问:
"Everything is a Map", am I doing this right?
I watched Stuart Sierra's talk "Thinking In Data" and took one of the ideas from it as a design principle in this game I'm making. The difference is he's working in Clojure and I'm working in JavaScript.  I see some major differences between our languages in that:

Clojure is idiomatically functional programming

Most state is immutable

I took the idea from the slide "Everything is a Map" (From 11 minutes, 6 seconds to > 29 minutes in).  Some things he says are:

Whenever you see a function that takes 2-3 arguments, you can make a case for turning it into a map and just passing a map in.  There are a lot of advantages to that:

You don't have to worry about argument order

You don't have to worry about any additional information.  If there are extra keys, that's not really our concern.  They just flow through, they don't interfere.

You don't have to define a schema

As opposed to passing in an Object there's no data hiding.  But, he makes the case that data hiding can cause problems and is overrated:

Performance

Ease of implementation

As soon as you communicate over the network or across processes, you have to have both sides agree on the data representation anyway.  That's extra work you can skip if you just work on data.

Most relevant to my question. This is 29 minutes in: "Make your functions composable". Here's the code sample he uses to explain the concept:

```<code>;; Bad
(defn complex-process []
  (let [a (get-component @global-state)
        b (subprocess-one a)
        c (subprocess-two a b)
        d (subprocess-three a b c)]
    (reset! global-state d)))

;; Good
(defn complex-process [state]
  (-> state
    subprocess-one
    subprocess-two
    subprocess-three))
</code>```

I understand the majority of programmers aren't familiar with Clojure, so I'll rewrite this in imperative style:

```<code>;; Good
def complex-process(State state)
  state = subprocess-one(state)
  state = subprocess-two(state)
  state = subprocess-three(state)
  return state
</code>```

Here are the advantages:

Easy to test

Easy to look at those functions in isolation

Easy to comment out one line of this and see what the outcome is by removing a single step

Each subprocess could add more information on to the state.  If subprocess one needs to communicate something to subprocess three, it's as simple as adding a key/value.

No boilerplate to extract the data you need out of the state just so that you can save it back in.  Just pass in the whole state and let the subprocess assign what it needs.

Now, back to my situation:  I took this lesson and applied it to my game.  That is, almost all of my high level functions take and return a gameState object.  This object contains all the data of the game.  EG: A list of badGuys, a list of menus, the loot on the ground, etc.  Here's an example of my update function:

```<code>update(gameState)
  ...
  gameState = handleUnitCollision(gameState)
  ...
  gameState = handleLoot(gameState)
  ...
</code>```

What I'm here to ask about is, have I created some abomination that perverted an idea that is only practical in a functional programming language?  JavaScript isn't idiomatically functional (though it can be written that way) and it's really challenging to write immutable data structures.  One thing that concerns me is he assumes that each of those subprocesses are pure. Why does that assumption need to be made?  It's rare that any of my functions are pure (by that, I mean they often modify the gameState.  I don't have any other complicated side effects other than that).  Do these ideas fall apart if you don't have immutable data?

I'm worried that one day I'll wake up and realize this whole design is a sham and I've really just been implementing the Big Ball Of Mud anti-pattern.

Honestly, I've been working on this code for months and it's been great.  I feel like I'm getting all the advantages he's claimed.  My code is super easy for me to reason about.  But I'm a one man team so I have the curse of knowledge.

Update

I've been coding 6+ months with this pattern. Usually by this time I forget what I've done and that's where "did I write this in a clean way?" comes into play. If I haven't, I'd really struggle. So far, I'm not struggling at all.

I understand how another set of eyes would be necessary to validate its maintainability. All I can say is I care about maintainability first and foremost. I'm always the loudest evangelist for clean code no matter where I work.

I want to reply directly to those that already have a bad personal experience with this way of coding.  I didn't know it then, but I think we're really talking about two different ways of writing code.  The way I've done it appears to be more structured than what others have experienced.  When someone has a bad personal experience with "Everything is a map" they talk about how hard it is to maintain because:

You never know the structure of the map that the function requires

Any function can mutate the input in ways you'd never expect.  You have to look all over the code base to find out how a particular key got into the map or why it disappeared.

For those with such an experience, perhaps the code base was, "Everything takes 1 of N types of maps." Mine is, "Everything takes 1 of 1 type of map". If you know the structure of that 1 type, you know the structure of everything.  Of course, that structure usually grows over time.  That's why...

There's one place to look for the reference implementation (ie: the schema). This reference implementation is code the game uses so it can't get out of date.

As for the second point, I don't add/remove keys to the map outside of the reference implementation, I just mutate what's already there. I also have a large suite of automated tests.

If this architecture eventually collapses under its own weight, I'll add a second update.  Otherwise, assume everything is going well :)

答:
From what (little) I've seen, using maps or other nested structures to make a single global immutable state object like this is fairly common in functional languages, at least the pure ones, especially when using the State Monad as @Ptharien'sFlame mentioend.

Two roadblocks to using this effectively that I've seen/read about (and other answers here have mentioned) are:

Mutating a (deeply) nested value in the (immutable) state

Hiding a majority of the state from functions which don't need it and just giving them the little bit they need to work on / mutate

There are a couple of different techniques / common patterns which can help alleviate these issues:

The first is Zippers: these let one traverse to and mutate state deep within an immutable nested hierarchy.

Another is Lenses: these let you focus into the structure to a specific location and read/mutate the value there. You can combine different lenses together to focus on different things, sort of like an adjustable property chain in OOP (where you can substitute variables for actual property names!)

Prismatic recently did a blog post on using this sort of technique, among other things, in JavaScript/ClojureScript, which you should check out. They use Cursors (which they compare to zippers) to window state for functions:

Om restores encapsulation and modularity using cursors. Cursors provide update-able windows into particular portions of the application state (much like zippers), enabling components to take references to only the relevant portions of the global state, and update them in a context-free manner.

IIRC, they also touch on immutability in JavaScript in that post.


问:
For HTML report generation, should CSS be put into stylesheet or written into the html file?
I'm writing a report generator for an automation tool.

Right now I have a report template html file which is read by the generator and the results are filled in by the tool to be written to another html file.

I suppose the benefit of using the

答:
In a web-serving context, putting the stylesheet in a separate file is MUCH preferred. It will lead to much better in-browser and in-Web-middleware caching behavior, so have much better performance (and impose lower load on all of the systems involved). There are other benefits as well (e.g. better modularity, versioning, ...).

But that's not your case. You seem to have a situation where having a single, all-inclusive, self-contained HTML files  would be preferable. The parts of the document (like CSS) that can be separated...well, if someone's not careful in transmitting the files, they will be separated. And then the document won't "look right." It will look broken. Perhaps very broken, depending on how much you rely on CSS. So by all means, embed your styles.

Aside About Images and Email

In HTML, images are often left external. For truly self-contained files, you'd like them to be included too. That is now generally possible if you base64 encode them. There is a older alternative strategy, MHTML, for sending images and other content through email. Directly stating base64 data seems to be better supported these days, especially for browser viewing.

But if you are encoding HTML (reports, documents, etc.) for email (i.e. as the primary email message, rather than as attachments), beware. This is a bit of a dark art, even today requiring a lot of expertise about the vagaries of the different end-points/mail programs. Outlook vs. Gmail vs. XYZ--they can be very different, not only from each other, but also from the HTML you would use and expect to work correctly across their browser products. Email HTML is a tricky devil, and it doesn't play by the normal rules. Stylesheets there, for example, are not recommended at all, because they will often be intentionally disregarded. If you want to style those, write your stylesheet for composing your HTML email, then use a library to deconstruct your stylesheet and explicitly pack the appropriate styling into style attributes. See premailer for an example of a library that helps you style email HTML in a way that will be respected by the average mail program.

ContentLicense: CC BY-SA 3.0


问:
Why are floating point numbers used often in Science/Engineering?
While investigating the accuracy of floating point numbers, I've seen in a few places a statement similar to

"float and double are (designed for/used often in) engineering and scientific calculation"

From my understanding, the strength of floats and doubles are the amount of memory they use for their (good, but not perfect) precision.

I feel like I'm almost getting an understanding from this answer

"floating point numbers let you model continuous quantities"

I still am not convinced I understand. Engineering and Science both sound like fields where you would want precise results from your calculations, which, from my understanding, floating points do not give. I'm also not sure I follow what a "continuous quantity" is, exactly.

Can somebody expand on this explanation and perhaps give an example?

答:
Floating point numbers provide relative accuracy: they can represent numbers that are at most a small percentage (if you want to call something like 0.0000000000001% a percentage) away from any accurate number over a wide range of numbers.  They share this trait with a slide rule, though the latter does not get better than something like 3 digits of accuracy.  Still, it was quite sufficient for working out the static and dynamic forces of large structures before digital computers became commonplace for that, and that's because the material constants also show some variation, and picking constructs that are reasonably benign against material and construction differences will tend to make the maximum loads and weak points reasonably identifiable.

Now "accuracy" is a useful feature for many numbers representing measurements and/or magnitudes of physical properties.

Not everything in science/engineering belongs in that category.  For example, if you are using number theoretic transforms for multiplying large numbers or Galois fields for manipulating error correction polynomials, there is no such thing as a small error: any single bit error during processing will lead to results that are quite indistinguishable from completely random noise.

Even in those areas one can work with floating point numbers (like using complex FFTs for doing convolution) if one keeps track of the accumulation of errors and makes sure that the floating point errors do not accumulate enough magnitude to possibly even flip a single bit in the actual entities that they are an approximations of.  For such approximations, fixed point processing would likely be more appropriate but floating point units in the field tend to provide faster operation and a larger number of usable bits.

Also programming languages like C or Fortran make it surprisingly hard to access basic operations like mixed precision multiplication and division or a carry bit for addition/subtraction, and those are basic building blocks for going beyond limited precision integers.

So if you can map operations to floating point numbers, you tend to have reasonably powerful hardware at your disposal these days and you can reasonably well specify your algorithms in one of today's general purpose programming languages.


问:
Peer review for tests just like code reviews
Does anyone practice the "code review" process for functional tests? Do you find it useful? The way that my current employer practices SCRUM we include functional testing as part of our "must have done" stuff in any given sprint.</p>

答:
Good heavens yes (I try not to use expletives on SO ;p).  Peer reviewing your functional tests is basically peer reviewing your requirements and analysis, it's incredibly important, and if you use a BDD language like cucumber you can involve non programmers as well!

It's awesome when our end users spot issues with our functional tests and it makes them feel hugely part of the development process "I can read code too!!"

ContentLicense: CC BY-SA 2.5


问:
Return equal occurrence of char in a list of strings
I have an array of strings ["abb", "bbxxaa"].

I would like to print all characters that occur equal times in each index so in above case I would print bb because they occur twice in both indexes and a occurs once and twice in first and second index respectively.

My approach:

Keep track of only the characters in the first index and
because we would not need to worry about other letters anyway.
So in above case I would keep track of letter a and b and check if
they occur same time in the next indexes.

Can someone suggest a better way if possible or am I on right track?

答:
You are off to a good start but you might want to consider how it performs when these strings are long.  For each letter in the first string you could end up comparing against every letter in the second string, taking time that grows as the product of the two string sizes.

One way would be to preprocess both strings so that for a given letter you know how many times it happens. If you are sure that these are 8 bit characters, you could use two int arrays of size 256, if you make sure to reset them to zero.  (in c++ it might be easier to build a character to int map.)  For output you loop up the count of each character in your table, and see if it had the same count in the other table.

A slightly different way would be to sort each string.  Then you could scan forward through both sorted strings at the same time.


问:
database migration with data already in the database in production
I don't know much about migrations, but this is a specific question I'm not sure how to answer.

In production, how can one change the database format/schema when there is already user data in there? (Is the answer different for our Meteor app on MongoDB vs our master Postgres database?) Basically, if you write new code that introduces a new field, and new code that expects that new field to be present, then the system will not work when pulling data from the database that was there prior to the changeover.

For Mongo at least, a possible solution is to write a script to update the database layout with the data in it, but I wonder if this is too error prone for a production database, and infeasible when you just don't have the necessary information (like if you didn't collect a certain info field from the user before.)

答:
if you write new code that introduces a new field, and new code that expects that new field to be present, then the system will not work when pulling data from the database that was there prior to the changeover.

You have to take that into account when you are writing your code. You could run a script when you deploy the new changes to populate this field with a default value. You could write your code so that it is able to handle the situation where the field is no present/populated.

Exactly what you do will probably depend on the details of your situation, but you're correct: you have to do something to handle this.

...And it goes without saying that you should test this migration process thoroughly (on a copy of production, if possible) before running it in a production system. ;)


答:
Only tracking characters from the first string is a good idea.

You can also stop tracking characters once you've proven that there are more such characters in the second string than in the first.

So I'd keep a list of structs {char_t character, int count_first, int count_second} for each distinct character of first string. For each character in the second string, I'd scan the list and increment the count_second in the element where character matches the current character. If count_first < count_second after this, I'd remove the element from the list.

In the end, I'd filter the elements where count_first == count_second.

Title: Return equal occurrence of char in a list of strings

Body:
I have an array of strings ["abb", "bbxxaa"].

I would like to print all characters that occur equal times in each index so in above case I would print bb because they occur twice in both indexes and a occurs once and twice in first and second index respectively.

My approach:

Keep track of only the characters in the first index and
because we would not need to worry about other letters anyway.
So in above case I would keep track of letter a and b and check if
they occur same time in the next indexes.

Can someone suggest a better way if possible or am I on right track?


问:
C Linked List Implementation Pointer vs. Pointer-to-Pointer Consistency
To get some practice in C, I'm writing some basic functions for operating on a linked list of ints. I started out with functions that accepted as a "list" a pointer to the head node. Now, I find myself running into more and more occasions when I either need to limit the spec of the function more than I would like, or I need to use a pointer to a pointer to the head node to allow for alteration/removal of the head node in a way that is consistent with the way I alter/remove other nodes.

Is it preferable to have all functions accept a "list" in the same form, as a pointer to a pointer, rather than having some accept just a pointer to the node? Or should I perhaps change the way I think about altering/removing the head node to avoid needing to change the head pointer?

For example, if I write a remove function that removes all instances of the given int, and the head node's value is that int, I see a few obvious choices:

I can pass in a pointer to a pointer and move the head pointer to the next node not being removed.

I can pass in a pointer and I can move the value of the next node not being removed, say node x, into the head node and remove node x along with any other nodes that hold the value to be removed. This fails in the case that the list consists of only a single node that contains the value, and so I have to limit the spec to exclude this case.

In the case that I pass in a pointer to a pointer for this function, should I now change all other functions to accept a pointer to a pointer?

Are there standards for things like this or is it up to me? (Pretending of course that this code matters in some fashion to someone other than me and would, in that fantasy land, be used by other people without knowledge of the inner workings of the functions, beyond their signatures.)

答:
I wrote a similar program for the linked list in C, you need to get pointer to pointers in all functions to make it consistent across all function, because removing and create a new head or tail would require a pointer to pointer.
However you can make a enum for the tail and head pointers.
example from my code:

```<code>enum LIST_PTR {
    LIST_HEAD =0,
    LIST_TAIL
};
struct node {
  struct node *NextNode; // Pointer to next node
  int data; // node data.
};

void enqueue(struct node** head, struct node** tail,int data);
int dequeue(struct node** head, struct node** tail);
int getCount(struct node** head, struct node** tail);
int destroyList(struct node** head, struct node** tail);
</code>```

then you can declare and use or linked list in following manner

```<code>struct node* my_list[2];
my_list[0]=my_list[1]=NULL;

getCount(&my_list[LIST_HEAD],&my_list[LIST_TAIL]);
</code>```

make sure you assign the pointers to NULL or i am telling you by experience, you will have a seg fault of which you will have no idea!

Body:
I wrote a similar program for the linked list in C, you need to get pointer to pointers in all functions to make it consistent across all function, because removing and create a new head or tail would require a pointer to pointer.
However you can make a enum for the tail and head pointers.
example from my code:

enum LIST_PTR {
    LIST_HEAD =0,
    LIST_TAIL
};
struct node {
  struct node *NextNode; // Pointer to next node
  int data; // node data.
};

void enqueue(struct node** head, struct node** tail,int data);
int dequeue(struct node** head, struct node** tail);
int getCount(struct node** head, struct node** tail);
int destroyList(struct node** head, struct node** tail);

then you can declare and use or linked list in following manner

struct node* my_list[2];
my_list[0]=my_list[1]=NULL;

getCount(&my_list[LIST_HEAD],&my_list[LIST_TAIL]);

make sure you assign the pointers to NULL or i am telling you by experience, you will have a seg fault of which you will have no idea!


问:
How to securely implement roles in a Windows Form application?
As an ISV, what is considered best practice for implementing application role based security? In other words, only allow users to access certain features in the application based on what roles they belong to.

We currently just use a table in our database to store this, but it has been suggested that for maximum HIPAA compliance, this isn't secure enough.

My first thought was to just use Active Directory groups, as it would seem that is what they are designed for, however, it just doesn't seem practical to rely on our clients IT departments to create groups and assign users to them for groups that are specific only to our application. This can't be best practice for ISVs...

At this point it my research, it seems that possibly the best solution might be to use something like Active Directory Application Mode (ADAM) (Active Directory Lightweight Directory Services) and possibly AzMan (Windows Authorization Manager)?

Again, this is for a Windows Forms application, not a Web application or in an "in house" solution.

If it matters, we are also in the process of transitioning our home-baked authentication to instead use active directory for authentication.

Also of note is this needs to be secure (HIPAA compliant).

All the information I can find on these subjects seems to be for developing applications for in house use, or for web applications, and neither of these approaches feels appropriate for a Windows Forms application.

(We are using .NET for development.)

答:
Moving the roles to LDAP / AD as a solution isn't going to address your root problem in a simple fat client architecture, but that isn't a reason not to do it, read on...

In the case of HIPAA security, we want to implement a system such that someone that knows database security and .NET internals can't hack your system by reverse engineering your application. If I were to audit your application, a disassembler and a network sniffer are two of the tools I'd use.

Don't get distracted with "we don't know who has the database password..." and all that. HIPAA doesn't depend on that. That isn't the application's concern. Actually in a HIPAA-secure environment, you will assume that certain people are authorized to maintain the system data, and it isn't up to you to solve all potential security problems in the organization. Likely the owner/doctor and system administrators will have access to all of it. Much of HIPAA is legal contract. A HIPAA security implementation requires you to place some level of burden on the customer to maintain the appropriate policies and procedures at their healthcare practice.

The customer, and their staff, will have all signed HIPAA contracts that pertain to their role in the customer organization. So will you, if you are engaged to install, maintain or support the system in any capacity that means you may touch data. All other partners, associates, including system administrators and third-party contractor, will usually be covered by BAA agreements, based on who they are and what data they may handle.

For an RBAC architecture, our job is to secure the application. As an PHI Application Architect, we are concerned, in our application, with security of PHI data from:

Unauthenticated users

Unauthorized users - Example: If I have roles(Technician), I should never be able to view data for roles(Physician, Nurse, Admin)

Spoofed roles - the user is a Tech but claims he is a Doctor

To be HIPAA compliant the application must:

Identify unauthorized access

Identify which data was accessed

Identify when it was accessed

Identify where it was accessed

Identify who accessed it

Record the event

Notify appropriate parties of the access in a timely fashion

Some companies use very broad definitions for a HIPAA compliant application, but in designing several EMR systems and having had to answer a lot of hard questions from customers, CEOs, auditors, and critics, I've learned that if I use sound computer science, I can formally prove that the system is secure (bugs notwithstanding).

So in that light, what does LDAP accomplish? There are a couple of benefits that have nothing to do with security:

Stores roles for the organization in a standard format that a Windows system administrator might be more comfortable with.

Centralizes roles such that other applications can share these roles, and you don't have to repeat yourself.

So it's a good thing. Large organizations have a lot of separate systems and a lot of duplicate data and entry. Particularly hospitals! If you can support LDAP and HL7, you can possibly plug in to their IT infrastructure (but usually with a bit of customization). To be competitive, it is a good feature.

But LDAP alone solves nothing regarding enforcement of roles and data access; you shouldn't make it a requirement to run your application (unless you are in the mid- to high-end space where the cost and skill set requirement is minor compared to the overall price of the application, or your application is for a specific organization that already has AD). For small "mom and pop" practices, your application should be turnkey, probably on a simple architecture of one or two PCs or a PC and a cheap server. We often think of healthcare practices as cash rich, but as I'm sure you know, the truth is many of them are not, or if they were, they have already been burned over and over by software vendors claiming to have the total solution. That said, I'll proceed now on pure technical aspects and leave your business to you.

Technical Perspective:

A good practice is to think as if your front end application is written in Ruby (or some other scripting language). I can compromise a compiled binary if I have read-access to that binary program. On most OSes, if I can run it, I can read it. The privileges are Read Write and Execute (X), and X doesn't come without (R). So assume with a .NET local application, that I can decompile the application.

Don't entrust authorization and role management to the client application. I should not be able to use knowledge of the code to obtain data from the database that I have no rights for. If I decompile the end user application, replace the string "TECH" with "ADMIN", it should only impact the application, not the data access. However, it is perfectly acceptable to use these roles in the application for controlling which screens are presented. Screen access doesn't dictate data access. Don't burn up man-hours trying to control screen visibility. Assume a well-behaved user. If he tries hard enough, he gets a blank screen, but it isn't usually worth writing code for, just worry about the data.

If the application is designed to use individual database users (i.e. I authenticate to Oracle as MSMITH, and MSMITH has its own views to protect the base table data) then you can still get away with direct database access, as long as the roles are protected, and enforced. However, many (most) designs use shared-schema multitenancy and application/LDAP managed users and roles, and in that case, to really solve the problem, you have to introduce a middle layer; a gatekeeper that doesn't trust the application. The gatekeeper will independently authenticate and authorize the user's role and only serve up data accordingly.

Storing the roles in a database isn't less secure. We just can't allow people to assign roles to themselves (unless that is their role). And we can't allow the RBAC to be circumvented.

That leaves you with a decision regarding your architecture. Whether to move the database and/or gatekeeper of the data into a realm that isn't accessible to the user or front-end application, except through some communication protocol. This is one reason that SaaS is more secure for EMR applications, it provides a clean solution; the user can't read or directly execute the application, because he doesn't own it or the domain it runs in; he just accesses it through the exposed interface. Many people think SaaS means "cloud", or that they login to some remote application across the Internet. But it simply means your user accesses the software as a service, and the software is centrally hosted. If you think about it, you can architect your Windows Forms application to use the benefits of the SaaS model, or narrow it down to DaaS (data as a service). Move your database off of the client, so it isn't co-resident, or if you must make it work on a single computer, put it in a separate user account or secure VM, and run the application without administration privileges, to communicate with the database through a service layer. The DaaS server might run in a back computer room, or at a remote office; that part isn't relevant.

This solves the security problem completely in that the server can perform the authentication, authorization, and administration of the roles, and no amount of spoofing roles in the client is going to override the server. If your client application has to request data through a service layer, then the security is out of his control, and secure. It may sound expensive to implement; it isn't too bad if you already have an MVC / MVP and/or SOA architecture. And if rearchitecting your application is unreasonable or cost-prohibitive, there are ways to do it purely at the database level with most robust relational databases.


问:
How important is it to reduce the number of lines in code?
I am a Software developer who works on J2SE (core java).

Often during our code reviews we are asked to reduce the number of lines in our code.

It's not about removing redundant code, it's about following a style that focuses on doing the same things with fewer lines in the code, while I believe in having clarity in code even if it means increasing the number of lines.

What do you think is the right way of doing things?

If LOC (lines of code) is a small number, how does it affect the code?
If LOC is a larger number, how does it affect the code?

example from the website : "javaranch"  -

```<code>public static void happyBirthday(int age)
{
    if ((age == 16) || (age == 21) || ((age > 21) && (((age % 10) == 0) || ((age % 25) == 0))))
    {
        System.out.println("Super special party, this year!");
    }
    else
    {
        System.out.println("One year older. Again.");
    }
}
</code>```

VS

```<code>public static void happyBirthday(int age)
{

    boolean sweet_sixteen = (age == 16);
    boolean majority = (age == 21);
    boolean adult = (age > 21);
    boolean decade = (age % 10) == 0;
    boolean quarter = (age % 25) == 0;

    if (sweet_sixteen || majority || (adult && (decade || quarter)))
    {
        System.out.println("Super special party, this year!");
    }
    else
    {
        System.out.println("One year older. Again.");
    }
}
</code>```

答: To be perfectly honest, I don't give a hoot about LOC measurement. Sure, it is nice for a function or procedure to be as short as possible, but I take readable code over short any time of day.</p>


问:
Should service layer catch all dao exceptions and wrap them as service exceptions?
I have three layer Spring web app: dao, service and controllers. A controller never calls directly the dao, it does it through the service layer. Right now, most of the time  if there is dao exception (runtime) that is not handled, it'll be caught by a JSP showing an error message to the end user.
Should service layer catch all dao exceptions and wrap them as service exceptions?

```<code>try {
   daoInstance.someDaoMethod();
} catch(DataAccessException dae) {
   throw new ServiceException("message", dae);
}
</code>```

Let's suppose ServiceException is runtime as well and it's not handled neither. Is there any difference to just throw the DataAccessException instead of the ServiceException?
I just thought that the presentation layer should not know about data access exception. But I don't see the point of catching unrecoverable exceptions just to wrap them.

答:
The main reason one would use exception wrapping is to prevent the code in the business layer from having to know about every possible exception in the system. There are two main reasons for this:

Consistency: declared exceptions aggregate towards the top of the call stack. If you do not wrap exceptions, but instead pass them on by declaring your methods to throw them, you may end up with top level methods that declare many different exceptions. Declaring all these exceptions in each method back up the call stack becomes tedious.

Encapsulation: You may not want your top level components to know anything about the bottom level components, nor the exceptions they throw. For instance, the purpose of DAO interfaces and implementations is to abstract the details of data access away from the rest of the application. Now, if your DAO methods throw SQLException's then the code using the DAO's will have to catch them. What if you change to an implementation that reads the data from a web service instead of from a database? Then you DAO methods will have to throw both RemoteException and SQLException. And, if you have a DAO that reads data from a file, you will need to throw IOException too. That is three different exceptions, each bound to their own DAO implementation.

So, in short, the answer is yes!


答:
I think an important factor is who your service clients are.

If your service layer is just an architectural boundary between layers in your own project, and the service client is within the same trust realm, then it is ok to relax things, and let unchecked exceptions bubble out to the controller layer, or the service client.

However, for public facing code; service that are consumed by a third party or customer, I think it is cleaner to wrap any unchecked exceptions with a service oriented exception, primarily for security concerns, secondly for loose coupling, and clean abstraction.

A data layer exception should never, directly make it all the way to an end user of a web application. It potentially contains internal information about your schema, your queries, line number information, variable or function names, etc. End user exceptions can be sanitized in a secure setting.

An external service client isn't concerned with your implementation detail, and can't handle unchecked exceptions anyway, as they are bug or environmental issues. In secure applications, database errors are simply not secure enough to propagate, OracleException - ORA-01234 - ... which might be the 3rd table that was inserted. The client should be allowed to deal with any checked/expected exceptions that it can handle, and treat everything else as a potential bug report. Your service contract should be an atomic, consistent, transactional abstraction. If it can't do anything about the exception, then the only useful thing left is to give you a bug report. You already have the ability to log the exception, so why burden your end user with the details? Your app can be monitored, so you already know about the unchecked exceptions before the users report them.

It is never ok to eat exceptions, nor am I a fan of checked exceptions, but I prefer to have a plan that is appropriate for the nature of the overall product.

Body:
I have three layer Spring web app: dao, service and controllers. A controller never calls directly the dao, it does it through the service layer. Right now, most of the time  if there is dao exception (runtime) that is not handled, it'll be caught by a JSP showing an error message to the end user.
Should service layer catch all dao exceptions and wrap them as service exceptions?

```<code>try {
   daoInstance.someDaoMethod();
} catch(DataAccessException dae) {
   throw new ServiceException("message", dae);
}
</code>```

Let's suppose ServiceException is runtime as well and it's not handled neither. Is there any difference to just throw the DataAccessException instead of the ServiceException?
I just thought that the presentation layer should not know about data access exception. But I don't see the point of catching unrecoverable exceptions just to wrap them.

ContentLicense: CC BY-SA 4.0


答:
No, you should not wrap DAO exceptions in a web application

It's a lot of noise in the code for zero benefit. DAO exceptions are unchecked exceptions for a good reason. The application code cannot do anything useful to recover from a DAO exception. The real problem is here:

... it'll be caught by a JSP showing an error message to the end user.

Fix this problem in one place instead of crapping up the entire code base.

You control how an uncaught exception is displayed to the user.  Uncaught exceptions are due to application bugs or a failure in the underlying system.  There's no reason to give the user any information about the reason his request could not be served.  There's nothing the user can do.  All you should do is serve a friendly error page.

N.B.: if you find yourself writing a lot of tedious code, for example, creating a bunch of catch blocks that simply wrap and re-throw, there is almost always a better solution.

Title: Should service layer catch all dao exceptions and wrap them as service exceptions?


问:
Does the games industry use automated testing for visual parts of games/rendering? How?
Some parts of a game are easy to test in an automated way (logic, maths, input handling); but there's also a lot that's purely visual and not easily testable.

I would be surprised if the games industry left all of this to manual testing; there's enough money in it that I would guess that effort has been put into being able to regression test at least some visual aspect of games.

Is this true? If so, what are the possible ways that rendering of games can be tested? Capturing output and comparing images (can this be reliable?)? Intercepting data from the graphics card at a low level? Capturing vertex information (etc.) on its way to the graphics card? It seems like there are lots of possibilities; but I can't find any information on this :(

Note: This question was marked as a dupe of this one, but I'm not asking about specific tech/frameworks/tools on how to do this, but more broadly the ideas around this practice, and what the actual games industry do (if they do at all).

答:
Any company will do in different ways, even different games will be tested differently.

Maybe the lack of information about graphics is because rendering is indeed quite "repetitive" (I cannot think a better word, sorry) and in a typical complex scene there will be enough primitive combinations so most persons can usually see easily most of the glitches (with the exception of less used shaders, but a stress-shader special level/demo can be used). Remember that humans were hunters for thousands of years :) so probably we are engineered to see glitches.

Also the freedom of movement present in most games and the randomization of other elements on a typical game that makes to feel it as more "realistic" are usually a nightmare for applying pure automated tests: in fact a human tester will find more quickly and more errors than any automated test. You can code a logic for record timings, stats and positions/angles/other variables whenever a tester is playing... so even on no-automated tests you will have feedback like-automated-tests. It's usually useful to be capable of making a playback of any beta tester recorded session (and usually is a good feature for the final game as well).

About rendering stats, for example you can get: the draw-call count stats for each one of the shaders (as you will make the calls, it is enough to maintain some counters), the upload counts (the same, you will control when gpu buffers are updated), the timings (not only fps, also the lapses between each call), etc. If necessary (but I believe that is not recomended except when hunting for a specific error) you can get stats from the graphics card itself (for example you can get fill rates and others by using occlusion queries).

Finally, other reason to use beta testers is that different graphic cards will have probably different behaviors... you may need to have a farm of testing machines o_O. The beloved human beta testers will soft all that mess.

Hope that it helps!

Disclaimmer: I'm not a betatester, I'm a developer XDDD.


问:
How to create work for a client on login
I have a log-in service that runs a CPU-intensive hash multiple times when a user logs in. In order to reduce the effect of a login DDOS, is there any sort of function that I can "ask" that the client to run that would be somewhat CPU heavy and verify it's result (via a light-weight operation), prior to running my password hash?

I was thinking something along the lines of brute-forcing a weak security (where I generate say a 128 bit RSA key or similar) and giving the client the public key and asking it to find the private key.

Has anything like this been done? would this be a reasonable implementation? are there better alternatives?

答: Your idea in your question sounds feasible.  Another alternative is to ask for a string to be generated that hashes via some algorithm (e.g. SHA1) to a value with properties you specify.  E.g. find s such that s ends with a specified string and SHA1(s) % 5000 == 0; this will require the client on average to run 5000 SHA1 operations, while the server can verify the result with just 1.


问:
Do I have to make source code open, if I use GPLv2 licensed software to derive data
I'm working on a calendar project, on my own. In this project I've to use Swiss Ephemeris. It is licensed under GPLv2 and commercial. With commercial version of license, developers entitled to distribute the software, as his/her wish. But as this is my personal project, I've to use the GPLv2 license.

By using the library and data file, I'm generating data for calendars. In future I shall publish these calendars in a website, freely. In this process obviously I've to modify the library, write some of my own code and other chores. Will I've to make my final source code open.

I don't have any problem to make this public. But I'm asking, if I've to.

Edit: From the detailed answer from @apsillers & others, it is clear to me that, I'll not have to make my software GPL or even give source code to the visitors to the website. Though I've to make my displayed data GPL by the clause, as the Swiss Ephemeris data, licensed under GPLv2 or later and commercial:

More generally, when a program translates its input into some other form, the copyright status of the output inherits that of the input it was generated from.

答: The data incorporated in Swiss Ephemeris is, according to their web site, derived from data provided by NASA JPL.  As this is a work of the US Government, it is therefore free from copyright in the US and any country conforming to the Berne Convention (which requires works to be subject to copyright in their country of origin in order to qualify for protection in other countries).  See http://en.wikipedia.org/wiki/Copyright_status_of_work_by_the_U.S._government</p>


问:
Implements > extends, but what about variables?
It's preferable to write programs that depend on interfaces rather than on superclasses, but what if you want a class to have certain variables? Sometimes you want a class to implement a certain variable. (For example, imagine you have a datasource interface, and want all classes to implement a "String user").

In this case, I can see making an abstract class "datasource", which other classes could then extend. But this means they can't extend another class anymore, due to no multiple inheritance in Java.

So, to conclude, if I would have the above scenario, should I rethink my design, or is there a pattern I don't know about that I could follow to achieve the interface-with-variable design?

答:
If you need to share implementation, then use inheritance.  That's what it's for.  But use an interface as well, and treat the fact that inheritance is being used by the implementations as an implementation detail: client code shouldn't need to know.

For instance, see the library classes List, AbstractList, ArrayList and LinkedList.  There are common implementation details of the two concrete classes which are shared by them both inheriting from AbstractList.  But as a client of them, this is an unnecessary detail which we don't ever use... we only care that they both implement the interface, List.


问:
At what granularity are events recorded in Event Sourcing?
I'm growing my understanding of event sourcing.  My understanding is that it provides a means of recording events as they happen so that given a common beginning state and an audit log of recorded events, the events can be replayed to achieve the same final state.

I know that sometimes events are triggered by other events.  When I consider a system as a whole, I imagine that some events will be triggered externally by inputs from the user or another external source and that other events will be triggered and processed internally as side effects.  I am calling the former originating events and the latter secondary events.

Originating events trigger a domino effect of secondary events.  Since secondary events hinge directly on some originating event, should secondary events be recorded as part of the audit?

If you're aware of some source that discusses this in depth please cite.

答:
From a purely practical perspective, if you include events that are triggered by other events in your log, there are two consequences:

If you need to replay the log, these events will be automatically triggered anyway, so you'll need a way of filtering them out

If you later determine that the logic that generates some such events is incorrect, and therefore decide to rebuild your system by replaying all events to remove data corrupted by the bug, the log will still contain incorrect data

From this perspective, it seems clear that at the very least such events should be logged separately rather than together with externally sourced events.


问:
Data structures and algorithms for a directed rooted tree with inherited properties?
I need to represent a directed rooted tree in memory. The caveat is, that nodes have properties.

And those properties are inherited (but not 100%) by the child nodes, recursively.

What would be a good data structure and algorithms for storing this in memory?

For the purposes of notation:

D(V) - depth of the vertex (distance from the root).

A(V) - arity of the vertex (how many children it has).

V - Size of the tree (how many total vertices)

P - average # of properties inherited by a vertex.

The operations that need to be supported (efficiently) are:

Modifying the tree (add node/subtree; remove node/subtree, move node/subtree)

Tree modifications occur not too frequently, perhaps 1-3% of the tree changes throughout the day.

Change (add/delete/modify) a property on a node, and have all its descendents inherit that property according to inheritance rules:

a property is inherited by default.

A property itself has 2 attributes: "propagate" and "turned off".

A property is inherited from parent to child if (and only if): Parent node's property has "propagate" flag on AND the child node does NOT have the same property set with "turned off" attribute.

Query out properties of a given node (this is a very frequent query, massively dominating other access patterns by frequency)

Efficiently query out properties of a set of nodes

This means that, if we query out properties of N nodes sharing same parent, at depth D, the complexity would be O((N+D)P) instead of O(DN*P)

This query is frequent but significantly less so than the single-node one. BUT, the problem is that it would frequently be run on the entire tree or a very large portion of it, and the bulk speedup matters due to V being very large.

Efficiently query out all nodes (in whole tree or given subtree) that have a specific property (either set directly or inherited) that is not turned off.

This means that it should be much faster than O(V*P).

Access pattern: less frequent than the other two, BUT needs to be very fast because it's called by user-facing UI and thus for user experience purposes needs to be responsive.

I have tried implementing 3 approaches, but all of them suffer from different issues due to the seemingly irreconcilable trade-offs:

Approach 1:

Store the tree as a regular tree (possibly with enhancements to speed things up, such as doubly-linked edges to facilitate walking up the tree, and a hashtable to be able to find a given node in the tree in O(1).

Store properties with the nodes they are set on

Compute the properties inherited by nodes, by walking UP the tree from the node to find the path from root to the node, then walking back down that path and seeing which properties would propagate from root to child, then to grandchild... and so on till the node.

PROBLEM: Computing properties on a set of nodes is slow. Dumb implementation results in O(PDN) although I have a feeling this can be improved.

PROBLEM: Finding out which nodes inherit a specific property in the whole tree is VERY slow and I don't see a good way to optimize it.

This implementation results in O(V*P) complexity, which is unacceptable.

Approach 2:

Store the tree as a regular tree (possibly with enhancements to speed things up, such as doubly-linked edges to facilitate walking up the tree, and a hashtable to be able to find a given node in the tree in O(1).

Store properties with the nodes they are set on, AND separately store (cache) the inherited properties of each node.

This solution makes finding properties inherited by a node O(P) and a set of nodes O(P*N) very efficient.

PROBLEM: Tree manipulation is slow. Basically, you need to re-compute O(PD + PN) (where D is a depth of a node where change occurred and N is amount of nodes being added/moved)

PROBLEM: Finding out which nodes inherit a specific property in the whole tree is VERY slow and I don't see a good way to optimize it.

This implementation results in O(V*P) complexity, where P is average # of properties inherited on a node and V is # of vertices on the whole tree.

Approach 3:

Store the tree as a regular tree (possibly with enhancements to speed things up, such as doubly-linked edges to facilitate walking up the tree, and a hashtable to be able to find a given node in the tree in O(1).

Store properties with the nodes they are set on, AND separately store (cache) the inherited properties of each node.

Also, have a separate cache linking properties to a list of nodes they are inherited in (call it "property cache").

This solution makes finding properties inherited by a node O(P) and a set of nodes O(P*N) very efficient.

PROBLEM: Tree manipulation is extremely slow. Basically, you need to re-compute O(PD + PN) (where D is a depth of a node where change occurred and N is amount of nodes being added/moved) AND then also spend time refreshing properties cache that can also be O(P*N) since you have to rebuild entire cache.

PROBLEM: Changing properties is also very slow because you also need to rebuild the entire properties cache for a changed property.

答:
A regular tree would suit just fine and Approach 1 would work here. I think you should also read up a bit about the search algorithms used for a B-tree and then see how you could modify it here.

To me, this question is basically about how to modify a generalized B-Tree to handle properties with a propagation element.

Like you say:

Store the tree as a regular tree.

Store properties with the nodes they are set on.

But:

Don't double link them - You can walk down the tree during the search (and also unfold if necessary revisiting the parent node when using typical recursive methods).

Don't create a hash-table - a hash-table is just another look-up data-structure, why use it when you can modify the tree!

DON'T DO THIS: Compute the properties inherited by nodes, by walking UP the tree ...

INSTEAD DO THIS: Store the properties as you walk through the tree locating the target node. You have to visit them anyway. During the node traversal search just pass through the property if 'propagate' is on. When at the child node; don't save it if the property also exists there and is set to 'turned off'. Keep traversing until you reach your target node, storing the properties as you go (perhaps in some simple little list).

Note that the property attributes requirements for 'propagate' and 'turned off' only impact the search algorithm by requiring logic to be placed in the traversal method.

PROBLEM 1: Computing properties on a set of nodes is slow. Dumb implementation results in O(PDN) although I have a feeling this can be improved.

SOLUTION: This is full of assumptions. What is a set? I only can assume a simple case like; set of nodes are all of the direct children of their parent node & depth of 1. Given this; Locate the parent node first with all the properties saved up until that parent node (as we just discussed in the previous point). Then for each child of that node you calculate out the properties - so for each child you have all the saved properties up to that parent node + the child's properties.

EXAMPLE: Traverse from the root node to a target node. For each node get the properties where they are 'propagated' and then traverse the next node passing through those properties. For the next node; for each property passed through check they are in the current node, if they are present and are 'turned on' then overwrite the property with the current nodes value. Then do the 'propagation' check and redo going through the nodes until the target node. Then you are left with the children - apply the same attribute logic and record the properties for each node.

PROBLEM 2: Finding out which nodes inherit a specific property in the whole tree is VERY slow and I don't see a good way to optimize it.

SOLUTION: Here, you want to search for this efficiently but the creation of your tree solution doesn't have to be so efficient. And it's not too complex because you just need to find if it is 'turned off' or not - and not involve the 'propagate' property. What you need to do here is use the tree as it is supposed to be used. If a property is not 'turned off' you want to say to the parent node that a child of theirs has a specific property and then update all the way back up to the root node. This way if a property doesn't exist at all you'll know straight away when visiting the root node that it doesn't exist.

EXAMPLE: Given a child node is set with a new property and 'turned on'; update the parent node with the same property and set to 'turned off' and use this to say the property exists in one of the nodes children. Then for each parent above that parent, set the same property and attribute. Now start to traverse from the root node the property will be set on the root node indicating that a descendant has that property. Do a traversal search and go through each child where the property is set - store each node where the property is 'turned on'.

Hopefully I can improve on this answer. Help me by indicating hard to understand parts of my answer.


问:
Web Application: Combining View Layer Between PHP and Javascript-AJAX
I'm developing web application using PHP with CodeIgniter MVC framework with a huge real time client-side functionality needs. This is my first time to build large scale of client-side app. So I combine the PHP with a large scale of Javascript modules in one project.

As you already know, MVC framework seperate application modules into Model-View-Controller.

My concern is about View layer.

I could be display the data on the DOM by PHP built-in script tag by load some data on the Controller. Otherwise I could use AJAX to pulled the data -- treat the Controller like a service only -- and display the them by Javascript.

Here is some visualization

I could put the data directly from Controller:

```<code><label>Username</label> <input type="text" id="username" value="<?=$userData['username'];?>"><br />
<label>Date of birth</label> <input type="text" id="dob" value="<?=$userData['dob'];?>"><br />
<label>Address</label> <input type="text" id="address" value="<?=$userData['address'];?>">
</code>```

Or pull them using AJAX:

```<code>$.ajax({
  type: "POST",
  url: config.indexURL + "user",
  dataType: "json",
  success: function(data) {
    $('#username').val(data.username);
    $('#dateOfBirth').val(data.dob);
    $('#address').val(data.address);
  }
});
</code>```

So, which approach is better regarding my application has a complex client-side functionality?

In the other hand, PHP-CI has a default mechanism to put the data directly from Controller, so why using AJAX?

答:
If you're going to have a significant amount of logic written client-side, then consider using MV[C]-style "separation of concerns" in your client-side JS code. For example, you might have some JS "view" logic which handles rendering:

```<code><script type="text/javascript">
function renderUser(user) {
  $('#username').val(user.username);
  $('#dateOfBirth').val(user.dob);
  $('#address').val(user.address);
}
</script>
</code>```

Then define some JS "controller" logic to pass the data into the view. The design of this depends on expected usage of the application -- e.g. if "user" is only rarely displayed, then the JS controller logic might look like:

```<code><script type="text/javascript">
function showUser() {
  $.ajax({
    type: "POST",
    url: config.indexURL + "user",
    dataType: "json",
    success: function(data) {
      renderUser(data);
    }
  });
}
</script>
</code>```

On the other hand, if the user is displayed on every page-request, then it's non-performant to fetch the user via AJAX -- better to include the user data as part of the initial page request. You can still use the same rendering function:

```<code><script type="text/javascript">
renderUser(<?php echo json_encode($userdata); ?>);
</script>
</code>```

Or if your web-application provides a real-time list of new user-accounts via web-sockets, you could draw them on-demand:

```<code><script type="text/javascript">
var ws = new WebSocket("ws://localhost:9998/users");
ws.onmessage = function (evt) {
    renderUser(evt.data);
};
</script>
</code>```

The examples above are a crude but hopefully demonstrate the flexibility that comes with separating MVC in JS. For a better discussion of that topic, check out a tutorial on one of the popular JS MV* frameworks (Backbone, Angular, Ember, etc).

http://www.codeproject.com/Articles/795965/BackBone-Tutorial-Part-Introduction-to-Backbone-Js

http://www.smashingmagazine.com/2012/07/27/journey-through-the-javascript-mvc-jungle/

https://thinkster.io/angulartutorial/a-better-way-to-learn-angularjs/

Body:
If you're going to have a significant amount of logic written client-side, then consider using MV[C]-style "separation of concerns" in your client-side JS code. For example, you might have some JS "view" logic which handles rendering:

<script type="text/javascript">
function renderUser(user) {
  $('#username').val(user.username);
  $('#dateOfBirth').val(user.dob);
  $('#address').val(user.address);
}
</script>

Then define some JS "controller" logic to pass the data into the view. The design of this depends on expected usage of the application -- e.g. if "user" is only rarely displayed, then the JS controller logic might look like:

<script type="text/javascript">
function showUser() {
  $.ajax({
    type: "POST",
    url: config.indexURL + "user",
    dataType: "json",
    success: function(data) {
      renderUser(data);
    }
  });
}
</script>

On the other hand, if the user is displayed on every page-request, then it's non-performant to fetch the user via AJAX -- better to include the user data as part of the initial page request. You can still use the same rendering function:

<script type="text/javascript">
renderUser(<?php echo json_encode($userdata); ?>);
</script>

Or if your web-application provides a real-time list of new user-accounts via web-sockets, you could draw them on-demand:

<script type="text/javascript">
var ws = new WebSocket("ws://localhost:9998/users");
ws.onmessage = function (evt) {
    renderUser(evt.data);
};
</script>

The examples above are a crude but hopefully demonstrate the flexibility that comes with separating MVC in JS. For a better discussion of that topic, check out a tutorial on one of the popular JS MV* frameworks (Backbone, Angular, Ember, etc).

http://www.codeproject.com/Articles/795965/BackBone-Tutorial-Part-Introduction-to-Backbone-Js

http://www.smashingmagazine.com/2012/07/27/journey-through-the-javascript-mvc-jungle/

https://thinkster.io/angulartutorial/a-better-way-to-learn-angularjs/


问:
What product is better: ADFSv2, Ping Identity, CS Siteminder?
I'm comparing different STS's for claims based authentication and am trying when it's appropriate to use each one.

It appears that ADFSv2 should be used in all Windows Environments.  Ping and Siteminder are more for the Unix side... although a sales rep said Ping was better for Windows, I didn't really understand "why"

Any comparative information is much appreciated!

答:
Which STS you choose should really be based on your near term as well as strategic requirements.  For the record, PingFederate works very well in a Windows environment.  Ping Identity actually has many, many Windows IT shops successfully deploying PingFederate.  So whether or not you are a Windows shop shouldn't be the sole determiner.

You might want to consider the range of applications that need to integrate into your SSO ecosystem.  That includes both identity management products such as Active Directory, OAM, SiteMinder, as well as relying applications.  Your SSO solution should be selected based on those integration needs.

Ping Identity did a ton of work this summer to ensure that we are well aligned with ADFSv2/WCF/WIF environments.  Along with that, PingFederate provides very rich integration into many existing identity management products, directories, and databases.  There are also several language kits for embedding SAML, WS-Trust, and WS-Federation single sign-on into .Net, Java, and PHP.

Another key differentiator between PingFederate and other SSO/Federation products is the speed and ease with which a PingFederate ecosystem can be established.  Generally, PingFederate customers get up in running in hours or day.  Not weeks or months.

Also note that Ping Identity offers a cloud based solution, PingConnect, for those companies that are not ready or don't need to invest in a full scale on premise SSO/Federation solution.

OwnerDisplayName: DavidSkyberg


答:
The premise of this question is a bit confusing. You cannot "implement a variable". It either exists or it doesn't. Further, "wanting" a class to contain a variable either means:

You own the code, so just put the variable in each of the implementing classes (via base class if so desired).

You don't own the code (future implementations of this interface). You can't dictate their implementation, only the specification, so don't worry about what they might name their user variable.

Beyond that, your options are limited by language. In C#, your interface could contain a property public String User { get; set; }. In Java, you are limited to using a base class, or possibly considering Java 8's default methods in interfaces.

Title: Implements > extends, but what about variables?

Body:
It's preferable to write programs that depend on interfaces rather than on superclasses, but what if you want a class to have certain variables? Sometimes you want a class to implement a certain variable. (For example, imagine you have a datasource interface, and want all classes to implement a "String user").

In this case, I can see making an abstract class "datasource", which other classes could then extend. But this means they can't extend another class anymore, due to no multiple inheritance in Java.

So, to conclude, if I would have the above scenario, should I rethink my design, or is there a pattern I don't know about that I could follow to achieve the interface-with-variable design?


问:
Unit testing when it's harder to come up with concrete cases than write the logic
I have little experience with unit testing, but at the project we're working on right now we decided to do unit testing. The project is a WPF/Entity Framework application, and the part I'm being confused about is a filter function.

Our universe of entities is like this: there are Products, Evaluations and Collections.

Evaluation 1 - n Product

Collection n - m Evaluation

Collection n - m Product

Now the filter function in question is called "in collection", and the logic is like this:
Include the Product if it has a Collection where Collection.Active == true, or if the Product has an Evaluation which in turn has a Collection.

So when unit testing this, I'm trying to find out the different possible corner cases, and make assertions about wether they are included in the filtered list or not. Products which has an active collection, Products which has no active collection but has an evaluation that has a collection, and so on.

The thing is, working out these corner cases is much harder work than writing a simple linq-to-entity query, and it seems that the probability of making an error in the test is much higher than making an error in the implementation of the filter.

How would you handle such situations? It doesn't seem uncommon, especially where there are tools that let you write logic in a simple way. Is it possible to benefit from unit testing here? How?

答:
Write the test anyway. If it is part of the software contract that needs testing, it is irrelevant how simple the feature is. It is the process of rigorously testing in a secondary notation that matters. Combined with the target code and the other clients of the code, the test makes up a quorum of three that verify the correctness. You may write a bug once, but it is less likely that you'll do it twice unless you misunderstood the logic or the specification was wrong.

Your unit tests:

Validate your contracts as you develop

Validate your thinking process. (Heard of rubber duck debugging?)

Become documentation

Protect the APIs from being accidentally broken. If the code breaks, the test yells loudly. New dev guy in the next cube may think your odd looking algorithm is a bug or useless code, until his "fix" breaks the test.

Watch after you when you are tired and protect you from checking in something dumb. We all do it from time to time. Better a test yells at you than your teammates. :)

Tests are the only way to systematically prove your software does what it is supposed to do.  Trust me there is something very comforting and satisfying about seeing your unit tests pass 100% after a long revision cycle.

Later on, if you leave, another developer can benefit from your tests in order to know whether he is going to break some undocumented code when he needs to change or add a feature.


答:
The common wisdom is that when a test fails, then the tested code must be at fault. But that only works if you can verify at a glance that the test is correct.

The reality is that when a test fails, then you have found a discrepancy between the test-case and the code under test. This discrepancy is either caused by a simple error (in either the test-case or the code under test) or a misunderstanding of the requirements.

When a test fails, you have to find out what the cause for the discrepancy is and then you fix either the test-case or the code under test (or in rare cases, both).

Even though writing the tests for this feature is hard, I would encourage you to do it anyway, as writing the tests can reveal ambiguities in the requirements and (repeatedly) executing the tests gives confidence that unrelated changes didn't break the feature.

Title: Unit testing when it's harder to come up with concrete cases than write the logic

Body:
I have little experience with unit testing, but at the project we're working on right now we decided to do unit testing. The project is a WPF/Entity Framework application, and the part I'm being confused about is a filter function.

Our universe of entities is like this: there are Products, Evaluations and Collections.

Evaluation 1 - n Product

Collection n - m Evaluation

Collection n - m Product

Now the filter function in question is called "in collection", and the logic is like this:
Include the Product if it has a Collection where Collection.Active == true, or if the Product has an Evaluation which in turn has a Collection.

So when unit testing this, I'm trying to find out the different possible corner cases, and make assertions about wether they are included in the filtered list or not. Products which has an active collection, Products which has no active collection but has an evaluation that has a collection, and so on.

The thing is, working out these corner cases is much harder work than writing a simple linq-to-entity query, and it seems that the probability of making an error in the test is much higher than making an error in the implementation of the filter.

How would you handle such situations? It doesn't seem uncommon, especially where there are tools that let you write logic in a simple way. Is it possible to benefit from unit testing here? How?


答:
If you were going with a test driven development way of unit testing, then I'd suggest you go with the Purist way of unit testing, that being, make a unit test that would fail then refactor your code to make it pass.

Even if its very tempting to skip testing very simple pieces of code, please don't because:

Writing Unit Tests puts the source of truthiness into the test cases and not the source code (meaning if the test magically fails even if the logic is simple, it means someone messed with the code base that cause the logic in the test to fail. Imagine if the source of truthiness is in your code, if the test were to fail, then the assumption of some people is that the test was written incorrectly instead of thinking that the implementation of their code is wrong)

Insurance. Unit tests allow you to catch bugs early on in the development phase, so use them as often as possible. Heck I'd even encourage aiming for a 100% test coverage of your code base because this would save you the trouble of having to test out your entire code base just to be sure that your refactor didn't break an innocent looking conditional statement in a method that you only use once in a blue moon.

Note: Also, If you're having a bit of trouble with writing plain old unit tests, I'd suggest you take a look at cucumber and its ilk. BDD lets you write test cases more naturally so it might be easier for you in some cases.

Note 2: As @gbjbaanb, said in the comments below, even with 100% LOC test coverage, it is still no substitute of manual testing and QA. Though writing automated tests like these do help reduce the burden on the tester.


问:
Transferring information between a web server and a Python backend?
I have been Googling my problem but haven't been able to come up with anything; here's the situation:

I have a PHP / MySQL website hosted with 1and1.com.

I also have a Python program that runs on a desktop computer I own.

I want users to be able to submit files and modify personal information on the website and then have that information transferred to the Python program on my desktop computer (so the desktop will basically have a copy of data being stored in the MySQL database).

I want to minimize the number of SQL queries, but I also want changes to be reflected in the desktop Python program within a minute or so.

I understand Python can query the MySQL database, but what is an efficient way to have it update its copy of the info stored on the MySQL database?

What I'm thinking is that I can have an "updates_to_db" table that records every change made to the main db, and then have the Python program use that to decide which files / db rows it needs to update.

Or is there a better way?

答:
I'd suggest that you look up a Master-Slave mirroring between your offsite MySQL database and one that you can host locally(its not that hard to host one on your desktop).

Why?
Instead of asking python to ask your offsite database every now and then if there are new changes, why not have that database update itself in a local database that you own. That should minimize the number of queries running around and if your python program is going to do something with the data you're pulling, you can safely just query from your local database without worries of accidentally borking something or going over your monthly bandwidth allocation

You can checkout a guide of that here: https://www.digitalocean.com/community/tutorials/how-to-set-up-master-slave-replication-in-mysql

if you have more questions about master-slave database mirroring, you should checkout https://dba.stackexchange.com/


问:
Code that converts a value into a different representation, then converts it back to where it started is bad, but how?
I was reading an article about bad programming practices.

It mentioned -

"Yo-Yo code" that converts a value into a different representation, then converts it back to where it started (eg: converting a decimal into a string and then back into a decimal, or padding a string and then trimming it)

I don't understand why the particular example he gives is a bad way to write programs.  It seems okay to me to convert back if the situation requires it so that the value can be used.

Can anyone explain more about this?

答:
Even if you do need both the numeric and the string representation of a number, it's better to convert just once and also hang on to the original value, instead of converting again every time you need one or the other.

The principle is, as always, that code that doesn't exist cannot have subtle defects, while code that exists often does. That may sound paranoid, but experience teaches us that it's appropriate. If you approach programming with a permanent light anxiety of "I'm not really smart enough to understand this complex system", you're on the right track.


问:
Plugins and exporting an API between python scripts
I've got a python script, which should read a subdirectory and make all the scripts within it callable like this:

```<code>python mainscript.py subscript arguments
</code>```

I've figured out most of the details but I'm having a lot of trouble deciding on how to export an API (object or selected functions) to subscripts that mainscript imports. The intention is for the subscripts to work as pluggable commands to mainscript (in other words, there is no need for them to work stand-alone).

Things I've tried, that I think would be elegant enough are (after import subdirectory.subscript in mainscript):

import __main__

which works, but gives my subscript access to everything unconditionally and will likely be a source of horrible bugs if this is to be used by others.

from __main__ import *

which doesn't work despite defining __all__ to include the name api at the end of mainscript (I just get told that name 'api' is not defined when I try to reference the object I want).

from __main__ import api

which tells me cannot import name api.

So I'm at a position where, I either do the haphazard import __main__ which I don't like at all, or have to move the api to a different file, which I also dislike because it would break the intended structure of:

```<code>mainscript.py
  - subdirectory:
    - subscript:
      subscript.py
</code>```

which, despite __init__.py files that have to be everywhere along the chain, is relatively simple to work with. An api.py somewhere would mean that, to maintain simplicity, I'd have to move mainscript.py and api.py into their own subdirectory and have a calling script where mainscript.py used to be (a python script, to keep things easily cross-platform, but that just adds another script to the chain). I want to keep everything simple and obvious, which is why I'd prefer to have the simple api within the master caller script.

In summary: What is the recommended, if any, way to export an api object from a calling script to called scripts? Is this approach to exporting an api wrong?

答: Turn the API into a Python package and install it. Then it is out of your way, and the structure of the scripts' directories can remain as it is.</p>


问:
How to store a potentially large amount of optional properties of objects?
I'm using Entity Framework Code First with ASP.NET MVC. This handles my database design based on the domain models within my application.

As it stands, the engine I'm writing will have a website class and store class. store is a property of website linked by a ForeignKey in the database. I want to implement some options like TaxDisplayType on each of the models but am unsure on the best approach.

The issue I have is that Store could potentially have the same option as website which if it's set against the store should be used but default back to the website level if not.

These are the options I can think of to do this:

Add this option against each class i.e Website.TaxDisplayType and Store.TaxDisplayType - I am worried about the amount of duplicated options between 2 tables.

Have one table object that stores Key / Value pairs with a reference to the "scope" (i.e website or store) and I write a wrapper to drag out the options via their name. The issue I have with this approach is the use of magic strings. Unlike option 1, if a config option name is wrong in the code, it will still compile the project.

I'm also worried that going forward, if I have 500 options, this would equate to 500 database columns - This doesn't seem like a good idea.

I'm looking for some advice on the best way to handle this type of data given that:

I'd like to use properties of classes rather than magic strings.

Avoid duplication where possible.

答:
As of this writing, I'm seeing two ways you can go with this, both of which are a variation of your option 2:

Have an option table. This table would look something like this:

Foreign Key(you might want to add one for Store and Website)

Scope - enum(either website or store, so you know what kind of option you're pulling out)

Option - enum(taxdisplaytype etc., just modify the enum in the schema whenever  you have new options to add)

Value

Pros: easy to query all the options for a website or a store and avoids duplication

Cons: you'd have a lot of rows if your websites and stores are using a LOT of options(shouldn't have a performance impact as long as its properly indexed), and you'd have to update your schema each time you add a new option(you need to add it to the list of allowed values of the enum so that the database doesn't throw a fit)

Stick with 2, but instead of magic strings, use serialization instead of directly accessing the strings. This way, you actually have class properties you can access.

Pros: You don't have to change your schema if you want to add a new option or modify how it is structured

Cons: You're still storing strings in the database so you just need to be sure you serialize the stuff you pull out before using them.


问:
Peer review for tests just like code reviews
Does anyone practice the "code review" process for functional tests? Do you find it useful? The way that my current employer practices SCRUM we include functional testing as part of our "must have done" stuff in any given sprint.</p>

答:
With the methodologies that put so much weight in testing the review of the tests becomes much more important, possibly required, sometimes more important that the review of the code itself since it is often assumed it can be replaced with any code that meets the same automated testing outcome.

Reviewing that the tests are correct is one aspect, that they are complete enough and accurate/representative is also very important.

Missing this point is one of the things that makes these methodologies look sloppy to outside reviewers.


问:
Is staying implementation agnostic really worth it?
I have a project that I'm working on currently using Tomcat, Spring 4, Spring Security, MySQL, and JPA w/ Hibernate.

I picked JPA from the standpoint that it's suppose to make swapping out the underlying implementation of ORM providers seamless, or at least less painful. I would say that this is  mentally using the spec over the implementation (JAX-RS) is the default standpoint of the Java development community.

I'm curious if this is really a task worth doing. I'm sure if I used Hibernate directly I would gain some power because I could use features that are not part of the main JPA specification.

Part of my concern comes from the idea of YAGNI. I'm essentially programming in a specific style and fashion (using JPA instead of Hibernate) so that at some point in the future I can swap out my ORM implementation. I severely doubt that will ever happen over the life of the product, so I'm essentially putting effort into something that I'll probably never reap the benefits of.

What are your thoughts? Is "programming to the interface" worth it when it comes to stuff like JPA? Have you ever actually swapped an entire ORM implementation in a product? Have you ever been able to completely avoid the abstraction from something like JPA leaking anyways? I personally have a single native SQL call already (to clean out the database tables), and there's somethings I'd like to futz with that are built into the JPA spec (get/set prefixes to your methods, and the difference between MEMBER OF/IN, which only binding myself to an underlying implementation will get me any chance of avoiding.

答:
At the risk of sounding contrarian here, I would say, that yes, it is worth it. And it is not.

The issue is not so much in switching your ORM or database provider as such. It is more of an issue of separation of concerns and staying agile.

Once you start relying on some implementation detail of a library, you start creating deeper and deeper entanglements of concerns.

If you know hat your ORM implementation is Hibernate, this knowledge starts seeping down the whole architecture of your application. And whenever a new technology comes along that displaces Hibernate or JPA so thoroughly as Hibernate did to whatever came before it, you find that the dependencies have become much deeper than you expected.

It is much better to tuck away the entire concern of persisting your model somewhere out of the way, where all the intricacies of dealings with databases and transactions and whatnot, can be easily ignored by the rest of the application.
In that remote dark corner, you can tie yourself in knots over specific implementation details if you want to -- it does not really matter any more.


问:
C Linked List Implementation Pointer vs. Pointer-to-Pointer Consistency
To get some practice in C, I'm writing some basic functions for operating on a linked list of ints. I started out with functions that accepted as a "list" a pointer to the head node. Now, I find myself running into more and more occasions when I either need to limit the spec of the function more than I would like, or I need to use a pointer to a pointer to the head node to allow for alteration/removal of the head node in a way that is consistent with the way I alter/remove other nodes.

Is it preferable to have all functions accept a "list" in the same form, as a pointer to a pointer, rather than having some accept just a pointer to the node? Or should I perhaps change the way I think about altering/removing the head node to avoid needing to change the head pointer?

For example, if I write a remove function that removes all instances of the given int, and the head node's value is that int, I see a few obvious choices:

I can pass in a pointer to a pointer and move the head pointer to the next node not being removed.

I can pass in a pointer and I can move the value of the next node not being removed, say node x, into the head node and remove node x along with any other nodes that hold the value to be removed. This fails in the case that the list consists of only a single node that contains the value, and so I have to limit the spec to exclude this case.

In the case that I pass in a pointer to a pointer for this function, should I now change all other functions to accept a pointer to a pointer?

Are there standards for things like this or is it up to me? (Pretending of course that this code matters in some fashion to someone other than me and would, in that fantasy land, be used by other people without knowledge of the inner workings of the functions, beyond their signatures.)

答:
There are three choices that I can see.

Use a "list head" struct that doesn't contain any data, but simply
points at "the list" (as pointed out by Jonathan Eunice in a comment, this means  you have a conventient place for any extra data you may eventually want to collect and means you no longer need pointers-to-pointers)

Use the pointer-to-pointer you have identified

Always return the "new" list value and make use of the returned value.

As an example of the third model:

```<code>struct list { int val; struct list *next; }

struct list *drop_head(struct list *lst)
{
  struct list *rv = lst->next;
  free(lst);
  return rv;
}

void blah()
{
  struct list *my_list;
  /* imagine interesting code here */
  my_list = drop_head(my_list);
  /* imagine more interesting code here */
}
</code>```

Body:
There are three choices that I can see.

Use a "list head" struct that doesn't contain any data, but simply
points at "the list" (as pointed out by Jonathan Eunice in a comment, this means  you have a conventient place for any extra data you may eventually want to collect and means you no longer need pointers-to-pointers)

Use the pointer-to-pointer you have identified

Always return the "new" list value and make use of the returned value.

As an example of the third model:

struct list { int val; struct list *next; }

struct list *drop_head(struct list *lst)
{
  struct list *rv = lst->next;
  free(lst);
  return rv;
}

void blah()
{
  struct list *my_list;
  /* imagine interesting code here */
  my_list = drop_head(my_list);
  /* imagine more interesting code here */
}


答:
You have to only if it was a Affero GPL otherwise not.

From the FSF FAQ:

A company is running a modified version of a GPL'ed program on a web site. Does the GPL say they must release their modified sources?
  (#UnreleasedMods)

The GPL permits anyone to make a modified version and use it without
  ever distributing it to others. What this company is doing is a
  special case of that. Therefore, the company does not have to release
  the modified sources.

It is essential for people to have the freedom to make modifications
  and use them privately, without ever publishing those modifications.
  However, putting the program on a server machine for the public to
  talk to is hardly “private” use, so it would be legitimate to require
  release of the source code in that special case. Developers who wish
  to address this might want to use the GNU Affero GPL for programs
  designed for network server use.

Also in the description of the Affero GPL they specifically state that the Affero GPL is there to require release in an open source license. This implies that the non-affero GPL allows to use GPLed code on webserver also for closed source projects.

Title: Do I have to make source code open, if I use GPLv2 licensed software to derive data

Body:
I'm working on a calendar project, on my own. In this project I've to use Swiss Ephemeris. It is licensed under GPLv2 and commercial. With commercial version of license, developers entitled to distribute the software, as his/her wish. But as this is my personal project, I've to use the GPLv2 license.

By using the library and data file, I'm generating data for calendars. In future I shall publish these calendars in a website, freely. In this process obviously I've to modify the library, write some of my own code and other chores. Will I've to make my final source code open.

I don't have any problem to make this public. But I'm asking, if I've to.

Edit: From the detailed answer from @apsillers & others, it is clear to me that, I'll not have to make my software GPL or even give source code to the visitors to the website. Though I've to make my displayed data GPL by the clause, as the Swiss Ephemeris data, licensed under GPLv2 or later and commercial:

More generally, when a program translates its input into some other form, the copyright status of the output inherits that of the input it was generated from.


问:
How Best Can I Use Git When My Employer Uses VSS?
I am going to be working with VSS but I am much more productive and diligent with GIT.

I have to fit within the workflow of VSS and keep good history in VSS. The standard work flow here with VSS is

get working copy

do work

right click on folder -> show differences

in that view:

checkout (without overwriting local changes)

checkin (keeping write access)

Add comment with specific template

Personally I think this is already side-stepping the intended workflow of VSS and potentially overwrites any changes made by other people.

I think I can prevent the possible overwrite, but are there any other potential problems  that I should be aware of with this workflow?

--EDIT--

It's worth mentioning that in this case VSS is only used on legacy projects, and its largely treated with scorn by both the people that use it and the people that maintain it.

80% of the people that use it, use it alongside another version control system (some git, most mercurial)

When I asked the sys admin what my workflow should be, I was told "whatever your preference". I have kept them up to date with my thinking and they are interested in the results.

I would not recommend using any extreme methods (such as my script below) unless you have discussed it with whoever maintains VSS

答:
You're forgetting something - standard workflow with VSS is:

checkout working copy

(optionally complain others have some files locked)

do work on files

(optionally deal with complaints that you have files locked)

checkin files.

What you need to understand is that while you can get a read-only copy, you cannot change files or commit changes unless you have a checkout which locks files so no-one else can modify them. So while your concept of working independently by migrating a working copy to git regularly is laudable, I doubt it'll work in practice. You will have to perform a checkout (that locks files) at the last moment, merge these latest files from VSS into your git repo, and then checkin the resulting merge into VSS.If someone else is working on these files when you decide you want to merge, you'll have to wait for them to finish. Also you'll have to lock all the files, as you won't (easily) know which have been changed since you took your last read-only copy.

Its better to organize the work you're doing, or the files you're working on, with your colleagues and just use the tool as it was intended. The important part of that is to communicate and organize the team's development work rather than work independently like you want to do using git.


问:
Software license without modify
I have my own company, and I would like to release our customer management system as open source so everybody can see what we do.

But it is very important to me that I don't want anyone else to use or modify the software.

My idea is to modify the MIT license, because it is simple to understand.

But I am not sure about modifying a license as I'm not a lawyer.

Is there a license that fits my needs?  Specifically, I want people to be able to see our system but not be able to use or modify it.

答:
First of all, what you plan does not satisfy the OSI definition of Open Source. Some people are quite touchy about that, so I recommend not using the label Open Source anywhere.

Unfortunately I don't know any accepted term for licenses that make the source code available but are too restrictive to be considered Open Source. Microsoft calls this their Shared Source program, but I haven't seen that term in other contexts.

I wouldn't start with a permissive license like MIT, since the spirit of what you want to achieve is pretty far from MIT.

The Microsoft Reference Source License looks pretty similar to what you want.

The relevant clauses are:

"Reference use" means use of the software within your company as a reference, in read only form, for the sole purposes of debugging your products, maintaining your products, or enhancing the interoperability of your products with the software, and specifically excludes the right to distribute the software outside of your company.

Copyright Grant- Subject to the terms of this license, the Licensor grants you a non-transferable, non-exclusive, worldwide, royalty-free copyright license to reproduce the software for reference use.

I'm not sure if the license itself is protected by copyright, so you might not be able to simply use it.

Title: Software license without modify


答:
Since the purpose of this license you seek is to assure your customers that your software is doing what you say it does, you don't really need to put your source code out as open source.

It doesn't take a genius to fork your code then rebrand it(even if you say in the license they're not supposed to do that, and trust me, its hard to litigate against foreign entities) so going open source might actually come back to bite you.

What you could do in my opinion though, is to have your source code audited, by a third party or by a group selected by your customers(just be sure to put the auditors under NDA so they don't spill the source code or they can be held legally liable for it), so that they can be assured that your code does what its supposed to do. Besides, you can even put this out as an extra bonus for your sales pitch. "We have our source code thoroughly audited by third parties at least once a year to assure you, our customers, that we are doing our best to take care of your data"

something like that.

Title: Software license without modify

Body:
I have my own company, and I would like to release our customer management system as open source so everybody can see what we do.

But it is very important to me that I don't want anyone else to use or modify the software.

My idea is to modify the MIT license, because it is simple to understand.

But I am not sure about modifying a license as I'm not a lawyer.

Is there a license that fits my needs?  Specifically, I want people to be able to see our system but not be able to use or modify it.


问:
Is there any hard data on the (dis-)advantages of working from home?
Is there any hard data (studies, comparisons, not-just-gut-feel analysis) on the advantages and disadvantages of working from home?

My devs asked about e.g. working from home one day per week, the boss doesn't like it for various reasons, some of which I agree with but I think they don't necessarily apply in this case.

We have real offices (2..3 people each), distractions are still common. IMO it would be beneficial for focus, and with 1 day / week, there wouldn't be much loss at interaction and communication. In addition it would be a great perk, and saving the commute.

Related: Pros and cons of working remotely / from home  (interesting points, but no hard facts)

To clarify: it's not my decision to make, I agree that there are pro's and con's depending on circumstances, and we are pushing for "just try it". I've asked this specific question because (a) facts are a good addition to thoughts in arguing with an engineer boss, and (b) we, as developers, should build upon facts like every respectable trade.

答:
Here is a link to an article that mentions a study commissioned by Citrix (The company that would love it if everyone worked from home.) http://www.workshifting.com/2010/12/making-collaboration-work-for-the-21st-centurys-distributed-workforce-study.html

I'm still looking for the study results.

Regardless of what you think of the book "The 4-Hour Workweek" by Timothy Ferriss (most people think the notion is preposterous), there is a chapter on strategies to get your company to let you work from home.

suggest a trial period.

Ask for a little more time than you
want so you have room to negotiate.

And emphasize that this is not
engraved in stone and if the
productivity isn't there, it can be
cancelled at the boss's discretion.

Get stuff done.

Make sure you are not confusing working from home with flex-time. Your boss may expect the same hours of availability. Failing to answer the home phone during 9-5, could ruin the whole thing. If you want flex-time, everyone is going to have adopt a project oriented way of tracking work and not the amount of hours.