答:
The result is usually a clunk of hardly-maintainable yet working code.

Correlation doesn't imply causation.  You have clunky and hard to maintain code because you write clunky and hard to maintain code.  I think the best tool for improving this are code reviews.  A project manager is not going to help you write better code.  Hiring a more experienced developer may help but it's really up to everyone to drive improvement.

Despite everything we are literally flourishing with many successful
  apps on all platforms and bigger clients each project.

So you must be doing something right.  Whatever you do make sure you keep doing the right parts.  Proceed with caution and make sure the process changes you adopt are targeted at fixing some specific problems that you identify.

It's not that we are unaware that stuff like requirements analysis,
  UML, design patterns, source code control, testing, development
  methodologies... etc. exist, we just simply don't use them, and I mean
  like never.

I concur with @JasonTrue that source version control should be your first priority.  In this day and age it is inexcusable not to use source control.  Tools are freely available (git, mercurial, subversion), they are easy to install and use, and the return on investment is practically immediate.  I would suggest starting to do some code reviews and some design reviews, not more than a few hours every week.  Simply taking some time to look at what you are doing, share your experiences and consider better ways of doing can be a big helper.  Agile practitioners will call this a retrospective.

Again I concur with @JasonTrue that build automation and test automation are the natural next steps.

Once you have version control, automated builds, you're doing some code reviews and retrospectives and basic simple automated testing things will look a lot better.  Just add your desired amount of chaos on top of that :-)

Oh, and definitely read books:
https://stackoverflow.com/questions/1711/what-is-the-single-most-influential-book-every-programmer-should-read

Title: How to Be a Software Engineer?


问:
What's the best Java equivalent to Linq?
Are there any libraries in Java that come close to providing the functionality of Linq?</p>

答:
There isn't a native feature in java that mimics linq. However, there are several APIs that provide the same functionality.

For example, this blog post has a custom jar to replicate linq.

http://javaworldwide.blogspot.in/2012/09/linq-in-java.html

And this is an example usage of the API from the post:

Suppose we have an Animal object containing name and ID which is represented with a list of animals.  If we want to get the all the Animal names which contains 'o' from the list animals, we can write the following query

from(animals).where("getName", contains("o")).all();

There are two other APIs referenced in the blog posting:
lambdaJ
and
jLinq

ContentLicense: CC BY-SA 3.0


答:
You could use Korma, a DSL for SQL queries written in Clojure.

Syntax is pretty neat:

```<code>(select user
  (with address)
  (fields :firstName :lastName :address.state)
  (where {:email "korma@sqlkorma.com"}))
</code>```

You can call this pretty easily from Java by importing the relevant Clojure libraries and just using the normal Clojure/Java interop.

Title: What's the best Java equivalent to Linq?

Body: Are there any libraries in Java that come close to providing the functionality of Linq?</p>

Body:
You could use Korma, a DSL for SQL queries written in Clojure.

Syntax is pretty neat:

(select user
  (with address)
  (fields :firstName :lastName :address.state)
  (where {:email "korma@sqlkorma.com"}))

You can call this pretty easily from Java by importing the relevant Clojure libraries and just using the normal Clojure/Java interop.


问:
Formal definition for term "pure OO language"?
I can't think of a better place among SO siblings to pose such a question. Originally I wanted to ask "Is python a pure OO language?" but considering troubles and some sort of discomfort people experience while trying to define the term I decided to start with obtaining a clear definition for the term itself.

It would be rather fair to start with correspondence by Dr. Alan Kay, who has coined the term (note the inspiration in biological analogy to cells or other living objects).

There are following ways to approach the task:

Give a comparative analysis by listing programming languages that can exhibit (or fail to do so) certain properties unique and sufficient to define the term (although Smalltalk, Scala, Java, and so on - are possible examples but IMO this way seems neither really complete nor fruitful)

Give a formal definition (or close to it, e.g. in more academic or mathematical style).

Give a philosophical definition that would totally rely on semantical context of concrete language or a priori programming experience (there must be some chance of successful explanation by the community).

My current version: "If a certain programming (formal) language that can (grammatically) differentiate between operations and operands as well as infer about the type of each operand  whether this type is an object (in sense of OOP) or not then we call such a language an OO-language as long as there is at least one type in this language which is an object. Finally, if all types of the language are also objects we define such language to be pure (strong) OO-language."

Would appreciate any possible improvement of it. As you can see I just made the definition dependent on the term "object" (often fully referenced as class of objects).

[EDIT]

In addition, I use (luckily well understood) notion of a type as in typed languages. Data type programming or type oriented programing is not only a syntactical interpretation (of the program text, i.e. how to treat certain  values of literals and data variables - something that evolves into type safety) but can be attributed to language grammar and studied in formal way (using mathematical logic) as so called type systems. Notice that requiring particular type system to have a so called universal type is one of the ways defining purity of OO language (there are ways to expand this semantically).

NB

how to answer:

it helps if you specify a book or a reference that supports/explains your understanding of terminology and concepts (usually a good definition covers or references all depended concepts except elementary).

if possible indicate an indented category of your answer/definition if it is not clear otherwise (see above: 1 - by language example, 2 - mathematical logic, 3 - technical description and programming philosophy)

classification is important (and also because term pure-OO is included into term OO) while answering try to unmix  elements of OO paradigm from other well known methodologies (and by no means confuse/overlap them, e.g. typically elements of modular programming can be covered/embodied with OO programming): try to distinguish OOP from (including or being a part of) Functional programming, Logical programming (especially strongly specialized ), Abstarct Data Types (ADT), Modular, Metaprogramming (generics and LISP's macroexpansion-time), Contracts (e.g. Eiffel), Aspect-oriented (AO), (difference between declarative and functional classification as well as historical definitions of Dijkstra's structured are clear)

on difficulty of giving a formal definition: surprisingly enough it is very easy to give a mathematical description of OOP in form of a certain logical (formal) system (most likely type based) and defining one concept after another. One can even try to do something more practical by applying that formalism to type safety checking or new language design aspects than merely abstract entertainment or exercise (also lookup formulation of OOP in Intuitionistic Type Theory, Dependent types, independently, in FOL formalisms as lambda calculus and just by using category theory). A main point here is that unsurprisingly such formulations IMO are strongly biased (flawed) by most likely initially incomplete understanding of OOP (in computer engineering) and end up being almost inaccessible afterwards (thus hardly contributing backwards to programming world - maybe except certain percentage finds applications back from formal world by being integrated into popular languages).

So yes, it is difficult to give exactly a "good" definition, not just definition. But I am positive of asking this here because of your experience and direct involvement, guys.

答:
You can think of it by negative example.  Java is not a pure object oriented language because there are also primitive types that are not objects.  These are integers, doubles, arrays and so on.  In a pure object language, the semantics of objects are available for everything.

There's also the question of how much of the language is closed to modification, even within the object framework.  In java you can't define new subclasses for some classes, such as
String or Class.

Which languages are pure? The only candidate that comes to mind is smalltalk.


问:
Python as a first language?
I have just started working in Information Security World. I want to learn the Python language for creating my own automated tool for Fuzzing, SQL-Injection etc.

My question is I don't know much about C language (only basic knowledge) but I want to learn directly Python Language so is it good?

I have seen there is lots of difference between Python and C (obviously) and for Information Security field Python = GOD so I want to know learning Python need any experience on C language? If not so can I start learning Python directly?

答: There is no need to know C if you want to learn Python. Do take a look around you what kind of language other people use, and find out why. If everyone else uses e.g. C it could make sense to use that. This makes collaboration and exchange of code easier. In addition, there might be reasons to choose a certain language, e.g. libraries or performance issues. I don't know what your situation is, but Python is great language imo.</p>

Title: Python as a first language?


答:
I would approach this by defining it as a language which uses OOP constructs and nothing else (in the same way that a pure FP language uses pure functions with immutable data and nothing else).

In particular:

Every entity that your program operates on is a first class Object - i.e. no primitives, no pointers, no arrays etc.

The only thing you can do with an object is call a (potentially polymorphic) method on it (== sending a message). No other operations exist.

All data is encapsulated - i.e. no public field access, you must go via methods on an object

If you have first class functions then they must also be objects - so you would need to do something like functionObject.call(param1,param2)

No global variables - if you want something like this you would need to use an object to represent the current global environment, e.g. environment.getValue("myThing") or put the variable in a class object

Note that this still leaves quite a few options open:

Class-based vs. prototype-based object models

How inheritance is implemented (if at all)

Whether you have single or multiple dispatch on methods

Whether your objects are statically or dynamically typed

The exact syntax used for method calls (e.g. you could have some syntactic sugar for getters / setters etc.)

Title: Formal definition for term "pure OO language"?

Body:
I can't think of a better place among SO siblings to pose such a question. Originally I wanted to ask "Is python a pure OO language?" but considering troubles and some sort of discomfort people experience while trying to define the term I decided to start with obtaining a clear definition for the term itself.

It would be rather fair to start with correspondence by Dr. Alan Kay, who has coined the term (note the inspiration in biological analogy to cells or other living objects).

There are following ways to approach the task:

Give a comparative analysis by listing programming languages that can exhibit (or fail to do so) certain properties unique and sufficient to define the term (although Smalltalk, Scala, Java, and so on - are possible examples but IMO this way seems neither really complete nor fruitful)

Give a formal definition (or close to it, e.g. in more academic or mathematical style).

Give a philosophical definition that would totally rely on semantical context of concrete language or a priori programming experience (there must be some chance of successful explanation by the community).

My current version: "If a certain programming (formal) language that can (grammatically) differentiate between operations and operands as well as infer about the type of each operand  whether this type is an object (in sense of OOP) or not then we call such a language an OO-language as long as there is at least one type in this language which is an object. Finally, if all types of the language are also objects we define such language to be pure (strong) OO-language."

Would appreciate any possible improvement of it. As you can see I just made the definition dependent on the term "object" (often fully referenced as class of objects).

[EDIT]

In addition, I use (luckily well understood) notion of a type as in typed languages. Data type programming or type oriented programing is not only a syntactical interpretation (of the program text, i.e. how to treat certain  values of literals and data variables - something that evolves into type safety) but can be attributed to language grammar and studied in formal way (using mathematical logic) as so called type systems. Notice that requiring particular type system to have a so called universal type is one of the ways defining purity of OO language (there are ways to expand this semantically).

NB

how to answer:

it helps if you specify a book or a reference that supports/explains your understanding of terminology and concepts (usually a good definition covers or references all depended concepts except elementary).

if possible indicate an indented category of your answer/definition if it is not clear otherwise (see above: 1 - by language example, 2 - mathematical logic, 3 - technical description and programming philosophy)

classification is important (and also because term pure-OO is included into term OO) while answering try to unmix  elements of OO paradigm from other well known methodologies (and by no means confuse/overlap them, e.g. typically elements of modular programming can be covered/embodied with OO programming): try to distinguish OOP from (including or being a part of) Functional programming, Logical programming (especially strongly specialized ), Abstarct Data Types (ADT), Modular, Metaprogramming (generics and LISP's macroexpansion-time), Contracts (e.g. Eiffel), Aspect-oriented (AO), (difference between declarative and functional classification as well as historical definitions of Dijkstra's structured are clear)

on difficulty of giving a formal definition: surprisingly enough it is very easy to give a mathematical description of OOP in form of a certain logical (formal) system (most likely type based) and defining one concept after another. One can even try to do something more practical by applying that formalism to type safety checking or new language design aspects than merely abstract entertainment or exercise (also lookup formulation of OOP in Intuitionistic Type Theory, Dependent types, independently, in FOL formalisms as lambda calculus and just by using category theory). A main point here is that unsurprisingly such formulations IMO are strongly biased (flawed) by most likely initially incomplete understanding of OOP (in computer engineering) and end up being almost inaccessible afterwards (thus hardly contributing backwards to programming world - maybe except certain percentage finds applications back from formal world by being integrated into popular languages).

So yes, it is difficult to give exactly a "good" definition, not just definition. But I am positive of asking this here because of your experience and direct involvement, guys.


答:
If you are interested in computer security, then having understanding of C and assembly is almost certainly a requirement(depending a bit on what kind of things you're interested in though). That said, I would personally begin with Python to learn basic concepts of programming but move onto C and assembly at some point to deepen understanding of how software really works at the operating system and hardware level.

Regarding security, There's also the IT Security StackExchange  site

Title: Python as a first language?

Body:
I have just started working in Information Security World. I want to learn the Python language for creating my own automated tool for Fuzzing, SQL-Injection etc.

My question is I don't know much about C language (only basic knowledge) but I want to learn directly Python Language so is it good?

I have seen there is lots of difference between Python and C (obviously) and for Information Security field Python = GOD so I want to know learning Python need any experience on C language? If not so can I start learning Python directly?


问:
What would be a good  way to request comments?
In the project/team I'm working the frequency of comments is a little low.
One reason might be that it is not clear to the long-time devs what lines in the code really needs a comment (each part of the project has quite fixed devs).

To increase this we plan to let team members review the code and check in "requests for comments", which the main dev of that part should replace with useful comments.

Do you think this could work?

If "yes": what tags should we use to mark? (e.g. //TODO please comment)

Can you think of alternatives for this process?

Edit: I appreciate your answers about best practice in commenting and writing code, and I completey agree.
But my question targets the cases where refactoring is not an option (not wanting to change working code, not wanting to "accuse" main dev of producing code that needs refactoring,...) - so only more or better comments are an option (at least for this question).

答:
IMHO lack of comments is not necessarily a bad thing. Most of the time the code can be written to be self-explaining, thus it needs no comments (apart from API documentation). The few exceptions are when the code is intentionally difficult, e.g. it implements a known algorithm, contains performance optimizations etc.

Overall, the quantity (and even the quality and correctness) of comments is a bad indicator of overall code quality. You should rather focus on the full picture: creating (and keeping) clean, readable, maintainable code - of which comments are only a small part.

So if you see a piece of code which you feel is in need of comments, consider refactoring first. Most often the code can be refactored to be easy to read, and this eliminates the need for comments.

E.g. if you see a long method performing some lengthy operation which clearly has several distinct phases / steps, you may feel it necessary to add comments before each phase, like

```<code>void SomeLongCalculation(...) {
  // Calculate the foo coefficient
  ...

  // Determine the bar factor
  ...

  // Sum up the blorg values
  ...

  // Calculate the yearly average
  ...

}
</code>```

whereas you could extract each step into a separate method with a descriptive name instead:

```<code>void SomeLongCalculation(...) {
  CalculateFooCoefficient(...);
  DetermineBarFactor(...);
  SumBlorgValues(...);
  CalculateYearlyAverage(...);
}
</code>```

This makes each step explicit, keeps all the code in your method on the same abstraction level, thus making it clean and easy to read. Moreover, it enables you to unit test each substep in isolation.

Body:
IMHO lack of comments is not necessarily a bad thing. Most of the time the code can be written to be self-explaining, thus it needs no comments (apart from API documentation). The few exceptions are when the code is intentionally difficult, e.g. it implements a known algorithm, contains performance optimizations etc.

Overall, the quantity (and even the quality and correctness) of comments is a bad indicator of overall code quality. You should rather focus on the full picture: creating (and keeping) clean, readable, maintainable code - of which comments are only a small part.

So if you see a piece of code which you feel is in need of comments, consider refactoring first. Most often the code can be refactored to be easy to read, and this eliminates the need for comments.

E.g. if you see a long method performing some lengthy operation which clearly has several distinct phases / steps, you may feel it necessary to add comments before each phase, like

void SomeLongCalculation(...) {
  // Calculate the foo coefficient
  ...

  // Determine the bar factor
  ...

  // Sum up the blorg values
  ...

  // Calculate the yearly average
  ...

}

whereas you could extract each step into a separate method with a descriptive name instead:

void SomeLongCalculation(...) {
  CalculateFooCoefficient(...);
  DetermineBarFactor(...);
  SumBlorgValues(...);
  CalculateYearlyAverage(...);
}

This makes each step explicit, keeps all the code in your method on the same abstraction level, thus making it clean and easy to read. Moreover, it enables you to unit test each substep in isolation.


答:
OO, according to Alan Kay is all about message passing, and that's it. You will see that qualities such as polymorphism and encapsulation are actually derived from message passing.

Now that stance is in fact very extreme, because it basically means that only Smalltalk and languages alike would qualify.

I think you can define OO as building your system on entities, that fully encapsulate their state, and that are rendered exchangeable due to their inherent polymorphous qualities. One could thus argue a purely OO language ensures these two core qualities are always met. What renders OO languages "impure" would be mechanisms that allow the creation of constructs that do not meet these criteria, such as the possibilities to:

declare public fields

declare variables that can only hold instances of a specific class and its subclasses (i.e. variables should be typed against interfaces, which is what the biological objects communicate through in Kay's anology), which is rendered even narrower if the class in question is final, as that leaves even less room for polymorphism

declare primitives

Then again, IMHO language purity is more a weakness than a strength. OO is not a silver bullet. No single paradigm is.


问:
Is mysql_* deprecated after PDO was introduced?
I have been noticing for a long time on Stack Overflow that most users recommend to use PDO instead of mysql_*, because PDO is more secure than mysql_*. But my question is if websites which are already running with mysql_* will stops working? Or what exactly does "deprecating" mean here? So should we have never used  mysql_*? From which PHP version is is deprecated?

答:
See PHP.net page FAQ.  It answers your question and gives migration advice.

Your code won't suddenly stop working unless when PHP remove the functionality, you upgrade your PHP version.  The FAQ page advice recommends you write new code using one of the alternatives.  If it's not a massive job, it could be worth considering switching.. that depends on your project though.


答:
Can you think of alternatives for this process?

Yes, I can. When you are going to review a piece of code, do it pairwise - one reviewer and the dev who wrote it, directly sitting in front of the same screen. Instead of adding "request for comments", let the main dev explain what the code does (and why!), and the reviewer directly add a comment with words he understands.

And think about allowing some refactoring during that process - at least, when you have automatic refactoring tools at hand, which give you only a very small risk of destroying something. I am here with Péter Török - small methods with self-describing names and small scope need less comments and are much better than big methods with lots of block-comments.

Title: What would be a good  way to request comments?

Body:
In the project/team I'm working the frequency of comments is a little low.
One reason might be that it is not clear to the long-time devs what lines in the code really needs a comment (each part of the project has quite fixed devs).

To increase this we plan to let team members review the code and check in "requests for comments", which the main dev of that part should replace with useful comments.

Do you think this could work?

If "yes": what tags should we use to mark? (e.g. //TODO please comment)

Can you think of alternatives for this process?

Edit: I appreciate your answers about best practice in commenting and writing code, and I completey agree.
But my question targets the cases where refactoring is not an option (not wanting to change working code, not wanting to "accuse" main dev of producing code that needs refactoring,...) - so only more or better comments are an option (at least for this question).


问:
Methods for systematically researching technologies to use in a project?
If I want to recommend a technology/plugin/library to my company for use in a project, are there any methodologies I can use that will produce more reliable results and a more convincing presentation of said results than just my own "common sense" approach?</p>

答:
There's a book published for the PRINCE2 development methodology called "Buying Software: A Best Practice Approach" that describes a ridiculously elaborate software procurement process that might be justified for choosing software to be deployed for daily usage by tens of thousands of employees and costing millions of dollars, but it could be scaled down to your scenario:

Focus on a business case, i.e. a costs/benefit comparison, where costs include learning the new technology

Identify stakeholders, i.e. the people who will use the technology or may have some input (e.g. lawyers) and get feedback from them (the overall most important point)

Collect criteria for choosing the technology: this may include functional and non-functional requirements, riskiness, legal and other constraints

Prioritize the criteria (stakeholders should be involved here)

If there are multiple candidate technologies, choose the most likely by using the highest-priority, most quantifiable or most easily evaluated criteria

Evaluate how the candidates fulfill the criteria, by actually testing them or looking for other people's experiences. This is the most time-consuming step and its length should be proportional to the expected benefit. Use it especially to reduce uncertainties.

The result is a matrix of how well the candidates fulfull the criteria. This should be presented as the basis for the final choice.

After a while, check whether the desired results have been achieved and if not, why.


答:
No, there is no formal or even useful definition, and there never will be. To some people, OOP means "Universal base class" and "Must use reference semantics, best with a garbage collector"- and you can even get quibbles about syntax, one of the least relevant things ever invented.

Ultimately, first, you have to answer the question "What is an object?". The more narrow-minded will insist on inheriting from some pointless universal base class and needlessly being allocated on a garbage collector to qualify. But I prefer a much more useful definition. The purpose of OOP is to have some data, and some functions you can call on that data. So

An object holds some state and offers some functions on that state.

In this case, even int qualifies. After all, when you write template code in C++ which can accept either primitives or objects, then it becomes difficult to argue that primitives are different in any substantial way. There's nothing meaningfully different about Vector v1, v2; v1 + v2; instead of int v1, v2; v1 + v2; (except the crappy initialization semantics, one must admit). Also, this permits lambdas and such things to be objects, as they hold state- their captures- and offer a function on that state, to call the lambda.

Fortunately, we can also classify pointers to free functions as objects, since they both hold state (an address) and a function on that state (to call it). So a free function should be allowed- even if you were to say that all free functions are in fact global function pointers.


答:
I think it is a good idea to do that, if the team is big enough and there is enough time. Comments are necessary in code, the question is how it is done. Your team probably has, or is planning on implementing a comprehensive way of commenting. Either way, the right kind of commenting will speed up the development process, combined with the answer by Péter Török.

On my project last semester, the supervisor used gerrit for the code review. This is the same system that is used in the whole department and it functions quite well. He simply reviewed our code and indicated all the parts that needed more comments or improvements. This can be an answer to your last two questions, or you could find a similar system that does this.


问:
Verification of requirements question
Doing a lot of reading about V&V, I would need to clarify the following.
A lot of definitions (less formal ones found in books) define verification like that:

Verification: The software should conform to its specification.

But then they speak about requirement verification, design verification etc. If I say that these items are "software" in terms of applying the definitions, what should I checked them against? What specification should requirements, which is the basic information, conform to?

And one more thing: shouldn't requirements also be validated? To make sure they meet the customer needs? All texts I have, speak only about SW validation on the end of the development process!

EDIT: Just to make it clearer, my main question is how the definition of verification apply to requirements. The bookss or e.g. ISO 12207:2008 mention that verification is a process that the product reflect the requirements. One of the process is requirements spec review. But how can requirements conform to requirements?

答: Requirements can be validated for consistency.  It's perfectly possible (and unfortunately even common) for a longer requirements document to contradict itself in places.  This would make it impossible for any of the next steps in the sequence to conform to the requirements, so validating the requirements themselves is the obvious and important first step.</p>

Title: Verification of requirements question


问:
"Do you have any questions for us?" In an interview
You know the prospective company fairly well but are asked "Do you have any questions for us?".  To show interest, what are some of your favorite questions to reply?</p>

答:
If it's only about showing your (fake) interest, ask questions about their business, what matters to them.

If you think it's an opportunity for you to interview them back, ask questions about things that matters to you.

ContentLicense: CC BY-SA 2.5


问:
Why are many programmers moving their code to github?
For the past 6 months or more, I've been seeing many codes hosted at sourceforge.net as well as other hosting sites "Move to GitHub". A mere Google Search with the phrase "Moved to Github" returns several results containing the text moved to github. This is very confusing for me, and I'm wondering, why exactly are people moving? Does it mean that GitHub is better or is there some special advantage I'm not seeing?</p>

答:
This is a symptom of a wider migration towards distributed version control systems.

Some websites which traditionally hosted non distributed VCS (eg Codeplex & SourceForge) were a little slow in adding support for DVCS (eg Git or Mercurial). So, people who wanted to use DVCS for their project were forced to migrate their projects over to the providers which supported them (eg Github or BitBucket). Github was one of the first to offer DVCS support and so naturally a lot of people migrated their code there in order to take advantage of it.

Those other websites are only now starting to catch up to DVCS (Codeplex for example now supports Mercurial & Git), but they are still a way behind in terms of features such as forking and submitting pull requests. To really take advantage of DVCS Github and Bitbucket are still the best options.


答:
It depends how are the terms defined in the book you are using.
In wikipedia there is an interesting text about SW Verification.

For me validation of requirements basically means that requirements are clear enough for the customer and the organisation that is going to deliver SW so that they can make a formal deal.
Of course the validation process is not so simple. I know projects where QA teams read requirements to validate their correctness.
Here you have example of checklist for requirements I use:

clarity

unambiguity

feasibility

provability

consistency

necessity

free of redundancy

Title: Verification of requirements question

Body:
Doing a lot of reading about V&V, I would need to clarify the following.
A lot of definitions (less formal ones found in books) define verification like that:

Verification: The software should conform to its specification.

But then they speak about requirement verification, design verification etc. If I say that these items are "software" in terms of applying the definitions, what should I checked them against? What specification should requirements, which is the basic information, conform to?

And one more thing: shouldn't requirements also be validated? To make sure they meet the customer needs? All texts I have, speak only about SW validation on the end of the development process!

EDIT: Just to make it clearer, my main question is how the definition of verification apply to requirements. The bookss or e.g. ISO 12207:2008 mention that verification is a process that the product reflect the requirements. One of the process is requirements spec review. But how can requirements conform to requirements?


问:
Complexity of a web application
I am currently writing my Master's Thesis on maintainability of a web application. I found some methods like the "Maintainability Index" by Coleman et.al. or the "Software Maintainability Index" by Muthanna et.al.
For both of them one needs to calculate the cyclomatic complexity. So my question is:

Is it possible to measure the cyclomatic complexity of a web application?

In my opinion there are three parts to a web application:

Server code (PHP, C#, Python, Perl, etc.)

Client code (JavaScript)

HTML (links and forms as operators, GET-parameters and form fields as operands!?)

What do you think? Is there another point of view on the complexity of web application? Did I miss something?

答:
Cyclomatic complexity is one of the multiple measurements of code complexity. For example, in Visual Studio, the maintainability index depends on:

Cyclomatic complexity,

Depth of inheritance,

Class coupling,

Lines of IL code (IL code being the source code compiled to Intermediary Language which is then JIT-compiled).

Every of those measurements, as well as other complexity measurements, work somehow, but are never the absolute indication that the source code has complexity issues. Some measurements, as LOC, are known to be totally meaningless and misleading; others, like cyclomatic complexity, are slightly better, but still have issues.

This is due to the fact that:

It is too complicated for a computer program to know how really complex the source code would be perceived by a developer.

For example, I often noticed a huge drop of maintainability index when refactoring the code from procedural-style to functional-style through LINQ, transforming a block of highly unreadable source code into a single chaining expression which was extremely explicit.

Another example would be the reflection of programming patterns on the metrics. Often, by introducing programming patterns into your code, you will make it less complex for a developer (assuming this developer is familiar with those patterns), but the maintainability index will drop.

Source code can have different forms.

Measuring cyclomatic complexity or depth of inheritance or class coupling is very limited for a web application, because, as you said, the existence of HTML/CSS, JavaScript, etc., and, as noted in the comments, the existence of database access.

This limitation doesn't exist only for web apps. In desktop applications, for example, what about the complexity of the UI layout (XAML code in Windows applications)? What about the generated code? Or database access?

Title: Complexity of a web application


答:
One of the best validations for a requirement, if you're going to do verification, is that it can be verified. How would you verify these:

The system will be responsive and fluid

The user interface will be intuitive

The system will be easily adaptable in the case of future changes

I see these sorts of things in requirements all the time. If you actually intend to have a pass through all the requirements one by one and say "yes, I confirm that requirement 124 has been met" then the statements above don't get to be requirements (and I'm not just talking about shall/will issues.) They're not testable.

What is testable? This sort of thing:

There will be a menu to enable users to choose a report

There will be a screen to enter a new customer. It will have the following fields: blah, blah, blah, blah for pages and pages

Only managers will be able to set an order's priority (this one needs two tests: one that a manager can, and one that non-managers can't)

Sales tax will be calculated as follows: [half page thing about in/out of state/province and all the other complicated stuff for sales taxes)

Each requirement should lead to at least one test that you would use to verify the software against it.

The only problem with writing requirements this way is that they become enormously long and repetitive. Ordinary users will refuse to read them after a few iterations, and the risks increase that your developers will produce something that meets all the requirements, but that nobody wants. Somthing to be aware of.

Title: Verification of requirements question


问:
How do I store the OAuth v1 consumer key and secret for an open source desktop Twitter client without revealing it to the user?
I want to make a thick-client, desktop, open source twitter client. I happen to be using .NET as my language and Twitterizer as my OAuth/Twitter wrapper, and my app will likely be released as open source.

To get an OAuth token, four pieces of information are required:

Access Token (twitter user name)

Access Secret (twitter password)

Consumer Key

Consumer Secret

The second two pieces of information are not to be shared, like a PGP private key. However, due to the way the OAuth authorization flow is designed, these need to be on the native app. Even if the application was not open source, and the consumer key/secret were encrypted, a reasonably skilled user could gain access to the consumer key/secret pair.

So my question is, how do I get around this problem? What is the proper strategy for a desktop Twitter client to protect its consumer key and secret?

答:
I may be wrong, but if you bundle keys with the desktop or mobile app, open source or not, it is possible to access them. If services like Twitter and Tumblr force us into using OAuth-only API, we have two options:

setup an auth proxy service for every app

bundle keys with the app

The former is more difficult and costly, not necessarily maintainable for small and open source apps. The latter means that the app may and will be blocked, once the spammers steal the keys. As Twitter and Tumblr don't give a better option yet, and screw all desktop clients, Open Source clients inclusive, there is a proposal to distribute "Big Fish" keys, and use them as a fallback.

Finally, there is an option to force every user into obtaining API keys.


问:
How to efficiently protect part of an application with a license
I am working on an application that has many functional parts.

When a customer buys the application, he buys the standard functionality, but he can also buy some additional elements of the application for an additional price.
All of the elements are part of the same application executable.
A license key is used to indicate which of the elements should be accessible in the application.

Some of the elements can be easily disabled if the user didn't pay for it.  These are typically the modules that you can access via the application's menu.

However, some elements give more problems:

What if a part of the data model is related to an optional part?  Do I build up these data structures in my application so the rest of my application can just assume they're always there?  Or do I don't build them, and add checks in the rest of may application?

What if some optional part is still useful to perform some internal tasks, but I don't want to expose it to the user externally?

What if the marketing responsible wants to make a standard part now an optional part?  In all of my application I assume that that part is present, but if it becomes optional, I should add checks on it everywhere in the application.

I have some ideas on how to solve some of the problems (e.g. interfaces with dual implementations: one working implementation, and one that is activated if the optional part is not activated).

Do you know of any patterns that can be used to solve this kind of problem?  Or do you have any suggestions on how to handle this licensing problem?

Thanks.

答: One thing that would be possible, as you mentioned it is having an interface with dual implementation, and using a DI container to conditionally inject the proper component if it is available. Simple and effective. You won't really need to add checks everywhere as this confines module management to a single place. This is obviously assuming that your system is designed well enough to profit from a DI container.</p>


问:
What is the impact of CSS Validation Failure?
I am developing a asp.net website. When I used the CSS property "word-wrap", VIsual Studio 2010 is showing a warning: Validation (CSS 2.1) 'word-wrap' is not a known CSS property name.

When I tested the website, it is working fine. However, can there be any issue in using this property ignoring the warning?

答:
Anything that is proprietary will only work in the browser that it is for. In other browsers, it is simply ignored. So in some way it is safe to ignore the warning, as long as you know it will not break the layout of the page in browsers that do not support the feature.

As far as the feature itself, from what I checked, it is a CSS3 feature. Which is why it will not validate as CSS2.1:

https://stackoverflow.com/questions/5923936/how-to-use-the-word-wrap-property-in-css-2-1-and-validate-css

http://www.w3.org/TR/css3-text/#overflow-wrap


问:
Resources for popular domain models
I have come across many situations where I had to build a system for a library or a clinic or other popular domains.

The thing is a domain model for a library was probably done 1000 times already with different level of details of course. Here is an example.

Is there a popular website or community where one can find ready made domain models for popular systems?

The whole purpose I'm trying to achieve is to quickly get a grasp of the domain I'm modelling and customise it to my needs. Re-inventing the wheel seems really absurd when the same system might have been modelled properly previously.

Note

I know Google might sound like the perfect source, but it will better if there is a repository out there that people can post there models, so that others can share them.

答:
The whole purpose I'm trying to achieve is to quickly get a grasp of the domain I'm modelling and customize it to my needs.

There are books and other resources specially in the area ERP that discusses domain model (at least at a high level). However, for a system such as Library Management, you may not find much in the public domain.

You could still utilize standard domain entities such as "part", "supplier", etc. with some modifications. You could also use industry standards such as Library of Congress ID, ISBN(s), etc.

The reasons that 1 domain model does not fit all are the following:

Business are different.

Desired span of automation (system scope) is different, as business goals are different.

Business processes are different.

One way to look for to get a better business understanding for this are is specialized books on the subject, something like this may help: Google Books-Library Information Systems and Library Automation.

The main categories you want to understand are:

1 - Business standards (such as ISBNs, etc. worldwide).

2 - General laws and regulations.

3 - Standard systems your system need to integrate with and how the integration works (you need to know special data exchange formats, data exchange protocols etc.).

4 - Specific customer requirements (processes, data, business rules, etc.).

Title: Resources for popular domain models


答:
The discussion about so-called OO languages has always been a bit on the brain-washed side. Ie:

"Someone has told me that language X is OO, so therefore language X equals OO then every language that lacks the features of language X cannot possibly be OO. And because I'm writing my code in language X, everything I do is OO."

The term object-oriented design boils down to 3 things:

Modular design with autonomous objects that don't know needless information about the rest of the program, aka as loose coupling as possible.

Encapsulation of data inside objects to prevent external access, both intentional and accidental.

Clearly specified dependencies between objects. To achieve loose coupling, but also to make the program easier to maintain and expand.

1) is pure program design, it can be achieved in any programming language. However, some languages have helpful features such as class/struct and private keywords.

2) is mainly program design, though cannot be fully achieved without language support, since you need language mechanisms like private/static to protect against accidental use.

3) is mainly program design. There are typically three different dependencies: "object X contains object Y", "object X is a kind of Y" and "object X interacts with object Y". There are plenty of language features to help with these dependencies: inheritance/polymorphism, abstract base classes and so on.

Now, if we look at the above we can see that you barely need any language features to write OO programs. The features just make it far easier.

The above goals cannot be achieved by using some muddy backwards-logic: just because you use the class keyword, your program does not automatically get a modular design. Just because you use inheritance, it doesn't automatically mean that your object dependencies make sense. A language with OO features would still allow things like class TheWholeBloodyProgram or "Animal inherits Cat".

Sadly, the topic of good object-oriented program design is rarely mentioned in these kind of discussions. Brainwashed programmers only look at the syntax and yap things like for example "C++ has primitive data types so your C++ program isn't OO", then they go off to write a downright horrible program in their own favourite language, without using any hint of program design what-so-ever.

To answer the question: very few, if any languages have support for proper OO program design. To find out which languages that has certain OO-related features is irrelevant as long as the programmer doesn't know what object-oriented design means. A programmer claiming that certain languages are object-oriented has most likely not grasped the concept of OO as whole. Ask the would-be OO programmer how they design OO programs. If the first thing they do is to start yelling language keywords, then you can safely assume they don't know OO design.

Perhaps there exists some fancy high-level UML-ish tool far above the raw source code, which enforces the programmer to only write programs with good object-oriented design, but I doubt it. The best design tools for OO programming is most likely still the human brain and common sense.


答:
You may ignore css warnings as far as they do not break your page layout.
However, if you do not use HTML validation in your development, you may turn off it as well.

You'll need to turn off HTML Validation:

Tools > Options > Text Editor > HTML > Validation

Uncheck the "Show Errors" check box.

And CSS file error detection:

Tools > Options > Text Editor > CSS > CSS Specific

Uncheck "Detect Errors"

Title: What is the impact of CSS Validation Failure?

Body:
I am developing a asp.net website. When I used the CSS property "word-wrap", VIsual Studio 2010 is showing a warning: Validation (CSS 2.1) 'word-wrap' is not a known CSS property name.

When I tested the website, it is working fine. However, can there be any issue in using this property ignoring the warning?


答:
Project hosting is infrastructure. Infrastructure exhibits network effects, which means that infrastructure gets more useful the more people are connected to it. (In particular, the usefulness is O(number_of_connections), which means that for any individual member it is O(total_members) and for the whole system it is O(total_members^2)). This, in turn, leads to an effect called natural monopoly, which means that it is natural for such a system that only one competitor will survive, since the usefulness is maximized when everybody uses the same system.

So, it makes sense to join the market leader, which is GitHub. There are more repositories, more users, more branches, more revisions, more everything on GitHub than on SourceForge, Google Code and CodePlex combined.

The interesting question is, of course, if network effects mean that the market leader automatically obtains a natural monopoly, how was GitHub able to break SourceForge's?

And the answer is, by being so disruptive that the pain of joining a much smaller infrastructure was worth it for the early adopters:

GitHub was the first to offer Git hosting with a feature set comparable to that of SourceForge (or at least that part of SourceForge that most people used)

GitHub was cool, from a UI standpoint: slick, modern Web UI

GitHub was cool, technology-wise: Ruby on Rails, Sinatra, Erlang, node.js

GitHub was Web 2.0, with its focus on Social Coding, and Users over Projects

Title: Why are many programmers moving their code to github?

Body: For the past 6 months or more, I've been seeing many codes hosted at sourceforge.net as well as other hosting sites "Move to GitHub". A mere Google Search with the phrase "Moved to Github" returns several results containing the text moved to github. This is very confusing for me, and I'm wondering, why exactly are people moving? Does it mean that GitHub is better or is there some special advantage I'm not seeing?</p>


答:
Sounds like what you need is a License or Product key.  Searching google with "license key generator" will turn up a number of results, including this one if you want to roll your own.

Generally, you'll put a security / license check near the beginning of the licensed code path.  Your callers will need to be able to gracefully handle a failed call due to not being licensed.

Ideally, you'll have some calls that check the license prior to populating the user menus.  It's a lot harder for the user to select the "wrong thing" that they aren't licensed for when the option isn't even visible.

There are a couple of ways to solve the problem of areas where you need to use some licensed functionality within a standard function.  Probably the easiest is to have two main paths into that licensed function.  One path checks the license and is ultimately exposed out to the UI.  The other path is not exposed and doesn't check the licensing either.

Similarly with the DB, you can have two paths to access the functionality.  If some of the standard function really relies upon optional DB structures then keep them in place, but don't expose the access through the UI.  Keep in mind that a DBA will still be able to tap into those table structures.  Generally, it's the functionality you provide around the structures that's more valuable, not the tables themselves so that shouldn't be too big of an issue.

To deal with market changes on what's licensed or not, you can either have all major functionality go through the security checks described or just add them in later as necessary.  I'd vote for the lazier route and only put the license check into standard functions if and when Marketing decides to go down that route.

Title: How to efficiently protect part of an application with a license

Body:
I am working on an application that has many functional parts.

When a customer buys the application, he buys the standard functionality, but he can also buy some additional elements of the application for an additional price.
All of the elements are part of the same application executable.
A license key is used to indicate which of the elements should be accessible in the application.

Some of the elements can be easily disabled if the user didn't pay for it.  These are typically the modules that you can access via the application's menu.

However, some elements give more problems:

What if a part of the data model is related to an optional part?  Do I build up these data structures in my application so the rest of my application can just assume they're always there?  Or do I don't build them, and add checks in the rest of may application?

What if some optional part is still useful to perform some internal tasks, but I don't want to expose it to the user externally?

What if the marketing responsible wants to make a standard part now an optional part?  In all of my application I assume that that part is present, but if it becomes optional, I should add checks on it everywhere in the application.

I have some ideas on how to solve some of the problems (e.g. interfaces with dual implementations: one working implementation, and one that is activated if the optional part is not activated).

Do you know of any patterns that can be used to solve this kind of problem?  Or do you have any suggestions on how to handle this licensing problem?

Thanks.


问:
Does the deprecation of mysql_* functions in PHP carry over to other Databases(MSSQL)?

I'm not talking about MySQL, I'm talking about Microsoft SQL Server

I've been aware of PDO for quite some time now, standard mysql functions are dangerous and should be avoided.

http://php.net/manual/en/function.mysql-connect.php

But what about the MSSQL function in PHP?  They are, for most purposes, identical sets of functions, but the PHP page describing mssql_* carries no warning of deprecation.

http://us.php.net/manual/en/function.mssql-connect.php

There are PDO drivers available for MSSQL, but they aren't quite as readily available or used as the MySQL drivers.

Ideally, it looks to me like I should get them working and move from mssql_* to PDO like I have with MySQL, but is it as big of a priority?

Is there some hidden safety to MSSQL that means it's exempt from all of the mysql_* hatred as of late?  Or is its obscurity as a backend the only reason there hasn't been more PDO encouragement?

答:
The MSSQL_* and MySQL_* families of functions share a common interface (i.e. similar naming), for convenience (if you know one's functions, then you know the other's) but that's where the similarities stop.

And... there's no hatred for the MySQL_* family, it's not "dangerous", its use is discouraged as it's using an older MySQL API that's no longer relevant (except for legacy applications). Right now (PHP 5.4) MySQL_* isn't actually deprecated, using its functions doesn't even raise an E_DEPRECATED error, but the extension is not actively developed, only maintained (bug fixes only, and even them are not high priority). We don't know when the functions will be actually deprecated, but the usual process is that in a future version using them will raise an E_DEPRECATED error, and at an even later version the extension will not be available as part of the default installation and will no longer be maintained.

I don't know what you mean when you say that MSSQL drivers aren't readily available, but PHP no longer bundles MySQL client libraries since the first iteration of PHP 5.0. Client libraries are essential for any database, as PHP's extensions are for the most part just wrappers of the client libraries. You'll have to install the client libraries yourself for both MySQL and MSSSQL, and perhaps you haven't noticed that yet because you are using a LAMP or WAMP bundle that installs everything for you. Still, in a vanilla setup the database's client libraries must be installed separately.

PDO offers a mostly database agnostic interface, however it's completely up to you whether you are going to use it or use MSSQL_*. If you are working with different databases, not necessarily in the same project, PDO might be the better choice as you'd have to familiarize yourself with one interface. And if your project uses multiple database then PDO is the clear winner. Personally I've moved on to PDO for all my database needs, and never looked back.

To summarize:

MSSQL_* and MySQL_* share a common interface for convenience, nothing more, they are just wrappers to their respective database client libraries.

MySQL_* soon won't be available, but MSSQL_* will.

Both PDO and MSSQL_* are valid choices for working with SQL Server.


答:
My understanding:

Verification: Software should conform to its specification.

I would say, according to ISO, that it applies to product of any development phase. That would match to the activities described in the ISO (Code review, Design review).
i.e:

Code should conform to design and standards

Design should conform to requirements

Requirements should conform to "documents from users describing their needs". I do
not know the name for this document.

But I must admit, I am not sure about the last one and how applying standards fits to the definiton of "Verification" in the ISO. I would be happy for comments claryfiing that.

Title: Verification of requirements question


问:
At what point is asynchronous reading of disk I/O more efficient than synchronous?
Assuming there is some bit of code that reads files for multiple consumers, and the files are of any arbitrary size: At what size does it become more efficient to read the file asynchronously? Or to put it another way, how small must a file be for it to be faster just to read it synchronously?

I've noticed (and perhaps I'm incorrect) that when reading very small files, it takes longer to read them asynchronously than synchronously (in particular with .NET). I'm assuming this has to do with set up time for things like I/O Completion Ports, threads, etc.

Is there any rule of thumb to help out here? Or is it dependent on the system and the environment?

答:
Unfortunately, the answer is, "it depends."  It would be easy for you to write a small program to empirically determine the times of both async and sync reads.

It will depend on lots of factors.  Are they stored on spinning disks, SSD, or a network drive?  What kind of CPU are you using?  How many sockets/cores?  Are you running in an VM or bare metal?  Are you running an ancient OS or modern one?


问:
How to Be a Software Engineer?
My problem is kind of weird so please bear with me.

I have been working in a start up concerned basically with mobile development since my graduation 2 years ago. I develop apps for iOS but it's not really relevant. The start up structure is simply founders > developers, with no middle-tier technical supervision or project management whatsoever.

A typical project cycle of ours is like this: meet with a client > send very vague requirements to an outsourced graphics designer > dig in development right after we get the design, no questions asked > then improvise improvise improvise! It's not that we are unaware that stuff like requirements analysis, UML, design patterns, source code control, testing, development methodologies... etc. exist, we just simply don't use them, and I mean like never.

The result is usually a clunk of hardly-maintainable yet working code. Despite everything we are literally flourishing with many successful apps on all platforms and bigger clients each project. The thing is, we want the chaos to stop and we're looking for advice.

How would you fix our company technically? Given that you can't hire project managers or team leaders just because we are barely 5 developers, so it wouldn't be a justified cost for the founders, but one-time things like courses, books, private training... etc is an option. Lastly, if it's relevant, we are based in Egypt.

Thank you a lot in advance.

答:
My absolute biggest tip: Don't try to fix everything at once, or change too much in one go!

Exactly how you proceed from here will depend on a few things: how busy your team is, how on-board everyone is with the idea that things even need to be improved, etc.

If people need convincing, you'll probably have to do a lot of the groundwork yourself to begin with. Identify a few key areas you see as needing improvement, work out a nice 'easy fix' for each (you can always improve again from there), put together some estimates on how long each would take, and then take this information to your colleagues to see if you can get some momentum going.

If everyone is already on-board but you don't know where to start, collaborate with them to identify the key areas and some potential solutions, and estimates for doing them. It will probably help to think about this from a what-problems-are-we-experiencing perspective rather than a what-do-we-think-we-ought-to-be-doing perspective. You'll find it's easier to identify solutions to known problems than pin down specific actions from a vague wishlist.

Once you have your list, prioritise it however makes most sense for your group. Since it sounds like things are just a little chaotic rather than totally dysfunctional, I'd suggest going with a 'least upheaval first' approach. Go for the low-hanging fruit to start knocking stuff off the list, it will let everyone get used to changes happening and refine your  strategy for handling the bigger changes.

Version control is probably the change which will give you biggest bang for your buck. Make yourself a test repo to practice with for a bit, get used to the workflow, then demo it to your colleagues and get it into full operational use.

Good testing will reduce your chaos significantly by reducing nasty surprises. My suggestions would be:

When you fix a bug, write a test which you can use to check for regressions in future versions.

Gather together a set of basic functionality tests to be run for every build, and set up reporting if any of them fail so it can be fixed ASAP.

Create and keep a mapping of which tests cover which requirements/functionality/bugs

In terms of the code itself, try to go for incremental improvement. Whenever you (the team) update a method, check that it's properly commented. Set up code reviews for big/important changes. It's rarely a good idea to try change the design of existing code, but for new projects, hold a design review early on in the lifecycle where you consider how easy the design would be to update, adapt, extend, or reuse (is it sufficiently modular? is it tightly coupled?)

Above all, keep chipping away! If you're going slowly because you're busy, don't worry about it too much. Just go back to the list when you do have the time.

Title: How to Be a Software Engineer?


问:
Function that requires many parameters
I have a problem related to this:

Are there guidelines on how many parameters a function should accept?

In my case, I have a function that describes a rounded rectangle. The caller specifies

An integer which determines how the rectangle should be merged into previously created shapes

An Anchor, which is a point that is used for alignment (right, left, top, bottom etc). (0,-1) means that position (next parameter) describes the top, middle point of the rectangle.

The position of the rectangle

Width and height

Corner radius

Should I use Parameter Object pattern in this case? It is hard to see how these parameters are related

答:
Not all the parameters are related, but some subsets are.  You could have 3 parameters:

Merge behavior

Position (base position & anchor point)

Rectangle description (height, width, corner radius)

Or, it might make more sense that anchor point is part of the rectangle description.

Title: Function that requires many parameters


答:
I prefer to keep the number of function arguments to four or fewer.

It sounds like the function "merges" a rounded rectangle it into some environment.  The first thing that comes to mind is to separate the activity into two parts: defining the rectangle, and then merging it.

```<code>rr = roundedRectangle(width, height, cornerRadius)
environment.merge(rr, how, alignment, where)
</code>```

If the cornerRadius has a convenient default (e.g. zero), then you could switch to:

```<code>rr = roundedRectangle(width, height).setCornerRadius(r)
</code>```

If the number of options to merge increases, then you could create a parameter object for those:

```<code>mm = mergeMethod(position).setAlignment(topCenter).setBehavior(...)
env.merge(rr, mm)
</code>```

This allows for a natural extension to other shapes.  It would be poor practice to repeat the list of mergeMethod arguments once for every shape that could be created.

=== Dan's Addendum ===

When splitting actions in this way, it is important to avoid introducing undesirable order dependencies.  Any values not specified when an instance is created should have useful defaults.  If you remove the cornerRadius argument from the roundedRectangle constructor, you must set a useful default.  It must be sensible to write either rr = roundedRectangle(width, height) or rr = roundedRectangle(width, height).setCornerRadius(...).

Title: Function that requires many parameters

Body:
I have a problem related to this:

Are there guidelines on how many parameters a function should accept?

In my case, I have a function that describes a rounded rectangle. The caller specifies

An integer which determines how the rectangle should be merged into previously created shapes

An Anchor, which is a point that is used for alignment (right, left, top, bottom etc). (0,-1) means that position (next parameter) describes the top, middle point of the rectangle.

The position of the rectangle

Width and height

Corner radius

Should I use Parameter Object pattern in this case? It is hard to see how these parameters are related

Body:
I prefer to keep the number of function arguments to four or fewer.

It sounds like the function "merges" a rounded rectangle it into some environment.  The first thing that comes to mind is to separate the activity into two parts: defining the rectangle, and then merging it.

rr = roundedRectangle(width, height, cornerRadius)
environment.merge(rr, how, alignment, where)

If the cornerRadius has a convenient default (e.g. zero), then you could switch to:

rr = roundedRectangle(width, height).setCornerRadius(r)

If the number of options to merge increases, then you could create a parameter object for those:

mm = mergeMethod(position).setAlignment(topCenter).setBehavior(...)
env.merge(rr, mm)

This allows for a natural extension to other shapes.  It would be poor practice to repeat the list of mergeMethod arguments once for every shape that could be created.

=== Dan's Addendum ===

When splitting actions in this way, it is important to avoid introducing undesirable order dependencies.  Any values not specified when an instance is created should have useful defaults.  If you remove the cornerRadius argument from the roundedRectangle constructor, you must set a useful default.  It must be sensible to write either rr = roundedRectangle(width, height) or rr = roundedRectangle(width, height).setCornerRadius(...).


答:
Async has 3 main advantages:

It lowers CPU utilization. This could be useful if you are also doing CPU-heavy operations with data you just read.

Using some kind of async infrastructure makes the code easy to paralelise. Especially if you are reading lots of files.

By sending multiple read-write requests to OS, OS and HW can re-order those operations to be completed faster. SATA2 has such feature.

I believe main advantage of asynchronous read is when you are working with lots of files or you need lots of CPU power.

Title: At what point is asynchronous reading of disk I/O more efficient than synchronous?

Body:
Assuming there is some bit of code that reads files for multiple consumers, and the files are of any arbitrary size: At what size does it become more efficient to read the file asynchronously? Or to put it another way, how small must a file be for it to be faster just to read it synchronously?

I've noticed (and perhaps I'm incorrect) that when reading very small files, it takes longer to read them asynchronously than synchronously (in particular with .NET). I'm assuming this has to do with set up time for things like I/O Completion Ports, threads, etc.

Is there any rule of thumb to help out here? Or is it dependent on the system and the environment?


答:
It depends

One thing to keep in mind is how expensive is a context switch between processes. Node.JS is designed the way it is because it assumes that doing a context switch is very expensive and you will otherwise have a lot of processes waiting on IE which will bog down the computer.

On the other hand Erlang makes a process context switch very cheap so everything can be synchronous and the Erlang run time can keep track of the whole thing.

So the factors to consider:

the Cost of a context switch operation

the speed of the disk for
seek operations

the speed of the disk for read operations

are the files in cache

And I am sure I am leaving out a half a dozen factors


问:
statistics for checking imported data?
I'm working on a data migration of several hundred nodes from a Drupal 6 to a Drupal 7 site. I've got the data exported to the new site and I want to check it. Harkening back to my statistics classes, I recall that there is some way to figure out a random number of nodes to check to give me some percentage of confidence that the whole process was correct. Can anyone enlighten me as to this practical application of statistics? For any given number of units, how big must the sample be to have a given confidence interval?</p>

答:
I found this sample size calculator. For my population of 215 items, if I want a 95% confidence with +/- 5% confidence interval, I'll need to randomly sample 138 items.

Edit: Here's the actual formula that I was looking for.

Title: statistics for checking imported data?


答:
First and foremost, code should be self-documenting. Each line of code should be easy to decipher, and the sum total of those lines of code should be easy to trace through. This generally means that methods and variables should have descriptive yet concise names, operations should be clearly defined, design patterns that encourage smaller, single-purpose methods should be employed, and "hacks", including code reliant on arcane details of the implementation behind the language spec, should be avoided. Given these things, any reasonably-experienced coder should be able to decipher your code without any comments needed.

That said, you will not always be able to do this. Time, resources, technical ability, etc will at some point force you to do something in a way that is unclear or kludgy. To mitigate the murkiness of your code, comments that state what you are doing and why can sometimes be necessary. It can be difficult for a programmer going flat-out, heads-down at an algorithm to realize when they may be necessary, so a code review step is a good idea. Have another developer go over the code, and if they point to something and ask "why", that's a good candidate for some comments.

Another thing I often find useful is "comment-driven development". When you create a new method, write out lines of comments detailing how the method should progress through its designed task. You're basically making notes about what the method should do, even if at this point in your coding you won't actually write any of the code in that method. This can be invaluable in collaborative programming, where an algorithm for something critical or extremely involved was designed on a whiteboard by the team and then given to one or two coders to implement. Then, as you code, the comments detail the task performed in each stage. They can be removed if the operation is plainly obvious, or they can stay if the logic is more complex than the conceptual idea of that code. However, when using this technique, it's important to understand that what you thought you were going to do isn't always what you ended up doing; you have to identify those cases and either update or rewrite the comments.


问:
Ideal programming language learning sequence?
What do you think? What is the ideal programming language learning sequence which will cover most of the heavily used languages and paradigms today as well as help to grasp common programming basics, ideas and practices?
You can even suggest learning sequence for paradigms rather than languages.

N.B. : This is port of the question I asked in stackoverflow and was closed for being subjective and argumentative.

答:
OK, this is the last day for bounty. And I am adding my answer. My suggested sequence-

C, C++, JAVA/C#, Python/Ruby, Any other language(Assembly/Lisp/Prolog etc)

I don't think the first language has to be the easiest one. Rather I think it should give the overall idea of how computer works keeping some abstraction.

Transition from C to C++ will be easier. There will be OOP, the most used paradigm these days.

Transition from C++ to C#/Java will be easier. I prefer C# because it incorporates many paradigms like functional programming.

When someone now come to dynamic languages like Python or Ruby, there will be a "WoW". It will be easier to feel the beauty of dynamic typing. But learning dynamic languages first and static ones later will cause, "Oh! Why I have to add all these?"

Now, the most used paradigms and languages are almost done. So, explore whatever you want. From Assembly to Lisp, Prolog or Haskell. And discover newer contexts ans features of various programming languages.


答:
Actually, I am in a very similar position, managing the development of a product with a likewise license model, and a core database shared by different functions in our software.

What if a part of the data model is related to an optional part? Do I build up these data structures in my application so the rest of my application can just assume they're always there? Or do I don't build them, and add checks in the rest of may application?

I don't know your product, but in ours we deliver always the full data model. A data model per se (or any part of it) is no useful product function for any of our customers - a useful function is a process or operation on that data, which is part of the applications code. So we toggle the functionality only there. Also consider that a normalized data model tends to provide the same data for different functionalities.

What if some optional part is still useful to perform some internal tasks, but I don't want to expose it to the user externally?

I assume you are talking about parts of the data model - does it really matter if you expose it to the user, as long as all optional processes/operations the customer did not buy are switched off? And what does "expose" mean? If you mean "expose" at the UI level, then it should be easy for you to disable that UI. If you mean at the database level (because you give your users direct access to your database), then you can probably live with that.

What if the marketing responsible wants to make a standard part now an optional part? In all of my application I assume that that part is present, but if it becomes optional, I should add checks on it everywhere in the application.

To my personal experience, parts which are made optional are almost always parts the user can easy identify as separate functionalities. Otherwise marketing would run into problems to advertise that separate function. In most cases that means that those checks do not have to to be added "everywhere", but only at a handful, manageable number of places.


答:
GitHub is simple, easy-to-use, easy to get started with, powerful and looks great and is Web 2.0-ish.

I use GitHub, and I find it remarkably easier to use than SourceForge, which had its power hidden behind a series of menus and required fairly elaborate operations to get anything set up. And I'm a programmer.

In addition, I think there is one more powerful feature: whether its an individual wanting to publish their first open-source project somewhere, or teams that want to collaborate on a commercial (private) project, GitHub "scales" perfectly well for almost all use cases.

End of the day, I think its about human psychology. Is the product easy to use, easy to start using, inexpensive (or free) ... does it look good and is it something I would recommend to my friends? For GitHub, I would answer yes to all those questions.


问:
Programming languages with a Lisp-like syntax extension mechanism
I have only a limited knowledge of Lisp (trying to learn a bit in my free time) but as far as I understand Lisp macros allow to introduce new language constructs and syntax by describing them in Lisp itself. This means that a new construct can be added as a library, without changing the Lisp compiler / interpreter.

This approach is very different from that of other programming languages. E.g., if I wanted to extend Pascal with a new kind of loop or some particular idiom I would have to extend the syntax and semantics of the language and then implement that new feature in the compiler.

Are there other programming languages outside the Lisp family (i.e. apart from Common Lisp, Scheme, Clojure (?), Racket (?), etc) that offer a similar possibility to extend the language within the language itself?

EDIT

Please, avoid extended discussion and be specific in your answers. Instead of a long list of programming languages that can be extended in some way or another, I would like to understand from a conceptual point of view what is specific to Lisp macros as an extension mechanism, and which non-Lisp programming languages offer some concept that is close to them.

答:
Scala makes this possible too (in fact it was consciously designed to support the definition of new language constructs and even complete DSLs).

Apart from higher-order functions, lambdas and currying, which are common in functional languages, there are some special language features here to enable this*:

no operators - everything is a function, but function names can include special characters like '+', '-' or ':'

dots and braces can be omitted for single-parameter method calls, i.e. a.and(b) is equivalent to a and b in infix form

for single-parameter function calls you may use curly brackets instead of normal braces - this (together with currying) allows you to write things like

```<code>val file = new File("example.txt")

withPrintWriter(file) {
  writer => writer.println("this line is a function call parameter")
}
</code>```

where withPrintWriter is a plain method with two parameter lists, both containing a single parameter

by-name parameters allow you to omit empty parameter list in lambdas, allowing you to write calls like myAssert(() => x > 3) in a shorter form as myAssert(x > 3)

The creation of an example DSL is discussed in detail in Chapter 11. Domain-Specific Languages in Scala of the free book Programming Scala.

*I don't mean these are unique to Scala, but at least they don't seem to be very common. I am not an expert in functional languages though.

Body:
Scala makes this possible too (in fact it was consciously designed to support the definition of new language constructs and even complete DSLs).

Apart from higher-order functions, lambdas and currying, which are common in functional languages, there are some special language features here to enable this*:

no operators - everything is a function, but function names can include special characters like '+', '-' or ':'

dots and braces can be omitted for single-parameter method calls, i.e. a.and(b) is equivalent to a and b in infix form

for single-parameter function calls you may use curly brackets instead of normal braces - this (together with currying) allows you to write things like

val file = new File("example.txt")

withPrintWriter(file) {
  writer => writer.println("this line is a function call parameter")
}

where withPrintWriter is a plain method with two parameter lists, both containing a single parameter

by-name parameters allow you to omit empty parameter list in lambdas, allowing you to write calls like myAssert(() => x > 3) in a shorter form as myAssert(x > 3)

The creation of an example DSL is discussed in detail in Chapter 11. Domain-Specific Languages in Scala of the free book Programming Scala.

*I don't mean these are unique to Scala, but at least they don't seem to be very common. I am not an expert in functional languages though.


答:
Haskell

Haskell has "Template Haskell" as well as "Quasiquotation":

http://www.haskell.org/haskellwiki/Template_Haskell

http://www.haskell.org/haskellwiki/Quasiquotation

These features allow users to dramatically add to the syntax of the language outside of normal means. These are resolved at compile time as well, which I think is a big must (for compiled languages at least) [1].

I have used quasiquotation in Haskell once before to create an advanced pattern matcher over a C-like language:

```<code>moveSegment :: [Token] -> Maybe (SegPath, SegPath, [Token])
moveSegment [hc| HC_Move_Segment(@s, @s); | s1 s2 ts |] = Just (mkPath s1, mkPath s2, ts)
moveSegment _ = Nothing
</code>```

[1] Else the following qualifies as syntax extension: runFeature "some complicated grammar enclosed in a string to be evaluated at runtime", which of course is a load of crap.

Title: Programming languages with a Lisp-like syntax extension mechanism

Body:
I have only a limited knowledge of Lisp (trying to learn a bit in my free time) but as far as I understand Lisp macros allow to introduce new language constructs and syntax by describing them in Lisp itself. This means that a new construct can be added as a library, without changing the Lisp compiler / interpreter.

This approach is very different from that of other programming languages. E.g., if I wanted to extend Pascal with a new kind of loop or some particular idiom I would have to extend the syntax and semantics of the language and then implement that new feature in the compiler.

Are there other programming languages outside the Lisp family (i.e. apart from Common Lisp, Scheme, Clojure (?), Racket (?), etc) that offer a similar possibility to extend the language within the language itself?

EDIT

Please, avoid extended discussion and be specific in your answers. Instead of a long list of programming languages that can be extended in some way or another, I would like to understand from a conceptual point of view what is specific to Lisp macros as an extension mechanism, and which non-Lisp programming languages offer some concept that is close to them.

Body:
Haskell

Haskell has "Template Haskell" as well as "Quasiquotation":

http://www.haskell.org/haskellwiki/Template_Haskell

http://www.haskell.org/haskellwiki/Quasiquotation

These features allow users to dramatically add to the syntax of the language outside of normal means. These are resolved at compile time as well, which I think is a big must (for compiled languages at least) [1].

I have used quasiquotation in Haskell once before to create an advanced pattern matcher over a C-like language:

moveSegment :: [Token] -> Maybe (SegPath, SegPath, [Token])
moveSegment [hc| HC_Move_Segment(@s, @s); | s1 s2 ts |] = Just (mkPath s1, mkPath s2, ts)
moveSegment _ = Nothing

[1] Else the following qualifies as syntax extension: runFeature "some complicated grammar enclosed in a string to be evaluated at runtime", which of course is a load of crap.


答:
Ruby has a quite flexible syntax, I think it's a way of "extend the language within the language itself".

An example is rake. It's written in Ruby, it is Ruby, but it looks like make.

To check some possibilities you can look for the keywords Ruby and metaprogramming.


问:
Teaching myself, as a physicist, to become a better programmer
I've always liked physics, and I've always liked coding, so when I got the offer for a PhD position doing numerical physics (details are not relevant, it's mostly parallel programming for a cluster) at a university, it was a no-brainer for me.

However, as most physicists, I'm self taught. I don't have broad background knowledge about how to code in an object oriented way, or the name of that specific algorithm that optimizes the search in some kD tree.

Since all my work so far has been more concerned about the physics and the scientific results, I undoubtedly have some bad habits - more so because my coding is my own, and not really teamwork. I have mostly used C since it is very straightforward and "what you write is what you get" - no need for fancy abstractions. However, I have recently switched to C++ since I'd like to learn more about the power that comes with abstraction, and it's pretty C-like (syntax-wise at least).

How do I teach myself to code in a good, abstract way like a graduate in computer science?

I know my code is efficient, but I want it to be elegant as well, and readable. Keep in mind that I don't have time to read several 1000-page tomes about abstract programming. I need to spend time on actual, physics related research (my supervisor would laugh at me if he knew I spent time thinking about how to program elegantly). How do I assess if my work is also good from a programmer's perspective?

答:
As a physicist turned programmer myself, I found my physics background most helpful in forming the right metaphors for understanding software concepts. This perspective also made learning programming more fun for me and helped me develop the sense for "elegance" in software, which you seem to strive for.

I've described the important and under-appreciated role of metaphors and analogies in software in my CUJ column "Patterns of Thinking--names, metaphors, better programming, and the politics of the language". For example, the OO concepts of class inheritance is often compared to passing traits from parents to offspring in a family. This is an incorrect analogy. The correct analogy for class inheritance is biological classification of organisms (e.g., a class RedRose is a kind of Flower, and a Flower is a kind of Plant).

Or take for example the software concept of a hierarchical state machine. A good metaphor here is the concept of a bound quantum system such as the hydrogen atom. As you recall, the states of an atom are numbered by three quantum numbers |n, l, m>, exactly because they are "nested" (hierarchical). This metaphor shows you how to understand that states nest within states (just like states of angular momentum (l) nest in the energy states (n)) and also you immediately see that state nesting is always reflection of some symmetry of the system.

Another interesting analogy from physics is the "actor model of computation", which lately has been re-discovered due to multi-core CPUs and the distributed computing in the "cloud". I found it helpful and fun to think of events exchanged by stateful actors (a.k.a. active objects) as virtual bosons, such as photons in QED, or gluons in QCD. This metaphor explains the fundamental asynchronous nature of communication, the run-to-completion event processing (quantum leap), and strict encapsulation of active objects, which can only interact with each other via the explicit intermediate artifacts.

Anyway, developing a system metaphor is a recommended practice in XP (eXtreme Programming), and as a physicist you will have an edge in coming up with good metaphors. You will also gain a sense for "elegance", because your software will inherit the conceptual integrity from good metaphors you apply.


答:
Extending the syntax the way you're talking about allows you to create domain specific languages.  So perhaps the most useful way to rephrase your question is, what other languages have good support for domain specific languages?

Ruby has very flexible syntax, and a lot of DSLs have flourished there, such as rake.  Groovy includes a lot of that goodness.  It also includes AST transforms, which are more directly analogous to Lisp macros.

R, the language for statistical computing, allows functions to get their arguments unevaluated.  It uses this to create a DSL for specifying regression formula.  For example:

```<code>y ~ a + b
</code>```

means "fit a line of the form k0 + k1*a + k2*b to the values in y."

```<code>y ~ a * b
</code>```

means "fit a line of the form k0 + k1*a + k2*b + k3*a*b to the values in y."

And so on.

Body:
Extending the syntax the way you're talking about allows you to create domain specific languages.  So perhaps the most useful way to rephrase your question is, what other languages have good support for domain specific languages?

Ruby has very flexible syntax, and a lot of DSLs have flourished there, such as rake.  Groovy includes a lot of that goodness.  It also includes AST transforms, which are more directly analogous to Lisp macros.

R, the language for statistical computing, allows functions to get their arguments unevaluated.  It uses this to create a DSL for specifying regression formula.  For example:

y ~ a + b

means "fit a line of the form k0 + k1*a + k2*b to the values in y."

y ~ a * b

means "fit a line of the form k0 + k1*a + k2*b + k3*a*b to the values in y."

And so on.


答:
Rebol sounds almost like what you're describing, but a bit sideways.

Rather than define specific syntax, everything in Rebol is a function call - there are no keywords. (Yes, you can redefine if and while if you truly desire to).  For example, this is an if statement:

```<code>if now/time < 12:00 [print "Morning"]
</code>```

if is a function that takes 2 arguments:  a condition and a block.  If the condition is true, the block is evaluated.  Sounds like most languages, right?  Well, the block is a data structure, it's not restricted to code - this is a block of blocks, for example, and a quick example of the flexibility of "code is data":

```<code>SomeArray: [ [foo "One"] [bar "Two"] [baz "Three"] ]
foreach action SomeArray [action/1: 'print] ; Change the data
if now/time < 12:00 SomeArray/2 ; Use the data as code - right now, if now/time < 12:00 [print "Two"]
</code>```

As long as you can stick to the syntax rules, extending this language is, for the most part, going to be nothing more than defining new functions.  Some users have been backporting features of Rebol 3 into Rebol 2, for example.

Body:
Rebol sounds almost like what you're describing, but a bit sideways.

Rather than define specific syntax, everything in Rebol is a function call - there are no keywords. (Yes, you can redefine if and while if you truly desire to).  For example, this is an if statement:

if now/time < 12:00 [print "Morning"]

if is a function that takes 2 arguments:  a condition and a block.  If the condition is true, the block is evaluated.  Sounds like most languages, right?  Well, the block is a data structure, it's not restricted to code - this is a block of blocks, for example, and a quick example of the flexibility of "code is data":

SomeArray: [ [foo "One"] [bar "Two"] [baz "Three"] ]
foreach action SomeArray [action/1: 'print] ; Change the data
if now/time < 12:00 SomeArray/2 ; Use the data as code - right now, if now/time < 12:00 [print "Two"]

As long as you can stick to the syntax rules, extending this language is, for the most part, going to be nothing more than defining new functions.  Some users have been backporting features of Rebol 3 into Rebol 2, for example.


答: I'm not sure there's a particular "point", but it makes the most sense when you've got a lot of threads working, as it allows you to overlap your I/O with other work.  If you've got spare threads going idle, then reading asynchronously isn't going to give you any advantage.  It's only when you've got work queues filling up and your thread could be usefully doing other work instead of waiting for I/O that async file access gives any advantage.</p>


答:
Perl allows for pre-processing of its language.  While this isn't often used to the extent of radically changing the syntax in the language, it can be seen in some of the... odd modules:

Acme::Bleach for really clean code

Acme::Morse for writing in morse code

Lingua::Romana::Perligata for writing in Latin (for examples, nouns are variables and number, case, and declension change the type of the noun nextum ==> $next, nexta ==> @next)

There also exists a module that makes allows perl to run code that looks like it was written in Python.

A more modern approach to this within perl would be to use Filter::Simple (one of the core modules in perl5).

Note that all those examples involve Damian Conway who has been referred to as the "Mad Doctor of Perl".  Its still an amazingly powerful ability within perl to twist the language how one wants it.

More documentation for this and other alternatives exists at perlfilter.


答:
Prolog allows defining new operators which are translated to compound terms of the same name. For example, this defines a has_cat operator and defines it as a predicate for checking if a list contains the atom cat:

```<code>:- op(500, xf, has_cat).
X has_cat :- member(cat, X).

?- [apple, cat, orange] has_cat.
true ;
false.
</code>```

The xf means that has_cat is a postfix operator; using fx would make it a prefix operator, and xfx would make it an infix operator, taking two arguments. Check this link for more details about defining operators in Prolog.

Body:
Prolog allows defining new operators which are translated to compound terms of the same name. For example, this defines a has_cat operator and defines it as a predicate for checking if a list contains the atom cat:

:- op(500, xf, has_cat).
X has_cat :- member(cat, X).

?- [apple, cat, orange] has_cat.
true ;
false.

The xf means that has_cat is a postfix operator; using fx would make it a prefix operator, and xfx would make it an infix operator, taking two arguments. Check this link for more details about defining operators in Prolog.


问:
Should I include HTML markup in my JSON response?
In an e-commerce site, when adding an item to a cart, I'd like to show a popup window with the options you can choose.  Imagine you're ordering an iPod Shuffle and now you have to choose the color and text to engrave.

I'd like the window to be modal, so I'm using a lightbox populated by an Ajax call.  Now I have two options:

Option 1: Send only the data, and generate the HTML markup using JavaScript

What's nice about this is that it trims down the Ajax request to the bear minimum and doesn't mix the data with the markup.

What's not so great about this is that now I need to use JavaScript to do my rendering, instead of having a template engine on the server-side do it.  I might be able to clean up the approach a bit by using a client-side templating solution.

Option 2: Send the HTML markup

What's good about this is that I can have the same server-side templating engine I'm using for the rest of my rendering tasks (Django), do the rendering of the lightbox.  JavaScript is only used to insert the HTML fragment into the page.  So it clearly leaves the rendering to the rendering engine.  Makes sense to me.

But I don't feel comfortable mixing data and markup in an Ajax call for some reason.  I'm not sure what makes me feel uneasy about it.  I mean, it's the same way every web page is served up -- data plus markup -- right?

答: You should use the template engine for markup and keep a hidden field somewhere to store values, that you can then find in the document using a selector.</p>


问:
What legal considerations do I need to have when programming?
Recently I worked with a group to create a logging system for tutoring labs to track Tutor hours, and usage of the labs. We had to change the design a fair amount to be in compliance with FERPA. </p>

<p>My question stems from the curiosity that in my course of study there has never been a real mention of how people in this field have to deal with complying with the law in their work. So I would like to know how much programmers have to consider the law in the work they do. </p>

答:
I develop for a company involved with medical software, and HIPAA compliance does affect the design of our programs. Anything that may contain patient information must have options for restricting and logging access.

In the course of supporting our clients, our engineers may chance to view patient-specific information, so our company also held HIPAA training sessions we had to attend to make sure we were aware of how to be HIPAA-compliant.


问:
Verification of requirements question
Doing a lot of reading about V&V, I would need to clarify the following.
A lot of definitions (less formal ones found in books) define verification like that:

Verification: The software should conform to its specification.

But then they speak about requirement verification, design verification etc. If I say that these items are "software" in terms of applying the definitions, what should I checked them against? What specification should requirements, which is the basic information, conform to?

And one more thing: shouldn't requirements also be validated? To make sure they meet the customer needs? All texts I have, speak only about SW validation on the end of the development process!

EDIT: Just to make it clearer, my main question is how the definition of verification apply to requirements. The bookss or e.g. ISO 12207:2008 mention that verification is a process that the product reflect the requirements. One of the process is requirements spec review. But how can requirements conform to requirements?

答:
It means that you need to define your own specifications and verify requirements against those.  There are many types of requirements:

customer requirements

operational requirements

architecture requirements

quality requirements

interface requirements

functional/non-functional requirements

product/product component requirements

The list goes on, and as reality would have it, each of these types are open to interpretation.  I believe that what the ISO standard is trying to say is that there should be some effort to create specifications for your requirements (like an audit checklist, as Marcin Sanecki points out), but how you do that is up to you.

Title: Verification of requirements question