答:
They should not; first method for me.

When I look at the second one, because of the unused lines (those only having braces on it, other than the very last closing brace), it feels like it breaks the continuity of the code. I can't read it as fast because I need to take special attention to empty lines which usually mean a separation in code purpose or something like this, but in no case "this line belongs to a curly brace" (which only repeats the meaning of indentation).

Anyway, just like when you write text... adding an indentation at the beginning of a paragraph is superfluous if there is a blank line before it (double sign of paragraph change), there is no need to waste lines for braces when we are properly indenting.

Plus, as already stated, it allows to fit more code in the screen, which otherwise is a little bit counterproductive.

Title: Should curly braces appear on their own line?

Body:
Should curly braces be on their own line or not? What do you think about it?

```<code>if (you.hasAnswer()) {
    you.postAnswer();
} else {
    you.doSomething();
}
</code>```

or should it be

```<code>if (you.hasAnswer())
{
    you.postAnswer();
}
else
{
    you.doSomething();
}
</code>```

or even

```<code>if (you.hasAnswer())
    you.postAnswer();
else
    you.doSomething();
</code>```

Please be constructive! Explain why, share experiences, back it up with facts and references.


问:
Are there any valid ways of eliminating/reducing state?
For definitions and examples of "state", see: http://en.wikipedia.org/wiki/Program_state , http://en.wikipedia.org/wiki/Finite_state_machine , http://en.wikipedia.org/wiki/State_diagram

A diagram showing a very easy example, notice how the current state changes how the turnstile operates when the same input (inserting a coin, pushing on the turnstile) is given twice in a row: http://en.wikipedia.org/wiki/File:Turnstile_state_machine_colored.svg

I thought about this question for a bit and came up with nothing other than:

Reduce the scope/features of the project/software.

Push the burden of making intelligent decisions to the user and/or supply the program with a "cheat sheet" that makes decisions easier (for example: instead of trying to write a program that drives a car using only two webcams, you could embed waypoint markers in the road every 100 ft, place special reflective markers in between lanes, and use a database of terrain maps to help the program make decisions; one would require the work of a Tesla/Newton -level genius [assuming the program can do things like (1) dodge animals, the remnants of exploded tires, etc. while taking less drastic measures for things like cardboard and plastic bottles, (2) deal with the occlusion of landmarks and indicators caused by other vehicles, (3) adjust to weather, etc. conditions, and so on] vs. someone who can write a "connect the dots" algorithm)

PS: I would classify these two methods as "cheating" because you are significantly changing the input/output of the program.  In the first case, you are whittling away your program to nothing, and in the second, you are shifting much of the burden of decision-making onto whoever maintains the database and transit system.

Are there any valid ways of eliminating/reducing state?

答:
The turnstyle example is already at the 'minimal' state needed to work. It has a locked state. You can trick this by changing the object (having a LockedTurnstyle and an UnlockedTurnstyle), but that mostly obscures the state rather than eliminating it.

In most code though, the problem is not so clear cut. In most cases, the code has state that it does not strictly need to operate. Reducing that unneeded state is much of what you'll end up doing in practice.

Further, state in and of itself isn't that bad. Varying state is the more troublesome culprit. By making state invariant at certain limited times or situations will reduce many of the practical problems in software. This too is what you'll end up doing to get practical benefits in software engineering.

ContentLicense: CC BY-SA 3.0


问:
Does it still make sense to think about effective code on micro scale in C++?
Early in my programming career I was in love with pointer twiddling, lean code, doing everything with as little layers of abstraction as possible and so on. The code was very C like I would say, close to metal and clever.

Time has passed, I have a lot more experience, and I'm noticing my attitude towards the code has changed.

And with changed, I mean, I don't want to bother about everyday stuff anymore, unless it's super easy to do.

If there is a string concatenation, I will never choose raw pointers deliberately. If I need to concatenate stuff, I might add a quick guess reserve for an STL container, but I don't want to bother with preallocated buffers, C like APIs, caches, avoiding hitting the disk, or trashing. I know realloc might happen from time to time, including all the heap locks, extra copying and so on, but I don't even bother anymore.

Maybe, it is because I have spent some time early in my career where I thought of a clean and beautiful schemes with worker threads that process large amount of trivial data, only to find out later that the whole unoptimized realloc+copy+realloc+copy+realloc+copy+5 layers of wrappers doesn't even register in profiler.

Maybe it's because I've seen how compilers sometimes do magic.

However, such trivial things do add up. When all your code base uses higher order constructs, it has chances that there will be some realloc all over the place, or cold disk hits, that can cause a general perception of a slow application.

Sort of like WTL vs MFC. Or how you instantly know that the application is written in Java when you launch it.

But is it really? Is there any comparisons of software that's using only very lean and smart code vs software that uses generic containers all over the place?

Would you even feel a difference if the string allocation throughout the program would be using prereserves and smart moves vs lazily calling string.append in every place where there is a need for such functionality?

Do you try to implement mitigation solutions for such simple, well known things that are cheap to execute anyway?

Can software turn into bloatware just because extra caution is not applied to every line of code?

答:
Yes, of course, in the right places. Would you rely on well tuned libraries such as the C++ standard libraries if they were written poorly and 10 times slower than they are today? Would everybody you've worked with have the same response to the previous question?

"C like" and "clever" aren't generally compliments in C++. Generic containers aren't inherently slow. In C++, abstraction layers can be written such that they cost next to nothing at runtime (if that is a concern).

Your energy (assuming it is finite) should not be evenly divided among lines. instead, look at the areas which get the most reuse/use and which more commonly serve as the foundation of other implementations if speed, size, and/or resource utilization are considerations. Staying close to the metal is easy when you are reusing and writing good implementations.

As libraries, kernels, hardware, compilers, etc. vary and advance, you will realize that you can't predict the optimal solution for every platform/system. You can't always win, nor should one attempt to always win given those great variations (consider somebody always twiddling implementations which use std::string for multiple SSO sizes). However, inefficient general purpose abstractions can quickly add up and cost several times more than well executed and efficient implementations.

The bottom line is "Yes, lazily written programs can easily be many times slower and resource hungry than well written programs".

Whether your drawing code (as an example) needs to be (or should be) ten times faster than it is today is another question. If the program were a small one trick pony, then it may not need any additional optimization. As complexity grows, these inefficiencies and poor resource utilization quickly become very significant problems. If you know the users will take your program to the ceiling of the hardware's capabilities often and time or performance are critical, you should take some time to consider multiple approaches to an implementation, and to write programs which are efficient early on.

Imagine how much better your computing experience would be if all programs you use today were 10 times faster, used far less memory, used good parallel forms, etc. -- the complexity of software grows almost as fast as hardware advances, but a lot of that 'growth' is also bloat and implementations which have not been well optimized. There's a lot of room for improvement.


问:
How do you disarm a cowboy coder?
I found a question (code cowboy on the team), but it was more related to "Ninja Coder" then the problem that I have.

I have a team member who is a pure living example of "Cowboy Coder".
I do understand that one can't change people, but is a way to make him stop behaving like a "Cowboy Coder"?

He refuses to listen to the team, and he recently stopped code reviews, unit testing, sharing the implementation details, etc.

Yes, he "codes" fast, but his code is just a bug generator. Other team members and I are in a "bug fixing phase" and 80% of bugs comes from his code. I don't want to fix his bugs. And management is blind, or doesn't want to see this, or maybe they like his "speed".

Is there any way that I (as his younger colleague by age, not his boss) can do something about it?

How can I disarm this cowboy coder?

I feel like I'm the last one who really cares about the project at all.

答:
Go to management with your statistics about how many bugs/issues are coming from this one developer. Explain to them that fixing their bugs affects your team's productivity. If indeed 80% of issues are coming from one person, that definitely needs to be addressed. As long as you explain it to management in terms they can agree with (i.e. "time wasted is money wasted"), they will intervene.

Also, this developer should be fixing their own bugs/issues, so it may be helpful to assign these issues to them. Your team should not be covering for this one person.

Title: How do you disarm a cowboy coder?


问:
How important is an SSL certificate for a website?
I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's justified, really!) I'd need one of those expensive certificates that cover subdomains.

As I'm doing this out of my own time and money, so I'm hesitant to drop a couple of hundreds on a certificate, plus a couple of hours delving into something I haven't tried before. I'm not storing any sensitive information besides the email address and the password. As far as I understand, the only vulnerability happens when a user logs or signs up from an unencrypted network (such as a coffee shop) and someone is listening the network.

Am I being cheap? Is this something I should tackle before releasing into the wild. I probably should mention I have 25,000 users signed up to be notified when I launch, so I'm nervous about it.

答:
Passworrds should be treated as personal information -- frankly given password reuse, it is probably more sensitive than a SSN.

Given that and your description, I wonder why you are storing a password at all...

I would use OpenID and if you feel the need to have your own login, create a single subdomain for that, and use OpenID everwhere else.

If you won't do OpenID, you can still use the same login.yourdomain pattern to keep from needing a wildcard certificate, but like I said, in todays world passwords are at least as sensitive as SSN/birthday, don't collect it if you don't have to.


问:
Does "Property" in C# cost much?
I have a class created in some namespace, like SomeNameSpace.SubNameSpace.StaticClassName

Here is a code snippet from other code file where I want to use this class many more times, so I created a property in the code file like this

```<code>//Just to provide an Alias for long name "SomeNameSpace.SubNameSpace.StaticClassName.PropertyName"
public StaticClassName ServerProxyAlias
{
    get
    {
        return SomeNameSpace.SubNameSpace.Instance.PropertyName;
    }
    set
    {
        SomeNameSpace.SubNameSpace.Instance.PropertyName = value;
    }
}
</code>```

Is there any problem in doing like this ?

答: So you are creating a class for the sole purpose of being able to use a shorter name? Don't you have enough classes in your system already? Good software developers work hard to make their system easier to understand. You seem to be working hard to make it more convoluted and difficult to understand.</p>

Title: Does "Property" in C# cost much?


答:
The language doesn't make a big difference in what it makes sense to care about. If you're working on a project where your code is currently 4.2 KiB, and you need to add two more functions, and fit the result into a 4 KiB ROM, then coding to minimize size probably makes a lot of sense.

On the other hand, if you're coding for desktop machines, where 16 gigabytes of RAM and 2 Terabytes of drive space costs a total of about $200, spending a lot of time on making sure your code is the smallest and fastest it could possibly be is probably misplaced zeal.

The obvious place the language enters the question is that in the case of C++, a lot of work has been put into providing higher-level constructs while minimizing the penalty associated with using them instead of tailoring all the code to the exact task at hand. This wasn't always the case -- years ago, Alexander Stepanov wrote a benchmark showing the penalty associated with using the higher level constructs in the standard template library. Most of the tests had at least two or three "steps" from code written in maximally C-style to code taking full advantage of the standard containers, algorithms and iterator.

When it was new, it was pretty much a given that every step you took away from C-style code toward making more complete use of containers/algorithms/iterators had a penalty, so by the time you got to the maximally-STLish version, it was often anywhere from 2 to 5 times slower (and sometimes closer to 10 times slower).

With current compilers that's no longer the case -- in fact, it's no longer all that rare for the C-like code to actually be a bit slower than the STL code (though rarely by enough to care much about).

This has taken a great deal of effort on the part of compiler vendors -- but since they've done that work, it usually makes the most sense to take advantage of it. The fact that you can write equivalent code much more quickly and easily it handy -- but the fact that in the process you typically reduce bugs dramatically is generally much more important.

Title: Does it still make sense to think about effective code on micro scale in C++?

Body:
Early in my programming career I was in love with pointer twiddling, lean code, doing everything with as little layers of abstraction as possible and so on. The code was very C like I would say, close to metal and clever.

Time has passed, I have a lot more experience, and I'm noticing my attitude towards the code has changed.

And with changed, I mean, I don't want to bother about everyday stuff anymore, unless it's super easy to do.

If there is a string concatenation, I will never choose raw pointers deliberately. If I need to concatenate stuff, I might add a quick guess reserve for an STL container, but I don't want to bother with preallocated buffers, C like APIs, caches, avoiding hitting the disk, or trashing. I know realloc might happen from time to time, including all the heap locks, extra copying and so on, but I don't even bother anymore.

Maybe, it is because I have spent some time early in my career where I thought of a clean and beautiful schemes with worker threads that process large amount of trivial data, only to find out later that the whole unoptimized realloc+copy+realloc+copy+realloc+copy+5 layers of wrappers doesn't even register in profiler.

Maybe it's because I've seen how compilers sometimes do magic.

However, such trivial things do add up. When all your code base uses higher order constructs, it has chances that there will be some realloc all over the place, or cold disk hits, that can cause a general perception of a slow application.

Sort of like WTL vs MFC. Or how you instantly know that the application is written in Java when you launch it.

But is it really? Is there any comparisons of software that's using only very lean and smart code vs software that uses generic containers all over the place?

Would you even feel a difference if the string allocation throughout the program would be using prereserves and smart moves vs lazily calling string.append in every place where there is a need for such functionality?

Do you try to implement mitigation solutions for such simple, well known things that are cheap to execute anyway?

Can software turn into bloatware just because extra caution is not applied to every line of code?


答:
Is there any way that I (as his younger colleague by age, not his boss) can do something about it?

Peer pressure and leading by example are the only good ways. The best ways are done by their boss/lead. If you're not their boss/lead then talk with those who are. But in the end it's their job to take care of it, not yours. Make sure you're doing a good job and things tend to work themselves out.

Title: How do you disarm a cowboy coder?

Body:
I found a question (code cowboy on the team), but it was more related to "Ninja Coder" then the problem that I have.

I have a team member who is a pure living example of "Cowboy Coder".
I do understand that one can't change people, but is a way to make him stop behaving like a "Cowboy Coder"?

He refuses to listen to the team, and he recently stopped code reviews, unit testing, sharing the implementation details, etc.

Yes, he "codes" fast, but his code is just a bug generator. Other team members and I are in a "bug fixing phase" and 80% of bugs comes from his code. I don't want to fix his bugs. And management is blind, or doesn't want to see this, or maybe they like his "speed".

Is there any way that I (as his younger colleague by age, not his boss) can do something about it?

How can I disarm this cowboy coder?

I feel like I'm the last one who really cares about the project at all.


答:
I see a few options:

Approach the coder with your concerns.  It must be done as constructive criticism with specific points.  Before taking bigger steps it's appropriate to raise concerns directly and in private to give the person the opportunity to change.

Gather information and statistics and bring it to management.  Management might not appear to care, but it's often important to make the effort anyway in case it works.  Possible negative consequences include alienating others who don't appreciate complaints to management.

Find a peer of the cowboy coder and discuss it in private.  He/she might have a better chance at getting the person to listen.

Ask to work on another team. Won't solve the problem but you'll keep your sanity. At the very least always work to the best of your ability and don't let it drag you down.

Leave the organization if no one will listen.  It sounds like a bad environment.

Title: How do you disarm a cowboy coder?


问:
What is meant by "Now you have two problems"?
There is a popular quote by Jamie Zawinski:

Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems.

How is this quote supposed to be understood?

答:
jwz is simply off his rocker with that quote. regular expressions are no different than any language feature - easy to screw up, hard to use elegantly, powerful at times, inappropriate at times, often well documented, often useful.

the same could be said for floating point arithmetic, closures, object-orientation, asynchronous I/O, or anything else you can name. if you don't know what you are doing, programming languages can make you sad.

if you think regexes are hard to read, try reading the equivalent parser implementation for consuming the pattern in question. often regexes win because they are more compact than full parsers...and in most languages, they are faster as well.

don't be put off of using regular expressions (or any other language feature) because a self-promoting blogger makes unqualified statements. try things out for yourself and see what works for you.

ContentLicense: CC BY-SA 2.5


问:
What is the logic behind filtering/sanitizing input?
I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database.

But I see that some frameworks provide automatic XSS filters for incoming POST and GET data. What is the logic behind this solution? I can't see any advantages in doing this except providing a quick and easy solution to "lazy" developers.

Or is there some specific security reason I don't understand?

答: My preference is to always validate input and filter output.  Filtering input will often save time and help the lazy, but it's always possible your output filtering will need to change or you'll want to analyze the raw data for security or statistical reasons.</p>


问:
Is it worth moving from Microsoft tech to Linux, NodeJS & other open source frameworks to save money for a start-up?
I am currently getting involved in a startup, I am the only developer involved at the moment, and the other guys are leaving all the tech decisions up to me at the moment.

For my day job I work at a software house that uses Microsoft tech on a day to day basis, we utilise .NET, SqlServer, Windows Server etc. However, I realise that as a startup we need to keep costs down, and after having a brief look at the cost of hosting for Windows I was shocked to see some of the prices for a dedicated server. The cheapest I found was £100 a month. Also if the business needs to scale in the future and we end up needing multiple servers, we could end up shelling out £10's of £000's a year in SQL Server / Windows Server licenses etc.

I then had a quick look at the price of Linux hosting for a dedicated server and saw the price was waaaaaay lower than windows hosting. One place was offering a machine with 2 cores for less than £20 a month.

This got me thinking maybe the way to go is open source on Linux.

As I write a lot of Javascript at work (I'm working on a single page backbone app at the moment), I thought maybe NodeJS and a web framework like Express would be cool to use. I then thought that instead of using SQL why not use an open source NoSQL database like MongoDB, which has great support on NodeJS?

My only concern is that some of the work the application is going to do is going to be dynamically building images and various other image related stuff, i.e. stuff that is quite CPU heavy - so I'm thinking of maybe writing anything CPU heavy in C++ and consuming it as a module in Node.

That's the background - but basically is Linux a good match for:

Hosting a NodeJS/Express site?

Compiling C++ node modules?

Using a NoSQL DB like MongoDB?

And is it a good idea to move to these unfamiliar technologies to save money?

3 MONTH UPDATE

I've been working on this for the past few months now so thought I would give an update in case anyone is interested.

In the end I decided against using a NodeJS & Linux stack for the simple reason of time. I am doing this startup on the side, so I am working 9 hour days, then going home and working until late on the startup. While working in this way I obviously need to be as efficient with my time as possible, or I will never end up shipping the product.

After taking some of the advice on this thread I did apply for Microsoft BizSpark, and was accepted. This means I now have access to Visual Studio license, Windows Server license etc, all for free. Which is awesome. Hopefully by the time we are required to begin paying for everything we will be turning over enough that will make it a non-issue.

Do not think I am only using Microsoft tech, however, as I have tried to use open source stuff where possible. The main place I have done this is my data layer, where I have decided to use PostgreSQL and MongoDB. I am also using BackboneJS on my front end.

Below is a summary of the tech/frameworks I am currently using:

Standard DB stuff: PostreSQL

Logging & Data Store: MongoDB

ORM: Entity Framework 5

Core libraries: .NET (C#)

Web Framework: ASP.NET MVC3

UI: Razor view engine / BackboneJS

答:
The cost of Microsoft products might not be as bad as you think. Microsoft have various schemes available that greatly reduce the cost of their software. Most of them are aimed at software development companies, but there may be a package that meets your needs.

Examples:

BizSpark - Free MS Software For Startups

TechNet - Cheap MS Software - around $199 - $599 a year.

It may be worth looking into, you just might qualify for some of the offers.


问:
Whats the difference between an interpreted language and one compiled to a VM?
It occurs  to me that there's not a heck of a lot of difference between

$>python module.py

And:

$>javac module.java

$>java module.class

The former compiles to an intermediate language (python bytecode) and executes the program. The latter breaks the steps up, first compiling to the intermediate language (jvm bytecode) and then executing on another line. In fact I can rewrite the python to break out the two steps, as in this SO question.

It seems people make a big deal about the stark difference between compiled and interpreted languages. It seems the lines are entirely blured. Other popular interpreted languages havi similar features. Php "compiles" to its own opcodes which can be cached or stored for later use. Perl also is compiled to something.

So... is there really any difference between these popular interpreted languages and popular compiled languages that compile to VMs? Perhaps in one case the VMs are typically more memory resident whereas with the "interpreted" languages they typically have their runtimes spun up? Yet this seems like it could be easily changed.

Yet there still seems to be something of a difference. If they are more-or-less the same, then why is it that the performance of Java/C# seems to approach C++ while the "interpreted" languages are still an order of magnitude off? If its all truly bytecodes running in a VM, and all really the same, why the big difference in performance?

答: Typically, interpreted languages aren't eligible for full-on static analysis (e.g. static type checking across multiple modules) and optimization.  Compiling to bytecode can provide this.  OTOH, interpreted languages can run even if some parts (libraries, etc.) are missing, because you're late-binding references.  IOW, if you don't actually call the code, it doesn't matter if it's there or not.</p>


问:
What do you say in a code review when the other person built an over complicated solution?
The other day I reviewed code someone on my team wrote. The solution wasn't fully functional and the design was way over complicated-- meaning stored unnecessary information, built unnecessary features, and basically the code had lots of unnecessary complexity like gold plating and it tried to solve problems that do not exist.

In this situation I ask "why was it done this way?"

The answer is the other person felt like doing it that way.

Then I ask if any of these features were part of the project spec, or if they have any use to the end user, or if any of the extra data would be presented to the end user.

The answer is no.

So then I suggest that he delete all the unnecessary complexity. The answer I usually get is "well it's already done".

My view is that it is not done, it's  buggy, it doesn't do what the users want, and maintenance cost will be higher than if it were done in the simpler way I suggested.

An equivalent scenario is:

Colleague spends 8 hours refactoring code by hand which could have been automatically done in Resharper in 10 seconds. Naturally I don't trust the refactoring by hand as it is of dubious quality and not fully tested.

Again the response I get is "well it's already done."

What is an appropriate response to this attitude?

答:
You can't fix the world.

You can't even fix all the code on your project.  You probably can't fix the development practices on your project, at least not this month.

Sadly, what you are experiencing in code review is all too common.  I have worked at a couple of organizations where I found often found myself reviewing 100 lines of code that could have been written in ten, and I got the same answer you did: "It's already written and tested" or "We're looking for bugs, not a redesign."

It's a fact that some of your colleagues can't program as well as you can.  Some of them may be pretty bad at it.  Don't worry about that.   A couple of classes with bad inplementations won't bring down the project.  Instead, focus on the parts of their work that will affect others.  Are the unit tests adequate (if you have them)?  Is the interface usable?  Is it documented?

If the interface to the bad code is ok, don't worry about it until you have to maintain it, then rewrite it.  If any one complains, just call it refactoring.  If they still complain, look for a position in a more sophisticated organization.


答:
Sometimes it is worth it as a group to focus on some of the "Agile" principles--they can help a group or individual who seems to be a little off course.

Focusing doesn't have to mean some great big re-working of your team, but you should all sit down and discuss what practices are most import to you as a team.  I'd suggest discussing at least these (and probably quite a few more):

Do the simplest thing that could possibly work?

You ain't gonna need it (are you solving problems that weren't in the spec)

Write the test before coding (Helps you focus your code)

Don't repeat yourself

Also occasional (Weekly?) reviews of what works, what doesn't and what's still needed can be really helpful...  If nothing else, why not commit to an hour a week to discuss team values and practices?

Title: What do you say in a code review when the other person built an over complicated solution?

Body:
The other day I reviewed code someone on my team wrote. The solution wasn't fully functional and the design was way over complicated-- meaning stored unnecessary information, built unnecessary features, and basically the code had lots of unnecessary complexity like gold plating and it tried to solve problems that do not exist.

In this situation I ask "why was it done this way?"

The answer is the other person felt like doing it that way.

Then I ask if any of these features were part of the project spec, or if they have any use to the end user, or if any of the extra data would be presented to the end user.

The answer is no.

So then I suggest that he delete all the unnecessary complexity. The answer I usually get is "well it's already done".

My view is that it is not done, it's  buggy, it doesn't do what the users want, and maintenance cost will be higher than if it were done in the simpler way I suggested.

An equivalent scenario is:

Colleague spends 8 hours refactoring code by hand which could have been automatically done in Resharper in 10 seconds. Naturally I don't trust the refactoring by hand as it is of dubious quality and not fully tested.

Again the response I get is "well it's already done."

What is an appropriate response to this attitude?


答:
Escalation, if you have a technically minded manager. This sounds like a habit that needs to be broken.

If the code is not built to spec, then by definition it should fail code review. I don't understand the concept of "well we've done something that no one asked for, and it's not working so we'll leave it there instead of doing something someone asked for that works".

This is a bad habit for any developer to get into. If he/she was working to a design spec then not matching it without good reason is a no no.


答:
He refuses to listen to the team, and he recently stopped code reviews, unit testing, sharing the implementation details...

Do you not have a documented path for code through review, testing and implementation? If not, you've a wider problem. If you do, then this is something that needs to be escalated.

Title: How do you disarm a cowboy coder?


答:
One word: agile

It certainly doesn't solve everything. But by reigning in your iterations (1-2 weeks, for example), limiting work in progress and leveraging sprint planning/review, you should avoid these waterfall-like mistakes. You need better visibility into what's actually being done - while it's being done.

For normal project-based development, I'd recommend adopting a Scrum approach. For continuous development/integration environments, and especially if you have many developers working on the same or related projects, consider incorporating elements of Kanban. Another effective approach is to leverage pair programming, a defined practice of Extreme programming.

Your situation is hardly unique. And even with small teams, process can go a long way to helping avoid the situation you're in now. With proper visibility and a reasonably groomed backlog, questions like these become sprint planning decisions -- saving you from managing technical debt.


答:
Frequently it is worth moving to an open source stack, but it's more likely to be driven by a combination of factors:

Cost - yes, you will save some money on licensing and hosting. But it probably isn't enough to sway the decision in most cases. If you can't afford or raise a few thousand dollars, then are you really sure you should be doing a startup whatever space you are targetting? Your time is worth more than a small amount of cash.

Avoiding platform lock-in : important if you want to have the flexibility to scale up without reliance on a single vendor-controlled platform. You don't want your company's technological destiny tied to the whim of one supplier (particularly one like Microsoft, which isn't the best known for long term consistency in it's technologies).

Specific technologies - the open source world has some impressive solutions that you may prefer (all else being equal) over the Microsoft equivalents. Look at some of the Java-based big data solutions like Hadoop or Cassandra for example....

Productivity - some of the open source solutions are impressively productive once you get up to speed with them - Ruby on Rails, Clojure etc.

Community - the open source communities are very helpful and can usually help you solve a lot of issues for free whether through forums, online documentation, IRC rooms etc.

You have to balance this, of course, against the time it will take to learn new open source platforms and technologies if you currently have mainly Microsoft skills.

It's a close call overall:

If you already have a mix of skills then I'd generally recommend going the open source route. My experience is that it works out better in the long run.

If you have only Microsoft skills then I think you will probably want to stick with Microsoft purely for the reason that you will be quicker getting up and running. Startups need to move fast, and learning a completely new technology stack isn't an extra problem you want to have on your plate.

Title: Is it worth moving from Microsoft tech to Linux, NodeJS & other open source frameworks to save money for a start-up?

Body:
I am currently getting involved in a startup, I am the only developer involved at the moment, and the other guys are leaving all the tech decisions up to me at the moment.

For my day job I work at a software house that uses Microsoft tech on a day to day basis, we utilise .NET, SqlServer, Windows Server etc. However, I realise that as a startup we need to keep costs down, and after having a brief look at the cost of hosting for Windows I was shocked to see some of the prices for a dedicated server. The cheapest I found was £100 a month. Also if the business needs to scale in the future and we end up needing multiple servers, we could end up shelling out £10's of £000's a year in SQL Server / Windows Server licenses etc.

I then had a quick look at the price of Linux hosting for a dedicated server and saw the price was waaaaaay lower than windows hosting. One place was offering a machine with 2 cores for less than £20 a month.

This got me thinking maybe the way to go is open source on Linux.

As I write a lot of Javascript at work (I'm working on a single page backbone app at the moment), I thought maybe NodeJS and a web framework like Express would be cool to use. I then thought that instead of using SQL why not use an open source NoSQL database like MongoDB, which has great support on NodeJS?

My only concern is that some of the work the application is going to do is going to be dynamically building images and various other image related stuff, i.e. stuff that is quite CPU heavy - so I'm thinking of maybe writing anything CPU heavy in C++ and consuming it as a module in Node.

That's the background - but basically is Linux a good match for:

Hosting a NodeJS/Express site?

Compiling C++ node modules?

Using a NoSQL DB like MongoDB?

And is it a good idea to move to these unfamiliar technologies to save money?

3 MONTH UPDATE

I've been working on this for the past few months now so thought I would give an update in case anyone is interested.

In the end I decided against using a NodeJS & Linux stack for the simple reason of time. I am doing this startup on the side, so I am working 9 hour days, then going home and working until late on the startup. While working in this way I obviously need to be as efficient with my time as possible, or I will never end up shipping the product.

After taking some of the advice on this thread I did apply for Microsoft BizSpark, and was accepted. This means I now have access to Visual Studio license, Windows Server license etc, all for free. Which is awesome. Hopefully by the time we are required to begin paying for everything we will be turning over enough that will make it a non-issue.

Do not think I am only using Microsoft tech, however, as I have tried to use open source stuff where possible. The main place I have done this is my data layer, where I have decided to use PostgreSQL and MongoDB. I am also using BackboneJS on my front end.

Below is a summary of the tech/frameworks I am currently using:

Standard DB stuff: PostreSQL

Logging & Data Store: MongoDB

ORM: Entity Framework 5

Core libraries: .NET (C#)

Web Framework: ASP.NET MVC3

UI: Razor view engine / BackboneJS


答:
I wouldn't say frameworks provide XSS filtering because developers are "lazy."  They do it so developers can focus on the creating code specifically for their application.  A developer's job is hard enough handling the (sometimes) baffling business rules applications have to enforce.

Let's say you were an expert carpenter.  Given enough time you can build anything.  You have a job to redo someone's kitchen.  Should you spend a good chunk of time making the best hammer in the world?  Or, should spend your time redoing the kitchen and use the $20 hammer you can pick up at Lowe's?

The company that makes hammers focuses all their energy on making the best hammers they can.  The people who make the frameworks focus their energy on making the best frameworks they can.  They can spend their time testing and retesting that code because that is what they focus on.  When you have to roll your own you may miss something or create a bug you could never think of.  Sometimes you have to create your own hammer (or code) to meet a very specific need, but hopefully that is few and far between.

Title: What is the logic behind filtering/sanitizing input?

Body:
I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database.

But I see that some frameworks provide automatic XSS filters for incoming POST and GET data. What is the logic behind this solution? I can't see any advantages in doing this except providing a quick and easy solution to "lazy" developers.

Or is there some specific security reason I don't understand?


问:
Using a SetProperty method to prevent accidental changes to a property
Is it good/bad practice to do the following:

```<code>public class MyClass {
  public MyType MyProperty { get; private set; }

  public void SetMyProperty(MyType myProperty) {
    MyProperty = myProperty;
  }
}
</code>```

My intention is to prevent MyProperty from being accidentally changed outside the class. However, it can be changed if needed.

Also, if MyType is a reference type, then will the private set prevent, for example:

```<code>instanceOfMyClass.MyProperty.SomeField = 2;
</code>```

In other words, will it make MyProperty and all its members readonly, or just the reference to MyProperty?

Sorry if this seems an unintelligent question; I'm afraid I'm a beginner.

答:
If something would behave as a read-write property, it should generally be implemented using a read-write property.  On the other hand, the fact that the value of a property can be changed does not mean it will behave like a read-write property.  I would suggest that in general, something should only be implemented as a read-write property if it acts as a "clean" property (described below), though I would note that many classes in .net use read-write properties in ways which do not conform to what I suggest.  I would conjecture that in many cases, this stems from time pressure to get the framework implemented before the full philosophical background was completely worked out.

I would regard a read-write property as clean if:

Reading it will never have any side effect and will always yield the same value in the absence of a method call or write to that property.

Reading it and then writing back the value read will have no effect.

A read which follows a write without intervening method call will always yield the value written.

Writing the property more than once without any intervening method calls will have the same effect as performing only the last write.

In the absence of intervening method calls, the effect of setting a clean property to X and then setting some other property to Y will be the same as setting the other property to Y and then setting the clean one to X.

Note that it is perfectly permissible for a write to a "clean" property to affect the state of other read-only properties.  The effect of setting multiple properties should depend upon the values written, but not the sequence in which the writes occur.  If myRect is initialized to (X=1,Y=2,Width=3,Height=4), the effect of MyRect.X=2; MyRect.Top = MyRect.Right; should be the same as MyRect.X = 2; MyRect.Top = 5; or MyRect.Top = 5; MyRect.X = 2;, even though it wouldn't be the same as MyRect.Top = MyRect.Right; MyRect.X = 2;.

Many .net classes use properties in ways which are by these definitions "unclean".  Using these definitions, for example, StringBuilder.Length should probably be a read-only property, but Text could probably be a read-write property (reading Text would be equivalent to ToString(), while writing it would be equivalent to clearing it and doing Append).

There are variety of situations in which one may be able to change properties of an object, but they should not be considered "clean read-write properties".  Among them:

A rectangle which stores (X,Y,Width,Height) and exposes them as read-write properties may have a `Right` property, but attempting to set it would affect one of the others.

An object may hold a reference to an `IDisposable` object and be expected to possibly call `Dispose` on it when it's no longer needed.  A method `SetXXAndTakeOwnership()` would offer clearer semantics (call `Dispose` the old object before setting the property) would offer much clearer semantics than a read-write property.

Some objects may have properties which can only be set to certain combinations of values; having a method to set all such properties at once may be much nicer than having to set the properties individually and worry about sequencing.  `ProgressBar` is particularly icky in this regard, since its properties must be written in an order which depends upon old and new values; if a `ProgressBar` is presently indicating 7/9 done, changing it to 3/5 requires writing `Value` before `Maximum`, but setting it to 14/19 requires writing one must update `Maximum` first.  A `SetFraction` method which accepted parameters for both value and maximum, and updated both simultaneously, would have been much better.

Some properties like the time remaining on a timer may change between the time they're written and the time they're read.  Such things may be perfectly fine as read-only properties (reading them would take time, and the act of taking time might affect future readings, but such side effect would be no different from any other code the system might execute) but they would violate the rule that a clean property should return the last value read.

If any of those conditions (or any of many others--the list is hardly exhaustive) apply, use a SetXX method rather than a read-write property.


问:
Should I swap from WCF to NserviceBus
We have a central server that sends and recieves messages from a number of PCs that are located on client networks in various locations. To facilitate this, currently I'm using WCF with TCPNetBindings, using duplex communication secured with certificates.

Now, we have a number of issues with this - mainly that we are being asked to support "disconnected mode" (we need to be fault tolerant). From what I know, there is no simple way to do this using the WCF stack - we'd need to implement something and perhaps use msmq. I've been looking at NServiceBus lately, and from I can see it seems to fit the bill well - fault tolerance, messages can be sent over the internet via a simple http gateway, etc. I know it's well respected in the community, and I can see why from looking into it.

So, my question is...Does employing NServiceBus sound like a sensible idea, or does anyone have any other suggestions / real world experience that relate to this? I guess I'm worried of introducing a new tech that I know relatively little about, and facing problems with things like securing it, setting everything up in a reliable way, gotchas along the way.. I'm also wary of "gold-plating" the architecture, and choosing something shiny that will end up bogging me down in implementation versus sticking with WCF and just making it work for me..

Thanks!

答:
My suggestion, if you need to be quick about this and only need something simple to facilitate durable (disconnected) operation with WCF, is to look in to the WCF - MSMQ bindings. If you need something in a larger environment, look at nServiceBus.

In my mind, nServiceBus would really begin to shine in a larger distributed environment. Take, for instance, the following example (that would be hell on earth with WCF but simple with nServiceBus):

Infrastructure made up of app server tier, cache server tier, read only database tier, read/write database tier

Any time the client submits a new entry, you'd really like all of these tiers updated at once

In WCF, you'd need to expose separate services at each tier level and have the client push to all of them (or have some central orchestration doing the same thing for you)

In nServiceBus you'd have each tier be a subscriber to this information, and the client would publish it once, allowing the service bus to take care of the rest

WCF has MSMQ Bindings

If you need to mostly stick with WCF, however (short timelines, need other WCF features), I'd suggest you check out this article at MSDN. It shows you how to use the WCF bindings for MSMQ, and then shows you how to migrate one service from HTTP to MSMQ. Along the way it shows you some of the problems with this scenario (and useful solutions to these problems).

Both of these suggestions make heavy use of MSMQ, so a note about that: unlike Apache MQ, RabbitMQ, and other popular queueing systems, MSMQ is not a typical broker based queue architecture, it is instead a distributed queue. This means that if your WCF client sends a message over an MSMQ transport while it cannot connect to the remote server that hosts the queue, the client machine will enqueue the message in what is referred to as an "Outgoing Queue" locally instead. The message will stay there safely until such time as the client's MSMQ service detects that it can connect to the remote MSMQ service again. At that point the message will flow from the client to the end destination.

There is at least one caveat to the above - if the remote server is offline for too long (check your documentation for MSMQ) the client will give up and move the message from outgoing to the dead letter queue. Messages transferred to the dead letter queue cannot be re-sent automatically, they must be re-constructed.

If you require encryption and don't have ActiveDirectory, on this blog entry, Sergey Sorokin details the steps necessary to encrypt communication of MSMQ using WCF without Active Directory.

Title: Should I swap from WCF to NserviceBus


问:
Git Project Dependencies on GitHub
I've written a PHP framework and a CMS on top of the framework. The CMS is dependent on the framework, but the framework exists as a self-contained folder within the CMS files. I'd like to maintain them as separate projects on GitHub, but I don't want to have the mess of updating the CMS project every time I update the framework. Ideally, I'd like to have the CMS somehow pull the framework files for inclusion into a predefined sub-directory rather than physically committing those files.

Is this possible with Git/GitHub? If so, what do I need to know to make it work? Keep in mind that I'm at a very, very basic level of experience with Git - I can make repositories and commit using the Git plugin for Eclipse, connect to GitHub, and that's about it. I'm currently working solo on the projects, so I haven't had to learn much more about Git so far, but I'd like to open it up to others in the future and I want to make sure I have it right.

Also, what should my ideal workflow be for projects with dependencies? Any tips on that subject would also greatly appreciated. If you need more info on my setup, just ask in the comments.

答:
Git Submodules is a great way of managing git project dependencies.

If you're looking for another approach:

Composer can do this all for you. Composer is a dependancy manager for php. It's syntax is of json. It's rather easy and cheap to use.

More about composer:

Composer is a tool for dependency management in PHP. It allows you to
  declare the dependent libraries your project needs and it will install
  them in your project for you.

On the documentation page, you can find an example of how your composer.json file would be constructed:

```<code>// Composer.json
{

    "name": "acme/blog",
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/composer/hello-world"
        }
    ],
    "require": {
        "acme/hello-world": "dev-master"
    }
}
</code>```

Once you have your composer.json and composer.lock file created for your project you can then just install your dependancies easily:

composer.phar install
or update them:
composer.phar update
or create a particular project from packagist:
composer.phar create-project acmeproject

Title: Git Project Dependencies on GitHub

Body:
Git Submodules is a great way of managing git project dependencies.

If you're looking for another approach:

Composer can do this all for you. Composer is a dependancy manager for php. It's syntax is of json. It's rather easy and cheap to use.

More about composer:

Composer is a tool for dependency management in PHP. It allows you to
  declare the dependent libraries your project needs and it will install
  them in your project for you.

On the documentation page, you can find an example of how your composer.json file would be constructed:

// Composer.json
{

    "name": "acme/blog",
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/composer/hello-world"
        }
    ],
    "require": {
        "acme/hello-world": "dev-master"
    }
}

Once you have your composer.json and composer.lock file created for your project you can then just install your dependancies easily:

composer.phar install
or update them:
composer.phar update
or create a particular project from packagist:
composer.phar create-project acmeproject


问:
Including local headers first
So I read up on the ordering of your includes, and this guy suggested you include your local header first so as to make sure it doesn't have prerequisites. Ok, I get that. I'm on board. The whole compartmentalization thing is good.

But I've got this file,  file.c which includes it's file.h, which declares functions to save files. Which passes around the FILE* type used by fopen and friends.

If I include file.h before I include stdio.h then there's an obvious parsing error when it's building file.h because it doesn't know about the FILE* type.

I know I've got to be missing something dirt simple, but I can formulate this into something google can use. Should I be doing something different in file.h? Is this simply something that needs to be included in a specific order? Thoughts?

答:
If a header file such as file.h depends on other headers such as stdio.h, then file.h should #include those headers as necessary.

Each header file should keep track of its own dependencies, and use #include guards to prevent multiple translation if it winds up being included several times:

```<code>#ifndef FILE_H
#define FILE_H

#include <stdio.h>
...
void myfunc(FILE *);
...
#endif
</code>```

This way the order of the includes simply doesn't matter, which makes maintenance much less crazy-making.

Title: Including local headers first

Body:
If a header file such as file.h depends on other headers such as stdio.h, then file.h should #include those headers as necessary.

Each header file should keep track of its own dependencies, and use #include guards to prevent multiple translation if it winds up being included several times:

#ifndef FILE_H
#define FILE_H

#include <stdio.h>
...
void myfunc(FILE *);
...
#endif

This way the order of the includes simply doesn't matter, which makes maintenance much less crazy-making.


问:
Can I use CodeSynthesis XSD (C++/Tree mapping) together with a GPLv3-licensed library?
Is it possible to write an open source project that uses generated code from CodeSynthesis XSD (C++/Tree) and then link it to a third-party library that is licensed under the GPL version 3?

Some background information:
CodeSynthesis XSD is licensed under the GPL version 2 but with an extra FLOSS exception (http://www.codesynthesis.com/projects/xsd/FLOSSE).

C++ source code generated from CodeSynthesis XSD (C++/Tree) needs to be linked against Xerces (http://xerces.apache.org/xerces-c/) that is licensed under the Apache License 2.0.

Update

I posted a similar question on the xsd-users mailing list two years ago but I didn't fully understand the answers.

In that email thread, I wrote:

I think it is the GPL version 3 software that doesn't allow itself be linked to software that can't be "relicensed" to GPL version 3 ( for instance GPL version 2 software ). That would also include XSD as the FLOSS exception doesn't give
permission to "relicense" XSD to GPL version 3.

答:
Take a look at the GPL Compatibility matrix.  Without the FLOSS exception you mentioned, then you wouldn't be able to proceed.

Then consider looking at this section of the GPL FAQ that discusses Free Software with Non-Free libraries as there are a number of related questions.

Worth mentioning is the GNU license listing which is also linked from the FLOSS exception.

All that having been said, it appears that the FLOSS exception will allow you to take the CodeSynthesis XSD output and license that output as GPLv3.

Based upon the GNU license list, Apache License v2 appears to be compatible with GPLv3.

As both of your "downstream" licenses are compatible with the FLOSS exception, it appears that you'll be okay.


答:
For my day job I work at a software house that uses Microsoft tech on
  a day to day basis, we utilise .NET, SqlServer, Windows Server etc.
  However, I realise that as a startup we need to keep costs down, and
  after having a brief look at the cost of hosting for Windows I was
  shocked to see some of the prices for a dedicated server. The cheapest
  I found was £100 a month. Also if the business needs to scale in the
  future and we end up needing multiple servers, we could end up
  shelling out £10's of £000's a year in SQL Server / Windows Server
  licenses etc.

If you reach the kind of scale that requires that kind of money, then in theory your income will match those expenses and you will be able to get better deals, and host stuff with your own hardware.  One of the reasons your quotes are so high, is because your renting hardware, and not buying it and hosting it yourself ( cerca facebook, Amazon, Microsoft ).

I then had a quick look at the price of Linux hosting for a dedicated
  server and saw the price was waaaaaay lower than windows hosting. One
  place was offering a machine with 2 cores for less than £20 a month.

My first question is "what is wrong with the company offering those sort of prices", and how much was linux server at the same company as the windows server going to cost?  I know I am asking a question in an answer, but the question itself, is the answer.

As I write a lot of Javascript at work (I'm working on a single page
  backbone app at the moment), I thought maybe NodeJS and a web
  framework like Express would be cool to use. I then thought that
  instead of using SQL why not use an open source NoSQL database like
  MongoDB, which has great support on NodeJS?

My only concern is that some of the work the application is going to do is going to be dynamically building images and various other
  image related stuff, i.e. stuff that is quite CPU heavy - so I'm
  thinking of maybe writing anything CPU heavy in C++ and consuming it
  as a module in Node.

My only suggestion is use what you are familar with.  Use the programs that exist to help businesses like yours have success, once you have that sucess, you can implement and make pretty much ANY change you want.  If you do get that sucess, and you are able to afford the higher prices, you might decide its not actually a problem.

Like I said your worries are sound, but are you looking at it from the correct scale, have you looked at business projections to help you decide what to do?  I realize you already decided ( within a short amount of time ) what you basically going to do.

Just try to look at the larger picture, you are not going to be paying a single company that sort of money to host your servers, you likely would be doing it yourself.


答:
He refuses to listen to the team, and he recently stopped code reviews, unit testing, sharing the implementation details...

Code reviews don't necessarily require the coder to submit the work for review.

An easy way to keep track of what he does is to keep an eye on the VCS history, looking for his check-ins. If you're worried about his code, this is an easy way to find it. Get a diff history, look at what he put in, and see if any red flags jump out at you. Catch his checkins fast enough and if you find a problem, you can roll back the commit and e-mail him to that effect. You are allowed to call out your fellow team members, even as a junior coder, when you see something obviously wrong.

Yes, he "codes" fast, but his code is just a bug generator. Other team members and I are in a "bug fixing phase" and 80% of bugs comes from his code. I don't want to fix his bugs. And management is blind, or doesn't want to see this, or maybe they like his "speed".

Code comes from requirements. Requirements result in runnable tests that verify the requirements have been met. Those tests can be further broken down, and can be written before changes are made to verify that the changes meet the requirements (red-green-refactor; the essence of TDD).

Add a "code coverage" metric to your team's build server (hopefully you have one; if not, that's your first problem). Simply checking that unit tests pass won't catch the problems with his new non-TDDed code, made in areas that don't have unit tests. After running all unit tests, the build server should ideally have executed every line of code, but there really are some things you just can't unit-test. Realistically, you should still be able to expect 95% coverage or better (or exclude certain libraries or types of files from coverage). Sooner or later, your cowboy will check in something that breaks the build because he's dropped the coverage level below the threshold, and you call him out.

And as far as "speed" is concerned, speed is how fast you get things "done", and it's not "done" until it's done correctly. You can put it to your managers this way; consider an auto mechanic who, when the manager takes his BMW to get an oil change, forgets to out the oil pan plug back in, and as a result all the new oil pours out before he even drives out of the garage. Sure, the oil change only took five minutes, but the manager's not going to care about that when his car's engine seizes up on the way home. He's going to care that the mechanic missed a step, that is going to cost him a lot of additional time and money to have fixed. Right now, he's paying one cowboy to do the job really fast, and then he's paying the rest of the team a much larger sum to come in and re-do the job correctly. What, really, is the advantage of continuing to let the cowboy do his thing?

Is there any way that I (as his younger colleague by age, not his boss) can do something about it?

Call him out. When you find something he screwed up, show him how his code is failing, how he could have prevented the problem in the first place (including proper design, TDD, code reviews) and what you were or will be required to do as a result to fix his broken code.

I feel like I'm the last one who really cares about the project at all.

klaxons blaring, lights flashing, sirens wailing - if you really do feel like you're the only person who cares about the quality of code produced by the team, then there is a SERIOUS problem. If you feel you're trying to drag the entire team kicking and screaming into the era of good coding, and it's just too much weight to haul, then drop it. If there's another team at the company that's doing it right, ask for a transfer, otherwise get the hell out.

Title: How do you disarm a cowboy coder?


问:
HTML in docblock comments?
In the PEAR standards there is no reference to HTML, if its allowed or not.

http://pear.php.net/manual/en/standards.sample.php

But I see some people use HTML tags like  and stuff..

So is HTML allowed?
Will it break some doc parsers?

答: According to this other page they follow the phpDoc standard.  You should follow that standard strictly, although some common extensions can sometimes be assumed.  For publicly available code (on other projects) I do not put HTML into my phpDoc compatible comments.</p>

Title: HTML in docblock comments?


答:
You're really looking at major paradigm shifts here with the unfamiliar technologies.  I had good success with converting ASP.NET 2.0 apps and running them on top of mono with 3rd party libraries.  http://www.ubiquityhosting.com/ provides cheap mono hosting.  Both MySql and Postgres support ADO.NET connectors which saves you a lot of development time.  I typically develop all my databases in sql server management studio then make minor changes to the generate sql scripts task output to get them to work in mysql\postgres.  I imagine it would work in a similar fashion for ORMs like NHibernate.

As for a C++ application, you could always host a few boxen yourself if the backend work is cpu heavy and not bandwidth heavy to keep costs low from avoiding dedicated servers.  Triple core machines with 2 to 4 GB of ram are cheap with linux running on top of them.

Finally it is best to focus more effort on the features, UI\UX, graphical interface and advertising that will sell your app rather then the underlying technology stack.  If you start getting a lot of traffic right away, you can always move to azure or amazon to better handle the load.


问:
How to motivate co-workers to write unit-tests?
We're working on a large product which has been in production for about 5 years. The codebase is.. erm.. working. Not really well but it is working. New features are thrown into production and tested with a small QA. Bugs are fixed, etc. But no one, except me, is writing unit-tests. No one uses the power of "tracking" down bugs by writing unit tests to ensure this special bug (test case) would never, ever occur again.

I've talked to management. I've talked to developers. I've talked to everyone in the whole company. Everybody says: "Yep, we must write more unit-tests!" That was about a year ago. Since then I have forced introduction of pre-commit code review (Gerrit) and continuous integration (Jenkins).

I held some meetings about unit-tests and I also showed the benefits of writing unit-tests. But no one seems to be interested.

Q1: How do I motivate my fellow co-workers to write unit-tests?

Q2: How do I stay motivated to follow my personal code quality standards? (Sometimes it' s really frustrating!)

PS:
Some frustrating facts (reached in 1 year):

Total unit-tests: 1693

Total "example unit-tests": around 50

Done by me: 1521

Edit: Am I expecting too much? Its my first working place and I'm trying to do my best.

Edit 2: Based upon all answers I've made a small checklist for myself. I've talked to two developer in private and we had a good and honest talk.

One of them told me, like Telastyn said, that he is really uncomfortable with unit-tests. He said that he would like to be "more professional" but he needs a kickstart.   He also said that our unit-test meeting with all developers (around 9-11) was good, but it was too crowdy. Meh. Some critics for me, but I'll learn from that. (see answers below concering tdd kata meetings!)

The other one said that he is not interested in writing unit-tests. He thinks that his work is good enough for his salary. He don't want to put more effort in. I was quite speechless. Typical 9-5 "worker".

Next week I'm going to talk to the other developers.

Thanks for your great answers (so far!) and your support. I really appreciate it! I'ved learned a lot, thank you very much!

答:
I would start by demonstrating the benefits of TDD. Try to showcase benefits of unit testing.

As normal human beings, developers are motivated by benefits. They don't want to do things that just create more work. Unit testing means less work. It means going out with friends more. It means having more fun because you don't have to spend every night coding till 11pm. It means going on vacations more with a peace of mind.

One of the biggest benefits of TDD is that you can refactor your program to a better design or just change the name of something ... and as long as that design doesn't break the tests, you can have 100% confidence that your change didn't break anything.

Another great case for TDD is creating unit tests for legacy code. This would represent one of the best ways to start refactoring out the evil. In the long run, this will serve to improve your knowledge of the code base, understand its strengths and flaws, spot hard-coded business logic in the code and give you a good start to improve the quality moving forward!

Good references for further reading:

Why You Should Write Unit Tests

Motivation Visibility, and Unit Testing

The art of unit testing, according to Roy Osherove


问:
Am I shooting myself in the foot if I use Mercurial for Rails development?
I'm a Rails developer and I prefer Mercurial over Git. However, I know that the Rails community is very pro-Git. So my question is it possible that my choice of version control system would turn back some developers?</p>

答:
In my opinion, you shouldn't choose a version control tool because of a service, you should choose a tool because the tool itself is what you really really need and it makes sense for you.

I guess it could come down to this: how hard do you want to allow the history of changes to be modified?. This maybe the main difference between both systems, Git lets its users go trigger-happy with bashing at the history while Mercurial is more conservative.

Although... maybe this has changed a little, as Mercurial has become better at this through phases and they can protect you from an unwanted rebase (yes, there is rebase in Mercurial, see the rebase extension and the histedit extension which is now officially supported). Mercurial has less power tools, like git obliterate, still, chances are that you won't need the extra power (which IMHO, can sometimes lead to bad practices if your organization doesn't set the rules of when and why should you go at the change history).

You should also consider if the people you want to work with uses Windows, in this case I'd say Mercurial is a friendlier and more seamless experience.

Other than the previous, if you know Git you know hg (maybe with the most notable difference that Mercurial stages your changes automatically). If you know hg, you can learn Git pretty fast.

As far as repository management goes, Bitbucket is not bad at all, but I personally prefer something more governable like Rhodecode.

Finally, there is some interoperability between both systems (see HgGit and about using hg convert), so you could work with both and figure what is best for your project later. A good example is Rhodecode: the guy that maintains Rhodecode (which works well for both Git and hg) personally uses Mercurial and has a Bitbucket and a Github mirror (his main repo is in his Rhodecode instance), here are some stats:

Bitbucket mirror: 63 forks + 289 followers

Github mirror: 10 forks + 47 watchers

Don't let others hype you into something, try it out yourself and see what works for you, as you can migrate out of Mercurial into Git and viceversa if you need it.

In summary, I guess my advice would be is: keep using hg, put a github mirror, see what sticks and go with the flow.


答:
http://blog.jtimothyking.com/2006/07/11/twelve-benefits-of-writing-unit-tests-first

I think I bookmarked that link from a Jeff Atwood article some time ago [edit: yep, here it is]. Old but relevant. Due to these benefits and others that will undoubtedly be outlined in other answers, your programmers should be able to motivate themselves! It will allow them to work more efficiently and thus make their job a bit easier. Who doesn't want that?

In regards to your 2nd question: your sense of ownership and pride in your code quality standards should keep you going with them. Think about what you want to accomplish by having such standards and who benefits from them. My personal code standards can be frustrating as well, but I always feel like I'm doing the world/company/team a favor by implementing them. So I don't think you're trying to do too much - results will vary place to place but at least you're making the effort.

Title: How to motivate co-workers to write unit-tests?

Body:
We're working on a large product which has been in production for about 5 years. The codebase is.. erm.. working. Not really well but it is working. New features are thrown into production and tested with a small QA. Bugs are fixed, etc. But no one, except me, is writing unit-tests. No one uses the power of "tracking" down bugs by writing unit tests to ensure this special bug (test case) would never, ever occur again.

I've talked to management. I've talked to developers. I've talked to everyone in the whole company. Everybody says: "Yep, we must write more unit-tests!" That was about a year ago. Since then I have forced introduction of pre-commit code review (Gerrit) and continuous integration (Jenkins).

I held some meetings about unit-tests and I also showed the benefits of writing unit-tests. But no one seems to be interested.

Q1: How do I motivate my fellow co-workers to write unit-tests?

Q2: How do I stay motivated to follow my personal code quality standards? (Sometimes it' s really frustrating!)

PS:
Some frustrating facts (reached in 1 year):

Total unit-tests: 1693

Total "example unit-tests": around 50

Done by me: 1521

Edit: Am I expecting too much? Its my first working place and I'm trying to do my best.

Edit 2: Based upon all answers I've made a small checklist for myself. I've talked to two developer in private and we had a good and honest talk.

One of them told me, like Telastyn said, that he is really uncomfortable with unit-tests. He said that he would like to be "more professional" but he needs a kickstart.   He also said that our unit-test meeting with all developers (around 9-11) was good, but it was too crowdy. Meh. Some critics for me, but I'll learn from that. (see answers below concering tdd kata meetings!)

The other one said that he is not interested in writing unit-tests. He thinks that his work is good enough for his salary. He don't want to put more effort in. I was quite speechless. Typical 9-5 "worker".

Next week I'm going to talk to the other developers.

Thanks for your great answers (so far!) and your support. I really appreciate it! I'ved learned a lot, thank you very much!


答:
I noticed that talking about TDD hardly works. People like to see raw results. Saying that "writing tests will reduce development time" is most likely true, but it might not be enough to get anybody convinced.

I was in similar position (well, not as bad as yours), and it kind of resolved itself when people started working on my code (note: my code was unit tested, others' not so much). When something stopped working, natural follow-up after local investigation was to ask me what could be the reason. Then we sat, we ran unit tests and saw what happened. If tests were passing, most of the time problems were in the new, untested code. If not, tests were usually able to spot the problem (or at least point us in the right direction). We fixed the bug, tests were up again, everybody was happy.

Long story short, a few situations like this transpired and 2 more developers became TDD/testing enthusiasts (there are still a few more to go, but it looks promising).

As for advice, you can give a go with TDD kata; simple task to implement using a test first approach as opposed to no tests. Depending on how complex the task is, non-test approach should usually be slower, especially with incremental required changes:

Roy's string calculator

Bank OCR

Edit: OP's comment made me realize there's even stronger argument at his disposal - regression aka returning bugs. Those kind of situations are perfect examples demonstrating how benefical unit tests can be. People like numbers - like I said, telling "unit testing is good" might not be convincing, but arranging data like below might surely be:

time spent to implement feature (no tests were written; I assume this happened often so it should be relatively easy to find such example)

estimated time to implement feature with TDD (or even tests after approach; doesn't matter - what's important is presence of unit tests)

time spent resolving the bug on untested vs tested code

One thing to warn you about (this migth be obvious but is worth noting): outcome bias - make sure you don't select example where the only way of spotting bug with test was to write test for that bug. Usually, nobody knows bug will occur upfront, but it's tempting to say "man this bug would be trivial if we had test for X" - it's easy to find a winning tactic for a war after it has ended.

Outcome of those examples should be simple question - if you could spent x-hours developing feature Y, why would insist on doing it in 2x?


答:
See http://en.wikipedia.org/wiki/PHPDoc#DocBlock_Description_Details

HTML is supported in the Long Description:

The Long Description continues for as many lines as desired and may contain HTML markup for display formatting.

There is a specific list of tags that PHPDoc supports:

Here is a list of tags supported by phpDocumentor:

 -- emphasize/bold text

 -- Use this to surround php code, some converters will highlight it

 -- hard line break, may be ignored by some converters

 -- italicize/mark as important

 -- denote keyboard input/screen display

 -- list item

 -- ordered list

 -- If used to enclose all paragraphs, otherwise it will be considered text

``` -- Preserve line breaks and spacing, and assume all tags are text (like XML's CDATA)

<samp> -- denote sample or examples (non-php)

 -- unordered list

<var> -- denote a variable name

Also of note, it looks like a blank line between paragraphs is interpreted as a paragraph break even without
 tags.

Title: HTML in docblock comments?

Body:
In the PEAR standards there is no reference to HTML, if its allowed or not.

http://pear.php.net/manual/en/standards.sample.php

But I see some people use HTML tags like  and stuff..

So is HTML allowed?
Will it break some doc parsers?

Body:
See http://en.wikipedia.org/wiki/PHPDoc#DocBlock_Description_Details

HTML is supported in the Long Description:

The Long Description continues for as many lines as desired and may contain HTML markup for display formatting.

There is a specific list of tags that PHPDoc supports:

Here is a list of tags supported by phpDocumentor:

<b> -- emphasize/bold text

<code> -- Use this to surround php code, some converters will highlight it

<br> -- hard line break, may be ignored by some converters

<i> -- italicize/mark as important

<kbd> -- denote keyboard input/screen display

<li> -- list item

<ol> -- ordered list

<p> -- If used to enclose all paragraphs, otherwise it will be considered text

<pre> -- Preserve line breaks and spacing, and assume all tags are text (like XML's CDATA)

<samp> -- denote sample or examples (non-php)

<ul> -- unordered list

<var> -- denote a variable name

Also of note, it looks like a blank line between paragraphs is interpreted as a paragraph break even without <p> tags.


答:
Ask them.

You say that people have been told, and agree that they should write more tests. Why are they not?

It may not (often times isn't) a matter of simple motivation. They might forget about them. They might feel under time pressure. They might not know how to write good tests. They might think you're so good that they don't need to do it. Knowing the root cause will help you solve the problem better.


答: Bake unit testing in the process. If a bug shows in production that is too obvious to catch in unit test then this guy takes the blame. Assign people to write each test they make. Randomly pick cases and watch the execution of few cases every week. By doing unit tests, people will ask about the requirements and eventually tie the requirements to development and hopefully develop software that both required and works :)</p>


答:
You would think the unit tests would be the selling themselves.  I don't know how your company works, but when there is an issue during a production rollout we work it until it is fixed.  It doesn't matter if it happens at 2 AM on a Sunday morning.  This is very rare for us, but when it does, it sucks.

I would start by asking them how many times they had to get up in the middle of the night to fix some major issue that could have easily been found automated testing.  That is not to say automated testing will fix everything, but it should help reduce that.

The second big seller is the QA cycle.  Prior to the start of TDD in my company we would push new releases to QA to test every week.  They would create a pile of bugs off that release, we fix those bugs and push another release.  Repeat until finished.  The first project we did TDD didn't require a push out to QA until several weeks later.  And the number of bugs found has been very, very small.  10% compared to a similar project.  Do you have anyway to compile those stats for your team?

The other big selling point was how the code looked after TDD was embraced, it was easier to read, because we wanted to make it easier to test.  Show a comparison between code written for unit tests and code not written.

Finally, show them how they will be able to refactor code with confidence.

Keep all that in mind when you don't feel like writing tests. :)


问:
In a web application, is it ok to group multiple pages in one view class or one class per page?
If you are building a web application, and you have a user management component, is it recommended to do:

```<code>class UserAdminView extends View {

}
</code>```

or

```<code>class UserAdminUpdateView extends View {

}
</code>```

What about controllers? Thoughts?

答:
Taking a look at a popular MVC framework such as Codeigniter for PHP or even the structure of Play Framework (java) should help.

For example in both cases the idea of a view is that it seperates the coding from the templating (gui). Creating an individual view as its own class confuses this as a front end developer shouldn't be using code. It would be more beneficial to create a view class which effectively allows you to load HTML based templates and pass your data to them. For example:

```<code>class userAdmin extends Controller {

  public void view() {
    data = userAdminModel->getView();
    view_html->('header');
    view_html->('userAdmin.view',data);
    view_html->('footer');
  }

  public void updateView() {
    success = userAdminModel->updateView(...);
    view_html->('header');
    view_html->('userAdmin.updateView',success);
    view_html->('footer');
  }
}
</code>```

The controller invokes the method based on the users action. This method performs any business logic requesting any persistent data from the database using the model. The data is then passed into the view which is effectively a templating engine which has rudimentary scripting to iterate through such data.

The brilliance of the MVC model is that a developer can create the logic that passes the expected data to the view. A HTML/CSS developer (for example) with limited coding skills can then create the front end which uses variables passed in without any concern over how the data is generated and has been manipulated.

The model allows you to access the data within the controller in a standardised way without worrying how that data is stored.

I would suggest googling MVC for a more indepth look.

Body:
Taking a look at a popular MVC framework such as Codeigniter for PHP or even the structure of Play Framework (java) should help.

For example in both cases the idea of a view is that it seperates the coding from the templating (gui). Creating an individual view as its own class confuses this as a front end developer shouldn't be using code. It would be more beneficial to create a view class which effectively allows you to load HTML based templates and pass your data to them. For example:

class userAdmin extends Controller {

  public void view() {
    data = userAdminModel->getView();
    view_html->('header');
    view_html->('userAdmin.view',data);
    view_html->('footer');
  }

  public void updateView() {
    success = userAdminModel->updateView(...);
    view_html->('header');
    view_html->('userAdmin.updateView',success);
    view_html->('footer');
  }
}

The controller invokes the method based on the users action. This method performs any business logic requesting any persistent data from the database using the model. The data is then passed into the view which is effectively a templating engine which has rudimentary scripting to iterate through such data.

The brilliance of the MVC model is that a developer can create the logic that passes the expected data to the view. A HTML/CSS developer (for example) with limited coding skills can then create the front end which uses variables passed in without any concern over how the data is generated and has been manipulated.

The model allows you to access the data within the controller in a standardised way without worrying how that data is stored.

I would suggest googling MVC for a more indepth look.


问:
Must a programmer learn text editors like Emacs and Vim? How important are they?
I have been writing code so far in conventional text editors that come with the OS so far or use an IDE in some cases. I know there are some advanced text editors like Emacs and Vim available solely for the purpose of coders. How important are they really? Should a programmer dealing with PHP, Python etc. learn these editors? What are the advantages that they provide over conventional editors like Notepad++, Scribes etc.?

答:
If you need to learn an editor for programming, make it emacs.  Why?

If I need to make an rpm and I open emacs, and tell it to find a file which happens to end with the extension .spec
WHAM! A skeleton file appears with all the tags and macros already filled in with text color-coded.

And if I want to submit to my favorite version control,
esc-x load-library mercurial (or git or svn) puts emacs in the mood to drop down the right commands from its version control menu or to recognize the commands like ctrl-x v v to check in or out code from a repository, and to do everything one can do with a repository.

Optic fatigue occurs when one stares at the same colors for too long.  I use konsole for terminal windows and change the colors frequently.  With emacs not in a terminal window, I have more than 50 color themes to choose from, some of them comfortably low contrast, like Alice Blue, and some eye-stabbing like euphoria for when I need to stay awake.

I code a lot of python.  When I need to test some coding for syntax, I don't leave emacs.  I start the Python interpreter, and the screen splits, then I save my python file and import it to the interpreter to check syntax--an error will be readily apparent, and I can fix it immediatelty.  When I am done, I can switch to an unsplit window and continue work.

Some folk say use vi, and I do use it on some older SUN systems...  I have a regular rhythm--hit i and insert a char then hit escape and hit i again and type the next char...  (barely better than ed, but it is what's available).

Usually my first install on any new system is zile.  GNU zile is emacs without all the window dressing like browsing and email and irc and colors, just a C-coded binary that works in about 100k and uses emacs keycodes.

If emacs were as onerous as most try to make it sound, it should be amazing that so many folk were gluttons for self-flagellation by making emacs-like editors.  MINCE Is Not Complete Emacs, the 31 flavors of micro-emacs, Jed, Zile, Joe and an oddball python coding or two plus web-based YMacs, are all emacsen.  peppy http://peppy.flipturn.org/ is a different take, using emacs keycodes and coded in Python and it will edit nigh on everything, including chunks of binary data, and it has dozens of modes for programming languages, but its keycoding paradigm is emacsen.

YEah, emacs is worth learning, and so is vi.  Of the rest, maybe Eclipse is as useful, if you can stand the hoggishness of its many inserts.  And if you need something REALLY small, lightweight, and fast, check out e3.  The x86 version is written in assembler and serves many keycode sets including Emacs and Vi. https://sites.google.com/site/e3editor/

And oh yes, I open emacs, type 17 pages, and BLAP!  Lightning strikes and my power goes out.  When power is restored, I look at the work and discover I lost the last 7 characters I typed....  And if I decide to follow the "recover crashed session" procedure, I can reduce it to 2 lost.

Python code doesn't believe in indentation, it DEPENDS on them.  Emacs is aware of that and makes sure your indentation is proper.  But if you decide to remove an "if" you will have a whole region in the wrong indentation status.  With emacs you fix that by:

ctrl-space and arrow keys to highlight the region

ctrl-c < to outdent all the highlighted code. (ctrl-c > indents it again, correctly).

I think I have used more than 60 editors, and still the one I come back to is emacs, not because I can get function code stubs in C or proper indentation or color-coding, but because I can customize it beyond its already awesome capabilities.  Richard Stallman's brainchild was adapted by so many...


问:
What's your favourite quote about programming?
What's your favourite quote about programming?

One quote per answer, and please check for duplicates before posting!

答:
Nine people can't make a baby in a month.

    — Fred Brooks, The Mythical Man-Month

LastEditorDisplayName: Roger Pate


答:
First you have to know why they aren't writing tests.

Tight dev schedules is often the reason, but you say you don't have that.

Next reason is that with a large existing untested code base, writing tests probably seems overwhelming- a never ending job (like laundry and about as exciting). So human nature is to think that's too much to face, so I'll skip it.

Another reason could be that while they think tests are a good idea, they are not confident about how to start writing them especially if they have never worked anywhere that did write them.

Another strong possibililty is because they really don't see any value for more work even though they are giving lip service to the idea.

So how do you handle the different reasons?

Reason one is simple, show them an example of how it saves development time.

Reason two - show them how many tests you have written in a year and what percentage of the code base it covers. Do the math to show how many more tests they could have at this time next year if they do this. Once they see that little bits of progress on a daily basis really add up, the whole idea isn't so overwhelming. If you can pull the data out of the system, show them how many bugs were repeat bugs in the untested parts of the code and how many repeat bugs appear in the code with unit tests.

Reason 3 is training, not just showing. Make them write tests in a training class.

Reason 4, this is the crux of the matter. First, pick a pain point, one of those bugs that has returned multiple times. When that comes in, this is the time to suggest to management that if they had unit tests on this item, it wouldn't keep coming back like a bad penny.

Another way to address reason 4 is to have management make it part of the process and the code doesn't pass code review unless the tests also pass code review. Best to approach them with making this a policy right after one of those pain points or preferably right after you have had several in a matter of days.

We all like to think that as developers we self-manage (LOL), but the ambitious will care about what managment emphasizes to them that they should care about and the professionals who really do self-manage are already writing the tests. If they neither care about being professional and doing best practices because they improve the product or care how about impressing managers to get promoted (or not fired), then you might consider if this is the right place for you. If you can't get management to care about best practices, then you will be fighting an uphill battle all the way and again, you might assess if this is the right corporate culture for you. While every work place has its problems (and running away isn't always the answer), this place doesn't seem to fit your level of professionalism.


问:
Would a statically typed alternative to JavaScript on webpages be practical?
Preference for dynamic and static typing is largely a matter of taste, and different people find them more or less suitable in different situations.

My question is, would it be technically possible to have a statically-typed alternative to JavaScript for client-side web page augmentation etc.?

答:
Would it technically be possible?  If it's to be implemented in Java, I'd say "very, very hard, but possible" without significant performance loss.

I'm actually handwriting a statically typed DSL in Java right now, and the only way I've found to avoid runtime type-checking is to use generics and suppress "unchecked" warnings... that is, until the time came to implement multi-dimensional arrays (class parameters must be known at compile time and are thus inherently finite, whereas multi-dimensional arrays represent an infinite number of types...)  Still trying to figure this one out, unfortunately-- I'm sure I'll encounter similar problems with user defined classes.

Thing is, I keep stumbling on these sorts of problems, but after sitting on it for a while, I come up with a good solution.  So, to do it and have the performance benefits of static typing (no runtime type checking), I'd say it's extremely difficult, but not impossible.  Minus the performance, I'd say hard but very possible.

I know it's an old question, just thought my experience might be valuable to someone.


问:
What is meant by "Now you have two problems"?
There is a popular quote by Jamie Zawinski:

Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems.

How is this quote supposed to be understood?

答:
Regular expressions are more suitable for tokenisation than for full-scale parsing.

But, a surprisingly large set of things that programmers need to parse are parseable by a regular language (or, worse, almost parseable by a regular language and if you only write a little more code...).

So if one is habituated to "aha, I need to pick text apart, I'll use a regular expression", it's easy to go down that route, when you need something that's closer to a push-down automaton, a CFG parser or even more powerful grammars. That usually ends in tears.

So, I think the quote isn't so much slamming regexps, they have their use (and well-used, they're very useful indeed), but the over-reliance on regexps (or, specifically, the uncritical choice of them).


问:
Is code reviewing good practice?
When the company I work in hired new managers, they offered us to overview someone's code on every meeting. We have meetings every two weeks, so each time one of developers was to show his/her code on the projector, and others were going to discuss it.

I thought this would be great: each developer would be more careful when writing code and we could share our experience better. But somehow we forgot about this and the offer just remained an offer.

What are the benefits of this and are there any drawbacks?

答: This sort of group show and tell would be good for new technologies or to get several jr. devs up to speed, but I don't think it is as good as a consistent review of new code. It is more efficient to have to do it one on one.</p>

Title: Is code reviewing good practice?


问:
Guided Questioning iOS App
I'm making an iPad app that will display a few choices and based on your choice will display a series of questions with each question triggering a different set of questions. I was wondering if there was a name for this or any open-source library that someone has made for this kind of app.

If not, would it be best to hard code all the questions and responses into the app, or to read them from a file?

答:
What kind of framework do you really need? A few view controllers, some nicely-laid-out views, and a sensible way to represent the data: you're done. If you're having trouble seeing how to write such a thing, I'd suggest that you start by deciding how to organize the data:

What's a question?

Are questions organized into groups?

How does the answer to one question affect the question that the program asks next?

"Twenty questions"-like programs have been around for decades. Here's some ancient BASIC source code for Animals. And here's output, thanks to Jeff Atwood's article on a similar theme. Back when personal computers were very new, question-and-answer games were some of the first programs that were used widely in classrooms.

Also very old are text-based adventure games where the player is presented with a situation and a number of options. These kinds of programs aren't very different from the kind of thing you're describing.

So, all this is to say that the structure of your program is probably going to be pretty simple -- I doubt you'll need a framework to get you there.

Title: Guided Questioning iOS App


问:
How important is an SSL certificate for a website?
I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's justified, really!) I'd need one of those expensive certificates that cover subdomains.

As I'm doing this out of my own time and money, so I'm hesitant to drop a couple of hundreds on a certificate, plus a couple of hours delving into something I haven't tried before. I'm not storing any sensitive information besides the email address and the password. As far as I understand, the only vulnerability happens when a user logs or signs up from an unencrypted network (such as a coffee shop) and someone is listening the network.

Am I being cheap? Is this something I should tackle before releasing into the wild. I probably should mention I have 25,000 users signed up to be notified when I launch, so I'm nervous about it.

答: RapidSSL through Trustico is only $30 or you can get a RapidSSL wildcard for less than $160 - they also have a price guarantee, so if you find it cheaper they'll match it.  </p>


答:
I'd like to expand upon HLGEM's answer, especially this section:

Next reason is that with a large existing untested code base, writing tests probably seems overwhelming- a never ending job (like laundry and about as exciting). So human nature is to think that's too much to face, so I'll skip it.

I've found that code I write with the intention of writing tests is significantly better code than code I write without the intention of writing tests; asking myself How will I test this function? forces a better design of each and every function. (Less reliance on global or semi-global data; IO separated from computation; functions do only one thing; consistent error handling; and so forth.)

Trying to put tests on old code that was not written with testing in mind may be beyond frustrating.