问:
Carpool logical architecture
I'm designing a carpool system (drivers can publish their routes and passengers can subscribe to them) with WebServices(axis2) and Android clients (ksoap2).

I have been having problems with the logical architecture of the system and I wondered if this architecture is fine.

And another question: for that architecture (if it is ok), how would be the packages structure?

I suppose something like that:

(In android)

package org.carpool.presentation

*All the activities here (and maybe mvc pattern)

(In the server)

package org.carpool.services

*Public interfaces (for example: register(User user), publishRoute(Route route) )

package org.carpool.domain

*Pojos (for example: User.java, Route.java, etc)

package org.carpool.persistence

*Dao Interface and implementation (jdbc or hibernate)

答:
Overall, looks good. But I would give some thought to how you are gonna scale this if it's going to be a public system. If you expect very little changes to some of your data (route info) but expect it to be read a lot, you will need a memcached kind of caching solution at the backend. You should also think about write scaling, if you expect a lot of input. </p>

<p>Finally, You should capture your thoughts around your external dependencies for this(google maps? Facebook?). At this level, those assumptions will play a big role in understanding your product placement. </p>

Title: Carpool logical architecture

Body:
Overall, looks good. But I would give some thought to how you are gonna scale this if it's going to be a public system. If you expect very little changes to some of your data (route info) but expect it to be read a lot, you will need a memcached kind of caching solution at the backend. You should also think about write scaling, if you expect a lot of input.

Finally, You should capture your thoughts around your external dependencies for this(google maps? Facebook?). At this level, those assumptions will play a big role in understanding your product placement.


问:
How to cure the "can not deliver"/ "cannot deliver on time syndrome"
I am an above average programmer (I take interest in the development of languages, frameworks and technology in general and have a good grasp of systems), but I constantly find my self not being able to deliver things (on time). This does not affect my day to day work as it has good control process (bite sized tasks with shame driven development) But it definitely hurts me in my personal projects.

Some of the reasons that I think are at play.
-I make things more complicated than they need to be. Often a lot more than I admit to my self.
-I am not very good at making the tasks smaller at times.
-I wander off into obscure corners when I encounter them instead of keeping a laser focus.

The result is often that I don't deliver. Now I may know at the back of my head that what I need to do, but I would appreciate your strategy on how to be the guy who "delivers".

答:
Great advice here - In addition to that, try getting a partner who is interested in the same project as you want to do. Then you can motivate each other and getting things done. It is just like getting a gym partner - it helps a lot in the lean days.

This is exactly why open source projects work - many people who really want to do that thing,  kind of push each other to keep up quality / consistent delivery.

ContentLicense: CC BY-SA 3.0


问:
Code ownership: What should I do when a dev leaves or team splits?
There are multiple ways of tracking code ownership (i.e., collective, team or individual).

In case of team or individual ownership, how do you:

track ownership?

deal with situations when dev leaves or team splits/re-organizes for new projects?

答:
As a team leader, you should always plan for someone leaving / getting hit by a bus. People implement this in many ways: Pair programming / buddy testing and so on. Sole proprietorship in a corporate environment is detrimental to both the company and the developer. The developer can never be promoted because he is too important to move away from this, or worse, could be promoted too high, just to keep him around and will be the first one to be laid off in lean times. Its a lose lose scenario.

Having said that, whenever teams split, I have seen serious knowledge transfer sessions / recorded presentations / documentation touch ups happen.


答:
I have the same problem and have found the following 2 things helped me tremendously:

Do functional specs up front.  Even though it's only you, you don't want to get into a cycle where you keep changing your mind about things.

Use The Pomodoro Technique.  This helps prevent yourself from avoiding the tough stuff with time wasters.

Title: How to cure the "can not deliver"/ "cannot deliver on time syndrome"

Body:
I am an above average programmer (I take interest in the development of languages, frameworks and technology in general and have a good grasp of systems), but I constantly find my self not being able to deliver things (on time). This does not affect my day to day work as it has good control process (bite sized tasks with shame driven development) But it definitely hurts me in my personal projects.

Some of the reasons that I think are at play.
-I make things more complicated than they need to be. Often a lot more than I admit to my self.
-I am not very good at making the tasks smaller at times.
-I wander off into obscure corners when I encounter them instead of keeping a laser focus.

The result is often that I don't deliver. Now I may know at the back of my head that what I need to do, but I would appreciate your strategy on how to be the guy who "delivers".


问:
How to break the "php is a bad language" paradigm?
PHP is not a bad language (or at least not as bad as some may suggest). I had teachers that didn't even know PHP was object oriented until I told them. I've had clients that immediately distrust us when we say we are PHP developers and question us for not using chic languages and frameworks such as Django or RoR, or "enterprise and solid" languages such as Java and ASP.NET.

Facebook is built on PHP. There are plenty of solid projects that power the web like Joomla and Drupal that are used in the enterprise and governments. There are frameworks and libraries that have some of the best architectures I've seen across all languages (Symfony 2, Doctrine). PHP has the best documentation I've seen and a big community of professionals.

PHP has advanced OO features such as reflection, interfaces, let alone that PHP now supports horizontal reuse natively and cleanly through traits.

There are bad programmers and script kiddies that give PHP a bad reputation, but power the PHP community at the same time, and because it is so easy to get stuff done PHP you can often do things the wrong way, granted, but why blame the language?.

Now, to boil this down to an actual answerable question: what would be a good and solid and short and sweet argument to avoid being frowned upon and stop prejudice in one fell swoop and defend your honor when you say you are a PHP developer?.

(free cookie with teh whipped cream to those with empirical evidence of convincing someone —client or other— on the spot)

P.S.: We use Symfony, and the code ends being beautiful and maintainable

P.P.S.: Facebook is written in PHP, compiled to C++ via HipHop and deployed on Hadoop. Here: http://arstechnica.com/business/2012/04/exclusive-a-behind-the-scenes-look-at-facebook-release-engineering/1/

答: There is no short and sweet one-liner you can bust out to convince people of the worthiness of PHP and its developers, but you wrote a very convincing argument right before you asked the question.</p>


答:
Why?

Anyone who makes you feel you have to defend yourself (whether it's career, spouse, spending habits, etc.) is wasting their own time. You taking the time to defend yourself is simply humouring the wrong kind of people - now you're wasting your own time, as well as theirs.

Cut these people out of your life - you're better off without them.

Title: How to break the "php is a bad language" paradigm?

Body:
PHP is not a bad language (or at least not as bad as some may suggest). I had teachers that didn't even know PHP was object oriented until I told them. I've had clients that immediately distrust us when we say we are PHP developers and question us for not using chic languages and frameworks such as Django or RoR, or "enterprise and solid" languages such as Java and ASP.NET.

Facebook is built on PHP. There are plenty of solid projects that power the web like Joomla and Drupal that are used in the enterprise and governments. There are frameworks and libraries that have some of the best architectures I've seen across all languages (Symfony 2, Doctrine). PHP has the best documentation I've seen and a big community of professionals.

PHP has advanced OO features such as reflection, interfaces, let alone that PHP now supports horizontal reuse natively and cleanly through traits.

There are bad programmers and script kiddies that give PHP a bad reputation, but power the PHP community at the same time, and because it is so easy to get stuff done PHP you can often do things the wrong way, granted, but why blame the language?.

Now, to boil this down to an actual answerable question: what would be a good and solid and short and sweet argument to avoid being frowned upon and stop prejudice in one fell swoop and defend your honor when you say you are a PHP developer?.

(free cookie with teh whipped cream to those with empirical evidence of convincing someone —client or other— on the spot)

P.S.: We use Symfony, and the code ends being beautiful and maintainable

P.P.S.: Facebook is written in PHP, compiled to C++ via HipHop and deployed on Hadoop. Here: http://arstechnica.com/business/2012/04/exclusive-a-behind-the-scenes-look-at-facebook-release-engineering/1/


答:
The only answer I have is this: everything sucks.

You can find tons of arguments against OOP being any good (a quick search will reveal them) versus functional or procedural programming. You seem to indicate that PHP's OO support defends it.

Google blank sucks and you will find results for anything.  Python sucks.  Ruby sucks.  Rails sucks.  PHP sucks.  Java sucks.

You want to know what really sucks?  Programmers.  Programmers suck.  Any good developer should be able to create an amazing application, front end and back end, regardless of the language -- even if they were not familiar with the language!  (That is to say, a good programmer should be able to learn and work with any language effectively).

Also note that the success of an application has nothing to do with its code.  I've heard that Facebook code is awful, but by God is it effective.  Same is probably true of Wikimedia (Wikipedia is built on PHP and is also an extremely popular website).  What really matters is results!

PHP is the language that I am personally most familiar with.  I will defend it to the death.  I have worked with PHP frameworks, straight up PHP code, and PHP, python, and ruby (and even Java)  all for web development.  I can't say that one is particularly better than the other.  What matters more is the developers and the algorithms.  I have seen amazingly good and completely awful code in many languages (especially PHP since I have so much exposure).

Now for your question: it depends on who you're dealing with

Businessmen

They care mostly about results and cost-effectiveness.  The fact that the very successful Facebook, Wikipedia, and Wordpress use PHP should be more than enough to convince them that it's an effective language for building successful applications.

Programmers

Let your code speak for itself.  If a developer says that PHP is inferior in some way, show them some PHP code that you believe to be effective.  The proof of the pudding is in the eating.


答:
This is a great time for a code review and adding documentation to the code. Often, programmers will write large chunks of code with the intent to clean it up and make it readable later. Code reviews very much encourage the cleanup and allow others to view and learn the code.

If there is one person responsible for a region of code, have them formally hand off the code to another person -- if possible -- through pair programming, code review, or mentoring. Trouble is, if you haven't done this before you lose a developer, you may never get the chance. This can be a downfall of individual ownership.

Title: Code ownership: What should I do when a dev leaves or team splits?

Body:
There are multiple ways of tracking code ownership (i.e., collective, team or individual).

In case of team or individual ownership, how do you:

track ownership?

deal with situations when dev leaves or team splits/re-organizes for new projects?


答: Don't let yourself start another project until you finish the one you are working on. I end up piling too many things I want to do, that I don't finish any of them. If you get bored, juggle 2 projects.</p>


问:
Are there any ways to track for the visitor of my site , which site visitor come from?
This is a problem  because when I do email campaign,
There is a link on the email, that link to my company homepage,
I would like to differentiate between the visitor come from another way (e.g. search on google) or the visitor come from the email I have sent.

Is it able to check such kind of information ? Thankyou

答:
Use the Javascript `document.referrer.hostname'. Note that it will be null if the user navigated to your page via the address bar, and it doesn't work in IE, so enclose it in a trycatch block.

For different email campaigns, modify their links. So have one email campaign go to yoursite.com/landing.php?campaign=1 the other to yoursite.com/landing.php?campaign=2

To implement all this, create a php/jsp/asp file, landing.php that can record the email campaign. Make a similar bare-bones page, record.php, that records the sitename and IP. On every page of your site, add the javascript code. If the result isn't your sitename, blank, or null, have the JS AJAX-request the page record.php?fromsite=sitename&ip=IPAddress. Or something like that.


问:
Is unit testing or test-driven development worthwhile?
My team at work is moving to Scrum and other teams are starting to do test-driven development using unit tests and user acceptance tests. I like the UATs, but I'm not sold on unit testing for test-driven development or test-driven development in general.

It seems like writing tests is extra work, gives people a crutch when they write the real code, and might not be effective very often.

I understand how unit tests work and how to write them, but can anyone make the case that it's really a good idea and worth the effort and time?

Also, is there anything that makes TDD especially good for Scrum?

答:
Short Answer: Absolutely positively.

Long Answer: Unit tests are one of the most important practices I try and influence at my place of work (large bank, fx trading). Yes they are extra work, but it's work that pays back again and again. Automated unit tests not only help you actually execute code you're writing and of course verify your expectations but they also act as a kind of watch dog for future changes that you or someone else might make. Test breakage will result when someone changes the code in undesirable ways. I think the relative value of unit tests declines in correlation with the level of expected change and growth in a code base, but initial verification of what the code does make it worthwhile even where the expected change is low. Unit test value also depends on the cost of defects. If the cost (where cost is loss of time/money/reputation/future effort) of a defect is zero, then the relative value of a test is also zero; however this is almost never the case in a commercial environment.

We generally don't hire people anymore who don't routinely create unit tests as part of their work - it's just something we expect, like turning up every day. I've not seen a pure cost benefit analysis of having unit tests (someone feel free to point me to one), however I can say from experience that in a commercial environment, being able to prove code works in a large important system is worthwhile. It also lets me sleep better at night knowing that the code I've written provably works (to a certain level), and if it changes someone will be alerted to any unexpected side effects by a broken build.

Test driven development, in my mind is not a testing approach. It's actually a design approach/practice with the output being the working system and a set of unit tests. I'm less religious about this practice as it's a skill that is quite difficult to develop and perfect. Personally if I'm building a system and I don't have a clear idea of how it will work I will employ TDD to help me find my way in the dark. However if I'm applying an existing pattern/solution, I typically won't.

In the absence of mathematical proof to you that it makes sense to write unit tests, I encourage you to try it over an extended period and experience the benefits yourself.


答:
Is unit testing or test-driven development worth while?

Yes it does. Uncle Bob(Robert C Martin) told in a in a presentation;

For a developer to prove that his code is working better to write a test and pass it than shouting , singing or dancing about it.

And since you are not going to delete the test, as long as the test is a pass you are sure that functionality is working - regression issues are solved.

There are a lot of stuff written on it,

You are responsible for making that feature work. Write a test. Just do it.

When to replace Unit Tests with Integration Test

Are SCRUM, Unit testing and TDD related?

Shortly, When you are a master at Unit testing you will be near to TDD. SCRUM has nothing to do with this, but as they say, great things mix up well, these techniques of developing a software adds up into an excellent stack, if you have not tried it yet give it a try.

Is there anything that makes TDD especially good for SCRUM?

As I told above they make a good combination; If you add some automation testing to it, then it is more special.

Title: Is unit testing or test-driven development worthwhile?

Body:
My team at work is moving to Scrum and other teams are starting to do test-driven development using unit tests and user acceptance tests. I like the UATs, but I'm not sold on unit testing for test-driven development or test-driven development in general.

It seems like writing tests is extra work, gives people a crutch when they write the real code, and might not be effective very often.

I understand how unit tests work and how to write them, but can anyone make the case that it's really a good idea and worth the effort and time?

Also, is there anything that makes TDD especially good for Scrum?


答:
It seems like writing tests is extra work, gives people a crutch when they write the real code, and might not be effective very often.

Unit testing has value as a crutch. It supports your development efforts, allowing you to change your implementation without fearing that your application will cease to work as required. Unit tests are also much more than a crutch, as they give you a tool with which you can validate that your implementation matches the requirements.

All testing, whether unit tests, acceptance tests, integration tests, and so on, is only as effective as the people using them.  If you approach your work sloppily, your tests will be sloppy, and your implementation will have problems. So why bother? You bother testing because you need to prove to yourself and your customers that your software works, and hasn't any problems that could prevent the software from being used. Yes, tests are definitely extra work, but how you go about testing will determine how much effort you will need to put in fixing bugs after release, and how much effort your code will require to change and maintain.

I understand how unit tests work and how to write them, but can anyone make the case that it's really a good idea and worth the effort and time?

TDD, and really any method that requires you to write tests before you code takes the approach that you put in an effort early as a down payment on future technical debt. As you work through the project, anything that gets missed, or is not implemented well will incur more technical debt in the form of increased difficulty of maintenance, which directly affects future costs and resourcing requirements. Testing up front ensures that not only have you made an effort to address future technical debt, but also ensures that you encode your requirements in such a way that they can be verified simply by running your code. Test first also gives you the opportunity to validate your understanding of the problem domain before you commit to solving the problem in code, and it validates your implementation efforts.

It really comes down to attempting to maximize the business value of your code.  Code that is largely untested and difficult to maintain is generally cheap and fast to create, and very costly to maintain over the lifetime of the product after release.  Code that has been tested thoroughly at the unit level is generally more expensive to create, but costs comparatively little to maintain over the lifetime of the product after release.

Also, is there anything that makes TDD especially good for SCRUM?

TDD is not specifically good for any particular methodology. It is simply a tool. A practice that you can integrate into your development processes in order to help you to achieve your specific outcomes. So to answer your question, TDD is complimentary to your method, whether it is SCRUM, or any other approach.


问:
Imitating Exchange Server's "RBAC AuthZ" in my own application... (is there something similar?)
Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user.

(Image source)

This is a great & flexible model considering how I can leverage all the benefits of PowerShell, while using the right low level technologies (WCF, SOAP etc), and requiring no additional software on the client side.

(Image source)

Question(s)

Is there a way for me to leverage Exchange's delegation model in my .NET application?

Has anyone attempted to imitate this model?

If I must start from scratch, how would I go about imitating this approach?

答:
The two largest RBAC for .NET are NetSqlAzMan http://netsqlazman.codeplex.com/ and RhinoSecurity https://github.com/ayende/rhino-security

If you end up having to go the route of starting from scratch, you could use either of the above as a starting base.

OwnerDisplayName: Jared Shaver


答:
Exchange is providing a constained runspace, and there aren't actually any cmdlets available in that runspace.  What appear to be cmdlets are actually proxy functions.  Your capabilities in the runspace are controlled by limiting what proxy functions are provided, and what capabilites of each cmdlet are exposed by the proxy function.

Duplicating that would involve developing a routines that populate the runspace with proxy functions tailored to the user requesting the runspace, based on the role groups they belong to.  I don't see any reason AD groups couldn't be as your role groups.

Implementation details would be application specific, but basically it means that you limit who can use which parameters of the cmdlets by choosing which parameters the proxy functions provided to that user will have and/or limiting what values the function will accept for particular parameters.

Title: Imitating Exchange Server's "RBAC AuthZ" in my own application... (is there something similar?)

Body:
Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user.

(Image source)

This is a great & flexible model considering how I can leverage all the benefits of PowerShell, while using the right low level technologies (WCF, SOAP etc), and requiring no additional software on the client side.

(Image source)

Question(s)

Is there a way for me to leverage Exchange's delegation model in my .NET application?

Has anyone attempted to imitate this model?

If I must start from scratch, how would I go about imitating this approach?

OwnerDisplayName: mjolinor


问:
How frequent should the Token Updation in CSRF security be?
To start with the background, this post is what Jeff Atwood says about CSRF tokens. In this very page, he goes on to say:

An even stronger, albeit more complex, prevention method is to
  leverage server state -- to generate (and track, with timeout) a
  unique random key for every single HTML FORM you send down to the
  client. We use a variant of this method on Stack Overflow with great
  success.

But in this post itself, Jeff never remarks about when and how the tokens should be updated.

I was using a similar technique in a web-app I was working on. It works like this:

Whenever the user will POST data to my server, a csrf token is sent along.

This CSRF token is stored in a cryptographically strong cookie in user's session.

If the token is valid, the user's request is processed and vice-versa.

If the request is valid, discard the old token on server side and create a new token. The response from server contains a new csrf token to be used in the next request. The old token on all the forms on a page is updated with the new one so that the next request is processed properly.

Is it wise to update the tokens after ever POST request or should the updation be done only whenever the user makes a GET request and keep the same token till the next GET request is made?

答:
The main point of a CSRF token is that it can't have been sent from another site. So therefore it (a) can't be predicted or detected by an attacker, and (b) is not automatically attached to a request the way a cookie is.

So theoretically if a CSRF token is never disclosed to third parties, again theoretically, you don't have to expire them at all. But then you run the risk of your token getting "leaked" somehow. So your expiry period really should be short enough to combat the prospect of a token getting out and being used against your user.

There aren't really any guidelines, but a good solid techique is to auto-generate a new token on EVERY request which embeds a signed timecode, and then accept tokens up to a certain age.

A sample function might be:

```<code>concat(current_time,salt,sha256_sum(concat(salt,userid,current_time,secret_string)))
</code>```

The token contains timing information and a salt, but also contains a signature which can't be forged and which is tied to the userid.

Then you can define your own expiry interval -- an hour, a day, 2 hours. Whatever. The interval in this case isn't tied to the token, so you're free to set expiry rules however you want to.

At the very least, though, CSRF tokens should expire when the login session expires or when the user logs out. There's no expectation by the user that a form that you brought up BEFORE you logged out will continue to work AFTER you log back in again.

Body:
The main point of a CSRF token is that it can't have been sent from another site. So therefore it (a) can't be predicted or detected by an attacker, and (b) is not automatically attached to a request the way a cookie is.

So theoretically if a CSRF token is never disclosed to third parties, again theoretically, you don't have to expire them at all. But then you run the risk of your token getting "leaked" somehow. So your expiry period really should be short enough to combat the prospect of a token getting out and being used against your user.

There aren't really any guidelines, but a good solid techique is to auto-generate a new token on EVERY request which embeds a signed timecode, and then accept tokens up to a certain age.

A sample function might be:

concat(current_time,salt,sha256_sum(concat(salt,userid,current_time,secret_string)))

The token contains timing information and a salt, but also contains a signature which can't be forged and which is tied to the userid.

Then you can define your own expiry interval -- an hour, a day, 2 hours. Whatever. The interval in this case isn't tied to the token, so you're free to set expiry rules however you want to.

At the very least, though, CSRF tokens should expire when the login session expires or when the user logs out. There's no expectation by the user that a form that you brought up BEFORE you logged out will continue to work AFTER you log back in again.


答:
People think it is extra effort because it is an up front activity. What you lose in time now you gain back later on.

My reasons for unit testing also include:

Gives you a target: You can't write a test if you don't know what the software should do. This helps weed out issues in specifications earlier rather than later.

Gives you a sense of progress.

Warns you if a code change alters the output of other areas of code. That makes refactoring easier.

Provides an additional layer of documentation (especially if you comment your tests properly).

Encourages all sorts of good practices. Because tests should run fast, it encourages you to write code that is decoupled and supports mocking. This all aids refactoring.

There are others as well covered in other posts in this thread. It is worth it.


答:
PHP has a sordid history. It's much better now that it was even a short while ago, but there was a time, a very long time, where a lot of bad practices and patterns were encouraged and difficult to avoid. There is an entire generation of terrible PHP code out there that is still kicking around, and to the extent that new programmers are learning by reading old code, they're learning bad behavior. PHP may not now deserve it's blackend reputation, but it certainly earned it nonetheless.

Your best bet for defending PHP is to carefully distance and distinguish the current state of the art from the history everyone is familiar with. You can say that PHP isn't a terrible language, but if you're talking to someone who's been in the industry for a number of years, their memory tells them otherwise.

Show them how the PHP team has learned from their mistakes and changed the language for the better. Gone are the days of magic quotes and register globals. Gone is the global-everything paradigm, and safe-mode, and mysql_escape_string. Explain to them that real PHP programmers always use namespaces and parameterized queries, they avoid deprecated functions and always put their library code outside the document root.

PHP has changed, and PHP programmers have changed. Which is why PHP is the wonderful platform it is today. Also, it's the only platform that you know your customers will have pre-installed. That's huge.

As a side note, I'd recommend against citing existing CMS engines and frameworks as a big win for PHP. You run the risk of them pointing out things like the Websense security study from 4 days ago showing that 94% of recent website infections were against PHP websites running software like Joomla and Wordpress. That's not the sort of company you want to be seen with. Instead point out that your code will be way more secure than all that other stuff.


答:
All of the code you write needs to be tested at some point. You don't want to write the whole thing all in one go and then hit the compile button and cross your fingers. You write and compile small blocks and send carefully-crafted input at your code to verify that it does what you think it does. Then, you usually delete your ad-hoc testing apparatus and move on to the next component.

With unit testing, it simplifies this process and gives you an excuse to keep your tests around. That way if you make any changes that break the stuff that you'd tested in the past, you can catch that regression explicitly instead of allowing it to affect other parts of your code. There's real value in that.

As for the red-green-refactor approach to TDD, I find that a bit tedious. But to each his own.


问:
Is OO-programming really as important as hiring companies place it?
I am just finishing my masters degree (in computing) and applying for jobs. I've noticed many companies specifically ask for an understanding of object orientation.  Popular interview questions are about inheritance, polymorphism, accessors etc.

Is OO really that crucial?  I even had an interview for a programming job in C and half the interview was OO.

In the real world, developing real applications, is object orientation nearly always used?  Are key features like polymorphism used A LOT?

I think my question comes from one of my weaknesses. Although I know about OO, I don't seem to be able to incorporate it a great deal into my programs.

答:
OOP is not important because of itself, but because of what it takes with it.
Something that deals with the capability to abstract and isolate, group things
together end expose only the parts that are required to interact together.

This is a common engineering technique called "modularization", that allows to
create complex systems as aggregation of simpler ones, without to take care of
every single details at high level, and that require components to be replaceable,
even without them to be exactly the same.

Those "engineering concepts" have been tried to be kept into the software
development from the time software product themselves had become larger than the
"single developer capability", thus requiring a way to make developers to work
on independent pieces, and let those pieces to interact together.

That said, those principles are not necessarily found only in OOP (it the
computation theory is valid, there are infinite possible methods
to come to those results).

OOP is simply a successful attempt to put those things together,
giving to those general terms (like modules, encapsulation, substitution) more
precise definitions and elaborate conceptualization on those definitions
(patterns) that can fit into programming languages.

Think to OOP first not as a "language feature" but as a "common lexicon" that
makes software engineers approach the software design.

The fact that a given language has or not primitives that directly enforce that
lexicon ensuring -for example- that a "capsule" is not opened inadvertently by who is not
supposed to do that is a secondary aspect of OOP design.
That's why even large C project are often "managed as" OOP, even if the language
itself offers no direct support to that.

The advantage of all that is not recognizable until a project size stay into
the single developer capability in understanding and track everything he does
(in fact, in those situation it may be even seen as "overhead") or into a small
group developing something in a short period.
And that's the main reason juniors who studied OOP in term of a "language feature"
often misinterpret it producing bad designed code.

How OOP fits into languages depends on how language designers interpret
the OOP principle in their own construct.

So "encapsulation" in C++ becomes "private members" (and a "capsule" become a class),
"substitution" becomes virtual functions override or template parametrization/specialization etc,
while in D a capsule is a "module" (and substitution goes through classes etc.), thus
making certain paradigm or pattern directly available in a given language and
not in another and so on.

What recruiters seek in asking OOP question is just check your capability to
abstract and concieve software design for future large projects and development.
OOP, for them is just a "dictionary" they supposed both you and them know so that
you can talk about other more general things or concretize into a specific implementation.


问:
Should there be more scientific study of the effectiveness of various hyped-up ideas in software development?
Everyone seems to implicitly assume that the free market of ideas will eventually converge on the "right" solutions in software development. We don't assume that in medicine - we recognise that scientific experiments are needed there - so why should we assume it in software development?

I am not arguing for regulation of programmers. It is far too early to even talk about that. Before healthcare could be effectively regulated, there was a need for scientific experiments to establish which treatments worked and which didn't.

Software engineering doesn't even have this scientific evidence base to back up touted methodologies such as Scrum or Agile, or programming paradigms like functional programming or MDA. As

(a) large software projects are responsible for many government project failures (with the UK government being a really good example)

(b) Agile and Lean are being used outside of software development, including in the public sector [of course, Lean originated outside of software development]

this is increasingly politically relevant. Government project failures may be influenced by a failure to use a best practice, or even by using something that is considered by some people to be a best practice, but which actually makes things worse, or just costs money without really helping very much.

The question is, why is this scientific evidence base (for all intents and purposes) nonexistent?

There is a large open source community from which research participants could be drawn. My fear is that the closed-source and in-house software developers would treat with suspicion any research based on this community, fearing (perhaps rightly) that the results would not translate over. And companies that develop closed-source and in-house software would probably not be willing for their developers to participate in any scientific studies. For one thing, it would probably take time away from getting work done; for another, the results could be embarrassing to the company or to senior managers.

答:
Wouldn't that be great if there were. This would probably come from the universities, but they're battling the problem of not producing programmers who know what they're doing when they graduate. Do we see them as teaching theory and doing research or doing technical job training. If you can't demonstrate graduates get jobs, enrollment/money drops. The money for research has to come from somewhere. You'd think the less technical business managers would be interested in funding the research, so they could use it to base decisions. Applying scientific research in business is just scratching the surface.

The medical profession is a good analogy. When someone graduates from medical school (theory and research), they're not ready to be practicing doctors. They do internships and a residency for several years and possibly go into specializations. This happens at the hospitals. Companies that hire jr. devs need to understand they are still "practicing" programming and require mentorship and training. This could free up the CS departments to devote more time to researching the latest and greatest.

A lot of programmers are in jobs where they don't get to consider the hyped technologies whether there's any data to support them or not. Unlike switching a patient's prescription, rebuilding legacy applications may not be cost effective. How much time does a doctor invest in learning about the new drug compared to what it would take a programmer to learn a new platform or language?

What do we expect the research to tell us? If you fully understand a technology, apply it properly in the right situation, it will work the best. We're in a specialized industry. Yes, your product is as good as you've "hyped" it, but I can't hire enough devs that know how to use it and most projects don't have enough time for learning new things.

ContentLicense: CC BY-SA 4.0


问:
Why such popularity with Python?
Other than being annoyed at whitespace as syntax, I'm not a hater, I just don't get the fascination with Python.

I appreciate the poetry of Perl, and have programmed beautiful web services in bash & korn, and shebang gnuplot.  I write documents in troff and don't mind REXX.  Didn't find tcl any more useful years ago, but what's the big stink about Python?  I see job listings and many candidates with this as a prize & trophy on their resumes.

I guess in reality, I'm trying to personally become sold on this, I just can't find a reason.

答:
It's elegant and really easy to learn, and once you're familiar with its basic types (especially lists) your productivity has no limit. It's perfect for prototyping algorithms, or for writing them in a pseudocode-like language that can eventually put directly on a machine, and it's really good as a scripting language for doing repetitive jobs or perform annoying operations on files. I use it as a glue language for making subprocesses communicate with each other: not as powerful as bash for some easy tasks, but WAY easier if you need to do more than just a single line of code.

And then it doesn't distinguish between functions and subroutines, you know what I mean.

ContentLicense: CC BY-SA 2.5

Title: Why such popularity with Python?


问:
Suggestions to manage semi-structured email bounces?
The company I work for sends a lot of emails, and in return we get a lot of bounces.

We currently don't have a good way of sorting them and help us archive the routine ones while putting the important ones in front of human eyes.

From a format of view these email bounces are not well structured, but there are some sort of patterns.

There is a preliminary system that is being worked on but it is becoming an unmanagable collection of complicated regular expressions.

I convinced my company to let me take home a portion of the bounces, and I am hoping to find a better way to handle them in my free time. It's both an opportunity to learn something interesting and do something valuable.

How would you approach this problem? Is there a class of methods or algorithms that are a good fit for this situation?

Thank you.

答:
Four words:  Bayesian Classifier with scoring.

Bayesian Classifier:  Since you have a large set of data where you know the "correct" outcome (i.e., archived or seen by humans), you can use it to provide initial training for the classifier.  As a test, you can run each item through the set and see if they're classified properly, then run a batch of unknown items and see how the classifier does on them.

Once you're feeding humans the classified items, it's important to adjust the system they use so there's a mechanism to provide feedback when the classifier made the wrong decision:

Seen by a human but should have been archived

Archived but should have been seen by a human (Use random spot checks of the archive to achieve this if things are never fished out of the archive to be human-processed.)

...or when it made the right decision (these should be implicit if you get no feedback on an item):

Seen by a human and should have been seen by a human

Archived and should have been archived.

Bayes classifiers need to be trained with both kinds of information, and get pretty good at being right as positive and negative examples pile up.

Scoring:  This is probably what you're doing now with regular expressions and is where you integrate all of the human expertise that a classifier can't handle.  Each item starts with a score of zero ("neutral") and each matched rule pulls it in a positive or negative direction depending on whether the rule means the item should be archived or seen.  One of those rules should adjust the score based on what the classifier returns, applying a negative score for probabilities in [0.0,0.5), zero for 0.5 and a positive score for values in (0.5,1.0].  Once you get a handle on how well the classifier does, you can adjust the magnitude of the score adjustment based on where in the ranges the probability falls.  Another thing you can do is lower the threshold for being seen so a bigger range of probabilities around the center (the "not sure" range) will be screened and you'll be able to collect feedback that will make the classifier better able to make decisions that fall out of that range.

Implementation:  The good news is that you don't have to develop all of this yourself.  Since you're working with email, SpamAssassin can do nearly all of the grunt work for you and is ripe for adaptation to fit your application.  (With some clever re-packaging of the data, you can use it for applications that don't involve email, too.)  All you need to do is tear out all of the built-in rules and substitute your own set.  One of SpamAssassin's other handy features is that it can add reporting on what it matched directly to the headers of each item.  That gives you the ability to use the feedback you collect to find what rules are most often involved in misclassifications and adjust them accordingly.

Side note:  For applications that require classifying things n ways, run each bit of input through multiple filters and pick the one that returns the highest score.


问:
How to minimize typos when you code?
I make a lot of typing mistakes when I program. I have a good keyboard writing speed but I try to write faster and in the process end up making typos.

I want to type faster, but make less errors. Can I do something to improve the situation?

答:
Simple: Slow down ;). You probably make typos because you try to type as fast as you think, or try to type code as fast as possible. The only way to reduce the amount of typos you make is to practice; slow down your typing, until you actively think about every key you hit - and never make a mistake again. Speed up from there. Slow down when you make typos again.

(Note: This is not my answer, it's how I learned to drum: slow down so you can actively think about which foot / arm to move next. Repeat until it becomes a natural / automated motion)

Title: How to minimize typos when you code?


答:
There are decent libraries of research into software development projects. Just take a look at the IEEE Computer Science Digital Library and the ACM Digital Library for two examples. More specifically, the IEEE Transactions on Software Engineering and ACM Transactions on Software Engineering and Methodology present academic and industrial research into various aspects of software development, ranging from tools through methodologies and paradigms. In addition, IEEE Software is more of a magazine format that presents relevant topics and information in a easier to digest format for professionals "in the trenches", so to speak. So there is research out there.

However, one of the biggest problems is variation in the software industry. Projects depend on so much - domain, knowledge and skills of the people involved, process methodology, the choices made at various phases of the project (from the technology to use to the system architecture and design - there are often many good choices). It becomes very difficult to look at projects and generalize information in such a way that it is both scientifically valid and useful across the majority of projects.

Your comments about cost and embarrassment are also probably true, at least in some organizations. Organizations pay their engineers to product shippable products. From what I've seen, the majority of the research involving commercial products involves three things: a description of the technique before some change, a description of some technique after a change, and the impact of this change. Going back to embarrassment, some companies aren't going to publish reports that say their productivity decreased or their defects increased and analyze why this happened. Instead, they are going to tend to show off techniques that improved the organization and discuss why. However, in science, the failures are just as important as the successes, especially when something that didn't work on one project can be improved or adopted and work extremely well on another project.

Title: Should there be more scientific study of the effectiveness of various hyped-up ideas in software development?

Body:
Everyone seems to implicitly assume that the free market of ideas will eventually converge on the "right" solutions in software development. We don't assume that in medicine - we recognise that scientific experiments are needed there - so why should we assume it in software development?

I am not arguing for regulation of programmers. It is far too early to even talk about that. Before healthcare could be effectively regulated, there was a need for scientific experiments to establish which treatments worked and which didn't.

Software engineering doesn't even have this scientific evidence base to back up touted methodologies such as Scrum or Agile, or programming paradigms like functional programming or MDA. As

(a) large software projects are responsible for many government project failures (with the UK government being a really good example)

(b) Agile and Lean are being used outside of software development, including in the public sector [of course, Lean originated outside of software development]

this is increasingly politically relevant. Government project failures may be influenced by a failure to use a best practice, or even by using something that is considered by some people to be a best practice, but which actually makes things worse, or just costs money without really helping very much.

The question is, why is this scientific evidence base (for all intents and purposes) nonexistent?

There is a large open source community from which research participants could be drawn. My fear is that the closed-source and in-house software developers would treat with suspicion any research based on this community, fearing (perhaps rightly) that the results would not translate over. And companies that develop closed-source and in-house software would probably not be willing for their developers to participate in any scientific studies. For one thing, it would probably take time away from getting work done; for another, the results could be embarrassing to the company or to senior managers.


答: Compared to Ruby, which is really cool and produces amazing Code Golf-offs, Python has this core philosophy that "There should be one - and preferably only one - obvious way to do [things]," meaning the idiomatic Python way. I have found this to be a huge advantage compared to Ruby.</p>

Title: Why such popularity with Python?

Body:
Other than being annoyed at whitespace as syntax, I'm not a hater, I just don't get the fascination with Python.

I appreciate the poetry of Perl, and have programmed beautiful web services in bash & korn, and shebang gnuplot.  I write documents in troff and don't mind REXX.  Didn't find tcl any more useful years ago, but what's the big stink about Python?  I see job listings and many candidates with this as a prize & trophy on their resumes.

I guess in reality, I'm trying to personally become sold on this, I just can't find a reason.


问:
The application I wrote is listed as malware. How to fix it?
I have a program that I wrote in Delphi. The program is available for download, but some antivirus like Norton detects it as malware, while other antivirus, like AVG, has no issues with it.

Moreover, Google Chrome also gives a malware warning when you want to download the program from my website.

Is there some way to prevent this, apart from putting the EXE file in a ZIP file?

答: You should try to contact Norton's (Symantec's?) customer service. I believe this is standard practice among vendors of legit programs which are wrongly flagged as viruses.</p>


问:
What benefits does embedding resources into the source/binary provide?
I have 300-500 images and other files that my program uses. I realize I have two options:

Save them in a binary format such as BMP which is loaded dynamically.

Save them in a C source file such as XPM which allows it to be compiled into the program, but it also can be loaded dynamically.

Assuming both are just as easy to implement and I don't require dynamic loading, what are benefits of each method?

How would the loading/startup speed compare?

答:
With the first choice you possibly decrease memory footprint (by loading only what you want), but if it will ever show up depends on the OS you use — if the OS mmaps the executable, you'll probably get nothing.

With the second one you save yourself a little bit of deployment hassle. Also, if you're going for a portable distribution stored on a flash stick, a single file is much quickier to read at once than hundreds of small ones.


答:
Most of the time I find developers are resilient to the idea of writing tests. It's not so much that they will argue tests have no value but rather that they are merely a means to figure out how to solve a particular problem. Usually this problem changes based on the context. Once that is done then the tests serve no purpose and might as well be deleted.
Here's a sample of contexts my colleagues have given in the past on how to decide when to write a test and you'll find the only possible answer according to them is never:

the problem at hand must be a text book example for TDD such as a stack or a calculator

trivial code should not be tested (invalidates previous argument)

critical or difficult code should be thoroughly tested (implied by previous argument)

tests should not be thigtly coupled to the implementation to allow for sweeping refactoring (invalidates previous argument)

testing for side-effects such as calling a third party service with a specific payload is not necessary (so no black box testing)

Actually there is one type of testing which I have found is generally accepted and which I believe is ultimately useless. Namely GUI based testing such as by using selenium, webdriver, watir or arquillian. This is how we get the 7 hour build cycles rather than the 5 minute build cycles on my TDD projects.

These same devs usually complain with everybody else how bad the code is and how incompetent the previous devs must have been. They also find it extremely important you make a proper design using a whiteboard, MS office or a wiki and take great care to ensure this design remains up-to-date.

That last one is what really got me to realise such devs are frauds.
We all know any design document which is not a unit test will become outdated and will not be kept up-to-date because of the sheer maintenance cost to do so.
In fact I've tried and tried to come up with a good means to express design ideas in MS office format which was useful and legible both before and after the fact of writing code. I failed in all cases and though there are people who manage to produce an MS office document which appears pretty I've never actually found those useful either.

So, you have a choice.
You can do design and documentation by practicing TDD which is the only known and proven method for producing such documentation based on my 10 years of development experience.
Or you can go into politics.


答:
In order to address the "PHP is a bad language", you have to figure out why the individual in question thinks it's a bad language. Maybe (s)he worked on a bad project written in PHP. Maybe (s)he just doesn't like prefixing their variables with $. Maybe they themselves have attempted to use the language and written unmaintainable mess. Many programmers coming from other programming languages see PHP and see a mess, because what makes sense in PHP does not really make sense in other language or on other platforms. For instance, in PHP, arrays are the "duct tape of the universe", and are used to accomplish pretty much anything, while in other programming languages such a thing would be absurd.

I would suggest a combination of the answers here.

As tylerl said, you have to show that modern PHP is significantly better than it's older cousins. Gone is the nastiness of create_function. Gone is the jungle of calling include manually everywhere.

Acknowledge that there are faults in PHP. There are faults in every programming language. Saying otherwise will make many serious programmers completely ignore your response as being a "fanboi".

Show people things that are easy in PHP that are difficult in other programming languages. Programming languages are designed to make some tasks easy, which necessarily makes other tasks hard. C? Memory manipulation and bit hacks are really easy, and the language is really simple, but maintaining large applications is hard. Java? Doesn't have free, and everything is "OO-ish", but the runtime is large and OO can be limiting. C++? Lets you make types that behave exactly like primitive types (e.g. int) in the language, but that comes with large amounts of complexity. PHP? Makes it really easy to start off without much programming knowledge, but as a result has lots and lots of garbage code posted on the internet.

Acknowledge non-language advantages of PHP. There are still many things in PHP, as a language that can be... annoying to work with. But it's easy to configure, easy to deploy, and comes with a large set of great libraries that you can "plug in" to without much additional work.

There's a place for every language. Choose the language to suit the problem at hand, don't try to shoehorn a preferred language into places where it does not belong.


答:
Also remember,

You will need a rebuild of your program every time you change an image (This is prior to release).

Editing / previewing the image is crazy hard when it is embedded in your program.

Program bloat.I would argue this forces the OS to load the entire program when some images aren't necessary - but this is very OS implementation dependent.

Localization / having multiple versions per your customer needs is a pain when you embed.

Title: What benefits does embedding resources into the source/binary provide?

Body:
I have 300-500 images and other files that my program uses. I realize I have two options:

Save them in a binary format such as BMP which is loaded dynamically.

Save them in a C source file such as XPM which allows it to be compiled into the program, but it also can be loaded dynamically.

Assuming both are just as easy to implement and I don't require dynamic loading, what are benefits of each method?

How would the loading/startup speed compare?


问:
What is the best way to INSERT a large dataset into a MySQL database (or any database in general)
As part of a PHP project, I have to insert a row into a MySQL database. I'm obviously used to doing this, but this required inserting into 90 columns in one query. The resulting query looks horrible and monolithic (especially inserting my PHP variables as the values):

```<code>INSERT INTO mytable (column1, colum2, ..., column90)
VALUES
('value1', 'value2', ..., 'value90')
</code>```

and I'm concerned that I'm not going about this in the right way. It also took me a long (boring) time just to type everything in and testing writing the test code will be equally tedious I fear.

How do professionals go about quickly writing and testing these queries? Is there a way I can speed up the process?

答: Your scenario looks like a very good fit for a NoSQL solution, since the attribute list can change anytime the format changes. Have you evaluated other options than MySQL? Dig around DynamoDB/MongoDB/Cassandra - that might be a better fit.</p>


问:
How to tackle massive Linux/makefile projects effectively?
I have been developing Windows applications in C++ for like 10 years now. And recently I've started digging into some Linux projects, and I can't stand how unproductive I am...

I'm a fast learner, and I've been using Linux as a primary platform for some time now. And I do feel very comfortable with shell, OS principles and GUI. But when it comes to development, it feels like I'm back to school.

As soon as I open some larger project, I'm stuck. Most of them are makefile based, so basically when I try to navigate them with QT or CodeBlocks, at best, I can use intellisense on a per-file basis. And most of the time variables leak from scope.

Then there is a go-to-definition stuff, which seems nonexistent, try to join some larger project from sourceforge, and you're stuck for days, because navigating to definitions is so hard... grep -r "this_def" . --include "*.cpp" --include "*.h" seems so slow and clumsy.

And then, the debugging, gdb does work, but no matter what I do, it seems like it's light years behind WinDbg or VisualStudio debugger.

And these things are making me desperate, I want to write code, but it just goes so slow... I'm starting to think that Linux developers learn function definitions by heart and analyze code by eyes, but I can't believe it's so.

Has anyone gone through this? Is there something that I'm missing that could make me more productive?

答:
Great answers. Adding to them,

When I made this move, the mistake I did was trying to jump into the code without giving the due diligence to the GNU build system, which came back to bite me when I wanted to make code changes. Spend the couple of days it takes to understand how AutoMake/AutoConf/Make suite of tools work, you will be very quick after that.

Regarding tools - Eclipse + CDT / GDB + DDD goes indeed a long way.


问:
How much extra time is needed to add unit test in a development task?
My team is considering moving to test-driven development. Currently we have almost no unit testing, we have been only relying on the user acceptance test, and developer's own manual test. Not everyone have agreed with this proposal. In the team, no one really has an experience on unit testing, so it's hard to convince everyone the benefit of doing it. One of the objection is the time needed.

My question is, how much extra time is usually needed to add unit test, relative to the task itself? Let's say if the coding of a task (excluding acceptance test) takes half a day, how much time will the unit test take, in average? This estimation is important for us to explain the relative benefit of doing unit test, and to adjust our planning.

If it matters, we are mostly working with .NET desktop application (with a GUI and a database), and it is not safety-critical (I mean, it's not for a nuclear power plant or stuff like that). Also note that none of us have experience, so there will be a learning curve

答:
My experience has been that unit tests don't add much time; they save implementation time, in fact. If you write your code to be testable, you tend to write clearer, more modular code that you feel more confident is correct. You also end up with tests that prove correctness in the cases you've tested and demonstrate how you intend your methods to be called.

You stated that no one on your team has a lot of tesing experience yet. There will be some ramp up time before everyone feels confident in the tools and what makes a good test. On the team I work with, it took about two months before all of us fully understood how to split code down into testable chunks. The biggest challenge we had was learning to leave seams in our classes so that external dependencies, like database managers, could be injected for testing. The results were well worth it though - we ended up with a clear pattern of keeping database connection details separate from the code requiring them. Should we ever need to change our DB scheme, we've been able to limit the affected areas down to a single layer. Not only that, but all references to the DB can be found quickly using our IDE.


答:
Here's some advice to get it working easier:

Start from the beginning. This means you'll use bash script as a makefile replacement first, and then simple makefiles once you need dependencies. Keep it simple at the beginning. Your makefile does not need to handle 15 different unix platforms -- just make it compile with dependencies. (your initial makefile is going to look like: all: g++ -o main main.cpp) (more complex example can be found from http://sivut.koti.soon.fi/~terop/Makefile -- when starting from scratch, just copy the file to the project, change filenames, mkdir objs directory, change libs you want)

Forget the IDE. It's only going to make you slower. Learn to read the code and remember the file hierarchy of your project. Normal commandline tools like 'cd dir' and 'emacs foo.cpp' needs to be so automatic that you don't think twice typing it.

Forget syntax highlighting and intellisense. It's never going to work the same way it works on visual studio, and the hints its giving is only going to confuse you since it's different from what you've used to. Learn to not rely on them.

Gdb is a good debugger. You'll get a call stack. Do not even try to step around the code, it's not going to work very well. Use valgrind too. Breakpoints are good too, but don't rely on them too much; only rarely used with gdb.

If your compilation is anything else than simple 'make' in the shell, you need to rethink your edit-compile-debug-edit -cycle.

Here's a trick that visual studio cannot do: Show both header file and .cpp file on the screen at the same time -- so that both are visible without flipping between them with tabs. Emacs can do it. So can notepad. Visual studio or IDE cannot.

Learn emacs keybindings. It's going to make you faster. A nice hint is that all the keys are located very near in the keyboard. The command sequences are longer, but it's still faster to type them.

There is easy trick to replace go-to-definition: write the code to same file, and use esc-< and C-s ::myfunction in emacs to find the function you want. The process is different if you've used to many short files - your code is going to look different. (learn ctrl-f in notepad, and you'll get the idea). But you definitely do not need to do it in shell.

Text editor startup time is very important. If it takes longer than 1 second to open it, it's no good. Every IDE is broken because of this requirement. Notepad and emacs are ok.

goto-line in emacs is important feature for programming. Bind it to some key. I use C-x g

Title: How to tackle massive Linux/makefile projects effectively?

Body:
I have been developing Windows applications in C++ for like 10 years now. And recently I've started digging into some Linux projects, and I can't stand how unproductive I am...

I'm a fast learner, and I've been using Linux as a primary platform for some time now. And I do feel very comfortable with shell, OS principles and GUI. But when it comes to development, it feels like I'm back to school.

As soon as I open some larger project, I'm stuck. Most of them are makefile based, so basically when I try to navigate them with QT or CodeBlocks, at best, I can use intellisense on a per-file basis. And most of the time variables leak from scope.

Then there is a go-to-definition stuff, which seems nonexistent, try to join some larger project from sourceforge, and you're stuck for days, because navigating to definitions is so hard... grep -r "this_def" . --include "*.cpp" --include "*.h" seems so slow and clumsy.

And then, the debugging, gdb does work, but no matter what I do, it seems like it's light years behind WinDbg or VisualStudio debugger.

And these things are making me desperate, I want to write code, but it just goes so slow... I'm starting to think that Linux developers learn function definitions by heart and analyze code by eyes, but I can't believe it's so.

Has anyone gone through this? Is there something that I'm missing that could make me more productive?


问:
Is it a good idea to do UI 100% in Javascript and provide data through an API?
My primary day job is making HTML applications. With that I mean internally used CRUD-type applications with lots of editable gridviews, textboxes, dropdowns, etc. We're currently using ASP.NET webforms, which do get the job done, but the performance is mostly dismal, and quite often you have to jump through hoops to get what you need. Hoops which are hung from the ceiling and set aflame.

So I'm wondering if it perhaps would be a good idea to move all UI to the JavaScript side. Develop a strong set of reusable controls which are tailored specifically to our needs, and only exchange data with the server. Yes, I like the "control" (aka "widget") paradigm, its quite well suited to such applications. So on the server side we would still have a basic layout simliar to our current ASPX markup, but that then would get sent to the client only once, and the Javascript part would take care of all the subsequent UI updates.

The problem is I've never done this before, and I've never seen anyone doing this either, so I don't know what the problems would be. In particular, I'm worried about:

Performance still. Benchmarking shows that currently the main delay is on the client side, when the browser tries to re-render most of the page after an AJAX update. ASP.NET webforms generated markup gives a new meaning to the word "web", and the rich Devexpress controls add their own layer of Javascript complexity on top of that. But would it be faster to recalculate all the necessary changes on Javascript side and then update only what needs to be updated? Note that I'm talking about forms that have several editable gridviews, lots of textboxes, many dropdowns each with half-a-zillion filterable items in them, etc.

Ease of development. There would be a lot more Javascript now, and it would probably mix with the HTML markup of the page. That or some kind of new view engine would have to be produced. Intellisense for Javascript is also a lot worse than for C# code, and due to the dynamic nature of Javascript it can't be expected to get a lot better. Coding practices can improve it a bit, but not by much. Also, most of our developers are primarily C# developers so there will be some learning curve and initial mistakes.

Security. A lot of security checks will have to be done twice (server-side and UI-side), and the data-processing server side will have to include a lot more of them. Currently, if you set a textbox to be read-only on server side, you can depend on its value not changing through the client roundtrip. The framework already has enough code to ensure that (through viewstate encryption). With the data-only approach, it gets harder, because you have to manually check everything. On the other hand, maybe security holes will be easier to spot, because you will have only data to worry about.

All in all, will this solve our problems, or make them worse? Has anyone ever attempted this, and what were the results? Are there any frameworks out there that help in this sort of endeavor (jQuery and moral equivalents aside)?

答:
The team I'm in decided to migrate to ExtJS late 2008. We had at that point a 200.000 line PHP app that suffered from front-end issues. Our situation was much worse than yours, because we had a handrolled form controls framework that was really bad, and we had heavy use of iframes to load sections of the page (the visual architecture dated back to 2005, and the team wasn't aware of ajax that early on). We had to refactor the code anyway, so this made it easier to decide to heavily rearchitect the codebase to be primarily client-side.

Today the app is 300.000 lines, of which 60.000 lines are extjs code, and roughly 3/4th of the functionality has been migrated to ExtJS. The extjs code is all a single-page app, but it still embeds some legacy forms inside iframes. We ported over the navigation container first, and then migrated the different feature areas piecemeal. With this approach we managed to slipstream the extjs migration into the regular feature dev process, without slowing us down too much.

Performance

The ExtJS code proved much faster than the legacy code. The old code was ofcourse really bad performance-wise, but even so we're happy with the results. The UI code is all static javascript, so it caches really well (we're in the planning stages of throwing it on a CDN). The server is not involved in the front-end rendering, which reduces the workload there. It also helps that ExtJS provides a lot of control over the lifecycle of UI (lazy rendering, easy unloading of invisible UI elements). Typically once the code is bootstrapped (on-demand loading architecture) most of the load time of a screen is spent in the web service call to fetch the data. The ExtJS grid is really fast, especially when using buffered views for rendering the visible rows on scroll.

Ease of development

To be honest, this one is a mixed bag. ExtJS is a DSL, it's not really web development in the traditional sense. It took our developers a long time to really learn the framework's API, and I don't see this curve being any less steep on other client-side frameworks. Everyone on the team must be a "senior" javascript developer (as a rule of thumb, crockford's book should hold no secrets). We suffer from bootstrapping issues with new developers, because client-side expertise is not as widespread as you would think, and extjs expertise is almost nil (in Belgium, where we are located).

On the other hand, once you are up-to-speed, the dev experience is very nice. ExtJS is very powerful, so if you're in the groove you can whip up amazing screens very quickly. IDE-wise we use PHPStorm, which I've found to be competent enough with ExtJS code.

Security

Security is one of the main reasons to do client-side UI. The reason is simple: attack surface reduction. The web service API's used by our ExtJS code are a much smaller attack surface than a server-side UI layer is. OWASP's ASVS specifies that you should validate all input on the server for correctness before using it. In a web services architecture, it's obvious and easy when and how to do input validation. I also find it easier to reason about security in a client-side UI architecture. We still struggle with XSS issues, because you're not absolved from encoding to HTML, but overall we're much better about security than we were on the old codebase. ExtJS makes it easy to do server-side validation of form fields, so we don't suffer much from having to write code twice.


问:
How do you find time to work on Open Source Projects?
A bit of background: I've got a small open source project that I've started on, a basic framework which provides an object oriented means of generating HTML code (since I don't really like HTML, and I do like PHP). It has some released source, and a few downloads, but primarily, the project is for me, with the Open Source portion just being a side benefit.

The original project which caused me to be able to develop on this project has mostly gone into hibernation for the time being, which means that all the development I get to sink into it at this point is personal time only. Unfortunately, I'm currently working toward my bachelor's degree, studying for certifications, and I have a three month old baby at home. In short, by the time I get around to "me time", I rarely feel like doing work, but rather usually feel like just chilling out.

So, if there's anyone else out there who feels like they're in a similar position, what strategies have you used to keep yourself motivated toward working on the project? I would really like to at least be able to work on this until I have 100% spec coverage, but I haven't committed source in months. Anyone out there who can help?

答: It depends upon how important the open-source project is in the grand cosmic scheme of things. If the project involves creating trivial screen-savers, you just work on it haphazardly now and then whenever you are too bored to do anything else. If it is a project like http://code.google.com/p/mindforth for creating true artificial intelligence that will bring on a Technological Singularity, then you need to organize your entire life and all available nanoseconds in service to your Grand Challenge Open-Source AI Project.</p>


答:
To all the rest of the good advices that you already received, I would like to add a couple of links, respectively to
ack and pss. </p>

<p>They are aimed at programmers who have to specifically care about source code, trying to improve over grep. </p>

Body:
To all the rest of the good advices that you already received, I would like to add a couple of links, respectively to
ack and pss.

They are aimed at programmers who have to specifically care about source code, trying to improve over grep.


答: In general, I'd say that it's pretty much impossible to draw any meaningful real-world scientific conclusions because every (non-trivial) software project is unique and software development is, by its very nature, non-deterministic. So I don't think scientific studies would give much useful information.</p>


答:
In case anyone is interested, this article treats a similar case with a program that's just a do-nothing WinMain function - The Case of Evil WinMain.

Story about how a third of all antivirus programs has gone crazy for no obvious reason...

```<code>#include <windows.h>

int WINAPI WinMain(HINSTANCE inst,HINSTANCE prev,LPSTR cmd,int show) {
    return 0;
}
</code>```

...

So what caused additional antivirus software vendors to go NUTS?

I am starting to feel that they simply started to search for malware in libc itself. If so then that's kind of strange because there is not that many versions of libc linked to nearly everything under the sun over and over.

Here is the mentioned VS 2008 ProjectFile + source + resulting binary not doing anything along with vtotal results for it.

But please go ahead and create an EMPTY C++ project to see it yourself.

Add a cpp file with this empty winmain doing nothing build release ...

Title: The application I wrote is listed as malware. How to fix it?

Body:
I have a program that I wrote in Delphi. The program is available for download, but some antivirus like Norton detects it as malware, while other antivirus, like AVG, has no issues with it.

Moreover, Google Chrome also gives a malware warning when you want to download the program from my website.

Is there some way to prevent this, apart from putting the EXE file in a ZIP file?

Body:
In case anyone is interested, this article treats a similar case with a program that's just a do-nothing WinMain function - The Case of Evil WinMain.

Story about how a third of all antivirus programs has gone crazy for no obvious reason...

#include <windows.h>

int WINAPI WinMain(HINSTANCE inst,HINSTANCE prev,LPSTR cmd,int show) {
    return 0;
}

...

So what caused additional antivirus software vendors to go NUTS?

I am starting to feel that they simply started to search for malware in libc itself. If so then that's kind of strange because there is not that many versions of libc linked to nearly everything under the sun over and over.

Here is the mentioned VS 2008 ProjectFile + source + resulting binary not doing anything along with vtotal results for it.

But please go ahead and create an EMPTY C++ project to see it yourself.

Add a cpp file with this empty winmain doing nothing build release ...


答:
Errors found earlier is less costly to fix than errors found later. TDD helps you verify the correctness of your system. You invest a little more up-front, but get it back later. The graph is a bit exaggerated , but it shows the idea well.

Image Source


问:
Agile development : How to design your code for an iteration / Sprint?
In Agile development you work on small user stories and produce a working iteration.

But what happens when the next user story comes in and affects the design for the already done iteration?

Sometimes it seems like re-doing the last iteration or another user story to incorporate the new user story in the last iteration!

How to approach on this?

答:
I'm handling it like this*:

Build your code in small modules. If the modules are independent, you'll never need to modify existing code. New task=new module.

Avoid intersection of old code and new code.

Replace empty lines of code with new code.

(do not refactor)

(only write perfect code - no modifications needed later)

(make adding new modules as easy as possible. If it takes longer than 1 minute to add a new module, it's broken)


答: Something to keep in mind:  It might really be infected.  There is a virus out there that infects Delphi itself.  If you're infected with it any executable that Delphi produces will be infected.</p>


问:
Any Code Review tool with direct connection to CVS?
I've found many Code Review tools:

Phabricator (by Facebook) - http://phabricator.org/

Rietveld (by Google) - http://code.google.com/appengine/articles/rietveld.html

GitHub - https://github.com/

Crucible - http://www.atlassian.com/software/crucible/overview

GitLab - http://gitlabhq.com/demo.html

SmartBear - http://smartbear.com/products/software-development/code-review

etc.

But didn't found any, which would be directly connected with the versioning system.

As I want the code review proccess to be required, so nobody can push any single line of unreviewed code to master, I need my versioning system to deny all pushes of revisions which were not reviewed yet.

Is there any tool which does that? Or is there any easy way how to do that?

答:
I'm not familiar with the other tools, but Facebook accomplishes this with Phabricator by installing pre-commit (SVN) or pre-receive (Git) hooks. Phabricator ships with some example hook actions:

arc svn-hook-pre-commit: https://github.com/facebook/arcanist/blob/master/src/workflow/svn-hook-pre-commit/ArcanistSvnHookPreCommitWorkflow.php

arc git-hook-pre-receive: https://github.com/facebook/arcanist/blob/master/src/workflow/git-hook-pre-receive/ArcanistGitHookPreReceiveWorkflow.php

However, the open source versions of these hooks (especially the Git hook) aren't in great shape (most OS Phabricator users host on GitHub, where you can't install pre-receive hooks, and Facebook's internal hooks are more complicated, so we haven't had too many requests to modernize/improve them), so they're more like templates than working solutions right now.

These hooks also go farther than requiring code review: they block commits which raise lint errors, to (for example) reject changes that introduce syntax errors. (This occurred routinely at Facebook.)

Generally, with any code review tool, you should be able to write a fairly simple hook to verify reviews (you can consult your VCS's documentation on hooks for details), so you might be best off selecting a review tool based on other features and then hooking up integration afterward if it doesn't ship with anything.


问:
How to break the "php is a bad language" paradigm?
PHP is not a bad language (or at least not as bad as some may suggest). I had teachers that didn't even know PHP was object oriented until I told them. I've had clients that immediately distrust us when we say we are PHP developers and question us for not using chic languages and frameworks such as Django or RoR, or "enterprise and solid" languages such as Java and ASP.NET.

Facebook is built on PHP. There are plenty of solid projects that power the web like Joomla and Drupal that are used in the enterprise and governments. There are frameworks and libraries that have some of the best architectures I've seen across all languages (Symfony 2, Doctrine). PHP has the best documentation I've seen and a big community of professionals.

PHP has advanced OO features such as reflection, interfaces, let alone that PHP now supports horizontal reuse natively and cleanly through traits.

There are bad programmers and script kiddies that give PHP a bad reputation, but power the PHP community at the same time, and because it is so easy to get stuff done PHP you can often do things the wrong way, granted, but why blame the language?.

Now, to boil this down to an actual answerable question: what would be a good and solid and short and sweet argument to avoid being frowned upon and stop prejudice in one fell swoop and defend your honor when you say you are a PHP developer?.

(free cookie with teh whipped cream to those with empirical evidence of convincing someone —client or other— on the spot)

P.S.: We use Symfony, and the code ends being beautiful and maintainable

P.P.S.: Facebook is written in PHP, compiled to C++ via HipHop and deployed on Hadoop. Here: http://arstechnica.com/business/2012/04/exclusive-a-behind-the-scenes-look-at-facebook-release-engineering/1/

答:
I think it may also be useful to understand the other side of the coin, and recognize PHP's shortages. While PHP has advanced a lot from being a template language, there are still many things that could be improved. There are some points where PHP is still lacking: Unicode, functional features, the organization of the standard library, the array and so on.

What I suggest is that - in order to make a constructive discussion about PHP strengths and weaknesses - it could be good to acknowledge all this. "Yes, I know that PHP standard library is not very organized. But if it was written today, it could make use of namespaces and object oriented APIs". "Yes, I know that the default array makes a little mess by mixing dictionary and array structures. But if one wants some better collections, one can make use of the SPL".

Your point of view will result stronger if you show that you know that the other people's arguments have some reason.


答:
PHP is the COBOL of the web. Both languages get no respect, yet many people make their living building and maintaining systems written in them, and they are present in volume in almost every major computer system for their native world (i.e., the web and commercial business respectively).  Both languages are looked down on by practitioners of other, more popular, languages, based largely on old and obsolete habits practiced by programmers who have since learned better and improved their tooling.

PHP should be so lucky, that it lives COBOL's life.  COBOL has been around longer than anything but FORTRAN, and it isn't going away any time soon.  There are plenty of COBOL programs in daily use that are older than the people maintaining them.  It may not be "the new hotness", but there will always be money to be earned working in and with it.


答:
I have moved entirely to GIT from CVS for all but large legacy systems where the cost to migrate is not worth it. This is largely as a result of the improved tool support and work flow. To all practical purposes, CVS development stopped a long time ago, and the third party tool support for modern features followed soon after, you have always had to role your own bespoke systems with CVS, whereas with GIT, Mecurial etc, theres a lot of off the shelf stuff that just works (provided you want to do it the way the tool chan does).

The CVS systems we used had a large amount of custom code around workflow and Config managment attched. These amounted to years of development effort, as CVS alone didn't cut it. In fact the only cvs command we used directly was 'cvs checkout'.  The lack of tool suuport such as you are asking for is a large reaosn for the move.

Depending on your circumstanse, would it be possible to move to GIT for all developer workflow, use Gerrit for code review, and then push the reviewed code to the CVS repo?

Title: Any Code Review tool with direct connection to CVS?

Body:
I've found many Code Review tools:

Phabricator (by Facebook) - http://phabricator.org/

Rietveld (by Google) - http://code.google.com/appengine/articles/rietveld.html

GitHub - https://github.com/

Crucible - http://www.atlassian.com/software/crucible/overview

GitLab - http://gitlabhq.com/demo.html

SmartBear - http://smartbear.com/products/software-development/code-review

etc.

But didn't found any, which would be directly connected with the versioning system.

As I want the code review proccess to be required, so nobody can push any single line of unreviewed code to master, I need my versioning system to deny all pushes of revisions which were not reviewed yet.

Is there any tool which does that? Or is there any easy way how to do that?


问:
Need to test .properties one by one in every possibility?
For example, there are some key-value configuration in .properties file. Such like someFeatureEnable=true. It must be bool type value which will be parsed by framework, in my case it's typical Java Spring configuration. Spring will handle the configuration and throw Exception when users set someFeatureEnable=123.

My question is: if there many properties in .properties file, Is it worth testing them one by one? It's quite troublesome and low priority. The .properties file is always configured by tech administrator stuff. Limited chances that they will mess up the configuration.

Thanks!

答:
If a property is trivial (i.e. it merely returns a value), no, I don't write a unit test for it.

Instead, I rely on the unit tests that prove that the framework parser works, and unit tests that prove that the code that depends on the property settings works.

If there is a problem reading the properties (because one is misspelled, perhaps), it will show up somewhere else in the testing chain (most likely in the integration tests).


答:
The philosophy that the Benevolent Dictator should enforce his idea of good style[1], his idea of good programming, his idea of how to program frustrates me regularly. I don't think like van Rossum. However, his language resists attempts to express non-van Rossum thoughts.  His thinking works really well for many (most?) programmers. But I seem to not fit into his model of how to program.

That is why I believe Perl is a superior language.

[1] See his blog about removing reduce.

Title: Why such popularity with Python?


答:
It's difficult to provide a definitive answer without better understanding the development processes that you usually use, the experience of your team, and more importantly, the complexity of the tasks at hand. To this I should also probably add the way in which you generally write your methods and the design choices you have made.

Unit testing always adds time to the development, and if you are testing your code properly, then you should be spending more time writing tests than implementation code. This sounds quite horrendous at first and is probably one of the main reasons why many choose to avoid unit testing in the first place.  Even in my present workplace, it took me more than 4 years to convince everybody that their concerns over testing overheads were only as a result of not fully understanding the longer term benefits.

In the shorter term, and particularly when you first start unit testing, you find that your development time slows down considerably. This is a necessary learning period.  You'll find most developers will be selective about where they apply unit tests, or will write their code first, and apply tests after the implementation is essentially complete.  In doing so, they will find bugs, which will require a change in the implementation code, requiring a subsequent change in the tests.  This will prove to be a very counter-productive process, and will make most developers wonder why they bother if they are always playing catch-up with the tests. The real epiphany will come when your developers start to code complete tests before writing the implementation code, because the resulting code will most likely be more concise, and will be much quicker to write.

An advantage of the test first approach is in the fact that the test will indicate the implementation code works at the exact moment that the code is written to satisfy the conditions of the test.  Further, if the implementation code has been kept relatively concise it will likely be easier to modify with the tests, providing you with the real advantage of testing first, which is the assurance of a system that will identify the exact moment when the code has been modified to include an error. Modifications to code are much easier with supporting tests already in place, which significantly reduce your maintenance overheads and make debugging efforts much less onerous.

When you are very comfortable with unit testing and test first, then you will find that your estimates for tasks will become easier to make, and won't be messed up by lengthy and unexpected delays caused by bugs and the subsequently difficult to estimate debugging effort, as you will find that the majority of your potential bugs will have been dealt with simply by focusing your development efforts around testing. Where you may have previously found yourself dealing with a lengthy debugging process during the user acceptance testing period, you should in future find the post-implementation debugging phase, and user acceptance tests taking much less time.

So the real issue then becomes less about how much additional time testing adds, and more about a trade-off between the longer time to implement verses the shorter post implementation time spent debugging and maintaining your product, and also about how your test suite will benefit you when it comes time to change any part of your code base. More importantly, how all of this translates into a real and measurable value to your business.  As a very rough example of what I am talking about, when my team first started seriously writing unit tests, I took some measurements relating to bug issues and time to develop modules for our product, and I added in a comparison between the amount of time working on new developments versus maintenance issues.  Before test first unit testing, our maintenance efforts were triple the development efforts, whereas on those projects where we had moved entirely to unit testing first (and after a few months of experience), our effort expended on new development work is greater than the effort expended on maintenance. This amounts to a measurable saving with a real dollar value attached.  It means that the team has been able to take on more work without needing to expend more cash and juggle resources.

How this will exactly translate into your own working environment is difficult to predict specifically, and I can only recommend having a couple of people act as method champions and work in a test-first manner for a while to get a real feel for how it will fit within you working environment. One suggestion would be to do a little experimental development.  Have a couple of people work on a couple of similar tasks (or duplicating the same task if you can afford to allocate the time) for a short while and see what the difference is in terms of time to implement vs time to debug after completion, and conduct code reviews to examine code quality issues as each task progresses. Give it a little time, and see whether your teams objections diminish or become stronger.

Personally, I can't think of any real reasons why you shouldn't be unit testing, however I don't work in your particular environment so I can't really speak for you, and at the end of the day unit testing is merely a practice. It's a tool that if used well can provide you with great results, yet if the entire team is unable to use the tool, or if the use of a tool results in a pattern of failures within a team, then perhaps that tool isn't right for you. The only way you can know for certain is to try it and see for yourselves.

Title: How much extra time is needed to add unit test in a development task?

Body:
My team is considering moving to test-driven development. Currently we have almost no unit testing, we have been only relying on the user acceptance test, and developer's own manual test. Not everyone have agreed with this proposal. In the team, no one really has an experience on unit testing, so it's hard to convince everyone the benefit of doing it. One of the objection is the time needed.

My question is, how much extra time is usually needed to add unit test, relative to the task itself? Let's say if the coding of a task (excluding acceptance test) takes half a day, how much time will the unit test take, in average? This estimation is important for us to explain the relative benefit of doing unit test, and to adjust our planning.

If it matters, we are mostly working with .NET desktop application (with a GUI and a database), and it is not safety-critical (I mean, it's not for a nuclear power plant or stuff like that). Also note that none of us have experience, so there will be a learning curve


问:
Ubuntu, OpenSuse, the world of linux for a web-developer
I'm learning web development. My main OS is windows 7 but I've used Linux and currently dual-booting with Ubuntu. My Linux knowledge however, is pretty limited. I can work with the command line on simple tasks but that's pretty much it. I don't do any shell scripting, don't know very well the most important commands, nor the system in general.

I am interested in web development. Should I get myself familiarized more with Linux ?  Is it a must for future job positions considering my field of interest?

答: It is not a must, but certainly an advantage. Most servers run some kind of linux/unix, so it will help you there. I would recommend that you do it, and maybe you even will prefer it over windows after a while :)</p>


问:
Is a company order to switch to a certain IDE a red flag?
I recently joined a rapidly growing startup. In the past 3 months the development team has grown from 4 to 12.  Until now they were very laissez-faire about what developers used to do their work. In fact one of the things I initially found attractive about the company is that most programmers used Linux, or whatever OS they felt best suited their efforts.

Now orders, without discussion, have come down that everyone is to switch to Eclipse. A fine editor. I prefer SublimeText2, but it's just my personal taste.

Just to be clear: we are a JS team using Backbone and Eclipse just isn't good at understanding Backbone code.  This means that those on the team who use a /good/ IDE (PHP Storm), have to go back to doing a lot of search-find-oh-wait-where-was-I-three-steps-ago kind of things instead of just ctrl+clicking and using back/ forward - probably diminishing productivity by say 15% and enjoyment by 50%...

Is this a red flag? It seems capricious and unreasonably controlling to tell developers (non-MS) what IDE or tool-sets to use if they are already settled in and productive.

答:
If you are using maven or something similar, it shouldn't matter which IDE you are using. There might be cases where one is tied to a specific IDE like eclipse, if there are plugins you rely on.

I think you should be able to choose your own IDE, the IDE you are most productive in. However, as I already stated there are cases where it makes sense to use a standard IDE.