问:
What kinds of Open-Source licenses are NOT OK to use internally in a corporation?
I have recently learned about several cool open source add-on tools and libraries for Microsoft Visual Studio. The tools just help you be more productive; the libraries would get linked into the corporate code base.

I have listed all these cool tools and libraries on a spreadsheet and I'm going to run down the type of license each one is under. So far, amongst my cool libraries, I see MIT, BSD, Apache License Version 2.0. However, there could be more in the future.

How can I find out (or better yet, can you just list) the popular licenses which are NOT compatible with internal corporate use (not to be distributed outside the company)? And for an extra thank you, can you say or point to an explanation. I'm not a lawyer and reading the fine print of these licenses gives me a headache.

I want to be prepared to explain why using the allowable licenses is OK.

答:
This depends a lot on context.

If you want to use any open source software you are free to.

If you want to use any open source software for the basis of internal company projects then you are also free to ( since the more contagious licences like the gpl require you to provide the source code upon request to all who the compiled code is distributed to, if it's a internal application then this is a non issue )

If you want to used open source software for the basis of a product then you have to follow the licence carefully ( get your company lawyers involved for this ) and if the licence is infectious then you may have to make your source code available to all those who receive the compiled code . In some cases this is acceptable ( for example writing a custom product for a single customer who owns the source code anyway ) in others this is not ( for example a product which is sold to the general public with a "trial" version available for anyone )

But to answer your question directly lgpl and gpl are perfectly fine for internal corporate use.

Since I can download nedit, or gnu, change it to my hearts content without the need to make my code public, and then use it myself there is no difference to me doing so for my employers own internal use.


问:
Beginner Facade Pattern Example
I came across this article: http://didawiki.cli.di.unipi.it/lib/exe/fetch.php/magistraleinformatica/tdp/dp-l10a-facade2014.pdf

At the end, it has a question asking:

One common problem experienced by software development teams who use the Façade Pattern occurs when the Façade class is used to represent the entire system on which the team is working.
  A team of 20-30 people sends every method call to the system through the Façade, with each team member making several changes to the system per day.

Because of the heavy dependency on the Façade class, however, the team’s schedule is frequently delayed because the Façade class is often locked by a particular developer for quite some time.

Discuss how this problem might be overcome without sacrificing the use of the Façade Pattern.

Can somebody explain to me how we might be able to solve this problem while still using the Facade Pattern? A clear answer doesn't pop directly into my mind.

答:
If you design a system where 20-30 people all have to edit the same class of your codebase on a daily basis, I would say you will have a pretty big organizational issue and a pretty big architectural issue as well with your system. If such a class is a facade or something else is irrelevant.

To solve these issues, I would start with splitting the teams to a smaller size, with at maximum 5 to 6 developers per teams, and each team only responsible for a part of the codebase. Assumed each team manages some components, with well-defined interfaces between the components, your "facade" will be in one of those components, so you have in fact reduced the number of people which can get a conflict to 5-6.

If those 5 to 6 people still have to edit that class each day, then there is still something wrong with the responsibilities of that class. It is probably a god class, a well-known anti pattern, and the solution to deal with that is exactly what Robert Harvey wrote in the comments: split the class up into smaller ones.

Note that just using a class by lots of people does not lock it, that is pretty nonsense (even if you use a version control system from "the dark ages" like PVCS). Only editing a class simultanously by two people may lead to a conflict, which can be solved by the help of any decent version control system.

ContentLicense: CC BY-SA 3.0

Title: Beginner Facade Pattern Example


问:
How to infer the result of a query?
To understand what a query does, I have always thought the following is the procedure on evaluating a query:

Form the table as specified in the FROM clause.

Pick the rows from that table as specified in the WHERE clause.

Show the columns of the resulting rows, as specified in the SELECT clause.

But the problem is; all around, I see that SQL is a declarative language. That is, there is no guarantee how a particular query will be executed. Given that, my question is:

Is reasoning about the result of a query in the way I do wrong? If so, how am I supposed to reason about the result of a query? In other words, if I am not able to reason in a step by step basis, how am I supposed to predict what will the result of a particular query be?

Thing is, although this is not a big problem in trivial queries, as queries gets more complex, such as by incorporating various correlated subqueries, I can't see how am I supposed to understand what a query does, without thinking about the query in a step-by-step execution. So, I would like to learn how to reason about SQL queries.

答:
Reasoning about a query's meaning (i.e. the results it should produce) using the naive procedural approach you describe is perfectly fine. As you say, with complex queries it's often the only easy way to work out what's going on.

The problem would be if you used this reasoning to infer properties about the query execution (such as time complexity or memory usage). That's unwise because the actual database probably uses indexes and temporary tables and query planners containing all sorts of black magic optimizations you don't and shouldn't know about. As long as you never make assumptions like "Nested subqueries use lots of memory because they construct temporary tables" without any hard evidence, you should be fine.

If you have any background in math, it might help to think of declarative statements like SQL queries as definitions of mathematical sets. For instance, the result of this query:

```<code>SELECT id, name FROM table WHERE id > 10
</code>```

is arguably equivalent to a set like this:

```<code>S = { {id, name} | id > 10 ∧ ∃row (row ∈ table) ∧ row(0) = id ∧ row(1) = name }
</code>```

Since set-builder notation is not normally intended as pseudocode for set construction algorithms, this formation puts some mental distance between the query/set definition and the naive algorithm it happens to imply.

Title: How to infer the result of a query?

Body:
Reasoning about a query's meaning (i.e. the results it should produce) using the naive procedural approach you describe is perfectly fine. As you say, with complex queries it's often the only easy way to work out what's going on.

The problem would be if you used this reasoning to infer properties about the query execution (such as time complexity or memory usage). That's unwise because the actual database probably uses indexes and temporary tables and query planners containing all sorts of black magic optimizations you don't and shouldn't know about. As long as you never make assumptions like "Nested subqueries use lots of memory because they construct temporary tables" without any hard evidence, you should be fine.

If you have any background in math, it might help to think of declarative statements like SQL queries as definitions of mathematical sets. For instance, the result of this query:

SELECT id, name FROM table WHERE id > 10

is arguably equivalent to a set like this:

S = { {id, name} | id > 10 ∧ ∃row (row ∈ table) ∧ row(0) = id ∧ row(1) = name }

Since set-builder notation is not normally intended as pseudocode for set construction algorithms, this formation puts some mental distance between the query/set definition and the naive algorithm it happens to imply.


问:
Does path coverage guarantee finding all bugs?
If every path through a program is tested, does that guarantee finding all bugs?

If not, why not? How could you go through every possible combination of program flow and not find the problem if one exists?

I hesitate to suggest that "all bugs" can be found, but maybe that is because path coverage isn't practical (as it is combinatorial) so it isn't ever experienced?

Note: this article gives a quick summary of coverage types as I think about them.

答:
If every path through a program is tested, does that guarantee finding all bugs?

No

If not, why not? How could you go through every possible combination of program flow and not find the problem if one exists?

Because even if you test all possible paths, you still haven't tested them with all possible values or all possible combinations of values.  For example (pseudocode):

```<code>def Add(x as Int32, y as Int32) as Int32:
   return x + y

Test.Assert(Add(2, 2) == 4) //100% test coverage
Add(MAXINT, 5) //Throws an exception, despite 100% test coverage
</code>```

It is now two decades since it was pointed out that program testing may convincingly demonstrate the presence of bugs, but can never demonstrate their absence. After quoting this well-publicized remark devoutly, the software engineer returns to the order of the day and continues to refine his testing strategies, just like the alchemist of yore, who continued to refine his chrysocosmic purifications.

-- E. W. Dijkstra (Emphasis added.  Written in 1988. It's been considerably more than 2 decades now.)

Body:
If every path through a program is tested, does that guarantee finding all bugs?

No

If not, why not? How could you go through every possible combination of program flow and not find the problem if one exists?

Because even if you test all possible paths, you still haven't tested them with all possible values or all possible combinations of values.  For example (pseudocode):

def Add(x as Int32, y as Int32) as Int32:
   return x + y

Test.Assert(Add(2, 2) == 4) //100% test coverage
Add(MAXINT, 5) //Throws an exception, despite 100% test coverage

It is now two decades since it was pointed out that program testing may convincingly demonstrate the presence of bugs, but can never demonstrate their absence. After quoting this well-publicized remark devoutly, the software engineer returns to the order of the day and continues to refine his testing strategies, just like the alchemist of yore, who continued to refine his chrysocosmic purifications.

-- E. W. Dijkstra (Emphasis added.  Written in 1988. It's been considerably more than 2 decades now.)


答:
In addition to Mason's answer, there is also another problem: coverage does not tell you what code was tested, it tells you what code was executed.

Imagine you have a testsuite with 100% path coverage. Now remove all assertions and run the testsuite again. Voilà, the testsuite still has 100% path coverage, but it tests absolutely nothing.

Title: Does path coverage guarantee finding all bugs?

Body:
If every path through a program is tested, does that guarantee finding all bugs?

If not, why not? How could you go through every possible combination of program flow and not find the problem if one exists?

I hesitate to suggest that "all bugs" can be found, but maybe that is because path coverage isn't practical (as it is combinatorial) so it isn't ever experienced?

Note: this article gives a quick summary of coverage types as I think about them.


问:
If I fork a project on Github that is licensed under MIT, how do I handle the attribution and copyright notice?
If I plan to fork an MIT project and significantly modify and rename it, how do I handle the copyright notice above the MIT license on the main License file. Would I list the original author and my company, or just the original author? What are my legal options as far as attributing the original author? I intend to license our software under MIT as well and keep it open source.</p>

答:
The MIT license doesn't specify attribution beyond maintaining the copyright notice.

The above copyright notice and this permission notice shall be included in
  all copies or substantial portions of the Software.

Somewhere within the source for the project you are considering forking, there should be a LICENSE file or equivalent.  If there isn't, then you ought to create one.

The license file provides two key aspects:

Statement of copyright to the source.

License terms for use of the software.

To cover the first aspect, within the license file, you should state something to this effect:

Copyright for portions of project Foo are held by  [original author, year] as part of project Bar.  All other copyright for project Foo are held by [your name, year].

And after that copyright statement, you should make sure the full text for the MIT license is listed, which covers the second aspect.

ContentLicense: CC BY-SA 4.0


问:
Why do people do REST API's instead of DBAL's?
At the past two companies, I've been at, REST API's exist for querying data via webapp - i.e. instead of having the webapp do SQL directly it calls a REST API and that does the SQL and returns the result.

My question is - why is this done?

If it was going to be exposed to third-parties I could understand. Better to expose a limited REST API than the full DB. But in both of these companies that's not the the case.

It's been suggested to me that these REST API's make it easier to switch between DBMS. But isn't that the point of a database abstraction layer (DBAL)? Maybe you use an ORM  as your DBAL or maybe you could just write raw SQL and have your DBAL translate the DB specific stuff if appropriate (e.g. translate LIMIT for MySQL to TOP for MSSQL).

Either way it seems unnecessary to me. And I think it makes diagnosing issues more difficult as well. If a report on the webapp is giving the wrong numbers you can't just dump out the SQL query - you have to dump the REST URL and then go into the project that's serving as the REST API and pull out the SQL from that. So it's an extra layer of indirection that slows down the diagnostic process.

答: You are thinking that REST is for database queries and it is not. REST represents the state of something at the moment. Using REST changes or retrieves a representation but that is all. If that state becomes available by database, it doesn't matter and no one cares because HOW that representation comes to be is not part of REST and neither are database queries.</p>


问:
Source file shouldn't be more than 100 SLOC
I just started working on a baseline that is rooted in Ada. Many of the older Ada programmers insist that the source files shouldn't be more than 100 SLOC. I researched this online and I have not found any source to this statement. Is this a guideline or a rooted in sound software engineer principles? I have been a software engineer for 13 years and never heard of this until now. They insist that code in these smaller source files are easier to understand but it seems to me that there would be tons of small source files.</p>

答:
The closest I have ever come to a guideline similar to that you ideally should be able to see the full source of a subprogram on the display at the same time.

I am pretty sure the "Ada 95 Quality and Style Guide", which is the authoritative style guide for modern Ada programming, does not contain anything like this limitation.


答:
Here's a simpler example to round things off. Consider the following sorting algorithm (in Java):

int[] sort(int[] x) { return new int[] { x[0] }; }
```

<p>Now, let's test:</p>

<pre class="lang-java prettyprint-override"><code>sort(new int[] { 0xCAFEBABE });
</code>```

Now, consider that (A) this particular call to sort returns the correct result, (B) all code paths have been covered by this test.

But, obviously, the program does not actually sort.

It follows that coverage of all code paths is not sufficient to guarantee that the program has no bugs.

Body:
Here's a simpler example to round things off. Consider the following sorting algorithm (in Java):

int[] sort(int[] x) { return new int[] { x[0] }; }

Now, let's test:

sort(new int[] { 0xCAFEBABE });

Now, consider that (A) this particular call to sort returns the correct result, (B) all code paths have been covered by this test.

But, obviously, the program does not actually sort.

It follows that coverage of all code paths is not sufficient to guarantee that the program has no bugs.


答:
If I understand correctly what a DBAL is, then the answer is that a REST interface allows you to use any language for its clients, while a DBAL is a library that allows you to use a single language for its clients.

This, in turn, can be an advantage for a company where there are many development teams and not all of them are proficient in the same language.  Allowing their software to query directly the DB would be equivalent in functionality, but as you say "better to expose a limited REST API than the full DB".

In more abstract terms, you yourself are answering the question:

So it's an extra layer of indirection that slows down the diagnostic process

... since there is this famous aphorism that states: "All problems in computer science can be solved by another level of indirection". :)

Title: Why do people do REST API's instead of DBAL's?

Body:
At the past two companies, I've been at, REST API's exist for querying data via webapp - i.e. instead of having the webapp do SQL directly it calls a REST API and that does the SQL and returns the result.

My question is - why is this done?

If it was going to be exposed to third-parties I could understand. Better to expose a limited REST API than the full DB. But in both of these companies that's not the the case.

It's been suggested to me that these REST API's make it easier to switch between DBMS. But isn't that the point of a database abstraction layer (DBAL)? Maybe you use an ORM  as your DBAL or maybe you could just write raw SQL and have your DBAL translate the DB specific stuff if appropriate (e.g. translate LIMIT for MySQL to TOP for MSSQL).

Either way it seems unnecessary to me. And I think it makes diagnosing issues more difficult as well. If a report on the webapp is giving the wrong numbers you can't just dump out the SQL query - you have to dump the REST URL and then go into the project that's serving as the REST API and pull out the SQL from that. So it's an extra layer of indirection that slows down the diagnostic process.


答:
Consider the abs function, that returns the absolute value of a number. Here is a test (Python, imagine some test framework):

```<code>def test_abs_of_neg_number_returns_positive():
    assert abs(-3) == 3
</code>```

This implementation is correct, but it only gets 60% code coverage:

```<code>def abs(x):
    if x < 0:
        return -x
    else:
        return x
</code>```

This implementation is wrong, but it gets 100% code coverage:

```<code>def abs(x):
    return -x
</code>```

Body:
Consider the abs function, that returns the absolute value of a number. Here is a test (Python, imagine some test framework):

def test_abs_of_neg_number_returns_positive():
    assert abs(-3) == 3

This implementation is correct, but it only gets 60% code coverage:

def abs(x):
    if x < 0:
        return -x
    else:
        return x

This implementation is wrong, but it gets 100% code coverage:

def abs(x):
    return -x


答:
Just because you're inside the same company doesn't mean you should expose everything to everyone. REST APIs are a way to define a limited consumer/provider relationship between teams in a company, with a clear contract. Amazon has been a pioneer in this form of organization.

APIs also provide a layer of abstraction, allowing you to use a specific set of idioms -- you don't necessarily want to talk to your consumers in the same terms that are used in your database. You also don't necessarily want to talk to each consumer the same way.


答:
If you allow a client to access the database directly - which they would do, even with a database abstraction layer, then:

You get a coupling between their code and yours - particularly, there is a very strong coupling between your database structure and their code;

Your client may do some pretty undesirable stuff on your database - whether it be updating data that they should not, writing a query that takes too much time, deadlocking something because they do not acquire locks cleanly...

If you have made some less than optimal choice in your database structure, then moving out of that choice may be very hard, especially if you do not have a good way to make your clients migrate over to new structures.

That is, I am not touching at all on the REST part - isolating your database behind an API is simply a more sensible choice if the team that maintains the database and the teams that use it are not in sync, as it allows these parts to evolve at their own pace.


问:
Why is SQL known as a relation-based / functional language?
We're learning that most languages are classified as either of the two, "relation based" or "high level". I've never used SQL before, but from reading its syntax it seems more like the imperative/high-level syntax than functional/relation-based (Lisp, Haskell)??

Or it could just be that my interpretation of my professor's lecture notes is wrong... but it definitely lists SQL as one of the relation-based languages (as opposed to high level), and it equates relation-based with functional... or perhaps it's that I don't understand why the fact that SQL deals with relational databases makes a functional language the way it should be implemented? (and why 'relation-based' equates with 'functional' when categorizing programming languages?)

Thanks :)

答:
I think, SQL is a syntactic sugar around relational algebra + something more. Relational algebra has a lot of power of functional languages, it indeed leverages functions of very high expressing power (selection, projection, renaming, join, union, intersection...). But s far as I know, basic treatment of relational algebra usually has no equivalent of lambda operator, although it can be extended with a recursion operator in a seamless way.

I think relation algebra is rather an algebraic language. SQL, with its subqueries, has moved from pure relational algebra towards a more functional style, but without a lambda operator, I think it is not a full functional language. I no not know whether it could be extended to a full functional language in a seamless way, I am not expert in this field. Haskell has some libraries with the goal of very high-level database languages.


问:
How to version control a running web application?
I am developing a web application in PHP and JS. The software until recently was only being developed on and not being used by clients, so I could just change the script files directly. After the application went into release I just copied the application in a beta folder in which I could do changes. After testing the changes I manually selected the changed files and copied them into the release system.

Well, I really think there must be a better approach to my problem, that does not include manually copying files from beta to release. I used git for projects to collaborate with other people, but those always were non web applications, that were not running, while changing them. Collaboration is not as important, for I am working alone, at least in the medium term. Are there approaches to use git oder something else for working web applications?

As IDE I am using Netbeans, which is synchronized with the server.

Edit: Currently the productive code is located in the htdocs folder of the webserver. A copy of the whole stuff is in htdocs/dev. I do changes on the code in dev via Netbeans, without any version control plug-in, it just synchronizes the project files via sftp with the files in dev. After changing I am able to test the changes using example.org/beta. If everything's fine I copy the changed files into the productive system.

答:
SVN/GIT or any control version should work.
Except for very specific application, web application a rarely live ( in the sense Physically loaded in memory) and i assume your application doesnt rewrite itself ( else you have the risk of rewriting the push you just made).
Then if you push your file the next call on the webserver/php will load the new code (except if you have a cache system obviously) and go foward on the new code.

So Git push your change, remove the cache and you should be good to go.

In Case you DO have an application wich is simultaneously fully charged in memory and use no cache, you should use a cyclic call to check for a flag File.
When you push a mod, push also the Flag.
Make your soft do a soft landing ( no new connection, wait until all old connection die down ), do the mod, delete the flag and then restart into normal (accepting connection) mode.
At first make the check a lot ( something like every minute, at least every hour), then when  you stabilize your dev cycle more you can space out the check ( something like once a day, once a week)


问:
Many small requests vs. few large requests (API Design)
I'm currently working on a project with an organization as follows:

Client - Gets data from the main server via REST api.

Server - Requests data from various other servers via third-party APIs

Third-party APIs - Services out of my control that provide data to the server (Reddit, Hackernews, Quora, etc.)

For the sake of argument, let's say the client first needs a list of items from each of the third-party APIs. From this list, an item will be chosen at which point the client needs to see the full content of the item as well as responses (i.e. comments) to the item. I'm trying to decide between three options:

A la Carte

In this approach, I would have 3 separate endpoints on my server: one to get the list of items, one to get the main content for an item, and one to get the responses of the item.

Pros: I never make more requests than I need to, requests should be small so generally they should be faster.

Cons: I have to make a lot of requests. After choosing an item from the list, the user may have to wait before seeing the main content and then wait even longer to see the responses

Server-side cache

In this request, I would make a single call to my server to "fetch" all the data for all sources. The data would then be cached on the server. The client would then have the same REST endpoints as before, except there wouldn't be much waiting between calls since my server already has the data and just has to feed it to the client.

Pros: Still easy to implement on the client side, but without the latency issues

Cons: A bit more involved server side, and the first call could take really really long.

Client-side cache

This scenario is similar to the previous one except the client only ever makes one request to the server: give me all of the data. From here it's the client's responsibility to save the data and use it appropriately.

Pros: Easy server implementation, very speedy after the first call

Cons: First call will be very slow, more complicated client-side implementation

I'm not sure which is the best approach, or if maybe I'm missing the obvious solution. Any advice would be greatly appreciated!

答:
As always in programming, it depends.

So, the real question is: what should you consider when deciding for A/B/C or a combination of the three?

I would say that the real discriminating factors are the implementation details of the 3rd party APIs you are consuming.
As an example, you should consider:
Are they fast or slow?
Do data changes frequently and unexpectedly?
Are they "chatty" or Rest?

In case of fast, easy to call services, with data changing so frequently that your server side cache is going to create stale-cache problems, by all means, go for option 1: more requests, no cache, only when needed.

If your external data is going to change in a predictable way, or you are limited with the usage, or simply you can get a better user experience caching data on your server, go with 2. But keep in mind that cache is not free: it has costs in terms of debugging and sometimes users complaining they don't see updates.

Option 3, I would consider only if data is not much, but in that case even options 1 or 2 can work, and you keep more logic on the server, so I would stick for 1 or 2.

Just my 2c.


答:
Based on just the info you gave, option 1, because

with a single client request you'd be mixing apples and oranges and the fruit basket might be very large.

caching is a tradeoff where you gain performance but potentially lose consistency (stale data). If you don't have any identified performance issues, synchronization problems are usually not worth risking.

Title: Many small requests vs. few large requests (API Design)

Body:
I'm currently working on a project with an organization as follows:

Client - Gets data from the main server via REST api.

Server - Requests data from various other servers via third-party APIs

Third-party APIs - Services out of my control that provide data to the server (Reddit, Hackernews, Quora, etc.)

For the sake of argument, let's say the client first needs a list of items from each of the third-party APIs. From this list, an item will be chosen at which point the client needs to see the full content of the item as well as responses (i.e. comments) to the item. I'm trying to decide between three options:

A la Carte

In this approach, I would have 3 separate endpoints on my server: one to get the list of items, one to get the main content for an item, and one to get the responses of the item.

Pros: I never make more requests than I need to, requests should be small so generally they should be faster.

Cons: I have to make a lot of requests. After choosing an item from the list, the user may have to wait before seeing the main content and then wait even longer to see the responses

Server-side cache

In this request, I would make a single call to my server to "fetch" all the data for all sources. The data would then be cached on the server. The client would then have the same REST endpoints as before, except there wouldn't be much waiting between calls since my server already has the data and just has to feed it to the client.

Pros: Still easy to implement on the client side, but without the latency issues

Cons: A bit more involved server side, and the first call could take really really long.

Client-side cache

This scenario is similar to the previous one except the client only ever makes one request to the server: give me all of the data. From here it's the client's responsibility to save the data and use it appropriately.

Pros: Easy server implementation, very speedy after the first call

Cons: First call will be very slow, more complicated client-side implementation

I'm not sure which is the best approach, or if maybe I'm missing the obvious solution. Any advice would be greatly appreciated!


问:
How does Elastic Search approach the problem of distributed membership and consensus?
I already understand that Elastic Search is supposed to be deployed in a distributed topology, in that you can have multiple nodes for a cluster of ES instances.

I like the API, and it looks promising. But I wonder how Elastic Search solves some standard problems in distributed computing. My "architectural" questions are motivated out of trying to understand whether I ought to commit to using the product.

Consider membership problem: If I add a node to the cluster, how does Elastic Search cluster know to add that node wants to join? Or what if a node goes down (or the network to the data center it is in) gets too flaky. Is it using some sort of gossip protocol like Amazon Dynamo does?

Consider the consensus problem: if I POST a document to one node to the cluster, how does the change get propagated to the other nodes? Of course, I understand that the document has to be indexed, so I cannot expect a search query to find it immediately. Does ES use a Paxos algorithm? Raft algorithm?

UPDATE: A nice discussion of the split-brain problem in Elastic Search.

答:
There are also some tweaks you can apply on server configuration, in order to reduce split-brain problems in large(ish) clusters, namely the so-called discovery.zen.* parameters.

There is not that much information about the inner workings and algorithms of ES, but what I found during my evaluation was the reference documentation about the server setup.

In particular, a nice thing about ES is that almost all the server configuration is done through a single file, elasticsearch.yml, under the ./config dir of your installation.

So, I would start with the setup configuration and I would go on opening the actual .yml on your installation. It's commented really well, and goes into explaining a lot of things (including the "zen" parameters used to solve split-brain problems) and cross-links to web pages.


答:
If, as you write, you directly edit files on the server over SFTP, your only option (as far as I can see) is to install git on the server, login via SSH and do all git operations locally. You'd have to create a repository on the server, add all your files and then commit regularly. In that case your working directory would be the directory where all the JS and PHP files live.

However, I would not recommend this approach, as it has some problems. Among others, you need SSH login on the server, your git repo must be on the server, and if your application's files are spread over multiple directories, it gets difficult to put everything into one repository.

What I would recommend instead is: Develop locally, then deploy to server.

That means you install PHP, webserver etc. locally, then keep the code on your workstation and do most of your development there. Then you can alwso use git locally to version your code.

Once a feature is ready, you deploy your code to the production web host, to make it go live (or to a test installation for final testing). This gives you much more flexibility while developing (easier to use various tools, like git, no need for constant server access, less risk to mess up the server while developing etc.).

To do this, you need

a local installation of PHP and all other required infrastructuresome, and

some kind of deployment system.

Local installations of PHP are readily available (see for example the question PHP server on local machine? ).

For deployment, there are many existing systems, and there are deployment solutions specifically for PHP. You could also just start out with a simple script that SFTPs everything to the server, and makes them live (restarts any services as required, clears caches etc.) and then go on from there.

Title: How to version control a running web application?

Body:
I am developing a web application in PHP and JS. The software until recently was only being developed on and not being used by clients, so I could just change the script files directly. After the application went into release I just copied the application in a beta folder in which I could do changes. After testing the changes I manually selected the changed files and copied them into the release system.

Well, I really think there must be a better approach to my problem, that does not include manually copying files from beta to release. I used git for projects to collaborate with other people, but those always were non web applications, that were not running, while changing them. Collaboration is not as important, for I am working alone, at least in the medium term. Are there approaches to use git oder something else for working web applications?

As IDE I am using Netbeans, which is synchronized with the server.

Edit: Currently the productive code is located in the htdocs folder of the webserver. A copy of the whole stuff is in htdocs/dev. I do changes on the code in dev via Netbeans, without any version control plug-in, it just synchronizes the project files via sftp with the files in dev. After changing I am able to test the changes using example.org/beta. If everything's fine I copy the changed files into the productive system.


问:
Secure DAL Design using Stored Procedures
I normally avoid sProcs as much as possible. I dont like the language be it TSQL or PL/SQL; they seem archaic against Java/Dot-Net which I use. I go for them when a routine needs to fetch a lot of data, crunch it and generate a small set of output. Sitting inside the DB makes the fetching process a lot fast, no network hit. But that is all.

I recently came across a DAL design where absolutely all of the CURD operations were implemented in Stored Procedures. Actually one giant sProc to be precise. Here is the skeleton:

```<code>PROCEDURE myGenericProc(int QueryNo, varchar genericParam1, ..., varchar genericParamN)
BEGIN
    SWITCH queryNo
    CASE 1
        SELECT * FROM table1 INNER JOIN table 2 ON ...

    CASE 2
        DELETE FROM table 3 WHERE ...
    ...

    CASE n
        UPDATE table4 SET a=b WHERE ...
END
</code>```

The designer's logic behind this is: if I do these things in code, then the database-connection needs to have full rights on all the tables. The connection credentials are generally in connection string, which is on the application server. If the application server is compromised, inevitably the entire DB is also compromised.

As an alternative, have all the queries in the sProc, then grant that sProc full rights. Call only that sProc. This way, even if the application server is compromised, only the sProc interface can be attacked. No one can do DROP users_master.

While I agree with the principle, I hate the implementation. Unfortunately, some security paranoid clients (banks) want us to do exactly that. Also, the DBAs hate tuning access privileges on 200+ sProcs, they want as-few-as-possible items to audit.

Question:

Is there any other implementation that provides same level of security, but is more cleaner ?

答:
Sprocs are very good for implementing a secure data access layer - you write sprocs for reading and writing data, and give the client execute access to the sprocs only - no access to the underlying tables or views.

This gives your DB an API that clients use, in much the same way as any class implemented in your business logic code would, but much more secure. It prevents the kind of exploits we keep reading about in the news where some hacker has gained access to every user's password - if the only way to access a password was via a sproc, the attacker who gained access to the DB could only retrieve 1 password at a time, running select * from users just isn't possible once he's bypassed your publicly-facing servers.

In addition, you can partition your back-end DB into schemas so that some sprocs cannot even access other parts of the DB.

In short, its a nice way of implementing a controlled API for the DB rather than just letting anyone run whatever query that feel like against it. You can obviously improve performance using sprocs for data access that requires complex queries, and you can re-implement your back-end schema without any client realising its changed.

I worked in a highly secure system a few times (financial) that required the front-end web site access business logic in a middle-tier service, the service was secured so only the web server could access it, it in turn called sprocs on the db that were in turn secured so only the middle tier services that needed access to them were allowed. It might seem over complex but once you'd done the first example of each part it was very easy to understand where to put other features. It also meant specialists could write the relevant parts of the application (ie web, service or sql) and they'd come together later in integration.

I wouldn't like to write a single sproc that caters to all API calls - that's total pants. The DBAs should be happy with several sprocs, they can review and audit only changes then - and not audit the entire thing for 1 piddly change.


问:
As a lone developer, how can I be sure I am learning and doing decent work?
Background: I work in a small (less than 75) person engineering/manufacturing company. I was hired as a developer to work with a single teammate, our purpose being to migrate the company to the modern digital age. My teammate however is not a developer, but instead an industrial engineer, who primarily works on broad ideas, planning, and other non-code related areas. I do all the development.

Problem: I enjoy my work, and it's (shockingly) low stress, probably due to the fact that pretty much no one understands what I do. This includes my boss, he hired me only knowing that he needed someone who can "code". The problem with this is that I am forced to solve every task myself, without any input from colleagues/seniors. I am very good at what I do, but also quite young (haven't even started college yet), and so I would have seriously benefited from having seniors to teach and correct me. Unfortunately this isn't possible at the current time, so I'm stuck doing everything my way and hoping it works out.

This works I suppose, except I have no way to know if I am doing things in a terrible fashion that will eventually cost me months of rework time. Am I doing things efficiently? And although I haven't run into this yet, what if I really just can't figure out a problem that blocks our project? I can't hand it off! And what about when I leave? What if the next developer grows to curse my very being because of what lays before his eyes? :)

These questions worry me quite frequently, and it brings me to my question:

As a lone developer, what can/should I do to make sure I am learning, and producing efficient, maintainable, and proper (near bug free) code. How can I do things like:

review my own code

review my own designs

etc.

EDIT:

My question is similar but not a duplicate of Can a lone programmer become a mid or senior level programmer without a mentor?, that question is about "ranking up" as an individual programmer, I am asking how I can make sure I am learning and doing things properly without any other technical oversight.

答:
As a lone developer, what can/should I do to make sure I am learning,

There are books you can read.

There are user-groups/meetups where you can talk with other developers.

There is a code review site here where you can post code (that isn't vital/identifyable to your company) to get feedback.

These are all fine, but no substitute for good practice. In order to write good code, you're invariably going to have to write bad code first. The best thing you can do is be introspective about how the code is.

Is it painful to use? Is it fragile to extend? Do you seem to be doing the same things over and over?

That sort of iterative improvement is the key for growing - programming or not.

OwnerDisplayName: Josiah

OwnerDisplayName: Telastyn


答:
It is good that you recognize your situation and are wanting to do things right. Some bad habits are hard to kick if you keep them for too long.

If there are developers on other teams at the company, see if you can join up with them to bounce ideas off of, and to have them look over your shoulder once in awhile.

Books, blogs, podcasts, local user groups and meet ups (as @Telastyn said) are all good sources of new ideas, as well.

Title: As a lone developer, how can I be sure I am learning and doing decent work?

Body:
Background: I work in a small (less than 75) person engineering/manufacturing company. I was hired as a developer to work with a single teammate, our purpose being to migrate the company to the modern digital age. My teammate however is not a developer, but instead an industrial engineer, who primarily works on broad ideas, planning, and other non-code related areas. I do all the development.

Problem: I enjoy my work, and it's (shockingly) low stress, probably due to the fact that pretty much no one understands what I do. This includes my boss, he hired me only knowing that he needed someone who can "code". The problem with this is that I am forced to solve every task myself, without any input from colleagues/seniors. I am very good at what I do, but also quite young (haven't even started college yet), and so I would have seriously benefited from having seniors to teach and correct me. Unfortunately this isn't possible at the current time, so I'm stuck doing everything my way and hoping it works out.

This works I suppose, except I have no way to know if I am doing things in a terrible fashion that will eventually cost me months of rework time. Am I doing things efficiently? And although I haven't run into this yet, what if I really just can't figure out a problem that blocks our project? I can't hand it off! And what about when I leave? What if the next developer grows to curse my very being because of what lays before his eyes? :)

These questions worry me quite frequently, and it brings me to my question:

As a lone developer, what can/should I do to make sure I am learning, and producing efficient, maintainable, and proper (near bug free) code. How can I do things like:

review my own code

review my own designs

etc.

EDIT:

My question is similar but not a duplicate of Can a lone programmer become a mid or senior level programmer without a mentor?, that question is about "ranking up" as an individual programmer, I am asking how I can make sure I am learning and doing things properly without any other technical oversight.

OwnerDisplayName: Kent Anderson


答:
You really want to get some input from other developers. Adding to what Telastyn and Kent have already suggested, contributing to some active open source project is a good way to get feedback on your coding style/efficiency.

Another thing to think about is what do you dislike (specifically) about your current language/tools. Chances are that some problem areas aren't really and are instead excellent places to improve yourself in.

OwnerDisplayName: Celos


答:
In addition to the other answers:

Participating on programming forums like StackOverflow, Programmers.SE and CodeReview.se can also help you. You could decide to spend a percentage of your time there. Studying is part of the job of being a developer.

Also, there's probably video's out there about new features in your programming language - those with people actually writing code examples. Even if you have no intention of upgrading your dev environment, you always see people doing things differently than what you're used to.

These are ways to stay in contact with other developers without actually meeting them.

OwnerDisplayName: Jan Doggen


答:
Modern Object Relation Mapping libraries, and even the lower level libraries allowing you to run SQL against the database, have guards in place to prevent SQL injection attacks. To use stored procedures because all other solutions are not secure is both short sighted and false. If you must hard code SQL, you can use parameterized queries, which guard against SQL injection attacks.

If your reason for using stored procedures is to centralize business logic, then you've got a legitimate reason for using them, but it had better be a good enough reason to make your system harder to test. Throwing a bunch of unit tests at classes in Java or C# is pretty easy. Unit testing your stored procedures is more difficult, but if you many different technologies needing the same database, and the same business rules then stored procedures are nice to have.

I have a love-hate relationship with them. On the one had, I hate having to map every single stinking parameter and I like how an ORM can just auto generate the INSERT, UPDATE and DELETE commands. Then again, most ORMs allow you to call stored procedures, so you get the dynamic querying ability of the ORM with the hardened interface provided by stored procedures.

Really, your reason for using stored procedures should not be "because it's more secure", as this likely results from not knowing how to use the other tools available.

Title: Secure DAL Design using Stored Procedures

Body:
I normally avoid sProcs as much as possible. I dont like the language be it TSQL or PL/SQL; they seem archaic against Java/Dot-Net which I use. I go for them when a routine needs to fetch a lot of data, crunch it and generate a small set of output. Sitting inside the DB makes the fetching process a lot fast, no network hit. But that is all.

I recently came across a DAL design where absolutely all of the CURD operations were implemented in Stored Procedures. Actually one giant sProc to be precise. Here is the skeleton:

```<code>PROCEDURE myGenericProc(int QueryNo, varchar genericParam1, ..., varchar genericParamN)
BEGIN
    SWITCH queryNo
    CASE 1
        SELECT * FROM table1 INNER JOIN table 2 ON ...

    CASE 2
        DELETE FROM table 3 WHERE ...
    ...

    CASE n
        UPDATE table4 SET a=b WHERE ...
END
</code>```

The designer's logic behind this is: if I do these things in code, then the database-connection needs to have full rights on all the tables. The connection credentials are generally in connection string, which is on the application server. If the application server is compromised, inevitably the entire DB is also compromised.

As an alternative, have all the queries in the sProc, then grant that sProc full rights. Call only that sProc. This way, even if the application server is compromised, only the sProc interface can be attacked. No one can do DROP users_master.

While I agree with the principle, I hate the implementation. Unfortunately, some security paranoid clients (banks) want us to do exactly that. Also, the DBAs hate tuning access privileges on 200+ sProcs, they want as-few-as-possible items to audit.

Question:

Is there any other implementation that provides same level of security, but is more cleaner ?


问:
Changing repetitive code to improve good programming design
In Java Swing if you want to add a listener to a component, it would look something like this...

```<code>JButton j = new JButton();
int counter = 0;
j.addAncestorListener(new AncestorListener() {
    @Override
    public void ancestorMoved(AncestorEvent event) {

    }
    @Override
    public void ancestorAdded(AncestorEvent event) {
        counter++;
    }
    @Override
    public void ancestorRemoved(AncestorEvent event) {

    }
});
</code>```

If I were able to create a new Java keyword and just say this....

```<code>JButton j = new JButton();
int counter = 0;
swinglistener (j, AncestorListener) {
    ancestorAdded {
        counter++;
    }
}
</code>```

.... to achieve the same effect. Would this code be more readable? Would it be better? What other aspects of "good" software design would this change achieve?

答:
Assuming you have control over the interface, you're basically describing Java 8's default methods. You can define an implementation of interface methods that will be used if the implementing class does not explicitly override it.

```<code>public interface MyAncestorListener {
    default void ancestorAdded(AncestorEvent event) {
    }

    default void ancestorMoved(AncestorEvent event) {
    }

    default void ancestorRemoved(AncestorEvent event) {
    }
}

class MyAncestorListenerImpl implements MyAncestorListener {
    @Override
    public void ancestorMoved(AncestorEvent event) {
        // Custom implementation here
    }
}
</code>```

If you don't have the option of modifying the interface (such as in your Swing example), you can use an abstract base class to provide empty implementations for the interface methods.

```<code>public abstract class AbstractAncestorListener implements AncestorListener {
    @Override
    public void ancestorAdded(AncestorEvent event) {
    }

    @Override
    public void ancestorMoved(AncestorEvent event) {
    }

    @Override
    public void ancestorRemoved(AncestorEvent event) {
    }
}
</code>```

You can then override just the methods you need to implement.

```<code>JButton j = new JButton();
int counter = 0;
j.addAncestorListener(new AbstractAncestorListener() {
    @Override
    public void ancestorAdded(AncestorEvent event) {
        counter++;
    }
});
</code>```

Body:
Assuming you have control over the interface, you're basically describing Java 8's default methods. You can define an implementation of interface methods that will be used if the implementing class does not explicitly override it.

public interface MyAncestorListener {
    default void ancestorAdded(AncestorEvent event) {
    }

    default void ancestorMoved(AncestorEvent event) {
    }

    default void ancestorRemoved(AncestorEvent event) {
    }
}

class MyAncestorListenerImpl implements MyAncestorListener {
    @Override
    public void ancestorMoved(AncestorEvent event) {
        // Custom implementation here
    }
}

If you don't have the option of modifying the interface (such as in your Swing example), you can use an abstract base class to provide empty implementations for the interface methods.

public abstract class AbstractAncestorListener implements AncestorListener {
    @Override
    public void ancestorAdded(AncestorEvent event) {
    }

    @Override
    public void ancestorMoved(AncestorEvent event) {
    }

    @Override
    public void ancestorRemoved(AncestorEvent event) {
    }
}

You can then override just the methods you need to implement.

JButton j = new JButton();
int counter = 0;
j.addAncestorListener(new AbstractAncestorListener() {
    @Override
    public void ancestorAdded(AncestorEvent event) {
        counter++;
    }
});


问:
Structuring project (refactoring)
I'm working on a project that requires from me to make modular and extendible code structure. This code should be able to support multiple clients. The good news is that code should not do anything spectacular. I will explain this in more details later in the question.

So now I have around 30 branches for about 60 clients. Some clients needed their own branch because at the time it was easier to just separate their code from everyone else’s so that over time grow to 30 separated codes, that are very very similar.

So now architecture could not be more simpler. Request comes from client in XML form and then I process I return XML. Process part is mostly CRUD. Nothing fancy. I have two front controllers one for actions (INSERT, UPDATE, DELETE) and one for requests(SELECT). Then that front controller just includes script that client requested. Every request and every action has their own dedicated script. There are not a single class in the project. Everything is written in procedural way.

So in the new App structure the goal is to have one main branch that will all clients use and it will be managed from conf file.

I'm telling you all this because I'm not sure how to structure everything. I don't have much experience with OOP I know the concepts and theory but its harder when it comes to actual coding in that style.

My idea now is. I'm leaving two front controller for action and request because that doesn't require any change from client-side of application and that is important for now. They will now serve as only get request and echo it back. They will also call ActionController and RequestController. They will be a little smarter. They will know how to recognize which request/action client sent and then they will make new object of that class.

Every action/request has some steps that it needs to do. So i'm thinking that every class need some public method 'execute' that will just call method of that class by the order that it needs to, but I'm afraid that, that is also procedural way of thinking just it wont be in global score but in Class.

```<code>$client_request = new $fullClassPath(new $mapperClassPath);
$response = $client_request->execute($request);
</code>```

Also How to handle Database, I probably should make actions on database as abstract as possible.

Configuration file will be very important, so I don't know if it's the solution to make class for every feature and include classes if that feature field is set to true in config file?

Every action has its own response to client and it can be pretty heavy xml. What is the solution there. Should I have a Response class that will handle that. Im afraid that the class will be pretty heavy because there are around 20 actions and 5 requests and everyone have different xml response.

So every help is appreciated with someone who had experience with similar projects, some links on good articles also wouldn’t hurt.

I should mention that language I’m working with is vanilla(plain) PHP.

答:
It's hard to say how to structure your application without knowing the differences between each 'branch'. What I would do is compare the functionality of each branch and distill the common denominators. Put these into classes that you use for each client. The parts that differ from client to client I would then put into adapters or strategies that (optimally) share a common interface.

We had the same problem with a codebase I inherited. Some pointers I used in that project:

Heavy use of adapters or strategies.

Use of dependency injection to swap out different classes for different clients.

If a client needs a special exception, see if it can instead be added to the generic classes using some configuration.

Title: Structuring project (refactoring)


答: My answer to What version control system can manage all aspects? may help.  Basically, you need to tag the released version so an automated process can check it out.  I've used cron to check for and apply changes on a periodic basis.  </p>


答:
I try to avoid stored proc's if at all possible. But when I have to for security, my goal is a compromised approach. I use stored proc's for updating commands (INSERT, UPDATE, DELETE) and the ORM for everything else.

Further, each stored proc does a single operation on a single table. The application code coordinates all of the calls and manages the transactions.

The biggest problem I've experienced with stored proc's is that development becomes more difficult. Stored proc's obfuscate the work:

Following the program flow is more difficult, especially if two different IDE's must be used (one for the stored proc's, one for the code)

Tracking bugs down is harder because of the mental context switch

When stored proc's call other stored proc's, the problems get exaggerated


问:
Which things instantly ring alarm bells when looking at code?
I attended a software craftsmanship event a couple of weeks ago and one of the comments made was "I'm sure we all recognize bad code when we see it" and everyone nodded sagely without further discussion.

This sort of thing always worries me as there's that truism that everyone thinks they're an above average driver. Although I think I can recognize bad code I'd love to learn more about what other people consider to be code smells as it's rarely discussed in detail on people's blogs and only in a handful of books. In particular I think it'd be interesting to hear about anything that's a code smell in one language but not another.

I'll start off with an easy one:

Code in source control that has a high proportion of commented out
  code - why is it there? was it meant
  to be deleted? is it a half finished
  piece of work? maybe it shouldn't have
  been commented out and was only done
  when someone was testing something
  out? Personally I find this sort of
  thing really annoying even if it's just the odd line here and there, but when you see large blocks interspersed with the rest of the code it's totally unacceptable. It's
  also usually an indication that the rest of
  the code is likely to be of dubious
  quality as well.

答: Functions that reimplement basic functionality of the language.  For example, if you ever see a "getStringLength()" method in JavaScript instead of a call to the ".length" property of a string, you know you're in trouble.</p>

ContentLicense: CC BY-SA 2.5


问:
NoSQL within SQL Server
This question is not about the difference between SQL and NoSQL. I am looking for some rationale for something that really does not make sense to me at the moment (maybe because of my lack of understanding or appreciation).

We have started a new project from scratch using MVC5, Entity framework 6 code first and SQL Server 2008. When the architect reviewed the database schema it was stated that all foreign keys and other such constraints should be removed as this is “business logic” and should be applied within the business layer of the application code.

My opinion is that foreign keys form part of data/referential integrity and do not really mimic business logic. I see business logic as more the process and validation which controls what/when/how/why references are applied. I can kind of understand that unique constraints are arguably business processes, but for me this just complements the logic and forms part of the integrity.

A second argument is the aim is to adopt a NoSQL approach to the data. I found this really unusual and unorthodox: considering the use of SQL-Server 2008, the need for reporting, the data not scaling to terabytes and the lack of consideration towards technologies such as Mongo, Raven, etc.

Has anyone came across such a scenario before? Why would anyone adopt a NoSQL approach in an SQL Server designed for referential data and not want foreign keys?

答:
When he reviewed the database schema he stated that all foreign keys and other such constraints should be removed as this is business logic and should be applied within the business layer.

Then he's an idiot, and some excerpt from your codebase is likely to end up on The Daily WTF someday.  You're absolutely right that his approach doesn't make sense, and frankly neither does his explanation.

Try explaining to him that referential integrity constraints are not "business logic"; they're a correctness standard with its own built-in verification.  Business logic is about what you do with the data; integrity is about ensuring that the data itself is not corrupt.  And if that doesn't work... well, he's in charge.  You can either go along with his plan and try to mitigate the damage somewhat, or start looking for a better place to work. (Or both.)

Title: NoSQL within SQL Server


答:
In over 40 years in this crazy racket, as a student and as a professional, I have basically seen one (1) routine that NEEDED to be more than about one printed page (about 60 lines) long.  I've seen some really ugly state machines that had a LOT of states (I think the record is 35), that really couldn't be factored cleanly, but state machines are a special case.

That's not to say I haven't seen a lot of routines that WERE more than one printed page long.  Average and below-average (by definition, half of all programmers are below average!) C and C++ programmers spout 500 line stream-of-consciousness spews at the drop of a keystroke, and somehow never manage to go back and clean them up.  Cut-and-paste coding is the norm, with the same dozen lines appearing in half-a-dozen places, instead of being cut into a subprocedure and called (or macro-expanded, in the RARE! case where subroutine call overhead is too high).

For that matter, I've written a few of them, under schedule pressure.

There is a HUGE body of knowledge, going back to before I started, showing conclusively that programmer comprehension drops off dramatically the moment a programmer has to "turn a page".  Start with Weinberg's "Psychology of Computer Programming".  At 100 SLOC, you are going to turn a listing page at least once.  You are going to scroll your editor two or three times, depending on screen size.  (I once adopted a fairly quirky editor for a task, JUST because it supported 50-line VGA mode, for working on a certain very messy piece of code.)

I have seen considerable evidence that enforcing modularity makes a big difference.  Traditional FORTH implementations force modularization and refactoring, as they make it IMPOSSIBLE to write long stream-of-consciousness code spews.  FORTH programmers are FORCED to break things into easily-digestible chunks, and it seems to make a big difference.  (Note: Elizabeth Rather, the second FORTH programmer in history, disagrees with me on this.)

People occasionally ask whether modern IDEs that allow code to be "folded" (blocks collapsed) would get around this human limitation.  I have seen no studies, and I would be suspicious of any study that purported to address it: I'd want to know how many people of what kinds of backgrounds were in the study.  I have also actually never seen such an IDE in actual use.  (I've only heard of one, the old Rational R1000 Ada Development System, and it went to the dinosaur graveyard a long time ago.)

"100 SLOC" is probably a guideline, but it has the flavor of a guideline written in the blood of countless software engineers who had to debug 1000-SLOC spews.  (Been there, done that, didn't WANT the T-shirt.)  You probably want to follow it, if only to keep the greybeards from screaming "GET OFF MY LAWN!" at you.

Title: Source file shouldn't be more than 100 SLOC

Body: I just started working on a baseline that is rooted in Ada. Many of the older Ada programmers insist that the source files shouldn't be more than 100 SLOC. I researched this online and I have not found any source to this statement. Is this a guideline or a rooted in sound software engineer principles? I have been a software engineer for 13 years and never heard of this until now. They insist that code in these smaller source files are easier to understand but it seems to me that there would be tons of small source files.</p>


问:
Efficient ordering of objects online
I have a list with objects stored in a database. These objects are shown in a list and the user can drag and drop them to order them in a specific way. I want that specific order to be stored.

How can I do this in an efficient manner? I've thought of the following options:

Maintain an array with the desired order. Array can be stored locally (not an option in my current project) or online (extra table :(). I don't really like this solution.

Add a "priority" field to each object, and sort the objects by it. By dragging and dropping the priority of one object is changed to a value < the object above and > than the object beneath. There should be a big margin between those priority values though, or I should use halve numbers/float (infinite to platform's float definition). Else one might end up trying to decide what number is bigger than 2 and smaller than 3, for example. Update the updated object only.

Same as 2. but update ALL objects after a drag and drop action, and store them all. This feels a bit inefficient and unnecessary.

Am I missing the obvious? Is there a better way?

答:
You're probably overthinking the efficiency aspect.  Any list small enough for a human to reasonably reorder via drag and drop is trivial for a computer to manipulate, even with very "inefficient" algorithms.  Also keep in mind that humans are very slow, and updating the order is a relatively infrequent operation compared to querying for it.

However, I believe the algorithm with the best tradeoffs between query time and update time would be what I call the BASIC algorithm.  BASIC programs used to have integer line numbers to make interactive programming easier.  Because you might need to insert a line between two lines, you would start out numbering them by 10s.  If you needed to insert a line between, you'd make it a multiple of 5, and so on.  If you ran out of space in between, there was a renum command that put everything back to multiples of 10.

Using this method to sort objects would mean most of the time, you just need to update the one row, with the occasional renumbering of the entire list when you run out of space in between.  Since the numbers wouldn't be user-visible, you can put quite a bit of space in between, so the renumberings should be relatively rare.  That gives you a worst case update of O(n), but an amortized update close to O(1).

Title: Efficient ordering of objects online


问:
Is LinkedList an Abstract Data Structure?
This quote is from the book HeadFirst C:

A linked list is an example of an abstract data structure. It’s called
  an abstract data structure because a linked list is general: it can be
  used to store a lot of different kinds of data.

Is this accurate / correct information?

答:
It just depends on how you interpret "abstract". The excerpt you quote defines "abstract" as capable of holding different kinds of data.

Don't confuse this sense of "abstract" with the JAVA/OOP sense of abstract. In Java, for example, the LinkedList class is not abstract -- it can be instantiated.


答:
Yet another addition to Mason's answer, a program's behavior may depend on the runtime environment.

The following code contains a Use-After-Free:

int main(void)
{
    int* a = malloc(sizeof(a));
    int* b = a;
    *a = 0;
    free(a);
    *b = 12; /* UAF */
    return 0;
}
```

<p>This code is Undefined Behavior, depending on the configuration (release|debug), OS and compiler it will yield different behaviors.
Not only path coverage won't guarantee that you will find the UAF, but your test suite will typically not cover the various possible behaviors of the UAF that depend on the configuration.</p>

<p>On another note, even if path coverage were to guarantee finding all bugs, it is unlikely that it can be achieved in practice on any program. Consider the following one:</p>

<pre class="lang-c prettyprint-override"><code>int main(int a, int b)
{
    if (a != b) {
        if (cryptohash(a) == cryptohash(b)) {
            return ERROR;
        }
    }
    return 0;
}
</code>```

If your test-suite can generate all paths for this, then congratulations you're a cryptographer.

Body:
Yet another addition to Mason's answer, a program's behavior may depend on the runtime environment.

The following code contains a Use-After-Free:

int main(void)
{
    int* a = malloc(sizeof(a));
    int* b = a;
    *a = 0;
    free(a);
    *b = 12; /* UAF */
    return 0;
}

This code is Undefined Behavior, depending on the configuration (release|debug), OS and compiler it will yield different behaviors.
Not only path coverage won't guarantee that you will find the UAF, but your test suite will typically not cover the various possible behaviors of the UAF that depend on the configuration.

On another note, even if path coverage were to guarantee finding all bugs, it is unlikely that it can be achieved in practice on any program. Consider the following one:

int main(int a, int b)
{
    if (a != b) {
        if (cryptohash(a) == cryptohash(b)) {
            return ERROR;
        }
    }
    return 0;
}

If your test-suite can generate all paths for this, then congratulations you're a cryptographer.


答:
The answer is open to interpretation.

To me a basic or concrete data structure simply manipulates memory. Linked lists and arrays fit the bill. Abstract data structures impose regulations or semantics above a basic data structure. Queues, stacks, heaps, and so on.

Title: Is LinkedList an Abstract Data Structure?

Body:
This quote is from the book HeadFirst C:

A linked list is an example of an abstract data structure. It’s called
  an abstract data structure because a linked list is general: it can be
  used to store a lot of different kinds of data.

Is this accurate / correct information?


问:
What practical steps do you take to ensure you are thorough?
Bit of Context

I'm not sure if this is fitting to the programmers.stackexchange area, but I'm not going to post it in SO. Any problem with ambiguity and I'll happily remove it.

If I had to talk openly about my skills and how I sit in a company, I'd say I'm mid-level and about a solid year or two's worth of work away from shooting for a senior position. I'm a C# developer with a strong(ish) background and have a pro-active attitude but my downfall, however, seems to be how thorough I am, and it needs improving fast.

I've had code reviews lately, and it's brought it to my attention that I leave careless holes in what I code before I'm happy to push it over to peers for review. The kind of holes that are embarrassing to hear about, it's not stuff that's outside of the realm of what I already know and are very aware shouldn't be there. For example, I had multiple controller actions today with missing [HttpPost] attributes - something I'm well aware should be there, but were not.

Question:

What approach do you take (or what do you incorporate into your approach) to coding tasks that help avoid carelessness and ensure you're doing a thorough job?

I'm looking for some tangible measures I can put in place today to help. Do you write out what you want to do in plain text or pseudo code first? Do you break your tasks down into much more smaller tasks first with your own set of low-level requirements? Do you write myself a mini tech-spec first? Do you use unit tests to a level that's granular enough to help defend against silly mistakes?

I'm not convinced this problem is entirely down to mind set, I'm convinced my approach is off somehow, and I can't see me tackling the next level without cracking this first.

答:
Do 1 thing at a time and progress to the 2nd thing only after you're done with the first. You missed those [httpPost] bits because you didn't write a controller, and all its associated code, you went straight to the next one before you'd completed the first.

We all do it to some extent, and its generally caused by coding away oblivious to what your code is going to do in action.

the other aspect is testing, did your controller method even work? If not, why not! Coding isn't about writing code. Its part documentation, analysis, coding and testing. If you miss any of those steps out then you're just an amateur bashing away at the keyboard.

You don't have to do a lot for these things, but you do have do do them. Documentation can be just adding the right comments, analysis can be a simple walk through in your head before you start, testing can be just running through the final code in the debugger. You can do these things more thoroughly if you like and have the time, but you have to do them in order to create good product.


答:
Putting every local variable in the
first feew lines of the method block.
Especially in conjunction with long
methods.

Using boolean variables to break out of loops / skip iterations instead of just using break / continue

Title: Which things instantly ring alarm bells when looking at code?

Body:
I attended a software craftsmanship event a couple of weeks ago and one of the comments made was "I'm sure we all recognize bad code when we see it" and everyone nodded sagely without further discussion.

This sort of thing always worries me as there's that truism that everyone thinks they're an above average driver. Although I think I can recognize bad code I'd love to learn more about what other people consider to be code smells as it's rarely discussed in detail on people's blogs and only in a handful of books. In particular I think it'd be interesting to hear about anything that's a code smell in one language but not another.

I'll start off with an easy one:

Code in source control that has a high proportion of commented out
  code - why is it there? was it meant
  to be deleted? is it a half finished
  piece of work? maybe it shouldn't have
  been commented out and was only done
  when someone was testing something
  out? Personally I find this sort of
  thing really annoying even if it's just the odd line here and there, but when you see large blocks interspersed with the rest of the code it's totally unacceptable. It's
  also usually an indication that the rest of
  the code is likely to be of dubious
  quality as well.


答:
The question of abstractness is closely related to the language it is implemented in.

In Java, C# and the like, an abstract data structure is truly an abstract one. You can't instantiate it directly. This may be because it is an interface or an abstract class.  It is a concept with some underlying things to it.  LinkedList isn't abstract - it is a concrete implementation of a List (that's an abstract data structure in Java), which itself is a Collection (for more abstract set of operations on it).

In C, however, you don't have the generics.  Unless you are doing everything with void* types in a given data structure, it doesn't really exist in the abstract. And so concepts such as hash tables (a concrete type in Java) and linked lists remain in the abstract realm until you make a "here is a struct with this data structure that allows you to implement a linked list".

So, is it abstract or not? In some languages it is, in others it isn't.

Lets confuse things a bit.

A linked list is a Pattern - it is a tool you use or implement when a particular problem calls for it. Some have argued that design patterns are missing language features.  That it is abstract in one language and concrete in another is because it is a "missing" language feature in C and not in Java (but there its part of the class library rather than being a fundamental part of the language like in Lisp).

At the end of the day, don't worry about if it is abstract or not. It is something. And you implement or use it somehow. When a C programmer and a Java programmer talk about a Linked List, they are talking about the same thing (just the C programmer did more work). That's all that matters. Its a common way of talking about a common thing, and that's what Patterns are about.


答:
What approach do you take (or what do you incorporate into your approach) to coding tasks that help avoid carelessness and ensure you're doing a thorough job?

I by and large don't - it's a waste of time.

Missing attributes is a 30 second fix and will be easily caught by testers/integration tests/UAT/whatever. In my current position (and others I've held), that sort of error is easily correctable and has little impact on business. I'm not writing code for the space program. So I'm not going to implement say... a 30 minute process to catch a 30 second fix.

Do you write out what you want to do in plain text or pseudo code first?

Rarely. The only reason I write it out is so that I can run the plan by others to make sure I'm not overlooking big things.

Do you break your tasks down into much more smaller tasks first with your own set of low-level requirements?

It depends on what you mean. In many jobs, I will break user stories (1-2 week work) into tasks (0-2 day work). That though won't help me catch overlooked attributes.

Do you use unit tests to a level that's granular enough to help defend against silly mistakes?

Absolutely. Because the unit tests generally catch those sorts of silly mistakes. Code coverage tools can help me see what things are (probably) tested sufficiently and what parts might need more eyeballs. Unit tests should be about 5 lines of code, and should have only one reason to fail. The real world sometimes prevents that, but yes, they should be that granular.

That wouldn't help for attributes on your controller, which is why unit tests are but one part of a layered testing approach.

Mostly though, it seems as though you're worrying about trivialities. Remember the old idiom - "Perfect is the enemy of good".

Title: What practical steps do you take to ensure you are thorough?

Body:
Bit of Context

I'm not sure if this is fitting to the programmers.stackexchange area, but I'm not going to post it in SO. Any problem with ambiguity and I'll happily remove it.

If I had to talk openly about my skills and how I sit in a company, I'd say I'm mid-level and about a solid year or two's worth of work away from shooting for a senior position. I'm a C# developer with a strong(ish) background and have a pro-active attitude but my downfall, however, seems to be how thorough I am, and it needs improving fast.

I've had code reviews lately, and it's brought it to my attention that I leave careless holes in what I code before I'm happy to push it over to peers for review. The kind of holes that are embarrassing to hear about, it's not stuff that's outside of the realm of what I already know and are very aware shouldn't be there. For example, I had multiple controller actions today with missing [HttpPost] attributes - something I'm well aware should be there, but were not.

Question:

What approach do you take (or what do you incorporate into your approach) to coding tasks that help avoid carelessness and ensure you're doing a thorough job?

I'm looking for some tangible measures I can put in place today to help. Do you write out what you want to do in plain text or pseudo code first? Do you break your tasks down into much more smaller tasks first with your own set of low-level requirements? Do you write myself a mini tech-spec first? Do you use unit tests to a level that's granular enough to help defend against silly mistakes?

I'm not convinced this problem is entirely down to mind set, I'm convinced my approach is off somehow, and I can't see me tackling the next level without cracking this first.


答:
One approach I have been taking that has been very helpful is:

starting out with acceptance test without implementing it to give the context of what needs to be worked on and then diving into building the structure.

Once there is some structure (i.e. I have classes, interfaces, some unimplemented methods) I go ahead and start writing unit tests for whatever makes sense. Try not forcing unit test or you'll end up testing things you don't need.

I don't think this is pure TDD because I am not writing all of my tests first. Instead, I am writing one or two high-level tests to see the structure in my mind more clearly and then I go ahead and implement it. There are a few reasons why this is helpful and why it can keep you away from making silly mistakes.

1) You see the big picture first in your implementation. Even if you haven't implemented the acceptance test you already see your inputs and required outputs. This gives a whole lot of context and how you should be moving forward. Hence clear vision, which will help you be more thorough.

2) You are following TDD (even though not fully) which keeps your code testable at all times and therefore with a higher probability of being decoupled. This is just good design.

3) When you understand the context of what is being worked on your mind is more comfortable thinking about the low-level details, allowing you to reduce the amount of silly mistakes you could have made otherwise.


问:
How can I create a model to efficiently answer the question of - where to place my db-interaction code I am about to write?
I am seeking the right model for storing and retrieving data, when working with any specific class, while keeping in mind the bigger picture.

Details:

I have some SQL code in (one) of my classes and I would like to use Separation of Concerns (SoC) to remove dealing with direct-database-specific code in that class.

Simplest thing will be to create DBCodeForOneSpecificClass class, but thinking globally, I may end up with too many classes - I think creating a DB handling class for each Business logic is wasteful.

So I need to find a way to consolidate those DB-access functions properly.

I recall there was an advice in a book on refactoring SQL specifically and it was "pull all SQL code in your entire codebase and consolidate it in a single space, away from all other non-direct-SQL-dealing classes".  I do not recall specifics.  I presume all SQL-code was to go into its own separate folder, where perhaps there was some kind of strategy or philosophy to keep a happy medium between the extremes of

create a single separate db-handling class for all classes in your entire codebase

create a single separate db-handling class for each BusinessLogic class

My question is -- can you help fill some specifics into the space between the extremes -- what are some heuristics / models / ways I could use to make a decision on how to structure my DB-handling classes, so that I pretty much immediately know what to do, when handling a question of "Where do I place my db-handling code I currently find myself writing in this BusinessLogicClass?"

Because right now I seem to solve this question on a case-by-case basis, either having SQL right inside the class, or in a separate class made just for one class, or grouping SQL by an aspect.  In the end, ending up with various models mixed up, and that is not good.  I am thinking that maybe may need help defining what an aspect is, or identifying clearer boundaries of what my domain objects are, which perhaps means identifying larger moving parts of the codebase, and then structuring my DB-interaction classes around those parts.

My satisfaction with the answers will depend on whether I am able to get closer to answering question of "Where do I put my d--n SQL while writing this specific new feature in this specif class...?", while supporting SoC principle, and without being wasteful (too specific) or creating a big ball of mud (too general).

答:
You could use the Template Method Pattern. Here is how.

Have an abstract class that will be the parent and define the way things are being loaded from the database.

Loading method will be an abstract method returning a generic value.

Connection string will be an abstract property.

Once you extend other classes from this parent class you can then define their own connection string as needed and implement the method for loading by returning their own specific value through the use of generics.

If there is a similarity in all of the subclasses on how things are being loaded from the database just push it up to the parent class.

If there are no similarities then separating them was a good idea in the first place because you are separating concerns and not merging them.

This also allows you to keep your codebase organized when other developers contributing since they would need to extend the parent class which has the loading template to be able to write their own loading implementation.

It also decouples your repository from the rest of the codebase because the rest of your codebase doesn't have a clue as to which specific subclass is implementing the parent class that knows how to load stuff.


问:
Doubts about architectural pattern for customizable standard enterprise application
My company needs to build an application to be rolled out for a lot of clients. This software will have many modules and functionalities, but some of these will need specific adjustments for some companies. Those adjustments might be of minor nature (like a new input in a form), or may be major customizations, like changing the entire form with different steps and business rules before save/edit/delete. It can be expected that the customization may also leads to some changes on database level, like new columns.

The application already exists, but we did not include these changes yet. The application uses .NET, WebApi, AngularJs. As software architecture design pattern we use microservices and a Domain Driven Design (DDD) approach. The Visual Studio Solutions structure is like this:

WebApp: routes, JS, CSS, html.

Module-Interface: WebApi Controllers, and Services

Module-Domain: bounded contexts, aggregation roots, domain.

Module-Infrastructure: unit of works, repositories, persistence validators, entity mapping

An idea to control this complex scenario is using different branches (on git) for each client. But this may lead to the problem that we need to maintain different applications in the future.

We think it is much better to keep it all in a single branch. But we have a lot of doubts about how to realize it in a good manner (best practice?).

As an example, imagine a CRUD for "User" domain that can have different business rules on different clients. Problems that we see:

Do we need to create different save methods on User domain? Like "saveForClient1", "saveForClient2"...?

We fear that inheritance on domains could have a negative impact on our DDD approach for this problem.

If the customization is that huge that different HTML/Javascript files and .cs files need to be created, but also use already existing code, how can this be organized in a 'nice' way?

Updated (18/10/2016)

I changed of job before going more deep in the solution, but there are comments asking about what strategy we choose.

Use different branches it's the worst idea. The better strategy is control the differences in the code, making different packages, files and REST resource paths to organize this code and attend the specific functionalities. Use interfaces and dependency injection to maintain the same contract in the system but with different implementations for the clients. DDD can help you to isolate this cases where some information from database is client specific.

In the front-end, it's a good idea to choose a painless library to help you to build interfaces, gaining flexibility to make different interfaces reusing the same components (like React).

答:
Customization is as simple or complex as introducing any other requirement. Each time you add a custom business rule or a business rule modification to your application, analyse how to make this rule visible or invisible, active or inactive, available or not available by some kind of run-time switch. Think of the customization step just as an extra, separated requirement, and deal with each of this run-time switches exactly the same as you do with any other requirement: analyse your options how to implement it, make technical decisions, plan the effort, develop, test and deploy the feature. Ask yourself

which impact will decision have on the existing code base

which changes will be necessary in your database (maybe you need some custom fields only used for some of your customers, maybe you need a different table, maybe you have to make your model more generic etc.)

Just do not expect a "one size fits all" solution: different business requirements will lead to different forms of customization, so you will have to repeat these steps with each new custom feature. And avoid to group customizations "per client" like "saveForClient1", "saveForClient2". Instead, add customizations "per feature" - that gives you a much better granularity. For example, lets assume the business rules in the former case are the validation rules of the save method. You could either have one save method with a customized list of validations before saving happens, you could have a save method with additional parameters for controlling the validation, you could have two different save methods like "saveWithDefaultValidation" and "saveWithSpecialValidation", you could have a flag in your User object or somewhere else in your data model for controlling which validation rules will apply - and there are many more possible solutions. As an additional option to this, you could also think of a plugin system, where extra functionality is made available by some additional modules sold only to the customers who pay for them (but still your core product remains 100% the same for each customer). Just pick the one which serves your purpose best.

It should be obvious that you will have to plan if your clients shall be able to change the specific customization options by themselves (for example, by some config file), or if you do this for them, or if you need to take some technical measures to prevent your clients for activating features they have not paid for. The plugin system above maybe such a measure. Nevertheless I recommend to avoid different core deployments for different clients, if possible.

EDIT: I like to add that I agree with the OP about not using per-client branches in the VCS for this purpose. The problem which occurs is that whenever a new feature in the trunk is added, the dev who adds the feature cannot see immediately if this will collide with any code of the other branches, and if there is something to be changed, too, or if a more general solution is needed which works for the trunk and client specific releases as well. If you are lucky, you might notice this later, when you try to propagate changes from the trunk to the client branches and get merge collisions. If you are not so lucky, you do not get any merge collisions, but one of your client releases now has a severe bug. Maybe your automatic tests will catch this, maybe your manual testing, or in the worst case the customer is the first who notices it, but it should be clear that your testing effort multiplies with each client. This is because when you allow arbitrary changes in each branch, you will have to make a full integration test with the whole product after a change in the trunk for each branch.


问:
How can 'yield' be added as a keyword in ES6 if it wasn't a reserved word?
yield is not a reserved word in JavaScript, yet ES6 makes it a keyword.

I thought the point of reserved words was for backwards compatibility. For example, let and const were reserved, so you couldn't use those words as variable names in your ES5 code. That ensures that your ES5 code will run fine in an ES6 engine.

...but what if you used yield as a variable name? Why was this word not reserved? And if it doesn't matter, then why were any words reserved?

答:
In ECMAScript 5, yield is a strict-mode "Future Reserved Word":

7.6.1.2 Future Reserved Words

The following words are used as keywords in proposed extensions and are therefore reserved to allow for the possibility of future adoption of those extensions.

...

```<code>class enum    extends super
const export  import
</code>```

The following tokens are also considered to be FutureReservedWords when they occur within strict mode code (see 10.1.1). The occurrence of any of these tokens within strict mode code in any context where the occurrence of a FutureReservedWord would produce an error must also produce an equivalent error:

```<code>implements  let      private    public  yield
interface   package  protected  static
</code>```

This means that in non-strict code, your concerns are correct: the correctness of the line var yield = 5; will differ in non-strict mode between an ES5 and ES6 implementation. However, in strict mode, the line is invariably invalid for both ES5 and ES6. This means that you should use strict mode whenever possible to maximize forward compatibility of your ES5 code.

As for why yield was not fully reserved for non-strict code, I assume this was done to bridge compatibility between ES3, which did not include yield as a FutureReservedWord (see ES3 section 7.5.3, on page 14). In order to introduce yield, the commitee had to break compatibility somewhere, either in the 3-to-5 transition or the 5-to-6 transition. However, some reserved words that were included in ES3 were downgraded to strict-mode reserved words in ES5. I do not know the rationale for that decision.

Body:
In ECMAScript 5, yield is a strict-mode "Future Reserved Word":

7.6.1.2 Future Reserved Words

The following words are used as keywords in proposed extensions and are therefore reserved to allow for the possibility of future adoption of those extensions.

...

class enum    extends super
const export  import

The following tokens are also considered to be FutureReservedWords when they occur within strict mode code (see 10.1.1). The occurrence of any of these tokens within strict mode code in any context where the occurrence of a FutureReservedWord would produce an error must also produce an equivalent error:

implements  let      private    public  yield
interface   package  protected  static

This means that in non-strict code, your concerns are correct: the correctness of the line var yield = 5; will differ in non-strict mode between an ES5 and ES6 implementation. However, in strict mode, the line is invariably invalid for both ES5 and ES6. This means that you should use strict mode whenever possible to maximize forward compatibility of your ES5 code.

As for why yield was not fully reserved for non-strict code, I assume this was done to bridge compatibility between ES3, which did not include yield as a FutureReservedWord (see ES3 section 7.5.3, on page 14). In order to introduce yield, the commitee had to break compatibility somewhere, either in the 3-to-5 transition or the 5-to-6 transition. However, some reserved words that were included in ES3 were downgraded to strict-mode reserved words in ES5. I do not know the rationale for that decision.


问:
Simple TimeZones
I need to send out emails based on a timestamp. But the timestamp must be what the user expects it to be.

The timestamp is set by the user submitting an object.

E.g

Al from L.A in the U.S saves an object with a timestamp of '3/30/2015 10:00:00AM'.

Lars from Berlin in Germany saves an object with the timestamp of '4/15/2015 11:00:00PM'.

The system that looks at these objects and later sends out emails is based in a GMT+1 timezone.

My thought, to keep it super simple, is to add or subtract the difference in the timezone hours, based on where the object is from (timezone).

So in Al's example the system would subtract 9 hours (GMT+1 difference) but in Lars' example the system would keep the date, since Germany is also GMT+1.

Wouldn't that be an ok soultion ?

答:
Not so much. Maybe.

The problem is that if Al from LA marks something with 1/1/2015 10AM and 7/1/2015 10AM, those will be different offsets from GMT.

"What the user expects it to be" can get really dicey given our overly complex way of measuring times. Where at all possible, work using UTC (which may or may not be different from GMT depending on your precision needs) and translate to local time as close to display to the user as possible.

Title: Simple TimeZones