问:
UML Receptions and AcceptEventActions
What shall be the relationship between the receptions of a class (was classifier before Aadaam correction) and the AcceptEventActions in the activity describing the behavior of its instances?

I understand the former is related to signals reception of the type while the latter is related to runtime ReceiveSignalEvent events of the class instances (objects). But it is not totally clear to me how to express consistency among these constructs.

I am defining a set of M2M and M2T Transformations (by means of QVT and MOFM2T). However independently of what I am trying to do I am curious to know what is the correct syntax for such models.

答:
Bit of a background: UML is the Universal Modeling Language. The aim for version 2.0 was to grab all the different diagramming / modeling standards that exists in IT, and meta-standardize them, whilst trying to help static analysis on models. That way they could've created the true lingua franca of IT.

That's why MOF has about 400 classifiers. The only thing you can say to that is OMG.

One of such brought in modeling standard was the SDL from telecommunications. That is where AcceptEventActions come from: basically there are two parallel universes, with a parallel set of tokens, and AcceptEventActions are the "sensors" who "sense" this parallel universe and trigger themselves on accepting a token from it.

It's like when a phone call is coming in to your landline: it's not your phone who has the event, the event comes from the outside world.

Now a classifier is anything which has a classifier attribute, that is, a class is something which constitutes a set: for everything in the world, you can say that it belongs to the class, while the other does not. It's a pretty broad thing.

Therefore, a classifier doesn't have any receptions - it might have, it might not have, well, those who have something called reception constitute a class.

In a broad sense, a classifier is a set of common features which the members (instances) of the class share, or rather, in which these are interestingly different. That is, if I say, that a cat is classified by its eye color, age, breed and color of fur, that means, that I expect the instances of the cat class to be different in these properties, but I don't expect any of them to have milk allergy: the love of milk is common to the set, and as long as I don't have to define this class against the class of dogs for example, we don't care, and we don't model it.

What you might talk about is object nodes. An object node represents an instance of a class (not a classifier, who was that who wrote that...), which exists at a given moment of time. It's used simply to classify the message traveling between two nodes, that is, it tells you that function A returns with an object of class C, which will be an input to function B. It can also be, that both of these functions have a much more restricted interface (eg, A returns an object with interface I while B expects something with interface F, both implemented by all members of class C), it's just a note that hey, we will have an object sometime, which is an instance of class C.

It's basically a shiny label. It's like writing on a tube: "cold water": the washing machine expects cold water, the water tower provides cold water, so the condition is satisfied (well, except for some parts of London and England in general, but let's not get into that)

Now this label, this pipe is part of the system. It doesn't come from the air, it has to be defined in other parts of the system, somehow, you have to care about it, you have to create it somewhere, you have to make sure it reaches all its intended recipients, etc.

However, a phone call does come "from the air". You don't care about how it was made, how it was created, you only realize that it's a phone call and it's there. That's an event. It's from the outside world.

Therefore, there is no incoming control flow of an AcceptEventAction, (as it's basically a start sign, but there is an outgoing control flow in case control flows are modeled (it triggers the system)

I guess this is just plainly stupid:

(Image credit: Gentleware / Poseidon. Reproduced in belief of fair use)

That's because an AcceptEventAction is a start sign. It doesn't have any control reception from the system. The control is lost after the payment request, and it is regained after the confirmation comes, as anyone who has ever built a payment gateway client or an SSO gateway client knows.

I guess it could have an incoming object flow, or an outgoing object flow (that is, a parameterized event, like a caller id).

However, an object node always has an incoming object flow and an outgoing object flow (as it's inside the system, I mean, does an object appear and then gets immediately garbage collected? Then why did we create it), but no control flow (as it's just a label).

Title: UML Receptions and AcceptEventActions


问:
How have languages influenced CPU design?
We are often told that the hardware doesn't care what language a program is written in as it only sees the compiled binary code, however this is not the whole truth. For example, consider the humble Z80; its extensions to the 8080 instruction set include instructions like CPIR which is useful for scanning C-style (NULL-terminated) strings, e.g. to perform strlen(). The designers must have identified that running C programs (as opposed to Pascal, where the length of a string is in the header) was something that their design was likely to be used for. Another classic example is the Lisp Machine.

What other examples are there? E.g. instructions, number and type of registers, addressing modes, that make a particular processor favour the conventions of a particular language? I am particularly interested in revisions of the same family.

答:
The Intel 8086 instruction set includes a variation of "ret" which adds a value to the stack pointer after popping the return address.  This is useful for many Pascal implementations where the caller of a function will push arguments onto the stack before making a function call, and pop them off afterward.  If a routine would accept e.g. four bytes' worth of parameters, it could end with "RET 0004" to clean up the stack.  Absent such an instruction, such a calling convention would likely have required that code pop the return address to a register, update the stack pointer, and then jump to that register.

Interestingly, most code (including OS routines) on the original Macintosh used the Pascal calling convention despite the lack of a facilitating instruction in the 68000.  Using this calling convention saved 2-4 bytes of code at a typical call site, but required an extra 4-6 bytes of code at the return site of every function that took parameters.

ContentLicense: CC BY-SA 3.0


问:
How to implement a software development process in an existing project?
My question involves setting up a Software Development process. If you came in to an existing project that had no formal methodology or process set up, and then were asked to set one up yourself, how would you handle it? I have looked into various methodologies like Agile, or subsets thereof like XP, but these are primarily aimed at how to set up new projects. I am rather unsure how to implement them into an existing project.

Also, many of these are aimed at web or desktop applications. My software project is an embedded system, so while many aspects of them are applicable, it is a bit overwhelming trying to figure out which one to use and how to convert it for use in an embedded system. Unit testing on embedded hardware (especially with a Single Board Computer for which no simulator exists) is incredibly difficult, particularly if the software is very far along, and to add a hardware abstraction layer to aid unit testing would involve tearing up the code dramatically.

What tips would you have for setting up a Software Development Process for an existing project, for a programmer that knows how to program, but is new to software development process management?

答:
Software Development process/methodology is usually important part of a company culture and rarely changes per project. It is also strongly correlated to development methodologies that development team is comfortable/capable to practice.

One of the widely known and used methodologies is the model-based design for Embedded Systems developments. The significant feature of this model based design is that it facilitates quicker and more cost-effective development of the dynamic embedded systems. More detailed info is provided here - Embedded 360.

Another very important trend for Embedded Systems Development is to use  Agile Methodology. It is widely used by software companies to develop embedded products based on requirements sent in by the client at different points of time. Here, different iterations of the embedded products are developed based on different sets of client requirements.


答:
In my experience the software methodology is more an organization policy than a project decision. Implementing any methodology in an organization requires a level of commitment that transcends the barriers of the project team (i.e. customers, managers, project-managers, stakeholders and other decision makers).

Establishing a new order of things, in my experience, rarely works if it comes from bottom-up. It works better when you negotiate with all parties involved. Unless you have the unlimited power to decide what should be done.

If there is already a methodology in place, even if it is not a good one (meaning it is not producing good results), introducing change is always painful and there will be resistance. Here it is where you will need support and commitment from managers and decision takers in the organization.

If you want to change a methodology in place by proposing a new one, then you will need to gather evidence that demonstrate how the current methodology is preventing the organization from achieving better results and you may propose to run a pilot with a project or two to gather results that demonstrate that a new methodology could prove to be much better.

Given the fact that the status quo is evidently not working, you may consider introduce the new methodology gently, by first making changes where it matters most, those changes that will help you prove with results that the new methodology, the new order of things, is valuable.

For example, if you are not doing any kind of testing, you may consider the introduction of some of the practices of TDD and then gather statistics for a few months, and then demonstrate to managers how the bug statistics have been increasingly improving. You can show this to the team as well, so they get excited and even more compromised with the methodology. Then you can move to a second phase and most probably get better support from the rest of the organization. Eventually, the whole organization can adopt the methodology.

I think that something of paramount importance is to get project managers on board with the new methodology, they must believe in it, and believe that it will improve performance. They must enforce it in the team members, who initially may show resistance. Otherwise, the changes will lose momentum and eventually fall into disuse and people will go back to the status quo.

Ultimately, whatever methodology you choose must show to improve the performance of your organization, ideally with numbers you can show to your manager and your customers. As such, IMHO, I would introduce change little by little, improving where I see problems, not caring so much about a methodology itself, but on how to make things better.

Have you considered other less popular methodologies like Personal Software Process or Team Software Process?

Title: How to implement a software development process in an existing project?

Body:
My question involves setting up a Software Development process. If you came in to an existing project that had no formal methodology or process set up, and then were asked to set one up yourself, how would you handle it? I have looked into various methodologies like Agile, or subsets thereof like XP, but these are primarily aimed at how to set up new projects. I am rather unsure how to implement them into an existing project.

Also, many of these are aimed at web or desktop applications. My software project is an embedded system, so while many aspects of them are applicable, it is a bit overwhelming trying to figure out which one to use and how to convert it for use in an embedded system. Unit testing on embedded hardware (especially with a Single Board Computer for which no simulator exists) is incredibly difficult, particularly if the software is very far along, and to add a hardware abstraction layer to aid unit testing would involve tearing up the code dramatically.

What tips would you have for setting up a Software Development Process for an existing project, for a programmer that knows how to program, but is new to software development process management?


问:
Which mobile devices cover the widest spectrum for testing?
My company has decided to purchase a multitude of devices for browser testing our stages e.g. iPhones, Android, Windows and assorted tablets. They've tasked me with finding specific devices that cover largest common denominator of users and scenarios.

We recently had a client that had us testing 10-20 different devices; each having their own oddities.

Which android and windows phone would give us the largest spectrum of the market in terms of compatibility?

答:
Rather than a comment discussion above I'll highlight what I see as points to consider.

Consider only phones (for sake of discussion). If you want to buy ten devices, I'd buy just one iPhone, one or maybe two Windows phones (if you want to support older phones), and seven or eight Android devices. It may or may not be apparent to you, but

all iPhones have the same or almost the same hardware specification

almost all iPhones are running the same (latest) operating system

the API is well tested against the hardware - what runs on one should run on all

and

all Windows Phones have a strongly defined minimum hardware spec, including fixed resolution

there are only a couple of operating system variations, and the majority of phones are running the latest OS

the API is again well tested against the hardware, because the hardware is strictly defined.

Compare with Android

there is no hardware spec, no minimum requirement

there is no manufacturer licencing, so there are dozens of device makers using Android (cf one for iPhone, and just a handful for Windows)

there is well known operating system fragmentation; 2.3 is the most common OS in the wild but millions of people have 4.1, 4.0, 3.0, 2.3, 2.2 and so on.

screen resolution varies wildly - not just in absolute size but also in apsect ratio.

Now if you market is primarily going to be iPhone then get two iOS devices, because there are in truth two screen specs ('normal' and 'retina'). Similarly WP7 has some minor difference between 7.1 and 7.5. But if you want to cover the widest range of devices, spread yourself across Android.


问:
Can I link to a GPL library from a closed source application?
Okay, before everyone goes shouting about duplicate questions, yes, I've already seen several questions like this here. But none answer the question.

If I link against a GPL-ed library without modifying that library, do I need to release my source code?

According to this question, the answer is yes!

But this answer is not satisfactory to me. The answer basically says that I cannot use GPL code in any way without making my code open source.

But if the previous is true then that would indicate that no person or organization could ever release any proprietary software on Linux ever. Which must be wrong. Simply because in order for any application to do anything useful, open files, write to the console, create TCP connections, the application must be linked to libc which is GPL-ed.

So my question is this: If the GPL states, as all the previous answers on the site say it does, that a program which links to another GPL program must be GPL itself, how is it possible to create/release/sell any proprietary application at all which runs on Linux? Since as I described above that application must be liked to GPL code just to run on Linux.

A more practical example say I link to a shared library which is GPL-ed in a non-GPL application, would that force the non-GPL application to become GPL-ed? More specifically if I use a GPL library without modifying it, and then distribute that library as an .so or .dll, would that require my application be open source?

答:
In the general case, you are correct in that you can't link to a GPL library, distribute your code, and then not release your code as GPL.

However, there is the System Library Exception which is how folks link against Linux libs and still release their product under non-GPL licenses.

Another exception is when the two licenses are compatible with each other.  Check out the FSF compatible license page for further reading.

Finally, the authors of the GPL'd lib can create specific exceptions, such as for non-commercial or hobbyist use.

Unfortunately, there are too many potentialities to have a hard and fast rule.  Without more specifics in your question, your answer is "probably can't, but maybe you can."


问:
How should common interfaces be shared across source control repositories?
I have code that represents the interface for a library that is used by a variety of internal clients. How should that interface code be exposed to these internal clients that live in different source control repositories?

The interface should be relatively stable, but is in development (as is most of the internal clients) so keeping changes communicated is important, as is keeping breaking changes to a minimum. Normally, I would just directly reference them in the other modules but the separated nature makes that troublesome.

答:
There are multiple ways and it really depends on your library/setup.

Typically you can reference other repositories, e.g. with submodules for git or for example externals and svn. This is the simplest and probably also hackiest solution as you are directly referencing to the library and your clients would have to build them as well.

You can provide binary packages for your library, e.g. gems/eggs/debs/rpms/… and just reference it from your build process or assume it is present at runtime. This is in my opinion a quite clean approach.

Let your buildsystem handle the dependencies, e.g. rely on maven or use other tools like bundler/carton/openembedded or other similar tools for your language. They can automatically download and build your dependencies.


问:
Cpu-heavy web server
When reading about web servers, frameworks, etc most of the time I notice that the goal is to have a technology that has the next features:

Able to handle as many connections as possible.

Fit an I/O model (connections to DBs and other web services).

Those features fit the actual web model but I am interested in knowing which technologies will fit a heavy-cpu user case.

For example, Node.js is a technology that really shines when you have to write an application that uses a lot of I/O. On the other hand, due to the Node.js nature of being evented, It is not suitable for being use in CPU-heavy user cases.(video encoding, machine learning, graphics)

I also have take a look at Haskell web frameworks like Snap and Warp and at the benchmarks they really are fast.

Are they Haskell web frameworks suitable for CPU-heavy problem? Which other languages/technologies are candidates?

答:
You might want to check out Erlang It has a very easy concurrency model and will easily support very heavy loads. It also is designed so that you can build very reliable systems with relative ease. </p>

<p>Other advantages of Erlang include being able to upgrade running code without taking a system offline. So if you have a server that is streaming data to users you don't need to disconnect the users to upgrade the server. </p>

Title: Cpu-heavy web server

Body:
You might want to check out Erlang It has a very easy concurrency model and will easily support very heavy loads. It also is designed so that you can build very reliable systems with relative ease.

Other advantages of Erlang include being able to upgrade running code without taking a system offline. So if you have a server that is streaming data to users you don't need to disconnect the users to upgrade the server.


问:
Software design by pseudocoding?
Do you know a good way to design (i.e. write down) software with a method based on pseudocode?

I'm new to software design and read some information about UML. My humble class hierarchies are good so far, however, after it gets complex I notice that with "seeing the whole" picture I could have used a different structure for more future extendability. As Python is good to prototyping I'm almost fine with just starting to write, but not quite.

So I tried UML class diagrams, but they don't seem to help me much. The problems I solve there I can trivially do in my head. But I do notice additional design requirements once I start to pseudocode the actual methods.

So if you wanted to design by pseudocode, how would you do it? I believe for me a method which is roughly 1-to-1 with code works best. But most UML software doesn't even show the method's code (as opposed to pictures in e.g. GoF).

Someone claimed UML is for documentation and presentation only and not that great for design? I also get that feeling. I thought pure UML and some simplistic whiteboard sketches were the way to design software until googling I found Envision APDT.

So is agile development something I should look out for or do they randomly call that agile -  I thought agile is about schedule only? Or am I designing incorrectly (with UML) - does anyone design by pseudocode? How can I find a good tool for that?

答:
I think graphical tools are better than pseudocoding, but UML is simply so much overcomplicated that it combines the bad in those methods :-)

To be a bit more clear: I think programming is mostly a way to analyze a certain problem, separate it to smaller components and their interaction. This is "a journey, not a destination", you constantly improve your knowledge about the problem, so the graph of components is changing: layers appear and fade away, functions and data items move up and down, etc.

The natural tool to follow this process is a sketchboard, as simple as possible, but enough complex to help quick understanding (same colors, shapes, arrows for the same logical meaning). I have not found the silver bullet, and perhaps I will write my own one day, but now I use gliffy; combined with the zooming feature of prezi it would almost be perfect.

Why not pseudocoding? Pseudocoding is one step forward to implementation, a "serialized form of the component graph", when you yet shape your ideas. Not good, limits your head. In my experience I found that the later I start coding, the less code I have to throw away...

But perhaps this is because I have written all those thrown out codes, so I don't have to write them now, the experience I gained from them is with me when designing the system? Well, I have to modify the statement.

If you are lost with your graph, and see many equivalent possible solutions, do go to pseudocode, or even do write that code with mock objects - in Java, that is almost no difference. See the code, feel the structure and usability of those components, it will help you fixing your graph and make decisions. But this works ONLY if you are ready to throw away that code if you feel it is bad. I think this is the advantage of pseudocode: the less temptation for keeping it when it works, but it is wrong in structure (and as always, you don't have enough time). :-)

Title: Software design by pseudocoding?


问:
Conceptually what does it mean when it is said that each thread gets its own stack?
I have been reading Java Concurrency in Practice by Brian Goetz  and inside the section Stack Confinement it is mentioned that each thread gets its own stack and so local variables are intrinsically confined to the executing thread; they exist on the executing threads stack, which is not accessible to other threads. What does he mean that each thread has its own execution stack ?

答:
You know when you break to the debugger for whatever reason, and the IDE gives you a stack trace?  And each method (stack frame) has its own set of local variables that you can examine in the debugger?

That's the "execution stack" of your program.  It shows what the local state of your program looks like at the moment.  What the author is saying is that each thread gets its own distinct execution stack like that.  It has its own call stack, and each of the methods have their own local variables.

Because the variables are stored as part of the execution stack and not in the heap, they are unique to the thread that's being run and can't be shared directly.  You can copy them, or pass references to objects to other threads in various ways, though, so that's mostly an academic distinction.


问:
Why can't the IT industry deliver large, faultless projects quickly as in other industries?
After watching National Geographic's MegaStructures series, I was surprised how fast large projects are completed. Once the preliminary work (design, specifications, etc.) is done on paper, the realization itself of huge projects takes just a few years or sometimes a few months.

For example, Airbus A380 "formally launched on Dec. 19, 2000", and "in the Early March, 2005", the aircraft was already tested. The same goes for huge oil tankers, skyscrapers, etc.

Comparing this to the delays in the software industry, I can't help wondering why most IT projects are so slow, or more precisely, why they cannot be as fast and faultless, at the same scale, given enough people?

Projects such as the Airbus A380 present both:

Major unforeseen risks: while this is not the first aircraft built, it still pushes the limits of the technology and things which worked well for smaller airliners may not work for the larger one due to physical constraints; in the same way, new technologies are used which were not used before, because for example they were not available in 1969 when the Boeing 747 was certified.

Risks related to human resources and management in general: people quitting in the middle of the project, inability to reach a person because she's on vacation, ordinary human errors, etc.

With those risks, people still achieve projects like those large airliners in a very short period of time, and despite the delivery delays, those projects are still hugely successful and of a high quality.

When it comes to software development, the projects are hardly as large and complicated as an airliner (both technically and in terms of management), and have slightly less unforeseen risks from the real world.

Still, most IT projects are slow and late, and adding more developers to the project is not a solution (going from a team of ten developers to two thousand will sometimes make it possible to deliver the project faster, sometimes not, and sometimes will only harm the project and increase the risk of not finishing it at all).

Those which are still delivered may often contain a lot of bugs, requiring consecutive service packs and regular updates (imagine "installing updates" on every Airbus A380 twice a week to patch the bugs in the original product to prevent the aircraft from crashing).

How can such differences be explained? Is it due exclusively to the fact that the software development industry is too young to be able to manage thousands of people on a single project in order to deliver large scale, nearly faultless products very fast?

答:
Airbus A380 was not a successful project as you have mentioned. I happen to work in a CAD/CAM company, and I was told that it (we had the Airbus prioject too) was delayed by few years, because they were using different version of software in different company. That is, different parts were being designed in different part of the world. And while integrating they came to know that all the design ca'nt be integrated, so they have to redesign it in one version. So looking at it I don't think it was successful. Had it came 2-3 years before, it would have been game changer for Airbus.

Also regarding robust software, you look at any airplane, car (ABS, EPS, climate control, etc.) or space shuttle they have more than 50% software which are running them and belive me they are very robust. It's just that we are more close to software, and there are many more software programs, so we see more errors in them.

Visit: http://www.globalprojectstrategy.com/lessons/case.php?id=23
and see how much successful Airbus A380 was.

ContentLicense: CC BY-SA 4.0


答:
IBM's Z series mainframe, is the descendant of the IBM 360 from the 1960s.

There were several instructions which were put there to specifically to speed up COBOL and Fortran programs.  The classic example being the BXLE – "Branch on Index Low Or Equal" which is most of a Fortran for loop or a COBOL PERFORM VARYING x from 1 by 1 until x > n encapsulated in a single instruction.

There is also a whole family of packed decimal instructions to support fixed point decimal arithmetic common in COBOL programs.

Title: How have languages influenced CPU design?

Body:
We are often told that the hardware doesn't care what language a program is written in as it only sees the compiled binary code, however this is not the whole truth. For example, consider the humble Z80; its extensions to the 8080 instruction set include instructions like CPIR which is useful for scanning C-style (NULL-terminated) strings, e.g. to perform strlen(). The designers must have identified that running C programs (as opposed to Pascal, where the length of a string is in the header) was something that their design was likely to be used for. Another classic example is the Lisp Machine.

What other examples are there? E.g. instructions, number and type of registers, addressing modes, that make a particular processor favour the conventions of a particular language? I am particularly interested in revisions of the same family.


问:
Does Silverlight have a future?
Recently I have read some articles/blogs/comments about the development and history of WPF and Silverlight. In some forums many developers and users criticize the performance of WPF applications (for example Visual Studio 2010). Actually the market share of Silverlight in comparison to Flash is not very high. At PDC 2010 Bob Muglia said something like "our Silverlight strategy and focus going forward has shifted...." and Microsoft wants to push HTML5 in the future.

Additionally, Microsoft has announced HTML5 being a core part of the Windows 8 and Windows Phone 8 ("Mango") platforms.

Recently I have started learning Silverlight and now I must ask myself, if I should continue investing time in learning these (in my opinions) very nice and powerful technologies!? Does they have a future? Does (Windows) desktop (client) applications have a future? Does so called "Rich Internet Applications" have a future? Or will HTML5 become the "absolute truth" in software development?

What is your opinion and what do you think?

答: Silverlight for use on the web has never really taken off - however, Microsoft is pushing hard on Windows Phone 7, which uses WPF/Silverlight for apps, so Silverlight itself is not being killed off, its just the focus of where it's deployed which is changing.

Title: Does Silverlight have a future?

ContentLicense: CC BY-SA 2.5


问:
Emotional attachment to code
As an employee of a company, when you write code do you feel like you have an attachment to it? Do you feel that you have some ownership of the code? Or do you write it completely detached from it without any concern about what happens to it after you've moved onto something else?

EDIT: I'm not talking about writing bad code and then running...

答:
Contractors and consultants who might never see their code again are probably not the ideal candidate to get emotionally attached to their code. Having to "abandon" it over and over would probably cripple the poor consultants creative drive after a while.

If we look at it from the perspective of an employee and not a contractor I would say that I would like all of my team members to feel ownership in the code they write and in everything the create. This ownership and pride should extend to the entire team. Feeling pride and ownership creates an attachment to the product in questions and adds meaning and sense into the work of a team member. I have seen this boost the performance greatly in small to large teams.

What should be avoided and what I dislike is people who seem emotionally attached to the specific lines of code they have written and defends it to the grave. They don't want changes made, they look down and turn down any idea for change or improvement and try to justify it with something that sounds credible.
What this often boils down to, from my own experience, is the fear of change and fear of the unknown. It's not actually giving up their old lines of code that's the issue. Instead it's having to take on something new, sometimes not written by yourself, and the fear of failing at it.

This kind of "sick" attachment to code is something I work hard to try to prevent. But "healthy" emotional connections to the product, and by extension the written code, is something I encourage.

Title: Emotional attachment to code


问:
Storing plaintext passwords for detecting fraud
I am well aware of best practices for storing user passwords:

Never store passwords in plaintext

Never store encrypted passwords; always store password hashes

Always salt your password hash to deter brute force attacks

Always use unique salts to deter attacks using rainbow tables.

However, I have recently came upon on a potentially legitimate use case for keeping plaintext (or plaintext-accessible encrypted) user passwords: fraud detection. For example, if we have a system that needs to restrict purchases to 1 (or a small number) per person, we have observed that fraudsters often use the same password over and over, so if we have detected fraudulent purchases on one account, we can use the fact that password matches as a useful signal in a fraud detection system.

But implementing such a system requires breaking all the best practices for password storage.

Question: If it is determined that the fraud-detection ability of being to retrieve passwords is necessary, what are the best practices for storing passwords securely but in a way that is plaintext-accessible?

答:
Making the passwords accesible in plaintext in one way or another is already a HUGE security flaw. This is one of the most important security components on any site anywhere. I believe you already know that.

My recommendation is to find another way to deal with those frauds. Exposing user passwords like that is just not worth it. You win a little and lose a lot. If you do it, you'll regret it later.

EDIT: I guess it depends a lot on what people can purchase on that site. You can check against the same passwords, the same IP, the same browser etc. but if someone wants to make 2 or more purchases, they can. If the goods we're talking about are actual objects, then in my opinion the best way to detect such "frauds" are by comparing shipping addresses. Someone may use a different account/password/browser (that is easy), but they will rarely change their address to accomplish something like this.


答:
In this case you could, upon registration, generate a hash of the entered password for every salt used so far, then check these salted and hashed passwords against all the passwords already stored.

You could even cache all the salts used so far, this is potentially a smaller list than having to loop through all passwords every time to collect these.

If that is too expensive to compute on each registration, limit the number of salts you generate (pick randomly from a limited list) to reduce calculation time. That'll still be safer (by far) than storing plain text passwords.

Note that if this is just for the sake of fraud detection, a security breach and resulting (huge) negative publicity is going to cost you much more, wiping out any advantages you gained from catching a few fraudsters this way.

Title: Storing plaintext passwords for detecting fraud

Body:
I am well aware of best practices for storing user passwords:

Never store passwords in plaintext

Never store encrypted passwords; always store password hashes

Always salt your password hash to deter brute force attacks

Always use unique salts to deter attacks using rainbow tables.

However, I have recently came upon on a potentially legitimate use case for keeping plaintext (or plaintext-accessible encrypted) user passwords: fraud detection. For example, if we have a system that needs to restrict purchases to 1 (or a small number) per person, we have observed that fraudsters often use the same password over and over, so if we have detected fraudulent purchases on one account, we can use the fact that password matches as a useful signal in a fraud detection system.

But implementing such a system requires breaking all the best practices for password storage.

Question: If it is determined that the fraud-detection ability of being to retrieve passwords is necessary, what are the best practices for storing passwords securely but in a way that is plaintext-accessible?


答:
Is the risk of the bad PR if your passwords leak worth it for the slight fraud-fighting gain you get? Personally, I wouldn't.

If you really have to
"have a system that needs to restrict purchases to 1 (or a small number) per person"
(which sounds an impossible task) is there not something else you can use?

Same IP address?

Same browser?


答:
If I understand you correctly you intend to use this information only internally within your organization to detect possible fraud?

Now I don't know if you encrypt and salt the password on the client side using JavaScript or something similar before sending it to the server. But if not, then you could store unencrypted password at another db server in an isolated network not accessible from outside and run the checks on that?

Regarding checking for IP and browser I would guess that most people doing these types of fraud work through different proxies to change their ip around and use incognito features to "hide" their browser.

Update:
Some people here seem to miss the fact that a question was raised. It has nothing to do with our own personal believes of password treatment and best security practices.

If one agrees to what the person asking the question wants to do or not is not the point. The question was plain and simple:

Question: If it is determined that the fraud-detection ability of being to retrieve passwords is necessary, what are the best practices for storing passwords securely but in a way that is plaintext-accessible?

He doesn't ask IF it's 100% secure. He asks for practices of making it as secure as it can be.

Yes, it will most likely suck and be impossible to protect with a 100% success rate. But IF IT HAS TO BE DONE, how could he do it as secure as possible. There will ALWAYS be a way around anything not encrypted with a, as of yet, unbroken hash algorithm. It might be more or less dramatic and might require some C4 to get into a server room 100m bellow the surface and kill 10 armed guards hardwired to a system that kills them if they even try to leave the room (so that they themselves can't steal the information and leave).

But it's still not the point of the question. He wants to know how to store PLAIN TEXT passwords as securely as possible. From whom isn't very specified and if he is the only one handling this system (and we assume he can trust himself) the only ones he has to protect the data from are outside parties. If not, then internal parties will also have to be taken into account.

Does it suck to store sensitive data as plaintext? HELL YES! Does the person asking the question deserve to know that? Yes!

Do we answer his question by only stating that? NO!


问:
Do you start migrating your Swing project to JavaFX
I have a 4 years old project which is written in Swing + SwingX. Currently, it is still alive and still kicking.

However, as more GUI related feature requests coming in (For instance, a sortable tree table), I start to feel the difficulty in fulling the requests. This is true especially since there isn't any active development going around SwingX project.

Also, I can hardly find any good, yet actively maintained/ developed/ evolving GUI Java framework.

I was wondering, do any of the Swing developers feel the same thing? Have you start to migrate your Swing project to a much more active developed GUI framework, like JavaFX?

答:
While the new JavaFX versions look very impressive, I doubt it is worth doing a full migration unless you are willing to invest a lot of time / effort / money in a complete overhaul of the GUI.

Swing may have its quirks and is showing its age but also it has some advantages:

Very strong cross-platform capability, currently much better than JavaFX

It's mature and proven, much more so than JavaFX

It has a large user community / library ecosystem

You probably already have lots of Swing skills or can hire people easily with them

Ultimately, if it isn't broken, why fix it?

Of course, for a new project I would be looking very seriously at JavaFX, Android and/or a web-based GUI (perhaps with something like Vaadin).


问:
How to search for information related to Go programming language?
If there's something that would kill Go language, then it's name.

I find it very hard to find anything in web related just by using "Go" in the query. The word is on of the most frequent in English. So I see everything in the result except Go-related stuff. Even Google, who sponsors the language and famous for tracking anything I search, can not track I'm a programmer so interested in the programming language and not English grammar.

How to search for information related to the programming language itself, excluding the results related to English grammar?

Imagine for example a blog post where someone mentions his observation about Go. He probably won't use the easy-to-search sentence like "go programming language", maybe something "there's one thing I like about Go".

答:
I find reasonable results with the search term "google go".

Not sure if there are third party and forum sites that that misses, but it seems to get the main stuff.


答:
The Motorola 68000 family introduced some autoincrement adressmode that made copying data through the cpu very efficient and compact.

[Updated example]

this was some c++ code that influenced 68000 assembler

```<code>while(someCondition)
    destination[destinationOffset++] = source[sourceOffset++]
</code>```

implemented in conventional assembler (pseudocode, I forgot the 68000 assembler commands)

```<code>adressRegister1 = source
adressRegister2 = destination
while(someCondition) {
    move akku,(adressRegister1)
    move (adressRegister2), akku
    increment(adressRegister1, 1)
    increment(adressRegister2, 1)
}
</code>```

with the new adressmode it became something simmilar to

```<code>adressRegister1 = source
adressRegister2 = destination
while(someCondition) {
    move akku,(adressRegister1++)
    move (adressRegister2++), akku
}
</code>```

only two instructions per loop instead of 4.

Body:
The Motorola 68000 family introduced some autoincrement adressmode that made copying data through the cpu very efficient and compact.

[Updated example]

this was some c++ code that influenced 68000 assembler

while(someCondition)
    destination[destinationOffset++] = source[sourceOffset++]

implemented in conventional assembler (pseudocode, I forgot the 68000 assembler commands)

adressRegister1 = source
adressRegister2 = destination
while(someCondition) {
    move akku,(adressRegister1)
    move (adressRegister2), akku
    increment(adressRegister1, 1)
    increment(adressRegister2, 1)
}

with the new adressmode it became something simmilar to

adressRegister1 = source
adressRegister2 = destination
while(someCondition) {
    move akku,(adressRegister1++)
    move (adressRegister2++), akku
}

only two instructions per loop instead of 4.


问:
Any reasons not to use multiple version control systems?
I'm working on a project which uses GIT as the main version control system for trunk, the official branches and most sub-projects/unofficial branches. As such, I want to make my own branch use GIT to allow the rest of the community to access my branch using the system they know.

However, I'm working on a part of the project which overlaps both official and unofficial branches, along with some patches which will never enter trunk - as such, I need to be able to keep my patches separate, allowing all to be used in my branch and selective patches to be taken for use in trunk. This naturally leans towards using mercurial queues.

Is there any reason that I can't use mercurial for my own local repository, but push the entirety to both GIT and Mercurial hosted repositories? Or rather, is there any good reason not to, I'm sure it's possible.

答: You shouldn't do this for the same reason you shouldn't have a variable which tries to track the state of another - you might lose track of which version is authoritative.</p>


答: I find that "go language" seems to give fairly accurate results. If there is a specific topic tacking that onto the end should work fine.</p>

Title: How to search for information related to Go programming language?

Body:
If there's something that would kill Go language, then it's name.

I find it very hard to find anything in web related just by using "Go" in the query. The word is on of the most frequent in English. So I see everything in the result except Go-related stuff. Even Google, who sponsors the language and famous for tracking anything I search, can not track I'm a programmer so interested in the programming language and not English grammar.

How to search for information related to the programming language itself, excluding the results related to English grammar?

Imagine for example a blog post where someone mentions his observation about Go. He probably won't use the easy-to-search sentence like "go programming language", maybe something "there's one thing I like about Go".


答: The existing answers focus on ISA changes. There are other hardware changes, too. For instance, C++ commonly uses vtables for virtual calls. Starting with the Pentium M, Intel has an "indirect branch predictor" component which accelerates virtual function calls.</p>


答: I currently do this using git and svn. While there are reasons not to do it, there is no general rule. Git can do things svn cannot, I am used to those features so my workflow hence productivity increases when I can use git. Looking at the pros and cons in my situation, I would be stupid not to use both. You should look at your situation the same way. (btw the only cons for me are having to run a single tiny script to sync git with svn)

Title: Any reasons not to use multiple version control systems?

Body:
I'm working on a project which uses GIT as the main version control system for trunk, the official branches and most sub-projects/unofficial branches. As such, I want to make my own branch use GIT to allow the rest of the community to access my branch using the system they know.

However, I'm working on a part of the project which overlaps both official and unofficial branches, along with some patches which will never enter trunk - as such, I need to be able to keep my patches separate, allowing all to be used in my branch and selective patches to be taken for use in trunk. This naturally leans towards using mercurial queues.

Is there any reason that I can't use mercurial for my own local repository, but push the entirety to both GIT and Mercurial hosted repositories? Or rather, is there any good reason not to, I'm sure it's possible.


问:
What are the practical ways to implement the SRP?
Simply what are the practical techniques people use to check if a class violates the single responsibility principle?

I know that a class should have only one reason to change, but that sentence is somewhat lacking a practical way to really implement that.

The only way I found is to use the sentence "The ......... should ......... itself." where the first space is the class name and the later is the method (responsibility) name.

However, sometimes it's hard to figure out if a responsibility really violates the SRP.

Are there more ways to check for the SRP?

Note:

The question is not about what the SRP means, but rather a practical methodology or a series of steps to check and implement the SRP.

UPDATE

I have added a sample class that clearly violates the SRP. It would be great if people could use it as an example to explain how they approach the single responsibility principle.

The example is from here.

答:
Here's a quote from rule 8 of Object Calisthenics:

Most classes should simply be responsible for handling a single state
  variable, but there are a few that will require two. Adding a new
  instance variable to a class immediately decreases the cohesion of
  that class. In general, while programming under these rules, you’ll
  find that there are two kinds of classes, those that maintain the
  state of a single instance variable, and those that coordinate two
  separate variables. In general, don’t mix the two kinds of
  responsibilities

Given this (somewhat idealistc) view, you could say that any class which contains only one or two state variables is unlikely to violate SRP. You could also say that any class which contains more than two state variables may violate SRP.


答:
What you're asking for is typical of an n-tier architecture.

You want a web tier that is designed for IO, that's its primary task. When it needs to perform some heavy processing then you need to farm that out to another tier that is designed for CPU crunching.

A lot of websites do this (at least the really big ones), they have a farm of web servers spreading the IO load, but these are there solely for presentation work - handing back static files and taking in requests. When a request for work comes in, the web server passes the request to an application tier, where app servers crunch the data and pass the results back to the webserver to return to the user.

The benefits are in scalability - you can add a new app server anytime you like if you have more cpu crunching to do, similarly, if the amount of IO requests gets too much, you can add a new web server.

What you must not do is think of a web server as an applications server. Whilst it can perform that role in a small application, that's only there as a convenience.

So node.js can perform the task you want, you just need to send any CPU-heavy work off somewhere. It's easy to send requests (on an async method!) to another service or process. As node runs on a single thread, that means you have several others on the same box available, assuming you've not filled them with DB work (which is a CPU-heavy task itself).

Title: Cpu-heavy web server

Body:
When reading about web servers, frameworks, etc most of the time I notice that the goal is to have a technology that has the next features:

Able to handle as many connections as possible.

Fit an I/O model (connections to DBs and other web services).

Those features fit the actual web model but I am interested in knowing which technologies will fit a heavy-cpu user case.

For example, Node.js is a technology that really shines when you have to write an application that uses a lot of I/O. On the other hand, due to the Node.js nature of being evented, It is not suitable for being use in CPU-heavy user cases.(video encoding, machine learning, graphics)

I also have take a look at Haskell web frameworks like Snap and Warp and at the benchmarks they really are fast.

Are they Haskell web frameworks suitable for CPU-heavy problem? Which other languages/technologies are candidates?


答:
Any asynchronous web server (Node.js being one of them) can be easily adapted for heavy CPU lifting. Question is, that the CPU intensive task should be spawned independently of the main server (separate thread, separate process, thread or process pool or better yet completely decoupled service). Asynchronous servers can easily poll numerous running task, without creating much overhead. </p>

<p>On the other hand, what would be very bad idea, is to execute CPU heavy tasks within the web server itself. A practice not unheard of in Apache+PHP setups, but that's far from being good practice. It's also neither efficient nor scalable. </p>

Title: Cpu-heavy web server

Body:
Any asynchronous web server (Node.js being one of them) can be easily adapted for heavy CPU lifting. Question is, that the CPU intensive task should be spawned independently of the main server (separate thread, separate process, thread or process pool or better yet completely decoupled service). Asynchronous servers can easily poll numerous running task, without creating much overhead.

On the other hand, what would be very bad idea, is to execute CPU heavy tasks within the web server itself. A practice not unheard of in Apache+PHP setups, but that's far from being good practice. It's also neither efficient nor scalable.


问:
How is Sencha Touch performing on Android in practice?
I'm just about to start a project using Sencha Touch, and just done some minor testing on my HTC desire device. All tutorial videos at Vimeo seems to be using an iPhone emulator running on a Mac. Im not sure how fast this emulator is compared to a real iPhone device or even an real Android device, but from what i have experienced, it seems that my HTC desire is not performing that nicly as this emulator.

All animations (sliding, fading, etc) seems abit laggy. You can easily notice that the FPS is much less than on the Vimeo videos.

HTC desire is a relativly new and modern Android 2.2 phone, running with decent hardware, so im wondering if Sencha Touch is "ready" for the Android platform.

Anybody with practical experience with Android and Sencha Touch ?

答:
I know this is an older question, however, I can confirm that we are also having performance issues running Sencha Touch 2.0 on Android. We've built a quite simple prototype with very simple card layouts and no custom images or css at all and still noticed a big amount of lag on every Android device we tested. At first, we thought we were violating some Sencha best practices, however after looking through the code and revising every area where we thought could be causing issues, we still could not get the responsiveness and smoothness anywhere near what we had hoped for.

On more of a side note, it seems that in general any non native method (esp JS/HTML/CSS based) for developing a mobile app will always have at least some small issues with performance. We are now considering using Titanium since it offers a single code base solution with performance much closer to native (since it technically is native).


问:
Coincidence or rule?
I was reading about Assemblies (modules, which Microsoft CLR works with). The Assembly contains so called Manifest, which by definition describes a set of files in the Assembly.

I know that Android applications also contain a file called Manifest, which also describes a set of files contained in the application.

Is this simply a coincidence? Or are there some commonly accepted rules in software development to name "special" files?

答:
So you can mark this one as answered, these three comments accurately summarize things:

Baqueta's comment:

```
I'm pretty sure the terminology comes from the term shipping manifest, which wikipedia
describes as: "Manifest, a document listing the cargo, passengers, and crew of a ship,
aircraft, or vehicle, for the use of customs and other officials."
```

Joachim Sauer's comment:

```
As far as I know Java was the first one to call it "manifest" (at least of the three
that where mentioned). And since it's a fitting name (similar to a shipping manifest,
it describes the content of a package), others just used the same term for similar files.
```

MattDavey's comment:

```
It's neither a coincidence nor a rule, just a good descriptive word to capture a concept.
It's the same reason words like 'factory', 'facade', 'token', 'agent' are ubiquitous in
software development.
```

Title: Coincidence or rule?

Body:
So you can mark this one as answered, these three comments accurately summarize things:

Baqueta's comment:

I'm pretty sure the terminology comes from the term shipping manifest, which wikipedia
describes as: "Manifest, a document listing the cargo, passengers, and crew of a ship,
aircraft, or vehicle, for the use of customs and other officials."

Joachim Sauer's comment:

As far as I know Java was the first one to call it "manifest" (at least of the three
that where mentioned). And since it's a fitting name (similar to a shipping manifest,
it describes the content of a package), others just used the same term for similar files.

MattDavey's comment:

It's neither a coincidence nor a rule, just a good descriptive word to capture a concept.
It's the same reason words like 'factory', 'facade', 'token', 'agent' are ubiquitous in
software development.


答: One can also use "golang" as a search term. It works fine to catch the content from the Go mailing lists.</p>


问:
Should java developers know about garbage collection algorithms?
I have been recently asked in an interview if I know about any garbage collection algorithms.

I knew what garbage collection is but I never really thought about learning about garbage collection algorithms since as a developer I never had to worry about it and the Garbage collector does all the hard work for me.

Do you guys think that Java developers should know about garbage collector algorithms? If yes can you tell me which ones should I look into?

答:
I think knowing garbage collection algorithms isn't important at all if you develop "standard software" and not software platforms. You should have a basic understanding of how a garbage collector works and that's about it. Unless you experience critical delays in your software caused by garbage collection or you need to optimize memory usage.

If you're interested in those algorithms, please see this post of mine: What are the algorithms behind low pause GC?


答:
I see two reasons why one should know how garbage collector (or any algorithm/technology) works. Here they are:

 1. You get a better knowledge of what is going on beneath the code you write. This can often help you write more efficient code, which will guarantee better performance. In some cases this can be vital. (I've had an unpleasant experience when GWT was relying on browser's garbage collector, and we had a huge memory leak with Chrome. So we had to see what exactly caused the leak.)

 2. Such algorithms are always (or almost always, no, always) trusted to smart, skilled, qualified and experienced developers. So studying their approach can be very useful.

I see another reason why you were asked such question at interview. Some developers (my ex-colleague particularly) think that a developer isn't smart or hard-working enough, if he/she doesn't know such things. I disagree with this statement. But anyway, knowing such things is aften a good way to impress your interviewer.

Title: Should java developers know about garbage collection algorithms?

Body:
I have been recently asked in an interview if I know about any garbage collection algorithms.

I knew what garbage collection is but I never really thought about learning about garbage collection algorithms since as a developer I never had to worry about it and the Garbage collector does all the hard work for me.

Do you guys think that Java developers should know about garbage collector algorithms? If yes can you tell me which ones should I look into?


答: You should know about generational garbage collection, and the specifics about Java garbage collection (the PermGen, Eden and Tenured spaces).  You should also be familiar with garbage collection in general (like why reference counting is usually a bad idea, and why mark-and-sweep is better).  I'd also recommend reading up on some alternate implementations (like the "pauseless" GC in Azul's Zing JVM and IBM's real-time Metronome project).</p>


问:
EE vs Computer Science: Effect on Developers' Approaches, Styles?
Are there any systematic differences between software developers (sw engineers, architect, whatever job title) with an electronics or other engineering background, compared to those who entered the profession through computer science?

By electronics background, I mean an EE degree, or a self-taught electronics tinkerer, other types of engineers and experimental physicists.

I'm wondering if coming into the software-making professions from a strong knowledge of flip flops, tristate buffers, clock edge rise times and so forth, usually leads to a distinct approach to problems, mindsets, or superior skills at certain specialties and lack of skills at others, when compared to the computer science types who are full of concepts like abstract data types, object orientation, database normalization, who speak of "closures" in programming languages - things that make little sense to the soldering iron crowd until they learn enough programming.

The real world, I'm sure, offers a wild range of individual exceptions, but for the most part, can you say there are overall differences?   Would these have hiring implications e.g. (to make up something) "never hire an electron wrangler to do database design"?   Could knowing about any differences help job seekers find something appropriate more effectively?   Or provide enlightenment or some practical advice for those who find themselves misfits in a particular job role?

(Btw, I've never taken any computer science classes; my impression of exactly what they cover is fuzzy.   I'm an electronics/physics/art type, myself.)

答:
I doubt you'd see much difference in the usual sort of business or web apps that most people end up working on, once both have a few years of experience under their belts. All the things you list as confusing to the "soldering iron crowd" are normal programming skills. In essence you're answering your own question - someone without a programming background can learn programming, but until they do they're not a programmer. Someone with a logical and analytical mind will find it much easier to learn to program well than someone who does not - that would be the only advantage I can think for a self-taught electronics tinkerer.

Computer Science (as opposed to Computer Engineering) is predominently maths, as (at the higher levels) are the various other sciences such as physics - but it's a very different sort of maths. If you've done a different science then you will also have done maths and so should find it possible to get up to speed unlike someone who has no maths background. Of course, very few programmers ever really need to know about set theory, big-O, or whatever else - certainly not at a high level anyway.


答:
I find class diagrams to be barely worth the effort, even when you skip listing all the methods and simply show the inheritance hierarchy.  Sequence diagrams are good, but feel awkward when I'm drawing them (probably just me).

I find data flow diagrams and structure charts to be more useful (although structure charts are commonly associated with BDUF and are therefore out of favor at the moment).  DFDs are especially useful for functional decomposition.  Each "bubble" in a DFD can be broken down into its own DFD until you get to whatever level of detail you want.

Title: Software design by pseudocoding?

Body:
Do you know a good way to design (i.e. write down) software with a method based on pseudocode?

I'm new to software design and read some information about UML. My humble class hierarchies are good so far, however, after it gets complex I notice that with "seeing the whole" picture I could have used a different structure for more future extendability. As Python is good to prototyping I'm almost fine with just starting to write, but not quite.

So I tried UML class diagrams, but they don't seem to help me much. The problems I solve there I can trivially do in my head. But I do notice additional design requirements once I start to pseudocode the actual methods.

So if you wanted to design by pseudocode, how would you do it? I believe for me a method which is roughly 1-to-1 with code works best. But most UML software doesn't even show the method's code (as opposed to pictures in e.g. GoF).

Someone claimed UML is for documentation and presentation only and not that great for design? I also get that feeling. I thought pure UML and some simplistic whiteboard sketches were the way to design software until googling I found Envision APDT.

So is agile development something I should look out for or do they randomly call that agile -  I thought agile is about schedule only? Or am I designing incorrectly (with UML) - does anyone design by pseudocode? How can I find a good tool for that?


问:
How to implement a software development process in an existing project?
My question involves setting up a Software Development process. If you came in to an existing project that had no formal methodology or process set up, and then were asked to set one up yourself, how would you handle it? I have looked into various methodologies like Agile, or subsets thereof like XP, but these are primarily aimed at how to set up new projects. I am rather unsure how to implement them into an existing project.

Also, many of these are aimed at web or desktop applications. My software project is an embedded system, so while many aspects of them are applicable, it is a bit overwhelming trying to figure out which one to use and how to convert it for use in an embedded system. Unit testing on embedded hardware (especially with a Single Board Computer for which no simulator exists) is incredibly difficult, particularly if the software is very far along, and to add a hardware abstraction layer to aid unit testing would involve tearing up the code dramatically.

What tips would you have for setting up a Software Development Process for an existing project, for a programmer that knows how to program, but is new to software development process management?

答:
I think eventually, you'll want to create or acquire a simulator that will allow you to test your code in shorter cycles than you say you are currently able to do.  In the meantime, look at other best practices and start incorporating them in a serious, standardized way,

Fist and foremost, you can certainly institute regular code reviews.  Code reviews, done well, will prevent more bugs than just about anything else you can do.  http://www.amazon.com/Peer-Reviews-Software-Practical-Guide/dp/0201734850/ref=sr_1_1?ie=UTF8&qid=1343746666&sr=8-1&keywords=code+reviews is a great reference for doing this.

Second, work closely with your QA group--make sure the developers know the tests they are coding against.

Third, simply take the principles of the Agile Manifesto to heart--do what you can do to focus on working software and simple communication throughout the project.  Get people talking constructively about what is wrong and what can be done better NOW.  Then do it.

I'd also recommend Alistair Cockburn's http://www.amazon.com/Agile-Software-Development-Cooperative-Game/dp/0321482751/ref=sr_1_7?s=books&ie=UTF8&qid=1343746954&sr=1-7&keywords=agile+software+development for suggestions on how to build a methodology appropriate to your environment.


答:
Garbage collection is an interesting, non-trivial computer science problem.

Knowing and understanding an algorithm for it is an indication that you have a pretty deep interest and understanding of these algorithms.  Even if you haven't studied Java's GC algorithm, it would impress me if someone would be able to give a reasonable description of what data structures and algorithms would be used.

In terms of as a Java programmer, it would be good if a developer could describe the advantages and disadvantages of GC, which would include a bit of knowledge about how it's implemented.  This would indicate having an interest in how the tools you use work rather than just passively using them.  Knowing the costs would also help you to program in a way that minimizes the costs.

I wouldn't say this is "required knowledge" to make a living as a Java developer, but a plus skill that shows you're able and willing to go a little deeper than what you need to know to get today's job done.


问:
Why should I push if I'm working alone in a local repository?
I'm interacting with Git through GitHub for Windows, which is funny since I'll never push my repository to GitHub. I'm working on it alone and it's intended to be used only by me. I noticed that my commits are listed under "unsynced commits" and under "history" it says "no commits". Which brings me to the question, what will I achieve by pushing except my commits listed under "history"?</p>

答:
You are technically correct -- no real need to push if you aren't sharing the code with anyone.

Then again, your laptop has a hard drive made by the lowest bidder. Your house could burn down before the hard drive fails. You might want to look at your code remotely. Or even share it with someone.

Now, with Github, they require everything be public or you need to pay for private repositories. So if you want to keep it to yourself, you might want to check out bitbucket which will let you do git but also features free private repos.

Another option would be to save your git repository somewhere that is backed up remotely. But there are few advantages doing this rather than just using a cloud SCM provider these days.


答:
As a distributed SCM, git distinguishes between the concepts 'make a snapshot of the working copy' (commit) and 'sync repositories' (push / pull / fetch).

If you only ever have one local clone of your repository, then it doesn't make sense to push. However, with github, you do have another clone (the one on github), and pushing your changes there has at least one advantage: backup. If your computer dies, you still have everything pushed so far on github.

Of course, that's not github's primary purpose; github is intended for sharing code, so if your project is on github, you can allow others to pull from there, clone your project, act on pull requests from their clones, or even give trusted others push access to your repository.

Another reason to push is if you use several local clones. This can be useful for various things: for example, you may want to work on two different branches at the same time, or you may want to try out possibly destructive operations on your repository; if all works as intended, you keep the modified clone (or push your changes back to the original repo), but if things go south, you can just delete the messed up clone and go back to the original one (which is still unchanged).

Some people even use git for deployment: the production version is also a git repo, and updating to a newer version is a matter of fetch and checkout (obviously, this only works if you don't need a build step). I wouldn't necessarily recommend it for serious stuff, but for small things it is a simple and pragmatic solution.

Title: Why should I push if I'm working alone in a local repository?

Body: I'm interacting with Git through GitHub for Windows, which is funny since I'll never push my repository to GitHub. I'm working on it alone and it's intended to be used only by me. I noticed that my commits are listed under "unsynced commits" and under "history" it says "no commits". Which brings me to the question, what will I achieve by pushing except my commits listed under "history"?</p>


答:
Hell yes, I once beat up a coworker because he was arrogant enough to rename a couple of variables.

No, not really. I get paid for software development. Even though I do admit, seeing bugfixes done to my code by other devs has an impact on -the ego-.

Title: Emotional attachment to code

Body:
As an employee of a company, when you write code do you feel like you have an attachment to it? Do you feel that you have some ownership of the code? Or do you write it completely detached from it without any concern about what happens to it after you've moved onto something else?

EDIT: I'm not talking about writing bad code and then running...


问:
How to structure a development team
I am the manager of a team of 11 software developers who look after my company's web sites / web applications, running up to 4 concurrent projects plus day-to-day support at any time. Within the 11 developers there is a mixture of technical skills, job titles and experience, although the team structure is flat with all 11 developers reporting directly to me.

The whole team having a single manager is starting to prove not to scale very well. I am starting to be spread too thinly so want to reduce my number of direct reports. All the ways I can think to do this have significant downsides:

Have junior developers report to senior ones. This reduces the time spent on development by the best technicians.

Split the team by software product, e.g. developers 1-6 work on intranet and 7-11 work on external sites, with each section having new team lead (possibly a new job description with more management / mentoring / coaching responsibility than the current senior developers). This adds artificial silos and might make it difficult to get an "intranet developer" to work on an external website if I want them to.

Keep the structure flat and add managerial support in the shape of Project Managers / Team Administrators just to take the pressure off. This doesn't solve the problem as the team can't go on growing like this forever.

Is there a standard way of solving this problem which I am missing?

If not, how have others of you solved this problem?

答:
Is there a standard way of solving this problem which I am missing?

Not really. It will depend on your team, you, what you need to get done, and what resources the company will make available to you.

Personally, the best sort of switch is by splitting the technical management from the administrative management. It's rare that people are good at both, and they rarely tend to interact.

One person handles the technical aspects. What needs to be done, who is going to do it, how things need to line up. The other handles administrative aspects. Reviews, budget meetings, product planning, etc. They then work together to communicate insights from one side to the other and to provide a united front.

How this is broken up can go a few different ways. The most common is to have the engineering manager be the administrative side and an achitect be the technical side. They are peers and report to a director/VP.

Another I've seen work is to have the engineering manager be the administrative person, and then the team lead(s) act as the technical person. This is trickier, and requires the right people to act as (mostly) peers even if the reporting is hierarchial.

For your specific scenario, I would recommend having 2-3 teams and have technical leads do the technical aspects and you focus on the administrative. Yes, it cuts time from the leads actually writing code, but they should (if they're doing a good job) recoup that time by making the more junior developers more efficient/productive. It provides them more motivation and a sense of accomplishment with the actual promotion too. And most practically, it's an easier sell to management than opening a new position.

Title: How to structure a development team


问:
Recommended methodology for working with shared libraries and Mercurial
I work in a small team of developers who all collaborate on several Zend PHP projects.  We are using Mercurial with a collection of upstream repositories, as well as Jenkins for centralized testing and health reports.  We want to implement a shared library of common classes, but are struggling with finding a workflow that works well with our current environment.

Currently, each project contains a structure like this:

- application        (project specific code)
- build              (temporary files generated by each build)
- library            (code used by multiple projects)
    - OurLibrary     (our company’s shared codebase)
    - Zend           (external libraries)
- tests              (test code specific to this project)
```

The library folder is excluded from testing, and so we have created a project specifically for running unit tests against the shared library.  This decision was made primarily to avoid deploying the test classes by accident, something which can largely be mitigated by a modification to the automated build process, but also because we felt that it was preferable to keep the library lightweight.

We are including the library in each project as a Mercurial sub-repo.  This means that changes pushed into the library from a developer working on ProjectA wil not automatically propagate to ProjectB (good) but will also not propagate to the library testing project (bad), and Jenkins will therefore not automatically warn us of potentially breaking code in the library (very bad).

An ideal situation would be that developers can commit changes to the library from any project, and that our automated tools would then run the latest library tests against the latest library code. Furthermore, this should not result in a version conflict when a developer pulls a new version of the library tests.

Is there an established methodology for this kind of workflow, or should we look into structuring our working practises a little differently before we fully commit ourselves to sub-repos?

答:
If it were me I'd just set up the 'OurLibrary' project like any other. i.e. As a single project which includes tests.

I don't see how exposing a project's tests to other projects would ever be problematic: since tests are part of your documentation, I'd actually argue that it would be a good thing!

If that really isn't possible for some reason, another option to consider is to have projects use a compiled version of 'OurLibrary'. This has some drawbacks of its own though - e.g. having to manage the compiled version of the library; being unable to edit the 'OurLibrary' code project directly from other projects; etc.


答:
This is an interesting question and I agree with one of the postings above: Yes and No - but for different reasons.

Do I grow attached to the code? Definitely yes. But I don't think it's the code itself but the overall architecture and application. Usually you have to do a lot of domain specific research before you can really put into code what the business people want (unless you're writing an IDE - then you're definitely stuck in recursion).

On the other hand: There are not many things I like more than throwing away obsolete parts of the codebase. No matter how difficult the writing may have been. The journey matters a lot more than the product (at least for the ego, of course the product itself has to work as well).

Is there a sense of ownership? Well it depends on the project situation. When you'll never see the code again (because your part in the project is over and you're moving on) then why get romantic about the stuff? However if you keep supporting it (in whatever way) then a feel of attachment is a good thing! When you care about the product you're building then chances are quite high you're trying hart to deliver high quality artifacts.

So all in all I try to adopt a pragmatic "relationship" with the code I write.

Title: Emotional attachment to code


问:
Worst coding standard you've ever had to follow?
Have you ever had to work to coding standards that:

Greatly decreased your productivity?

Were originally included for good reasons but were kept long after the original concern became irrelevant?

Were in a list so long that it was impossible to remember them all?

Made you think the author was just trying to leave their mark rather than encouraging good coding practice?

You had no idea why they were included?

If so, what is your least favorite rule and why?

Some examples here

答: Like a lot of programmers (but not enough), I hate code decoration. It infuriates me when I have to use a dollar sign($) prefix for variable names, or underscores for private variables, even with no getters/setters. If you need to decorate you code to understand it, then you need to get the hell out!</p>


问:
Learn programming backwards, or "so I failed the FizzBuzz test. Now what?"

A Little Background

I'm 28 today, and I've never had any formal training in software development, but I do have two higher education degrees equivalent to a B.A in Public Relations and an Executive MBA focused on Project Management. I've worked on those fields for about 6 years total an then, 2,5 years ago I quit/lost my job and decided to shift directions.

After a month thinking things through I decided to start freelancing developing small websites in WordPress. I self-learned my way into it and today I can say I run a humble but successful career developing themes and plugins from scratch for my clients - mostly agencies outsourcing some of their dev work for medium/large websites.

But sometimes I just feel that not having studied enough math, or not having a formal understanding of things really holds me behind when I have to compete or work with more experienced developers. I'm constantly looking for ways to learn more but I seem to lack the basics.

Unfortunately, spending 4 more years in Computer Science is not an option right now, so I'm trying to learn all I can from books and online resources. This method is never going to have NASA employ me but I really don't care right now. My goal is to first pass the bar and to be able to call myself a real programmer.

I'm currently spending my spare time studying Java For Programmers (to get a hold on a language everyone says is difficult/demanding), reading excerpts of Code Complete (to get hold of best practices) and also Code: The Hidden Language of Computer Hardware and Software (to grasp the inner workings of computers).

TL;DR

So, my current situation is this: I'm basically capable of writing any complete system in PHP (with the help of Google and a few books), integrating Ajax, SQL and whatnot, and maybe a little slower than an experienced dev would expect due to all the research involved.

But I was stranded yesterday trying to figure out (not Google) a solution for the FizzBuzz test because I didn't have the if($n1 % $n2 == 0) method modulus operator memorized.

What would you suggest as a good way to solve this dilemma? What subjects/books should I study that would get me solving problems faster and maybe more "in a programmers way"?

EDIT - Seems that there was some confusion about what did I not know to solve FizzBuzz.

Maybe I didn't express myself right: I knew the steps needed to solve the problem. What I didn't memorize was the modulus operator. The problem was in transposing basic math to the program, not in knowing basic math.

I took the test for fun, after reading about it on Coding Horror. I just decided it was a good base-comparison line between me and formally-trained devs.

I just used this as an example of how not having dealt with math in a computer environment before makes me lose time looking up basic things like modulus operators to be able to solve simple problems.

答:
Here's a sample course:
http://www.ox.ac.uk/admissions/undergraduate_courses/courses/computer_science/computer_science_.html

I suggest read up on the following first:
Object-oriented programming (very common, used everwhere, this is where java comes in)
Concurrency (to write java programs that don't crash mysteriously in the real world, learn about deadlocks)
Database concepts ( most applications need to save data, theory is important here)
Programming paradigms (read about at least one non oops language, preferably functional, to expand your thinking and learn new stuff)

When I look at the 4 years of comp science education, to be honest I think there's only a handful of courses that you need to take seriously.

Data structures and algorithms (and you need math here to get really good and be taken seriously by other programmers), computer networking and operating systems come to mind as the most important. Other subjects that deal with lower level code, like being able to code in assembly are arguably not so important for you. Software engineering and testing expose you to concepts that are useful and you can pick that up with time.

Just download a pdf that explains these concepts in an intuitive way and you'll be on your way.

In some comp science courses, at least in mine, the first year is an introduction to all fields of engineering, like mechanical, electrical, civil, etc. There is lots of complicated math, mind you, which again may or may not be relevant for most application programmers today. So, many of the engineers around today actually have only 3 years of real comp science education (Hope this makes you feel better :)

Crux of the answer: you can take some time to study everyday, say an hour or so, and over a period of time become a pretty good programmer. Just keep learning. And remember to write some code everyday.


答:
Yes, every Java developer should definitely know what's going on behind the scenes of the virtual machine and that includes the work of the garbage collection.

The level of knowledge howver is another question. I wouldn't expect a normal developer to explain the difference of an actual implementation (I would have to do some research of that myself) however the basic principle of what a GC does and what the pros and cons against managing the memory yourself should be clear.


答:
You should have SOME knowledge about how the garbage collection for Java works for two reasons:

First, if you don't know how it works, then you may accidentally make design decisions that lead to worst-case performance in your actual application. This becomes less and less likely as the GC improves, but if you have a choice of algorithms in your app, then knowing something about the GC means you can pick one with knowledge of what it's going to do, instead of finding out that it causes bad behavior.

Second, if you don't know how it works, you can't possibly tune the GC for a given application. Most Java programmers never need to tune the GC, as the default parameters work well enough most of the time. If you do something that gets out of that 'most of the time', then you may find yourself tuning the GC parameters. Doing so without knowledge of the GC is just randomly turning knobs - you might get something useful out of it, but more likely you'll jut screw things up worse.

So, while I wouldn't expect a good Java programmer to know everything under the sun about GC, I'd expect that programmer to know at some level how the GC in the JVM they are using functions, and what the tradeoffs are for that GC algorithm.


答:
As others have pointed out, golang (and its variants) seems to work at the moment.  I'll also add that I don't think we should have to pick names of products, projects, or services based solely on search optimization.  Other one, two, or three letter languages seem to be rather searchable.  "C" isn't exactly the best name for a language but it seems to be rather searchable.  As web content for Go becomes more prolific, I imagine it'll improve.

The world isn't perfectly parsable.  If I were in Google's shoes, I would almost take it as a personal challenge to pick names on preference regardless of any perceived searchability up front.

As a side note, if a name as simple and universal as Go is enough to kill the language, it has no business becoming mainstream anyway.  That said, the language is out there the implementation is open source, it could dwindle in use, but it will never die.  Languages have a way of doing that.


问:
Does Silverlight have a future?
Recently I have read some articles/blogs/comments about the development and history of WPF and Silverlight. In some forums many developers and users criticize the performance of WPF applications (for example Visual Studio 2010). Actually the market share of Silverlight in comparison to Flash is not very high. At PDC 2010 Bob Muglia said something like "our Silverlight strategy and focus going forward has shifted...." and Microsoft wants to push HTML5 in the future.

Additionally, Microsoft has announced HTML5 being a core part of the Windows 8 and Windows Phone 8 ("Mango") platforms.

Recently I have started learning Silverlight and now I must ask myself, if I should continue investing time in learning these (in my opinions) very nice and powerful technologies!? Does they have a future? Does (Windows) desktop (client) applications have a future? Does so called "Rich Internet Applications" have a future? Or will HTML5 become the "absolute truth" in software development?

What is your opinion and what do you think?

答: It's just a guess, but with the rise of smartphones and tablets, especially those from Apple, Silverlight as a web technology doesn't seem to make much sense anymore.

Title: Does Silverlight have a future?


问:
Why null pointer instead of class cast?
In Java:

```<code>int count = (Integer) null;
</code>```

throws a java.lang.NullPointerException.

Why doesn't this throw a Class Cast Exception for ease in programmer understanding?

Why was this exception chosen over any other exception?

答:
When executing your code, the Java runtime does the following:

Cast null to an object of class Integer.

Try to unbox the Integer object to an int by calling the method intValue()

Calling a method on a null object throws a NullPointerException.

In other words, null can be cast to Integer without a problem, but a null integer object cannot be converted to a value of type int.

EDIT

I had a related question a while ago at Stack Overflow, see here.

Title: Why null pointer instead of class cast?


问:
Why can't the IT industry deliver large, faultless projects quickly as in other industries?
After watching National Geographic's MegaStructures series, I was surprised how fast large projects are completed. Once the preliminary work (design, specifications, etc.) is done on paper, the realization itself of huge projects takes just a few years or sometimes a few months.

For example, Airbus A380 "formally launched on Dec. 19, 2000", and "in the Early March, 2005", the aircraft was already tested. The same goes for huge oil tankers, skyscrapers, etc.

Comparing this to the delays in the software industry, I can't help wondering why most IT projects are so slow, or more precisely, why they cannot be as fast and faultless, at the same scale, given enough people?

Projects such as the Airbus A380 present both:

Major unforeseen risks: while this is not the first aircraft built, it still pushes the limits of the technology and things which worked well for smaller airliners may not work for the larger one due to physical constraints; in the same way, new technologies are used which were not used before, because for example they were not available in 1969 when the Boeing 747 was certified.

Risks related to human resources and management in general: people quitting in the middle of the project, inability to reach a person because she's on vacation, ordinary human errors, etc.

With those risks, people still achieve projects like those large airliners in a very short period of time, and despite the delivery delays, those projects are still hugely successful and of a high quality.

When it comes to software development, the projects are hardly as large and complicated as an airliner (both technically and in terms of management), and have slightly less unforeseen risks from the real world.

Still, most IT projects are slow and late, and adding more developers to the project is not a solution (going from a team of ten developers to two thousand will sometimes make it possible to deliver the project faster, sometimes not, and sometimes will only harm the project and increase the risk of not finishing it at all).

Those which are still delivered may often contain a lot of bugs, requiring consecutive service packs and regular updates (imagine "installing updates" on every Airbus A380 twice a week to patch the bugs in the original product to prevent the aircraft from crashing).

How can such differences be explained? Is it due exclusively to the fact that the software development industry is too young to be able to manage thousands of people on a single project in order to deliver large scale, nearly faultless products very fast?

答:
The definition of "large project" is skewed.

A large project, technically, can be delivered on time, and flawlessly, granted it is something that's been built many, many times over the years.

A Pac-Man clone.

A calculator

A text editor

I'm sure you're thinking..."but those are small projects! A text editor is simple." I would disagree with you. Computers are outrageously complicated. Just installing and setting up users on an operating system can be difficult at times, and you didn't even write the OS, or build the hardware.

The projects you're talking about are huge projects, akin to space exploration. How do you know how long it takes to develop inter-galactic travel? What model do we base it on? You have the known knowns, the known unknowns, the unknown knowns, and finally, the unknown unknowns, which happen to come up a lot in software development.

I think the problem is one of expectation. Just because the technology is there doesn't mean using it is going to be successful (or wise to use) for a while. If other industries behaved like the software industries did, we'd have black hole powered vacuum cleaners for sale by the end of the decade. Or some "visionary" would have the resources to build a moon base, and decide that a Starbucks would really "round out" the experience for visitors. I don't think the problem is the software industry, but the expectations placed on it.


问:
Is Liskov Substitution Principle incompatible with Introspection or Duck Typing?
Do I understand correctly that Liskov Substitution Principle cannot be observed in languages where objects can inspect themselves, like what is usual in duck typed languages?

For example, in Ruby, if a class B inherits from a class A, then for every object x of A, x.class is going to return A, but if x is an object of B, x.class is not going to return A.

Here is a statement of LSP:

Let q(x) be a property provable about objects x of type T. Then q(y) should be provable for objects y of type S where S is a subtype of T.

So in Ruby, for example,

class T; end
class S < T; end
```

<p>violate LSP in this form, as witnessed by the property <em>q(x)</em> = <code>x.class.name == 'T'</code></p>

<hr>

<p><em>Addition.</em> If the answer is "yes" (LSP incompatible with introspection), then my other question would be: is there some modified "weak" form of LSP which can possibly hold for a dynamic language, possibly under some additional conditions and with only special types of <em>properties</em>.</p>

<hr>

<p><em>Update.</em> For reference, here is another formulation of LSP that I've found on the web:</p>

<blockquote>
  <p>Functions that use pointers or references to base classes must be able to use objects of derived classes without knowing it.</p>
</blockquote>

<p>And another:</p>

<blockquote>
  <p>If S is a declared subtype of T, objects of type S should behave as objects of type T are expected to behave, if they are treated as objects of type T.</p>
</blockquote>

<p>The last one is annotated with:</p>

<blockquote>
  <p>Note that the LSP is all about expected behaviour of objects. One can only follow the LSP if one is clear about what the expected behaviour of objects is.</p>
</blockquote>

<p>This seems to be weaker than the original one, and might be possible to observe, but I would like to see it formalized, in particular explained who decides what the expected behavior is.</p>

<p>Is then LSP not a property of a pair of classes in a programming language, but of a pair of classes together with a given set of properties, satisfied by the ancestor class?  Practically, would this mean that to construct a subclass (descendant class) respecting LSP, all possible uses of the ancestor class have to be known?  According to LSP, the ancestor class is supposed to be replaceable with any descendant class, right?</p>

<hr>

<p><em>Update.</em>  I have already accepted the answer, but i would like to add one more concrete example from Ruby to illustrate the question.  In Ruby, each class is a module in the sense that <code>Class</code> class is a descendant of <code>Module</code> class. However:</p>

<pre class="lang-rb prettyprint-override"><code>class C; end
C.is_a?(Module) # => true
C.class # => Class
Class.superclass # => Module

module M; end
M.class # => Module

o = Object.new

o.extend(M) # ok
o.extend(C) # => TypeError: wrong argument type Class (expected Module)
</code>```

答:
After looking through Barbara Liskov's original paper, I've found how to complete the Wikipedia definition so that LSP indeed could be satisfied in almost any language.

First of all, the word "provable" is important in the definition. It is not explained in the Wikipedia article, and "constraints" are mentioned elsewhere without reference to it.

Here is the first important quote from the paper:

What is needed is a stronger requirement that constrains the behavior of sub-types: properties that can be proved using the specification of an object’s presumed type should hold even though the object is actually a member of a subtype of that type...

And here is the second, explaining what a type specification is:

A type specification includes the following information:

The type’s name;

A description of the type's value space;

For each of the type's methods:

Its name;

Its signature (including signaled exceptions);

Its behavior in terms of pre-conditions and post-conditions.

So, LSP only makes sense with respect to given type specifications, and for an appropriate type specification (for the empty one for example), it can be satisfied in probably any language.

I consider Telastyn's answer to be the closest to what I was looking for because the "constraints" were mentioned explicitly.