问:
Login into application at startup
Short version: I want "Login on program startup" checkbox like in Skype, for example, but don't know how to protect saved credentials securely.

I'm writing client application which, before doing actual requests to server, should be authorized by server. Authorization goes as follows: user fills in standard login dialog, data goes to server via HTTPS and, if it was correct, server sends credentials.

However, entering password each time is disturbing and prevents starting application on system startup. I want to encrypt those credentials and save them on disk. I could not find appropriate encryption key, however.

Key should be, obviously, user-specific (not system-wide!) and reasonably hard to fraud.

For now I just use hash of some HDD info and username and fallback to hash of process environment, if WinAPI call fails (how bad is that?).

I'm writing for Windows using C++/Qt, but any recommendation is welcomed.
Thanks.
upd1

Ok, to make myself clear:

Required encryption level is:
you cannot login by simply copying credentials.dat file from one computer to other (or one user folder to other);

Keeping password secure (which is not stored by application) is user's responsibility.

I want to store not the password, but encrypted access token which is user-id and public key for encrypting communications with server.

From your answers I've understood that my auth. system isn't okay. I will reconsider it. And yes, I have access to both, server- and client-side.

For now, I want way to determine machine- and user-unique encryption key, which I can get from OS in runtime to decrypt/encrypt credentials (which is server's answer to email/password entered by user).

答:
You could do some basic CHAP style method.

Example:

Client and server have a shared private key for each client user.

User authenticates first time; server returns a pass token (guid)

pass token is stored client end.

Upon "Login on program startup", client requests access.

Server responds with an "access token" and pre-computes the response (shared private key + access token + pass token)

client responds by giving the HASH of (shared private key + access token + pass token).

Pass token is valid until the user logs out.

EDIT:
I have done something similar to this for a web service, a little more involved but on the same principles.

Title: Login into application at startup


答:
If your application needs to supply the username and password every time, then one way or another, you will be storing them locally (obfuscated somehow, or not).

If you can change the server-side authentication, you could implement an access token-based authentication (as in Darknight's answer), which is what I would favor myself.  That way, you avoid actually storing passwords on the user's hard drive.

If you have no control over the server-side, and must supply username and password each time, I would agree with Tom Squires that you should store them as simply as possible.

Why?  Because to do anything else is to provide a false sense of security to the user.  For a full argument, you should read "Plain Text Passwords" on the Pidgin wiki.

You should read that page for the full argument, but to briefly summarize:

Any obscured password (anything that isn't hidden behind another
password) can eventually be un-obscured.

Not only can it be un-obscured, but a utility could be made that would return you the
plain-text password with a single button-press.

If you have physical access to the computer, passwords aren't relevant.

ContentLicense: CC BY-SA 3.0

Title: Login into application at startup

Body:
Short version: I want "Login on program startup" checkbox like in Skype, for example, but don't know how to protect saved credentials securely.

I'm writing client application which, before doing actual requests to server, should be authorized by server. Authorization goes as follows: user fills in standard login dialog, data goes to server via HTTPS and, if it was correct, server sends credentials.

However, entering password each time is disturbing and prevents starting application on system startup. I want to encrypt those credentials and save them on disk. I could not find appropriate encryption key, however.

Key should be, obviously, user-specific (not system-wide!) and reasonably hard to fraud.

For now I just use hash of some HDD info and username and fallback to hash of process environment, if WinAPI call fails (how bad is that?).

I'm writing for Windows using C++/Qt, but any recommendation is welcomed.
Thanks.
upd1

Ok, to make myself clear:

Required encryption level is:
you cannot login by simply copying credentials.dat file from one computer to other (or one user folder to other);

Keeping password secure (which is not stored by application) is user's responsibility.

I want to store not the password, but encrypted access token which is user-id and public key for encrypting communications with server.

From your answers I've understood that my auth. system isn't okay. I will reconsider it. And yes, I have access to both, server- and client-side.

For now, I want way to determine machine- and user-unique encryption key, which I can get from OS in runtime to decrypt/encrypt credentials (which is server's answer to email/password entered by user).


问:
How to keep user's guide in lockstep with branches for a non-developer?
Our current user's guide is built using asciidoc. The documentation is managed by a non-technical person, but we keep the source text files as well as generated HTML in source control. Issues arise when they are making doc updates for version x.z in the x.y branch. Typically, one of the developers will update their environment, but they can be very forgetful. I know there has to be a better way to do this.

How do you manage users' guides in a versioned manner without actually depending on non-technical users to learn VCS?

答:
When your documentation is under version control, it is typically not an unreasonable request for the person doing the documentation and/or managing the documentation to ensure that it is properly checked-in -- be they a technical developer or otherwise.

In my experience, a sticky note on the desktop (virtual or not) with the few git/svn/etc commands, or the interaction path with one's GUI client of choice, on the desktop of an otherwise non-technical person has worked just fine when the responsibility and expectation is made clear that documentation checkin is part of the job.

You may not be able to do this in your specific situation, but if we took out the "my husband is the CTO and does some things for me" (note: this was in the original question) and tackled the issue in general then some options include:

The person learns how to use version control and it is made part of their workflow, as noted above (and again, not unreasonable, although the project manager or technical lead or whomever keeps an eye on things might have to keep an extra eye on things the first few times).

The person doesn't learn how to use version control and the workflow step for documentation check in falls to someone on the development team or perhaps the release manager (depending on when the checkin happens).

Something else probably more convoluted and inefficient than keeping a sticky note on the desktop about how to checkin a document...


答: Well, in which branch should she actually make doc updates? In x.z, in x.y, or in both? If there is just one branch, restrict her access to that branch at your VCS server. If she has to work on both branches in parallel, better teach her a bit more about version control, and make sure it is easy to see which branch she is currently working at.</p>

Title: How to keep user's guide in lockstep with branches for a non-developer?

Body:
Our current user's guide is built using asciidoc. The documentation is managed by a non-technical person, but we keep the source text files as well as generated HTML in source control. Issues arise when they are making doc updates for version x.z in the x.y branch. Typically, one of the developers will update their environment, but they can be very forgetful. I know there has to be a better way to do this.

How do you manage users' guides in a versioned manner without actually depending on non-technical users to learn VCS?


问:
is it programmer's duty to disable directory listing?
Recently I have project in which a directory listing is enabled, due to which some scripts can be seen by outside world. I asked website administrator and he said it's not his responsibility, its the programmer's job. I also asked programmer about this and he said that the script is actually a cron job, and according to him, he has to test the script on webserver as there is a difference between development and production environment, so he placed there to test that. According to him, there was no direct link as he assumed directory listing is disabled and taken care by administrator.

Who is the right person to do this?

答: It's programmer duty to protect his code and application, if he has the control to upload code and able to use htaccess then why not use index there. Often cpanel and other web servers has directory indexes enabled, no good programmer can leave important docs, zips and scripts in document root.</p>


问:
RDF and OWL: Have these delivered the promises of the Semantic Web?
These days I've been learning a lot about how different scientific fields are trying to move their data over to the Semantic Web in order to "free up data from being stored in isolated silos". I read a lot about how these fields are saying how their efforts are implementing the "visions" of the Semantic Web.

As a learner (and from purely a learning perspective) I was curious to know why, if semantic technology is deemed to be so powerful, the efforts have been around for years but myself and a lot of people I know have never even heard of it until very recently? Also, I don't come across any scholarly articles deeming "oh, our inferencing engine was able to make such and such discovery, which is helping us pave our way to solving...." etc.

It seems that there are genuine efforts across different institutions, fields, and disciplines to shift all their data to a "semantic" format, but what happens after all that's been done? All the ontologies have been created/unified, and then what?

答:
The different technologies of the Semantic stack/cake are trying to solve different problems: Some of them are more flexible but less structured (for example XML), while some others (RDF, OWL) are more rich regarding the structure and semantics of metadata.

I agree with you that the Semantic Web (as such) is mostly used in academia, but individual parts of the Semantic stack/cake are also used in the industry: XML for creating meta-languages, RDF in compilers, OWL for creating ontologies used in medicine, food and drink industry, etc.

To answer you last question, for taking advantage of the data described using Semantic Web technologies, we need tools that are aware of them. Tim Berners Lee describes "Semantic Web agents" as automated tools that can interpret the RDF/OWL contents of Web Ontologies and make inferences about them.

The main problems of the Semantic Web IMHO are: (1) The non-intuitive syntax of its languages, (2) Programmers/Companies are not motivated to use Sematic Web technologies, (3) There is a lack of good Semantic Web tools.

I find ideas like microformats easier to use and perhaps that's a good start for enriching raw data using metadata.


答: Simply, it is a programmer's job. Can a programmer upload his application with no security & testing, then sit back for a system admin to add Security for  him?  Certainly not.  A professional programmer won't do this.  A professional programmer will take the responsibility of making his/her code secure.</p>

Title: is it programmer's duty to disable directory listing?

Body:
Recently I have project in which a directory listing is enabled, due to which some scripts can be seen by outside world. I asked website administrator and he said it's not his responsibility, its the programmer's job. I also asked programmer about this and he said that the script is actually a cron job, and according to him, he has to test the script on webserver as there is a difference between development and production environment, so he placed there to test that. According to him, there was no direct link as he assumed directory listing is disabled and taken care by administrator.

Who is the right person to do this?


问:
Is there a performance benefit to using immutable objects in a scripting language?
As I understand it, writing your objects in an immutable style can help the performance of your program for compiled languages, as the compiler tends to rewrite your code in single static assignment form under the hood anyway.

Is there a performance benefit to using immutable objects in an interpreted language like Python or PHP?

I understand there may be readability or code quality benefits from immutability, but I am asking specifically about performance.

答:
The major benefit of immutable variables come the moment you go distributed and have your data spread over several computers.  Mutable data needs elaborate mechanisms to ensure that when data is updated, all copies in various caches are updated too, which besides being elaborate also take time.

Immutable data can be copied and cached as much as is needed.  You are guaranteed that the data will not change.

I do not know if Jython supports multi-threading, if so, it would be an advantage on heavily multithreaded, multi-core applications.


问:
Is it a good idea to write requirements specifications by stories?
We're using agile methods in my current project at the moment, and we have heaps of stories like these:

As an assistant, I want to pay a customer a refund so that they can
get some money when they request it

As a customer, I want to pay for a purchase so that I can receive my
item.

How we've done it so far is to pick the most important stories every sprint and elaborate it into a number of formal requirements specs (we group some of the stories that are similar together in the same spec). Depending on the story, it could just be a button on a screen or an entire workflow.

The problem now is that because there's so many stories, it's not immediately clear, for any part of the system which stories relate to it.

It works at the time of developers, every sprint the devs just get a spec outlining what they need to do and the changes they need to make. But in terms of maintaining this story list and for testing, its starting to get really hard tracking bugs and in general just maintaining the specs, because one piece of functionality in the screen might have been documented in a number of different places due to it being split by story.

Is writing specs based on stories a good idea? Have we written the stories in the wrong way?

答:
As of time writing this answer, I've realized it's not about testing, it's about documentation. You should first read agile manifesto:

[We value] working software over comprehensive documentation

So, you should make your specifications executable, i.e. write them as a fully automated set of tests.

Is writing specs based on stories a good idea?

Yes, imho, it is. It's called "behaviour driven development" or "specification by example". In ruby there's a great tool cucumber that helps in that much .

The problem now is that because there's so many stories, it's not immediately clear, for any part of the system which stories relate to it.

Why do you want it to be clear? I mean, do you really need a "test/code" traceability matrix? The advantage of writing tests as a specification is that you don't need a separate "requirements/tests" traceability, because tests become requirements. For the purposes of integration testing you should treat your software as a whole, not as separate parts.

You might need a coverage tool to see if there are "dead" modules, parts of your system not covered by your specification tests. But you really shouldn't care what specification this particular code corresponds to. It should be vice versa: from a particular specification you should know which part of the system corresponds to it. You shouldn't worry about some duplication in your specifications. And if you apply a DRY principle to your code there would be dozens of specs executing the same code.

It works at the time of developers, every sprint the devs just get a spec outlining what they need to do and the changes they need to make. But in terms of maintaining this story list and for testing, its starting to get really hard tracking bugs and in general just maintaining the specs, because one piece of functionality in the screen might have been documented in a number of different places due to it being split by story.

It's not that uncommon that hundreds of integration tests are broken by one little change in a critical module. That's where unit testing steps into.

You should structure your tests as such so that you can tell if a particular test covers a high level requirement, or just a subtle detail of it. If the latter, you should separate this test from your integration tests suite. The purpose of unit testing is to localize bugs. So that if you introduce a bug, there will be one and only one test failure.

Have we written the stories in the wrong way?

I think, you just need to organize your stories into epics either by user, e.g. "Customer",  "Assistant", or by features/screens/workflows ("Purchase", "Refund").

And again, specification tests are not a replacement to unit testing. Read more


问:
Is Perl still a useful, viable language?
I know it may have been asked before, but here goes nothing...

Is Perl still something that would be considered useful? If someone was a new programmer (either completely new to programming or just a few month/years of experience) would Perl be something to be considered worthwhile to learn?

Is Perl still used with frequency? Is it still popular?

Or is Perl dying out compared to languages like Python, Ruby, PHP, ASP.NET, etc.?

Basically it boils down to this:

Is it still used/is it still used frequently? If yes, is it dying? If no, will it make a come back?

Is it something that would be worth learning?

How does it compare in demand to languages like Python in both popularity and usability/viability? Could languages like Python or Ruby be considered replacements for Perl?

Also, will newer versions of Perl really bring a large improvement to the Perl community, and perhaps bring Perl back to centerstage compared to other languages?

EDIT:

Okay, I suppose here's a better, reworded question:

Is Perl still growing, or is it "dying"? Is it still a language worth learning and using? What projects does it really "shine" in compared to other languages? What makes Perl a language to choose? Essentially: is Perl growing obsolete compared to other languages, and if so, do you expect that to change, or to continue?

And thank you to everyone who has answered so far, the discussion has been really interesting!

答:
I've been using perl for web game development since the 90s, and after a 3 year break, I agree with the previous poster. I come back and find it's evolved way above and beyond where I left it.

Is it dying? Not a chance.

Is it useful? I'd be lost without it. Maybe that's just me, but from the other responses, I'd say it's a very active living creature.


问:
How to find just starting OpenSource project and Join or find programmers for own?
Is there any place on the web where can I join a team when they are just starting their project?

Is there any place where developers can make groups for projects?

I know there are some /dev/forums where you can have luck to find something interesting in some topic ... but the chances there are really low.

I know that you can find some projects on CodePlex or GitHub but they will be already started projects and it's not so easy to understand and join it ...

I want to find some place where new ideas comes to new teams.

So ... maybe starting project must already have a good base, but not to big base and then project leader must Promote it and find developers who like the idea ?

Sometimes that is really hard to catch such promotions.

答:
How about Code52?  They start a new project each week so you can get in at the start and see a project through to the end.  Code52 is the brainchild of a few Australian developers but anyone can pitch in and help with each project.  In fact, each week they post a recap post showing, amongst other things, the number of contributors and there are always more than 10 contributors.

Don't be put off by the 1 week schedule; a lot can be accomplished in that time frame and you can always continue to work on them after.

You can also make suggestions for future projects and the most popular ones are the ones which are chosen.  If you have a particular idea, post it here and drum up support for it!

ContentLicense: CC BY-SA 2.5


问:
What's the best way to modularize a User schema so it's generic
I have a database design question. Basically I want to be able to create a schema for a User model, then use this User model in other models that extend User but I want to design it in such a way that it's generic enough to be used in every application.

For example a Profile or Account model might extend User, and in both cases they will be different based on the web application you are designing but the core credentials of User should never be different across any web application.

What fields do you think should be in the User model?

I think the bare minimum to successfully handle authentication would be:

email (the login unique identifier)

salt (obviously!)

password (duh)

lostToken (a hash to verify lost password functionality)

role (member, admin, editor, etc.. IMO this list of roles would differ between sites however it's too important to the User model not to have here?)

Now we get into other interesting fields that are still very very useful:

createdAt (when the account was created)

ipAddress (track the ip when the account was created)

refererUrl (which site it came from)

lastLoggedIn (the last time the user logged in)

isOnline (is the user currently online)

And even more fields that are still pretty useful:

username (might not be used on every site)

number of consecutive logins (similar to the stack network)

I think anything else like social data (likes, votes, profile views), badges/achievements, the last time they updated their profile/account/whatever, and other info like their name belong in the per-site Profile model.

What do you think?

Edit:
I fully understand that this question is partly subjective but I do think there's definitely room for discussion.

答:
I'd advise for a separate database, we use STS and SQL Server for our 'User Store' schema.  It roughly contains:

User Table - This contains UserID, Password hash etc.  It also has a
ID field which is an indentifier for the user other than the User ID.

User Audit - This contains audit information everytime the user
authenticates, URL, IP Address, etc.

Application - Known applications in the system

Roles - A role is a lists of policies

Policy - A specific policies

Environment - Defined Environments (SQL Server DB)

License (We rolled our own), this probably is not in your schema

When a user authenticates, as part of that process we need to know what application and what environment they are using/going to.   A user could have multiple environments for one applicatoin (Dev, Test, Integration, Production), so there is that level of separtion.  Once we know that, then we look up there role and policy set for that appplication/environment and store that in the token. At that point the user has authenticated and we know that user via thier ID.  They also have thier policy set readily available for any application specific logic since wherever they go, the token follows.  The UserID and password are out of the picture and the application no longer needs or uses it, and now all references are by the ID, not UserID.

It's generic in the sense that if another team develops an application all they have to define is there application, roles, and policies and then they can use the STS that is set up.  Since we have a common ID to identify the user, the application itself can have further table(s) defined for any application specific attributes as needed.

For example, badges and achievements would not be stored in the user store, rather they would be stored in the application schema and would be referenced by the ID of that user.

Basically, the user store is generic when it authenticates only.  Additionally, we have extended it to allow for applications to hold authorization information as well.

By doing that, we can create an administration console for any number of applications that can control user authentication and authorization.  Any user attributes beyond authentication and possibly authorization need to be stored elsewhere.


问:
Software license restricting commercial usage like CC BY-NC-SA
I want to distribute my software under license like Creative Commons Attribution - Non commercial - Share Alike license, i.e.

Redistribution of source code and binaries is freely.

Modified version of program have to be distributed under the same license. Attribution to original project should be supplied to.

Restrict any kind of commercial usage.

However CC does not recommend to use their licenses for software. Is there this kind of software license I could apply? Better if public license, but as far as I know US laws says that only EULA could restrict usage of received copy?

答:
I'm not a lawyer, but I'm quite certain that the legal wording of CC isn't suited to software; there are many suitable open source software licenses.

Liberal licenses include ("liberal" here means both open and closed source products can be derived and commercialized) :

MIT License

BSD License

Apache License

Reciprocal licenses include ("reciprocal" here means only open source products can be derived and commercialized):

General Public License (GPL)

Lesser General Public License (LGPL)

Mozilla Public License (MPL)

For your needs, GPL is the best match: free use and redistribution of sources and binaries, reciprocation of any changes released, and derived products must be released under the same license.

Note that even with GPL, commercialization is still possible, albeit with a strong imposition of open source. If you don't want any commercialization, you may have to draft your own license.


问:
Can someone find a job as a programmer without an education?
Interested in knowing from the more experienced ones if someone can find a job as a programmer without even a highschool degree. Consider the said person to be an average programmer. Would someone even consider giving him/her a chance on an interview ? The languages of interest would be python/php/java/c#

Please answer for your region/city/country only. No "go back to school" answers please.

答: Personally I wouldn't hire someone without a masters degree, unless they could document some relevant experience and had very good references. </p>


问:
PHP common uses for the Command Line
I started with PHP a little while ago. I've been doing a lot of tutorials, practice sites, etc. and it's going great.

One thing I like about PHP is how easy it is to get started (downloading WAMP and voila). However, up until I learned about PEAR and MVC frameworks,  I haven't put much thought in using a command line Interface for PHP development...

I've not really used the command line that much and it will take me some getting used to, so a couple of questions I have are:

What are the most common uses of the Command Line when developing websites and web applications with PHP?

Can you run MVC frameworks such as Zend, CakePHP, etc without ever using it?

Besides PEAR, are there any other PHP repositories that use the command line to work?

(It seems if you want to avoid using PEAR there are countless other PHP Classes/libraries on the internet that one could download and then simply copy and paste files into your site.)

答: PHP is generally best suited to web development even though it has been adapted for other purposes. Common use on the command line is likely to be in the context of web development, particularly working with tools that are bundled with web frameworks such as the CakePHP console.</p>

Title: PHP common uses for the Command Line


问:
Are frameworks necessary In PHP?
Are frameworks really necessary in PHP?

What are the advantages and disadvantages of using one?

答:
Not all applications require a framework, but most consequential ones do.

The advantages are:

Don't repeat yourself - Any new application is will have functionality in common with many existing applications. It makes sense to avoid repeating yourself. A framework bundles functionality you'll need for most applications. You'll consequently save time (and money).

Don't drudge yourself - Software development in general can be quite grindingly painful. It makes sense to automate the mundane stuff. A framework takes care of the plumbing, so you can focus on being profoundly creative. You'll consequently save effort (and money).

The disadvantages are:

Our way or no way - You may have to follow the framework's rigid conventions, which might contravene your dogmatic beliefs about how things should be done (and consequently enrage you).

Acquired framework syndrome - You may become too dependent on frameworks to get even the simplest things done. You'll forget how to route requests, access databases, map objects to database queries, etc since the framework holds your hand through all that.

All in all, it's better to use one.

Title: Are frameworks necessary In PHP?


问:
Programming IDEs feature to add a forgotten open parentheses?
I very often find myself in situations where I should have opened a parentheses, but forgot and end up furiously tapping the left arrow key to get to the spot I should have put it, and doing the same to get back to where I was - that, or removing one hand from the keyboard to do it with the mouse. Either way, it's a stupid mistake on my part and a poor use of time going back to fix it.

For example, if typing something like

```<code>var x = 100 - var1 + var2;
</code>```

I might get to the end of the statement and realize I wanted to subtract the sum of var1 and var2 from 100 and not add var2 to the difference of 100 and var1.

I can't really expect an IDE to prevent my mistakes, but I was thinking there could be a simple enough feature that would save time when they're made. Specifically, some kind of function that, after a closing parenthesis is added where there isn't an opening one, would start ghosting in an opening parenthesis at different statements and allow the user to switch between them.

For example:

Say you have the following statement:

```<code>var x = oldY * oldX + newY / newX - left - right;
</code>```

If you put a closing parenthesis after right and pressed the shortcut, the IDE would do:

var x = oldY * oldX + newY / newX - ( left - right);

press left, and then:

var x = oldY * oldX + newY / ( newX - left - right);

...then:

var x = oldY * oldX + ( newY / newX - left - right);

Anyway... Does this feature exist? If not, should it exist? What do senior programmers do when this happens?

答:
Senior programmers use the Next/Previous word, start of line end of line hot keys to navigate the code - if you ever get a chance, watch a vi expert in action. These things 'just happen' - you don't think "left, left, left, left, Brace, right right right", you think "brace over there" and your fingers do it for you.

Senior devs also  don't worry too much about the time taken to type. We are not the Typing Pool - paid for word/minute. We add a parenthesis (or any artifact that makes the code readable, let alone correct) when needed, as we know the time to write it is trivial compared the time it will be read thousands of times.

Further senior developers would not write

```<code>var x = oldY * oldX + ( newY / newX - left - right);
</code>```

As it's very odd code that does not 'look' right, meaning even more time will be spent reading it and trying to second guess what the original write wanted it to do (Any developer should be able to work out what it does).

Body:
Senior programmers use the Next/Previous word, start of line end of line hot keys to navigate the code - if you ever get a chance, watch a vi expert in action. These things 'just happen' - you don't think "left, left, left, left, Brace, right right right", you think "brace over there" and your fingers do it for you.

Senior devs also  don't worry too much about the time taken to type. We are not the Typing Pool - paid for word/minute. We add a parenthesis (or any artifact that makes the code readable, let alone correct) when needed, as we know the time to write it is trivial compared the time it will be read thousands of times.

Further senior developers would not write

var x = oldY * oldX + ( newY / newX - left - right);

As it's very odd code that does not 'look' right, meaning even more time will be spent reading it and trying to second guess what the original write wanted it to do (Any developer should be able to work out what it does).


答:
background processing (yep, it's quite ugly)

<?php system("php background-process.php &");

putting php jobs (e.g. db maintenance?) into cron tables

cgi processing in unsupported web servers

linting before uploading

php -l file.php

fast checkup of daring language constructs

php.exe -r "$a=array(1,6,9); array_splice($a,2,1,array(9,10,46)); var_export($a);"

php -r '$a=array(1,6,9); array_splice($a,2,1,array(9,10,46)); var_export($a);'

testing backend code during development

...and then, I also do shell scripting in php.

```<code>#!/usr/bin/env php
<?php
  echo "Hello World!\n";
</code>```

Title: PHP common uses for the Command Line

Body:
I started with PHP a little while ago. I've been doing a lot of tutorials, practice sites, etc. and it's going great.

One thing I like about PHP is how easy it is to get started (downloading WAMP and voila). However, up until I learned about PEAR and MVC frameworks,  I haven't put much thought in using a command line Interface for PHP development...

I've not really used the command line that much and it will take me some getting used to, so a couple of questions I have are:

What are the most common uses of the Command Line when developing websites and web applications with PHP?

Can you run MVC frameworks such as Zend, CakePHP, etc without ever using it?

Besides PEAR, are there any other PHP repositories that use the command line to work?

(It seems if you want to avoid using PEAR there are countless other PHP Classes/libraries on the internet that one could download and then simply copy and paste files into your site.)

Body:
background processing (yep, it's quite ugly)

<?php system("php background-process.php &");

putting php jobs (e.g. db maintenance?) into cron tables

cgi processing in unsupported web servers

linting before uploading

php -l file.php

fast checkup of daring language constructs

php.exe -r "$a=array(1,6,9); array_splice($a,2,1,array(9,10,46)); var_export($a);"

php -r '$a=array(1,6,9); array_splice($a,2,1,array(9,10,46)); var_export($a);'

testing backend code during development

...and then, I also do shell scripting in php.

#!/usr/bin/env php
<?php
  echo "Hello World!\n";


问:
What's the difference between using RDFS/OWL versus XML?
I was wondering what advantages the ontology languages of RDFS/OWL has over using a tagging/markup system (such as http://www.schema.org/) for managing and creating metadata?</p>

答:
RDF and OWL are established standards for encoding semantic data and their schema, on a much deeper and generic level than an ad-hoc markup.

For example, with OWL, you can define new Schema, which will be at least partially understood by other tools (because you can mix different OWL/RDF schema together). This way, you can export from one dataset different "views" of it and have everyone cooperate. Also, you can just "explore" links between objects and their properties.

With microdata, it's basically an ad-hoc, accepted set of things you can apply, not a general semantic platform.


答:
For the purpose of developing future products, RDFS/OWL XML files are to be considered pretty much dead and gone.

They require too much work to express concepts that a custom built solution based on custom text formats would express better, while keeping the data more readable and editable to humans and machines alike. They add no real value and only make life a little more miserable for everybody that stumbles on them. (and has to deal with their namespace nomenclature)

There are gigantic document handling solutions based on them, though, and they were recently developed, deployed, and are in current service. They threaten to linger around for a very long time. Many programmers in the future will undoubtedly suffer from many RDF-and-OWL-inducted WTFs.

Microdata systems, (the validator-friendly version of microformats) like those described in schema.org, present instead a lot of advantages for developers, editors, and readers, alike; both human and mechanical.

RDF concepts (those worth saving) can be mapped (and are actually being explicitly mapped) over microdata representations painlessly.

Microdata items allow authors and document handling systems to enrich communication in a way that's pretty easy (as easy as CSS or DOM) to handle and customize for the reader.

Title: What's the difference between using RDFS/OWL versus XML?

Body: I was wondering what advantages the ontology languages of RDFS/OWL has over using a tagging/markup system (such as http://www.schema.org/) for managing and creating metadata?</p>


问:
How do you handle changes in client focus?
We are working on a large ongoing project that has continual feature changes. These features could take as long as 3 - 4 weeks to complete.

This would of course be fine, except the client is always changing its priorities/focus based on pushes from THEIR clients who may want certain features implemented before others.

So, we often have to shift gears in the middle of a major feature build and start a new feature that all of a sudden has a greater priority. We then of course have the time cost of merging everything together at some point, and also the cost of that lost momentum on the original feature.

Our estimates are out the window at that point.

Is there any good way to handle this?

Some options I've thought of:

assume this is the way things will be, and apply a 'distracted client' factor of up to 100% on all estimates (this is dangerous in the case where we can actually complete a feature without interruption)

educate the client on the costs of shifting gears, and perhaps apply a change premium to previous estimates if they want us to change to working on a different feature

refuse to work on more than one feature/release at a time (aside from bug fixes). This is probably not realistic.

I'm looking forward to hearing about how others have tackled this. It can't be uncommon.

答: Unless they add features and you don't adjust the billable amount, I would think this client is aware of this already since it happens so much. They know it would have been cheaper to do it up front. Whether or not the cost is worth it is up to them.</p>


答:
in Python and PHP there's very little benefit, most of it because immutable structures are usually simpler and smaller because they don't have to support any modifying feature.

OTOH, modern JITs (like LuaJIT or any modern JavaScript) could take advantage of any opportunity to constrain possibilities and produce tighter code (similar to what compilers do, but way more aggressively).

Title: Is there a performance benefit to using immutable objects in a scripting language?

Body:
As I understand it, writing your objects in an immutable style can help the performance of your program for compiled languages, as the compiler tends to rewrite your code in single static assignment form under the hood anyway.

Is there a performance benefit to using immutable objects in an interpreted language like Python or PHP?

I understand there may be readability or code quality benefits from immutability, but I am asking specifically about performance.


问:
Type mocking frameworks does not change coding practices from testability point?
Many people recommend that we should code against interfaces and avoid statics for testability.

Interfaces are not just for testability, they are sometimes a requirement. But sometimes we introduce new interfaces in application only for testability.

If type mocking frameworks help us to isolate dependent types, then why should we use interfaces just for the sake of testability?  Also, why should we avoid static members?

答:
I typically don't create a new interface every time I mock something out. I honestly feel that it doesn't provide enough value and it's just one more file to manage. Once the application's business logic code drives me to multiple implementations I may extract an interface. I may also create an abstract class or use another delegation pattern to implement it. As was mentioned elsewhere, the extract interface refactoring is a simple keystroke away and it allows us to create that interface just in time.

As far as statics are concerned, they have a tendency to encourage global state, which can be problematic (Object oriented global variables are still global variables). Also, I often see them used as creation methods called from within their collaborators instead of using DIY making them difficult to fake.

Thanks!

Brandon


问:
What are benefit/drawbacks of classifying defects during a peer code review
About 3 months ago, our engineering group rolled out Review Board to be used for all peer code reviews.  Today, I had a discussion with one of the people involved in that process and found out that we are already looking for a replacement (possibly something commercial) because of several missing features.

One of the features that is apparently asked by many people is the ability to classify/categorize each code review comment (i.e. is it a style issue, coding convention, resource leak, logic error, crash... whatever).

For those teams that regularly practice code review, is this categorization a common practice? Do you do it? have you done it in the past? Is it good/bad?

On one hand, it gives the team some more metrics and possibly will indicate more specific areas where developers may potentially need to be trained in (at least that seems to be the argument).  Are there other benefits?  And on the other hand, and this is my concern, is that it will slow down code review process that much more.  As a team lead, I've done a fairly large share of reviews, and I've always liked the ability, to highlight a chunk of code, hammer off a comment and move on as fast as possible.  Although I haven't tried it personally, I have a feeling that expanding that combo box every time and scrolling/searching for the right category would feel like something is tripping you. Also if we start keeping metrics on this stuff, my other concern is that valuable code review meeting time will be spent on arguing whether something is a logic error or if it should be classified as a crash.

答:
It looks like you are looking for codestriker. It has a feature to classify problems both by mode, level and type.

For those teams that regularly practice code review, is this categorization a common practice?

Well, since I use the above tool, I am forced to do. The problem I see with that is that sometimes it can be difficult to get all right, because there are so many options.

The classification of problems provides little value to the code review, since the comment is more important. Actually, since I am forced to set 4 fields in the tool above for every comment, it became cumbersome.

Later when you check the summary of reviews, you can see that the distribution seems to have unique distribution. People tend not to make the same mistake several times.


问:
What does a company typically expect from a Perl developer?
Are there any common expectations from perspective employers when they hire a Perl developer?

For a student who likes Perl and Linux and would like to get a job as Perl developer, what would you recommend to learn?

I am looking for things that are generic and applicable to most/all Perl positions, as opposed to specific details of a given company's requirements.

In other words, what are the things I should be able to to/know to become more attractive to ANY company looking for a Perl developer.

答: Along with points @DVK and other developers mentioned companies might look for good C programming coding skills as for performance reasons there are many parsing modules written in C so sometime you might need to debug for some issues. So better if you know code in C language.  </p>


问:
Is Information Technology really Engineering?
While travelling I met a mathematician who was sitting near me. In a discussion he said: "...there is nothing like engineering in IT or rather programming". A true engineering is what Architecture is, what Electrical and Mechanical is.

It made me think and I was puzzled. A percent of my brain agreed also because in Indian Army, there is no subject like Computer Engineering in the Engineering Corps. They don't consider programming as engineering. This is what I heard few years back, I don't know what Indian Army thinks now.

What are your views?

答:
Next time someone tries to bait you on the topic, ask them about the following jobs:

Locomotive engineer

Flight engineer

Audio engineer

None of those positions have much to do with electrical/mechanical/civil engineering either.


问:
Login into application at startup
Short version: I want "Login on program startup" checkbox like in Skype, for example, but don't know how to protect saved credentials securely.

I'm writing client application which, before doing actual requests to server, should be authorized by server. Authorization goes as follows: user fills in standard login dialog, data goes to server via HTTPS and, if it was correct, server sends credentials.

However, entering password each time is disturbing and prevents starting application on system startup. I want to encrypt those credentials and save them on disk. I could not find appropriate encryption key, however.

Key should be, obviously, user-specific (not system-wide!) and reasonably hard to fraud.

For now I just use hash of some HDD info and username and fallback to hash of process environment, if WinAPI call fails (how bad is that?).

I'm writing for Windows using C++/Qt, but any recommendation is welcomed.
Thanks.
upd1

Ok, to make myself clear:

Required encryption level is:
you cannot login by simply copying credentials.dat file from one computer to other (or one user folder to other);

Keeping password secure (which is not stored by application) is user's responsibility.

I want to store not the password, but encrypted access token which is user-id and public key for encrypting communications with server.

From your answers I've understood that my auth. system isn't okay. I will reconsider it. And yes, I have access to both, server- and client-side.

For now, I want way to determine machine- and user-unique encryption key, which I can get from OS in runtime to decrypt/encrypt credentials (which is server's answer to email/password entered by user).

答:
You can encrypt it and store the credential info on the client side using any strong and recommended algorithms like SHA-1. But do not store the key used for the encryption on the client side. Let only your server know the key which can decrypt the data.

To keep the client and server in sync, you can ask user to Login/Register into your website and then provide him the link for downloading the application. While creating the application link implant a seed into the application and store the same against the user ID in your server side DB. Use this seed to encrypt and store the credentials on client side and delete the seed after first successful login.

Title: Login into application at startup


问:
Resources for learning common algorithms by Lisp
Many books about algorithms and data structures are coded by imperative languages. Is there any book that can show functional programming languages can do the same thing or do them better?

In particular I am interested in sorting, searching, data structures and graph.

答: If you're interested in purely functional data structures (which naturally go hand-in-hand with algorithms) you should check out Okasaki's Purely Functional Data Structures. It's in ML (with examples in Haskell as well) rather than Lisp, but it is still a very good resource for purely functional programming.


答:
We code review using a simple Major/Minor and Root Cause (Requirements/Design/Implementation). Keeping the number items down gives usable metrics, without the burden of being too fine grained. There's rarely a discussion over a category as there're too few to choose from.

Our review tracking is ancient, but has evolved over 20 years. The tool of "choice" is Excel, so it's already burdensome. We are switching to Gerrit for less formal code reviews (Outside of "The Process" as it fits developer needs better - with gerrit we just bang in the comment and move on. Not "metrics" capture.

I personally think that Metrics are over rated - review is about code improvement, and ask anyone who has sat in on a few, they will tell you the same things the metrics will. However, the metrics cannot be argued with. They can also be usefully manipulated as required, and management is none the wiser (I am a bit/lot of a cynic at times.)

Title: What are benefit/drawbacks of classifying defects during a peer code review

Body:
About 3 months ago, our engineering group rolled out Review Board to be used for all peer code reviews.  Today, I had a discussion with one of the people involved in that process and found out that we are already looking for a replacement (possibly something commercial) because of several missing features.

One of the features that is apparently asked by many people is the ability to classify/categorize each code review comment (i.e. is it a style issue, coding convention, resource leak, logic error, crash... whatever).

For those teams that regularly practice code review, is this categorization a common practice? Do you do it? have you done it in the past? Is it good/bad?

On one hand, it gives the team some more metrics and possibly will indicate more specific areas where developers may potentially need to be trained in (at least that seems to be the argument).  Are there other benefits?  And on the other hand, and this is my concern, is that it will slow down code review process that much more.  As a team lead, I've done a fairly large share of reviews, and I've always liked the ability, to highlight a chunk of code, hammer off a comment and move on as fast as possible.  Although I haven't tried it personally, I have a feeling that expanding that combo box every time and scrolling/searching for the right category would feel like something is tripping you. Also if we start keeping metrics on this stuff, my other concern is that valuable code review meeting time will be spent on arguing whether something is a logic error or if it should be classified as a crash.


问:
CQRS and cache invalidation (while load balancing)
I'm slowly trying to migrate our web application to use CQRS principals.  In particular, I have separated "write" and "read" interfaces into commands and queries.

I have implemented a "reader" class that can read some data from the DB.  I have also implemented a decorator for this reader that caches the data to avoid any unnecessary roundtrips to the DB.  At the moment this decorator is caching per-request.  I'd like to cache this data for a longer duration - eg for a sliding 5 minute window.

However, the problem is that a command that updates the data should invalidate the cache once the write occurs, and I'd like to capture that notion explicitly in our domain model.

Specifically, here is the "read" interface  (c#):

```<code>public interface IRoleLister
{
    IList<DomainRole> Fetch(OtuIdentity otuIdentity);
    IList<DomainRole> FetchForAuthenticatedId(int userId);
}
</code>```

And here is the write interface:

```<code>public interface ICanChangeDomainRoles
{
    void AddRoleToUser(int userId, DomainRole domainRole);
    void RemoveRoleFromUser(int userId, DomainRole domainRole);
}
</code>```

I realize that some variant of the observer pattern would probably be applicable, but I'm not sure how to capture that in the domain model.

I also have identified another problem - namely cache key naming.  In the IRoleLister I want to cache IList<DomainRole> by user (eg typeof(IList<DomainRole>) + ":userid" as the key) but in ICanChangeDomainRoles I don't know the key name.  My thoughts are that the Observer should in someway be responsible for this.  (Or perhaps some other interface?  How do I capture that concept in my domain).

Finally, I realize that some form of distributed cache would help, but that seems like an implementation detail - I want to capture the invalidation/notification/observer concept in my domain model.

Any pointers would be appreciated

答:
General case, I would expect caching to be a policy applied to the data and not an attribute of the data itself.

I this is a perfect candidate for aspect-oriented-programming (eg PostSharp) and/or inversion of control frameworks (eg Spring.Net).


答:
I believe that you have largely answered your own question as to the relative benefits and drawbacks.

Code reviews can often end up being quite laborious and drawn out affairs, and anything that adds to the time taken to review code is going to make it seem worse. The way I see it, you want to keep your review process very short, and not labor too heavily over the finer points. So the key is to decide what it is about the review process that offers business value to your team.

Issues of style are probably one of the items I would place as the lowest of priorities.  Sure, keeping code neat and uniformly formatted can make it easier to understand, but fussing over style can also result in HUGE inefficiencies during the coding process, because worrying about how pretty the code is takes the developers thoughts away from the problems to be solved. If you are still concerned about style issues, then using a Style/Formatting checking tool (E.g.: StyleCop for C#) is a great way to leave the style-specific issues to to last moment, and take the decision-making process relating to style out of the developers hands, freeing their thinking for the more important stuff. If you don't have such a product for your language of choice, perhaps a simple parser can be written to quickly scan your code for such issues, but this should only be done if you can see that real value will be delivered as a result.

Memory Leaks and other performance specific issues should never be up to the review process to pick out.  Sure, if you spot something that will obviously cause a major problem you should point it out, but it shouldn't be the purpose of the code review to track down every little memory/performance problem in your code.  That's what a good profiling tool is for, and they are certainly worth every penny spent if you manage to locate a very good one for the language you are developing in.

Logic issues are problematical at best, and these are the things that can really suck up a lot of valuable time when you are reviewing code. Rather than leaving this all entirely to the code review, this is what your unit tests should be used for. Yes, even tests can be wrong, however if you develop test first, Stick to the SRP and DRY principals, refactor mercilessly and define your unit tests as a means to to validate your specifications, you'll find that you'll end up with far fewer logic-related issues. If you test after you code, you're less likely to deal with potential logic problems as they arise, and more likely to forget to test a particular pathway through your code.

So if you do everything as I have suggested here, what does that leave you to do in the code review?  The simple answer is that your code review becomes a fairly simple process whereby the coder explains to the reviewer how a particular requirement has been captured in the tests, and how those tests have been applied to the problems solved. You tend to spot check the code more, and analyze the tests more thoroughly, as this is where the greatest business value can be measured, and particularly when that code needs to be maintained later. To make the test code review even more painless, using a good Behaviour Driven test framework can simplify the review greatly, as the specifications are captured in code as an almost plain English description about how the test will run.  Detailed checks are performed on any code supporting the tests, and if your BDD framework produces nice text reports listing the tests in plain text story/feature statements, then the process becomes even easier still. This all adds up to an extremely efficient process that will be just as valuable as a more traditional code review, but can be conducted much more quickly and in a more focused manner, helping you to avoid becoming bogged-down in trivialities and double-checks that often lead you nowhere. This leaner approach means more time spent testing and coding, and less time on administrative processes.

So what about those metrics then?  If all problems are treated simply as "bugs", then the only metric you really need concern yourself with is the number of bugs you encounter before and after release, over time, and whether the bugs identified are trending in any particular direction. If you are using even a half decent issue tracking system, all of this information will be practically at your fingertips, and you won't need to worry about whether your review process needs to identify them. At the end of the day, your team wants to do what they are good at, which is writing software, and not spend too much time on administrative issues that often only offer something of interest to 1 or 2 individuals in the company. Even the most simple cost/benefit analysis would show you that time spent in red tape is going to drive your expenditure up and tie up resources that you could better allocate to new tasks, and this is probably where the risk and drawbacks will be if your code review process becomes too inefficient.


答:
I hope I did not understand the question wrong since I saw no suggestion for this book.

In my university we have a course that teaches paradigms of programming languages, they involve prolog, and lisp basically since we already cover Pascal, C, and Java on previous semesters.

The adopted book is available online for free: http://www.gigamonkeys.com/book/

I used this book most for reference, but I think to be a good one. While I as an assistant in this course we suggested the creation of a "LispUnit" a simple program so that students could test their own assignments. The code is available there online, and it was a very interesting experience.

Few students ended up learning how to test using Lisp actually.

On one of the assignments we proposed we emphasized as well how the idea of building from very simple blocks and reusing them on functional programming was more natural than in Java or C. We used few basic natural functions such as +, -, etc. Gave them the successor operation and they ended up creating many of the natural functions on Lisp. I think this is a simple, yet powerful way to mix mathematical concepts, specially since this is covered on Discrete Mathematics for Computer sciences degrees. We did not use LISP for anything like a real application thou, but I believe this book to provide better examples such as the test framework.

Hope this helps.

Title: Resources for learning common algorithms by Lisp

Body:
Many books about algorithms and data structures are coded by imperative languages. Is there any book that can show functional programming languages can do the same thing or do them better?

In particular I am interested in sorting, searching, data structures and graph.


答: I'd say most programmers are actually software mechanics. I mean, most programmers in the software industry do no more than software maintenance and bugfixing.

Title: Is Information Technology really Engineering?

Body:
While travelling I met a mathematician who was sitting near me. In a discussion he said: "...there is nothing like engineering in IT or rather programming". A true engineering is what Architecture is, what Electrical and Mechanical is.

It made me think and I was puzzled. A percent of my brain agreed also because in Indian Army, there is no subject like Computer Engineering in the Engineering Corps. They don't consider programming as engineering. This is what I heard few years back, I don't know what Indian Army thinks now.

What are your views?


答:
A very thorough introduction to the core foundations of computer science, e.g.

some data structures and algorithms,

what's under the hood of a functional programming language,

how to use abstraction and modularity

is the classic book Structure and Interpretation of Computer Programs (SICP), which uses the language Scheme.

The book is also online at MIT, where they are using it heavily in teaching.


问:
What is best practice for log level in PHP?
When programming in C, I often get the advice to turn on many or all warnings and not ignore warnings.

Does the same hold in PHP, should I enable all warnings in the PHP log?

答: Yes, of course. Why on Earth would you not want to automatically catch as many problems and potential issues as you can, especially when starting from scratch?</p>


答: Enabling warnings in PHP gives an extra edge for a programer to know where his coding is going wrong on which page , line etc... imagine manually checking 1000's of line to catch an error, if you have included multiple files, then you need to check as many as you have got. Therefore, it is better practise to enable it for a programer point of view!.</p>

Title: What is best practice for log level in PHP?

Body:
When programming in C, I often get the advice to turn on many or all warnings and not ignore warnings.

Does the same hold in PHP, should I enable all warnings in the PHP log?


答:
Default log level for PHP excludes notices, ie. it's E_ALL & ~E_NOTICE for PHP 5.2, E_ALL & ~E_NOTICE & ~E_STRICT for 5.3 and E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED for 5.4.

If you're working only with your code, then you're much better off setting it to E_ALL. Seeing notices will save you lot of debugging time, seeing deprecation and compatibility notices, will save you a lot of pain upgrading to newer PHP.

However, if you're working with third party code, turning on all notices  (E_NOTICE, E_STRICT and E_DEPRECATED) can lead to spamming of your log, as a lot of older code will generate a notice every few lines of code.


问:
Should Git be used for documentation and project management? Should the code be in a separate repository?
I'm starting up a Git repository for a group project. Does it make sense to store documents in the same Git repository as code - it seems like this conflicts with the nature of the git revision flow.

Here is a summary of my question(s):

Is the Git revisioning style going to be confusing if both code and documents are checked into the same repository? Experiences with this?

Is Git a good fit for documentation revision control?

I am NOT asking if a Revision Control System in general should or shouldn't be used for documentation - it should.

Thanks for the feedback so far!

答:
I came here with a similar question. We come from a SVN-environment, where it basically is a no-brainer to keep all materials related to a project in the same repository. Due to SVN's nature, you can easily check out parts of the repository, so if you just need the sourcecode (for example, a website deployment), that's no problem.

With Git, things are different. A checkout is always at the root level, so if you want to put everything in the same repository, you will always end up with the same directory structure. One approach I have come across is to put everything in separate branches, i.e. you have code-branches (which would typically be your normal master, develop, etc. branches) and a doc branch, which has its own, separate directory structure. I'm not certain yet that's the best idea, but it is a suggestion which circumvents the problem which I imagine is at the base of your question.

OwnerDisplayName: EmpireJones


问:
How do you manage feature requests and software changes?
I am a Software Engineer and over the past few years I have become the de-facto software project manager simply because there isn't one. So to keep our sanity in the R&D/Engineering department, customers have become accustomed to coming to me with their requests. I have no experience in this realm so it is my first time acting as a project manager for software projects. I have managed other things but not software.

So, how do you manage software projects and mark priorities? Requests come in at infrequent intervals so we very well could be working on something for someone else and then another person comes in with a "rush" job that needs working on. Is it easier to just say First Come, First Serve or is it the person with the most money?

答:
Setup a feature/bug/request tracking system and have your customers/coworkers file tickets. If they don't file a ticket for it, you aren't doing it. Tickets must be detailed enough to be actionable and must specify an "urgency" ("I need it now" vs. "nice to have").

Go through new tickets and carefully scope them. Enter the cost in the ticket in dollars, developers, resources, and/or time. This is essential. When your customers see what something will really cost them, you'll see very different choices in the "urgency" field.

On a daily basis, figure out your schedule based on the tickets filed & their urgency. Make the schedule visible to others so it's obvious what you're up to and your availability for future requests.


问:
Are there any negative side effects of splitting up large modules?
I was browsing a github project and found this module which has more than 10 thousand lines.

Is it a common practice to have that much code in a single module?

It seems to me that this should be split over multiple modules. Maybe one for each db engine.

What benefit does the developer get from making one huge module like this (other than "having it all in one place") or what downside is there from splitting it up (other than "complexity")?

答:
Wow.

I guess I don't know the full answer for this one, but I like thinking as an answer to the title question "How large should a Python module be?" as the concept of Parnas, hiding a secret. In this case the module seems to do that properly (and thats such a big secret it hides).

I've been digging into papers later that talk about a lot regarding coupling and cohesion. Maybe having many db modules would force too many calls between modules leading to increase what is considered bad practice, that is, lower cohesion and higher coupling?

I've seen experimental data talking about programmers deciding to sacrifice good practice for the sake of simplicity and understanding despite whatever good practice dictates. In fact, there could be a conflict between good practices as well. Say, performance doesn't usually makes the people who do maintenance happy later. I'm not quite sure how legibility would be improved in this case with such a big module.

Another thing I noticed is that part of the code is stated as generic and the rest of the dbs are extended from it. I'm not a python programmer, but perhaps this could justify something?

So, I don't have a final answer, but I hope someone highlights these points too!


答:
What you encountered is the so-called "God object", because it does all or knows all. Run away from it (if you can).

There isn't a definite number of LOC per module, but it should be something that makes it easy to browse the code and easily understand what the methods are doing.  From my personal experience, if your module goes beyond 1k lines*, you are doing something wrong.

* Even a 1k line module is very big.

Title: Are there any negative side effects of splitting up large modules?

Body:
I was browsing a github project and found this module which has more than 10 thousand lines.

Is it a common practice to have that much code in a single module?

It seems to me that this should be split over multiple modules. Maybe one for each db engine.

What benefit does the developer get from making one huge module like this (other than "having it all in one place") or what downside is there from splitting it up (other than "complexity")?


问:
Is it better to have C developers learn Flash, than hire Flash guys?

Last year, my department developed web based gaming, and needed Flash. It was difficult to manage. The Flash guys didn't fit in regardless of skill or popularity in the office. Maybe it's prejudice from the AS 2.0 days, or C programmers do things differently in my department. I don't get it!

EXAMPLE

They hired a BAD Flash Guy used Tweener and Keyframes (they hated him). Then they hired a GOOD Flash Guy that was expert at AS 3.0 and followed best OOP standards (they liked him). The result was the same, the C programmers overwrote all of they're code, even the GOOD Flash Guy's code.

QUESTION

Is it better to have C developers learn Flash, than hire Flash guys? No offense to Flash guy's, I'm trying to understand this on a project management level.

Thanks,

答:
Apparently Your definition of good flash as3 developer does not include that the developer does proper requirement gathering as to what all programs/process/API would interact with his program, and the environment/conditions it is deployed in.

Like others have pointed out This is essentially a process management and architecture problem. so who ever assigned the task to the flash guy must ave kept him in a black/box without divulging any information on integration.

But in general Its better to hire flash guy's than have pure c developers learn flash to work on a major project. Flash has a lot of Niche's and Gotchas in itself .

But Id like to point out the very difference in your own wording.
c developer vs flash guy . One would assume a developer is a person who has broader outlook of the existing system and understanding how to fit his task into the flow.


问:
Company wants to write custom project management tool, rather than use third party product
At the company I work, we are really wanting to get into the agile methodology for developing software. One thing that I'm not excited about is the fact that management wants us to build a custom project management feature inside the company's Intranet.

I think this is a total waste of time. There are many great third party tools available (e.g. Axosoft OnTime) that can do everything we need, and more. For how much development time it would cost us to build our own project management module, we could buy numerous licenses for a third party product.

One concern is that, whilst we are writing code for a client, and using our custom Intranet project management module, we find bugs in the module that need fixing ASAP. That means having to stop work on the client code to fix the Intranet. That just puts shivers down my spine.

Another worry I have is lack of functionality. This custom module is going to be so basic, that it will just feel really crap to use. That might sound a bit snooty, but for goodness sake, many third party tools are so feature rich, that the idea of having to write our own tool makes feel very uneasy. In fact, I can't be bothered.

What do you guys think?

I'm going to raise this issue with my boss, since I feel it's such an important topic to talk about.

EDIT:

Thanks for the great responses, much appreciated. To summarize some of them:

Money

Naturally my boss does want to save money, by not forking out a few hundred £'s for licenses. However, for us to write a custom tool, it will take x number of days, multiplied by approx £500, which is our costs. I don't see the business value in this.

Management have mentioned that they want to sell the Intranet as a product in the future, but it's so custom to our needs (and downright basic), that in order to give it to another client, I can see us having to fork a version of the code and rebuild the majority of it anyway. So it's not like we're gaining anything there in reuse.

Features

Having our own custom module means not feature bloat - only the functionality we require will be in the product. My issue is that there are plenty of free, open-source project management tools out there with minimal features already. So even if cost is an issue, we could look into open-source. Again it all boils down to the fact that I don't see the point in writing a project management tool in this day and age. It's a bit like writing your own web browser - why?, what's the point?

Although management are asking for this tool, just because they are, it does not mean I'm going to please them and do it just because they asked for it. If something does not make sense, then I will raise it as a concern.

At the end of the day, it's the developers who write the code, it's the developers who make money for a business. Thus, as far I'm concerned, the devs have a very big role in deciding how a company should manage projects and what tools are used. "I am Spartan, argh!" :)

Hmm, I've not been able to make this question a wiki for some reason, thus I'm going to have to pick an answer to accept.

Edit:

I had a meeting with my boss today. I told about my concerns on us writing a custom tool from scratch. I even showed him OnTime 2010, plus I ran an OnTime SDK example project which showed we could write our own custom code to interact with the data and do whatever we want. I showed all the lists, features, I could think of.

But he wasn't convinced. Un-f@king-believable! :(

So we will have to write everything from scratch, knowing full well that we could just buy a tool of the shelf to do the job. There's a lot of swear words I could use right now to describe how I'm feeling!

EDIT:

Responding to recent comments:

1) A developer who says he "can't be bothered".

There were three devs in the team, including myself. One dev was full time on a client project, myself and the remaining dev were working on a big client project. That means myself and the other dev would have to work on the client project, as well as the custom management module - at the same time.

The end result was that we ended up a management module, written in ASP.NET MVC by a dev with minimal MVC experience (I was only able to provide a small chunk of time to this module, as I was full time on the big client project). It wouldn't be unfair to say it was pretty crap (no fault of the dev). So yeah, I've no shame in saying I couldn't be bothered to split my time writing a pointless management module, whilst trying to also write a system for a client that were actually going to pay us.

2) A developer who doesn't have confidence in his team to build even a simple application to be relatively polished and free of significant bugs (and this is a shop that accepts contract work?

The company did great work, we delivered good software to clients - the devs were capable, as a team, to deliver good work. You've put words in my mouth there. I did have confidence in the team, but I wasn't confident they could build client systems on time, and to quality, whilst being distracted with this custom waste of time.

3) The one everyone picked up on already, dictatorial management.

Our director was pretty set in ways - he wanted the custom module regardless of the fact there were better options. It felt like a lost situation for us. Didn't feel great knowing that he didn't care what alternatives were available.

EDIT:

To put more context on the situation at the time - our boss wanted us to write the client app and the management module at the same time. They also wanted us to actually use the management module (user stories, tasks, etc) whilst it was being built i.e. dog fooding, with tasks related to the client project.

So imagine building TFS, and developing a new version of Visual Studio, but using the in-development TFS to store your work items, user stories, notes, etc relating to the Visual Studio development project. Not cool.

答:
This is one of well know management anti-patterns, known as reinventing the wheel. It's typical of big corporations, and driven by Not Invented Here syndrome. Basically managers fear, that 3rd party tool will somehow become unsupported.

Yes, pros of in-house development is having system tailored to your needs, but on the other hand having to re-invent whole basic functionality might lead to not having enough time/resources to actually implement these specifics.

Cons are obvious, not only you have to dedicate your developers' time to creating that solution from scratch, but also to maintaining and supporting it (eg. making compatible with newer versions of external dependencies).

Good solution — take a product that is highly extensible and customizable.
Most successful commercial and open-source products are. You can tailor Trac, Redmine, Pivotal Tracker or even JIRA to exactly meet your needs. There are also tons of plugins, so very likely you can get very close to what you need without writing a single line of code.


答:
Well, as much as I hate to admit it, C guys should be kept away from OOP code as much as possible. There are exceptions, but C mindset is a lot different, and this will most likely be a problem.

C is low level, function/struct oriented language with a lot of memory management. And C experts tend to carry over that style. A lot of C developers are scared from high-level constructs and exceptions, and they have a VALID reason for that.

For OOP environments that's not a very good idea. There are a lot of things that are not popular in C. Exceptions, polymorphism, etc. C guys will need quite a long time before they migrate away from C with classes. And start clean OOP code with SOLID and everything.

It would be a different story with C++ developers. There the discussion is open, IMHO.

Not that I hate C or anything. C is very good at some things C++ suck at, and the other way around. But clean C is a lot different from clean C++ code wise, with both styles having HUGE drawbacks and HUGE strengths going for them.

Body:
Last year, my department developed web based gaming, and needed Flash. It was difficult to manage. The Flash guys didn't fit in regardless of skill or popularity in the office. Maybe it's prejudice from the AS 2.0 days, or C programmers do things differently in my department. I don't get it!

EXAMPLE

They hired a BAD Flash Guy used Tweener and Keyframes (they hated him). Then they hired a GOOD Flash Guy that was expert at AS 3.0 and followed best OOP standards (they liked him). The result was the same, the C programmers overwrote all of they're code, even the GOOD Flash Guy's code.

QUESTION

Is it better to have C developers learn Flash, than hire Flash guys? No offense to Flash guy's, I'm trying to understand this on a project management level.

Thanks,


答:
I've used Trac, Trello, Pivotal Tracker and others and I would use Pivotal Tracker.

I would suggest that you talk to your boss again with words similar to:

"I've thought more about this.  I really care a lot about this companies future.  I really want to see this product succeed.  I'm just really nervous that the direction you're recommending will really affect that.

I want the company to succeed and I want us both to succeed.

I feel really strongly about this and I've talked to other folks in the industry and they mostly agree with me.  I feel that the direction that you're recommending is not going to help us succeed and I feel so strongly about our company's success that if we take this custom-built route, I'm just going to have to look for other opportunities with other companies.

I really don't want to do this I want to stay with our company and help us succeed but, again, following the right course of action to achieve this is all I want to see.

Title: Company wants to write custom project management tool, rather than use third party product

Body:
At the company I work, we are really wanting to get into the agile methodology for developing software. One thing that I'm not excited about is the fact that management wants us to build a custom project management feature inside the company's Intranet.

I think this is a total waste of time. There are many great third party tools available (e.g. Axosoft OnTime) that can do everything we need, and more. For how much development time it would cost us to build our own project management module, we could buy numerous licenses for a third party product.

One concern is that, whilst we are writing code for a client, and using our custom Intranet project management module, we find bugs in the module that need fixing ASAP. That means having to stop work on the client code to fix the Intranet. That just puts shivers down my spine.

Another worry I have is lack of functionality. This custom module is going to be so basic, that it will just feel really crap to use. That might sound a bit snooty, but for goodness sake, many third party tools are so feature rich, that the idea of having to write our own tool makes feel very uneasy. In fact, I can't be bothered.

What do you guys think?

I'm going to raise this issue with my boss, since I feel it's such an important topic to talk about.

EDIT:

Thanks for the great responses, much appreciated. To summarize some of them:

Money

Naturally my boss does want to save money, by not forking out a few hundred £'s for licenses. However, for us to write a custom tool, it will take x number of days, multiplied by approx £500, which is our costs. I don't see the business value in this.

Management have mentioned that they want to sell the Intranet as a product in the future, but it's so custom to our needs (and downright basic), that in order to give it to another client, I can see us having to fork a version of the code and rebuild the majority of it anyway. So it's not like we're gaining anything there in reuse.

Features

Having our own custom module means not feature bloat - only the functionality we require will be in the product. My issue is that there are plenty of free, open-source project management tools out there with minimal features already. So even if cost is an issue, we could look into open-source. Again it all boils down to the fact that I don't see the point in writing a project management tool in this day and age. It's a bit like writing your own web browser - why?, what's the point?

Although management are asking for this tool, just because they are, it does not mean I'm going to please them and do it just because they asked for it. If something does not make sense, then I will raise it as a concern.

At the end of the day, it's the developers who write the code, it's the developers who make money for a business. Thus, as far I'm concerned, the devs have a very big role in deciding how a company should manage projects and what tools are used. "I am Spartan, argh!" :)

Hmm, I've not been able to make this question a wiki for some reason, thus I'm going to have to pick an answer to accept.

Edit:

I had a meeting with my boss today. I told about my concerns on us writing a custom tool from scratch. I even showed him OnTime 2010, plus I ran an OnTime SDK example project which showed we could write our own custom code to interact with the data and do whatever we want. I showed all the lists, features, I could think of.

But he wasn't convinced. Un-f@king-believable! :(

So we will have to write everything from scratch, knowing full well that we could just buy a tool of the shelf to do the job. There's a lot of swear words I could use right now to describe how I'm feeling!

EDIT:

Responding to recent comments:

1) A developer who says he "can't be bothered".

There were three devs in the team, including myself. One dev was full time on a client project, myself and the remaining dev were working on a big client project. That means myself and the other dev would have to work on the client project, as well as the custom management module - at the same time.

The end result was that we ended up a management module, written in ASP.NET MVC by a dev with minimal MVC experience (I was only able to provide a small chunk of time to this module, as I was full time on the big client project). It wouldn't be unfair to say it was pretty crap (no fault of the dev). So yeah, I've no shame in saying I couldn't be bothered to split my time writing a pointless management module, whilst trying to also write a system for a client that were actually going to pay us.

2) A developer who doesn't have confidence in his team to build even a simple application to be relatively polished and free of significant bugs (and this is a shop that accepts contract work?

The company did great work, we delivered good software to clients - the devs were capable, as a team, to deliver good work. You've put words in my mouth there. I did have confidence in the team, but I wasn't confident they could build client systems on time, and to quality, whilst being distracted with this custom waste of time.

3) The one everyone picked up on already, dictatorial management.

Our director was pretty set in ways - he wanted the custom module regardless of the fact there were better options. It felt like a lost situation for us. Didn't feel great knowing that he didn't care what alternatives were available.

EDIT:

To put more context on the situation at the time - our boss wanted us to write the client app and the management module at the same time. They also wanted us to actually use the management module (user stories, tasks, etc) whilst it was being built i.e. dog fooding, with tasks related to the client project.

So imagine building TFS, and developing a new version of Visual Studio, but using the in-development TFS to store your work items, user stories, notes, etc relating to the Visual Studio development project. Not cool.


问:
When is optimization not premature and therefore not evil?
"Premature optimization is root of all evil" is something almost all of us have heard/read. What I am curious what kind of optimization not premature, i.e. at every stage of software development (high level design, detailed design, high level implementation, detailed implementation etc) what is extent of optimization we can consider without it crossing over to dark side.</p>

答:
It's not optimisation when picking things that are hard to change eg: hardware platform.

Picking data structures is a good example - critical to meeting both functional and non-functional (performance) requirements. Not easily changed and yet it will drive everything else in your app. Your data structures change what algorithms are available etc.


问:
Efficient methods for storing tens of millions of objects for querying, with a high number of inserts per second?
This is basically a logging/counting application that is counting the number of packets and counting the type of packet, etc. on a p2p chat network. This equates to about 4-6 million packets in a 5 minute period. And because I only take a "snapshot" of this information, I am only removing packets older than 5 minutes every five minutes. So the maximum about of items that will be in this collection is 10 to 12 million.

Because I need to make 300 connections to different superpeers, it is a possibility that each packet is trying to be inserted at least 300 times (which is probably why holding this data in memory is the only reasonable option).

Currently, I have been using a Dictionary for storing this information. But because of the large amount of items I'm trying to store, I run into issues with the large object heap and the amount of memory usage continuously grows over time.

```<code>Dictionary<ulong, Packet>

public class Packet
{
    public ushort RequesterPort;
    public bool IsSearch;
    public string SearchText;
    public bool Flagged;
    public byte PacketType;
    public DateTime TimeStamp;
}
</code>```

I have tried using mysql, but it was not able to keep up with the amount of data that I need to insert (while checking to make sure it was not a duplicate), and that was while using transactions.

I tried mongodb, but the cpu usage for that was insane and did not keep either.

My main issue arises every 5 minutes, because I remove all packets that are older than 5 minutes, and take a "snapshot" of this data. As i'm using LINQ queries to count the number of packets containing a certain packet type. I also am calling a distinct() query on the data, where I strip 4 bytes (ip address) out of the keyvaluepair's key, and combine it with the requestingport value in the Value of the keyvalupair and use that to get a distinct number of peers from all the packets.

The application currently hovers around 1.1GB of memory usage, and when a snapshot is called it can go so far as to double the usage.

Now this wouldn't be an issue if I have an insane amount of ram, but the vm I have this running on is limited to 2GB of ram at the moment.

Is there any easy solution?

答:
The first thought that springs to mind is why you wait 5 minutes. Could you do the snap-shots more often and thus reduce the big overload you see at the 5 minute boundary?

Secondly, LINQ is great for concise code, but in reality LINQ is syntactic sugar on "regular" C# and there is no guarantee that it will generate the most optimal code. As an exercise you could try and rewrite the hot spots withouth LINQ, you may not improve performance but you will have a clearer idea what you are doing and it would make profiling work easier.

Another thing to look at is data structures. I don't know what you do with your data, but could you simplify the data you store in any way? Could you use a string or byte array and then extract relevant parts from those items as you need them? Could you use a struct instead of a class and even do something evil with stackalloc to set aside memory and avoid GC runs?

OwnerDisplayName: Josh


答:
Having worked in one place where we replaced the company designed bare bones project management tool with a feature rich, customizable tool. I would have gone back to the reliable, easily supported company developed tool in a heartbeat. The cost to add the few new features we needed when we changed over was far outweighed by the time wasted daily trying to make this tool work for our company (it can take up to half an hour to close a project for instance when it took less than 30 seconds before) and the sheer amount of money it cost as well as the thousands of dollars in customer development we needed to pay for in order to retool this thing so that it was more user friendly.

In general (and this is a personal opinion) I have found that COTS products are usually horrible designs with horrible performance (and as a data person, I've had the opportunity to see a lot of them in "action" and seen how incredibly bad the designs of their databases are) because they try to be all things to all people and do nothing well. And many of them charge too much (we could have paid two developers full time for the price we paid for our useless project management system in that job) and know that their real money comes from paying their developers to come customize for you because no one in your office is going to be able to work their way through all the land mines to do it correctly themselves. Perhaps open source products are better (at least they aren't deliberately designed to make you need their consultants), but I've never worked anywhere where senior management would consider using an open source product for business critical functions.

Perhaps I sound bitter but honestly when 100 percent of the people who use the software daily wanted to get rid of it and the local developers were volunteering to fix the old system for free if we could just have it back, well I have reason to feel bitter about COTS products picked by people who don't have a clue as to what they need but fall for a slick sales pitch.


答:
Ok, maybe I am just paranoid, but this might be a bit of reading the writing on the wall.

Your boss would rather build than buy, are they reluctant to buy other tools and assets?  This could be an indication of a cash flow problem.  They probably have the cash flow for salaries, but little else.

This might be a time to sharpen that resume up and check around your area for some better run and more solvent companies.

If they don't have a problem with cashflow then:

The boss wants to put a feather in his hat with this project. Telling him it will be a huge FAIL will only make you look like you can't deliver.

The boss doesn't have a f-ing clue about software development, so he is figuring on selling this tool as is to clients.

It is marketing.  I worked at a shop where we had an in house tool like this.  It took a  full time developer to keep it running and add features.  Basically $100k in costs / year.  But they got to claim and show off this turd to all their clients.  (It was a turd, but it was our turd, it worked sort-of).

You boss and management are conviced (incorrectly) that your process is so special and unique no off the shelf tool could work.

Unfortunately any of the 4 above are hopeless causes and again it is indicative of a management team that doesn't get you.  Look for someplace that does.  It is a sellers market right now and you have the goods.


问:
Subscript binding and array categories
I am learning "Programming languages principles" and there is a lot of information about stuff which make up a programming language . Unfortunately every material I came across until now has a lot of technical jargon involved and is very difficult to understand (Atleast for a beginner sincerely trying to understand the topic on his own by reading the material) .

Can anyone explain me the "Subscript binding and array categories" in general .. The classification says there are five kinds of arrays -

1.Static array

2.Fixed stack-dynamic array

3.Stack dynamic array

4.Fixed heap dynamic array

5.Heap dynamic array

This is what I could understand from the definitions (almost on every article on this topic I came across) .

Static array - subscript ranges are statically bound and storage allocation is static.

I understood that the space for the array is allocated in memory at compile time (before run time) .

Fixed stack-dynamic array  - subscript ranges are statically bound, but the allocation is done at elaboration time during execution.

Now I didn't understand anything . What is meaning of the italicized phrases

Stack-dynamic array  - the subscript ranges are dynamically bound, and the storage allocation is dynamic “during execution.”  Once bound they remain fixed during the lifetime of the variable.

I dont understand what is meant by being 'bound' ?

I should be able to understand the remaining two definitions if I understand these three .

I know I am asking a lot .

Thanks :)

Here's a link I recently came across which I find useful for this topic . Anyone interested in this topic , check it out . :)

答: The classification is wrong. They are all arrays, and of fixed size. The only thing that changes is the memory region where they are allocated, and sometimes, the fixed size doesn't need to be known until runtime. These are not type-changing properties. All of those things are the exact same thing- an array.</p>

Title: Subscript binding and array categories


问:
Changing from VB.NET to C#?
I am working on co-op at a company as a test engineering specialist.  This is not technically a software job, however at the end of the day, I spend most of my time programming.

I am not a programming wiz by any means, but I am very comfortable using VB.NET since that is what projects started at my company previous to my time were written in, and so it is what I have learned and used in the position.

I have gotten the feeling from my time searching for help online when I need it that there is generally more and better support for C# than there is for VB.NET.  This has led me to thinking that it may be beneficial for the company going forward to start programming less in VB.NET and more in C#.

However, almost all projects in my department (since several other people work on small programming projects) are currently written in VB.NET.  Additionally, most of the software design done in our department is relatively simple I would imagine relative to a software focused area of any company. Probably half of it is generating html pages with graphs to visually illustrate certain data.  Taking these two facts into account, there are obvious disadvantages to trying to switch the main programming language used.  Also, the vb.net language is very similar to VBA (for excel) and VBScript, which are also used quite a bit in my area of the company.

I am basically not sure if it would be worth the work to change the main language used since there is not a lot of complicated programming done, and similar languages are necessary anyways it seems.

I was curious what additional insight experienced programmers may be able to offer me regarding changing the main language used in my area from VB.NET to C#?  What benefits or disadvantages are there that I may not have thought of?  How big a role do each advantage and disadvantage play?

What is your overall opinion on the idea of changing from VB.NET to C#?

答:
I agree with other posters who suggest it may not be worth it unless you feel you will gain enough in productivity somehow to counter the short-terms costs of changing.

I was in a similar position a couple of years ago, however I DID decide to make the move across. There were a number of reasonsL

I was developing in isolation and hadn't that big an investment in VB.NET, so the cost of transfer wasn't as significant.

As a solo developer, if I needed help, I found more C# online than VB.NET, so I had to as least understand C# basics

I wanted to enhance my CV (Resume), and if I'm honest, I wanted the personal amusement and satisfaction.

I would recommend you spend some time learning some C# basics, just to you can get full benefit from the various resources available online.

Title: Changing from VB.NET to C#?