问:
Some hint to program a webservice "by subscription"
I have some web sites programmed, I know to do it with python and PHP basically. Normally they are simple web sites, but now I want to provide REST web services but only for allowed users (allowed by me).

I saw that a lot of services uses the "KEY" and "SECRET_KEY" concepts, which seems to be what I need (if I understand it right).

My suppositions are:

If I only do a GET service to retrieve, e.g., all my clients, without anymore, anyone can retrieve my clients without limitations.

I will need some KEY generator to provide keys for my allowed users, so they can use my webservices.

Only with a KEY is not enough: someone can steal a KEY and supplant my user (and this is the reason because exists a SECRET_KEY, right?).

If all this is right, how can I make/use a system like that in my web services? Some open source example?

Or maybe there are another easy solutions I'm not considering?

My objective is to allow some users to use my web services.

答:
The solution is relatively straightforward, once you have understood it. The very basic explanation goes as this:

You have a client and a server. The client has a private key (or secret key). The server can retrieve the private key from a database based on the public key of the client. If the client now sends a request to the server, it calculates an HMAC hash from all the parameters that it would send anyway plus some extra goodies. These extra goodies are the private key, a timestamp and nonce value.

The server receives the request with the hash and recalculates the HMAC hash to verify that the real client sent the request. Since the private key can be received from database, no vulnerable data is transmitted via Internet.

The timestamp and nonce prevents man-in-the-middle attacks that try to replay the message. Such an attacker would either need to include the real nonce and timestamp value or a modified one. With the modified one, the HMAC hash won't fit and with the original one, the server can recognize that a request with the same values has been uttered already.

In short this is the explanation for the procedure. It is comparable to the two-legged OAuth.


问:
In ASP.NET MVC/Razor, how to add initializer JavaScript to a "control"?
Actually, I already have at least 3 different solutions for the problem, I just don't like any of them for various reasons.

In ASP.NET MVC/Razor, there are no controls anymore, in the sense as they were in ASP.NET. An ASCX control used to be view+controller intertwined, so I get it. Instead we have html helpers that emit strings, html fragments. Let's say I want to create a helper method in a library that creates a jQuery UI date picker.

First solution. I just write a method that first creates a textbox (actually I can just call TextBoxFor because it does the same thing for me), then it creates a small JavaScript code fragment that calls $('#textboxid').datepicker(). Then I can call that in my Razor views and it works. I don't like the fact that view-related stuff is done in code, and not in Razor, but all default editor templates are like that, sadly. I don't like the fact that there will be lots of small script fragments after each textbox in the output html. And my code fragment can get complex, if that initializer JS had many parameters, it would look ugly, there would be string escape issues, etc.

Microsoft is pushing unobtrusive JavaScript architecture. I could just put a CSS marker class on my textbox, add some data-attributes if needed, and emit only one JavaScript that turns all my textboxes to date pickers, based on the CSS marker class. This one last part is the main problem, I do need an imperative JS code to do that. Unobtrusive AJAX and validation work well because they don't need that at all, they just respond to user interaction events. This is not the case, I need to turn my textboxes to date pickers whenever they appear. And they can appear dynamically in an editable grid, or after an AJAX call, whenever.

Third solution, view should be done in Razor, so let's do it in Razor, as an editor template. Problem is, we're talking about a class library here. In the past, I have seen ugly hacks to embed .cshtml files as embedded resources or compile them to actual C# code during compilation. Last I checked, they seemed like ugly hacks and weren't supported.

Is there another solution? If not, which of the above is the nicest, the one that most conforms to the state of the art coding conventions, or Microsoft's idea, etc?

答:
Another one is to have a cshtml and corresponding controller beneath. Such a thing we call a control and embed it in another view using @Html.RenderPartial('<action_url>', <model>). In the controller action should be annotated with [ChildActionOnly] attribute so it cannot be called in a direct call.

Not that I am huge fan of that approach, just describe it here so we have full picture.

You can also use Razor's @helper in addition to you @Html. helpers.

ContentLicense: CC BY-SA 3.0


问:
GPL - Writing an exception for a plugin interface under section 7 of GPLv3

The problem

I've written a application for Android licensed under GPLv3 which needs to use Google Play Services, a proprietary library, as a plugin to the app.

Now I'd also like to add libspotify as a plugin.

For all of the proprietary libraries used I'm providing alternative open source plugins but they are not as good as the proprietary ones, not even close.

The user should then be free to disable all proprietary parts either at compile or runtime.

Possible solutions

The GPLv3 has a section "7. Additional Terms." under which you can add a "classpath" exception. I'd like to use this exception to do the following.

The idea of a classpath exception is explained in the GPLv3 FAQ here:

Linking over a controlled interface:
http://www.gnu.org/licenses/gpl-faq.html#LinkingOverControlledInterface

http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs

The basic idea

Implement these interfaces:

interface Plugin {}

interface ProprietaryPlugin extends Plugin {}

interface XYZ_1 extends Plugin {
    public void someHook();
    public void someOtherHook();
    ...
}

interface XYZ_2 extends Plugin {
    public void someHook();
    public void someOtherHook();
    ...
}

XYZ_3, 4, ...
```

<p>The above interfaces are part of the project and are under GPL.</p>

<p>But I'd like to let all code that extend some subinterface of Plugin except ProprietaryPlugin to be able/allowed to be proprietary given that they mark themselves as ProprietaryPlugin.</p>

<p>My intention is to make tight plugin hooks that all proprietary plugins must follow and a way to indicate to the user which plugins that we can remove at runtime.</p>

<p>Also, I want the "bridge" code, the implementation of the plugin interfaces to be open source and under a GPLv3 compatible license. And the source code must provide at least one GPLv3 implementation, hopefully creating a concrete wall between the GPLv3 and proprietary code.</p>

<h2>Visual explanation</h2>

<p><img src="https://i.stack.imgur.com/NmkP5.png" alt="visual explanation with UML and licenses"></p>

<p>Is this possible to do? I know that most guys here are not lawyers, but I find asking developers first enlightening.</p>

<h2>A suggestion from irc.gnu.org#gnu</h2>

<p>The guys at irc.gnu.org#gnu gave me the following suggestion:
https://raw.github.com/qcad/qcad/master/gpl-3.0-exceptions.txt</p>

<p>It states that:</p>

<pre class="lang-none prettyprint-override"><code>As a special exception, the copyright holders of QCAD hereby grant permission
for non-GPL compatible plug-ins and script add-ons to be used and distributed
together with QCAD, provided that you also meet the terms and conditions of the
licenses of those plug-ins and script add-ons.
</code>```

Is "non-GPL compatible plug-ins and script add-ons" vague / a loophole, or is it clear and does it apply to my case?

A second suggestion

I got a second suggestion at #gnu: http://roundcube.net/license/

It states that:

This file forms part of the Roundcube Webmail Software for
which the following exception is added:
Plug-ins and Skins which merely make function calls to the Roundcube Webmail Software,
and for that purpose include it by reference shall not be
considered modifications of the software.

If you wish to use this file in another project or create a modified version that will
not be part of the Roundcube Webmail Software, you may remove the exception above and
use this source code under the original version of the license.
```

<p>What do you think about this one?</p>

<h2>My attempt at a "classpath exception"</h2>

<p>My first idea was to add the classpath-exception to Plugin with something like the following... does it accomplish my intent or is it filled with loopholes, etc.?</p>

<pre class="lang-none prettyprint-override"><code>Additional permission under GNU GPL version 3 section 7

0. Definitions

"FSF" means the Free Software Foundation, Inc.

"Compatible License" means any license the FSF
considers to be compatible with the GNU GPL version 3.

"Plugin interface" means any interface definition file in the Corresponding Source
containing - in the file's header - the words
"The licensors of this Program designates this particular file as a Plugin interface"

"Proprietary interface mark" means any interface definition file in the Corresponding Source
containing - in the file's header - the words
"The licensors of this Program designates this particular file as a Proprietary interface mark""

"Allowed library" means any library that is linked or combined with this Program,
 or any covered work that creates a derivative work of a
subinterface of a Plugin interface not directly linking with the library.
Such a subinterface provides at least the source code
of one working implementation licensed under This License.
The derivative work of the subinterface linking to the
Allowed library implements a Proprietary interface mark.
Such a derivative work is referred to as a "Proprietary plugin implementation".
A Proprietary plugin implementation is licensed under a Compatible License.

1. Exceptions

If you modify this Program, or any covered work, by linking or combining it
with any Allowed library (or a modified version of those libraries),
containing parts covered by the terms of those libraries, the licensors of this
 Program grant you additional permission to convey the resulting work.
{Corresponding Source for a non-source form of such a combination shall include
 the source code for the parts of any Proprietary plugin implementation
used as well as that of the covered work.}
</code>```

答:
I don't think you can do what you are trying to do.  And you would be well advised to contact the FSF or an attorney specializing in intellectual property.

If you look at the FSF FAQ on the GPL and Plugins, they have some relevant comments for your situation.

It depends on how the program invokes its plug-ins. If the program uses fork and
  exec to invoke plug-ins, then the plug-ins are separate programs, so the license for the
  main program makes no requirements for them.

If the program dynamically links plug-ins, and they make function calls to each
  other and share data structures, we believe they form a single program, which must be
  treated as an extension of both the main program and the plug-ins. This means the plug-ins
  must be released under the GPL or a GPL-compatible free software license, and that the
  terms of the GPL must be followed when those plug-ins are distributed.

If the program dynamically links plug-ins, but the communication between them is limited
  to invoking the ‘main’ function of the plug-in with some options and waiting for it to
  return, that is a borderline case.

I don't think your program is going to fall into the first case of using fork or exec.  If it did, then you wouldn't have any issues.  It's more likely that your program falls into the third category with dynamic linking.  But it's not a good sign when the FSF tells you that you're in a gray zone.  When it comes to the GPL and the copyleft, you want clear-cut answers.

The key for FSF's determination seems to be this phrase:

If the program dynamically links plug-ins, and they make function calls to each other and share data structures ...

which is repeated in another FAQ answer.  If I had to guess, I suspect your program is going to share data structures and the two components (your application plus the plugin) will be making function calls to each other.  And it that's the case, then you're squarely within their second example and the plugins will need to be licensed as GPL or a GPL-compatible license.


问:
Do RESTful APIs tend to encourage anemic domain models?
I'm working on a project in which we are trying to apply both domain-driven design and REST to a service-oriented architecture. We aren't worrying about 100% REST compliance; it would probably be better to say we are trying to build resource-oriented HTTP APIs (~Level 2 of Richardson's REST maturity model). Nevertheless, we are trying to stay away from RPC-style use of HTTP requests, i.e. we attempt to implement our HTTP verbs according to RFC2616 rather than using POST to do IsPostalAddressValid(...), for example.

However, an emphasis on this seems to be at the expense of our attempt to apply domain-driven design. With only GET, POST, PUT, DELETE and a few other rarely used methods, we tend to build CRUDdy services, and CRUDdy services tend to have anemic domain models.

POST: Receive the data, validate it, dump it to the database. GET: Retrieve the data, return it. No real business logic there. We also use messages (events) between the services, and it seems to me that most of the business logic ends up being built around that.

Are REST and DDD at tension at some level? (Or am I misunderstanding something here? Are we maybe doing something else wrong?) Is it possible to build a strong domain model in a service-oriented architecture while avoiding RPC-style HTTP calls?

答:
POST was deliberately designed to be "intentionally vague;"  the result of a POST is implementation-specific.  What prevents you from doing what Twitter and other API designers do, and define each POST method in the non-CRUD portion of your API according to your own specific requirements?  POST is the catchall verb.  Use it when none of the other verbs are a good fit for the operation you want to perform.

To put it another way, your question could be equally posed as "Do 'smart' objects encourage RPC-style design?"  Even Martin Fowler (who coined the term "Anemic Domain Model") concedes that bare DTO's do have some benefits:

Putting behavior into the domain objects should not contradict the
  solid approach of using layering to separate domain logic from such
  things as persistence and presentation responsibilities. The logic
  that should be in a domain object is domain logic - validations,
  calculations, business rules - whatever you like to call it.

Regarding the Richardson Maturity Model, you can get to level 3 without ever concerning yourself about "Anemic Domain Models." Remember, you're never going to transfer behavior to the browser (unless you plan on injecting some Javascript through your models).

REST is mostly about machine independence; implement the REST model to the degree that you want your endpoints to represent resources, and for consumers of your API to be able to easily access and maintain those resources in a standard way.  If that seems anemic, then so be it.

See Also

I Need More Verbs

ContentLicense: CC BY-SA 4.0


答:
I'm not entirely sure I've identified the right problem, but if I have, this may help:

We created a class called ScriptManager which lets us add arbitrary javascript files and/or functions to the bottom of all our pages when they are rendered.  Give this a try:

```<code>public class ScriptManager
{
    public List<string> scripts = new List<string>();
    public List<string> scriptFiles = new List<string>();
}
public static class HtmlExtensions
{

    [ThreadStatic]
    private static ControllerBase pageDataController;
    [ThreadStatic]
    private static ScriptManager pageData;

    public static ScriptManager ScriptManager(this HtmlHelper html)
    {
        ControllerBase controller = html.ViewContext.Controller;

        // This makes sure we get the top-most controller
        while (controller.ControllerContext.IsChildAction)
        {
            controller = controller.ControllerContext.ParentActionViewContext.Controller;
        }
        if (pageDataController == controller)
        {
            // We've been here before
            return pageData;
        }
        else
        {
            // Initial setup
            pageDataController = controller;
            pageData = new ScriptManager();
            return pageData;
        }
    }
}
</code>```

Then, at the bottom of your _Layout.cshtml page:

```<code>@foreach (var script in Html.ScriptManager().scriptFiles.Distinct())
{
    @Html.Script(script);
}
@foreach (var script in Html.ScriptManager().scripts)
{
    @Html.Raw("<script type='text/javascript'>")
    @Html.Raw(script)
    @Html.Raw("</script>")
}
</code>```

Finally, you use it in a partial view like:

```<code>@{
  Html.ScriptManager().scriptFiles.Add(Url.Content("~/Scripts/jquery.blockUI.js"));
 }
</code>```

You lose the ability to tell the client about the scripts in the header of the page, but they will be included on all pages you use a partial view that uses the blockUI (for example).

Title: In ASP.NET MVC/Razor, how to add initializer JavaScript to a "control"?

Body:
Actually, I already have at least 3 different solutions for the problem, I just don't like any of them for various reasons.

In ASP.NET MVC/Razor, there are no controls anymore, in the sense as they were in ASP.NET. An ASCX control used to be view+controller intertwined, so I get it. Instead we have html helpers that emit strings, html fragments. Let's say I want to create a helper method in a library that creates a jQuery UI date picker.

First solution. I just write a method that first creates a textbox (actually I can just call TextBoxFor because it does the same thing for me), then it creates a small JavaScript code fragment that calls $('#textboxid').datepicker(). Then I can call that in my Razor views and it works. I don't like the fact that view-related stuff is done in code, and not in Razor, but all default editor templates are like that, sadly. I don't like the fact that there will be lots of small script fragments after each textbox in the output html. And my code fragment can get complex, if that initializer JS had many parameters, it would look ugly, there would be string escape issues, etc.

Microsoft is pushing unobtrusive JavaScript architecture. I could just put a CSS marker class on my textbox, add some data-attributes if needed, and emit only one JavaScript that turns all my textboxes to date pickers, based on the CSS marker class. This one last part is the main problem, I do need an imperative JS code to do that. Unobtrusive AJAX and validation work well because they don't need that at all, they just respond to user interaction events. This is not the case, I need to turn my textboxes to date pickers whenever they appear. And they can appear dynamically in an editable grid, or after an AJAX call, whenever.

Third solution, view should be done in Razor, so let's do it in Razor, as an editor template. Problem is, we're talking about a class library here. In the past, I have seen ugly hacks to embed .cshtml files as embedded resources or compile them to actual C# code during compilation. Last I checked, they seemed like ugly hacks and weren't supported.

Is there another solution? If not, which of the above is the nicest, the one that most conforms to the state of the art coding conventions, or Microsoft's idea, etc?

Body:
I'm not entirely sure I've identified the right problem, but if I have, this may help:

We created a class called ScriptManager which lets us add arbitrary javascript files and/or functions to the bottom of all our pages when they are rendered.  Give this a try:

public class ScriptManager
{
    public List<string> scripts = new List<string>();
    public List<string> scriptFiles = new List<string>();
}
public static class HtmlExtensions
{

    [ThreadStatic]
    private static ControllerBase pageDataController;
    [ThreadStatic]
    private static ScriptManager pageData;

    public static ScriptManager ScriptManager(this HtmlHelper html)
    {
        ControllerBase controller = html.ViewContext.Controller;

        // This makes sure we get the top-most controller
        while (controller.ControllerContext.IsChildAction)
        {
            controller = controller.ControllerContext.ParentActionViewContext.Controller;
        }
        if (pageDataController == controller)
        {
            // We've been here before
            return pageData;
        }
        else
        {
            // Initial setup
            pageDataController = controller;
            pageData = new ScriptManager();
            return pageData;
        }
    }
}

Then, at the bottom of your _Layout.cshtml page:

@foreach (var script in Html.ScriptManager().scriptFiles.Distinct())
{
    @Html.Script(script);
}
@foreach (var script in Html.ScriptManager().scripts)
{
    @Html.Raw("<script type='text/javascript'>")
    @Html.Raw(script)
    @Html.Raw("</script>")
}

Finally, you use it in a partial view like:

@{
  Html.ScriptManager().scriptFiles.Add(Url.Content("~/Scripts/jquery.blockUI.js"));
 }

You lose the ability to tell the client about the scripts in the header of the page, but they will be included on all pages you use a partial view that uses the blockUI (for example).


问:
Is embedded programming closer to electrical engineering or software development?
I am being approached with a job for writing embedded C on micro controllers. At first I would have thought that embedding programming is too low on the software stack for me, but maybe I am thinking about it wrong.

Normally I would have shrugged off an opportunity to write embedded code, as I don't consider myself an electrical engineer. Is this a bad assumption? Am I able to write interesting and useful software for embedded systems, or will I kick myself for dropping too low on the software stack?

I went to school for computer science and really enjoyed writing a compiler, thinking about concurrent algorithms, designing data structures, and developing frameworks. However, I am currently employed as a web developer, which doesn't scream the interesting things I just described. (I currently deal with issues like: "this check box needs to be 4 pixels to the left" and "this date is formatted wrong".)

I appreciate everyone's input. I know I have to make the decision for myself, I just would like some clarification on what it means to be a embedded programmer, and if it fits what I find to be interesting.

答:
Like everything, it requires a balanced approach.  I love working with embedded systems at my day job.  They make me better at electrical engineering.  Physical computing and automation are very exciting.  On the other hand, building web apps and tinkering with cloud computing is awesome.

If you do it right, the software side of you will look for ways to do things smarter and better.  The hardware side of you will keep you mindful of resources and super efficient.

ContentLicense: CC BY-SA 2.5


问:
How to consider the login function collecting requirements of an application? is it a user requirement?
I am working on an application that expected to the user logs in when the application is started (as for example it is in Skype: the user open the application and appear to him a login mask when he insert the username and password to start work with the application)

Now I am preparing some use case diagram and I am collecting the application requirements (I have to write some documentation)

Can I consider it as a user requirement? Or what is it?

答:
Become a customer's request when the customer wants the user can authenticate into application.

As a result, in the architecture diagrams and in use cases diagrams, you must consider this.

It becomes a key element even for testing, and QA. In the work-flow of the application, you'll definitely consider cases involving the authentication process (permitted access, user name and password wrong, suspended accounts, and other).


问:
Custom Role Provider in ASP.NET MVC and specifically a User having multiple Roles
I have searched around and I can't find any particular answer that addresses what I am asking but no doubt it will have been mentioned already somewhere.

I know that when you inherit from an abstract System.Web.Security.RoleProvider you override this method public abstract string[] GetRolesForUser(string username);

and as the name of the method (GetRoles) and it's return value (string[]) implies, more than 1 role can be returned for a single user, but it could also be restricted to a single item array through a custom role provider.

In my situation I am implementing this in a .NET MVC web app and using a custom .NET role provider, and I have a decision to make as to whether I should allow a user to be in more than 1 role at a time.

I am looking for any general reasons for/against doing this (most specifically implementation reasons).

Most of the points I can think are app domain specific, here are a couple...

Deciding which role permissions take priority i.e. what to do when 1 role authorizes a particular action and another is supposed to deny it but both roles are assigned to the same user.

Whether to allow users to switch in and out of their roles or to only ever assign 1 role to them and have an administrator change this.

but is there any particularly bad reason why you should avoid giving a user multiple roles at a time? Is it better to give a user only 1 role?

答:
Roles are one of those things that is strongly domain-dependent.  In other words, you assign someone to a Role because that's the role they play IRL.

If you don't allow roles to overlap, you can find yourself in the uncomfortable position of creating "hybrid" roles that encompass multiple responsibilities, for example creating a role that solely describes the "QA Supervisor/Code Administrator/Floor Sweeper" guy.

If you allow multiple roles, you can just assign those three roles, and you're done.

Resolving role conflicts is easy enough; you just decide which one takes precedence, or you assume "deny" unless a specific permission is granted.  Users don't normally assign roles to themselves; someone higher up in the food chain has to do that.


问:
What are the advantages to developing with outdated technologies?
A little background:

I am working at a large company, using Windows XP and coding Winforms in VB6/VB.Net and some WebForms in VB.Net (95% maintenance code). I have one 4:3 19" screen. A more modern version of Windows isn't happening soon, neither is any greenfield work by the sounds of it!

I wasn't told about any of this when I joined the company, I was mislead to think I would be working with much more up to date technologies and frameworks.

I have much more up to date experience from previous jobs, both with more modern frameworks and other programming languages, and when I am catching up with developer friends from other companies all I hear about is how they are using the latest ASP MVC framework, or Vagrant/Ruby on Rails/etc and I am getting the green eyes!

I could sort myself out with another job pretty quickly, but I feel as though I should give this one more of a chance.

The question:

I am trying to convince myself that my current job isn't that bad. So what are the advantages to this sort of role? Are there advantages to working with outdated technologies? Maybe some techniques that I wouldn't pick up working with more modern ones? Or is this the sort of place where careers go to die, and I should get out while I still have my soul?

答:
There are multiple advantages:

1) There will be lots of resources available for the technologies as long as they were not obscure ones that were not widely used.

2) Hopefully others at the company will be well versed in the technologies as they haven't changed.

3) If there is not a lot of new development, you can work on refactoring old code to be cleaner, or faster.  Note that the type of shop that keeps this old tech probably will be against changing any code that "works" despite how abhorrent it may be.


答:
There are some advantages to developing with outdated technologies, but whether or not these outweigh the cost you suffer for losing fluency with their replacements and the pain of working with them is a personal choice between you and them.

I can think of three benefits of working with obsolete, replaced technology:

Familiarity  with the older technology itself

The only old technologies still in use are those that someone, somewhere, has decided are cheaper to maintain than replace.  Being able to list work experience with such older technology can, in and of itself, help you gain another job working in the same area.  And as more and more developers move on, the premium you can charge for working on such goes up.

A chance to practice learning something new

You're not really a programmer if you can only program in languages someone else taught you.  Being able to adapt your techniques and models to older technology requires much of the exact same skills you would need to adapt to new technology.

Deeper understanding of why they were replaced

It's hard to explain to a non-programmer HR or Executive type why VB.NET or C# is superior to VB6 if you're not familiar with the technology itself.  And if you're not entirely familiar with the latter, learning what they replaced can help understand some of why the replacements were written how they were.

All of the above said, there is absolutely no reason a company should persist in maintenance of any application written in technology that has become so outdated.

If it can be left alone until the runtime fails due to some undocumented bug, that's one thing--but each hour a developer spends on old tech without a transition plan is technical debt the enterprise will have to eventually pay.

Title: What are the advantages to developing with outdated technologies?

Body:
A little background:

I am working at a large company, using Windows XP and coding Winforms in VB6/VB.Net and some WebForms in VB.Net (95% maintenance code). I have one 4:3 19" screen. A more modern version of Windows isn't happening soon, neither is any greenfield work by the sounds of it!

I wasn't told about any of this when I joined the company, I was mislead to think I would be working with much more up to date technologies and frameworks.

I have much more up to date experience from previous jobs, both with more modern frameworks and other programming languages, and when I am catching up with developer friends from other companies all I hear about is how they are using the latest ASP MVC framework, or Vagrant/Ruby on Rails/etc and I am getting the green eyes!

I could sort myself out with another job pretty quickly, but I feel as though I should give this one more of a chance.

The question:

I am trying to convince myself that my current job isn't that bad. So what are the advantages to this sort of role? Are there advantages to working with outdated technologies? Maybe some techniques that I wouldn't pick up working with more modern ones? Or is this the sort of place where careers go to die, and I should get out while I still have my soul?


问:
How has an increase in the complexity of systems affected successive generations of programmers?
As a "new" programmer (I first wrote a line of code in 2009), I've noticed it's relatively easy to create a program that exhibits quite complex elements today with things like .NET framework for example. Creating a visual interface, or sorting a list can be done with very few commands now.

When I was learning to program, I was also learning computing theory in parallel. Things like sorting algorithms, principles of how hardware operates together, boolean algebra, and finite-state machines. But I noticed if I ever wanted to test out some very basic principle I'd learned in theory, it was always a lot more difficult to get started because so much technology is obscured by things like libraries, frameworks, and the OS.

Making a memory-efficient program was required 40/50 years ago because there wasn't enough memory and it was expensive, so most programmers paid close attention to data types and how the instructions would be handled by the processor. Nowadays, some might argue that due to increased processing power and available memory, those concerns aren't a priority.

My question is if older programmers see innovations like these as a godsend or an additional layer to abstract through, and why might they think so? And do younger programmers benefit more learning low-level programming BEFORE exploring the realms of expansive libraries? If so then why?

答:
As with everything, a little bit does you good, but too much hurts. The problem is too many systems don't know when to stop - just 1 more abstraction, to help you program faster... but then you end up coding in the real world where things are never quite as simple as you want, and you spend more time working round the edges than you would have spent with a less featured abstraction.

Its ably described here

or here - "with a single line of code you could add 500 users to the domain"...

Your abstractions try to hide the complexity from you, but really all they do is hide that complexity. The complexity is still there, its just that you have much less control over it - and that's why you end up with this kind of situation.


答:
all I hear about is how they are using the latest ASP MVC framework,
  or Vagrant/Ruby on Rails/etc and I am getting the green eyes!

Ah, but there they are playing with their toys, and there's you doing real work, using a tool that does the job to achieve a solution.

That's what you should be considering - software is too often an amateur affair with people jumping from one cool new tech to the next latest fashion. Then there are others who treat it as a much more professional career where the tools don't matter so much as the product or solution you create.

There are places where old tech needs to be replaced with something new, but its generally just upgrades, not wholesale replacements. Eg VB6 gets upgraded to VB.NET, Visual Studio 2002 gets upgraded to Visual Studio 2012. Anyone who goes into a complete rewrite always finds that things aren't quite so fantastic with the new tools. (which is why Joel, amongst others, say the rewrite is always the wrong answer)

So concentrate on achieving things, and upgrade where you can, slowly and carefully where it makes sense - not because you want to play with the newest toys (which will be discarded soon enough anyway, and the absolute last thing you want is to maintain a system written by people who coded in last year's cool tech)


答:
There are, indeed, several benefits for a company to stick with outdated technologies:

Legacy stuff sometimes doesn't work with new stuff

A company may have invested a large amount of money in systems which simply don't work with newer languages or operating systems. A classical example is many intranet web apps which are compatible with IE6, and IE6 only. The choice between sticking with Windows XP + IE6 and throwing away a working system and investing money in the new one is not obvious.

Changing for the sake of change is not a wise choice

Example: many banks still continue to maintain applications originally written in COBOL. When the stuff works, why would a business decide to rewrite it in another language, given the cost of rewriting a large business critical system, as well as the risk to get it wrong, introducing a bunch of new bugs? (One of the reasons is described below)

Licenses are expensive

Let's say a company has a few hundred desktops which use Windows XP. They want to move to Windows 8. What is the cost of a single license of Windows 8 Enterprise? What if we multiply this cost by the number of machines?

It becomes even worse for servers. A single license for Oracle or Microsoft SQL Server costs about $30 000 - $40 000. If a company has, say, fifty database servers, it becomes quickly very expensive even with Volume licensing.

At my company, we are stuck with Visual Studio 2010. We suffer from its numerous bugs, and we know they will never be solved, since Microsoft abandoned this version. But $13 000 (given that we need Ultimate version because of its unique features which are unavailable in other versions) is too high for us to update to Visual Studio 2013.

Having said that, there are also important drawbacks.

Legacy stuff doesn't attract new talents

That's one of the issues of the companies which are maintaining COBOL apps: they have a hard time finding inexpensive developers. Also, working on mainframes and writing COBOL code is not something attractive for creative persons.

While being a good choice for backbone systems which require to stay solid, those systems and languages won't fit well for products which require constant innovation.

Old doesn't mean secure

As rewriting a product in a new language may introduce new bugs, keeping old systems which are not supported any longer can be dangerous as well. Imagine a bug is found in Windows 98, which could compromise the whole system: would Microsoft release an update to solve it?

Legacy is viral

Incompatibility between legacy and newer systems means that often, when you're stick with an old product, language or infrastructure, you'll be unable to upgrade somewhere else. An old intranet app which works only on IE6 leads to Windows XP on all desktops, which means that you cannot migrate to a new Active Directory version, which means that you can't use new apps which require the most recent Active Directory version, and so on.

Productivity

New versions of products bring new features which, sometimes, increase productivity. A task which would take one hour with Visual Basic 6.0 could be done in less than an hour with Visual Studio 2013, because Visual Studio 2013 and .NET Framework 4.5 bring improved Intellisense, Entity Framework, and thousands of other things which reduce code one has to write, increase the speed of writing code and decrease the risk of introducing bugs.

If the example is not clear enough, here is another one. In Windows 3.1, system administrators would setup every machine one by one, by hand (unless there was some automation I'm not aware of). Today, they would use PXE and Windows Assessment and Deployment Kit to deploy within minutes a new OS and software over thousands of machines automatically.

Using older versions may simply become cost prohibitive. It may not be obvious to some users who are happy using Windows 95, but is much more obvious for developers, system administrators, designers, scientists and other persons who heavily rely on the power of hardware and applications.


问:
Is api user authentication with oauth possible for both email/pw and 3rd party services
I have an api only application (rails-api) and I'm looking to authorize a user on both email/password or 3rd party services like facebook or twitter etc, so I know I will have to use Oauth at some point.

My question is, can I solely use Oauth, or do I have to implement my own authentication (or something like Devise) to do the manual email auth. I don't understand Oauth well enough to know whether I can do manual authentication with my single endpoint, it seems like it only works with 2 endpoints (my server and a 3rd party service). I would much rather not use Devise is not built for an api and adds alot of overhead IMO.

答:
You could build your own oauth provider to wrap the 'email/password'. You'd need to understand oauth, but it's not actually that hard to do.

In that case, you would have one service running somewhere on your network, even same host, as the oauth provider, and then your site. Your own oauth provider would act just like facbook, twitter, etc.

It's not clear that this would be ultimately easier / better than supporting oauth + 'local/classic authentication' but it's certainly possible.

A lot of times, you can get away with just oauth to facebook, etc. If you're already using oauth anyway, then the key question is most likely whether more or less all your users already have a Facebook/Twitter/etc. account and if there's any reason they'd like to hide that fact from you or not. If you expect everyone to have an account with a 3rd party on the list and not be secretive about it, then you can often drop local authentication altogether.


问:
what is the difference between a software engineer and project manager?
I understand that a software engineers job is to work with all aspects of developing and supporting a software system. How does a project manager fit/work with a software engineer in a small team (5 or less) environment?</p>

答:
Caveat -- job descriptions and the duties attached vary wildly from company to company and even department to department.

A Project Manager:-

Manages the project schedule.

Manages the project budget and other resources

Communicates progress to the business and upper management

Allocates resources within the team

resolves disputes between team members

A Software Engineer:-

obtains and manages a list of business requirements.

selects suitable technologies to use for the solution.

produces an outline solution (hopefully based on use cases or similar)

provides the project manager with time and resource requirements for the above

develops a testing strategy

tracks and manages defects and fixes

constantly cross references the solution, defects etc. back to the business requirements.

Most people with the "Software Engineer" job title do a considerable amount of programming (I know I did), but, programming is not really what it is about.


问:
Is it reasonable to use git only on my local machine?
Is it ok to just use git only locally? I don't want to have to pay for a service that provides private repositories (such as Github) but I think git is a great way to organize my closed-source project.</p>

答:
While it's entirely reasonable and possible to use git locally, it's better to have backup.

You can arbitrarily push repos to basically anywhere. Github just happens to be easy hosting and collaboration. There are other options such as using Google Drive or Dropbox if you want remote storage.


问:
Highly scalable and dynamic "rule-based" applications?
For a large enterprise app, everyone knows that being able to adjust to change is one of the most important aspects of design. I use a rule-based approach a lot of the time to deal with changing business logic, with each rule being stored in a DB. This allows for easy changes to be made without diving into nasty details. Now since C# cannot Eval("foo(bar);") this is accomplished by using formatted strings stored in rows that are then processed in JavaScript at runtime. This works fine, however, it is less than elegant, and would not be the most enjoyable for anyone else to pick up on once it becomes legacy.

Is there a more elegant solution to this? When you get into thousands of rules that change fairly frequently it becomes a real bear, but this cannot be that uncommon of a problem that someone has not thought of a better way to do this. Any suggestions? Is this current method defensible? What are the alternatives?

Edit: Just to clarify, this is a large enterprise app, so no matter which solution works, there will be plenty of people constantly maintaining its rules and data (around 10).  Also, The data changes frequently enough to say that some sort of centralized server system is basically a must.

答:
If your rules are all of a form

```<code>if <condition>
then <action>
[else <action]
</code>```

You could use Drools.NET or another Rete implementation such as iLog.

Body:
If your rules are all of a form

if <condition>
then <action>
[else <action]

You could use Drools.NET or another Rete implementation such as iLog.


答:
The only "drawback" of using Git locally(compared to not using any SCM at all) is the extra work of committing, branching and tagging - and that extra work is not only neglected in the grand scheme but also contributes directly to organizing your code and documenting your progress.

Also keep in mind that Git is a distributed SCM. While the common case is to use it with a central repository, it was designed to be usable without one. You can create patches(or even better - bundles - which are a pack of patches[a single patch can only contain a single commit]) and send them by mail to your colleagues or save them as backups. This is less comfortable than using a central repository(that's why people usually prefer to use one), but it allows you to use Git for collaboration without paying for a private repo or hosting one on your own server.

Title: Is it reasonable to use git only on my local machine?

Body: Is it ok to just use git only locally? I don't want to have to pay for a service that provides private repositories (such as Github) but I think git is a great way to organize my closed-source project.</p>


答: Yes, it is entirely reasonable to use git only locally.  You may want to push to a local network drive or removable backup for redundancy reasons, but git itself works perfectly well without connecting to someone else's sever.</p>


答:
Another great argument for using git locally (i.e. only one copy in the universe) is git bisect, which can be used to find many a nefarious bug and has saved me many times.  It allows one to narrow down exactly which commit an annoying bug was added (and thus lets you focus on a much smaller segment of problem code).

Read more about git bisect


答:
Think about what you need and what you're going to use it for - your requirements.

If it's code for a spike for a couple of hours, just write it may be ok.

If you get to the point where you start to (or feel the need to) make backups to 'save working versions', then a version control system can help.

Also, if you get code to a working point and want to do your own spike, it can be handy to do a branch which you can then merge back in, as shown below where I am the sole contributor and this repo has never been pushed anywhere ('uncouple methods' was a branch I did for a spike):

Of course if you are also maintaining software that has several versions and/or releases, a version control system is very helpful, especially with the ability to merge changes.


问:
Should programmers help testers in designing tests?
How much should programmers help testers in designing tests?

I don't think they should help at all.  My worry is that if they help testers in designing tests for their own code, they'll 'infect' the testers with their own prejudices and blind spots about that code.

I feel that the requirements should be sufficient for giving the information needed for testers to create their tests.  If there is some part of the implementation that the programmers find worrisome, then I think it's their duty to implement unit tests to test that part or even run their own informal system tests to test that part.

Not everyone I know agrees with this though (and I understand some of their points to a certain extent).  What do others think about this?  Is this discussed in the literature anywhere?

答:
I'm doing QA, and unlike most domains knowing how to use our code is far more difficult than learning any programming lanquage. So we count on developers to give us test cases for their brand new whizzbang features, because we wouldn't know how to. In any case the QA problems are more to catch regressions and things that get broken than original testing of new features. In any case when the result is a complex computation, its hard to know what is a correct answer and what is a wrong answer, or even if an abnormal termination is a good or bad thing.

In any case, a developer, if he's honest probably knows something of his babies vulnerabilities. He probably knows at what parameter values, he has to select different algorithms, or domains in a table lookup or whatever. Knowing that, if he is sincere about rigorous testing, he should be able to generate a reasonable sized suite of tests that covers a lot of the code.


答:
At some point the company will need to be concerned about end of life of VB6 but sadly VB.NET has some breath left.

Is there any related reason you need to work on a single small monitor? That sounds more like the company being cheap than being concerned about well tested technologies. It's not like a couple of 21" monitors are going to introduce bugs.

To keep your skills sharp and get paid for it, I would suggest looking at your build, test and deploy setup. This may be an opportunity to start introducing some newer technologies by using rake, powershell, and/or nant for build and deployment. If you don't have unit tests, start adding them.

At the end of the day, if the company is not in the technology space then it will always be secondary to them. It makes total sense for them to maintain stability to protect their core business operations.

I'll avoid giving any career advice, I'm sure others have covered the bases.


答:
Martin Fowler's first law of distributed systems: "Don't distribute your objects!" Remote interfaces should be coarse-grained and internal interfaces fine-graned. Often rich domain model only applies within a bounded context.

REST API separates two different contexts both having their own internal models. The contexts communicate through coarse-grained interface(REST API) using "anemic" objects(DTO).

In your case it sounds like you are trying to spread a context over a boundary that is REST API. This can lead to fine-grained remote interface or anemic model. Depending on your project it may or may not be a problem.

Title: Do RESTful APIs tend to encourage anemic domain models?

Body:
I'm working on a project in which we are trying to apply both domain-driven design and REST to a service-oriented architecture. We aren't worrying about 100% REST compliance; it would probably be better to say we are trying to build resource-oriented HTTP APIs (~Level 2 of Richardson's REST maturity model). Nevertheless, we are trying to stay away from RPC-style use of HTTP requests, i.e. we attempt to implement our HTTP verbs according to RFC2616 rather than using POST to do IsPostalAddressValid(...), for example.

However, an emphasis on this seems to be at the expense of our attempt to apply domain-driven design. With only GET, POST, PUT, DELETE and a few other rarely used methods, we tend to build CRUDdy services, and CRUDdy services tend to have anemic domain models.

POST: Receive the data, validate it, dump it to the database. GET: Retrieve the data, return it. No real business logic there. We also use messages (events) between the services, and it seems to me that most of the business logic ends up being built around that.

Are REST and DDD at tension at some level? (Or am I misunderstanding something here? Are we maybe doing something else wrong?) Is it possible to build a strong domain model in a service-oriented architecture while avoiding RPC-style HTTP calls?


答:
IMHO I don't think they tend to encourage anemic domain models (ADMs), but they do require you to take some time and think things through.

First of all I think the main characteristic of ADMs is that they have little to no behaviour in them. That's not to say that the system has no behaviour, just that it's usually in some sort of Service class (see http://vimeo.com/43598193).

And of course if the behaviour doesn't exist in the ADM, then what does?  The answer of course is the data. And so how does this map to REST API? Well presumably the data maps to the content of the resource, and the behaviour maps to the HTTP verbs.

So you have everything you need to build a rich domain model, you just have to be able to see how the HTTP verbs map to the domain operations on the data, and then put those operations in the same classes that encapsulate your data.

I think where people tend to run into problems is that they have a difficult time seeing how the HTTP verbs map to their domain behaviour when the behaviour is beyond simple CRUD, i.e., when there are side-effects in other parts of the domain beyond the resource being modified by the HTTP request. One way to solve that problem is with domain events (http://www.udidahan.com/2009/06/14/domain-events-salvation/).


问:
Where do we put "asking the world" code when we separate computation from side effects?
According to Command-Query Separation principle, as well as Thinking in Data and DDD with Clojure presentations one should separate side effects (modifying the world) from computations and decisions, so that it would be easier to understand and test both parts.

This leaves an unanswered question: where relatively to the boundary should we put "asking the world"? On the one hand, requesting data from external systems (like database, extental services' APIs etc) is not referentially transparent and thus should not sit together with pure computational and decision making code. On the other hand, it's problematic, or maybe impossible to tease them apart from computational part and pass it as an argument as because we may not know in advance which data we may need to request.

答:
On the other hand, it's problematic, or maybe impossible to tease them
  apart from computational part and pass it as an argument as because we
  may not know in advance which data we may need to request.

This is an instance where, as noted in the comments, passing in the ability to retrieve data (e.g., first-class function, an object that implements an interface, etc.) provides a convenient mechanism for isolating side effects.

A higher-order function whose body is pure has unfixed purity:
http://books.google.com/books?id=Yb8azEfnDYgC&pg=PA143#v=onepage&q&f=false

I've written about this, calling this type of function a potentially-pure function:
http://adamjonrichardson.com/2014/01/13/potentially-pure-functions/

If you combine a potentially-pure function with fall-through functions (which lack branching constructs and do as little as possible), a combination I call isolation sets, you can isolate side effects quite effectively and create very testable code:
http://adamjonrichardson.com/2014/01/15/isolating-side-effects-using-isolation-sets/


答:
For older people, moving towards the end of their professional career, selling their profound knowledge of a older technology to company that still uses the old stuff, may be financally attractive. For example, if you are experienced in PDP-11 you may want to move to Canada.

However, earlier in your career, I would recommend moving on.


问:
Automated testing of programs with graphical output
I am a lecturer for a post-graduate module where I expect my students to write Python code that replicates examples from the textbook. The project has been running for a couple of years and this year I want to introduce more automated testing. The problem is writing tests for the functions which primarily produce a matplotlib figure. Note that we are only trying to replicate the figures approximately, so binary comparison with a target image won't be very useful.

The short question is therefore: what strategies can I use to test programs whose primary graphical output can not be compared against a strict reference image?

Some of the problems that I have with the existing code base that prevents automated testing in this case:

Producing the graph stops execution in many cases

It is not practical to generate a copy of the figure in the textbook that includes annotations and so on, so algorithmic image comparison is unlikely to be the answer.

To clarify my goals:

I would like to be able to execute all the code in the codebase to check that it is actually running, even if that means throwing away the output. This would catch regressions where a function is changed

Instead of investing deeply into fuzzy matching of the graphical output with the target, I believe that visual checking between a reference image and the generated image is probably going to be the simplest, but this should be deferred to happen once at the end of the run rather than during the run

Since this is a collaborative project, I don't have to assume that the students are going to be adversarial. Mistakes will be good-faith rather than perverse.

答:
If the result cannot match the original perfectly, you'll have to do some fuzzy matching.

One very simple measure would be to use the original picture as the golden standard. Subtract your own result (using the absolute difference as the result), and perhaps average over the whole picture. That should give you an idea of how well at least the shape of things fit the original.

A tweak on this method would be to resize both images until their sizes match. Another would be to resize both to a much smaller size and compare those much more strictly, to fit just overall structure of the original.

I'd also second @KilianFoth's idea of using other phase spaces, but be very careful that you're actually comparing apples and oranges in such cases, by for example ignoring low-frequence ("noise") data.

As a general tip, you have to have something the results can be compared to if you want to be able to test it. No matter what that is - a text description, a function or an image - you have to use that as the goal for the testing.


答:
This depends on what the context of such tests is.

In development, testing is usually a barrier against negligence, code rot, or misunderstandings. Software gets very complex, but normally at least it "fights fair": it doesn't deliberately try subvert your intentions with deliverables that are useless, but pass the test on a technicality.

When you deal with students programming for grades, this is a real possibility. Therefore, the balance of pressures shifts subtly against automated testing, particularly when the requirement is not some hard-and-fast mathematical property but something as vague as "replicate this figure approximately". Obviously there are various approximations of the goal criterion that you can use and that may be useful (count the number of black and white pixels, detect edges and compare their structure, perform a full Fourier transform and judge the similarity in the frequency space rather than on the pixels themselves...)

However, it may be that looking at the results with human eyes and classifying them manually is actually more efficient. Think of it as exploiting the amazing hardware acceleration that the human brain provides for pattern recognition.

Title: Automated testing of programs with graphical output

Body:
I am a lecturer for a post-graduate module where I expect my students to write Python code that replicates examples from the textbook. The project has been running for a couple of years and this year I want to introduce more automated testing. The problem is writing tests for the functions which primarily produce a matplotlib figure. Note that we are only trying to replicate the figures approximately, so binary comparison with a target image won't be very useful.

The short question is therefore: what strategies can I use to test programs whose primary graphical output can not be compared against a strict reference image?

Some of the problems that I have with the existing code base that prevents automated testing in this case:

Producing the graph stops execution in many cases

It is not practical to generate a copy of the figure in the textbook that includes annotations and so on, so algorithmic image comparison is unlikely to be the answer.

To clarify my goals:

I would like to be able to execute all the code in the codebase to check that it is actually running, even if that means throwing away the output. This would catch regressions where a function is changed

Instead of investing deeply into fuzzy matching of the graphical output with the target, I believe that visual checking between a reference image and the generated image is probably going to be the simplest, but this should be deferred to happen once at the end of the run rather than during the run

Since this is a collaborative project, I don't have to assume that the students are going to be adversarial. Mistakes will be good-faith rather than perverse.


问:
How to deploy C# application to be used in branch / remote office(s)
Have very recently started a new position. One of my key challenges is a C# WinForms application (let's call it AppX) that causes a lot of non-planned work.

The main reason for this is that it needs to be deployed to several hundred branch offices. Currently, this is done via GP update or bespoke application. Both of these methods are unreliable and means we can't effectively deploy version upgrades.

Bit of background to what the software needs to do and some of the technical issues / background:-

AppX needs to produce results in real time

AppX needs to connect to a SQL server (express or full edition) which is
physically located in the branch office

AppX needs to ensure that after a version upgrade all remote sites are on the same   version

AppX can't be deployed via a thin client solution such as Citrix or
Remote Desktop services

The headquarters network can see the entire branch office network and connect into their SQL servers

My initial thoughts were

ClickOnce deployment -- however there seems to be some suggestions that there may be some issues with conflicts of the .Net framework with other software

Deploy the solution as a web app at the headquarters which connects back into the remote SQL server - technically I'm not sure how I would go about this

I guess that this is something that others may have come across so I would be interested to know if there are any other suggestions on how to approach this

Thanks

答:
why not use TFS automated Build ? you can read more here

http://msdn.microsoft.com/en-us/library/ff650529.aspx.

For database you will have to create Database solution in your project and that's all you need to worry rest TFS will take care of it.


问:
Which one of the SOLID principles had the largest effect on your code?
Which if the SOLID principles introduced by "Uncle Bob" Martin had the largest effect on your day to day coding? Please give details!</p>

答:
All of them, and none of them per se - I started with OO programming about ten years before Uncle Bob's first book came out. ;-)

My favorite principle is DRY = Don't Repeat Yourself. Also called 'normalization'!


答:
I'm going to concentrate on the flipside of this question i.e. the disadvantages of using new technologies, as the advantages of outdated technologies have been sufficiently covered in other responses.

We still have a large Visual Studio 6 code base and it doesn't look like it will be replaced any time soon.

However, we are pressing ahead with new technologies where we can for new developments.

As I think you allude to, it is possible to write VB.NET that interfaces quite nicely with legacy VB6 code using COM.

Using cutting edge technologies is undoubtedly fun as they often bring significant productivity benefits. However, the flip side is that you can come across a bug/glitch that  puts you back days/weeks. It is called bleeding edge for a reason!

Even if the company were to stump up the cash to upgrade the software, this (as I've found from personal experience) can be a bit of a drag whichever way the company chooses to go:

Software Port

The software is rewritten but has to look exactly the same as the old software so as not to upset the users. The joy of working with new technology is overridden by the fact that you can't use any of the new GUI wizardry.

Visual Studio update

You don't really get to use any of the new features properly as you spend a lot of time ironing out glitches in the code where it works fine in one version of studio but not the other.

Functional migration

You migrate the software keeping the core functionality. This allows the most freedom from a developer point of view but bugs might be introduced which might cause the company to question the value of such an exercise unless new value-added features are also included.

Nirvana for most developers is quality training on modern technologies, a chance to practice what you've learnt and then a greenfield project to cut your teeth on.

What you should do depends largely on the type of person you are. Neophiles will always want to work with the new stuff whilst the luddites think old technology is best. Most of us are somewhere in between. You need to work out where you feel comfortable. If you feel you can live with the status quo then great, otherwise take the coin for now and keep half an eye out for a more suitable position.


问:
Time-complexity of nested for loop
I have loops like this:

```<code>for(int i = 0; i < n; i++) {
    for(int j = 0; j < i; j++) {
        sum += 1;
    }
}
</code>```

It's O(n * ), but I'm not sure what the j < i loop is.

I have some tests that I ran,

```<code>n = 10, runs = 45

n = 20, runs = 190

n = 40, runs = 780

n = 80, runs = 3160

n = 10, runs = 12720
</code>```

It seems to be converging onto .5*n^2, but I'm not quite sure.

答: You can see that it follows a particular equation which is (n*(n-1))/2. e,g for n=5, runs=(n*(n-1))/2=5*4/2=10.So it is O(n*(n-1))=O(n^n-n)=O(n^2)[As in case of Big-O, lower order terms and constants are ignored]

Title: Time-complexity of nested for loop


问:
Intentional misspellings to avoid reserved words
I often see code that include intentional misspellings of common words that for better or worse have become reserved words:

klass or clazz for class: Class clazz = ThisClass.class

kount for count in SQL: count(*) AS kount

Personally I find this decreases readability.  In my own practice I haven't found too many cases where a better name couldn't have been used — itemClass or recordTotal.

An example from the JavaDocs for Class show this in the parameters:

```<code> public <U> Class<? extends U> asSubclass(Class<U> clazz)
</code>```

Does this show a reasonable use case?

答:
One benefit to creative spelling, is better search-ability.  I think it's far easier to do a full code search for unique things, than for common words, where too often you will find all of the wrong things, and 1000 of them.  As an example, I used to own kzpg.com.  Google that now and you'll see only a few hits.  It's unique and therefore very findable.

But to a measure I think this question is one of opinion more than substance.  I personally grew up on Forth where it was all about words, and lots of them.  One learned to get very creative to save one's fingers.  In the end I had about 640,000 characters, more or less in my source base.  So keeping words short was important to getting work done.


问:
How can I share data across several websites?
I am trying to develop a simple system for sharing data across several websites. Most of them are developed in PHP while some are developed in Wordpress/Drupal. Redundant information is spread across several websites and this has caused a problem where we have to update the information across several websites separately.

I am trying to provide a solution where even static pages can get shared data. Here is my proposed architecture:

I am doing this for an academic institution. The data varies from simple fee structures to academic policies. For example consider academic costs.

Academic costs -> ug, graduate, pharmacy... each of the departments will have a fees structure categorized by off campus, on campus, commuter.

```<code>"Undergraduate": {
    "metaid": "0770",
    "Offcampus": {
      "FeesItems": {
        "comprehensive": {
          "label": "Comprehensive Fees",
          "value": "2,141"
      }
    }
  }
}
</code>```

For front end using mustache, they just have to include the js and use something like below to get values,

```<code><td>{{Undergraduate.Offcampus.FeesItems.comprehensive.label}} </td>
<td>{{Undergraduate.Offcampus.FeesItems.comprehensive.value}}</td>
</code>```

My questions:

Is this design scalable?

How to give the data owners the ability to edit the data?

How to store the data in SQL?

答:
Is this design scalable?

No, unless you host on a cloud MySQL database. JSON builder can be, depends how you code it and the web interface.

How to give the data owners the ability to edit the data?

Just make a PHP CRUD app with some framework, eg CakePHP etc.

How to store the data in sql?

Use the CRUD app to have a JSON to/from SQL converter.  Loads of online PHP examples.
JSON to PHP Array/MySQL and vice versa.


问:
How to get involved in open-source project? (Android/java programmer)
My question might sound stupid and not suitable for this site, but i dont have any better place to ask then here, so please bear with me.

Im a college student that love playing with android. Around last year, i changed my main OS to Ubuntu, and i found its amazing. So, i decided that i want to help developing open-source project.

However, ubuntu uses C++ & QML, not java so i cant code for them. Do you know where i can find a good or widely use android open-source project?

I know i can find some projects in code.google, but theres too many project. I dont know which one is suitable/good for me.

Any help/suggestion is appreciated (im still a college student after all). And if you wondering "why dont i learn c++?", well i think i dont have enough time to learn now because i also have a part-time job as a android developer. Thats why i prever android, or at least java.

Thanks for your time

答: Helping an open source project is a good cause, but motivation is more important. If you're coding for the sake of coding, my motivation wavers without a goal or a deep interest.  First, you must decide what is important to you, or what interests you.  Pick the field.  Then try to find an open source project based on your passion.  Usually contributing is as easy as getting the source, viewing their buglist, and getting familiar with their forums and submission guidelines.  The first accepted fix will most likely not be your first submission, so have patience, persist, and participate.</p>


问:
Do RESTful APIs tend to encourage anemic domain models?
I'm working on a project in which we are trying to apply both domain-driven design and REST to a service-oriented architecture. We aren't worrying about 100% REST compliance; it would probably be better to say we are trying to build resource-oriented HTTP APIs (~Level 2 of Richardson's REST maturity model). Nevertheless, we are trying to stay away from RPC-style use of HTTP requests, i.e. we attempt to implement our HTTP verbs according to RFC2616 rather than using POST to do IsPostalAddressValid(...), for example.

However, an emphasis on this seems to be at the expense of our attempt to apply domain-driven design. With only GET, POST, PUT, DELETE and a few other rarely used methods, we tend to build CRUDdy services, and CRUDdy services tend to have anemic domain models.

POST: Receive the data, validate it, dump it to the database. GET: Retrieve the data, return it. No real business logic there. We also use messages (events) between the services, and it seems to me that most of the business logic ends up being built around that.

Are REST and DDD at tension at some level? (Or am I misunderstanding something here? Are we maybe doing something else wrong?) Is it possible to build a strong domain model in a service-oriented architecture while avoiding RPC-style HTTP calls?

答:
Is your problem that you're trying to cram your model into the basic set of verbs, using POST as much as possible?

Its not necessary - I know that to most people REST means POST, GET, PUT and DELETE, but the http rfc says:

The set of common methods for HTTP/1.1 is defined below. Although this
  set can be expanded, additional methods cannot be assumed to share the
  same semantics for separately extended clients and servers.

And systems such as SMTP use the same style of verb-based methods but with a totally different set.

So, there's no reason why you have to use these, you can use whatever set of verbs you like (though, really you will find that you can do everything you need in the basic 4 with a bit of thought). The thing that makes REST distinctive from the other mechanisms is its stateless and consistent manner of implementing these verbs. You should not try to implement message passing system between the tiers as you're basically not doing REST then, you're doing a message-passing, RPC or message-queue mechanism instead which will undoubtedly lose you the benefits of REST (ie the simplicity of it that makes it work really well over a http connection).

If you want a full-features, complex messaging protocol, then build that (if you can do so over the web, there's a reason why REST is so popular), but otherwise try to stick to the architectural design of REST.


问:
Why can't we use unique identifier as combination of email and password?
For prevent email conflicts for authentication system we can surely choose email and password combination as unique identifier.

What can prevent me to built authentication system by treating unique identifier as  combination of email and password ? What is wrong with this design ?

答:
The immediate issue here is that a user's password can, and should change occasionally. By tying your unique ID to the password, you're effectively creating a new user account whenever a user changes his password.

If possible, the unique identifier should be something that never changes. If you have some sort of set-in-stone ID such as an employee ID or Social Security/ID Number, use that. If you don't, you should create a unique identifier in your database and use that as a reference. Passwords, as well as email addresses and names, might change.

A second problem here, as noted in the comments, is that a user's password should never be stored in plain text. You should be hashing the password and storing only that hash. Better yet, whatever security framework you use should be doing it for you.


问:
How to show an "or includes" relationship - UML Use case diagram
I haven't come across this issue before and can't find it in my Schaum's Outline UML book and was wondering if someone here could help.

I'm making a use case diagram for e-commerce, and in it I want to describe that in order to add a book to your shopping basket, you have to either search products (using the websites search engine) or browse products (using navigation).

But the thing is that it can be either one, and not both.

Is there a way to show that adding a product to the basket needs to include either this or that? Because otherwise it would look like it needs to include both.

Or should I join the two use cases (search products and browse products) into one?

答:
Yes, it is possible in UML.

Let us name alternatives A1 and A2.

They should have some common functionalities, or they wouldn't be interchangeable. Find those.

Make a common interface or abstract class for the alternatives.  Let us name it A.

Use reference to A instead of references to A1 or A2.

```<code> A a;
</code>```

As the common type is abstract, you have a guarantee, that you'll use A1 orA2.

```<code>a=new A1();
</code>```

or

```<code>a=new A2();
</code>```

Look at https://stackoverflow.com/a/21137565/715269 for a diagram

Body:
Yes, it is possible in UML.

Let us name alternatives A1 and A2.

They should have some common functionalities, or they wouldn't be interchangeable. Find those.

Make a common interface or abstract class for the alternatives.  Let us name it A.

Use reference to A instead of references to A1 or A2.

 A a;

As the common type is abstract, you have a guarantee, that you'll use A1 orA2.

a=new A1();

or

a=new A2();

Look at https://stackoverflow.com/a/21137565/715269 for a diagram


问:
Listing dependencies in the package.json for a node.js app on Heroku
I previously had an issue with my node.js app on Heroku. I added the dependency into my package.json and now it is working. But, is this the best way to do it?

```<code>{
  "name": "application-name",
  "version": "0.0.1",
  "private": true,
  "scripts": {
    "start": "node app.js"
  },
  "dependencies": {
    "express": "3.4.4",
    "jade": "*",
    "stylus": "*",
    "ejs": "0.8.5"
  },
  "engines": {
    "node": "0.10.1",
    "npm": "1.3.14"
  }
}
</code>```

I ask because the other dependencies have a "*" which were there by default in my express app. What exactly does that mean and am I fine with leaving this file the way it is?

答:
The * means that any version is fine. When running npm install (what Heroku does when pushing your solution) npm is going to get the latest version of the appropriate module.

This is usually not what you want because a new module version may break your existing code base. It's way better if you put fixed version numbers into your package.json file.

This still does not necessarily solve all potential issues (because you can not control what the module you require require for themselves), but it helps a lot. To really solve this issue you need to think about how to package your application including the modules you depend on. If you Google for this, you should find lots of results on how to do this.

Hope this helps.


问:
Dealing with the node.js callback pyramid
I've just started using node, and one thing I've quickly noticed is how quickly callbacks can build up to a silly level of indentation:

```<code>doStuff(arg1, arg2, function(err, result) {
    doMoreStuff(arg3, arg4, function(err, result) {
        doEvenMoreStuff(arg5, arg6, function(err, result) {
            omgHowDidIGetHere();
        });
    });
});
</code>```

The official style guide says to put each callback in a separate function, but that seems overly restrictive on the use of closures, and making a single object declared in the top level available several layers down, as the object has to be passed through all the intermediate callbacks.

Is it ok to use function scope to help here? Put all the callback functions that need access to a global-ish object inside a function that declares that object, so it goes into a closure?

```<code>function topLevelFunction(globalishObject, callback) {

    function doMoreStuffImpl(err, result) {
        doMoreStuff(arg5, arg6, function(err, result) {
            callback(null, globalishObject);
        });
    }

    doStuff(arg1, arg2, doMoreStuffImpl);
}
</code>```

and so on for several more layers...

Or are there frameworks etc to help reduce the levels of indentation without declaring a named function for every single callback? How do you deal with the callback pyramid?

答:
As an alternative to promises you should have a look at the yield keyword in combination with generator functions which will be introduced in EcmaScript 6. Both are available today in Node.js 0.11.x builds, but require that you additionally specify the --harmony flag when running Node.js:

```<code>$ node --harmony app.js
</code>```

Using those constructs and a library such as TJ Holowaychuk's co allow you to write asynchronous code in a style that looks like synchronous code, although it still runs in an asynchronous way. Basically, these things together implement co-routine support for Node.js.

Basically, what you need to do is to write a generator function for the code that runs asynchronous stuff, call the async stuff in there, but prefix it with the yield keyword. So, in the end your code looks like:

```<code>var run = function * () {
  var data = yield doSomethingAsync();
  console.log(data);
};
</code>```

To run this generator function you need a library such as the before-mentioned co. The call then looks like:

```<code>co(run);
</code>```

Or, to put it inline:

```<code>co(function * () {
  // ...
});
</code>```

Please note that from generator functions you can call other generator functions, all you need to do is prefix them with yield again.

For an introduction to this topic, search Google for terms such as yield generators es6 async nodejs and you should find tons of information. It takes a while to get used to it, but once you get it, you don't want to go back ever.

Please note that this does not only provide you with a nicer syntax to call functions, it also allows you to use the usual (synchronous) control flow logic stuff, such as for loops or try / catch. No more messing around with lots of callbacks and all these things.

Good luck and have fun :-)!

Body:
As an alternative to promises you should have a look at the yield keyword in combination with generator functions which will be introduced in EcmaScript 6. Both are available today in Node.js 0.11.x builds, but require that you additionally specify the --harmony flag when running Node.js:

$ node --harmony app.js

Using those constructs and a library such as TJ Holowaychuk's co allow you to write asynchronous code in a style that looks like synchronous code, although it still runs in an asynchronous way. Basically, these things together implement co-routine support for Node.js.

Basically, what you need to do is to write a generator function for the code that runs asynchronous stuff, call the async stuff in there, but prefix it with the yield keyword. So, in the end your code looks like:

var run = function * () {
  var data = yield doSomethingAsync();
  console.log(data);
};

To run this generator function you need a library such as the before-mentioned co. The call then looks like:

co(run);

Or, to put it inline:

co(function * () {
  // ...
});

Please note that from generator functions you can call other generator functions, all you need to do is prefix them with yield again.

For an introduction to this topic, search Google for terms such as yield generators es6 async nodejs and you should find tons of information. It takes a while to get used to it, but once you get it, you don't want to go back ever.

Please note that this does not only provide you with a nicer syntax to call functions, it also allows you to use the usual (synchronous) control flow logic stuff, such as for loops or try / catch. No more messing around with lots of callbacks and all these things.

Good luck and have fun :-)!


问:
Practical mysql schema advice for eCommerce store - Products & Attributes
I am currently planning my first eCommerce application (mySQL & Laravel Framework).

I have various products, which all have different attributes. Describing products very simply, Some will have a manufacturer, some will not, some will have a diameter, others will have a width, height, depth and others will have a volume.

Option 1: Create a master products table, and separate tables for specific product types (polymorphic relations). That way, I will not have any unnecessary null fields in the products table.

Option 2: Create a products table, with all possible fields despite the fact that there will be a lot of null rows

Option 3: Normalise so that each attribute type has it's own table.

Option 4: Create an attributes table, as well as an attribute_values table with the value being varchar regardless of the actual data-type. The products table would have a many:many relationship with the attributes table.

Option 5: Common attributes to all or most products put in the products table, and specific attributes to a particular category of product attached to the categories table.

My thoughts are that I would like to be able to allow easy product filtering by these attributes and sorting. I would also want the frontend to be fast, less concern over the performance of the inserting and updating of product records.

Im a bit overwhelmed with the vast implementation options, and cannot find a suitable answer in terms of the best method of approach. Could somebody point me in the right direction?

In an ideal world, I would like to offer the following kind of functionality - http://www.glassesdirect.co.uk/products/ to my eCommerce store. As can be seen, in the sidebar, you can select an attribute the glasses to filter them. e.g. male / female or plastic / metal / titanium etc...

Alternatively, should I just dump the mySql relational database idea and learn mongodb?

答:
I think the key thing here is flexibility. Since there are different types of products with each having different set of attributes, it would be fair to assume that product as well as attribute types will change. So it isn't very convenient to include attributes in the product tables.

Here is what you could do:

have a table of product types

have a table of products with a many-to-one relationships to the product types table

have a table of attribute types

have a table of (many-to-many) relationships between product types and attribute types

have a table containing attribute type, attribute value, product primary key

This design allows a huge flexibility. The tables are normalized, there is no redundancy, there is no need to alter any table schemes if the definition of a product changes. If the database is properly indexed and other search optimization techniques are implied as thorsten müller suggested, this solution will work.


问:
Optimizing mindmaps by finding the least amount of redundancy
When using mindmaps, you order them based on how you think it fits best.

So for instance (tab means subtree)

```<code>requirements
  dinner
    food
    forks
    spoons
  breakfast
    food
    forks
</code>```

this could be written using

```<code>food
  at
    dinner
    breakfast
forks
  at
    dinner
    breakfast
spoons
  at
    dinner
</code>```

What would an algorithm look like that finds the best sorting in the manner described. Best means, the least amount of redundancy?

(The 2nd example might not actually reduce redundancy but it shows what is meant by sorting/reordering)

答:
Your algorithm could resemble graph theory.  I understand the hierarchical lists above are shown for simplicity.  Given your requirements, the limits of a hierarchical structure are revealed!

The nodes need to be managed before they can be processed.  My approach to this problem, not having a background in graph structures, would be to review the material on graph structures first, for example this this and this and get my data encoded using them.  Once that's done then process and analyze the structures, for example, create a hash counting the parents, sort the list by the count and generate a new hierarchical representation without changing the underlying graph.

for example, borrowing from the code in the first link, in python3

```<code>class Vertex:
    def __init__(self, key):
        self.id = key
        self.connected_to = {}

    def add_neighbor(self, nbr, weight=0):
        self.connected_to[nbr] = weight

    def __str__(self):
        return str(self.id) + ' connected_to: ' + str([x.id for x in self.connected_to])

    def get_connections(self):
        return self.connected_to.keys()

    def get_id(self): return self.id

    def get_weight(self, nbr): return self.connected_to[nbr]

class Graph:
    def __init__(self):
        self.vert_list = {}
        self.num_vertices = 0

    def add_vertex(self, key):
        self.num_vertices += 1
        new_vertex = Vertex(key)
        self.vert_list[key] = new_vertex
        return new_vertex

    def get_vertex(self, n):
        if n in self.vert_list:
            return self.vert_list[n]
        else:
            return None

    def __contains__(self, n): return n in self.vert_list

    def add_edge(self, f, t, cost=0):
        if f not in self.vert_list:
            self.add_vertex(f)
        if t not in self.vert_list:
            self.add_vertex(t)
        self.vert_list[f].add_neighbor(self.vert_list[t], cost)

    def get_vertices(self): return self.vert_list.keys()

    def __iter__(self): return iter(self.vert_list.values())

# the main graph
g = Graph()

# populate the main graph
g.add_vertex('dinner')
g.add_edge('dinner', 'food')
g.add_edge('dinner', 'fork')
g.add_edge('dinner', 'spoon')
g.add_vertex('breakfast')
g.add_edge('breakfast', 'food')
g.add_edge('breakfast', 'fork')

print("\nThe main graph is:")
for v in g:
    for c in v.get_connections():
        print("( %s , %s )" % (v.get_id(), c.get_id()))

# flip the graph by populating a new one with the main's children
flipped_g = Graph()
for v in g:
    for c in v.get_connections():
        flipped_g.add_edge(c.get_id(), v.get_id())

print("\nThe main graph inverted is:")
for v in flipped_g:
    for c in v.get_connections():
        print("( %s , %s )" % (v.get_id(), c.get_id()))
</code>```

produces the following output:

```<code>The main graph is:
( breakfast , food )
( breakfast , fork )
( dinner , food )
( dinner , fork )
( dinner , spoon )

The main graph inverted is:
( food , breakfast )
( food , dinner )
( spoon , dinner )
( fork , breakfast )
( fork , dinner )
</code>```

This is certainly not a complete solution but it is a framework you can use to get the information you need.

Bear in mind that the add_vertex() method checks the list of connections and only adds a node if it isn't already there.  For example, there is only one dinner node and only one fork node.

Here are all the vertices as retrieved with: flipped_g.get_vertices()

```<code>dict_keys(['food', 'spoon', 'fork', 'dinner', 'breakfast'])
</code>```

Body:
Your algorithm could resemble graph theory.  I understand the hierarchical lists above are shown for simplicity.  Given your requirements, the limits of a hierarchical structure are revealed!

The nodes need to be managed before they can be processed.  My approach to this problem, not having a background in graph structures, would be to review the material on graph structures first, for example this this and this and get my data encoded using them.  Once that's done then process and analyze the structures, for example, create a hash counting the parents, sort the list by the count and generate a new hierarchical representation without changing the underlying graph.

for example, borrowing from the code in the first link, in python3

class Vertex:
    def __init__(self, key):
        self.id = key
        self.connected_to = {}

    def add_neighbor(self, nbr, weight=0):
        self.connected_to[nbr] = weight

    def __str__(self):
        return str(self.id) + ' connected_to: ' + str([x.id for x in self.connected_to])

    def get_connections(self):
        return self.connected_to.keys()

    def get_id(self): return self.id

    def get_weight(self, nbr): return self.connected_to[nbr]

class Graph:
    def __init__(self):
        self.vert_list = {}
        self.num_vertices = 0

    def add_vertex(self, key):
        self.num_vertices += 1
        new_vertex = Vertex(key)
        self.vert_list[key] = new_vertex
        return new_vertex

    def get_vertex(self, n):
        if n in self.vert_list:
            return self.vert_list[n]
        else:
            return None

    def __contains__(self, n): return n in self.vert_list

    def add_edge(self, f, t, cost=0):
        if f not in self.vert_list:
            self.add_vertex(f)
        if t not in self.vert_list:
            self.add_vertex(t)
        self.vert_list[f].add_neighbor(self.vert_list[t], cost)

    def get_vertices(self): return self.vert_list.keys()

    def __iter__(self): return iter(self.vert_list.values())

# the main graph
g = Graph()

# populate the main graph
g.add_vertex('dinner')
g.add_edge('dinner', 'food')
g.add_edge('dinner', 'fork')
g.add_edge('dinner', 'spoon')
g.add_vertex('breakfast')
g.add_edge('breakfast', 'food')
g.add_edge('breakfast', 'fork')

print("\nThe main graph is:")
for v in g:
    for c in v.get_connections():
        print("( %s , %s )" % (v.get_id(), c.get_id()))

# flip the graph by populating a new one with the main's children
flipped_g = Graph()
for v in g:
    for c in v.get_connections():
        flipped_g.add_edge(c.get_id(), v.get_id())

print("\nThe main graph inverted is:")
for v in flipped_g:
    for c in v.get_connections():
        print("( %s , %s )" % (v.get_id(), c.get_id()))

produces the following output:

The main graph is:
( breakfast , food )
( breakfast , fork )
( dinner , food )
( dinner , fork )
( dinner , spoon )

The main graph inverted is:
( food , breakfast )
( food , dinner )
( spoon , dinner )
( fork , breakfast )
( fork , dinner )

This is certainly not a complete solution but it is a framework you can use to get the information you need.

Bear in mind that the add_vertex() method checks the list of connections and only adds a node if it isn't already there.  For example, there is only one dinner node and only one fork node.

Here are all the vertices as retrieved with: flipped_g.get_vertices()

dict_keys(['food', 'spoon', 'fork', 'dinner', 'breakfast'])


问:
How to test the data access layer?
I have a DAO method that utilizes Spring for JDBC access. It calculates a seller's success rate of selling an item.

Here is the code:

```<code>public BigDecimal getSellingSuccessRate(long seller_id) {
    String sql = "SELECT SUM(IF(sold_price IS NOT NULL, 1, 0))/SUM(1)
                  FROM transaction WHERE seller_id = ?";
    Object[] args = {seller_id};
    return getJdbcTemplate().queryForObject(sql, args, BigDecimal.class);
}
</code>```

How should I go about testing this method or any DAO method with JUnit? What are some best practices to test the data access logic? I am thinking of testing it against an embeddable database loaded with some data, but shouldn't we do integration tests similar to a production environment in terms of RDBMS and the schema?

答:
On our project, each developer is running an empty database, its structure is the same as the production database.

In each unit tests TestInitialize, we create a connection & transaction to the database plus some default objects we need for each test. And everything gets rolled back after the end of each method or class.

In this way, it's possible to test the sql layer. In fact, every query or database call has to be tested in this way.

The downside is that it's slow, so we put it in a separate project from our regular unit tests. It's possible to speed this up by using an in memory database but the idea remains the same.

Title: How to test the data access layer?


问:
How has an increase in the complexity of systems affected successive generations of programmers?
As a "new" programmer (I first wrote a line of code in 2009), I've noticed it's relatively easy to create a program that exhibits quite complex elements today with things like .NET framework for example. Creating a visual interface, or sorting a list can be done with very few commands now.

When I was learning to program, I was also learning computing theory in parallel. Things like sorting algorithms, principles of how hardware operates together, boolean algebra, and finite-state machines. But I noticed if I ever wanted to test out some very basic principle I'd learned in theory, it was always a lot more difficult to get started because so much technology is obscured by things like libraries, frameworks, and the OS.

Making a memory-efficient program was required 40/50 years ago because there wasn't enough memory and it was expensive, so most programmers paid close attention to data types and how the instructions would be handled by the processor. Nowadays, some might argue that due to increased processing power and available memory, those concerns aren't a priority.

My question is if older programmers see innovations like these as a godsend or an additional layer to abstract through, and why might they think so? And do younger programmers benefit more learning low-level programming BEFORE exploring the realms of expansive libraries? If so then why?

答:
Really good training involves both extremes, as well as a bridge between.

On the low-level side: how a computer executes code from the ground up*, including knowledge of assembly language and what a compiler is doing.

On the high-level side: general concepts, e.g. using associative arrays, closures, etc. without having to waste time worrying about how it works under the hood.

IMHO everyone should have experience with both, including their drawbacks, and a taste of how to get from low-level concepts to high-level concepts. Love associative arrays? Great, now try using them on an 50-cent embedded processor with 1kB of RAM. Like writing fast code using C? Great, now you have three weeks to write a web app; you can spend your time dealing with data structures and memory management using C, or you can spend your time learning a new web framework and then implement the web app in a few days.

As far as the complexity aspect of it goes: I do think it is too easy these days to make complex systems  without a clear understanding of the cost of doing so. As a result, we have, as a society, built up a huge amount of technical debt that bites us from time to time. It's like earthquakes (just the cost of living near a geological fault, right?), only it's gradually getting worse. And I don't know what to do about it. Ideally we'd learn and get better at managing complexity, but I don't think that's going to happen. A responsible engineering education needs to include a lot more discussion of the consequences of complexity than most of our universities are currently providing.

* and, anyway, where is the "ground" in how a computer executes code? Is it assembly language? Or computer architecture? Or digital logic? Or transistors? Or device physics?