答:
The need of Scrum isn't to complete every story at the end of every sprint. In fact, that might not happen, especially early in a project when you are still settling on a velocity. The idea is to have a potentially shippable (working, tested, and documented) product that adds business value to the customer at the end of every iteration.

The first thing to do is to improve your definition of done. Done should mean that the story is complete. That means it has been designed, implemented, unit tested, integrated and passed system and acceptance tests. When a story is done, that means the feature or capability that the store represents is ready for delivery to the customer. The Scrum Alliance has some articles on what a good definition of done looks like, how to know when you are done with a story, and a methodology for creating a good definition of done.

Next, you should probably begin to work on your estimation and planning. It shouldn't be a continual struggle to incorporate the stories into each release. It begins with having appropriate and accurate estimates as to the size of the story, which often uses story points to provide an estimation of the relative effort required to complete the story. Once you have estimates, you need to use these estimates to plan. If you find yourself finishing 10 story points every sprint, don't pull more than 10 story points into the next sprint. If you pulled 10 story points into one sprint, but only finished 8 of them, only include 8 in the next sprint. If you finish early, you can either pull in more story points or use the additional time to reduce technical debt by refactoring, writing new automated tests, or improving existing tests (as a few examples).

Rather than starting the next sprint immediately, make sure you have time for your retrospective and planning meetings. Use this as an opportunity to determine what was problematic or needs improvement, and then implement corrections for the process in future sprints.

I think that doing this will resolve some of your problems, and make others easier to fix, or at least bring out more information. Some of the problems are also related to organizational culture, such as the entire team participating in testing or not using pair programming. Eventually, you are going to want to get the entire team into testing (and other activities), since Scrum is centered around a team that has cross-functional skills. Improved estimation will also help you identify if your stories are too large. As far as pair programming - it's a non-issue, since it's not required for Scrum and might not be of use to your team.

Title: How do we finish all our stories by the end of the sprint and not after and why is this important?

Body:
We are running 2 weeks sprints where the team will just barely finish development by the last day of the sprint but cards are not complete because testing is not finished.  The definition of done is really "when development is complete" rather than "when the stories are complete."  We have a 1 week delay between the last day of the sprint and the release date.  The team does finish the sprint by the release date but that seems like that isn't quite meeting the objective of scrum.  The team starts the next sprint the day after the previous sprint ends.

I see the following problems:

team is not using whole team testing

team is not too interested in pair programming or piling on one card at a time.

Maybe the stories are too large and we should break them down more so that we finish at a more steady pace throughout the sprint?

Any suggestions on how we get the team bought in to finishing the sprint by the end date? Or other ideas?

Why do we think it is important to finish by the last day? Why does it matter if the team is still finishing by the release date? (I have my own answers but am curious what others think here.)


问:
Webkit as GUI in .Net/Mono
I want to make a cross platform application, which will also have a website where the desktop applications (Windows, iOS, Linux) will talk to the server and keep the users data in sync.

So far the options I see are:

Write a native GUI for each of the 3 OS, so I would have 3 GUI codebases (and a single backend system)

Use something like GTK so I can use one system with support in all the mention platforms.

But the third which I have not been able to find much info on (maybe I'm not searching for the right terms as I'm still new to C# and .Net), is to have a window with an embedded WebKit instance built in, which would allow me to use the same GUI system that I would use for the website. Which would make the client app and the website look as close as possible to each other so the users are familiar with the interface.

Is this last option with WebKit plausible? I already know JavaScript/HTML well and if I can use that knowledge to make the interface, that would be great. Also would be a great way to allow users to customize the interface with plugins and they could keep in sync any UI preferences from local to web.

答:
Can't see why not, but you could just run Chrome in "windowless" mode instead, or IE in "hta" mode (we wrote a desktop app using web tech, deploying it as a hta on Windows a decade ago).

Today I'd do something without IE/IIS and use websockets for a more interactive experience.

There are components that allow webkit embedded in C# apps: see this post from SO (consensus is to use Webkit.NET)

I'd also use QtWebkit component instead, then you will write a single, lightweight, Qt-based, cross-platform 'desktop' app that embeds your web GUI.

ContentLicense: CC BY-SA 3.0

Title: Webkit as GUI in .Net/Mono


问:
Any tips to learn how to program with severe ADHD?
I have a difficult time trying to learn how to program from straight text-books. Video training seems to work well for me in my past experiences with PHP. I am trying my hardest to stay focussed and push through. Specifically I am looking to start indie game development.

Over the last two weeks I have been trying to pick the "right" language and framework to develop with. I started going through Python, but I am not really enjoying the language so far. I am constantly looking through this website to compare this language to that, and keep getting distracted.

Aside from all of this, is it possible to become a programmer when you have trouble focussing? Has anyone been through this that can recommend some advice?

答:
TLDR; Leverage the strengths of ADHD to learn how to code. Dive very deep on a specific language and framework and become an expert...repeat a few times and get away from coding. Day to day development isn't a strong area for those with ADHD.

One advantage that ADHD brings is a concept called Hyper Focus. See the misunderstanding of ADHD is that those diagnosed with it can't pay attention. That is false. It's just that we can't pay attention to things that don't interest us. If we find something that interests us, we zero in on it like a laser.

For me I discovered computers and Classical Culture (Greek/Roman history, mythology, languages) when I was young and fell in love with both. If you could imagine seeing me typing hundreds of lines of code from the back of Compute! magazine and being told as you watch me focused on this task for hours on end that I have ADD, you would think someone misdiagnosed me. Or watch me tear through the first 10 chapters of Wheelock's Latin before the first day of school. That is both the gift and the curse of our condition. If we genuinely love something, it's hard to pull us away from it. If something doesn't interest us, it's like pulling a stubborn mule up a mountain to get us to do it.

I found a few books that helped me take control of my condition. They may be able to help you as well. The first is Delivered from Distraction It provides some tips on how to capitalize on the strengths of ADD and mitigate the weaknesses. The Gift of Adult ADD provides some of the same guidelines but also casts ADD in a different light. What some people call inattentiveness is really us processing concepts in a conversation and integrating them very rapidly, resulting in "quantum leaps" that a lot of people find difficult to make. I've been frequently called "non-sequitur man" because I'll disengage from a conversation at times following my own train of thought and jump back in when I hit a "eureka" as if everyone else has been privy to my stream of consciousness.

One thing I've found working in the industry with my condition is that I'm great at higher level concepts and training others on what I've learned, not so great at the minutiae of development. In a pair programming setting though, I've found that the productivity multiplies above and beyond what either me or the other person could have produced in the same amount of time. So I've positioned myself as a strategist or team lead rather than a day to day coder.

Of course that was after 10 years of biting the bullet and getting good enough to be very knowledgeable at what I do. The downside to this is that employers/clients see my knowledge and figure, oh he's gotta be a great coder with what he knows. I explain very clearly that they don't want me as a pure coder because I'd be very ineffective at it. No matter how hard I try, I've found that once I've figured out HOW to do something actually doing it isn't as interesting to me.

On the other hand, explaining to others how to do it and letting them run with it has been one of my strongest abilities. For instance just this past week, I worked with a colleague who was new to WPF and showed him the ins and outs of the platform, how to use custom Panels and Data Templates and binding to do the heavy lifting for him. The result, he was able to complete his task in half the time scheduled for him and the client loves the results.

I think the results may differ for each individual, but I've found that most with ADHD prefer the abstract to the concrete.


问:
What is required for a scope in an injection framework?
Working with libraries like Seam, Guice and Spring I have become accustomed to dealing with variables within a scope.  These libraries give you a handful of scopes and allow you to define your own.  This is a very handy pattern for dealing with variable lifecycles and dependency injection.

I have been trying to identify where scoping is the proper solution, or where another solution is more appropriate (context variable, singleton, etc).  I have found that if the scope lifecycle is not well defined it is very difficult and often failure prone to manage injections in this way.

I have searched on this topic but have found little discussion on the pattern.  Is there some good articles discussing where to use scoping and what are required/suggested prerequisites for scoping?

I interested in both reference discussion or your view on what is required or suggested for a proper scope implementation.  Keep in mind that I am referring to scoping as a general idea, this includes things like globally scoped singletons, request or session scoped web variable, conversation scopes, and others.

Edit:

Some simple background on custom scopes: https://stackoverflow.com/questions/9429221/google-guice-custom-scope/9435182#9435182

Some definitions relevant to above:

“scoping” - A set of requirements that define what objects get injected at what time.  A simple example of this is Thread scope, based on a ThreadLocal.  This scope would inject a variable based on what thread instantiated the class.  Here's an example of this:

“context variable” - A repository passed from one object to another holding relevant variables.  Much like scoping this is a more brute force way of accessing variables based on the calling code.

Example:

```<code>methodOne(Context context){
    methodTwo(context);
}

methodTwo(Context context){
    ...
    //same context as method one, if called from method one
}
</code>```

“globally scoped singleton” - Following the singleton pattern, there is one object per application instance.  This applies to scopes because there is a basic lifecycle to this object: there is only one of these objects instantiated.

Here's an example of a JSR330 Singleton scoped object:

```<code>@Singleton
public void SingletonExample{
...
}
</code>```

usage:

```<code>public class One {
     @Inject
     SingeltonExample example1;
}

public class Two {
     @Inject
     SingeltonExample example2;
}
</code>```

After instantiation:

```<code>one.example1 == two.example2 //true;
</code>```

答:
Limit the use of scopes or more concretely Use scopes for wiring only.

Used properly, scopes can reduce a lot of factory boiler plate. I use scopes to wire together sub-processes that may need access to its name and arguments. This is similar to the RequestScopes provided by Guice and Spring.

But scopes are effectively a thread-local map of string to object. This is practically a Global Variable Depot. This is why I limit my scope usage.

This leads to the corollary:

Hide the scopes or more generally Hide your DI Framework

Because scopes (and DI frameworks) are essentially Global Variable Depots, I prefer to encapsulate the DIF such that the only thing that knows there is a DIF is the main method.

To do this, I define my own scope interface and my own ProcessFactory that I define within a Guice module.

Because of this, my process manager is free of references to Guice. In fact, it is little more than this method:

```<code>void run(final ProcessContext context) {
    try {
        this.scope.enter(context.processArgs());
        this.factory.create(args.processName());
    } finally {
        this.scope.exit();
    }
}
</code>```

Here's the complete Guice module that binds and hides my use of a Guice. It implements my own ProcessScope and ProcessFactory interfaces. It binds @ProcessParameters so they can be injected and a few convienience objects as well (@ProcessName String and ProcessConfig).

```<code>public class ProcessRunnerModule extends AbstractModule {
    private static final String PROCESS_RUN_SCOPE = "ProcessRunScope";

    /**
     * Objects of type Map<String, Object> parameterized by @ProcessParameters
     * are injected in the ProcessRunScope
     */
    static final Key<Map<String, Object>> PROCESS_PARAMETERS_KEY;
    static {
        final TypeLiteral<Map<String, Object>> MAP_TYPE = new TypeLiteral<Map<String, Object>>() {
        };
        PROCESS_PARAMETERS_KEY = Key.get(MAP_TYPE, ProcessParameters.class);
    }

    /**
     * Wraps Guice scope to ProcessScope. Injects the @ProcessParameters into guice
     */
    private static class GuiceScopeAdapter implements ProcessScope {

        private final SimpleScope scope;

        @Inject @SuppressWarnings("unused")
        public GuiceScopeAdapter(@Named(PROCESS_RUN_SCOPE) SimpleScope scope) {
            this.scope = scope;
        }

        @Override
        public void enterScope(Map<String, Object> parameters) {
            scope.enter();
            scope.seed(PROCESS_PARAMETERS_KEY, parameters);
        }

        @Override
        public void exitScope() {
            scope.exit();
        }
    }

    /**
     * Processes are run and bound in @ProcessRunScope.
     */
    protected void configure() {
        final SimpleScope processRunScope = new SimpleScope();
        bindScope(ProcessRunScope.class, processRunScope);
        bind(SimpleScope.class)
            .annotatedWith(Names.named(PROCESS_RUN_SCOPE))
            .to(processRunScope);
    }

    /**
     * This wraps Processes bound via MapBinder to a ProcessFactory
     */
    @Provides @Singleton
    ProcessFactory createProcessFactory(final Map<String, Provider<Process>> processFactories) {
        log.info("Instantiating process factory", "known-processes", processFactories.keySet());
        return new ProcessFactory() {
            @Override
            public Process create(final String name) {
                return processFactories.get(name).get();
            }
        };
    }

    /**
     * ProcessRunner does not know about Guice
     */
    @Provides @Singleton
    ProcessRunner createProcessRunner(
            final ProcessScope processScope,
            final ProcessFactory processFactory) {

        return new ProcessRunner(processScope, processFactory);
    }

    /**
     * Convienience: bind a @ProcessName extracted from the @ProcessParameters
     */
    @Provides @ProcessName @ProcessRunScope
    String bindProcessName(final @ProcessParameters Map<String, Object> params) {
        return params.get(ProcessRunner.PROCESS_NAME_KEY).toString();
    }

    /**
     * Convienience: bind a ProcessConfig wrapping the @ProcessParameters
     */
    @Provides @ProcessRunScope
    ProcessConfig createParamHelper(final @ProcessParameters Map<String, Object> params) {
        return new ProcessConfig(params);
    }
}
</code>```

Body:
Limit the use of scopes or more concretely Use scopes for wiring only.

Used properly, scopes can reduce a lot of factory boiler plate. I use scopes to wire together sub-processes that may need access to its name and arguments. This is similar to the RequestScopes provided by Guice and Spring.

But scopes are effectively a thread-local map of string to object. This is practically a Global Variable Depot. This is why I limit my scope usage.

This leads to the corollary:

Hide the scopes or more generally Hide your DI Framework

Because scopes (and DI frameworks) are essentially Global Variable Depots, I prefer to encapsulate the DIF such that the only thing that knows there is a DIF is the main method.

To do this, I define my own scope interface and my own ProcessFactory that I define within a Guice module.

Because of this, my process manager is free of references to Guice. In fact, it is little more than this method:

void run(final ProcessContext context) {
    try {
        this.scope.enter(context.processArgs());
        this.factory.create(args.processName());
    } finally {
        this.scope.exit();
    }
}

Here's the complete Guice module that binds and hides my use of a Guice. It implements my own ProcessScope and ProcessFactory interfaces. It binds @ProcessParameters so they can be injected and a few convienience objects as well (@ProcessName String and ProcessConfig).

public class ProcessRunnerModule extends AbstractModule {
    private static final String PROCESS_RUN_SCOPE = "ProcessRunScope";

    /**
     * Objects of type Map<String, Object> parameterized by @ProcessParameters
     * are injected in the ProcessRunScope
     */
    static final Key<Map<String, Object>> PROCESS_PARAMETERS_KEY;
    static {
        final TypeLiteral<Map<String, Object>> MAP_TYPE = new TypeLiteral<Map<String, Object>>() {
        };
        PROCESS_PARAMETERS_KEY = Key.get(MAP_TYPE, ProcessParameters.class);
    }

    /**
     * Wraps Guice scope to ProcessScope. Injects the @ProcessParameters into guice
     */
    private static class GuiceScopeAdapter implements ProcessScope {

        private final SimpleScope scope;

        @Inject @SuppressWarnings("unused")
        public GuiceScopeAdapter(@Named(PROCESS_RUN_SCOPE) SimpleScope scope) {
            this.scope = scope;
        }

        @Override
        public void enterScope(Map<String, Object> parameters) {
            scope.enter();
            scope.seed(PROCESS_PARAMETERS_KEY, parameters);
        }

        @Override
        public void exitScope() {
            scope.exit();
        }
    }

    /**
     * Processes are run and bound in @ProcessRunScope.
     */
    protected void configure() {
        final SimpleScope processRunScope = new SimpleScope();
        bindScope(ProcessRunScope.class, processRunScope);
        bind(SimpleScope.class)
            .annotatedWith(Names.named(PROCESS_RUN_SCOPE))
            .to(processRunScope);
    }

    /**
     * This wraps Processes bound via MapBinder to a ProcessFactory
     */
    @Provides @Singleton
    ProcessFactory createProcessFactory(final Map<String, Provider<Process>> processFactories) {
        log.info("Instantiating process factory", "known-processes", processFactories.keySet());
        return new ProcessFactory() {
            @Override
            public Process create(final String name) {
                return processFactories.get(name).get();
            }
        };
    }

    /**
     * ProcessRunner does not know about Guice
     */
    @Provides @Singleton
    ProcessRunner createProcessRunner(
            final ProcessScope processScope,
            final ProcessFactory processFactory) {

        return new ProcessRunner(processScope, processFactory);
    }

    /**
     * Convienience: bind a @ProcessName extracted from the @ProcessParameters
     */
    @Provides @ProcessName @ProcessRunScope
    String bindProcessName(final @ProcessParameters Map<String, Object> params) {
        return params.get(ProcessRunner.PROCESS_NAME_KEY).toString();
    }

    /**
     * Convienience: bind a ProcessConfig wrapping the @ProcessParameters
     */
    @Provides @ProcessRunScope
    ProcessConfig createParamHelper(final @ProcessParameters Map<String, Object> params) {
        return new ProcessConfig(params);
    }
}


问:
Scrum for team split between two spoken languages
I have a team that without a single common language among all of the team members. The team is split across two locations (though the geography isn't the main issue). All team members in each location speak the same language and there are members in both locations that can speak both. I'd like to introduce scrum, but am struggling with the logistics of dealing with the language issue.

This isn't an offshore team. All team members are employees of the company, but located in two different offices in different countries. Fortunately, we don't have any issues with timezones; language is the primary barrier. While the team could be split into two teams, given the size and skillset of the people in each location as well as other external factors, it is more desirable to integrate as a single team.

I think it would be preferable to use video conferencing in order to have richer communication and help unite the team in being able to see each other and do the true stand-up approach. However, I am afraid this will be difficult to communicate between languages. Should bilingual members of the team translate verbally? Alternately, we could use instant message as recommended by the only reference I could find to language issues in distributed scrum. I'm concerned about the "poorer" communication and perhaps it is a poor introduction to the scrum concept.

From people that have experience in dealing with language differences in a team, how did you address the problem and how well did it work for you?

答:
Most effective way is to split into two different teams with logical isolated deliverable(s) for each team - they will have their own scrum masters.

Please read the link below, This has many good points that you can follow. ( though think does not address the concern of two different languages, this has many points related to two geographical locations). Martin Fowler has written this article after many years of working with offshore teams.

http://martinfowler.com/articles/agileOffshore.html

Some of the bullet excerpts from the article below.

1. Use Continuous Integration to Avoid Integration Headaches

2. Have Each Site Send Ambassadors to the Other Sites

3. Use Contact Visits to build trust

4. Don't Underestimate the Culture Change

5. Use wikis to contain common information

6. Use Test Scripts to Help Understand the Requirements

7. Use Regular Builds to Get Feedback on Functionality

8. *Use Regular Short Status Meetings*

etc


问:
Do / how do the various flex frameworks work with Flash Builder
I have been reading about various Flex frame works, Robot Legs, Swiz, Cairgnom (spelling error) and a few others. What I am missing is how they actually work with Flex / Flash Builder. Are they simply libraries that you can use with the Flash Builder IDE? Why should I learn to use one of them instead of just using the IDE as it is?</p>

答:
They essentially try to provide basic functionality that is (hopefully) useful across many projects.  Most of them provide an implementation of MVC patterns.  The idea is that you don't need to spend your valuable time writing "plumbing" code, as the framework has done that work for you.

These frameworks often demand a large up-front learning cost to figure out "their way of doing things", but have the potential to save you time over the long run as you re-use the framework & knowledge over multiple projects.

Destroyica's answer details how exactly to wire these frameworks up.  Most provide a single .swc file that you link into your projects' libs\ folder, though some will offer you the source code to the project that you could add to your projects' src\ folder.


问:
My coworker created a 96 columns SQL table
Here we are in 2010, software engineers with 4 or 5 years or experience, still designing tables with 96 fracking columns.

I told him it's gonna be a nightmare.

I showed him that we have to use ordinals to interface MySQL with C#.

I explained that tables with more columns than rows are a huge smell.

Still, I get the "It's going to be simpler this way".

What should I do?

EDIT *

This table contains data from sensors.

We have sensor 1 with

Dynamic_D1X

Dynamic_D1Y

[...]

Dynamic_D6X

Dynamic_D6Y

[...]

EDIT2 *

Well, I finally left that job. It is a sign when the other programmer goes dark for months at the time, it is another sign when management does not realise this is a problem

答: Get him to read this article about technical debt. If he still decides to keep it this way, then at least you have offered a constructive opinion.</p>

ContentLicense: CC BY-SA 2.5


问:
How to get new team members up to date with the project?
We are about to hire 1-2 new engineers for the software team (consisting of 3 developers, 1 tester).

What are the steps to integrate them into the team?

My ideas are :

read documentation (coding standards, documents in development methodologies we use)

get them to read the existing code

assign them some simple tasks

at the end, make them responsible for the code part

What else could we do?

The project is in a medical sector (ultrasound system), and is already 5 years going. We have yearly releases, and we are about to finish one release, when we want to add 1-2 engineers.

The project is in the maintenance phase (refactoring legacy code, plus adding new features). Things are pretty much on schedule (more or less).

答:
I've only been working in industry for 10 months (On placement) but I found the following helped me:

Teaming up with other developers and observing how they tackle issues.

Testing the software helped, I would need to test feature x which means I read the documentation on feature x. I did this a lot, it helped.

Both of those helped me a fair bit. Good luck.


问:
Which architecture should I choose for this project?
I have a project. The server which based on a phone PCI-board is responsible for received phone calls from the customer and then redirect the phone calls to the operators.

I have decided to code the server using c++ programming language and qt framework because the PCI-board SDK's interface is c/c++ originated and for the sake of portability.

The server need to send the information of the the customer to the operator while ringing the operator and the ui interface of the operator client should be browser-based.

Now the key problem is how could the server notify the operator that there is a phone call for he/she.

One architecture I have considered is like this,

The operator browser client use ajax pooling the web server to check whether there is call to the client; the web server pooling the database server to check whether there is call;
the desktop server(c++) wait for the phone calls and set the information in the database.

The other operations such as hang up the phone call from the client, retransfer the phone call to the other operator also use this architecture.

Then, is there any way other than pooling the server(js code setInterval('getDail', 1000)) to decide whether there is a call to the operator?

Is this architecture feasible or should I use some terrific techniques that I do know such as web services,xml-rpc, soap???

The Caller center is for 8~300 operators and the operators do not seperate geographically.
Moreover, I have figured out that we need provide interface for customer programmer, so this thing is so called middleware? Then some new questions, how could we expose interface to customer, COM?

Thanks in advance.

答:
To send info to the web server from the phone box, I would recommend a RESTful web service. This will keep both of the servers free most of the time. (This is what the company twilio does)
REST API

Perhaps you could use websockets to "push" new calls to the operator's browsers. If you are using an older browser (like IE 8), this might not be the best choice. Otherwise, you'll have to do periodic refreshes with ajax. This will reduce the chatter of checking for changes all the time, but it will also keep a lot of connections open.
HTML5 WebSockets


问:
How can I monitor the JVM memory in a proper way?
I'm thinking of how we do JVM memory monitor in a low overhead way in production environment even under busy hour.

Suppose I have two tomcat app server in production, load balance set up behind them. If I can see the jvm memory statistics I can tell load balance to stop sending the request to the server which will encounter OOM issue.  Do this make sense? Jconsole or VisualVM eats more performance resourse is not my choice.

答:
JMX would be the answer (Jolokia being a JMX interface).

You might want to also look at -
https://stackoverflow.com/questions/242958/best-tools-to-monitor-tomcat


问:
Data migration to a single shared SQL table
We have three internal web applications we use at my company. Unfortunately none of my predecessors had the foresight of sharing tables amongst those apps.

It has become necessary to share some company data among the three internal web apps. As an example, each of the three websites have a companies table in their respective databases.

Website A Companies Table

```<code>id | name
---------
1  | Sprockleys Sprockets
2  | Goobers Gadgets
3  | Nancys Necklaces
</code>```

Website B Companies Table

```<code>id | name
---------
3  | Sprockleys Sprockets DENVER
22 | Gooburrs Gadgets
30 | Nancyies Necklaces
</code>```

I want to somehow merge all of this data together into a single shared database table. Unfortunately the ID's of the companies do not match up at all and other tables have foreign keys that map products and users to those companies.

What are some ideas for merging data like this?

答:
Make sure everyone understands how difficult this will be for everyone. Identify the benefits to the business. What sounds good in theory doesn't always work in practice.

Everyone involved except the developers are going to want some perfect solution that will automatically merge all of these different company ID's (get rid of the duplicates) without any manual data entry on their part. Because they are so certain things like names, addresses and phone numbers will be a perfect match. Don't believe it until you can prove it.

Another is when you're working on cleaning up this list, new duplicates are going to get entered.

Records from all 3 tables get copied to the new table so: A) They get a new primary key B)Keep track of the old ID with duplicates in a column C) have a column to identify which database they originated in.

Propogate the new key to all three databases and update foreign key records (The Old ID and database identifiers make this possible.

Insert code to use new single table.

Update constraints to use new table.

You could do this in stages where you have all the customer CRUD use the new table and a trigger of some sort to keep the 3 existing tables in sync. This depends on how long it takes you have to change the code to use the new table for all the other functionality. There may be reporting tools with hardcoded connections. Basically your running the single-table system in parallel with the triple-table system.

You'll also need a feature in your application to merge duplicate company entries. Automate this as much as you feel comfortable, but eventually there needs to be a manual process. There is nothing to prevent a user from entering the same company twice. You can restrict and constrain and check for duplicates and give all the error messages you can think of and someone is going to do whatever it takes to jam that company in there. Someone will spot it and ask you how are we going to fix this.


问:
What exactly are SDLC and OOP?
I have been asked "What are SDLC and OOP?" many times in job interviews but I am still not sure how to answer this question. I am a web developer for quite some time but I still have problem with explaining OOP and SDLC (System Development Life Cycle) .

Can someone help me to explain what these are to another person?

答:
When answering a question in an interview, you want your answers to be detailed enough to satisfy the interviewer, yet concise in order to give you more time to move on to other questions, including your own.

For OOP, a simple statement such as:

Object-Oriented Programming is a technique where you define structures - the objects - which combine data and system behaviours in code, solving problems by creating a model of real-world concepts.

For SDLC, you might say something like:

The Software Development Life Cycle is the method by which a software development project is managed, starting with the initial idea and gathering of requirements, through to implementation and testing, and culminating in a period of maintenance before eventually being retired. It is a structured process which can be entirely linear, iterative, or both, with the ultimate goal of developing high-quality software product.

However you answer the question, avoid trying to explain the concept in too detailed a way.  If your answer is concise, you are inviting the interviewer to ask additional questions, while providing too much detail can risk trapping you in a situation where you expose a weakness in your knowledge. Concise answers also show that you know what you are talking about enough to be comfortable with giving a short yet descriptive answer.

OwnerDisplayName: pirzada

Title: What exactly are SDLC and OOP?


问:
Overloaded high transaction SQL Server database Solutions
The current sql server database is overloaded and many transactions are failing.  The powers that be have a proposed solution to build a separate database to handle/store transactions and then asynchronously insert them into the current system. Specifically persist new transactions to a new database then build routines to insert the data from the new database into the current/old database.

I'm looking for best method to implement this solution... should I use a non-indexed table in the proposed new db for fast inserting, then use bulk inserting from newdb -> olddb to move the data back into the main database? Is this best done @ scheduled intervals or real time?

I was also wondering if scaling up/out would help here (budget permitting)? My initial thought was to recommend purchasing a second server and configuring a cluster to reduce the load.

To be honest I thought the web transactions would just timeout and not fail (but I guess that's ultimately the same)?

答:
Yes, this kind of thing works, but is generally achieved using an in-memory database such as TimesTen, we did something like this for handing massive amounts of CDR inputs once upon a time. Have a look at the whitepapers on that site for some good advice in configuring such a setup, the same principles apply if you're using an "on-disk" DB instead of TimesTen.

You will still need a second server to run it on, just running 2 instances on a single server is pointless, you'd be better off configuring your existing setup than running 2 DBs on the same hardware. I doubt a cluster will help as it has a bit of overhead in reconciling the transactions written to your tables - but that depends on your workload, whether each transaction is completely idempotent or not.

Timeout can be considered a failure, but technically they are different things that you could handle in different ways.


问:
Biggest mistake you've ever made
Similar to the question I read on Server Fault, what is the biggest mistake you've ever made in an IT related position. Some examples from friends:

I needed to do some work on a production site so I decided to copy over the live database to the beta site. Pretty standard, but when I went to the beta site it was still pulling out-of-date info. OOPS! I had copied the beta database over to the live site! Thank god for backups.

And for me, I created a form for an event that was to be held during a specific time range. Participants would fill out the form for a chance to win, and we would send the event organizers a CSV from the database. I went into the database, and found ONLY 1 ENTRY, MINE. Upon investigating, it appears as though I forgot an auto increment key, and because of the server setup there was no way to recover the lost data.

I am aware this question is similar to ones on Stack Overflow but the ones I found seemed to receive generic answers instead of actual stories :)

What is the biggest coding error/mistake ever…

答: On a manager's request, I copied /etc/sudoers from one machine to another (even though it wouldn't have fixed the problem at hand, but that's beside the point).  Unfortunately, I used sudo to move the copied file into place, without noticing that its owner and permissions were completely wrong.  At that point, nobody had a root shell open, nobody could sudo, and nobody could log in as root because its shell was set to /bin/false.  And the machine was in a remote data warehouse...

Title: Biggest mistake you've ever made


答:
OOP in a nutshell.

You have a class to model a clock. Everything you need to know about a clock is in this class, it has a few routines that allow you to set the time, and display the time. This is  Encapsulation.

But now you want a digital clock. This is a clock like you had before, but it wants to display the time in a digital rather than analog display, so you derive a new class off the original and replace the display routines to show stuff in digital format. This is Polymorphism.

And now you want an alarm clock. This does everything clock does, but it also makes a noise at set times, so you derive from the original clock class and add new routines to set and ring the alarm. This is Inheritance.

And there you have the 3 fundamentals of OOP.

Note that in all cases, you still have a clock. This is how OOP works, that you can sell someone a clock, then hand them an alarm clock and they will still be able to do 'clock' things to it like setting and telling the time.

SDLC:

This is the lifecycle of making software and delivering it to the customer. You start by figuring out what it is they want, figuring out how you're going to go about it, figuring out how to code it, figuring out why it doesn't work quite right, and then figuring out how to install it.

There's no "right" answer to "what is SDLC", but to show that you understand all aspects of creating software that the customer uses. Its to show that you understand there's more to software development than simply coding.

Title: What exactly are SDLC and OOP?

Body:
I have been asked "What are SDLC and OOP?" many times in job interviews but I am still not sure how to answer this question. I am a web developer for quite some time but I still have problem with explaining OOP and SDLC (System Development Life Cycle) .

Can someone help me to explain what these are to another person?


答:
My feeling is that most people's tolerance for reading documentation is fairly low (Good for a day or two, but beyond that they'll probably be itching to do something a bit more hands-on).

I don't think you can really get understanding of an application's code without a reasonable understanding of the application itself.  The software presumably has plenty of functionality which they could 'toy' with as a user; they're going to need to be able to test it eventually, so I'd expect that its fairly important that they know how to install it, configure it and perform common tasks with it

I personally find that a high-level architecture overview is usually quite handy for getting a basic feeling of how things work - Maybe allocate an hour or two of a senior engineer's time (or yourself if necessary?) in their first week simply to go through the basic nuts'n'bolts of the main application.  e.g. understanding all the subsystems and how things are tied together, knowing which bits are handled by 3rd-party software/libraries and which bits need to be maintained in-house. (Unless your organisation has got up-to-date documentation of truly exceptional quality, I'd guess that there's no way they're going to get a grip on that sort of stuff without someone explaining it to them directly using a whiteboard :-) )

As for giving them something "hands on", maintenance/bug chasing tasks might be a good way to get them up to speed for a while (a couple of weeks/months?) - they'll be in situations where specific areas of functionality need to be understood, tested and debugged; helping build up knowledge of the code, the requirements, the tools used by the company, the development processes and the product(s) as a whole while hopefully not needing to soak up too much time from the rest of the development team

Title: How to get new team members up to date with the project?

Body:
We are about to hire 1-2 new engineers for the software team (consisting of 3 developers, 1 tester).

What are the steps to integrate them into the team?

My ideas are :

read documentation (coding standards, documents in development methodologies we use)

get them to read the existing code

assign them some simple tasks

at the end, make them responsible for the code part

What else could we do?

The project is in a medical sector (ultrasound system), and is already 5 years going. We have yearly releases, and we are about to finish one release, when we want to add 1-2 engineers.

The project is in the maintenance phase (refactoring legacy code, plus adding new features). Things are pretty much on schedule (more or less).


答:
A very similar solution to your proposed is "CQRS" and/or "event sourcing", you should read on both and pick the particular aspects which can apply to the right slice of your application - assuming this is the right answer.

As a simple overview, separating your OLTP and reporting database, and applying "reporting" as a much more broad term than previously. Although you might not think of "list all the products a customer has bought" as a report since it's a small transaction normally done on OLTP, under CQRS you are encouraged to consider this as reporting data.

Event sourcing encourages you to log transaction data and use that to compose your data for reporting/other purposes.

http://martinfowler.com/bliki/CQRS.html

http://skillsmatter.com/podcast/open-source-dot-net/udi-dahan-command-query-responsibility-segregation/rl-311

Re: clustering - it depends on your pain points. If your app architecture does not support scaling then configuring a cluster will bring minimal benefits, maybe 2x server capacity brings a 10% performance increase due to key bottlenecks in processing or data structure. (Amdahl's Law).

Title: Overloaded high transaction SQL Server database Solutions

Body:
The current sql server database is overloaded and many transactions are failing.  The powers that be have a proposed solution to build a separate database to handle/store transactions and then asynchronously insert them into the current system. Specifically persist new transactions to a new database then build routines to insert the data from the new database into the current/old database.

I'm looking for best method to implement this solution... should I use a non-indexed table in the proposed new db for fast inserting, then use bulk inserting from newdb -> olddb to move the data back into the main database? Is this best done @ scheduled intervals or real time?

I was also wondering if scaling up/out would help here (budget permitting)? My initial thought was to recommend purchasing a second server and configuring a cluster to reduce the load.

To be honest I thought the web transactions would just timeout and not fail (but I guess that's ultimately the same)?


问:
Scheme vs Haskell for an Introduction to Functional Programming?
I am comfortable with programming in C and C#, and will explore C++ in the future. I may be interested in exploring functional programming as a different programming paradigm. I am doing this for fun, my job does not involve computer programming, and am somewhat inspired by the use of functional programming, taught fairly early, in computer science courses in college. Lambda calculus is certainly beyond my mathematical abilities, but I think I can handle functional programming.

Which of Haskell or Scheme would serve as a good intro to functional programming? I use emacs as my text editor and would like to be able to configure it more easily in the future which would entail learning Emacs Lisp. My understanding, however, is that Emacs Lisp is fairly different from Scheme and is also more procedural as opposed to functional.

I would likely be using "The Little Schemer" book, which I have already bought, if I pursue Scheme (seems to me a little weird from my limited leafing through it). Or would use the "Learn You a Haskell for Great Good" if I pursue Haskell. I would also watch the Intro to Haskell videos by Dr Erik Meijer on Channel 9.

Any suggestions, feedback or input appreciated.

Thanks.

P.S. BTW I also have access to F# since I have Visual Studio 2010 which I use for C# development, but I don't think that should be my main criteria for selecting a language.

答: If it is not pure, you may as well use an imperative language, so Haskell.</p>

OwnerDisplayName: haziz


答:
CQRS is a good angle to follow for lots of things. But I'm not sure if it is right here.

What they are really proposing is creating a service bus of some sort. The general concept is the live transaction gets written to a persistent message queue which then gets processed and pushed to appropriate services. You might want to look at [presuming .NET b/c SQL Server tag]:

NServiceBus

MassTransit

This StackOverflow Question

To start with. There are lots of options out there but the proposed model is solid. Lots of landmines in this space, rolling your own is definitely not recommended.

The other angle here is measurably and instrumentation. You can waste a lot of time guessing why things crashed. Knowing why things crashed is invaluable.


答: Unfortunately your average developer still thinks of relational databases as big flat files. The only way they will get any better is if someone takes charge and leads by example. Just recently I spearheaded a major redesign of an important schema in our database and followed common relational practices. All of the sudden our stored procedures were more elegant and all of the proper indexes seemed to fall into place like they were born for it. The ego driven developer will never believe you without proof.</p>

Title: My coworker created a 96 columns SQL table

Body:
Here we are in 2010, software engineers with 4 or 5 years or experience, still designing tables with 96 fracking columns.

I told him it's gonna be a nightmare.

I showed him that we have to use ordinals to interface MySQL with C#.

I explained that tables with more columns than rows are a huge smell.

Still, I get the "It's going to be simpler this way".

What should I do?

EDIT *

This table contains data from sensors.

We have sensor 1 with

Dynamic_D1X

Dynamic_D1Y

[...]

Dynamic_D6X

Dynamic_D6Y

[...]

EDIT2 *

Well, I finally left that job. It is a sign when the other programmer goes dark for months at the time, it is another sign when management does not realise this is a problem


答:
You need to do this in three stages.

Create a new central table with a new key, the name address details etc. and a column for the key values the existing tables.  Load up the data from the three sources into here.

Identify and merge duplicate rows. This has to be a hybrid automatic/manual procedure. Have a program identify possible duplicates then have a manual approve/reject process.

Switch the three existing apps to use the new central DB. BUT each app needs to use its "old" key to access the data (database views can help here)!

There are still some issues to be resolved -- you will need a common app to search for existing customer and/or add new customers, -- you will need a (mostly manual) process for resolving different entries for the same customer ("Acme Widget Company" v. "Acme Widget Co." etc.).

Title: Data migration to a single shared SQL table

Body:
We have three internal web applications we use at my company. Unfortunately none of my predecessors had the foresight of sharing tables amongst those apps.

It has become necessary to share some company data among the three internal web apps. As an example, each of the three websites have a companies table in their respective databases.

Website A Companies Table

```<code>id | name
---------
1  | Sprockleys Sprockets
2  | Goobers Gadgets
3  | Nancys Necklaces
</code>```

Website B Companies Table

```<code>id | name
---------
3  | Sprockleys Sprockets DENVER
22 | Gooburrs Gadgets
30 | Nancyies Necklaces
</code>```

I want to somehow merge all of this data together into a single shared database table. Unfortunately the ID's of the companies do not match up at all and other tables have foreign keys that map products and users to those companies.

What are some ideas for merging data like this?


答:
One "orientation" flow that I've been through (and found useful) was something along the lines of:

A brief presentation giving the "Big Picture" what the components are, how the fit in and the general architecture.

An overview of the code, intro to the functions that handle the main logic for the component(s) assigned to me. Covered some stuff related to coding conventions and style.

A bunch of open issues and low-priority bugs were assigned (which were largely localized to the component assigned to me and fairly simple).

I was expected to debug through the application and ask for help with stuff that I couldn't decipher.

After the fix was made, I was walked through the the process (code-review, dev-level testing etc.) of releasing to integration.

Repeat for the remaining tasks/bugs allocated.

I feel this approach (and variations of it) will be useful because:

This was a more hands-on and relatively independent (constant no hand-holding etc.). So, it provides enough room/time for the new person to get used to the code and the way things are done in the team.

It is also beneficial to the team as a whole since a couple of low-priority tasks/bugs can be resolved. The person helping out the new people also has more time for dealing with tasks assigned to them since constant hand-holding is not required and time can be specifically scheduled to deal with problems/issue that the new person might face.


答:
Since the complexity is better be served by small portions, I think this can be done with two big steps:

Create an intermediate table [CompanyName],[OldId1][OldId2]...[NewId] (if the company name is what they share). Don't know what your DBMS is, but for example Sqlite allows attaching databases in the same session and working with them on common queries. This step is safe for your data and apart from creating it, I'd look at different selects and joins of this new table with separated tables since the human eye is the best tester if something is wrong with your approach. Even simple select from this table will allow you to catch such anomalies as unexpected NULLs.

Perform necessary modifications to the existing and new table based on this new mapping.


答: Initial hires need need a small, but not too small, and well-defined task to work on. This way they can start getting a feel for how the code is structured by trying to figure out how to accomplish their task. In the process questions will come up and at that point you can direct them to documentation or other resources that they can use to help them internalize the code base. It also helps if your develop, commit, deploy cycle is short and they can see the fruits of their labor in action as quickly as possible.</p>


答:
Use the propositions above to merge the 3 tables into one. Make sure you keep in the new table the old key.

After you do that the major problem is to consolidate the same company that has different ids.

It depends how much time and resources you have.

1) Solution "i have time and resources"

If you have enough the best thing you can do is export the tables in excel and put people work on it in order to identify the same companies in the 3 tables. Do it simple, put people that know excel with people that now the companies.

2) Solution "i dont have time know"

If you need to start operating asap then you will have to:

Just merge the tables with a new key and keep the old one.

Use a mechanism like views or something in order for the apps to work immediately as before (with the old key).

Create a simple lookup table (common company code) where gradually you will consolidate the companies.

More on the last point:

Create common reports for all the companies at the very beginning . The results from these reports will have the same company more than one time BUT they will outline to the management the need to commit resources in consolidation.

I hope i made it more clear for you....


问:
Why do new programmers seem to ignore compiler error messages/runtime exception messages?
I think we’ve all seen this. Beginners ask questions on Stack Overflow that follow the basic outline...

I’m trying to do (very vague description of the goal) but it doesn’t work/I get an error/exception. Please help!

Isn’t it bizarre that so many of them seem to consider it unnecessary to paste the error message?

I wonder what the psychology of this is. What is it about error messages that makes people initially assume that they are useless and not worth paying any attention to?

The answer I’m looking for is not “they don’t understand the error message”. That doesn’t explain why they wouldn’t consider telling anyone else who might understand it.

答:
Because compiler errors/exceptions require you to know what you're doing wrong to fix it. They're for programmers who overlook stuff, not for people who don't understand them.

They're also not always the most obvious. An error like "unexpected if" isn't that intuitive. "But that if should be there" is the response of a newbie. A more experienced programmer knows that that means he's forgotten the semicolon on the preceeding line.


答:
I'm going to go out on a limb here and assume he's going to cut and paste a lot of code to work with this "New" table.

If so, you probably won't incur any additional technical debt.  He's just split his share of technical debt and may be well on the way to some sort of grand unification of things.

If he's got some tried and true methodology that requires a 96 column thing consider the actual benefits of doing it a different way in this particular case.  If there are none, then give him the benefit of the doubt, but remind him that next time you want to be in on the planning phase the next time he makes what we'd all consider to be a pretty dumb move.


答:
This is how I go about

Give them some tasks which are related to the project.(e.g.: If your
project is database application ask them to just create an
application to connect with the database and perform some simple
operation.)

When you find they have understood the idea of working, give them a demo of the Project

Ask them to read the documentation.

Make them familiar with the coding styles and standards

Later give them some debugging exercises(to know the flow of the project).

Ask them to fix a point that you have already fixed (just to find out their logic with it).

Finally make them a part of the project.

Remember : no matter how much you try, until and unless the joinee understands the project completely you wont be able to get work done most efficiently out of him.


问:
Why the static data members have to be defined outside the class separately in C++ (unlike Java)?
```<code>class A {
  static int foo () {} // ok
  static int x; // <--- needed to be defined separately in .cpp file
};
</code>```

I don't see a need of having A::x defined separately in a .cpp file (or same file for templates). Why can't be A::x declared and defined at the same time?

Has it been forbidden for historical reasons?

My main question is, will it affect any functionality if static data members were declared/defined at the same time (same as Java) ?

答:
Since static members are shared between ALL instances of a class, they have to be defined in one and only one place. Really, they're global variables with some access restrictions.

If you try to define them in the header, they will be defined in every module that includes that header, and you'll get errors during linking as it finds all of the duplicate definitions.

Yes, this is at least partly a historical issue dating from cfront; a compiler could be written that would create a sort of hidden "static_members_of_everything.cpp" and link to that. However, it would break backwards compatibility, and there wouldn't be any real benefit to doing so.


答:
Number one - first learn how to use the software to discover what problems it solves from the user's perspective. If it doesn't have a UI (e.g. its a backend service or something), let them use whatever interface is available to consume it. Getting a fresh take on a user's view of your software is always good, and it might help the new employee to see things that you can't, due to you being embedded in the project already.

After this, a good first project might be something like an add-on or new module to add to the software, minimizing the amount of knowledge needed of the existing codebase. Writing something new is always going to be easier than performing a bug fix, which might require lots of changes across many source files. In my opinion, giving a new employee a bug fix task will probably turn them off your company.


答:
The probable reason for this is that this keeps the C++ language implementable in environments where the object file and linkage model does not support the merging of multiple definitions from multiple object files.

A class declaration (called a declaration for good reasons) gets pulled into multiple translation units. If the declaration contained definitions for static variables, then you would end up with multiple definitions in multiple translation units (And remember, these names have external linkage.)

That situation is possible, but requires the linker to handle multiple definitions without complaining.

(And note that this conflicts with the One Definition Rule, unless it can be done according to the kind of a symbol or what kind of section it is placed in.)

Title: Why the static data members have to be defined outside the class separately in C++ (unlike Java)?

Body:
```<code>class A {
  static int foo () {} // ok
  static int x; // <--- needed to be defined separately in .cpp file
};
</code>```

I don't see a need of having A::x defined separately in a .cpp file (or same file for templates). Why can't be A::x declared and defined at the same time?

Has it been forbidden for historical reasons?

My main question is, will it affect any functionality if static data members were declared/defined at the same time (same as Java) ?


问:
Always return single objects in an array for REST API JSON payloads?
For a REST API that I am working on, I want to return JSON in a consistent layout:

```<code>{
  "Data" : {
     "Id" : 123,
     "Email" : "charlie@somewhere.com"
     "Firstname" : "Charlie",
     "Surname" : "Brown",
 },
 "Error" : null
}
</code>```

The payload will always contain "Data" and "Error", where one or the other can be null.

My question relates to "Data" and endpoints which only ever really return one object. For example, let's say I have an API users/current, which returns the currently authenticatedd user. I would have returned that user as shown above; a single JSON object named "Data".

For endpoints that could return zero, one or more objects, then I would (of course) make "Data" be an array:

```<code>{
  "Data" : [
    {
      (first object)
    },
    {
      (second object)
    }
  ],
  "Error" : null
}
</code>```

I've heard a point of view that, for consistency, "Data" should always be an array. Even when an endpoint would logically only ever return a single object (or null).

What do others think? I think that there's no need to make "Data" and array if there'll never be more than one object returned.

答:
If the receiving side needs a general recipient for your JSON messages, it can be useful to have the data node to be of the same format. So in this case it is useful to always have an array, so it can be parsed in the same way everytime.

If each response is going to be handled individually (different API calls from different methods), I can see your point, however it should be absolutely clear (from the API calls) when an array or one object is to be returned.


答:
I am falling on the side of always returning an array.
On the client side, I use my "Users" response object whether getting all users or just one.
If you have an endpoint that returns arrays, and another that returns the same object, but never more than one, still use an array.

There are similar arguments for using the same logic on the server side, just use the same code whether your query is returning one item or many.

The only exception would be when returning an object that never exists as an array, in any context, then there is no need.

Title: Always return single objects in an array for REST API JSON payloads?

Body:
For a REST API that I am working on, I want to return JSON in a consistent layout:

```<code>{
  "Data" : {
     "Id" : 123,
     "Email" : "charlie@somewhere.com"
     "Firstname" : "Charlie",
     "Surname" : "Brown",
 },
 "Error" : null
}
</code>```

The payload will always contain "Data" and "Error", where one or the other can be null.

My question relates to "Data" and endpoints which only ever really return one object. For example, let's say I have an API users/current, which returns the currently authenticatedd user. I would have returned that user as shown above; a single JSON object named "Data".

For endpoints that could return zero, one or more objects, then I would (of course) make "Data" be an array:

```<code>{
  "Data" : [
    {
      (first object)
    },
    {
      (second object)
    }
  ],
  "Error" : null
}
</code>```

I've heard a point of view that, for consistency, "Data" should always be an array. Even when an endpoint would logically only ever return a single object (or null).

What do others think? I think that there's no need to make "Data" and array if there'll never be more than one object returned.


答:
I think this type of consistency is misguided.

Wrapping the data in an array is unlikely to benefit an API consumer, because he would still have to know how to interpret the actual data. As an example, it is just not likely that the "data" results of /users/current and /cities/chicago/restaurants are going to be handled by the same code.

For errors, on the other hand, it is likely that all errors are processed by the same error handling code, and then there is a benefit to use the same structure.

Ask yourself this: if this was a class in your favorite OOP language, would you make all methods return the same type for consistency?


答:
Something similar was discussed previously on StackOverflow.

In general, having lots of columns on a table doesn't necessarily mean you are doing something wrong, but it definitely should raise some red flags so you look closely at the design. Sometimes a huge table is the right choice, but in many cases, other alternatives make more sense. For example, one option is to divide the storage into two tables: one table that identifies your entities and another table that is effectively a key/value store of attributes describing those entities (so you may end up with at most 96 rows for each entity). Other designs are possible as well. Talk with your teammates and figure out which solution is better depending on data normalization, code readability & maintainability (insert statements with 96 attributes to fill in?), performance implications, how often new attributes (columns) could be added or changed, how sparse the data is (how many of the 96 columns will ever be filled and how many remain NULL?), and implications on reporting. Any developer should be able to reasonably justify their design decisions and show that the cost/benefit trade off (and yes, every design decision is a trade off) is in their favor. Your responsibility is not to complain or criticize, but to propose alternatives and make sure they thought through these issues.


答:
I'm not a fan of the array approach because it does not offer true consistency It forces the user of the service to either wonder about things like, what happens if there is more than one object in this array or to get rid of the wrapping array as soon as possible for those singleton arrays. You'd still have to do two different things.

However, if you use the array make sure that Data is never null. If there is no data the array should be empty. It's the only advantage I can see.


答:
Your outline to familiarize the new ones with the project seems reasonable. But keep in mind that they will have a lot to learn in the beginning. This is usually an overwhelming situation. You will have to be patient and answer the same questions repeatedly. This is normal, new developers have to learn a lot, don't underestimate this. If you get angry about these repeated questions you'll risk that they will not ask and try to find out things alone which maybe very slow at best but frequently impossible. Also they will have to learn the lingo. Most teams projects develop their own language. When explaining consciously try to avoid the lingo. Explain this stuff like you would explain it to your mom. Again, be patient.

Additionally, you could try to integrate them with the others already on the team by trying some assessment center style tasks e.g. build a bridge in 45 min from 4 sheets of paper supporting a coffee cup. We use this technique in a practical course in software engineering to get a group of 8 students to break the ice before they work on a single project for 3 weeks. It helps to speed up the team forming phases.


问:
Stored Procedures a bad practice at one of worlds largest IT software consulting firms?
I'm working at a project in one of the world's top 3 IT consulting firms, and was told by a DBA that company best practice's state stored procedures are not a "best practice".  This is so contrary to everything I've learned.

Stored procedures give you code reuse, and encapsulation (two pillars of software development), security (you can grant/revoke permissions on an individual stored proc), protect you from SQL injection attacks, and also help with speed (although that DBA said that starting with SQL Server 2008 that even regular SQL queries are compiled if they are run enough times).

We're developing a complex app using Agile software development methodology.  Can anyone think of good reasons why they wouldn't want to use stored procs?  My guess was that the DBAs didn't want to maintain those stored procs, but there seem to be way too many negatives to justify such a design decision.

答:
It's always a source of problems to have the business logic splitted up between different layers, using different programming languages. Tracing a bug or implementing a change is way harder when you have to switch between worlds.

That said, I know companies that do pretty well by putting all business logic into PL/SQL packages living in the database. Those are not very large applications, but not trivial either; say 20K-100K LOC. (PL/SQL is better suited for that kind of system than T-SQL, so if you only know T-SQL, you probably shake your head in disbelieve now...)


答:
This is basically a workflow/queueing problem.

Incoming requests should be placed on a queue.

Each operator should request (with wait) the next item on the queue.

When a operator gets the item the "do useful work" as they say in all the best code samples.

When the operator is finished he/she requests (with wait) the next item in the queue.

You have chosen C++ for the right reasons so you should stick with that choice.
If Java was feasible you could have picked of one of several workflow/queuing frameworks to help you.  In the C++ you may end up coding much of this yourself. There are several queue management packages available, but, workflow managers are pretty scarce. Luckily your workflow should start of pretty simple.

Title: Which architecture should I choose for this project?

Body:
I have a project. The server which based on a phone PCI-board is responsible for received phone calls from the customer and then redirect the phone calls to the operators.

I have decided to code the server using c++ programming language and qt framework because the PCI-board SDK's interface is c/c++ originated and for the sake of portability.

The server need to send the information of the the customer to the operator while ringing the operator and the ui interface of the operator client should be browser-based.

Now the key problem is how could the server notify the operator that there is a phone call for he/she.

One architecture I have considered is like this,

The operator browser client use ajax pooling the web server to check whether there is call to the client; the web server pooling the database server to check whether there is call;
the desktop server(c++) wait for the phone calls and set the information in the database.

The other operations such as hang up the phone call from the client, retransfer the phone call to the other operator also use this architecture.

Then, is there any way other than pooling the server(js code setInterval('getDail', 1000)) to decide whether there is a call to the operator?

Is this architecture feasible or should I use some terrific techniques that I do know such as web services,xml-rpc, soap???

The Caller center is for 8~300 operators and the operators do not seperate geographically.
Moreover, I have figured out that we need provide interface for customer programmer, so this thing is so called middleware? Then some new questions, how could we expose interface to customer, COM?

Thanks in advance.


答:
Our Dutch-Speaking team is closely working together with our French-Speaking branch. None of the French speaking team speak Dutch and our French is only OK-ish.

Everyone speaks at least some English however, certainly programmers, it's the Lingua Franca in Western Europe. So all the documentation is in English, all code comments, all mails and meetings.

From time to time we also visit each others branches. Often someone who often visits it brings along someone new to let everyone meet everyone.

Title: Scrum for team split between two spoken languages

Body:
I have a team that without a single common language among all of the team members. The team is split across two locations (though the geography isn't the main issue). All team members in each location speak the same language and there are members in both locations that can speak both. I'd like to introduce scrum, but am struggling with the logistics of dealing with the language issue.

This isn't an offshore team. All team members are employees of the company, but located in two different offices in different countries. Fortunately, we don't have any issues with timezones; language is the primary barrier. While the team could be split into two teams, given the size and skillset of the people in each location as well as other external factors, it is more desirable to integrate as a single team.

I think it would be preferable to use video conferencing in order to have richer communication and help unite the team in being able to see each other and do the true stand-up approach. However, I am afraid this will be difficult to communicate between languages. Should bilingual members of the team translate verbally? Alternately, we could use instant message as recommended by the only reference I could find to language issues in distributed scrum. I'm concerned about the "poorer" communication and perhaps it is a poor introduction to the scrum concept.

From people that have experience in dealing with language differences in a team, how did you address the problem and how well did it work for you?


问:
Does Git have a "safe mode" to prevent rewriting history?
When you're kind of fresh with Git (and DVCS in general), and you start exploring history-rewriting changes, you're safe if the repository is only local, but you might run into problems if you work with remotes and try to push such changes.

A feature that I'd expect is the ability to enable a "safe mode" which would basically stop me from doing whatever I shouldn't do... And what do I mean by that? I mean history-rewriting changes for things already pushed to an origin. I can't define it precisely, but this would include such cases as:

commit --amend when HEAD has been already pushed

rebase of a non-local branch

reset of a branch that has been pushed

These are examples of situations which will will probably make the next push fail (because it wouldn't be fast-forward, IIRC). I've made some of that by accident and had to re-create the branch on the remote. And I still was lucky to do this fast enough so that nobody pulled the history I've rewritten.

I believe it's possible to identify this type of changes and, on demand, prevent the user from making them. Is there perhaps an option for that?

If there isn't, do you think it's worthwhile to attempt to create it? Would you try to define precisely how to identify such a "dangerous change"?

答:
No because it s part of the philosophy of git to give you full power and let you manage that power the way you want.

If you dont adhere to this philosophy, then maybe switching to Mercurial would be worth as they allow rewriting history but in a limited or, to be clear, reluctant way, that makes you feel it is not a good idea.


答: AFAIK, the way git solves these issues is that whenever you request such an action, it will perform it locally, but inform you that what you are doing may have undesirable consequences. At that point, you haven't pushed anything yet, so you are in a position to review your local repository, and possibly undo the dangerous change before you push. You do have to pay attention to what git is telling you though, and you better be careful when you repair such errors.</p>

Title: Does Git have a "safe mode" to prevent rewriting history?

Body:
When you're kind of fresh with Git (and DVCS in general), and you start exploring history-rewriting changes, you're safe if the repository is only local, but you might run into problems if you work with remotes and try to push such changes.

A feature that I'd expect is the ability to enable a "safe mode" which would basically stop me from doing whatever I shouldn't do... And what do I mean by that? I mean history-rewriting changes for things already pushed to an origin. I can't define it precisely, but this would include such cases as:

commit --amend when HEAD has been already pushed

rebase of a non-local branch

reset of a branch that has been pushed

These are examples of situations which will will probably make the next push fail (because it wouldn't be fast-forward, IIRC). I've made some of that by accident and had to re-create the branch on the remote. And I still was lucky to do this fast enough so that nobody pulled the history I've rewritten.

I believe it's possible to identify this type of changes and, on demand, prevent the user from making them. Is there perhaps an option for that?

If there isn't, do you think it's worthwhile to attempt to create it? Would you try to define precisely how to identify such a "dangerous change"?


问:
What are the best ways to get beta testers?
I have several projects coming up soon for public release, both commercial and open source. The projects are all downloadable, not web apps. I've worked on them alone and would like to get feedback during a beta period, but I don't currently have a large audience (though the markets are large). What are the best ways to get participation in the betas? Are there any existing sites or communities that specialize in software testing that I can reach out to? At this point, I'm specifically looking for technical testers who aren't intimidated diving into the code and can help spot security bugs, logical errors, etc.

Edit: I'm looking for websites or communities similar to Invite Share. Invite Share itself would be perfect, but there doesn't seem to be any public information about how to submit a beta.

Bounty Explanation:

While Joel's article on running a beta is helpful, I wonder if there isn't an existing community available for beta testing of any sort, technical or user. As a self-taught and sole developer, I don't have a lot of technical contacts that would be appropriate approaching for testing. I did propose a Beta Testing site in Area 51 a few months ago, but it seems as if it either got buried, there wasn't a whole lot of interest, or it's a poor fit for StackExchange. If you know of existing testing communities, sites like InviteShare, or other ways to get testers, please share.

答: While I still haven't come across quite as comprehensive as what I'm looking for, many of the websites in this article provide feedback for a design.</p>


问:
Scrum for team split between two spoken languages
I have a team that without a single common language among all of the team members. The team is split across two locations (though the geography isn't the main issue). All team members in each location speak the same language and there are members in both locations that can speak both. I'd like to introduce scrum, but am struggling with the logistics of dealing with the language issue.

This isn't an offshore team. All team members are employees of the company, but located in two different offices in different countries. Fortunately, we don't have any issues with timezones; language is the primary barrier. While the team could be split into two teams, given the size and skillset of the people in each location as well as other external factors, it is more desirable to integrate as a single team.

I think it would be preferable to use video conferencing in order to have richer communication and help unite the team in being able to see each other and do the true stand-up approach. However, I am afraid this will be difficult to communicate between languages. Should bilingual members of the team translate verbally? Alternately, we could use instant message as recommended by the only reference I could find to language issues in distributed scrum. I'm concerned about the "poorer" communication and perhaps it is a poor introduction to the scrum concept.

From people that have experience in dealing with language differences in a team, how did you address the problem and how well did it work for you?

答:
What is the official corporate language? I don't know the size of your company, but every single place I worked for had an official language.

My advice is to use the corporate language by default, unless the Scrum Team want something different and is supported by management.


答:
This looks very close, if not the same question as Strategy for Preventing or Catching Git History Rewrite

To sum it up you can enable

git config --system receive.denyNonFastforwards true

and

git config --system receive.denyDeletes true

Or write a post receive hook to reject anything you determine is a rewrite.


问:
When should you use bools in C++?
We had an assignment for our class where we had to create a Tic-tac-toe game. People like to complicate themselves, so they wrote complex games which included menus. At the end of the game, you had to have the option to play again or quit the program. I used an int variable for that, but I noticed some classmates using BOOLs.

Is it more efficient? What's the difference, between storing an answer that should only store two values in an int rather than storing it in a bool? What is the exact purpose of these variables?

答: When choosing variable types and variable names you want your intent to be as clear as possible. If you choose a bool (boolean) type, it is clear there are only two acceptable values: true or false. If you use an int (integer) type, it is no longer clear that the intent of that variable can only be 1 or 0 or whatever values you chose to mean true and false. Plus sizeof(int) will typically return as being 4 bytes, while sizeof(bool) will return 1.

Title: When should you use bools in C++?


答: Because in the end, you're going to convert your integer to a boolean anyhow: "if (i=1) then play another game". In this situation (i=1) is converted to true or false: a boolean.</p>

Title: When should you use bools in C++?

Body:
We had an assignment for our class where we had to create a Tic-tac-toe game. People like to complicate themselves, so they wrote complex games which included menus. At the end of the game, you had to have the option to play again or quit the program. I used an int variable for that, but I noticed some classmates using BOOLs.

Is it more efficient? What's the difference, between storing an answer that should only store two values in an int rather than storing it in a bool? What is the exact purpose of these variables?


答:
Bool types are smaller than Int types, thus use less room in memory. Depending on the system you're compiling on/for, an Int can be 4 - 8 bytes, whereas a Bool is 1 byte (as can be seen in this MSDN article)

Couple this with some of the aspects of KISS and good program design, and it becomes obvious why it's better to use a bool to store a variable that will only ever have 2 values.

Why over complicate things with an object that can store a wide range of values, when you are sure that you only ever need to store 1 of 2 different values?

What happens in the system that uses an int, if you store 75 in there? If you've added extra conditionals

```<code>if (value >= 0 )
  return true;  //value is greater than 0, thus is true
else
  return false; //value is 0 or smaller than 0, thus is false
</code>```

or

```<code>if (value == 0)
  return false;  //value is greater than 0, thus is true
else if (value == 1)
  return true; //value is 0 or smaller than 0, thus is false
</code>```

then you're covered for this situation. But if you haven't, then you're not.

You could also have a case (depending on how you're changing the value of the int) where you have a buffer overrun, and the value "resets" back to 0 or the lower bound of your int (which could be somewhere in the region of -127 to −9,223,372,036,854,775,808, depending on your target architecture) what happens in your code then?

However, if you used a bool you could use something like this:

```<code>if(continueBool == true)
  return true;
else
  return false;
</code>```

Or even:

```<code>return (continueBool== true) ? true : false;
</code>```

or even:

```<code>return continueBool;
</code>```

Depending on your compiler, there might be optimizations that it can perform on code that uses Bools to store mapped true/false values. Whereas, there might not be optimizations it can perform for Ints used to store mapped true/false values.

We've also got to remember that C++ (along with C, Assembly and FORTRAN) is used to write highly efficient, small and fast code. So, it would be better to use a Bool in this instance - especially if you are being marked on your use of variables, memory, cache or processor time.

A similar question would be: why would I store an integer (value) in a float?
Answer: You shouldn't, because there's no point.

Long story short: As your teacher/tutor/lecturer/professor to go over the sizes of different value types with you (in case you missed it), and why they're important in Software Development.

I hope that helps as a starting point (I also hope that it doesn't come across as pedantic)

Title: When should you use bools in C++?

Body:
Bool types are smaller than Int types, thus use less room in memory. Depending on the system you're compiling on/for, an Int can be 4 - 8 bytes, whereas a Bool is 1 byte (as can be seen in this MSDN article)

Couple this with some of the aspects of KISS and good program design, and it becomes obvious why it's better to use a bool to store a variable that will only ever have 2 values.

Why over complicate things with an object that can store a wide range of values, when you are sure that you only ever need to store 1 of 2 different values?

What happens in the system that uses an int, if you store 75 in there? If you've added extra conditionals

if (value >= 0 )
  return true;  //value is greater than 0, thus is true
else
  return false; //value is 0 or smaller than 0, thus is false

or

if (value == 0)
  return false;  //value is greater than 0, thus is true
else if (value == 1)
  return true; //value is 0 or smaller than 0, thus is false

then you're covered for this situation. But if you haven't, then you're not.

You could also have a case (depending on how you're changing the value of the int) where you have a buffer overrun, and the value "resets" back to 0 or the lower bound of your int (which could be somewhere in the region of -127 to −9,223,372,036,854,775,808, depending on your target architecture) what happens in your code then?

However, if you used a bool you could use something like this:

if(continueBool == true)
  return true;
else
  return false;

Or even:

return (continueBool== true) ? true : false;

or even:

return continueBool;

Depending on your compiler, there might be optimizations that it can perform on code that uses Bools to store mapped true/false values. Whereas, there might not be optimizations it can perform for Ints used to store mapped true/false values.

We've also got to remember that C++ (along with C, Assembly and FORTRAN) is used to write highly efficient, small and fast code. So, it would be better to use a Bool in this instance - especially if you are being marked on your use of variables, memory, cache or processor time.

A similar question would be: why would I store an integer (value) in a float?
Answer: You shouldn't, because there's no point.

Long story short: As your teacher/tutor/lecturer/professor to go over the sizes of different value types with you (in case you missed it), and why they're important in Software Development.

I hope that helps as a starting point (I also hope that it doesn't come across as pedantic)


问:
REST Service Authentication/Authorization
I have a WCF rest service that will be consumed by multiple clients.  The information returned by the client requires me to know who they are, so that I can return information specific to them.

Is the best way to approach this type of design to authenticate them and return a token for their session, then pass this token along with every request?

Thanks.

答:
One possible way to do this would be with a cookie-based (or URL parameter-based) session token, as you suggest. However, passing a session token like that violates the HATEOAS principle. For a "truly" REST-ful service, you should avoid maintaining server state.

If you're using HTTPS, it may be wise to consider using the built-in authorisation/authentication (Sec. 14.8) mechanisms in HTTP. Namely, using the WWW-Authenticate and Authorization headers to pass Basic Auth information back to the server on each request. This allows you to maintain statelessness, but because you're using HTTPS, it is also secure. If you're not using HTTPS, then maybe you should be :).

Using OAuth with the HTTP mechanism is another alternative to Basic Auth, but its complexity is not necessary if you're already encrypting the channel with HTTPS. Because OAuth requests cannot be replayed, and do not reveal the key, they're acceptable over plain-old HTTP, whereas Basic Auth is not.

So, in summary:

You can get away with simple Basic Auth, which is built into most HTTP client libraries, if you're communicating exclusively over HTTPS. Basic Auth is in general much simpler to implement.

You should not use Basic Auth if you are not using HTTPs. Instead, use 2-legged OAuth.

In either case, use the WWW-Authenticate and Authorization headers to share credential information


问:
My coworker created a 96 columns SQL table
Here we are in 2010, software engineers with 4 or 5 years or experience, still designing tables with 96 fracking columns.

I told him it's gonna be a nightmare.

I showed him that we have to use ordinals to interface MySQL with C#.

I explained that tables with more columns than rows are a huge smell.

Still, I get the "It's going to be simpler this way".

What should I do?

EDIT *

This table contains data from sensors.

We have sensor 1 with

Dynamic_D1X

Dynamic_D1Y

[...]

Dynamic_D6X

Dynamic_D6Y

[...]

EDIT2 *

Well, I finally left that job. It is a sign when the other programmer goes dark for months at the time, it is another sign when management does not realise this is a problem

答:
Is it normalised with 96 columns? Does it satisfy 1st, 2nd, 3rd etc NF?

It may be that you have 96 separate attributes for on entity.

Otherwise, make him read Joe Celko on Simple Talk


答:
If you are looking for ideas about security for REST web services then look at the OpenAuth spec Appendices describing the "handshake".

http://oauth.net/core/1.0/#anchor27

Creating web services that adhere to OpenAuth standards is probably one of the more secure ways that this can be done.  It can give you ideas on authentication, authorization strategies.

The following is an example taken from the Authorization header in a GET or POST:

```<code>Authorization: OAuth
    oauth_consumer_key="xxxxxxxxxxxx",
    oauth_token="xxxxxxxxxxxx",
    oauth_nonce="xxxxxxxxxxxx",
    oauth_timestamp="1184242096",
    oauth_signature_method="HMAC-SHA1",
    oauth_version="1.0",
    oauth_signature="xxxxxxxxxxxxxxxxxx"
</code>```

I am not going to go into all the details of OpenAuth but essentially it allows a client to provide a consumer key that identifies the client, a token that identifies the user, and a signature that represents the Base64 encoded bytes of the encrypted signature to verify that the request has not been tampered or altered on transport.

Building the signature string typically involves the percent encoded combination of the entire request, parameters, as well as consumer key, token, nonce, and a consumer secret which the client should keep safe.  Once this signature string has been built and percent encoded it can then by encrypted, and those encrypted bytes can be constructed into a Base64 encoded string that is included in the Authorization header.

If you perform this over SSL, then this is undoubtedly one of the most secure ways to handle authentication/authorization of a REST based web service.

Title: REST Service Authentication/Authorization

Body:
I have a WCF rest service that will be consumed by multiple clients.  The information returned by the client requires me to know who they are, so that I can return information specific to them.

Is the best way to approach this type of design to authenticate them and return a token for their session, then pass this token along with every request?

Thanks.

Body:
If you are looking for ideas about security for REST web services then look at the OpenAuth spec Appendices describing the "handshake".

http://oauth.net/core/1.0/#anchor27

Creating web services that adhere to OpenAuth standards is probably one of the more secure ways that this can be done.  It can give you ideas on authentication, authorization strategies.

The following is an example taken from the Authorization header in a GET or POST:

Authorization: OAuth
    oauth_consumer_key="xxxxxxxxxxxx",
    oauth_token="xxxxxxxxxxxx",
    oauth_nonce="xxxxxxxxxxxx",
    oauth_timestamp="1184242096",
    oauth_signature_method="HMAC-SHA1",
    oauth_version="1.0",
    oauth_signature="xxxxxxxxxxxxxxxxxx"

I am not going to go into all the details of OpenAuth but essentially it allows a client to provide a consumer key that identifies the client, a token that identifies the user, and a signature that represents the Base64 encoded bytes of the encrypted signature to verify that the request has not been tampered or altered on transport.

Building the signature string typically involves the percent encoded combination of the entire request, parameters, as well as consumer key, token, nonce, and a consumer secret which the client should keep safe.  Once this signature string has been built and percent encoded it can then by encrypted, and those encrypted bytes can be constructed into a Base64 encoded string that is included in the Authorization header.

If you perform this over SSL, then this is undoubtedly one of the most secure ways to handle authentication/authorization of a REST based web service.


答:
It seems in all the (till now) collected answers no-one caught the fact that the OP spoke about BOOL not bool.

Since the question is tagged C++, it must be noted that:

int is an integer that ranges from INT_MIN to INT_MAX — macros defined in <climits> whose values depend on the architecture of the hosting machine. In C++ these values are also accessible as std::numeric_limits<int>::min() and ...:max() respectively). The behavior of boolean operators applied to int treat 0 as false and everything else as true.

BOOL is just an hint suggesting a boolean behavior for a int. It is defined in <cstddef> as

```<code>#define BOOL int
#define TRUE 1
#define FALSE 0
</code>```

BOOL is so nothing more than syntactic sugar, for what -by the compiler- it is nothing more than an int. It is something C programmer use, but C++ programmers should avoid, since C++ has bool.

bool is a language integral type whose supported values are just true and false. When converted to int true becomes 1 and false becomes 0.

The important aspect is that it is more safe against programming mistakes:

```<code>BOOL a = FALSE;  // in fact int a = 0;
a = 5; //now a == 5 -- what does it mean?;
</code>```

is impossible to code with proper bool type:

```<code>bool a = false;
a = 5; // error: no bool(const int&) available.
</code>```

Using BOOL instead of bool is just a bad habit inherited from a glorious past no-ones is actually still able to forget, thus creating old problem for a less glorious tomorrow.

Language teachers should seriously think about it!

Title: When should you use bools in C++?

Body:
It seems in all the (till now) collected answers no-one caught the fact that the OP spoke about BOOL not bool.

Since the question is tagged C++, it must be noted that:

int is an integer that ranges from INT_MIN to INT_MAX — macros defined in <climits> whose values depend on the architecture of the hosting machine. In C++ these values are also accessible as std::numeric_limits<int>::min() and ...:max() respectively). The behavior of boolean operators applied to int treat 0 as false and everything else as true.

BOOL is just an hint suggesting a boolean behavior for a int. It is defined in <cstddef> as

#define BOOL int
#define TRUE 1
#define FALSE 0

BOOL is so nothing more than syntactic sugar, for what -by the compiler- it is nothing more than an int. It is something C programmer use, but C++ programmers should avoid, since C++ has bool.

bool is a language integral type whose supported values are just true and false. When converted to int true becomes 1 and false becomes 0.

The important aspect is that it is more safe against programming mistakes:

BOOL a = FALSE;  // in fact int a = 0;
a = 5; //now a == 5 -- what does it mean?;

is impossible to code with proper bool type:

bool a = false;
a = 5; // error: no bool(const int&) available.

Using BOOL instead of bool is just a bad habit inherited from a glorious past no-ones is actually still able to forget, thus creating old problem for a less glorious tomorrow.

Language teachers should seriously think about it!


答:
Short of going with certificates or OpenID, I've found that a token-based approach is the simplest solution.  In one enterprise service app I worked on, we had an Authentication Service that exposed a REST endpoint for authentication and responded with a token that was then passed in a header with all subsequent requests to other endpoints.  Each operation would inspect the header for the token and take the appropriate action based on whether it was there or not and, if present, if the token represented a user with the required authorization.

My suggestion is that you look into a claim-based security model.  First, it makes this MUCH easier to implement as you can keep the server stateless by encapsulating all of the user's claim information inside the token.  And, second, it is the model that Microsoft and many others are moving into.  If you are doing .NET development, look into the Windows Identity Foundation.  This is currently an add-on to the .NET framework but will be built into Windows 8 (and is, in fact, the default security model in .NET 4.5).