问:
How can I conceptually model a craigslist search?
I'm trying to understand how something like this works, but I'm inexperienced and I'm trying to understand how the process would work.

Say you have ten categories, a thousand zip codes, and ten thousand items listed in each category, each of which has a description.

When a user does a search for (e.g.) "guitar hero xbox" in the "video games" category within "50 miles", what happens next?

Would the database compare zip codes first, to find everything in range, then do a SELECT items WHERE category="video games" and zipcode=A OR B OR C OR D, then execute some sort of search on the description of each listing in the result set?

How would that work?

I'm not looking for exact answers about CL, I'm looking for a general idea of how this works anywhere/everywhere.

答:
I wouldn't worry too much about how Craigslist (or any large site) do it, because their insane performance requirements heavily dictate architectural decisions.

Solving this in a simple way would result in a query like this:

```<code># pseudo query
SELECT fields
  FROM ads
 WHERE ad.title MATCHES "search keywords"
   AND ad.location IS IN PROXIMITY to "search location"
</code>```

Now, both searching by keyword and searching by distance can be complex tasks in themselves. Typically, filtering by distance can be done much faster than filtering by words, so it's best to get that out of the way first.

That can be done with some relatively easy math if you have co-ordinates of your search location as well as for each entry in your database. You'd implement something like this - http://www.movable-type.co.uk/scripts/latlong.html. There are also more appropriate geospatial options if you have access to that.

Filtering by keyword usually starts with something trivial like: WHERE title LIKE '%search%' OR body LIKE '%search', but that's insanely slow and lacks the ability to sort by relevance.

Next, you move onto some sort of fulltext search - with MySQL, MyISAM provides the MATCH x AGAINST y method, which also gives you relevance.

Beyond this, people usually move to some sort of dedicated search program. Sphinx, Lucene and Elastic Search come to mind.

Looking back at Craigslist, they actually use Sphinx Search and have quite a complex infrastructure that probably won't be very helpful to you. Last time I checked, they are the largest user of Sphinx, so their findings are quite academic to other large users of it.

Body:
I wouldn't worry too much about how Craigslist (or any large site) do it, because their insane performance requirements heavily dictate architectural decisions.

Solving this in a simple way would result in a query like this:

# pseudo query
SELECT fields
  FROM ads
 WHERE ad.title MATCHES "search keywords"
   AND ad.location IS IN PROXIMITY to "search location"

Now, both searching by keyword and searching by distance can be complex tasks in themselves. Typically, filtering by distance can be done much faster than filtering by words, so it's best to get that out of the way first.

That can be done with some relatively easy math if you have co-ordinates of your search location as well as for each entry in your database. You'd implement something like this - http://www.movable-type.co.uk/scripts/latlong.html. There are also more appropriate geospatial options if you have access to that.

Filtering by keyword usually starts with something trivial like: WHERE title LIKE '%search%' OR body LIKE '%search', but that's insanely slow and lacks the ability to sort by relevance.

Next, you move onto some sort of fulltext search - with MySQL, MyISAM provides the MATCH x AGAINST y method, which also gives you relevance.

Beyond this, people usually move to some sort of dedicated search program. Sphinx, Lucene and Elastic Search come to mind.

Looking back at Craigslist, they actually use Sphinx Search and have quite a complex infrastructure that probably won't be very helpful to you. Last time I checked, they are the largest user of Sphinx, so their findings are quite academic to other large users of it.


问:
How should I behave as a developer in a project that's headed for failure?
I am a developer in a 5-member team and I believe our project is headed for disaster. I'll describe why in a moment, but my question is: how should I behave?

The deadline is in 1.5 months, and I feel no matter what we do, this project will fail. I'm of the opinion that we should just terminate the project and stop wasting our time, but politically I think it's impossible for our manager to do that.

What should I do in this case? Should I put in extra effort, or should I just take it easy? And what should I say to the manager?

Reasons this project is headed for failure:

With deadline approaching many of the must-have features are not finished

Application is unstable and very difficult to use

System is very convoluted, code very hard to understand, very difficult to change - Data model is too driven by a complex relational database (100+ tables)

Unclear leadership; the manager responds to new information with major changes

Almost no automated tests or unit test

Heavily depends on other systems, but no integration tests yet

In fact, we actually just inherited this project (along with the mess) around 1-2 months ago from another dev team under the same manager, who has worked on it for a few months.

答:
There are reams of practical (and otherwise) advice here already, but to me the keys to this mystery are the following two items (emphasis mine):

The deadline is in 1.5 months

and

...we actually just inherited this project (along with the mess)
around 1-2 months ago from another dev team under the same manager...

So....

Welcome to Team Patsy The Avengers

The prior team had better things to do...than fail. And somehow the manager went along with that. Changing teams this close to deadline is not the best project-management move to make, so...what's up with that?

Correction: The prior team was replaced, ~3 months before the deadline.

--> Find out how the prior dev team managed to escape, and do that. <--

3 months is barely enough time to come up to speed on a system of this apparent size, much less correct its architecture, add tests, and finish it. You need more time

And if you can't do that, unless you are absolutely certain that the project will be extended indefinitely, or aided by magic elves or something, you do not want to be the last man standing left holding the bag.

Harsh? Yes. But while poor planning (at least!) by prior teams/managers is not your fault, 'failure to deliver' will be.

The prior team bailed. The prior team was kicked to the curb. What does that tell you? It tells me that you are the turnaround team...and your manager is counting on your heroics to save the day.

A 5-person team, and 1.5 months to go. The new team has only had the project for 1-2 months, so the new team is not even over the learning curve. Taking a rough guess at the size of this project, it looks to me like there is no way the new team would have been over the learning curve even if the project had no problems at all.

So, I (still) think you've been shafted.

If that is the case - and only you can decide what is true, or what you want to believe - you do not owe anyone an explanation or an apology for getting out of the way of this train wreck. You do need to be discreet about it though.

I doubt seriously that the manager is unaware that the project is in jeopardy, which means that gentle explanations will get you nothing but negative attention. Unless your manager is Mr. Rogers, your future is in jeopardy.

But always remember: do not take career advice from strangers on the Internet.

ContentLicense: CC BY-SA 3.0


问:
Patterns for Integrating search (ex. Lucene) into a .NET desktop application
I am making a .NET desktop application (WinForms+Local PostgreSQL Server) for managing sales in a small store.

I wish to integrate Lucene search facilities into the 'Product Search' module of my software. Are there any good patterns for integrating such Information Retrieval Libraries into existing applications?

Note : The application is still in development and I can always modify the architecture to integrate Lucene.

Note : I know how to use Lucene and have created a simple demo app to test it's capabilities. I am only looking for patterns that integrate such search functionality into Desktop Applications.

Note : Also the main requirement of the integration is to enable the user to quickly search for products/brands/etc and provide a google autocomplete'esque system in the UI.

答:
The main question that comes around is how you manage your index. It's up to you whether you update it periodically or realtime - and this comes down to performance - how much stuff you're putting in there and how often.

As for "patterns" - hmm, add the library, make calls to create and update your index, and then write the UI to search it :)


问:
QFS (Quantcast File System): Scalable for medium "big data" problems or only for extremely large
I am doing some investigating and research into programming "big data", and am particularly interested in QuantCast (QFS) because it is written in my own favourite programming language, C++.

Looking at how this may play a part in the solution to certain "big data" problems, I know this can manage implementation of peta-byte file systems. I would like to know however how scalable it is for big-data systems that are not as hugely big.

I have seen a lot of comparisons between QFS and Hadoop, and how QFS can outperform Hadoop and so anyone who uses Hadoop may consider using Quantcast (if they just want mega performance).

Essentially is it scalable for medium to large projects? (Someone asked the same about BDD but not Quantcast)

(Also I have seen Hadoop and thus Quantcast being called a "database". I would call it a filesystem, on top of which you might build a database but wouldn't call it a database itself).

答:
DISCLAIMER - I work at Quantcast

The "speed at scale" benefits of QFS certainly become more pronounced the larger the scale of the deployment and the more intense the usage, but that's not to say there isn't some benefit for more modest deployments. However, I would grant that if you aren't running your cluster at full capacity 24/7 (like we are at Quantcast) and your cluster is relatively modest, speed isn't your primary motivator for using QFS.

The benefit that is available at any scale is an increase of logical storage capacity for a given hardware deployment over what HDFS offers for the same level of data integrity due to QFS using Reed-Solomon error correction rather than straight duplication (as in HDFS with 3-way duplication). The QFS approach to error correction also increases the failure tolerance for any given data set from 2 nodes (with 3-way data replication) to 3. More fault tolerant and half the physical space translate in to real dollars when it comes to operating a cluster. The value of this can't be understated, as it basically multiplies the usefulness of your capital expenditure. This financial benefits are the reason why we added the Reed-Solomon feature to QFS.


问:
Component based software engineering vs Service Oriented Architecture
What is the real difference between component-based software engineering and Service Oriented Architecture?

Clemens Szyperski and David Messerschmitt present the following five principles that a software component should have:

Multiple-use

Non-context-specific

Composable with other components

Encapsulated

A unit of independent deployment and versioning

Erl recognizes the following characteristics for SOAs:

Loose Coupling: minimum amount of interdependencies between services

Service Contract: the interaction between services is based on a communi-
cation and document agreement

Autonomy: services control the logic they encapsulate.

Abstraction: services hide their internal logic from the external environment
except those parts that are described in the service contract.

Reusability: dividing logic to services promotes reuse.

Composability: services can be assembled from other services

Statelessness: minimum amount of activity specific information is stored.

Discoverability: the existence of discovery mechanisms so that services can
be discovered by their users

A good article is http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.111.9582

UPDATE

As you have noticed, there are already questions about SOA that have an answer. But my question is a little bit more specific, because it looks for a comparison with Component Based Software Engineering.

A similar question to mine is How Service-oriented architecture and Component-based development relate to each other?

答:
SOA is about how different systems communicate with each other. It defines various standards for message formats, transport security etc.

Component based software is about how you build and implement a system. i.e. Take the whole system and divide it into smaller more manageable components.


问:
Disillusioned with agile; how do you prepare for life after release 1.1?
My company is going full steam with the agile process, with multiple agile projects in work.  The first agile team, the proof of concept, carried the product through release and the first post production release.

After this successful effort, the team was quickly disbanded, sent off to help other projects on their agile way.  My disillusionment with agile comes from third and later release stage of the software life cycle.

Agile is good at pulling expert and building moment, getting all excited for a project, but how do you wind down a project and move it stage where existing customers must be kept happy, to keep paying for all that early agile fun?  If you will, the party is over, and this light on documentation, don’t design it till you need it, and keep racing to the next sprint leaves little documentation, little vision, and poor records of why design decisions were made.  This stage of life also has little interest in the initial agile developers, as they are done with that project and are off looking for new exciting teams to start.

I understand, and have lived through waterfall of the problems with long term planning, schedules being missed, and requirements being out of date, but for part that was usable and accepted by the customer, there is information and distributed knowledge of why decisions were made, what steps were taken, and something more supportable in the end.

Basically, what does an agile team need to be doing, what must it do, what must be deliverable, for an agile project to be successful, with success being defined as a sustainable, maintainable, and hopefully revenue generating product?

If the agile software we build cannot be maintained, in a couple years agile will just be another broken promise, which business managers will not pay for, allowing them to go back to the old, micro-manageable waterfall process.

答:
Disillusionment comes from having illusions :-)

My take (wearing Scrum glasses) on these issues are that they are

Mainly caused by a poor "definition of done". If a later sprint needs to clean up after the current sprint, then to me that says that the sprint did not finish it's work.

Contributed to by breaking up a successful team. This is one of the classic methods of stuffing up a product.

To me, a key feature of agile is to maintain a sustainable pace. This comes from knowing the team's velocity, what they can achieve in each sprint. Big changes to the team means big changes in the reliability of past velocity as a predictor of the future. That sustainable pace includes maintenance, and also implies that there is no sudden cut-over.

Teams will, of course evolve, as people come and go, and skill requirements change. But disbanding the whole team makes me shudder.


问:
Standard practices for access control (design pattern)
I'm looking at my interface design and I am struggling to decide which is the most "correct" way to implement role-based access control, given a user and a subject that the user would like to access.

As far as I can see I have three core options (with a fourth being a bastardisation of the first three and a fifth being a tweak of the fourth):

Query the subject with a list of permissions that the user has - subject.allowAccess(user.getPermissionSet)

Query the user with a list of permissions that the subject requires - user.hasPermissionTo(subject.getRequiredPermissions())

Query a third-party to locate the intersections of permissions - accessController.doPermissionSetsIntersect(subject.permissionSet, user.getPermissionSet())

Query either the subject/user, while delegating the "decision" to a third-party class

Have the user attempt to access the subject and throw an error if access is not permitted

I am leaning toward option four - Have the subject contain an accessController field, where calls to subject.userMayAccess(User user) delegate the operation a la:

```<code>class Subject {
    public function display(user) {
        if(!accessController.doPermissionSetsIntersect(this.permissionSet, user.getPermissionSet())) {
            display403(); //Or other.. eg, throw an error..
        }
    }
}
</code>```

.. but then this raises further questions:

should the accessController be a field vs a static class..?

Should a subject know what permissions are required to be able to view it?

where does the principle of least knowledge come into play here, with respect to calling subject.display()? Should callers of subject.display() ever know that access control is in effect? (where subject.display() is a final "template method")

have subject.display() manage access control, throwing an exception where the user does not have the required permission?

What would be considered "best practice" in this situation? Where should responsibility for performing the checks actually occur?

As this is somewhat both an academic excercise which will then progress into implementation, references to design patterns would be appreciated.

答:
The best practice is to use something known as the Interceptor pattern to intercept calls to protected areas.

This can be achieved by use of AOP or cross cutting concerns applied to your access entry points.

The subject should never know about who is able to view it.  This complicates the subject code unnecessarily and there is no reason for it to be required, unless you inadvertently provide a direct access mechanism to the same function.

Preferably the caller and the callee should not know about access, apart from handling rejections.  However, the issue will be dependant on the system you are implementing on and how you gain access to the security credentials/principal for the caller.  For example, in SOAP systems this information is added onto the header of a SOAP message, whereas in a windows system it would be available via the windows authentication mechanism.

If you use the AOP or interceptor pattern approach it would throw any necessary exceptions, and it would be up to the client (caller) to handle any exceptions thrown.

In this way you keep your client, service, and authentication code separate with no intermingling of knowledge or functionality.


问:
Continuous Integration with Bamboo and Maven, Managing Version Numbers?
I am currently developing a product that is broken up into a few main parts: A Server, an Android client, a Desktop client, and a class library for providing common data structures. Currently my team is using Maven (with a private Nexus repo) and TeamCity to do continuous integration, but we're having a ton of problems with builds failing due to version numbering issues. Our current solution involves using the Auto-Increment Versions Plugin for Maven, but any time we make any changes to our pom files we have to manually update the version of the pom file since the version of the pom in Git is now out of date.

My team and I have decided to look at Atlassian Bamboo, and since we are making changes to our workflow we would like to iron out these issues all at once. Here is what we are looking for:

We want to specify a major and a minor build number (such as 0.3) and have the resulting artifact deployed to our repository as major.minor.auto-incrementing-build-number (such as 0.3.2, 0.3.3, 0.4.0).

We want this to be as automatic as possible, since we have several developers and it only takes one person making a mistake to cause a disruption to everyone's workflow.

We would prefer for this functionality to happen in Bamboo if possible, as Bamboo's "clone project" feature would allow us to replicate this functionality across multiple applications quickly, as well as keeping all of our pom files from having a ton of additional code for managing versions.

Has anyone had any experience doing something like this through Bamboo, or is there another approach that I should consider to make this easier?

答:
I find using a snapshot approach using the maven snapshot functionality works fine out of the box.

Maven will automatically grab the latest snapshot release from the repository for a particular major/minor build number.

It then becomes only a matter of updating the major/minor version numbers when you do a release, and maven can do that for you as well through the maven::release command.

I normally use Jenkins/Hudson to build the release and upload the artefacts to the repository on completion of the build.  I have used TeamCity before but find Jenkins a much more featured CI utility.


问:
Using a Public Property AND a Public Field
Where I work, using Properties are discouraged. We have code generation tools to "speed things up". All object data ends up being Public fields. If you request properties anyway, you get something like this:

```<code>Public sFoo as String

Public Property Foo as String
  Get
    Return sFoo
  End Get
  Set(ByVal value as String)
    sFoo = value
  End Set
End Property
</code>```

I can't think of a reasonable argument to do this. Are there any good reasons to use both a Public Property with a Public Field?

答:
Are there any good reasons to use both a Public Property with a Public Field?

In short: No, there are no justification for that. The public properties have more business uses than public fields.

Some of the many uses of properties are:

Properties can validate data before allowing a change

It can transparently expose data on a class where that data is actually retrieved from some other source, such as a database

It can take an action when data is changed, such as raising an event, or changing the value of other fields

As already suggested, using auto-properties is another smart way to go with.

More details in MSDN - VB.NET properties


问:
many include files vs one large include file
The company I work for is in the process of completely overhauling our current intranet site by moving it onto a Drupal framework. One area I am questioning is the number of include files we have. As it exists right now, every single .php page has a corresponding .inc page. There are .inc pages that provide certain functionality, but aren't tied to a specific page. However, each .php page includes multiple files - at a minimum, it will load the .inc page corresponding to it, and a few general scripts. This makes trying to find a function definition a nightmare when debugging.

My options right now seem to be the following:

1)Keep using this same system, but make it part of our convention to include a commented line stating where the function is defined
2) Consolidate all the include files into one large file. This would include class definitions, function definitions, everything. My concern here is that this file would get monolithic in a real big hurry. However, it would have the advantage of keeping all function definitions in one place.

I don't like either option to be honest. My goal is to reduce dependencies and make our code readable and easy to navigate. What is our best method to handle this problem?

I should also state that this is very much legacy code - it hasn't been refactored since it was created in 2003-2004. Just to give you an idea what I'm working with, there is a lot of php echoing html:

```<code>printf("<center>\n");
printf("<table>\n");
printf("<tr>\n");
printf("<td align=left>Select Division:</td>\n");
printf("<td><select name=\"div\">\n");
printf("  <option value=1 \"selected\">Division1\n");
printf("  <option value=2>Division2\n");
printf("</select></td>\n");
printf("</tr>\n");
printf("<tr>\n");
printf("<td align=center colspan=2><input type=\"submit\" value=\"Next->\"></td>\n");
printf("</tr>\n");
printf("</table>\n");
printf("</center>\n");
</code>```

答:
Perhaps the original structure is the result of someone designing the software like a set of C++ classes?

The problem that you have of finding function definitions sounds like a combination of your IDE missing a "go to definition" feature, and the functions not being grouped together in the places that you'd expect. So a third solution would be to regroup the functions to obey some more predictable placement rule.

Of the two options you've given, the first sounds like it would take a lot of discipline, and the second sounds like tossing away benefits from modularity.


答:
I think what you are experiencing is very similar to many other teams who first transitioned to Agile. In my last company when we were told to be agile, almost same thing happened.  This article about Cargo Cult Agile Methodology might resonate with some of the things you've probably experienced in your pre-1.1 era.  The point is that you cannot simply follow rules/guidelines written down without taking a step back and considering what is really important for your team and your specific situation.

The key is that Agile methodology never said that you cannot have documentation. It just seems that way because it eliminated 90% (if not more) of documentation when compared with waterfall. And that's a good thing, but some teams, take "no documentation" a bit too literally and go too far, eliminating 99.9% of documentation. Then they turn on agile as the cause of undocumented product.

I just did a google search to find this article on agile/lean documentation and ended up finding another question with my answer from a year ago that touches upon this same topic.  The bottom line from whatever I wrote there is that I believe design docs are important, but for organizational memory and only when kept at a high enough level. They are almost completely useless when written prior to code.

Same goes for vision and long term direction. Agile methodology suggested that big upfront design is bad. And what they meant is that don't attempt to "sketch out" every nut and bolt of your application using words and then try to code all that up. That doesn't work.  But many teams, my own included, took that a bit too literally and when starting new projects they would jump right into coding without defining overall architecture or coming up with overall rough picture of what final product should look like.  Bottom line is that in Agile you should have just enough documentation so that it helps you to go forward and makes you more efficient (i.e. come up with a vision so the team can work towards a common goal and not have to go back and redo work) but don't create documentation just for the same of producing volume upon volume of design specs that a) no one will ever read and b) will become completely obsolete even before software ships.

At it's very core Agile is incredibly simple. It's about short iterations, eliminating waste and continuous improvement. You should constantly review what wastes your time and makes you less efficient and fix it. If the team sees that they just spent 2 weeks producing documents and those documents are not needed by anyone, that's a waste. However, if the team sees that they are being slowed down by customer calls and their own inability to understand the code that was written, then possibly lack of documentation is the waste.

Title: Disillusioned with agile; how do you prepare for life after release 1.1?

Body:
My company is going full steam with the agile process, with multiple agile projects in work.  The first agile team, the proof of concept, carried the product through release and the first post production release.

After this successful effort, the team was quickly disbanded, sent off to help other projects on their agile way.  My disillusionment with agile comes from third and later release stage of the software life cycle.

Agile is good at pulling expert and building moment, getting all excited for a project, but how do you wind down a project and move it stage where existing customers must be kept happy, to keep paying for all that early agile fun?  If you will, the party is over, and this light on documentation, don’t design it till you need it, and keep racing to the next sprint leaves little documentation, little vision, and poor records of why design decisions were made.  This stage of life also has little interest in the initial agile developers, as they are done with that project and are off looking for new exciting teams to start.

I understand, and have lived through waterfall of the problems with long term planning, schedules being missed, and requirements being out of date, but for part that was usable and accepted by the customer, there is information and distributed knowledge of why decisions were made, what steps were taken, and something more supportable in the end.

Basically, what does an agile team need to be doing, what must it do, what must be deliverable, for an agile project to be successful, with success being defined as a sustainable, maintainable, and hopefully revenue generating product?

If the agile software we build cannot be maintained, in a couple years agile will just be another broken promise, which business managers will not pay for, allowing them to go back to the old, micro-manageable waterfall process.


问:
Pure Java web browser, is it practical?
I know that a Java web browser is possible, but is it practical? I've seen the Lobo project and must admit I am impressed, but from what I've gathered it seems that development stopped in 2009. Would a browser coded in pure Java (no WebKit java bindings of any type) be able to compete with those among the ranks of Chrome or Firefox, or would it be inherently slower, hindering the user?</p>

答:
About the feasibility of a Java web browser written in Java, maybe the wrong question was asked.

I see no need to re-invent the wheel and write a full-fledged browser when most of the existing ones are free and features rich.

That said what I (we?) should be looking for is "something" good enough to read web pages WITHOUT all the crap (re advertisements, videos, gifs) that gets piled on.

Google is the chief offender here with all their ads and such.

To address that I wrote a Java browser that uses the Java HTMLEditorKit with its HTML 3.2 implementation and reads a web page as text, strips all the javascript code, the style code, the links, the meta data (another source of irritation with its auto reload) and attempts to fix some special characters and image links set via javascripts. Hyperlinks and navigation work. For reading stuff like the LA Times, the NY Times, Il Corriere.it, ElPais.es, LeMonde.fr it delivers. Even Bing and Google searches come through. Eventually or when asked I will make it available for free. It is not much but it is a start.

Title: Pure Java web browser, is it practical?


问:
Is it a row or a record (or a tuple)

If I look at a database table for editing - is it made up of rows or records?

If I write some sql and then look at the result is this made up of the same elements as the answer to 1.?

Is it the case that they are all rows but in very specific circumstances they are also records?

EDIT

A recent article by Itzik Ben-Gan prompted my question and I see quite a discussion on dba.stackexchange.

In that article Aaron Bertrand brought up the same Itzik quote from his "Training Kit (Exam 70-461): Querying Microsoft SQL Server 2012"

As an example of incorrect terms in T-SQL, people often use the terms
  “field” and “record” to refer to what T-SQL calls “column” and “row,”
  respectively. Fields and records are physical. Fields are what you
  have in user interfaces in client applications, and records are what
  you have in files and cursors. Tables are logical, and they have
  logical rows and columns.

答:
Record really isn't a a database term with a specific meaning.  Which is not to say you can't use it, just that if/when you do, you should keep in mind that it is at best a useful lie but more likely just context sensitive slang.

Ether way, as long as the person you are talking to understands you, it doesn't matter.

Title: Is it a row or a record (or a tuple)


问:
Passing member variable as a method parameter
In a project, I've found a code like this:

```<code>class SomeClass
{
    private SomeType _someField;

    public SomeType SomeField
    {
        get { return _someField; }
        set { _someField = value; }
    }

    protected virtual void SomeMethod(/*...., */SomeType someVar)
    {
    }

    private void SomeAnotherMethod()
    {
        //.............
        SomeMethod(_someField);
        //.............
    }

};
</code>```

How do I convince my teammates that this is bad code?

I believe this is an unnecessary complication.  Why pass a member variable as a method parameter if you already have access to it?  This is also a violation of encapsulation.

Do you see any other issues with this code?

答:
Some things that come to me when thinking about this:

In general, method signatures with fewer parameters are easier to understand; a big reason methods were invented was to eliminate long parameter lists by marrying them to the data on which they operate.

Making the method signature depend on the member variable will make it harder to change those variables in the future, because you not only need to change inside the method, but everywhere the method is called as well.  And since SomeMethod in your example is protected, subclasses will also need to change.

Methods (public or private) that do not depend on the class internals do not need to be on that class. They could be factored out into utility methods and be just as happy. They have next to no business being part of that class. If no other method depends on that variable after you move the method(s), then that variable should go too! Most likely the variable should be on it's own object with that method or methods that operate on it becoming public and being composed by the parent class.

Passing data around to various functions like your class is a procedural program with global variables just flies in the face of OO design. That is not the intent of member variables and member functions (see above), and it sounds as if your class is not very cohesive. I think it's a code smell that is suggesting a better way to group your data and methods.


答:
What you were doing was not agile, lets go over your points :

light on documentation - Agile is not about "no documentation". It is about creating code that doesn't need documentation and only creating documentation that is necessary.

don’t design it till you need it - In agile, this doesn't mean anything. Just because you are designing later, doesn't mean you aren't designing at all.

keep racing to the next sprint - Agile is not about racing to the next sprint. Major point of agile is to create steady and sustainable development pace. So no matter how big or complex the software gets, the team can add new features and improve quality at same rate as year ago.

leaves little documentation - Again, agile is about having team decide what documentation they need for their work. Major problem with other methodologies is that it is someone else who decides what documents are needed, thus quite often documents give more problems than they solve.

little vision - Which is wrong. The developers themselves don't really need long-term vision. But at least product owner should look year or two into the future and imagine what kind of software they want. There is no need to burden developers with so many what-ifs.

poor records of why design decisions were made - In agile, these records exist in code, developer's memory and documents team created, because the decision was so complex that team decided to record it.

So to answer your question : You cannot be disillusioned with agile, when you never did agile.


问:
In freelance software development, what kind of penalties should firms have when they miss deadlines?
I was talking with a co-developer.

He has a client that wanted to make sure that he delivers on time. The client wants repercussions for missed deadlines.

While I do not do freelance work, I couldn't give an answer.

So, my question is:

What repercussions do you (freelancers) agree upon with your client if you miss deadlines on your deliverables (aside from being fired)?

答:
One of the most effective ones: penalty by day of delay. This is also what is done for large projects, the penalty being sometimes thousands of dollars per day.

If a precise deadline matters (for example if one develops for Olympic Games a web app which will handle the broadcast of the event in 2014, the deadline would be the beginning of the Olympic Games in 2014), then the effective measure could be that in a case when the project is late, the company is not paid at all, and should also pay a penalty.

If such drastic measures are not appropriate, then the sole fact that a well-paying customer will leave if the project is late can do the trick.

Note for the customer:

Many delays are the fault of the customers themselves. Causes can be multiple:

No SRS, but instead two paragraphs describing losely what the customer imagines being his needs (and of course, the customer don't want to pay for requirements gathering, considering this step a loss of time).

Coming two weeks before the final deadline and telling that it doesn't matter that the project was done in Java until now and used Oracle: it is imperative for it to be rewritten in Python and use MySQL, because the customer have read a magazine yesterday telling that those technologies are the future.

Coming with a fresh set of requirements at every meeting. Bonus points when those requirements contradict nearly every requirement given until now.

Good communication is essential for a good project.

Many other delays are due to the lack of communication. Practices where the customer has no communication whatsoever for months with the company and expects to be contacted only once the product is finished and polished invite a disaster.

You get what you pay for.

There are specific procedures which help keep the project organized, and actually, programming should take only 10 to 15% of time for large projects and 15% to 20% of time for medium projects. Those projects should also be done by people who know what they are doing.

In practice, customers are not willing to pay $800/day an analyst who will create architecture and software design, and they don't want to pay for other steps neither. A newbie Albanian programmer who is happy to work for $50/day seems much more advantageous.

Don't complain that the project is a disaster when you're only ready to pay for disastrous projects.

Don't negotiate time required to do the job.

I often encounter the discussions like that:

Developer: given the requirements, I can deliver that in four months.

  Customer: it is impossible. The project should be done in two months.

  Developer: well, unless you cut out some features...

  Customer: I can't! All features are needed. Why can't you do the job in two months? I contacted an Indian programmer, a friend of mine, he can deliver that in one month and a half, and asks only half of the price!

Negotiating time is a recipe for disaster.

Know your priorities.

Take in account the 90%-done rule. When the project is managed incorrectly, it is not unusual to see developers telling that they have done 90% of the project a month after starting the project. Then, a month later, it's still 90%. And a month later.

This can have two causes:

When the project is not done correctly, i.e. 100% of the time is dedicated to programming, which leaves 0% for requirements gathering, architecture, design and testing, what happens is that programmers have no idea about the work to do, and they discover new tasks during the whole life of the project. Preparing the project would help having a larger understanding of all the tasks which should be accomplished.

When the customer is in hurry, it is not unusual for some companies to deliver fast some crap, then spend an enormous amount of time solving bugs. Some companies work only like that, which helps them staying competitive and say that they accomplished a given project in three weeks, even if later, they spent three years solving the mess.

By putting priorities straight and requiring the project to be done correctly helps eliminating those companies from the list of candidates.


问:
How to assure users that website and passwords are secure
On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All passwords are hashed."

On my website, I will be storing all user passwords in a database after using SHA-512 (most likely) hashing with a random salt. I want to add a snipet assuring users that their passwords are secure so they will not be deterred from using my website because it requires a password. I want users to feel secure but I do not think everyone knows what hashing is.

MY QUESTION:
Is it okay to provide a message saying that "All passwords are encrypted and secure" since I do not think that the average user will know what the difference between hashing and encryption is, and will more likely feel secure just because they see the comfort word "encryption"? Or is there an alternative message I should provide?

On a side note, I am new to encryption and password hashing and I was wondering if this would be safe enough for now as I launch my site. I do not want to tell users it is secure if it is not. Any information would be greatly appreciated. Thanks.

答:
Users don't care.

The only time they care is when somebody withdraws the money from their bank account and it appears that it has a link that a few days before, somebody gained full access to your database.

In nearly every case I've seen such messages, they were misleading. The most hilarious one was on a website with "military-grade secure"-style labels on every page. There was an alert telling that HTTP certificate is invalid. There was an SQL Injection on logon form. A few weeks later, the website was hacked, then disappeared forever.

I stop counting the number of websites which claim that they keep the information secure, while having a "Recover my password" form, which actually sends the original password by e-mail.

It's like those "W3C valid XHTML" labels. Why are they usually put on websites where even a home page contains at least dozens of errors and code like
?

If you still want to reassure the users, you can put something like:

Your passwords are kept secure. Remember that we can't see your password and will never send you an e-mail asking you to provide one.

But frankly, the "Reset my password" form replacing the "I forgot my password; send it to me by e-mail" is much more reassuring than any words.

Hints from the different comments:

Don't reinvent the wheel: use OpenID. This way, you don't even store the hashes.

Source: comment by Jan Hudec.

Since you're a student, open source your project. Since your concern is: "I don't want users to think that their passwords are not secure because some kid in school designed it.", there is nothing more reassuring that being able to check, by reading the source code, that it was written by a skillful developer who cares about security.

Source: comment by Jan Doggen.

Body:
Users don't care.

The only time they care is when somebody withdraws the money from their bank account and it appears that it has a link that a few days before, somebody gained full access to your database.

In nearly every case I've seen such messages, they were misleading. The most hilarious one was on a website with "military-grade secure"-style labels on every page. There was an alert telling that HTTP certificate is invalid. There was an SQL Injection on logon form. A few weeks later, the website was hacked, then disappeared forever.

I stop counting the number of websites which claim that they keep the information secure, while having a "Recover my password" form, which actually sends the original password by e-mail.

It's like those "W3C valid XHTML" labels. Why are they usually put on websites where even a home page contains at least dozens of errors and code like <DIV COLOR='red'>?

If you still want to reassure the users, you can put something like:

Your passwords are kept secure. Remember that we can't see your password and will never send you an e-mail asking you to provide one.

But frankly, the "Reset my password" form replacing the "I forgot my password; send it to me by e-mail" is much more reassuring than any words.

Hints from the different comments:

Don't reinvent the wheel: use OpenID. This way, you don't even store the hashes.

Source: comment by Jan Hudec.

Since you're a student, open source your project. Since your concern is: "I don't want users to think that their passwords are not secure because some kid in school designed it.", there is nothing more reassuring that being able to check, by reading the source code, that it was written by a skillful developer who cares about security.

Source: comment by Jan Doggen.


答:
Don't store passwords in the first place! Follow the example of Stack Exchange and let users log in with their identity on another site that provides authentication via OpenID. Implementations are freely available for most common web frameworks.

Or possibly any other protocol. If it is in-house project for some institution (as your comment on the other answer suggests), there almost surely already is a LDAP, Kerberos (Windows Active Directory is based on those two too; apache supports HTTP authentication against them) or some such service for computer login. Just connect to that.

This saves you from storing sensitive information (you'll most probably still have to store permissions, but they are not that critical) and the users from having to remember yet another username and password, so overall win-win.

Title: How to assure users that website and passwords are secure

Body:
On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All passwords are hashed."

On my website, I will be storing all user passwords in a database after using SHA-512 (most likely) hashing with a random salt. I want to add a snipet assuring users that their passwords are secure so they will not be deterred from using my website because it requires a password. I want users to feel secure but I do not think everyone knows what hashing is.

MY QUESTION:
Is it okay to provide a message saying that "All passwords are encrypted and secure" since I do not think that the average user will know what the difference between hashing and encryption is, and will more likely feel secure just because they see the comfort word "encryption"? Or is there an alternative message I should provide?

On a side note, I am new to encryption and password hashing and I was wondering if this would be safe enough for now as I launch my site. I do not want to tell users it is secure if it is not. Any information would be greatly appreciated. Thanks.


答:
Saying:

"This is secure."

is a personal judgment you make about certain technological facts or processes, and this judgment is limited by what you yourself know about security at that time. But can you guarantee without a doubt that your encryption, storage method, etc. will hold up to any kind of attack, even ones you don't know about, or don't know about yet?

Meaning: This statement is in danger of being out of date, perhaps even without your being aware of it.

I therefore tend to agree with the above comment by @JoachimSauer: Just describe what you do, how you save user information, and tell users how this is supposed to make your service secure. Then let the users judge for themselves.


答:
If you want your system to be secure, the strength of the password algorithm is meaningless - most hackers can crack passwords in next to no time, especially if the password chosen is small or is comprised of generic words that the hacker already "cracked and stored" usiong rainbow tables and similar. Read ArsTechnica's article on password cracking for a lot of insight.

What you need to do is assure users that the bad guys cannot get to their hashes in the first place. One security-conscious firm I worked for had a 3 tier web system where the web servers were physically not connected to the database servers. When my boss wanted to put his website on and have direct access to the DB (poorly designed code, 'nuff said) he was told he couldn't have it, and when he pushed... was told there was no wires between them. He had to architect it so it passed all data requests through a middle tier service. And those services were not only secured, but exposed minimal surface to attack, and were locked down. And the DB never exposed any of its tables for reading, only stored procedures that in turn were locked down so only the relevant service had access.

It wasn't as bad to code for as you might think, once you knew the architecture and the separation of each tier, it was quite easy to code for.


答:
One of the fundemental object oriented principles is called Encapsulation. It says that each object should protect it's data from outside modification.

This is done by making all fields private and if possible also make all property setters private. Instead you have to introduce behaviour by adding methods which is used to modify state.

What you are doing is very wrong. In essence it's just functional programming where all classes are only data containers or a way of grouping methods togehter. The former is an anti pattern called Anemic Domain Model.

The problem with that is that the business logic for every domain model is spread out over several places in your application (i.e. every place where the object is modified). Hence it's hard to find bugs related to your business rules as you have to analyze every place where the object is used, instead of just analyzing the object iself.

I've blogged about this here: http://blog.gauffin.org/2012/06/protect-your-data/

Title: Using a Public Property AND a Public Field

Body:
Where I work, using Properties are discouraged. We have code generation tools to "speed things up". All object data ends up being Public fields. If you request properties anyway, you get something like this:

```<code>Public sFoo as String

Public Property Foo as String
  Get
    Return sFoo
  End Get
  Set(ByVal value as String)
    sFoo = value
  End Set
End Property
</code>```

I can't think of a reasonable argument to do this. Are there any good reasons to use both a Public Property with a Public Field?


问:
Is it correct to fix bugs without adding new features when releasing software for system testing?
This question is to experienced testers or test leads.
This is a scenario from a software project:

Say the dev team have completed the first iteration of 10 features and released it to system testing. The test team has created test cases for these 10 features and estimated 5 days for testing. The dev team of course cannot sit idle for 5 days and they start creating 10 new features for next iteration. During this time the test team found defects and raised some bugs. The bugs are prioritised and some of them have to be fixed before next iteration. The catch is that they would not accept the new release with any new features or changes to existing features until all those bugs fixed. The test team says that's how can we guarantee a stable release for testing if we also introduce new features along with the bug fix. They also cannot do regression tests of all their test cases each iteration. Apparently this is proper testing process according to ISQTB.

This means the dev team has to create a branch of code solely for bug fixing and another branch where they continue development. There is more merging overhead specially with refactoring and architectural changes.

Can you agree if this is a common testing principle. Is the test team's concern valid. Have you encountered this in practice in your project.

答:
How does your release to end users work into this process?  Your system test team should be less concerned with the development schedule, and instead focus on the customer release schedule.

There is little point in trying to formally test new features while development continues, because chances are good that your next 10 features are going to touch the same functionality and require them to test those areas again.

They can continue to informally test interim internal releases during development and flesh out their test design (hopefully catching most of the bugs in those new features), but they will need an additional period at the end of development for formal testing of new features and regression testing.

When they estimate 5 days required for testing your 10 new features, what they should be considering is that they need 5 days at the end of the development cycle, before the release to customers, to validate the new features (and probably more time to iterate if bugs are found).  During this period the customer release can be branched off for testing, and new feature development can continue for the next release.

ContentLicense: CC BY-SA 2.5


问:
Is a well written documentation a good enough reason for learning a programming language?
I am learning Python currently which wasn't part of my college curriculum. I was asked in an interview why I chose Python and I replied that it is easy to learn and the documentation is very well written. The interviewer didn't reply whether it was a good enough reason. He looked convinced but I cannot be sure.

Is a well written documentation along with ease of learning a good enough reason for choosing a scripting language? Or should I have elaborated more about the availability of Python libraries and bigger user base of Python?

Just a note. Python wasn't required for the job. The company worked on Ruby-on-rails. Python was in my resume and I think the interviewer just wanted to know what considerations I made as a fresher while choosing a programming language.

答:
No, well-written documentation is not a good enough reason for learning a language.

Badly written documentation is a good reason for not learning one.

There are four reasons to learn a language:

Because it may be a useful tool in your career

Language is a tool. One use a language rather than another because of its benefits in a given context. The fact that a language has a high quality documentation doesn't make it a better tool, or only marginally¹.

The language choice would rather be based on the prior experience, the paradigms (example: functional programming for Haskell), the approaches (example: fully-asynchronous mode for JavaScript as a server-side programming language with Node.js), the interoperability (example: compatibility with nearly every operating system for Java), etc.

Being able to use a tool in your daily life is one of the reasons to learn a language.

Because it broadens your culture and knowledge

Another reason to learn a language is to learn new concepts, paradigms and ways of writing elegant code (example: Haskell). Here again, documentation helps, but is not a sole reason to learn a language.

Because it requires minimum effort to learn it

Another reason to learn a language is because it's simple to learn (example: PHP). Again, documentation contributes a lot, but the language itself is still more important. Moreover, I would avoid telling during an interview that I learnt a language simply because it's easy to learn.

Because it's fun.

The last reason to learn a language is because it's simply exciting to learn either a well-designed language (examples: Haskell, Ruby) or a language for geeks (example: Brainfuck).

In a case of Python, what you can answer is that:

It's a dynamic language. Dynamic languages make it easy to create prototypes and to develop faster when circumstances make strong types not important.

It's elegant. Maybe not as elegant as, say, Haskell, but still the comparison with mainstream web-oriented languages such as PHP is easy to do.

The usage of meaningful indentation is interesting, given that many mainstream languages make indentation only a burden which should have been managed by the IDE in the first place. Haskell compiler and interpreter rely on indentation too, by the way.

Python has an elegant way to work with lists. List comprehensions and generator expressions are interesting concepts for someone who have never used functional programming before.

Django makes it very easy to create web applications fast while keeping code rather clean. This is a huge benefit over many other programming languages.

It's fast enough and powerful enough for large-scale web applications. For example, Dropbox is written in Python. YouTube relies heavily on Python. Reddit, if I remember well, also relies on Python.

¹ A well-written documentation still helps doing things the right way and fast.


答:
If you are like me, you do not use a hammer simply because it has a comfortable handle. You use a hammer because you need it to get something done hammered.

So, no, while good documentation is certainly helpful, it is not a reason in itself to learn a programming language.

Title: Is a well written documentation a good enough reason for learning a programming language?

Body:
I am learning Python currently which wasn't part of my college curriculum. I was asked in an interview why I chose Python and I replied that it is easy to learn and the documentation is very well written. The interviewer didn't reply whether it was a good enough reason. He looked convinced but I cannot be sure.

Is a well written documentation along with ease of learning a good enough reason for choosing a scripting language? Or should I have elaborated more about the availability of Python libraries and bigger user base of Python?

Just a note. Python wasn't required for the job. The company worked on Ruby-on-rails. Python was in my resume and I think the interviewer just wanted to know what considerations I made as a fresher while choosing a programming language.


问:
Are Frequent Complicated Merge Conflicts A Sign of Problems?
On our team, we use Git as our source control. We have several areas of code that are almost independent but have some overlap. Lately we have been discussing workflows and approaches to using source control. One complaint that comes up when I promote using a feature branch workflow is that people often run into complicated merge conflicts that they incorrectly resolve. By complicated, I mean "not obvious as to how to resolve". In light of this, other workflows are being more actively used, such a "pull rebase"-based workflow.

As an advocate of the feature branch approach, I'm not really getting the complaint. Yes, you have to keep your local feature branches up-to-date from master or wherever, but that's about the only real problem I see. I'm thinking that if your merges are always complicated and may have secondary effects, then that's more of a teamwork problem than a Git problem.

Am I correct in thinking this? Are complicated merge conflicts a sign of anything good or bad?

答:
You have a main (master) branch and everybody works in their feature branches.

Work in the feature branches can take anything from few hours to few months.

Every now and then somebody will reverse merge their changeset back into the main branch. Your team lead needs to make sure that only one person does a reverse merge at a time. Once this has been done, you need to forward merge from Main branch into your feature branch. Once everybody does a forward merge, another person can be allowed to reverse merge into main branch. Otherwise too many changes will be reverse merged and you'll have tons of merge conflicts on your forward merge.

Just to clarify the terminology, by "reverse merge" I mean merging from feature branch into main branch, and by "forward merge" I mean merging from main branch into feature branch. Based on what I've experienced before, you are likely to see more merge conflicts on reverse merge, as opposed to forward merge.


答:
Here are my top reasons why to learn a new language:

the rest of the team you are working with uses it, and you are the new guy going to become part of the team.

you want to solve a problem, and language X, or libraries/frameworks for language X seem to provide the best available support for that task

You do it just for educational purposes of your own.

Often for situation 2 there is more than one language or framework suitable to solve the problem. Then well-written documentation may be one of the factors to take into consideration (but other factors also). For point 3, good documentation may be more important, but honestly, if you want to learn a new language just for the sake of learning it, first find a problem you want to get solved, otherwise you will soon loose your motivation, well-written documentation available or not.


答:
You can develop the most secure site on the planet and have really poor user experience. Users will assume that your site is insecure.

You can build the least secure site on the planet and have amazing user experience. Users will assume that your site is secure. At least until it appears on evening news.


问:
MVC Architecture -- How many Controllers do I need?
I have been coding for a while, but mostly scripts and simple applications. I've moved into a new role where it is all about developing Web Apps and using a proper MVC architecture, so I am desperately trying to learn about all that very quickly.

I hope this question is not too similar to "Best Practices for MVC Architecture" but as I am going through a few different tutorials, I noticed that some have multiple controllers for different things.

How many controllers does a single web app need?

I realize this would be difficult to answer without an example so I'll provide one:

Application:

User logs in.

User can do one of three things:

a)  Upload a file (stored in a mongodb database with meta data).

b)  Search for a file.

c)  Log out.

My question is a general one, but I gave the example to help out anyone trying to answer.

答:
I assume that your example will evolve into a complex system.

Application:

User logs in:

LoginController

Its sole responsibility is to handle logins, re-direct or notify user of the outcome.

Upload a file

UploadController

I assume here that you want to upload any type of file. If at later date you decide to upload MP3s and PDFs, then I'd have a base UploadController, MP3UploadController and PDFUploadController.

Search for a file.

SearchFileController

This would suffice for a basic requirement. You can have multiple search controllers at a later date depending on how complex the search logic becomes. The last thing you want to have is a single SearchController with 20 action methods performing different searches.

Log out.

- LogoutController.

One might consider this to be an overkill, but I don't think it is. I think it's clean and nicely separated.

If I were to look at this project structure, I would instantly know what it does and how it's structured. To take it a step further, I would put LoginController and LogoutController into separate area.

I've developed something like this before and it worked really well.


问:
Any languages use the '=>' and '=<' operators?
I'm just curious if there are any programming languages that use the '=>' and '=<' operators for something.

I wonder why these are not commonly used when their variant '<=' and '>=' are so widely used by most languages.

Is there a reason why?

EDIT: I'm not asking why they aren't used for the same task as '<=', but why the operators go unused for anything.

答:
C# (and others) use => as a function declaration token.

The alternatives are used because when spoken it's always "Less than or Equal to" or "Greater than or Equal to" not "Equal to or...".


答:
About =>

C# does.
Look here: http://msdn.microsoft.com/en-us/library/bb311046.aspx

As MichaelT commented, it is used as a Fat comma. From Wikipedia:

It is primarily associated with PHP, Ruby and Perl programming languages, which use it to declare hashes. Using a fat comma to bind key-value pairs in a hash, instead of using a comma, is considered an example of good idiomatic Perl. In CoffeeScript, the fat comma is used to declare a function that is bound to this.

PHP: http://php.net/manual/en/language.types.array.php

Rails: https://stackoverflow.com/questions/969900/ruby-on-rails-what-does-the-symbol-mean

About =<

Prolog uses it as a comparison operator http://www.cse.unsw.edu.au/~billw/prologdict.html#comparison

Title: Any languages use the '=>' and '=<' operators?

Body:
I'm just curious if there are any programming languages that use the '=>' and '=<' operators for something.

I wonder why these are not commonly used when their variant '<=' and '>=' are so widely used by most languages.

Is there a reason why?

EDIT: I'm not asking why they aren't used for the same task as '<=', but why the operators go unused for anything.


答:
Scala and ML use => in pattern matching.

Scala Example :

```<code>x match {
  case 1 => "one"
  case 2 => "two"
  case _ => "many"
}
</code>```

ML Example:

```<code>case shape
of Circle (_, r) => 3.14 * r * r
 | Square (_, s) => s * s
 | Triangle (a, b, c) => heron (a, b, c)
</code>```

Haskell uses it for class constraints :

```<code>(Eq a) => a -> a -> Bool  -- type a should be a member of the Eq typeclass
</code>```

Body:
Scala and ML use => in pattern matching.

Scala Example :

x match {
  case 1 => "one"
  case 2 => "two"
  case _ => "many"
}

ML Example:

case shape
of Circle (_, r) => 3.14 * r * r
 | Square (_, s) => s * s
 | Triangle (a, b, c) => heron (a, b, c)

Haskell uses it for class constraints :

(Eq a) => a -> a -> Bool  -- type a should be a member of the Eq typeclass


问:
How do you keep track of what stage you are at in a program?
Like many, I'm developing a couple of applications on my own (not at the same time) to eventually sell. But I also have websites to run, college work and a social life etc., so often I can forgot what stage I am in programming, especially after holidays abroad.

Are there any techniques that I can use to help me keep track of everything?

答:
Any simple task manager tool will do a job of tracking your projects. The only downside is you need to remember to update them. Something free like Trello is great for keeping track of the stages you are in and what you have completed.

Toodledo is also great for adding priorities to work, if you are worried about deadlines too.


答:
Start with a simple and open source task tracker. It will be very handy in long run. It would also be an opportunity to learn a new type of tool to help you.

There are many alternatives to choose from. The one that i am using is Task Coach. It is a Free flexible open source todo manager featuring hierarchical tasks. You may also get a number of YouTube videos on how to use Task Coach here.

However, my college prefers Trac. This tool offers an issue tracking system and more. It runs by default with SQLite which means plain files. No need for a database server.

(although Trac can be configured to use MySQL or PostgreSQL, too)
However, depending on your changing priorities you may switch to a different open-source task tracker. There are couple of them which are very popular:

chandlerproject.org

taskfreak.com

taskjuggler.org

The following article which specifies features - 11 Open source project management tools.

However, if you look for comparison then the following Wiki page has most of the information.

Title: How do you keep track of what stage you are at in a program?

Body:
Like many, I'm developing a couple of applications on my own (not at the same time) to eventually sell. But I also have websites to run, college work and a social life etc., so often I can forgot what stage I am in programming, especially after holidays abroad.

Are there any techniques that I can use to help me keep track of everything?


答:
There are a number of soft techniques you can use:

Keep a log book of the progress of your project and make a note of where you have got to everytime you finish work

Plan your coding ahead a chunk at a time so you have some record of your train of thought when you come back to it

Only attempt something that can be reasonably be completed in the time you have available. If you're constantly stopping and starting a complex piece of code, it is likely to take much longer to complete

Also, from a coding point of view:

Add TODO comments to your code

Write code stubs for your methods so that the intention of the future code is clear

If the language supports it, write the interface upfront so you can see roughly what is expected from the class

Write descriptive code. Even if someone isn't familiar with the language, it should be easy to at least get a feel for what the code does from the variable/method/class names


问:
What does the "d" mean after linux packages?
I've noticed that a lot of the packages I've been installing on my Ubuntu machine has this "d" at the end.  Googling it doesn't give me any answers that I can find.

For example:

FTP server -
Package called: pure-ftpd

TFTP server -
Package called: atftpd

SSH server -
Package called: sshd

What's up with this "d"?

答:
d is for demon or daemon in this case.

Those packages are the background processes that handle the various connections (FTP, TFTP, SSH) mentioned.

As a hint, the name of the package ("__ server") indicates you're likely going to need a background process running to provide that service.

And here's the Wikipedia quote on daemon

In multitasking computer operating systems, a daemon (/ˈdeɪmən/ or /ˈdiːmən/)[1] is a computer program that runs as a background process, rather than being under the direct control of an interactive user. Traditionally daemon names end with the letter d: for example, syslogd is the daemon that implements the system logging facility and sshd is a daemon that services incoming SSH connections.


答:
Daemon:

In multitasking computer operating systems, a daemon (/ˈdeɪmən/ or
  /ˈdiːmən/) is a computer program that runs as a background process,
  rather than being under the direct control of an interactive user.
  Traditionally daemon names end with the letter d: for example, syslogd
  is the daemon that implements the system logging facility and sshd is
  a daemon that services incoming SSH connections.

[...]

The term was coined by the programmers of MIT's Project MAC. They took the name from Maxwell's demon, an imaginary being from a famous thought experiment that constantly works in the background, sorting molecules.

Title: What does the "d" mean after linux packages?

Body:
I've noticed that a lot of the packages I've been installing on my Ubuntu machine has this "d" at the end.  Googling it doesn't give me any answers that I can find.

For example:

FTP server -
Package called: pure-ftpd

TFTP server -
Package called: atftpd

SSH server -
Package called: sshd

What's up with this "d"?


答:
There are a lot of good tools to track projects for a team, a lot of which are overkill for a single user, and therefore often neglected.  At least for me, one reason I do projects at home is because it's more fun without the overhead.

My preferred method at home is just put my code in a git repository, and add a TODO file to keep notes to myself to keep my place.  The nice thing about git is everything is self-contained in a folder on your disk.  You don't need to maintain a server or a database.  The lower the server maintenance overhead, the more likely I'm able to pick it up later, even if I've switched computers or operating systems in the interim.


问:
Why one would commit changes to version control every three minutes?
The frequency of commits depend on two factors:

the developer himself: some developers tend to commit often, others may spend hours without committing,

the current work: the same developer may have to commit very frequently when effectuating risky refactoring operations or similar tasks, and quite rarely when working on other parts of the codebase.

From what I observed, beginners tend to commit one or two times per day on average. Developers with a few years experience are probably committing once per hour on average. Committing every fifteen minutes is probably the best thing to do, but I've rarely seen this commit frequency.

Question:

I've spotted in Google Closure Library logs that it has commits nearly every three minutes from the same developer.

What are the benefits of such high frequency?

Are there consequences on the way the code is written?

Is it related to the fact that at Google, codebase is compiled and tested on servers and so one should commit the code to see if it compiles and passes all the unit and integration tests?

答:
When you start thinking of commits as their own individual feature, or maybe even more so in the case of a high frequency, a project state, not "saves" or "rollback points", you could often be hitting this frequency of commits during normal development, especially early on in a project.

While I guess a commit every three minutes is quite high, I do sometimes find myself committing every ten minutes or so while mentally breaking down what may be a single feature into small pieces / changesets.


问:
common infrastructure for web apps using asp.net mvc
How to build a common infrastructure for my web apps using asp.net mvc, and efficiently manage it?

The goal is to increase developer productivity. The common infrastructure stuff includes visual & interactive components like customizable menus, consistent web page layout, consistent navigation experience, breadcrumbs, etc. It will also have some api's for user & role management.

So this platform/infrastructure will have its own database & tables (which can be deployed using entity framework). But there are other things which I don't have an answer to:

The database will also have user defined types, stored procs, etc. How should these get "deployed" (or adopted) in the target application?

There would be a set of controllers and views intended for user and role management. They need to be a part of the target project. What is the best way this can be included?

Just to outline the kind of experience a developer should get:

He'd start an MVC project.

Run some command (suitably in the IDE itself - I am thinking powershell or NuGet)

And he should get working...

At some point later, there would have been some updates in the platform...how should they be updated...the problems he might face here...how to resolve them...etc...?

How to design such a infrastructure project?

答:
These sorts of infrastructure projects are pipe dreams of scope creep -- you are hinting at that much yourself with the "user defined types" bits. While there seems to be a pancea of productivity at the end of the rainbow, typically you'll end up with a horribly convoluted project the developers spend more time fighting against than anything else.

If you want to go down this path, you should probably consider adopting a full-blown CMS product such as The Orchard Project (open-source) or SiteCore (commercial). Even if you insist on building your own I would start by looking at those CMS sort of products as that is the kind of things that has solved these problems for you so it is a good place to steal ideas.


问:
How can I conceptually model a craigslist search?
I'm trying to understand how something like this works, but I'm inexperienced and I'm trying to understand how the process would work.

Say you have ten categories, a thousand zip codes, and ten thousand items listed in each category, each of which has a description.

When a user does a search for (e.g.) "guitar hero xbox" in the "video games" category within "50 miles", what happens next?

Would the database compare zip codes first, to find everything in range, then do a SELECT items WHERE category="video games" and zipcode=A OR B OR C OR D, then execute some sort of search on the description of each listing in the result set?

How would that work?

I'm not looking for exact answers about CL, I'm looking for a general idea of how this works anywhere/everywhere.

答:
Many performant search products (either proprietary or otherwise) use Lucene as a basis. Other popular choices for "Big Data" include various forms of NoSQL. Another approach (although this tends to be a bit slower) is full-text searching in a regular SQL database.

These are how some searches similar to craigslist's search work - though I have no idea what craigslist uses to power its searching.


问:
Zero-knowledge code hosting?
In light of recent revelations about widespread government monitoring of data stored by online service providers, zero-knowledge services are all the rage now.

A zero-knowledge service is one where all data is stored encrypted with a key that is not stored on the server. Encryption and decryption happens entirely on the client side, and the server never sees either plaintext data or the key. As a result, the service provider is unable to decrypt and provide the data to a third party, even if it wanted to.

To give an example: SpiderOak can be viewed as a zero-knowledge version of Dropbox.

As programmers, we rely heavily on, and trust some of our most sensitive data - our code - to a particular class of online service providers: code hosting providers (like Bitbucket, Assembla, and so on). I am of course talking about private repositories here - the concept of zero-knowledge does not make sense for public repositories.

My questions are:

Are there any technological barriers to creating a zero-knowledge code hosting service? For example, is there something about the network protocols used by popular version control systems like SVN, Mercurial, or Git that would make it difficult (or impossible) to implement a scheme where the data being communicated between the client and the server is encrypted with a key the server does not know?

Are there any zero-knowledge code hosting services in existence today?

答:
I hate to do one of those 'this isn't quite going to answer your question' answers.. but..

I can think of two ready solutions which should address these worries.

Host a private Git server on your own. Then put that server on a VPN to which you give your team members access. All communication to and from the server would be encrypted, and you could of course encrypt the server at the OS-level.

BitSync should do the trick as well. Everything would be encrypted, and in a huge network which would be available from anywhere. Might actually be a really good application of all this BitCoin/BitMessage/BitSync technology..

Lastly, the folks over at https://security.stackexchange.com/ might have some more insight.

Title: Zero-knowledge code hosting?


问:
How do I go about debugging a PHP error?
I am coming from .NET to PHP. I am playing around with a long file written by someone else (called "cryptographp.inc.php"). It builds and returns an image to the browser.

I want to show the image that the file returns on my Cryptocode/index.php page--like this:

```<code><?php
include './cryptographp.inc.php';
?>
</code>```

But when I load the page, firefox returns an error saying

```<code>"The image http://localhost/Cryptocode cannot be displayed because it
contains errors"
</code>```

How would I go about debugging an error like this in PHP? I am used to stepping through code in visual studio. What techniques would people use in the PHP world?

答:
In short: I would start by enabling my development environment to catch the errors. There are some setting you would need to set.

For the syntax errors, you need to enable error display in the php.ini. By default these are turned off because you don't want a customer seeing the error messages. Check this page in the PHP documentation for information on the 2 directives: error_reporting and display_errors. display_errors is probably the one you want to change. If you can't modify the php.ini, you can also add the following lines to an .htaccess file:

```<code>php_flag  display_errors        on
php_value error_reporting       2039
</code>```

You may want to consider using the value of E_ALL (as mentioned by Gumbo) for your version of PHP for error_reporing to get all of the errors. more info

Three important points to consider:

Check the error log file as it will have all of the errors (unless logging has been disabled).

Adding the following 2 lines will help to debug errors that are not syntax errors:

error_reporting(-1);
ini_set('display_errors', 'On');

Use an editor that checks for errors why you type, such as PhpEd. It also comes with a debugger which can provide more detailed information. (The PhpEd debugger is very similar to xdebug and integrates directly into the editor so you use one program to do everything). The "xdebug" will make your reports much nicer as well.

Cartman's link also has very good guidelines to follow: http://www.ibm.com/developerworks/library/os-debug/

References and blog posts:

How to Debug in PHP

Turning on PHP Debugging and Error Messages

Mediawiki - PHP Errors

Body:
In short: I would start by enabling my development environment to catch the errors. There are some setting you would need to set.

For the syntax errors, you need to enable error display in the php.ini. By default these are turned off because you don't want a customer seeing the error messages. Check this page in the PHP documentation for information on the 2 directives: error_reporting and display_errors. display_errors is probably the one you want to change. If you can't modify the php.ini, you can also add the following lines to an .htaccess file:

php_flag  display_errors        on
php_value error_reporting       2039

You may want to consider using the value of E_ALL (as mentioned by Gumbo) for your version of PHP for error_reporing to get all of the errors. more info

Three important points to consider:

Check the error log file as it will have all of the errors (unless logging has been disabled).

Adding the following 2 lines will help to debug errors that are not syntax errors:

error_reporting(-1);
ini_set('display_errors', 'On');

Use an editor that checks for errors why you type, such as PhpEd. It also comes with a debugger which can provide more detailed information. (The PhpEd debugger is very similar to xdebug and integrates directly into the editor so you use one program to do everything). The "xdebug" will make your reports much nicer as well.

Cartman's link also has very good guidelines to follow: http://www.ibm.com/developerworks/library/os-debug/

References and blog posts:

How to Debug in PHP

Turning on PHP Debugging and Error Messages

Mediawiki - PHP Errors


问:
How do you find the first common element in two arrays
How do you find the first common element in two arrays?

My attempt:

I looped through each at the same time and add the current value to a separate set for each of the lists. Also, check if the current element is already in the other list's set.

I have no idea if this works though and if so, why? I know it finds a common element but does it find the first common element? I can't think of counter examples but I'm having trouble convincing myself it's definitely correct. Also, even if it is correct, is there a better way of finding the first common element?

答:
Say first array A has length n and second array B has length m.

Whichever is smaller in length, loop through it and put it's elements in a LinkedHashSet (it doesn't matter if it's sorted or unsorted). Then loop through the second array and query the set for that element. Wherever you find your first common element, break.

Space complexity: O(m) assuming m is the smaller or equal to n
Time complexity: O(n)

```<code>//Java-like pseudo code
class FirstCommonFinder {
    Element[] firstInput = {….};
    Element[] secondInput = {….};
    Set smallerInput = new LinkedHashSet<>();
    boolean found = false;
    //assuming firstInput is smaller than secondInput
    for (Element input: firstInput) {
        smallerInput.add(input);
    }</p>

```    //loop through and break upon first common occurrence
    for (int i = 0; i < secondInput.length; i++) {
        if (smallerInput.contains(secondInput[i])) {
        found = true;
        break;
    }
}
```

<p>}```

In case if you want to keep track of the indices in both input arrays (for commonly occurring elements), use a LinkedHashMap and put the array index as value to the element key.

Body:
Say first array A has length n and second array B has length m.

Whichever is smaller in length, loop through it and put it's elements in a LinkedHashSet (it doesn't matter if it's sorted or unsorted). Then loop through the second array and query the set for that element. Wherever you find your first common element, break.

Space complexity: O(m) assuming m is the smaller or equal to n
Time complexity: O(n)

//Java-like pseudo code
class FirstCommonFinder {
    Element[] firstInput = {….};
    Element[] secondInput = {….};
    Set smallerInput = new LinkedHashSet<>();
    boolean found = false;
    //assuming firstInput is smaller than secondInput
    for (Element input: firstInput) {
        smallerInput.add(input);
    }

    //loop through and break upon first common occurrence
    for (int i = 0; i < secondInput.length; i++) {
        if (smallerInput.contains(secondInput[i])) {
        found = true;
        break;
    }
}

}

In case if you want to keep track of the indices in both input arrays (for commonly occurring elements), use a LinkedHashMap and put the array index as value to the element key.


答:
The issue is that if they test the bugs on a branch they still need to retest and regression test them on the trunk once they're merged back in (unless they're very trusting which good testers rarely are).  This isn't just making more work for the developers, it's making more work for the testers.

There is no right answer here but a few things you should consider:

Might these bug releases (without the new functionality) ever go to the users?  If so then yes, it must be branched and tested and everyone needs to accept that as an overhead.

Is it possible to divide the new functionality out in such a way that it exists in entirely separate areas of the application to the previous chunks that were worked on?  If so this gives you options - the testers can carry out the bug retests and regression test parts of the application.  It's not ideal but it's a compromise that might work and give them some of what they want.

How much work really is it to branch them a release?  Generally it's a pain but the actual amount of work isn't normally that great.  Obviously you'd need them to confirm it's not just more work for them too (see the very first thing I say) but I've seen places make this work.

Is there a better way to use version control here?  Something like Mercurial (see http://hginit.com/ - read it, it's good) or another distributed version control system branches and merges in a different way and may allow you to get round the problem.  Really, have a look at it because I think it might be the answer to your problem.

But good luck, it's a pain.  Above all remember that best way forward will be very dependent on your company, product and situation so make sure you think about that and don't just pull something off the shelf and believe you must adhere to it 100%.

Title: Is it correct to fix bugs without adding new features when releasing software for system testing?

Body:
This question is to experienced testers or test leads.
This is a scenario from a software project:

Say the dev team have completed the first iteration of 10 features and released it to system testing. The test team has created test cases for these 10 features and estimated 5 days for testing. The dev team of course cannot sit idle for 5 days and they start creating 10 new features for next iteration. During this time the test team found defects and raised some bugs. The bugs are prioritised and some of them have to be fixed before next iteration. The catch is that they would not accept the new release with any new features or changes to existing features until all those bugs fixed. The test team says that's how can we guarantee a stable release for testing if we also introduce new features along with the bug fix. They also cannot do regression tests of all their test cases each iteration. Apparently this is proper testing process according to ISQTB.

This means the dev team has to create a branch of code solely for bug fixing and another branch where they continue development. There is more merging overhead specially with refactoring and architectural changes.

Can you agree if this is a common testing principle. Is the test team's concern valid. Have you encountered this in practice in your project.


问:
Design Pattern for Server, where application is single-page RIA
So I'm using Node and ExtJS server-side/client-side respectfully. By using ExtJS, I'm moving a lot of the presentation logic client-side. Thus, something like MVC wouldn't make sense server-side since the view-logic is all client-side.

At this point, my Node server's responsibilities are essentially:

Act as proxy to persistent storage (MongoDB) for ExtJS stores

User validation/sessioning with Windows Active Directory

Hooking-in with existing Enterprise infrastructure (databases, Salesforce.com, etc).

Well I know design patterns aren't the end-all-be-all, and conforming to a design pattern can in some cases impede progress, but I'm relatively new to web-programming in general. I'd like to use a pattern to start just so I don't make any major architectural decisions that will haunt me for the rest of the project.

Is there a pattern will suited for my needs that I could lean-on?

答:
Not sure what the pattern should really be called, "AJAXing" perhaps.

What you are (should be?) doing is shipping the "model" to the client, then implementing the Controller in JavaScript on the client to produce a view in the browser.

So it is essentially still MVC.

But this oversimplifies the pattern as you are unlikely to be shipping the entire database to the client so you still need to implement a data access/model building layer on the server, control however should still reside in the JavaScript client.


问:
Authenticating users for a website
I'm working on a website and I want to validate that an individual is an employee at one of a large number of companies (probably using their company's email address, which I don't know before hand). The idea being some users are the general public and others are from these companies. And I need some way to authenticate that the users claiming to be employees are being honest while still having a friendly enough UI.

I did an informal survey of people I know and the domains and emails will match in a majority of cases but they might not always match exactly so you might have a company with a website foo.com and an email billy@foobar.com (although foobar.com did redirect back to foo.com).

And while I can easily check that I'm not sure what other variations might be out there (maybe fooLA.com and email billy@foolosangeles.com, etc.)

答: You can let someone with an email under an unregistered domain create a corporate account and verify by replying. If someone at the company doesn't approve of this person creating or being an admin on the account, they can deal with it themselves. Later you can monitor domains setup that do not navy any activity or a minimum number of email addresses registered. I think this is how Yammer worked when I signed up. You could search to see if the company is legitimate as well.</p>

Title: Authenticating users for a website


问:
Programming *into* a language vs. writing C code in Ruby
Code Complete states that you should aways code into a language as opposed to code in it. By that, they mean

Don't limit your programming thinking only to the concepts that are supported automatically by your language. The best programmers think of what they want to do, and then they assess how to accomplish their objectives with the programming tools at their disposal. (chapter 34.4)

Doesn't this lead to using one style of programming in every language out there, regardless of the particular strengths and weaknesses of the language at hand?

Or, to put the question in a more answerable format:

Would you propose that one should try to encode one's problem as neatly as possible with the particulars of one's language, or should you rather search the most elegant solution overall, even if that means that you need to implement possibly awkward constructs that do not exist natively in one's language?

答:
Would you propose that one should try to encode one's problem as neatly as possible with the particulars of one's language, or should you rather search the most elegant solution overall, even if that means that you need to implement possibly awkward constructs that do not exist natively in one's language?

The point is that good programmers don't have a language. The quote from the book talks about "programming tools at their disposal" - that means if you know perl and Java, then maybe you should use perl for that quick string manipulation. Programming languages aren't boxes to limit us, but tools we use to solve problems. This is (imo) what Code Complete is getting at. Don't code in a programming language/environment box, put the best solution into the best programming language/environment for you, your problem, and your solution.


问:
Good practice to use namespace or prefix to indicate what file function is from?
For example, I have the function generate_salt() in encryption.file but the person may not know where generate_salt() is from. Using a namespace like encryption::generate_salt(), or encryption_generate_salt() for every function in the encryption.file. Or would it be a waste of space and typing because some IDEs can navigate you to the function?</p>

答:
YES.  Unless your code is stored in an opaque binary file,  any operating system you could program on can scan text files for a function declaration.

Now, namespaces themselves are excellent tools in any language that supports them.  But a large part of their utility is that they help make code polymorphic.  You can replace the entire encryption namespace without needing to hunt through your code, and with excellent tools even change the namespace entirely in a single action.

But the "namespaces" is not necessarily going to map to a specific file.  You may need to import them from a library, or have a namespace contained in several text files.  And you may need to change these later on, and if the functions are named for their files you wind up with either an artificial restriction or an inconsistency, neither of which make anyone's lives easier.

(naming your FILES and DIRECTORIES for the functions they hold is a different matter, and is a very good idea.  Because you might develop each function in its own file, and later combine or re-seperate them.)


问:
Is it bad to place "include directive" within main function?
It is always said that the include directives should be placed at the beginning of a script. The main reason is to make the functions available throughout the script. Regardless of this fact, is it bad to place an include directive within the main function where it is needed?

For example,

```<code>#include <stdio.h>
int main() {
#include <mysql.h>
}
</code>```

Instead of

```<code>#include <mysql.h>
#include <stdio.h>
int main() {
}
</code>```

I was unable to find any different in performance or compiled file size, but it is difficult to judge about this fact based on simple scripts. I wonder if it has any effect or drawback, or any reason to avoid this non-standard approach.

答: C programmers, on the whole, will expect the #include directives to be at the beginning of the file.  Why risk confusing them without any significant benefit?


问:
Generally speaking can a Javascript-based application (iUI) be deployed without a webserver?
Suppose I have a Javascript based application written in iUI or Kendo UI.  Can it be packaged in such a way they can run locally without a webserver?

I have a few web applications, that with some rework and HTML5 LocalStorage, can possibly work offline (in an airplane or subway).

My mobile development experience is limited to Blackberry Playbook, which I only did so I can get a free one a few years ago.  That platform supports "mobile applications" based on HTML, and an additional out-of-band packaging set of tasks.

Question

Are other platforms (iPhone, Android, etc) similar in that I can simply package an iUI based application so that it can run offline or on a webserver?

答:
Yes, any client-side JavaScript library can be included in a phonegap-style mobile application, and provide useful ui within the scope of the "client" in the phone, without running either a full http server locally or connecting to a remote computer.

Of course, depending on your definition of "server", the background framework that interacts with the device and sends files to the web browser control could be considered one.

(and you couldn't run php style code without an interpreter of some kind, but that can be done in the context of a mobile app.)