to do to an object can be expressed as a single call. If you don't, then the object can still be in a weird state, even with the locks.

Consider, for a moment, an object that holds a person's contact details. Assume that we wish to update both the phone number and e-mail address. If you have one method per thing to update (simple setters), then even though these setters have locks, the object can still be in an inconsistent state in between the calls to update the phone number and e-mail.

The only way to safely update such an object is either to have some way to lock the object as a whole (I believe Java does this?), and release it when done, OR to have 'combinatorial' methods that cover any set of simultaneous updates you'll ever want to make.

I'm not saying the technique is never useful, of course. But for average programming problems, I suspect it hurts more than it helps.

Title: How bad would it be to obtain a lock on every object?

Body:
Imagine a hypothetical programming environment that is largely like Java or .NET, i.e. object-oriented, garbage-collected, etc., but with one small change:

Every time you call a method on an object, a lock is obtained so that no two threads can execute methods on the same object at the same time. The lock is relinquished when the method returns.

The lock is also temporarily relinquished when you call Thread.Join (this is just to prevent certain kinds of deadlock situations).

How severe would the performance impact of that really be? How badly would this interfere with concurrency? Are there any algorithms/programs that it would be impossible to parallelise in this kind of environment?

In my previously posted question, a link was given to this page about the GIL in CPython which claims severe performance and concurrency problems with this. However, it also states that this environment uses reference counting and the increment/decrement of that reference count is an operation that obtains such a lock. Let's not assume that; .NET's GC is mark-and-sweep, not reference-counted.


问:
Should you version web applications?
I've recently had a discussion with a coworker about versioning web applications.

I don't think you need it at all, and if you just want a sanity check to confirm your latest release is live, I think a date (YYMMDD) is probably good enough.

Am I off base?  Am I missing the point?  Should I use web application version numbers

答:
Personally I think you should version anyway, but one big benefit of versioning web applications that is specific to websites is that it can make changes to static content much easier to manage.

For example, let's say you have a mysite.css file which has a far future expiry date (which you generally want to do so that it's cached in the browser across each page). If you then change a style in that file no-one who has been to your site before is going to see it unless they do something to clear that file from their cache.

If you're versioning you site though you could change all the css references in your build to something like mysite.css?v=1234 which will let you keep the far future expiry date and not worry about future changes as in the next build it'll be mysite.css?v=1235.

Title: Should you version web applications?


答:
This is a really great question. First of all, I would suggest a variant on your .plist idea. If you don't have one already, create a globally accessible class in which you can declare properties may that change often. For example, you can have a UIColor property for the text color you use throughout the app. When you need to use that color, just reference that property. Then if you ever decide to change the color, you will only have to change that one line in the globals class.

Also, I would be a bit hesitant on opening up Storyboard access to the designer. This is just because Storyboards are notorious for merge conflicts. So if you edit a screen in the Storyboard while the designer changes a tiny element, you're going to have some commit issues. It's much less of an issue if you're using individual .xibs though, because they're more isolated.

Edit: Or at least just try not to edit the same stuff at the same time. Problem solved.

Title: A better workflow between designer and developer on iOS XIB files development

Body:
We're working on an iOS project and right now, and whenever the designer has some feedback about fonts, colors, positions of elements, what images should go where etc., I have to go back and go through each little detail and make sure it's fixed.

I'm thinking there's got to be a better way to do this, where the designer could somehow be directly involved in the application's design.

The first idea I got is to create a global plist (or a per-XIB plist) which contains the details of the different elements (size, font, title color, background image etc.) and just let the designer fill that in, and have a special class that looks over the plist and sets the properties accordingly. If I have the time I might implement this.

Is there some other method of working that saves the developer all that nit-picking designing time?

edit: Or maybe is there some way to do iOS development similar to how CSS works with HTML?


问:
What's the difference between syntax and semantics?
I've always thought that referring to the syntax of a language was the same as referring to the semantics of a language. But I've been informed that apparently that's not the case. What's the difference?</p>

答:
Syntax is what the (lexical) symbols say. Semantics is what they mean.

Consider:

C#: condition ? true_value : false_value

VB.NET: If(condition, true_value, false_value)

-- Different syntax, same semantics.

C#: left_value / right_value

VB.NET: left_value / right_value

-- Same syntax, different semantics (for integers).


答:
Sometimes scripting is embedded in an application because it's a means to extend the host application by other developers. In order to capture as wide a range of programming language skills as possible, multiple scripting languages could be supported by the host. For example, on the JVM, you can embed a whole slew of JSR-223 compliant languages, including Python, Ruby, JavaScript, etc.

Another reason not already mentioned is that the embedded language has one or more standout features which the host language could not easily duplicate. An example of this would be the Parse functionality or effortless DSL (domain specific language/dialect) creation which can be found in a language like Rebol.


问:
What is the relationship between a framework like RoR and a database?
I'm a front end developer...I've never done ANY backend, although I did take a course in databases once. (I have a comp sci degree; I'm a competent programmer, I just haven't done any backend web stuff before.)

So I'm trying to figure out how the framework relates to the database. Presumably they're set up separately, and the framework receives requests from the website and sends them to the database, then receives the response and handles it appropriately to deliver the content correctly? It's basically a complex intermediary for all the web-app logic? Am I far off?

Need a good explanation of this.

答: Presumably, as a front end developer, you know how your Rails controller handles standard HTTP requests. Rails MVP framework also has models. Rails has support for ActiveRecord models. These are basically classes that are linked to some underlining database. In your controller, you can make calls on this model to read or modify data in the database.</p>


问:
Should web service response use a base class or generic class?
In my RESTful WCF web service I have something like the following response object.

```<code>public class WebResponse<T>
{
        public bool Success { get; set; }
        public T Data { get; set; }
        public string ErrorMessage { get; set; }
}
</code>```

This way I can capture any errors that occur during the request to the web service. It also separates the data object from the response object. Another way this could be done is with a response base class like this.

```<code>public abstract class WebResponseBase
{
        public bool Success { get; set; }
        public string ErrorMessage { get; set; }
}

public class CarResponse : WebResponseBase
{
        public string Manufacturer { get; set; }
        public string Make { get; set; }
}
</code>```

I personally prefer the first method as it gives me a clear separation of the data and the response/error status and allows me to easily return lists/arrays etc. without having to create multiple classes.

Are there any benefits to using the base class? Are there any limitations to using the generic class?

答:
The generic response looks effectively clearer, but requires slightly more typing. For example, instead of:

```<code>var response = this.GetCar();
if (respose.Success)
{
    Debug.WriteLine(response.Manufacturer);
}
</code>```

the caller has to write:

```<code>var response = this.GetCar();
if (respose.Success && response.Data != null)
{
    Debug.WriteLine(response.Data.Manufacturer);
}
</code>```

Still, I personally would prefer using generics, since:

It makes it easy to understand what belongs to the protocol, and what is the actual data,

It allows extending or modifying the protocol without carrying for collisions.

Imagine car has Size property. Later, WebResponse should implement Size property to specify the size of the response. Now you have a problem with Car. If data is dynamic, you can't even use your IDE to discover the collisions, and the compiler won't warn you neither.

Also note that according to MSDN, you wouldn't be able to use generics if you want the objects to traverse the boundaries of a context (like in a situation of a sandbox):

The current version of the common language runtime does not support generic ContextBoundObject types or nongeneric ContextBoundObject types that have generic methods.

Body:
The generic response looks effectively clearer, but requires slightly more typing. For example, instead of:

var response = this.GetCar();
if (respose.Success)
{
    Debug.WriteLine(response.Manufacturer);
}

the caller has to write:

var response = this.GetCar();
if (respose.Success && response.Data != null)
{
    Debug.WriteLine(response.Data.Manufacturer);
}

Still, I personally would prefer using generics, since:

It makes it easy to understand what belongs to the protocol, and what is the actual data,

It allows extending or modifying the protocol without carrying for collisions.

Imagine car has Size property. Later, WebResponse should implement Size property to specify the size of the response. Now you have a problem with Car. If data is dynamic, you can't even use your IDE to discover the collisions, and the compiler won't warn you neither.

Also note that according to MSDN, you wouldn't be able to use generics if you want the objects to traverse the boundaries of a context (like in a situation of a sandbox):

The current version of the common language runtime does not support generic ContextBoundObject types or nongeneric ContextBoundObject types that have generic methods.


问:
How can I plan optimization tasks in Scrum?
Recently my Scrum team has received several requests for optimizing certain parts of our code. Looking at the software with a profiler found some spots where the code could be improved.

We agreed to plan mostly based on user stories to ensure that everything we do has actual benefit for an end user, but how would this story be phrased? I can't come up with a good wording for them.

How would we best plan such effort? is there a good way of talking about performance optimizations in terms of user stories?

答:
The decision to word it in user stories is excellent. You've found that if you can't come up with a good story (particuarly the "so that") there may be no value in doing the work?

I agree on making it quantitative, otherwise how can you verify it.

I'd accept these if they reflected the what the users are experiencing:

"so that I don't get frustrated"

"so that I half the amount of time doing x"

"so that I am that little bit happier in the morning"


问:
Could Most Software Companies & Users Benefit From Rolling Versions
Having used Google Chrome now for a couple of years, I've really gotten to like rolling/automatic updates. I know that most modern software has "automatic updates", but many large pieces of software only have "minor version automatic updates", leaving you to pay to for each major version. Obviously, these companies get you hooked with version 1 and then get you to buy each subsequent version since you're often locked in and/or you're used to the product.

Is there a viable business model for "automatic major version updates"?

For instance: "Is there a business model in which Microsoft could just sell Office"?  There would be no version number.  As new features come out, they're automatically added.  How could/would they continue to make just as much money?

答:
Sure, there's a viable business model for "free" updates. Technically, every app in the iOS App Store works this way. There are ways around it, like selling new apps for major versions instead of upgrading the existing one, or including advertising. For many mobile applications, this model works pretty well. However, the iOS App Store also shows what's wrong with the model -- there's more incentive for developers to produce a number of distinct apps than to focus on improving a single app.

Look at it this way: if you were going to pay someone to cut your lawn for the entire summer, would you prefer to pay them a lump sum up front, or a number of smaller payments every week or two? When you pay up front, you're giving away all your bargaining power at once. A week into the deal, the lawn guy already has all the money he's going to get from you, so it makes more sense for him to cut corners on your lawn and spend his time recruiting more customers. On the other hand, if you make periodic payments with the promise that there's more to come, you're both more likely to be happy with the deal -- he gets a regular income and you get a consistently high level of service.

It's the same thing with software. If you think that the $199 that you pay today for the current version of your favorite photo editor (or whatever) is the last money you're going to spend on the product, you're not looking at it realistically. A certain number of upgrades may be built into that price, so you'll enjoy "free" upgrades for a while. In the end, though, the publisher has to pay its staff of programmers, artists, salespeople, and office workers every week or two, so unless the company is in a position to grow its customer base at a constant rate forever, or to realize some other revenue stream from the users (i.e. advertising), you're going to end up paying for an upgrade at some point in the future.


问:
Why do large websites use different languages for the backend and frontend?
My understanding from small MVC applications is that you have the front end, which deals with HTML, JS, jQuery, etc, and you have the back end, which consists of your controllers and models.

However, when I talk to developers from large companies, they often mention having a frontend tier and a backend tier. So sometimes, I might hear that they have a frontend with C# and a backend with Java. Why would any company want a backend and frontend in different languages? Does this help the large website scale better?

When people say that their frontend is built in C#, does this mean that they are using a framework for the frontend (like .NET) and an additional framework on the backend (such as Spring)? Or does it mean something entirely different?

答:
"Front-end" and "Back-end" can be nebulous terms, particularly in enterprise applications. "Front-end" can mean the UI, or it can be the entire application. "Back-end" can be used to mean the internals, or it could be the database or external services that are consumed. What the terms mean often depend entirely who are you talking to. So did you maybe ask "hey, what do you mean by that?"

When you get into large enterprise development, you are going to have lots and lots of teams writing lots and lots of code. These teams will be developing in different languages, using different paradigms, from different locations. Some of this code will need to work together and much of it will not.

I work for a large bank. My team develops our application in C#. All of it. But we consume web services that are largely written in Java, and those services talk to other services that talk to other services that get the account data to and from the appropriate data stores, and who knows what languages are used with those.

Short version: People use the tools that get the job done.


问:
spotting graph cycles - simple explanation
could some please help me understand how to find cycles in graphs in laymans terms?

I have read other questions, such as This one and also some of the wikipedia pages, but they seem to descend rather quickly into mathematical jargon.

I have a model of the graph in java, modelling nodes, and 'in' and 'out' edges - and the model knows nodes only connected in one direction, this allows me to find the leaf nodes as a starting point, my plan was to walk back up the graph from each of these leaf nodes, for each "walk", keeping a list of all the other nodes I've found on my route. If I see something already in the list at any point, I'll know I've found a cycle in the graph. This however feels a little simplistic.

I'm sure this is a solved problem, it would just be nice if it could be explained in simple terms.

-ace

答:
Basically, you do a breadth first search on the graph and keep track of which nodes you have visited using a hashmap.

At any point of time, if you encounter a node that has already been visited(present in hashmap), then you know that there is a cycle in the graph.


答:
I think you need to broaden the question a bit: Why do large software projects use more than one programming language?

There are many possible answers, the most notable ones being:

Large applications consist of many relatively independent parts; often, each part is built by a different team or even a different external contractor. The benefit of going with the best bid is often larger than the benefit of having everything in the same language.

Languages come and go, and sometimes a component of a large system outlives the ecosystem. An example from the Microsoft world is how many companies now use C# for all new projects, but they still have a considerable VB codebase around. The cost of rewriting a project just for the sake of doing it in the latest programming language is practically never justified.

Interfacing with third-party components. If your C# ecosystem needs to perform a specific task for which only Java solutions exist, then you have two choices: implement the solution yourself, or use the Java solution and develop a bit of glue to integrate it into your system. The latter is almost invariably cheaper for any non-trivial task.

Performance considerations are practically never the reason, except in extremely performance-critical applications like high-frequency trading - in those areas, it can be beneficial to write the critical core engine in a language with better run-time performance (say, C++), but the supporting systems (UI, reporting, etc.) in something higher-level like Java or C#.

Title: Why do large websites use different languages for the backend and frontend?

Body:
My understanding from small MVC applications is that you have the front end, which deals with HTML, JS, jQuery, etc, and you have the back end, which consists of your controllers and models.

However, when I talk to developers from large companies, they often mention having a frontend tier and a backend tier. So sometimes, I might hear that they have a frontend with C# and a backend with Java. Why would any company want a backend and frontend in different languages? Does this help the large website scale better?

When people say that their frontend is built in C#, does this mean that they are using a framework for the frontend (like .NET) and an additional framework on the backend (such as Spring)? Or does it mean something entirely different?


答:
In short, where you have large projects, you also have multiple teams of developers working on the project, and those teams tend to specialise on different layers of the application.

If you are focusing on the web UI, and you have flexibility in your choice of implementation, you are much more likely to use a web ui targeted language, such as JScript or Flex, rather than C#.

Likewise, if you are at the transactional data store end of the application, dealing with many concurrent actions at once, specialised languages such as erlang tend to get used. (Or third party products that are implemented in part in these languages)


答:
My specific situation, when I use an interpreted scripting language in a major application:

There is an external device that performs several functions. Measurements, control, readouts. It's pretty "dumb" itself and requires precise control, step-by-step, including lots of wait states and ad-hoc decision making on the control mechanism side.

Various functionalities of the device are required at various points of the main application, at different times, often on-demand. The main app does not allow for wait states as such, everything must be done with finite state machines.

Now whoever wrote a finite state machine knows implementing a wait state is effectively at least two, often three or four internal states of the machine. Implementing twenty wait-states for various functions (and waiting for their responses and reacting accordingly) of the external device would be a very, very frustrating experience.

So, instead there are states of "execute a no-wait function", "execute a blocking function", "execute a branching/conditional/jump" function in the finite state machine, maybe six states total. And there are control scripts that get scheduled for execution, then executed by the interpreter controlling the external device, and their results placed where they are required.

Summing up, the application: in a RTOS, using an internal interpreted scripting language may enormously reduce complexity of performing tasks abundant in wait-states (blocking functions).


问:
What are the major differences when moving from console-based to GUI-based programming?
I started, like many others, with console-based (as in terminal, not Playstation) programming. But sooner or later, one needs to touch upon GUI-based programming, whether you want to or not. This transition holds many changes in how you need to think about the frontend (and possibly also the backend).

So, what are the major differences when moving from console-based programming to GUI-based programming?

答: In some (many?) languages the major difference for me is, that now, you have to choice a library. Doing “console” programming the backbone (and much more, with some luck all) of your application use the standard resources of your language. Adding a GUI you can (hopefully) still have your “model” in standard idioms, but now a huge part, the “view” will depend on some extern library (and, unhopefully, you will stick with it “forever”). The choice of this library is a huge responsibility for a beginner as is your (my) case (not to mention the additional learning-step curve). </p>


答:
We work in a large corporation where our client is our Client Services department and our Product Owner is the head of that department. She has one "under-head" that assists her with everything.

To answer the question of developers talking to the client: In Scrum/Agile the 'client' would be the Product Owner (PO).
It is VERY important for the client to come into contact with the developers working on their product. It helps in Sprint Planning and Backlog Grooming to get the understanding of the developers on par with that of the client. So that what we build is damned close to what the client expects. But sometimes the nature of the client or the environment of the relationship is such that the two parties should rather not talk to each other. In cases like this one would get a Proxy PO who can communicate with both sides. Someone who can still give the developers the personal connection to the 'client' while keeping the client up to date with what is happening with their product.

I will attempt to answer your sub question, of dealing with feature creep, by explaining how we deal with it: With backlog grooming we can learn what the client has added to the backlog and what their priorities are. Here they can add what because in the corporate environment the one product we work on is long term. But if they start adding stuff during a sprint (after we have committed to X-amount of stories/effort points) then we simply size the new work and label it as "unplanned". Unplanned work can be added to the Sprint but then we either remove an equal amount of point from the initial list or we add it as negative points to our Sprint graph. This allows the client to see the impact of their decision on what they wanted for the sprint. Should they not get all the original features or should the original commitment not be met at the end of the sprint it is made clear it was their fault.

This happens but once or twice and then they stop doing it. :) But is does require the developer team to stick to their guns and not let the unplanned work "fall through the crack" and be done anyway.

Title: Should programmers talk with customers / users according to MSF / agile methods?

Body:
I've just read two statements that seem to be very different:

Des Weiteren ist mangelnde Kommunikation zwischen Programmierern und Nutzern eine nicht zu vernachlässigende Quelle von unzureichenden Produkten.

Translated:

A lack of communication between programmers and users is a source of poor [software] products.

Source: de.wikipedia.org

I think I have read something similar in CHAOS report of Standish Group.

And

Insbesondere bei der Rolle Development ist Kontakt zum Kunden oder zu den Benutzern nach Meinung des MSF geradezu zu unterbinden.

Translated:

According to MSF, especially the role "Development" should not have contact to the customer or to the user.

Source: msdn.microsoft.com

This also makes sense, because as a programmer I want to have happy end users. So the user likes to have a new feature, I'll try to implement it. This could lead to feature creep.

If I understand it correctly, MSF (Microsoft Solution Framework) tries to avoid this problem by a role that has contact to the customer (this is the product manager, the user experience role and maybe the testing role, isn't it?) and only one role that has contact to the development role (the program manager).

Question 1: How do agile methods deal with the problem of feature creep? I read that the developers should have very strong contact with customers in agile methods and that one of the main problems in using scrum is to persuade the customer to get involved in the process.

Does in SCRUM only the Product Owner have contact with the user / customer? Isn't this a problem, as the programmer might see different problems than the Product Owner?

Question 2: Who does the requirements engineering in agile methods and MSF?

Question 3: Do you validate in MSF / agile methods if your product does what the customer wants and the user needs before shipping it? How do you do it?


答:
It is relative in a large enterprise.

In my company the stack is roughly

```<code>(html/javascript)--> (JSP on Tomcat and Java based WebCMS) -> (.Net SOA)
</code>```

So for the web development team the frontend is HTML/JS and backend is Java. For the enterprise the frontend is Java and backend is .Net.

In fact the .Net layer has to work with a COBOL/UNIX application for Billing and Claims and so in this perspective .Net is frontend and COBOL is backend.

And yes as others have mentioned we have teams of UX designers, HTML/JS devs, Java devs, Web Middleware, .Net devs, SQL devs, COBOL devs working at each portion of the stack.

In fact in any sufficiently large enterprise it is turtles all the way down.

Body:
It is relative in a large enterprise.

In my company the stack is roughly

(html/javascript)--> (JSP on Tomcat and Java based WebCMS) -> (.Net SOA)

So for the web development team the frontend is HTML/JS and backend is Java. For the enterprise the frontend is Java and backend is .Net.

In fact the .Net layer has to work with a COBOL/UNIX application for Billing and Claims and so in this perspective .Net is frontend and COBOL is backend.

And yes as others have mentioned we have teams of UX designers, HTML/JS devs, Java devs, Web Middleware, .Net devs, SQL devs, COBOL devs working at each portion of the stack.

In fact in any sufficiently large enterprise it is turtles all the way down.


答:
There is one interesting way of using a scripting language inside an application which have not been mentioned by the others yet.

If your host language has a rich, reflective runtime, it is often useful to embed a simple language with REPL in your applications, hook it on a socket and give it an access to the whole system.

It can be used for an interactive debugging (and it's naturally much more powerful than your usual debugger), hot code patching, various monitoring purposes, even backdoors (if you're up to no good).


问:
Combining KanBan in a SCRUM process
Does anybody have an experience in combining KanBan in SCRUM, could this work, would this make sence or would it be an overdesign?</p>

答:
No, it's not an overdesign. But it should be taken in stages. It takes a mature Scrum team to handle the changes that Kanban brings.

In fact, I'll go further. Scrum can work in an isolated team, though not as effectively as if the business buys into it.

Kanban requires that the business be invested in the process, as much as the team, because they need to understand what's going on when you pull everyone's effort off what they're currently assigned to, so that you can clear a column out. And there's simply no point in raising Kaizen if the business isn't absolutely invested in reducing waste.

Google "Scrumban" and you'll find lots of advice on mixing up the two processes, but I found one article on Lean Software Engineering particularly useful.

A problem with the basic index-card task board is that there is nothing to prevent you from accumulating a big pile of work in process. Time-boxing, by its nature, sets a bound on how much WIP that can be, but it can still allow much more than would be desirable.

If a kanban is a token that represents a work request, and our task board can still get out of control, then what is the problem here? The problem is that a kanban is more than just a work request on a card, and putting sticky notes on a whiteboard is not enough to implement a pull system.

Title: Combining KanBan in a SCRUM process


问:
Automation Approaches: Events/Triggers/Cron
It has been my experience, when building websites, that most of the logic of a system is executed when user input is accepted, be it via POSTs, GETs etc.  I would like to know what processes or methodologies exist in Python (leaning towards using Python), PHP, and Ruby that allow web applications to perform tasks automatically without user input.  For instance performing tasks at a certain time or condition or event.  I have no experience with, and little understanding of, triggers, events, or cron, and all of the articles I ran across on google during my searches assumed a high familiarity with those concepts.  I simply desire a description of ways one could go about handling non-reactive processes in a web application.</p>

答:
You have pretty much answered the question yourself: cron jobs are the standard way of doing this.

In PHP, you don't have much of a choice about this: the entire language is built with an execution model in mind where you get a clean slate with each request, and the language isn't very suitable for implementing long-running processes - you can do it, but you have to be very careful about not leaking memory.

In Python, it depends on how you hook your code into a web server; if you use a web server that is integrated into your own code in a long-running process, you can trigger automatic processing directly from there, which means that you don't need cron in those cases. If, however, you follow a fresh-process-for-each-request paradigm like PHP does (mod_python does this IIRC) then you're pretty much limited to cron jobs or similar schedulers.

I don't know enough about Ruby to make any qualified comments, but I assume that the situation is similar to that in Python.

And of course, you can always implement a long-running process outside of your regular website, that just uses the same persistence backend and shares some code; such a process could then implement its own scheduling and even act upon other events. For example, you could set up a process that wakes up when a particular file changes, does some processing, then goes back to sleep. This approach has two advantages:

Since there is only ever one such process, you don't have to worry about race conditions such as those caused by a cron job taking so long that individual iterations start overlapping - your process simply does one iteration at a time.

You can act on events immediately without adding a lot of scheduling overhead. With cron jobs, you have to make a choice between frequent polling (shorter latency, more overhead) and less frequent polling (less overhead, longer latencies), but a process that just waits for a file to change has almost zero overhead while inactive.

It's harder to set up though, and you'll probably want some sort of watchdog mechanism in case the process dies.


问:
Is BDD scalable for medium to large projects?
In every Website you read about BDD (Behaviour Driven Development) you find a very simple nice example showing you how obvious and easy is it to define your requirements. But trying to implement this process in a big product (not a calculator example) showed me that things can get (or will get) pretty complex and unreadable; especially changing requests at a later point means a lot of work to correct the Integration tests for this.

So I'm wondering, is BDD really worth it? Does it solve a problem that other techniques don't!

答:
BDD is a development process based on TDD (Test Driven Development)
Here are some of the pros and cons of TDD drawn from my personal experience:

TDD, makes sure that your scope is well defined. This way, you design your test cases first. Thereby set an expectation for the piece of code you are supposed to write.

TDD is a way of safeguarding your code. Assume you write a simple function and then later you add some complex switching condition in this same function. Tomorrow, if someone else wants to modify this function, he can refer to the test case. If he wants to change  your function, then, he has to change the test case too (most of the times). This allows him/her to understand that there was a reasoning behind what you wrote.

TDD allows for a faster software development. Each of us would have faced this issue while coding. We start off with an idea. And slowly lose track of it. We end up putting unwanted pieces of code to handle some scenarios. In TDD, you set the expectations upfront. Thereby, you restrict yourself from wandering off too far from the objective.

TDD allows you to catch possible bugs before the project goes online. This has mainly got to do with the quality of the test cases which are written.

Cons:

At first, TDD can be a bit tricky. Many people dont understand the concept of a test case driving development.

TDD, sometimes can lead to huge efforts in maintenance. This has got to do with unwanted, or meaningless test cases.

TDD has to be taken with a pinch of salt. No developer likes spending time on some test case written by someone else. Deciphering the meaning of the testcase might sometimes cause a major headache.

I work on a project with more than 900,000 lines of code.
And I still follow BDD.One major thing you need to consider is the number of the possible errors you might catch purely due to the test cases. A few years down the line, you'll be swearing by BDD!


问:
Alternative to simplexml_load_string() function
I am using simplexml_load_string for xml string interpreting to object from results of a REST API. It's working fine in my local server, which is using PHP5. But my hosting is in Yahoo and the service provider is giving me PHP4.

For that I need to change the way of interpreting XML string to object to another method, which I don't know how to do.

答:
PHP4 did had a set of built in XML parsing functions. You start by creating instantiating a parser, then feeding it some data to be parsed, then running another function to extract the parsed data as something such as an array structure.

You will need to do a bit of porting to make this work as it is more complicated than the replacements introduced in PHP5, but it is workable.

That being said, your world would be a happier place and your customer would have a better product if you convince them to move to a host with PHP5. They are currently paying you to make something that will make their lives more difficult down the road, their product harder to maintain and thus more expensive, and exposing themselves to other unnecessary risks.


问:
Is it better to use assert or IllegalArgumentException for required method parameters?
In Java, which is more highly recommended, and why? Both types will throw exceptions, so in that regard handling them is the same. assert is slightly shorter, but I'm not sure how much that matters.

```<code>public void doStuff(Object obj) {
    assert obj != null;
    ...
}
</code>```

vs

```<code>public void doStuff(Object obj) {
    if (obj == null) {
        throw new IllegalArgumentException("object was null");
    }
    ...
}
</code>```

答:
I always prefer to throw IllegalArgumentException over assertions.

Assertions are used mostly in JUnit or other testing tools, to check/assert test results. So it might give false impression to other developers that your method is a test method.

Also it makes sense to throw IllegalArgumentException when a method has been passed an illegal or inappropriate argument. This is more consistent with the Exception Handling convention followed by Java developers.


问:
Using testing branches in Git
We have someone (let's call him Ted) that is responsible for testing new features and bug fixes.

We're using Git and GitHub. master should be/is always deployable and development is where we commit/merge new features or bug fixes, but only after they have been tested by Ted.

The project is in PHP.

I'd like the testing process to go like this:

A developer wants to work on a new feature (let's say the feature/bug #123 as Ted documented in the issue tracker), so he pulls origin/development to development on his local repository and creates a new branch (let's say issue-123) from there.

Once he's happy with his work, he commits and pushes his new branch to origin.

Ted connects to test.ourproject.com/choose-branch and sees a list of the branches on origin and chooses to switch on issue-123 (it should be doable through the webpage). He then goes on test.ourproject.com, tests the hell out of the web application (he's really pitiless) and after some back and forth with the developer, he's happy with the feature.

Ted tells the developer that he can merge issue-123 onto development on origin.

Rinse and repeat.

For the third step, I could hack something that does the job (showing and switching branches from a specific page), but I feel that what I've described is a very common pattern.

So my question is:
Is this a good / sustainable / maintainable workflow for branching? Can you back up your answer by citing some examples of other projects following this workflow?

答:
I am not sure the switching page itself is a common pattern. Most projects probably simply have the tester check it out with git command.

The general approach definitely sounds reasonable.

Google even wrote Gerrit to support similar style; it's more about reviewing the code, but approving integration normally involves both review and testing. Usually it is also interconnected with continuous integration server which builds all the submissions first (I am not sure whether they use Jenkins in Google, but I believe I've seen appropriate connectors somewhere).

Git itself uses a slight variation on the theme. It's maintainer has a script that merges all pending submissions into a branch called pu (for "proposed updates" presumably; the branch is deleted and re-created each time as the pending submissions are often rebased). This is than tested by various people. If it's fine, than the submissions that are considered complete are merged into next (that's the same as your development). If not, than somebody tests the individual submissions to see which one is broken. This makes it a bit easier for the tester since they don't have to switch branches most of the time; they simply report whether the test integration works.

Title: Using testing branches in Git


问:
Any resources or books to build VNC client
I am very interested in network programming and I want to build a VNC client for fun and for learning purposes. I have been Googling for resources about VNC client and server, but most of time, resources found were about how to use VNC not how to build or how it actually works in business layer so I can get an idea about how it could be simulated. Please suggest me any documentation / articles / resources related to this. Thanks in advance.

It is my first post on Programmers Stackexchange site so please forgive me if this question is not appropriate for topic of this site.

答:
This tutorial takes you through the process of implementing the RFB protocol and what nots. It even has diagrams and Github hosted source code. NoVNC is another open source project with Github code. A small swarm of git tutorials is available if you've never used it.

There's also the libVNCServer/LibVNCClient which is C based code for insertion into other things.


问:
Patching open source software when upgrading is not an option?
I recently ran into a rather annoying (confirmed) bug in an open source software package that I have integrated into my application.  According to the public issue tracker this bug has been resolved in the latest release of the software.

Occasionally you NEED that bug fix to avoid an expensive refactor of a particular module, however for technical and/or political reasons, you will not be able to upgrade to the latest release.

On inspecting the code changes made, the fix seems simple enough that I feel a viable option would be to patch the code myself and recompile my current approved version of the software, however detractors want to argue the case that this is nearly always a bad idea in that it is risky and introducing a troublesome complexity.

In their eyes because this code change was done by us solely for our use, it must be part of our code base, meaning that rather than introducing the open source software as a third party dependency, we must introduce it as a new project and incorporate its automated build into our build process.

To me I think this is wrong headed, as we would be pulling their code from their source control repository into ours, and we lose the history behind any code changes that came before that.  Also it just seems like something that is far too complicated for such a small code change that needs to be made.

Would it be a bad idea to do the above in this case?  If so, then what is the ideal situation when open source needs to change, but only for your sole benefit in house?

答:
What you are about to do is a bad idea in the more common case where you bundle third-party software and intend to track their releases. Usually people do that because they want a feature in the third-party component that the maintainers aren't willing to implement, or to implement in the way you need.

You, however, explicitly said that you will not upgrade the bundled code. That makes you effectively the maintainer of the third-party component. Therefore, whether patching it is a good idea or not depends only on whether you understand that code well enough to be confident of the desired effect. Your integration tests should be enough to verify that it is, in fact, doing what you assume. Therefore, as you tell the situation, it seems to me that your reviewers are wrong.


答:
If you can't use a later version that doesn't have the problem you're encountering, the only options you have are to either

live with the problem and find a workaround

fork the library and fix it in your private version (which is what you'd effectively be doing)

throw in the towel and tell your managers that the problem is insurmountable (which would be a lie, as you have two other options open to you).

I've been in your position, option 2 (make a custom fork) is often the most palatable solution available. That's life when dealing with open source libraries, especially ones that evolve quickly and have a bad habit to break backwards compatibility between releases (which in my experience is the most common reason to have to do things like this).

For more than a few OSS libraries it's led me and teams I've been a part of to mandate wrappers around any and all of them and accessing the functionality of 3rd party libraries exclusively through those wrappers. That way, if we need to replace a 3rd party library with a version that's so different it'd break our code, the changes are at least largely confined to that wrapper. It's not the nicest (adds code, can add complexity and cost performance) but sometimes it's the only way to retain your sanity.

Title: Patching open source software when upgrading is not an option?

Body:
I recently ran into a rather annoying (confirmed) bug in an open source software package that I have integrated into my application.  According to the public issue tracker this bug has been resolved in the latest release of the software.

Occasionally you NEED that bug fix to avoid an expensive refactor of a particular module, however for technical and/or political reasons, you will not be able to upgrade to the latest release.

On inspecting the code changes made, the fix seems simple enough that I feel a viable option would be to patch the code myself and recompile my current approved version of the software, however detractors want to argue the case that this is nearly always a bad idea in that it is risky and introducing a troublesome complexity.

In their eyes because this code change was done by us solely for our use, it must be part of our code base, meaning that rather than introducing the open source software as a third party dependency, we must introduce it as a new project and incorporate its automated build into our build process.

To me I think this is wrong headed, as we would be pulling their code from their source control repository into ours, and we lose the history behind any code changes that came before that.  Also it just seems like something that is far too complicated for such a small code change that needs to be made.

Would it be a bad idea to do the above in this case?  If so, then what is the ideal situation when open source needs to change, but only for your sole benefit in house?


答:
I think one of the best resources on BDD is Specification by Example book. It tells a lot about how to organize BDD tests and how they should be written so that they don't cause so much rework when requirements change.

If things get complex or overcomplicated in your tests then probably you are doing something wrong. It is same with BDD and TDD. Writing good tests is hard and it takes months to learn it.

Title: Is BDD scalable for medium to large projects?

Body:
In every Website you read about BDD (Behaviour Driven Development) you find a very simple nice example showing you how obvious and easy is it to define your requirements. But trying to implement this process in a big product (not a calculator example) showed me that things can get (or will get) pretty complex and unreadable; especially changing requests at a later point means a lot of work to correct the Integration tests for this.

So I'm wondering, is BDD really worth it? Does it solve a problem that other techniques don't!


答:
There's really not anything wrong with doing that as long as everyone can stomach the costs, benefits and risks.

...the fix seems simple enough ... to patch the code myself

When you have a job to do, perfect (having a third-party library that's exactly what you want) is the enemy of good enough (patching it yourself), and sometimes you have to do things like that.  I've done a number of projects where we've bought source licenses for commercial libraries so we could fix problems before the vendor got to it.

...detractors want to argue the case that this is nearly always
  a bad idea in that it is risky and introducing a troublesome complexity.

It's a bad idea if you don't have the chops to handle dissecting someone else's code, identifying a problem and writing a fix.  That's true whether the code is in-house or a third party; the only difference is whether it was thrown over a cubicle or building wall before it landed in your lap.

If your detractors are simply brushing the idea aside without weighing the costs of not doing this patch, they're not doing their homework.  If you have a lot of in-house code that's affected by the bug your patch would fix, you'll have to go through and change it to work around it and re-test everything to be sure it works correctly.  Then, should you ever upgrade the package to a bug-fixed version, you may have to find and remove your workarounds and re-test again.  There are risks to doing that as well, like missing a case you changed or insufficient testing.  Personally, if I have the opportunity to fix a bug at its source, I'd much rather do it there than chase around the rest of the code with a flyswatter and hope I get everything.

...code change was done by us ... it must be part of our code base
  ...we must introduce it as a new project and incorporate its
  automated build into our build process.

If you're doing a patch, the patch is part of your own code, which means you have to make it part of your process.  This isn't any different than adding something that's 100% your code to your system.  Treat the third-party distribution as sacrosanct and put it into a module just like it were source code.  Any patches you write are stored with it in separate files and applied as part of the build process.  That way you always go from clean source to patched source to built product and can show exactly what's going on.  (Some folks unpack, hand-patch, re-pack and store that in version control.  That's bad.)

...we would be pulling their code from their source control repository
  into ours, and we lose the history behind any code changes...

If you're treating the third-party library as a third-party dependency, you don't have that history to begin with and you're not losing anything.  If you have continuing access to the third party's repository, you can consult that should you need to.  The third-party releases should be treated like amorphous blobs that you check into your own system unaltered.  If you need to look at changes between the release you're using and later releases, you can do that and, should you want to, come up with patches to the old version that incorporate changes you want.

Also it just seems like something that is far too complicated for
  such a small code change that needs to be made.

If your build process is sufficiently sophisticated, adding this shouldn't be any more difficult than adding your own code.  There's a small amount of labor in getting it to the point where the unpack/patch/build process is automagic, but once it's done, it's done forever.  There may be one bug now, but there could be twenty in the future.  If there are, you'll be much happier that you laid the groundwork to support all of that now, because it will make dealing with the next 19 much less work.