问:
Writing a Software Requirement Specification
I have a few questions about writing a specification and they are:

When we write a software specification, under the topic "User requirements definition" we have to specify the "Functions" and "Constraints" only ?

Does "User Interface" fall into "functions" or "constraints" ?

What are the major key areas (requirements) a software can be broken into (e.g. UI ) ?

答:
I recommend reading Joel on software.  I'm not sure if it answers your specific questions, but he has an excellent overview of what it means to write functional specifications:

The most important function of a spec is to design the program. Even if you are working on code all by yourself, and you write a spec solely for your own benefit, the act of writing the spec — describing how the program works in minute detail — will force you to actually design the program...

...when you design your product in a human language, it only takes a few minutes to try thinking about several possibilities, revising, and improving your design. Nobody feels bad when they delete a paragraph in a word processor. But when you design your product in a programming language, it takes weeks to do iterative designs. What’s worse, a programmer who’s just spend 2 weeks writing some code is going to be quite attached to that code, no matter how wrong it is...

...When you write a spec, you only have to communicate how the program is supposed to work once. Everybody on the team can just read the spec. The QA people read it so that they know how the program is supposed to work and they know what to test for. The marketing people use it to write their vague vaporware white papers to throw up on the web site about products that haven’t been created yet. The business development people misread it to spin weird fantasies about how the product will cure baldness and warts and stuff, but it gets investors, so that’s OK. The developers read it so that they know what code to write. The customers read it to make sure the developers are building a product that they would want to pay for. The technical writers read it and write a nice manual...

When you don’t have a spec, all this communication still happens, because it has to, but it happens ad hoc. The QA people fool around with the program willy-nilly, and when something looks odd, they go and interrupt the programmers yet again to ask them another stupid question about how the thing is supposed to work...

without a detailed spec, it’s impossible to make a schedule... In too many programming organizations, every time there’s a design debate, nobody ever manages to make a decision, usually for political reasons. So the programmers only work on uncontroversial stuff. As time goes on, all the hard decisions are pushed to the end... Writing a spec is a great way to nail down all those irritating design decisions, large and small, that get covered up if you don’t have a spec...


问:
Agile project management, agile development: early integration
I believe that agile works if everything is agile.

In software development area, in my opinion, if team members' code is integrated early, code will be more in sync and this has a lot of pros:

Early integration helps team members to avoid painful merges.

Encourages better coding habits, because everyone makes sure that they don't break co-workers' code everyday.

Both developers and architects (code reviewers) may detect bad design decisions or just wrong development directions in real-time, preventing useless work.

Actually I'm talking about getting the latest version of code base and checking-in your own code to the source control in a daily basis.

When you start your coding day (i.e. you arrive to your work), your first action is updating your code base with the latest version from the source control. In the other hand, when you're about an hour to leave from your work and go home, your last action is checking-in your code to the source control and be sure that your day work doesn't break the project's build process.

Rather than updating and checking-in your code once you finished an entire task, I believe the best approach is fixing small and flexible personal milestones and checking-in the code once you finish one of these.

I really believe that this coding approach fits better in the agile project management concept.

Do you know some document, blog post, wiki, article or whatever that you can suggest me that could be in sync with my opinion?. And, do you find any problem working with this approach?.

Thank you in advance.

答:
And, do you find any problem working with this approach?

I'm going to focus on this particular point.

I do have problems with this approach, largely because it is kinda orthogonal to what people should be doing. Sure, we should promote more frequent 'get latest's and commits but aligning those with the workday is in poor alignment with what we're actually looking to solve and how development will usually work.

Programmers should get latest before they start a task, and before they commit code for a task. These are the two natural points to do merges for developers. If developers aren't doing this, then it's pretty straight-forward to correct that. "Hey, you should get latest to prevent breaking the build and merge pain." Developers like reducing development pain.

If that somehow leads to integration less frequently than daily, then you've worse problems than infrequent integration. You have very large tasks. These will inherently be more error prone, and lead to more merge issues overall; regardless of your integration frequency. You should be looking to cut down on the common task size into more manageable chunks. This will cut down far more on your integration pain (and other development issues like estimation error, coordination problems, time/issue tracking accuracy, etc) than dictating that people merge even if they're not in a good spot for it.

ContentLicense: CC BY-SA 3.0


问:
Application workflow
I am in the planning process for a new application, the application will be written in PHP (using the Symfony 2 framework) but I'm not sure how relevant that is. The application will be  browser based, although there will eventually be API access for other systems to interact with the data stored within the application, again probably not relavent at this point.

The application manages SIM cards for lots of different providers - each SIM card belongs to a single provider but a single customer might have many SIM cards across many providers. The application allows the user to perform actions against the SIM card - for example Activate it, Barr it, Check on its status etc

Some of the providers provide an API for doing this - so a single access point with multiple methods eg activateSIM, getStatus, barrSIM etc. The method names differ for each provider and some providers offer methods for extra functions that others don't. Some providers don't have APIs but do offer these methods by sending emails with attachments - the attachments are normally a CSV file that contains the SIM reference and action required - the email is processed by the provider and replied to once the action has been complete.

To give you an example - the front end of my application will provide a customer with a list of SIM cards they own and give them access to the actions that are provided by the provider of each specific SIM card - some methods may require extra data which will either be stored in the backend or collected from the user frontend. Once the user has selected their action and added any required data I will handle the process in the backend and provide either instant feedback, in the case of the providers with APIs, or start the process off by sending an email and waiting for its reply before processing it and updating the backend so that next time the user checks the SIM card its status is correct (ie updated by a backend process).

My reason for creating this question is because I'm stuck !! I'm confused about how to approach the actual workflow logic. I was thinking about creating a Provider Interface with the most common methods getStatus, activateSIM and barrSIM and then implementing that interface for each provider. So class Provider1 implements Provider - Then use a Factory to create the required class depending on user selected SIM card and invoking the method selected. This would work fine if all providers offered the same methods but they don't - there are a subset which are common but some providers offer extra methods - how can I implement that flexibly ? How can I deal with the processes where the workflow is different - ie some methods require and API call and value returned and some require an email to be sent and the next stage of the process doesn't start until the email reply is recieved ...

Please help !
(I hope this is a readable question and that this is the correct place to be asking)

Update

I guess what I'm trying to avoid is a big if or switch / case statement - some design pattern that gives me a flexible approach to implementing this kind of fluid workflow .. anyone ?

答:
I would start by defining a core API that you think that you can support across all of your providers.  Later you can extend with optional methods, and checks to let you know which actions particular providers support.  But that is definitely a stage 2.

That core API needs to be asynchronous because some of the providers do not respond to their methods in a reasonable time.  For instance you can launchSomeRequest which will enter data in a table saying that the request is made (so you can handle double clicks), and then offer checkSomeRequest that checks the table to say whether it is done.

Behind the scenes each request that is stored will record the provider, and information allowing the actual request to be made.  You can then have a cron job that regularly wakes up, looks for requests, and does the actual action.

(Note, my experience with push vs pull architectures strongly inclines me to prefer pull systems like this.  They are slower and less efficient, but their failure modes are much better.)

If you use this strategy your first step is to think through that initial lowest common denominator, and to figure out what information needs to be stored in your back end to make it work (which I'm assuming is some kind of database).  Code that up.  Code up at least two very different back ends.  (This is a good way to smoke out assumptions that you might have made.)  Then you can work on your front end and slowly start adding in other back ends.

Only then start thinking about adding optional parts of the API.

Title: Application workflow


问:
Does having a higher paid technical job mean you do not get to code any more?
I work at a large company where technical people fall roughly in one of these categories:

A developer on a scrum team who develops for a single product and maybe works with other teams that are closely related to the product.

An architect who is more of a consultant on multiple teams (5-6) and tries to recognize commonalities between team efforts that could be abstracted into libraries (architects do not write the library code, however). This architect also attends many meetings with management and attempts to set technical direction.

In my company the architect role is where most technical people move into as the next step in their career.

My questions are: Do most companies work such a way that their highest paid technical people are far removed from writing code? Is this a natural tendency for a developer's career? Can a developer have it all (code AND set direction?)

答:
Personal experience is the more experienced I get at writing code the less time I can afford to write code.

I spend time trying to fix problems before they arise. To assist others when they are stuck. To plan out how things will sit together. Even just trying to get people to pull in the same direction.

It feels inevitable in my position. I prefer working with the code, but there are things I can do for our company which are that much more valuable.

Now this is personal experience but yes I think it would reflect most smallish companies. However I've made it clear to my own boss that I don't want to be removed from the code completely.

I think the best software architects are hands-on I saw a good article http://www.infoq.com/articles/brown-are-you-a-software-architect Look at part 4 Design, Development and testing.

Having said that, why shouldn't the day-to-day coding activities be a
  part of an architect's role? Most architects are experienced coders,
  so it makes sense to keep those skills up-to-date. In addition, the
  architect can experience the same pain as everybody else on the team,
  which in turn helps them better understand how their architecture is
  viewed from a development perspective.


答:
I recommend to think in use cases. A use case for example is "Activate SIM Card". Create a interface like ActivateSimCardController or ActivteSimCardInteractor. Implementations of this interface are specific for every SIM card provider. To create the right implementation you need an identification for the provider, so you need an implementation in front of the controller to choose the right one or you can save all possible actions together with the provider. The client will choose the provider specific service in the second case.

All Service should return nothing, because you have this email back-end. The client has to call a GetStatusOfActivateSimCardController to get the result. In this way you can implement the same mechanism for all providers.

Title: Application workflow

Body:
I am in the planning process for a new application, the application will be written in PHP (using the Symfony 2 framework) but I'm not sure how relevant that is. The application will be  browser based, although there will eventually be API access for other systems to interact with the data stored within the application, again probably not relavent at this point.

The application manages SIM cards for lots of different providers - each SIM card belongs to a single provider but a single customer might have many SIM cards across many providers. The application allows the user to perform actions against the SIM card - for example Activate it, Barr it, Check on its status etc

Some of the providers provide an API for doing this - so a single access point with multiple methods eg activateSIM, getStatus, barrSIM etc. The method names differ for each provider and some providers offer methods for extra functions that others don't. Some providers don't have APIs but do offer these methods by sending emails with attachments - the attachments are normally a CSV file that contains the SIM reference and action required - the email is processed by the provider and replied to once the action has been complete.

To give you an example - the front end of my application will provide a customer with a list of SIM cards they own and give them access to the actions that are provided by the provider of each specific SIM card - some methods may require extra data which will either be stored in the backend or collected from the user frontend. Once the user has selected their action and added any required data I will handle the process in the backend and provide either instant feedback, in the case of the providers with APIs, or start the process off by sending an email and waiting for its reply before processing it and updating the backend so that next time the user checks the SIM card its status is correct (ie updated by a backend process).

My reason for creating this question is because I'm stuck !! I'm confused about how to approach the actual workflow logic. I was thinking about creating a Provider Interface with the most common methods getStatus, activateSIM and barrSIM and then implementing that interface for each provider. So class Provider1 implements Provider - Then use a Factory to create the required class depending on user selected SIM card and invoking the method selected. This would work fine if all providers offered the same methods but they don't - there are a subset which are common but some providers offer extra methods - how can I implement that flexibly ? How can I deal with the processes where the workflow is different - ie some methods require and API call and value returned and some require an email to be sent and the next stage of the process doesn't start until the email reply is recieved ...

Please help !
(I hope this is a readable question and that this is the correct place to be asking)

Update

I guess what I'm trying to avoid is a big if or switch / case statement - some design pattern that gives me a flexible approach to implementing this kind of fluid workflow .. anyone ?


问:
Designing a plug-in system
I'm working on a Java project and I would like to add a plug-in system. More precisely, I would like to let the user design his own module, pack it into a jar, leave it in a "plugins/" subfolder of my application and be done with it. I've managed to get a child classloader to instantiate objects of classes located in external jars, but now I'm facing a design dilemma:

Say Joe makes a plug-in and he packs it in joeplugin.jar. I would really like Joe to have a class named "instantiation.Factory" and I would also like everyone to have this class with this exact location and name. (This factory class obviously implements a interface that I provide and through it I get what I want from the plug-in.) If Joe wouldn't be restricted in this way I would have to look into his entire jar for some class that implements my factory interface and I don't want to imagine how complicated things get.

So my question is: should I enforce a strict naming convention for this single class? I have no idea how plug-in systems work.

答:
Presumably you define "PluginInterface" and require JoePlugin implements PluginInterface.
Beyond that, there's no limit to how much stuff you pack into PlugIninterface, except
that if you make it too complicated you'll inhibit plugin builders.</p>

Title: Designing a plug-in system


问:
Separation of development responsibilities in a new project
We have very recently started a new project (MVC 3.0) and some of our early discussion has been around how the work and development will be split amongst the team members to ensure we get the least amount of overlap of work and so help make it a bit easier for each developer to
get on and do their work.  The project is expected to take about 6 months - 1 year (although not all developers are likely to be on and might filter off towards the end),

Our team is going to be small so this will help out a bit I believe.  The team will essentially consist of:

3 x developers (All different levels i.e. more senior, intermediate and junior)

1 x project manager / product owner / tester

An external company responsbile for doing our design work

General project/development decisions so far have included:

Develop in an Agile way using SCRUM techniques (We are still very much learning this approach as a company)

Use MVVM archectecture

Use Ninject and DI where possible

Attempt to use as TDD as much as possible to drive development.

Keep our controllers as skinny as possible

Keep our views as simple as possible

During our discussions two approaches have been broached as too how to seperate the workload given our objectives outlined above.

OPTION 1:
A framework seperation where each person is responsible for conceptual areas with overlap and discussion primarily in the integration areas.  The integration areas would the responsibily of both developers as required.

```<code>View prototypes (**Graphic designer**)
         |
          - Mockups
         |
Views (Razor and view helpers etc) & Javascript (**Developer 1**)
         |
          - View models (Integration point)
         |
Controllers and Application logic (**Developer 2**)
         |
          - Models (Integration point)
         |
Domain model and persistence (**Developer 3**)
</code>```

OPTION 2:
A more task orientated approach where each person is responsible for the completion of the entire task (story) from view -> controller -> model.

QUESTION:
For those who have worked in small teams developing MVC projects how have you managed the workload distribution in this situation.  I can't imagine the junior would be responsible for building parts of the underlying architecture so would given them responsibility for the view make sense considering we are trying to keep it simple?

答:
Option 2 seems much better for agile development. I really cannot see how option 1 can work with agile. So if you are favoring option 1, then I would have to ask if you are really doing agile.

The cons you mention are not really problems and if you think they are problems, then you should be fixing something else than "overlap" of developer work.

If the intent of developer is not obvious from code, then this code definitely needs refactoring.

There are tools to check and enforce coding conventions. ReSharper for example.

what?

This happens all the time, no matter where, how and who. You just need to make sure you have way to catch those problems soon(pair programming, code review, lots of testers) and be able to fix them efficiently(unit testing)

Actually, you could combine both options in some way. Take pair programming, give pair a feature to implement and then each person can work on different "layers". Of course this is not real pair programming. But you still get advantages of shared knowledge of said feature, better coverage of "what if", the pair can help each other and people can still somehow specialize.


问:
Is there a way to develop desktop software using PHP?
I have to develop a real estate marketing CRM software for my client - where the application is installed on desktop but can also be accessed from web.

2 reasons why they want the application to run from desktop :

So that it can work with/without internet connection

They don't want their complete data to be online

They want to access few of the data like property listing & inquiries (managed from desktop application) from their website through secure login & password.

The data that is entered in desktop application should be automatically synchronized with the website application. I was wondering if there is a way to develop this kind of software using PHP & MySQL.  If yes, it will be great if anyone can provide me the referral link.Else please suggest, which language should I use.

答:
There is a way, yes, using a binding to a GUI library like PHP/Gtk.  But I don't advise that.

Instead, use a language like C#, VB.Net, Delphi, Lazarus, or Python to create the desktop app.  Their support for desktop applications is much more mature.  The results will be far better, and you'll have fewer headaches from the experience.  Don't try to force the square PHP peg into the round desktop hole.

If what you are really asking is if you can create desktop software with web technologies, then yes that is possible.  Look at tools such as nwjs (was node-webkit), with which you can create desktop apps using HTML & JavaScript.  In such an application, no webserver would be required - though it can certainly talk to a web server on which a PHP app was running if needed.


答:
Well, I see your Pro-list as rather weak list of "advantages"

Early integration helps team members to avoid painful merges

Painful merges are both types: or they do not exist yet or have been here already. Conflict (fact of this action) produces disorder, not the amount of actions before it

Encourages better coding habits, because everyone makes sure that they don't break co-workers' code everyday

If merging of coworker's code into my working codebase destroy build, it's not my fault, sorry! This is also true in the opposite direction of merging

Both developers and architects (code reviewers) may detect bad design decisions or just wrong development directions in real-time, preventing useless work.

If I saw this style of work in my team (control only merged code), PM and TL will be immediately dismissed with the black mark

I'm talking about getting the latest version of code base and checking-in your own code to the source control in a daily basis

"It depends" (c):

If nobody touches "my" files, I (can) don't worry about unrelated code-changes

If I close a lot of small related with other tasks, I'll prefer merge changes as fast as possible

Title: Agile project management, agile development: early integration

Body:
I believe that agile works if everything is agile.

In software development area, in my opinion, if team members' code is integrated early, code will be more in sync and this has a lot of pros:

Early integration helps team members to avoid painful merges.

Encourages better coding habits, because everyone makes sure that they don't break co-workers' code everyday.

Both developers and architects (code reviewers) may detect bad design decisions or just wrong development directions in real-time, preventing useless work.

Actually I'm talking about getting the latest version of code base and checking-in your own code to the source control in a daily basis.

When you start your coding day (i.e. you arrive to your work), your first action is updating your code base with the latest version from the source control. In the other hand, when you're about an hour to leave from your work and go home, your last action is checking-in your code to the source control and be sure that your day work doesn't break the project's build process.

Rather than updating and checking-in your code once you finished an entire task, I believe the best approach is fixing small and flexible personal milestones and checking-in the code once you finish one of these.

I really believe that this coding approach fits better in the agile project management concept.

Do you know some document, blog post, wiki, article or whatever that you can suggest me that could be in sync with my opinion?. And, do you find any problem working with this approach?.

Thank you in advance.


问:
Is Resharper still a significant improvement for Visual Studio 2012
I currently use Resharper with VS 2008 Pro. I find it almost a necessity to be as productive as I can be due to lack of some of the basic refactors/shortcuts in VS.

However I was wondering if since VS 2008 improvements have been made that make it almost as good as Resharper?

答:
I won't use VS2010 without it (see disclaimer). That and productivity power tools. I use both in VS2012 too. I think it improves the development experience significantly. I can navigate the code quicker, refactor way quicker. </p>

<p>It can be a resource hog, but the functionality helps me a lot. </p>

<p>*disclaimer: I did actually use 2010 recently for about three hours for a test on a machine with no resharper and a single monitor. Not a pleasant experience. </p>

Body:
I won't use VS2010 without it (see disclaimer). That and productivity power tools. I use both in VS2012 too. I think it improves the development experience significantly. I can navigate the code quicker, refactor way quicker.

It can be a resource hog, but the functionality helps me a lot.

*disclaimer: I did actually use 2010 recently for about three hours for a test on a machine with no resharper and a single monitor. Not a pleasant experience.


答:
A possibility could be to develop the application as a web application and run your web server on your desktop. In this way you do not need a different technology.

EDIT: there exist portable web server solutions (for example, http://www.server2go-web.de/ or http://portableapps.com/apps/development/xampp), which make this approach work much more smooth.

Title: Is there a way to develop desktop software using PHP?

Body:
I have to develop a real estate marketing CRM software for my client - where the application is installed on desktop but can also be accessed from web.

2 reasons why they want the application to run from desktop :

So that it can work with/without internet connection

They don't want their complete data to be online

They want to access few of the data like property listing & inquiries (managed from desktop application) from their website through secure login & password.

The data that is entered in desktop application should be automatically synchronized with the website application. I was wondering if there is a way to develop this kind of software using PHP & MySQL.  If yes, it will be great if anyone can provide me the referral link.Else please suggest, which language should I use.


问:
As a programmer, are you required to do timesheets?
Timesheets are something that I've never been fond of, but none the less something that is a requirement within my company. They don't bother me so much, but they seem to really grind some other people's gears. I suppose I have a few questions, and feedback would be great.

Are you required to do timesheets, assuming you aren't a contractor? (That is understandable to me).

What is the granularity of timesheets that you would be comfortable with or that you use? (ex: all entries must be under two hours).

Would timesheets ever factor into your reasons for not accepting a job or leaving a current one?

How has management within your organization justified timesheets if you aren't billing to a client?

答:
No, and I'd refuse job/contract offers that would make me fill out time sheets. I will never understand the ignorance of managers who think that the infamous time sheet is some sort of a great tool for keeping programmers disciplined as well as for measuring performance.

For all that he/she knows, I might have just copy/pasted a chunk of code from a blog that solves a hard problem in the first ten minutes and spent rest of my recorded time reading interesting discussions on P.SE.

We're not cotton plantation workers, and should not be treated as such.

ContentLicense: CC BY-SA 2.5


问:
Is there a name for this functional programming construct/pattern?
I wrote a function and I'd like to find out if it is an implementation of some functional programming pattern or construct.   I'd like to find out the name of this pattern or construct (if it exists)?

I have a function which takes a list of functions and does this to them:

```
    wrap(fn1, fn2, fn3, fn4)
    # returns
    partial(fn4, partial(fn3, partial(fn2, fn1)))
```

There are strong similarities to compose, reduce, and other fp metaprogramming constructs, since the functions are being arranged together and returned as one function.

It also has strong similarities to decorators and Python context managers since it provides a way to encapsulate pre and post execution behaviors in one function. Which was the impetus for writing this function. I wanted the ability that context managers provide, but I wanted to be able to have it defined in one function, and to be able to layer function after function on top.

UPDATE:

For clarity I've added the implementation:

```<code>
_wrap = partial(reduce, lambda inner, outer: partial(outer, inner))
def wrap(fns):
    fns = tuple(fns)
    if len(fns)==1:
        return fns[0]
    return lambda *a, **kw: _wrap(iter(fns))(*a, **kw)
</code>```

and an example:

```<code>
def fn_one(fn, *a, **kw):
  print "entered one"
  response = fn(*a, **kw)
  print "exited one"
  return response

def fn_two(fn, *a, **kw):
  print "entered two"
  response = fn(*a, **kw)
  print "exited two"
  return response

def zero():
  print "zero"

wrapped_zero = wrap((zero, fn_one, fn_two))
wrapped_zero() # returns entered two, entered one, zero, exited one, exited two
</code>```

答:
I believe you're referring to "threading".  Here's a nice Clojure explanation from Michael Fogus.

```<code>(-> (Math/sqrt 25) int list)
</code>```

Can literally be read:

Take the result of (Math/sqrt 25) Feed it into the function int Feed
  that result into the function list Graphically, this can be viewed as:

```<code>(Math/sqrt 25) --5.0--> (int 5.0) --5--> (list 5)
=> (5)
</code>```

Which expands into the following s-expression:

```<code>(list (int (Math/sqrt 25)))
</code>```

Body:
I believe you're referring to "threading".  Here's a nice Clojure explanation from Michael Fogus.

(-> (Math/sqrt 25) int list)

Can literally be read:

Take the result of (Math/sqrt 25) Feed it into the function int Feed
  that result into the function list Graphically, this can be viewed as:

(Math/sqrt 25) --5.0--> (int 5.0) --5--> (list 5)
=> (5)

Which expands into the following s-expression:

(list (int (Math/sqrt 25)))


答:
tl;dr

This is called currying, also sometimes schoenfinkelization and it's built-in default behaviour in Haskell and derivative languages. Plausibly other languages to I'm unfamiliar with.

http://en.wikipedia.org/wiki/Currying

In mathematics and computer science, currying is the technique of
  transforming a function that takes n multiple arguments (or an n-tuple
  of arguments) in such a way that it can be called as a chain of
  functions, each with a single argument (partial application). It was
  originated by Moses Schönfinkel[1] and later re-discovered by Haskell
  Curry.[2][3] Because of this, some say it would be more correct to
  name it schönfinkeling.[4][5]

Unnecessary details on currying:

Any language with higher order functions can have this behaviour mimicked, generics greatly help it be not clumsy, but the least clumsy languages for this are functional ones with facilities specifically to do it.

That said here are some articles about doing it in various languages to illustrate as you said it is a pattern:

http://msmvps.com/blogs/jon_skeet/archive/2012/01/30/currying-vs-partial-function-application.aspx

http://mtomassoli.wordpress.com/2012/03/18/currying-in-python/

https://wiki.php.net/rfc/currying

By default in haskell, every function takes no more than one value and returns one value, until eventually it takes no values and returns a value.

This is written as:

```<code>someFunc :: inputVal -> (returnVal)
</code>```

This becomes currying as:

```<code>someFunc :: inputVal1 -> (inputVal2 -> (inputVal3 -> (returnVal))))
</code>```

In this example, someFunc takes a value, and returns (a function which takes a value and returns (a function which takes a value and returns (a value)))).

Each of the functions in that chain take one value, the last return is not a function as it does not take anything but rather holds a computation (perhaps 1+2, something that doesn't take parameters).

I say this is default behaviour in Haskell because in Haskell, passing 2 values to someFunc will hand it one value, and hand the next value to the returned function, returning the 3rd function in the chain.

i.e. using the signature above, if I defined someFunc as:

```<code>someFunc x y z = x + y + z
</code>```

then I call it as:

```<code>plusTwo :: inputVal3 -> (returnVal)
plusTwo = someFunc 1 1
</code>```

Now I have captured the 2nd returned function in the chain by giving it one parameter which causes it to return the first function, and the second parameter I gave it is curried into that first returned function causing it to be called and return the 3rd function, which I use as the value for plusTwo

So in closing, currying works about like so:

given:

```<code>someFunc a b c d = a + b + c + d
plusOne   = someFunc 1
plusTwo   = someFunc 1 1
plusThree = someFunc 1 1 1
    four  = someFunc 1 1 1 1
</code>```

The signatures would be:

```<code>someFunc :: a -> (b -> (c -> (d -> (e))))
       plusOne :: b -> (c -> (d -> (e)))
             plusTwo :: c -> (d -> (e))
                 plusThree :: d -> (e)
                            four :: e
</code>```

Title: Is there a name for this functional programming construct/pattern?

Body:
I wrote a function and I'd like to find out if it is an implementation of some functional programming pattern or construct.   I'd like to find out the name of this pattern or construct (if it exists)?

I have a function which takes a list of functions and does this to them:

```
    wrap(fn1, fn2, fn3, fn4)
    # returns
    partial(fn4, partial(fn3, partial(fn2, fn1)))
```

There are strong similarities to compose, reduce, and other fp metaprogramming constructs, since the functions are being arranged together and returned as one function.

It also has strong similarities to decorators and Python context managers since it provides a way to encapsulate pre and post execution behaviors in one function. Which was the impetus for writing this function. I wanted the ability that context managers provide, but I wanted to be able to have it defined in one function, and to be able to layer function after function on top.

UPDATE:

For clarity I've added the implementation:

```<code>
_wrap = partial(reduce, lambda inner, outer: partial(outer, inner))
def wrap(fns):
    fns = tuple(fns)
    if len(fns)==1:
        return fns[0]
    return lambda *a, **kw: _wrap(iter(fns))(*a, **kw)
</code>```

and an example:

```<code>
def fn_one(fn, *a, **kw):
  print "entered one"
  response = fn(*a, **kw)
  print "exited one"
  return response

def fn_two(fn, *a, **kw):
  print "entered two"
  response = fn(*a, **kw)
  print "exited two"
  return response

def zero():
  print "zero"

wrapped_zero = wrap((zero, fn_one, fn_two))
wrapped_zero() # returns entered two, entered one, zero, exited one, exited two
</code>```

Body:
tl;dr

This is called currying, also sometimes schoenfinkelization and it's built-in default behaviour in Haskell and derivative languages. Plausibly other languages to I'm unfamiliar with.

http://en.wikipedia.org/wiki/Currying

In mathematics and computer science, currying is the technique of
  transforming a function that takes n multiple arguments (or an n-tuple
  of arguments) in such a way that it can be called as a chain of
  functions, each with a single argument (partial application). It was
  originated by Moses Schönfinkel[1] and later re-discovered by Haskell
  Curry.[2][3] Because of this, some say it would be more correct to
  name it schönfinkeling.[4][5]

Unnecessary details on currying:

Any language with higher order functions can have this behaviour mimicked, generics greatly help it be not clumsy, but the least clumsy languages for this are functional ones with facilities specifically to do it.

That said here are some articles about doing it in various languages to illustrate as you said it is a pattern:

http://msmvps.com/blogs/jon_skeet/archive/2012/01/30/currying-vs-partial-function-application.aspx

http://mtomassoli.wordpress.com/2012/03/18/currying-in-python/

https://wiki.php.net/rfc/currying

By default in haskell, every function takes no more than one value and returns one value, until eventually it takes no values and returns a value.

This is written as:

someFunc :: inputVal -> (returnVal)

This becomes currying as:

someFunc :: inputVal1 -> (inputVal2 -> (inputVal3 -> (returnVal))))

In this example, someFunc takes a value, and returns (a function which takes a value and returns (a function which takes a value and returns (a value)))).

Each of the functions in that chain take one value, the last return is not a function as it does not take anything but rather holds a computation (perhaps 1+2, something that doesn't take parameters).

I say this is default behaviour in Haskell because in Haskell, passing 2 values to someFunc will hand it one value, and hand the next value to the returned function, returning the 3rd function in the chain.

i.e. using the signature above, if I defined someFunc as:

someFunc x y z = x + y + z

then I call it as:

plusTwo :: inputVal3 -> (returnVal)
plusTwo = someFunc 1 1

Now I have captured the 2nd returned function in the chain by giving it one parameter which causes it to return the first function, and the second parameter I gave it is curried into that first returned function causing it to be called and return the 3rd function, which I use as the value for plusTwo

So in closing, currying works about like so:

given:

someFunc a b c d = a + b + c + d
plusOne   = someFunc 1
plusTwo   = someFunc 1 1
plusThree = someFunc 1 1 1
    four  = someFunc 1 1 1 1

The signatures would be:

someFunc :: a -> (b -> (c -> (d -> (e))))
       plusOne :: b -> (c -> (d -> (e)))
             plusTwo :: c -> (d -> (e))
                 plusThree :: d -> (e)
                            four :: e


答:
Isn't it essentially a (mathematical) function composition, only with reversed order of application? Your wrap is left-associative, compared with compose which usually is right associative, at least in Common Lisp.

The regular notation would be something like that:

fn1∘fn2∘fn3∘fn4(x) = fn1(fn2(fn3(fn4(x))))

In your case it's reversed:

fn1∘fn2∘fn3∘fn4(x) = fn4(fn3(fn2(fn1(x))))

This is akin to threading, described in Daniel J. Pritchett's answer, only with the argument omitted.

(-> Math/sqrt int list)


问:
My father is a doctor. He is insisting on writing a database to store non-critical patient information, with no programming background
So, my father is currently in the process of "hacking" together a database using FileMaker Pro, a GUI based databasing tool for his small (4 doctor) practice. The database will be used to help ease the burden on reporting from medical machines, streamlining quite a clumsy process.

He's got no programming background, and seems to be doing everything in his power to not learn things correctly. He's got duplicate data types, no database-enforced relationships (foreign/primary key constraints) and a dozen other issues. He's doing it all by hand via GUI tool using Youtube videos.

My issue is, that whilst I want him to succeed 100%, I don't think it's appropriate for him to be handling these types of decisions. How do I convince him that without some sort of education in these topics, a hacked together solution is a bad idea? He's can be quite stubborn and I think he sees these types of jobs as "childs play"

How should I approach this? Is it even that bad an idea - or am I correct in thinking he should hire a proper DBA/developer to handle this so that it doesn't become a maintenance nightmare?

NB: I am a developer consultant of 4 years and I've seen my share of painful customer implementations.

Update:

So it's a few years later now, and I've had time to reflect on this question. My dad ended up implementing a solution using Google Docs, FileMaker Pro and some email hooks. He set the whole thing up himself, and he says he is getting immense value from it.

If you are an experienced developer, you are perhaps reading that description and cringing. But I learnt a pretty good lesson from the whole thing actually - that people only care about the results, and not the implementation. All my dad cares about is the fact he doesn't need to enter patient information down on paper manually, and can instead quickly fill out a Google docs form. What's great is he's looking to hire a junior dev/ops person to focus solely on automation within his practice.

答:
A hacked together solution isn't always bad.  If it's solving his problem, I wouldn't make too much of a stink over it.  There's probably 10 working hacked together solutions in File Maker and Access for every professional database solution.  After all, that's what Filemaker and Access are for.  Sure, most of the hacked together solutions are awful under the hood.  But they exist to solve problems, not win beauty contests.  Often the scope of these solutions grow, and that's when someone is hired to build a professional solution.

What you might do to help his chances at success is express interest in his project and offer to sit down & help him define the database and walk through everything.  If he doesn't want your help... drop it & let him be.  What are you going to do, badger your father?  If/when he gets in over his head, he'll let you know.

Another thing to consider is if this is a common problem among doctors, you might have a very good business opportunity in creating a generic solution.


答:
As a software designer with 25+ years of experience, I can still see the attraction in crafting something yourself. Explaining things to someone not versed in that industry can be a  huge drag.

So what if the database isn't normalised or could be made faster? A lot of non-critical software (especially in the age of agile) follows the wabi-sabi principle. It does what it needs to do and no more.

Please appreciate that not all software has to scream along with a perfect interface, lightning-fast database access and an immaculate GUI.

Title: My father is a doctor. He is insisting on writing a database to store non-critical patient information, with no programming background

Body:
So, my father is currently in the process of "hacking" together a database using FileMaker Pro, a GUI based databasing tool for his small (4 doctor) practice. The database will be used to help ease the burden on reporting from medical machines, streamlining quite a clumsy process.

He's got no programming background, and seems to be doing everything in his power to not learn things correctly. He's got duplicate data types, no database-enforced relationships (foreign/primary key constraints) and a dozen other issues. He's doing it all by hand via GUI tool using Youtube videos.

My issue is, that whilst I want him to succeed 100%, I don't think it's appropriate for him to be handling these types of decisions. How do I convince him that without some sort of education in these topics, a hacked together solution is a bad idea? He's can be quite stubborn and I think he sees these types of jobs as "childs play"

How should I approach this? Is it even that bad an idea - or am I correct in thinking he should hire a proper DBA/developer to handle this so that it doesn't become a maintenance nightmare?

NB: I am a developer consultant of 4 years and I've seen my share of painful customer implementations.

Update:

So it's a few years later now, and I've had time to reflect on this question. My dad ended up implementing a solution using Google Docs, FileMaker Pro and some email hooks. He set the whole thing up himself, and he says he is getting immense value from it.

If you are an experienced developer, you are perhaps reading that description and cringing. But I learnt a pretty good lesson from the whole thing actually - that people only care about the results, and not the implementation. All my dad cares about is the fact he doesn't need to enter patient information down on paper manually, and can instead quickly fill out a Google docs form. What's great is he's looking to hire a junior dev/ops person to focus solely on automation within his practice.


答:
My feelings about ReSharper are mixed, in contradistinction to a number of my teammates. My favorite features are the smallest, like:

Little icons in the left margin for unit test cases to run/debug unit tests.

The unit test runner is generally kind of nice.

The reference-fixing that it adds. It is really nice to be able to put the cursor over a missing reference, hit alt-enter and enter again to add the missing using statements (for assemblies referenced elsewhere in the solution, but not in the project, ReSharper can even add the assembly reference first). I love this feature in particular, because I like to compose new code in Vim, ignoring using statements and such, then use ReSharper to quickly add them all.

These are not likely to be worth paying for. I hate fighting ReSharper for my keybindings--when I use Visual Studio, I want to use Visual Studio, not ReSharper. I seldom use the more advanced refactoring features.

Title: Is Resharper still a significant improvement for Visual Studio 2012

Body:
I currently use Resharper with VS 2008 Pro. I find it almost a necessity to be as productive as I can be due to lack of some of the basic refactors/shortcuts in VS.

However I was wondering if since VS 2008 improvements have been made that make it almost as good as Resharper?


答:
My issue is, that whilst I want him to succeed 100%, I don't think
  it's appropriate for him to be handling these types of decisions.

Filemaker got its start as a database that anybody could use, and it still works very well in that role. If your father knows what he wants and feels comfortable putting it together himself, what are you worried about? If it works the way he wants, he wins. If it doesn't work the way he wants, he'll fix it.

You'd be right to be concerned if he were building a database for all the doctors that work for Kaiser Permanente, but if he's just building a tool for use in his own practice it seems like he's probably exactly the right person to be handling these decisions.

Don't let perfect be the enemy of good.


问:
What mistakes do your users make, and how can you update your application to handle them?
In fact this question is about cautions to be taken to enhance quality user experience and reduce avoidable support calls.</p>

答: "Are you sure you want to delete this file/record? Yes/No". Clicked yes and then got a call that it "mistakenly" clicked the red delete button and it needs that data back:)</p>


答:
Here are two possible approaches I would take:

You could try Appcelerator Titanium for Desktop development with PHP.

Alternatively, you could install a local web server, develop the application logic, create a web-service and develop the view logic in something like Java to interface with the web-service.

If you take the second approach, I'd recommend you to use REST as the type of web-service.


问:
At what point/range is a code file too big?
I'm finding lots of 2-3k line files, and it doesn't really feel like they should be that big.

What is a good criteria to objectively call a source code file "too big"?, is there such thing  as a maximum amount of lines a source code file should have?

答:
No - not in terms of lines of code. The driver should be logical grouping. There certainly shouldn't be multiple classes in one large file for example

If you had a class that legitmately had a few hundred methods (not impossible in say 3D modelling) it would be a lot less convenient to split that into arbitrary files. We used to have to do this when memory was scarcer and processors slower - and it was a pains, constantly searching for the function definition.


答:
When the code in it becomes unmaintainable. i.e: you can't tell just by watching the code if the method/class/function you're looking for (and have to edit/debug) is in there, or not, and if so, where it is.

Your IDE/Editor choice and features will influence this upper limit's actual quantification, though. Code folding, function/method listing, and lookup will postpone the moment this development scenario presents.

But when it does, it's time to split it.

Title: At what point/range is a code file too big?

Body:
I'm finding lots of 2-3k line files, and it doesn't really feel like they should be that big.

What is a good criteria to objectively call a source code file "too big"?, is there such thing  as a maximum amount of lines a source code file should have?


问:
Why should I use a web framework's template language over python's templating options?
I'm coming from a python CGI background and was wanting to move into something more contemporary and think I have decided upon web.py as the framework I would like to use. In regards to templating, previously I used formatted strings and the string.Template module to effect most of my templating needs. After reading through a few of the templating options I have heard mentioned, I began wondering what the main benefits of using something like the Django or jinja templating options over "native" Python templating options were? Am I just going to be replacing $tmpl_var with {{ tmpl_var }} and s.substitute(tmpl_var=value) with t.render(s), i.e., alternate syntax? or will I gain additional advantages from using these templating systems?

答:
The first thing that you will notice is that if you want to have a repeated template (for instance think about having search results, with a block of text per entry), the solution that you're used to requires you to build up an array in Python, and then build up the final output.  But any decent templating system will let you code it inline, making it much easier to scan through the template and get a direct idea of the final output.

However if you talk to any experienced programmer, the first thing that they will cite is that you get the opportunity to separate presentation from content.  Just having different types of things in different places helps you organize your code better.  Read virtually any introduction to MVC (a random Google search said that http://tomdalling.com/blog/software-design/model-view-controller-explained/ was useful for some) for more on how you might want to organize your code.

To get a more precise idea what templating systems do and how they work, I really like http://perl.apache.org/docs/tutorials/tmpl/comparison/comparison.html.  Ignore all of the specific templating systems it discusses - they are all old systems for a different language.  But the first half of it provides a lot of context to understand the differences between different kinds of templating systems that you will run across in many languages.  And likewise to see the similarities between apparently different template systems.


问:
Is it time to deprecate synchronized, wait and notify?
Is there a single scenario (other than compatibility with ancient JVMs) where using synchronized is preferable to using a Lock? Can anyone justify using wait or notify over the newer systems?

Is there any algorithm that must use one of them in its implementation?

I see a previous questions that touched on this matter but I would like to take this a little further and actually deprecate them. There are far too many traps and pitfalls and caveats with them that have been ironed out with the new facilities. I just feel it may soon be time to mark them obsolete.

答:
Is there any algorithm that must use one of them in its implementation?

Almost certainly not.  (Indeed, from the theoretical perspective, you should be able to simulate wait / notify using other java.util.concurrent.. classes.  And synchronized could be replaced with explicit Lock operations ... though you would need to be careful to unlock in finally clauses.)

However, there are probably algorithms where the best performing implementation in Java involves direct use of synchronized, with or without wait and notify.

Is it time to deprecate synchronized, wait and notify?

Irrespective of the answer to the previous question, the answer is definitely no.

The wait / notify can be (and often are) used correctly.  In Java, deprecation is reserved for classes and methods that are broken; i.e. where continued use should be corrected as a matter of urgency.  If Sun (and now Oracle) deprecated something as fundamental and as widely used as wait/notify, they would be creating a serious compatibility problem for huge amounts of legacy code.  That is NOT in anyone's interest.

If you want to get rid of synchronized / wait / notify in your code, that is fine.  But deprecation calls for the rewriting of large amounts of essentially correct multi-threaded code, and that would be a BAD IDEA.  Corporate IT managers and software product managers would hate you for suggesting it ...

It is worth reading what "deprecated" means according to the Java documentation: http://docs.oracle.com/javase/1.5.0/docs/guide/javadoc/deprecation/deprecation.html

And also note that we are talking about deprecating stuff that is core to the Java language.  Deprecating synchronized has huge consequences.


问:
Why do so few large websites run a Microsoft stack?
Off the top of my head, I can think of a handful of large sites which utilize the Microsoft stack

Microsoft.com

Dell

MySpace

PlentyOfFish

StackOverflow

Hotmail, Bing, WindowsLive

However, based on observation, nearly all of the top 500 sites seem to be running other platforms.What are the main reasons there's so little market penetration?

Cost?

Technology Limitations?

Does Microsoft cater to corporate / intranet environments more then public websites?

I'm not looking for market share, but rather large scale adoption of the MS stack.

答:
So few? I don't think 34% market share is few.

http://w3techs.com/technologies/overview/operating_system/all

It's the study with the lowest result for Windows I've found.

There are others studies that grant Windows revenue based market share weight more than 60%.

Few is definitely not the good word to use.

More studies:

Reuters: http://www.reuters.com/article/idUSN2748543820080228

Netcraft: https://ssl.netcraft.com/ssl-sample-report//CMatch/osdv_all

Wikipedia: http://en.wikipedia.org/wiki/Usage_share_of_operating_systems#Servers

Does Microsoft technologies based websites can actually scale?

www.live.com (5th Alexa), www.msn.com (11th Alexa), www.microsoft.com (21th Alexa) or www.bing.com (25th Alexa) webmasters ;)

MySpace is also windows based.


问:
Should we use python 2.6 or 2.7 or 3.x?
The version of python which I am using is 2.6, and there is a 2.7 and 3.x. Usually I use python for some trivial program/snippet. I realize there are some major difference between 2.x and 3.x. I would really like to know, if I am going to make a bigger project with python, which version of python should I use?

Should I upgrade to 2.7, or go to 3.x or stay with 2.6?

The decision should be based on these terms:

Number of user in the internet as a community. More users mean more open-source package and help from them.

Functionality.

Support from official development team.

Compatibility for existing module/package.

Thanks!

答: Until a bridge is developed intrinsically within 3.x to allow the transparent use of 2.7 packages a move is fraught with peril because the language is really all about what has been contributed to it.  Formal considerations and purity are negligible in comparison.  Such a transparent bridge isn't likely to happen out of sheer pedantic stubbornness and disregard for the user base.  </p>

Title: Should we use python 2.6 or 2.7 or 3.x?


问:
Can I use aac in an commercial app for free?
I was wondering if I can use the aac codec in my commercial app for free (through lgpl ffmpeg). It says on the wiki:

No licenses or payments are required to be able to stream or distribute content in AAC format.[36] This reason alone makes AAC a much more attractive format to distribute content than MP3, particularly for streaming content (such as Internet radio).
  However, a patent license is required for all manufacturers or developers of AAC codecs.> For this reason free and open source software implementations such as FFmpeg and FAAC may be distributed in source form only, in order to avoid patent infringement. (See below under Products that support AAC, Software.)

But the xSplit program had to cancel the AAC for free members because they have to pay royalties per person. Is this true (that you have to pay per each person that uses aac)? If you do have to pay, which company do you pay to and how does one apply?

答:
Go to this page and they will set you right up:

###AAC Frequently Asked Questions

Who must sign a license?

What products are covered by the license?

What technologies are covered under the AAC patent licensing program?

Are there use fees for AAC?

What is the term of the AAC license?

I am already a licensee of MPEG-4 AAC and HE AAC. How can I take the AAC license?

Besides the license fees, are there any other costs involved?

What is "PC Enabling Software" as presented in the AAC license Fee Schedule?

Who are the licensors participating in the AAC Licensing Program?

How can I obtain a sample license for review?

What do I need to do in order to execute the agreement and obtain a license?

What are the reporting requirements of the AAC Program?

What is meant by a "reset" in the fee schedule?

What is the definition of a "professional" product?

Is there a difference between license fees for multi-channel products and stereo products?

How are products categorized as either stereo products or multi-channel products?

Is there a trial period available for licensed products?

What do I get after signing the AAC patent License Agreement?

Where can I get code or other "know-how" for AAC?

These answers to frequently-asked-questions are provided to explain the licensing program. The terms and conditions governing the license are provided in the license agreement.

ContentLicense: CC BY-SA 4.0


问:
When should I make the first commit to source control?
I'm never sure when a project is far enough along to first commit to source control. I tend to put off committing until the project is 'framework-complete,' and I primarily commit features from then on. (I haven't done any personal projects large enough to have a core framework too big for this.) I have a feeling this isn't best practice, though I'm not sure what could go wrong.

Let's say, for example, I have a project which consists of a single code file. It will take about 10 lines of boilerplate code, and 100 lines to get the project working with extremely basic functionality (1 or 2 features). Should I first check in:

The empty file?

The boilerplate code?

The first features?

At some other point?

Also, what are the reasons to check in at a specific point?

答:
I have gone through all the articles and i think we already got lots of good solutions but i would like to share my methodology with you.

While working on framework creation (right from scratch) lots of changes are going to take place for each module until the module is completed or finalized. So I always have 2 locations one is named as DYNAMIC and other is STATIC.
When changes are going on and framework is not yet finalized it’s been committed in DYANMIC location and once it is completed and finalized I move that to the STATIC location.
So I have a complete Source Control.

Thanks


答:
Cost

That's what I'm placing my money on. Facebook has 60k servers, what's the license cost on that vs. Linux?

Look at the "open stack" as we can call it:

Apache – Free

PHP - Free

MySQL - Free

Linux - Free

Contrast to the MS stack:

IIS - $$$

Visual Studio - $$$ (but it's great)

OS - $$$

SQL Server - $$$

Title: Why do so few large websites run a Microsoft stack?

Body:
Off the top of my head, I can think of a handful of large sites which utilize the Microsoft stack

Microsoft.com

Dell

MySpace

PlentyOfFish

StackOverflow

Hotmail, Bing, WindowsLive

However, based on observation, nearly all of the top 500 sites seem to be running other platforms.What are the main reasons there's so little market penetration?

Cost?

Technology Limitations?

Does Microsoft cater to corporate / intranet environments more then public websites?

I'm not looking for market share, but rather large scale adoption of the MS stack.


答: My advice is to pretend this doesn't exist or else it will drive you mad. I have a relative who's done a similar thing with his client list, and what he's created on his own is a monstrosity. I initially offered to help and he thought my quote (which had a hefty "family" discount) was outrageous. After having a look at it I suggested a bunch of changes, which he asked me to make in exchange for "a couple of beers." Family or not, Homie don't play that. I told him he should hire someone to do it, but he never did. I just had to cut myself off from it completely and pretend it doesn't exist, just to keep the awfulness of the project from eating at me.</p>


问:
Security issue about making my code public in GitHub
I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, not even SVN), to let others contribute to the project, and also perhaps using it to let my potential future employers see some of my code as some sort of curriculum.

But what I'm wondering now, and I'm suprised I haven't seen anyone mention it before is the security aspect of it. Isn't publishing the code of a website a HUGE security hole? Is like giving a potential hacker or anyone who would like to find any potential exploit possible, even considering that the critical files aren't uploaded (database passwords, authentication scripts, etc.).

Of course that there are millions of projects uploaded to GitHub and no one will find mine just 'by chance'. But if they look for it, it would indeed be there.

Bottomline: my problem is not about copyright or licenses, but others finding exploits in my website.

I'm I missing something here?

答:
I'm I missing something here?

Yes. Relying on people not knowing your source code to prevent them from finding security exploits in it is known as security through obscurity.

The problem: it doesn't work. Skilled hackers don't need the source code to find and exploit vulnerabilities. They'll do some fuzzing to find input that causes problems and then use their knowledge of how the underlying OS/language/framework works to identify a vulnerability.

It is widely agreed that having the source code public increases security by enabling well-meaning people to find vulnerabilities and fix them, or at least tell the developer about them. There are two important reasons why this works:

There are generally more well-meaning than malicious people

Any vulnerability found by a well-meaning person will be fixed for everyone; hackers are far less likely to collaborate

Of course it doesn't work with pet projects that have few active users, but those are also exceedingly unlikely to be targeted by a hacker.


答:
First off, you can use (distributed) version control without making the repository public. You can just create a repo on your local computer, and push to/pull from other computers. You can also upload the repository (giving you more backups and easier collaboration) without making it public. GitHub offers private repos for a fee, Bitbucket does the same and makes small (5 persons or something) private repos free. Of course, then you don't get the other benefits you mentioned.

The security aspect is rather small. There are many, many worthwhile attack vectors which can be tested out easily without looking at the (server-side) source code (like being attentive to GET and POST parameters, checking cookies and session handling, adding inputs that ought to get escaped and check if they are, etc.). If you're vulnerable to any of them, a determined attacker can exploit them reasonably quickly without looking at the source code. More obscure and harder-to-exploit errors are (probably) also harder to spot in the source code, so again, you don't lose much.

On the other hand, making it public and accepting contributions may attract people who can spot exploits, without ill meaning, and tell you about them (or even fix them themselves). This goes doubly if it's really popular but you're not a security expert (no offense, but you don't sound like one; for example, you didn't mention security through obscurity and how your concern is not a case of it).

Title: Security issue about making my code public in GitHub

Body:
I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, not even SVN), to let others contribute to the project, and also perhaps using it to let my potential future employers see some of my code as some sort of curriculum.

But what I'm wondering now, and I'm suprised I haven't seen anyone mention it before is the security aspect of it. Isn't publishing the code of a website a HUGE security hole? Is like giving a potential hacker or anyone who would like to find any potential exploit possible, even considering that the critical files aren't uploaded (database passwords, authentication scripts, etc.).

Of course that there are millions of projects uploaded to GitHub and no one will find mine just 'by chance'. But if they look for it, it would indeed be there.

Bottomline: my problem is not about copyright or licenses, but others finding exploits in my website.

I'm I missing something here?


答:
I've been engineering Healthcare solutions for many years. I won't go into all the different reasons that your father shouldn't be doing this; most of the reasons being academic: meaning, if you've been in the industry long enough you know how these things snowball and develop a life of their own.

Instead your father, as a physician, needs to understand the professional reasons and real-life, non-academic, reasons why what he is doing is dangerous and possibly life-threatening; dangerous to his colleagues, dangerous to his patients privacy and identity, and dangerous to his practice from a legal standpoint.

The danger is multi-faceted:

patient privacy (HIPAA, ARRA, Meaningful Use, HITECH Compliance)

what are the fields that are considered patient identifying fields (many professionals in the industry don't understand this, and just because you eliminate some of the obvious fields like last name, address, zip code there are still many other fields that would make it easy to associate clinical data to a specific patient; this, in itself, is difficult; there are companies out there making lots of money de-identifying clinical data - it's a whole domain in itself).

HIPAA, HITECH and newer legislation spells out clearly how

auditing should be done

security should be done

password requirements

should the data at rest be encrypted

should the data transmitted be encrypted, and how

you must consider the controls if you are using any kind of hosted service (IaaS, PaaS)

do you have proper BAA and DSA in place

how do those hosting your servers control access

how do they handle multi-tenancy (you'd be amazed at how some of these large entities do NOT handle this appropriately)

if you terminate the contract with those hosting your infrastructure, how will they ensure permanent deletion of your data (NIST regulations)

what are the governing controls in place for your development

do you have an sdlc in place

do you have traceability from requirements to code to QA

do you validate 'intended' use of your medical application/device

is your software being QA'd, and do you have a User Acceptance Test (UAT) environment

how do you secure this environment, because you'll be using real patient data

is he going to handle medicare patients, if so is he planning to use his database to report out?

the government has strict controls in place for the exchange of this data to their Health Information Exchange (HIE)

which leads to how will he implement his own exchange if he wants to take advantage of his clinical data repository (CDR)

does he understand the particular NIST regulations he needs to abide by for data security

such as permanent deletion of data (if using a hosted infrastructure)

you mentioned he will be taking data from medical machines

does he understand the new FDA medical device standards?

starting in 2013, any digital system that displays data from medical devices can be categorized as a medical device ... this means he must meet the FDA regulatory requirements for medical devices

will his team and staff be making medical decisions based on the data in his database?

has he developed a solid clinical data model, flexible enough to handle the ever changing requirements (i.e., ICD-9 to ICD-10 to ICD-11 coding standards)?

how will he version the data model and keep it in sync with the data (i.e., if he changes the clinical data model how will older data be represented?)

will his system be able to produce an exact snapshot of the clinical data as it was seen on the day that a clinical decision was made? there are legal repercussions if he can't

does he know the difference between a real delete and a logical delete, and the implications to his data model; to his storage requirements; to his practice's policies?

does he have a vocabulary solution in place to handle all the different services he will need to use; much of the data needs to be coded (as opposed to free text), because he will want to take advantage of his CDR to produce ICD-9 compliant reports. And then he needs to take into account the changing of these standards; e.g., ICD-9 to ICD-10.

for vocabulary, terminology or Health Data Dictionary (all basically synonyms) how will he implement and ensure that old terminology can still be rendered for old clinical decisions?

will he be storing allergy data?

how will his 'medical terminology' or 'vocabulary' definitions be stored?

will he integrate with other terminology systems like LOINC and First Data Bank?

does he have an understanding of terminology services (i.e., Health Data Dictionary)

will he want to have data interfaced into his system, and maybe out to a health information exchange (HIE)?

if so, does he understand HL7 and its impact on his database?

does he understand interface engines and all that goes along with that?

does he understand how to de-identify information?

this is important in the development phase and the bug fixing phase

These are just a few questions, and by no means should it be considered a comprehensive list. And for each answer there will be countless more questions.

In a Healthcare database there should not be any deletion or over-writing of previous data. This means there are never going to be 'delete from  where...' or 'update  set ...'. Instead you will only have inserts. You can imagine how this changes your data model and your queries. Now you can be creative and come up with different solutions to attain this goal, but the fact remains that this is a requirement that is unique to the Healthcare Clinical Data repository.

Just one more thought regarding the life-threatening side of this issue:

Let's take, for example, allergy information; I raise this one up because institutions who have been doing this digitally for years have learned that their processes need to ensure that allergy data is captured and that we can't assume that because technology captured the data in a database it is somehow inherently correct forever. This is why patients are asked for their allergies every single time as they move from one department to another, even within the same hospital. A patient's allergies can't be deleted (updates to a row delete the old information). A clinical decision based on digital data needs to capture what was 'presented' to the clinician at the time of the decision.

I know much of this may seem to be geared to a large institution. However, the regulatory parts aren't. And in any case, Healthcare Information Systems are inherently complex. Healthcare system engineering depends and recognizes the expertise and experience of good clinicians. However, there is a larger than average impedance mismatch (to borrow terminology from the ORM technology) in the Healthcare IT domain ... I venture to say larger because every domain has its mismatches.

Good luck!


问:
Is a scrum sprint backlog ordered?
Currently, Wikipedia Scrum Article defines "Sprint Backlog" as:

A prioritized list of tasks to be completed during the sprint.

It is my understanding that the "Product Backlog" is a prioritized list but that the "Sprint Backlog" does not have an order. I am looking for a definitive reference for the answer.

答:
I would argue that having "strictly ordered" product backlog i.e. a number ranking for each item in the list is waste.

Instead it's probably more like a partitioned set

Next iteration

Next iteration +1

Soon

The rest

Investing time in ordering at a level of detail more than this is not going to be productive, as it will create the artificial notion of a fixed order when things are more likely to chop and change.

--

For the sprint itself, the team need to hit the most valued items first - so yes it should be ordered. Estimations of size and velocity aren't always going to be perfect, so there will be (infrequent) times when stuff needs to be chopped so that the other stories can be 'done-done' - which would naturally be those at the bottom of the list.

Title: Is a scrum sprint backlog ordered?


答:
Setting aside the issue of security and whether making your code public would enhance it or not, you can setup a source control system on your machine yourself. In case of git it's trivial, just initialize a local repository and you're done, but setting an SVN also isn't a daunting task. Maybe an hour or two following the tutorials, if you have little prior knowledge on how to setup SVN.

So you can still benefit from source control, regardless whether you end up using an online service or not.


问:
Is it appropriate to run a complex enterprise-system configuration and migration project in a similar way to a Scrum development project?
I'm just starting out on the implementation of a large enterprise-wide system, which has complex requirements and many stakeholders.

The company has been through high-level evaluation and tender process and determined to purchase a highly configurable "off-the-shelf" product rather than building an entirely bespoke system. The system will replace several existing systems and will require a significant amount of data migration.

I'm thinking that the implementation of this system (which is expected to take over 2 years) could be run in a similar way to a Scrum software development project.

With the first sprints targeted at building the minimal possible functionality needed (across all functional areas), and then iteratively deepening the level of functionality according the stakeholder feedback. I think this will de-risk the project and help ensure a balance of stakeholder needs within the available time.

The user stories are still the same, it's just that to implement them we have work within the constraints of the pre-purchased system. When it comes to 'building stuff', instead of writing custom code the team will be configuring the off-the-shelf package, writing data conversion scripts and the like (and it should be a lot quicker!).

Does this sound like a sensible approach? Does the Agile approach makes sense here?

答:
Despite the use of an off-the-shelf product, this is a software development project and will have to be run accordingly (withs SCRUM, Agile and/or other methodologies).

As you said, you will have to write migrations scripts, configuration files and so on. This is software development. Anything else.

You will have to use a source code versioning system like GIT, Hg, Subversion or CVS. You will have to keep track of bugs and requested features.
You will have to document what you are developing.
You will have to test your system.

This is just "software development", so your approach is more than sensible. It is mandatory.

Agile development almost always make (at least some) sense. Sometime it has to be used together with others (more formal) methodologies but it is almost always a good starting point.


答:
As AlexBottoni already mentioned SCRUM can be used because even customizing is software development.

But for your approach to do several sprints in creating basic functionality is the wrong way. Get one of the existing systems and replace it with the new solution. This should be done in only a few sprints. Select only few user stories at first to implement. When the first system is replaced get the second one. Don't try to replace everything at once because then it is more likely to fail. Even if it seems to cost more time it is worth to replace one system after another. Also then the management will see faster what will be achived.

If you take two years to replace everything the current systems will be developed further and you have a moving target...

Title: Is it appropriate to run a complex enterprise-system configuration and migration project in a similar way to a Scrum development project?

Body:
I'm just starting out on the implementation of a large enterprise-wide system, which has complex requirements and many stakeholders.

The company has been through high-level evaluation and tender process and determined to purchase a highly configurable "off-the-shelf" product rather than building an entirely bespoke system. The system will replace several existing systems and will require a significant amount of data migration.

I'm thinking that the implementation of this system (which is expected to take over 2 years) could be run in a similar way to a Scrum software development project.

With the first sprints targeted at building the minimal possible functionality needed (across all functional areas), and then iteratively deepening the level of functionality according the stakeholder feedback. I think this will de-risk the project and help ensure a balance of stakeholder needs within the available time.

The user stories are still the same, it's just that to implement them we have work within the constraints of the pre-purchased system. When it comes to 'building stuff', instead of writing custom code the team will be configuring the off-the-shelf package, writing data conversion scripts and the like (and it should be a lot quicker!).

Does this sound like a sensible approach? Does the Agile approach makes sense here?


问:
What core principles would you want in a library?
Theres talk about what syntax and feature you like in a programming language; i'll now ask what core principles or feature would you like in a library in your favorite (or any) language?

An example is having adding list += anotherList valid as oppose to only allowing list += listElement (although some may see this as a bad idea)

答:
Make Simple Things Simple and Complicated Things Possible

This pretty much sums up every other design philosophy.  If your library only makes complicated things possible, people looking to solve the easiest 80% of use cases will be tempted to reinvent the wheel rather than deal with your overengineered monstrosity that requires you to use 6 different classes to do your library's equivalent of "Hello World".

If your library only makes simple things simple, people will become annoyed very quickly when they find out that they need to rewrite their code just because they had a requirement that was a little bit off the beaten path.

The best ways to accomplish this are:

Be liberal in what you accept.  If you're programming in a dynamic language, use duck typing to full effect.  If you're programming in C++ or D, use templates wherever possible.  Accept anything that satisfies some reasonably universal structural interface.  Don't force your users to do a lot of busy work converting data from one format to another.

Build high-level convenience functionality into your library, but build it in a transparent way on top of lower level functionality, and make sure the lower level functionality is there for people who need it.

Follow the principle of least surprise by default, even when doing so may limit flexibility or efficiency.  If necessary, add a second function with a more verbose name that emphasizes its surprisingness to allow for optimizations or increased flexibility.

Encapsulation is useful, but don't be anal about it.  People with unusual, unanticipated requirements occasionally might need to get underneath one of your abstractions to get the job done.  On the other hand, it should be hard to shoot oneself in the foot by accident, when using seemingly innocent constructs.  Keep this in mind when deciding how tightly you want to lock stuff down.

Use examples heavily in your documentation.  This serves both to illustrate common use cases to your user and to force you to think about whether the most common cases are sufficiently streamlined.

Have reasonable defaults for everything you can, but make sure those defaults are just defaults and that it's clear how to override them.


问:
Is modern C++ replacing C#? Is Microsoft pushing developers to adopt C++?
I hear about modern C++ popularity and some talks about migrating back to C++ from C# or other C-like languages.

I know about C++11 features but I would like to hear your experiences, especially from developers who migrated from C# to C++.

More importantly, does Microsoft push developers to use C++? If yes, why?

答:
No, C++ can't replace C# because all the non-Direct3D Windows Phone 8 apps must be developed with C#. You can't develop and publish applications to wp8 app store  just by using C++ or HTML5/Javascript. And as long as Microsoft doesn't remove this restriction, C++ isn't replacing anything. As a result, I am sure very few people will develop for WP8. Poor Nokia, losing one more time.

Here is the excerpt from microsoft dev center:

Windows Phone 8 doesn’t support the XAML UI with C++ code-behind app
  model that is supported for Windows Store apps.

yet another:

Does this mean that I cannot use C++ with XAML to develop an app on
  Windows PHone 8, am I restricted to use C# + XAML?

That is correct.
  XAML can only be used with C#.  C++ can be used for a WinRT component
  used by the C# project.

Even Microsoft MVPs claim that this rumor is a deliberate misinformation made by Microsoft himself:

I love what Microsoft is doing with WinRT and Windows Phone 8, but I
  wish they wouldn't oversell some of it as it will just frustrate users
  once they learn the completely truth of the matter.

And this deliberate wrong marketing wastes people's months:

It would have been nice to know this MONTHS AGO, before I went down
  the all native code route with my Metro app.


问:
Writing a Software Requirement Specification
I have a few questions about writing a specification and they are:

When we write a software specification, under the topic "User requirements definition" we have to specify the "Functions" and "Constraints" only ?

Does "User Interface" fall into "functions" or "constraints" ?

What are the major key areas (requirements) a software can be broken into (e.g. UI ) ?

答:
While I am not a big fan of gathering all requirements in detail up front (as they are subject to so much change over the course of a non trivial project), if you are writing requirements documents, the Volere requirements specification template is an excellent guide.

While it may be overkill for some projects, it provides a great checklist of things to think about, even if it's just to mentally check off the list that you don't need that item for this requirement.

Here's a link to more information about the template:

http://www.volere.co.uk/template.htm

The template itself (and the book Mastering the Requirements Process - which is actually slightly less expensive than the template and contains the full template text) contains a lot of information, examples and advice within the various sections as to what should go in each section.

Here's a summary of the sections in it (quoted from the above link):

The Purpose of the Project

The Stakeholders

Mandated Constraints

Naming Conventions and Definitions

Relevant Facts and Assumptions

The Scope of the Work

Business Data Model and Data Dictionary

The Scope of the Product

Functional and Data Requirements

Look and Feel Requirements

Usability and Humanity Requirements

Performance Requirements

Operational and Environmental Requirements

Maintainability and Support Requirements

Security Requirements

Cultural and Political Requirements

Legal Requirements

Open Issues

Off-the-Shelf Solutions

New Problems

Tasks

Migration to the New Product

Risks

Costs

User Documentation and Training

Waiting Room

Ideas for Solutions


答: BitBucket has free private repos and supports both git and mercurial.</p>


问:
java framework for a web wizard
I'd like to create a web wizard or a wizard on/within a website.

I know there are several java frameworks for wizards but there is none for the web in particular.

If I search for a framework, I always get wizards to create a website, applet, servlet and what not. But never how to create such a wizard itself.

So the question(s) is:
What framework should I use to create a web wizard?
And what frameworks are there?

The wizard will be the visualisation for a BPEL Process deployment on a apache ode.

I thought a webapp would be an easy way because the apache is running anyway.
I'm not bound to that, perhaps someone has a better idea.

答:
A webapp seems to be a good approach in your case.

Unfortunately, there isn't any framework that manages wizards only. All of the existing web frameworks, like Wicket, Tapestry, Ruby-on-Rails, Django and so on, deal with a much larger set of functionalities. A wizard is rarely included as a distinct, ready-to-use feature because it is quite easy to develop one with the tools supplied by the framework. As a consequence, you will have to adopt a general-purpose web framework and use it to develop a wizard.

Most likely, if you have to develop just a wizard, you should use something lighter and simpler than Wicket, Tapestry, Rails or Diango. Probably you should use someting like Padrino (Ruby-based, but there are "clones" of Padrino in many languages).

Googling around, you can find a framework that includes a ready-to-use wizard or a wizard plug-in. A wizard is a common need and it is more than possible that someone else has already developed something like that. Unfortunately, you will have to focus your attention on a few specific frameworks and investigate in depth about their features/plug-ins (because of the Google misunderstanding you experimented already).

PS: If Java is not mandatory, I would avoid it. It is probably easier and faster to develop such an application with Sinatra/Padrino (Ruby-based) or Bottle/Flask (Python-based). Django (Python-based) could be a good alternative, as well.

Title: java framework for a web wizard


问:
Sharing authentication methods across API and web app
I'm wanting to share an authentication implementation across a web application, and web API. The web application will be ASP.NET (mostly MVC 4), the API will be mostly ASP.NET WEB API, though I anticipate it will also have a few custom modules or handlers.

I want to:

Share as much authentication implementation between the app and API as possible.

Have the web application behave like forms authentication (attractive log-in page, logout option, redirect to / from login page when a request requires authentication / authorisation).

Have API callers use something closer to standard HTTP (401 - Unauthorized, not 302 - Redirect).

Provide client and server side logout mechanisms that don't require a change of password (so HTTP basic is out, since clients typically cache their credentials).

The way I'm thinking of implementing this is using plain old ASP.NET forms authentication for the web application, and pushing another module into the stack (much like MADAM - Mixed Authentication Disposition ASP.NET Module). This module will look for some HTTP header (implementation specific) which indicates "caller is API".

If the header "caller is API" is set, then the service will respond differently than standard ASP.NET forms authentication, it will:

401 instead of 302 on a request lacking authentication.

Look for username + pass in a custom "Login" HTTP header, and return a FormsAuthentication ticket in a custom "FormsAuth" header.

Look for FormsAuthentication ticket in a custom "FormsAuth" header.

My question(s) are:

Is there a framework for ASP.NET that already covers this scenario?

Are there any glaring holes in this proposed implementation? My primary fear is a security risk that I can't see, but I'm similarly concerned that there may be something about such an implementation that will make it overly restrictive or clumsy to work with.

答:
Well, usually this scenario (same server-side system, different clients) is managed delegating to the clients the responsability to use the same service set offered by the server in different ways (In your schema, it is the server that changes its behavour depending on the client request).

In other terms, usually you have:

A single API-exposing web server program (usually a webservice, most often a RESTful webservice) that handles all the requests.

A web client that asks for the data it needs, creates its own UI and handles all of its interactions with its user and with the server in its specific way. Of course, the UI is generated and managed with Javascript, HTML and CSS (AJAX).

An API (no UI) client that asks for the data it needs and handle them in its specific way.

On the server side it is normally used a RESTful webservice because using different HTTP verbs (GET, POST, etc.) it is quite easy to differentiate and satisfy the requests that came from different clients.

Put aside this, it is normally considered a very bad idea to play with custom authentication and security mechanisms/protocols because it is very easy to overlook some important vulnerability. If the main goal of your development effort is NOT the authentication mechanism, you should probably try to use an existing system, like OAuth, CAS or someting like that.

Of course, if the main goal of your development effort IS the authentication mechanism, this does not apply to you. In this second case, you should put in the client request header something that is generated on the server side, is used just to identify the client and is changed very often (that is: a client session ID, most likely a hash) and delegate all of the checks&dance to the server side programs (that is under your control and is trustworthy).

Putting an easy-to-copy, easy-to-forge string into the client request header, and change the server-side software behaviour depending on this string, is not a good way to handle a security-related mechanism like authentication.


问:
My father is a doctor. He is insisting on writing a database to store non-critical patient information, with no programming background
So, my father is currently in the process of "hacking" together a database using FileMaker Pro, a GUI based databasing tool for his small (4 doctor) practice. The database will be used to help ease the burden on reporting from medical machines, streamlining quite a clumsy process.

He's got no programming background, and seems to be doing everything in his power to not learn things correctly. He's got duplicate data types, no database-enforced relationships (foreign/primary key constraints) and a dozen other issues. He's doing it all by hand via GUI tool using Youtube videos.

My issue is, that whilst I want him to succeed 100%, I don't think it's appropriate for him to be handling these types of decisions. How do I convince him that without some sort of education in these topics, a hacked together solution is a bad idea? He's can be quite stubborn and I think he sees these types of jobs as "childs play"

How should I approach this? Is it even that bad an idea - or am I correct in thinking he should hire a proper DBA/developer to handle this so that it doesn't become a maintenance nightmare?

NB: I am a developer consultant of 4 years and I've seen my share of painful customer implementations.

Update:

So it's a few years later now, and I've had time to reflect on this question. My dad ended up implementing a solution using Google Docs, FileMaker Pro and some email hooks. He set the whole thing up himself, and he says he is getting immense value from it.

If you are an experienced developer, you are perhaps reading that description and cringing. But I learnt a pretty good lesson from the whole thing actually - that people only care about the results, and not the implementation. All my dad cares about is the fact he doesn't need to enter patient information down on paper manually, and can instead quickly fill out a Google docs form. What's great is he's looking to hire a junior dev/ops person to focus solely on automation within his practice.

答:
I think the answer to your question mainly depends on how critical for his medical practice is this application. Will he be storing there just some patients data which he finds useful or any malfunction of this application may have severe consequences?
If it may have severe consequences then he shouldn't do it but because we are not living in a perfect world convincing him that it is not a good idea may be completely different matter.

As you are a developer consultant I would suggest offering him help in QA and testing process. In this way you will keep good relationship with your father because you are "helping" him but at the same time you can make sure that his app is doing what is supposed to do or even find a problem which he will not be able to solve so he will seek more professional solution.

BTW I have seen quite many terrible apps which were doing their job and no amount of explanation why it's terrible would convince anyone to make any real changes in it.


答: Most malicious hacking is done anonymously. Some person in Russia running a script that scans hosts for open ports, or what-have-you. No one is going to explicitly pour over your code just to find a way to hack in to do harm. Not unless you really piss someone off.


问:
What are some known/common development specialties?
In an answer that I posted to another question, I noted that there is likely to become more and more specialization in software development: there being experts or specialists for given type of programming.

I'm wondering, what specialties are known to exist in reasonable quantities in the industry now (not academia), that are not technology specific (eg. for this discussion winforms isn't a specialty)? I'm also interested in the industry that such a specialist would have to work in if necessary.

答:
There is also the distinction of knowing a particular kind of software solution such as any of the following:

Enterprise Resource Planning

Customer Relationship Management

Content Management System

There are likely others but these are another form of specialty where one could work for almost any type of company doing a customization of the above potentially.  In my case, I have worked on a Content Management System for a couple of years now that I would say is a specialty in a sense.

Something like Web Development may not be specific enough as there can be many specialties within this area, or would it count for what you want?