问:
Queries on online project outsourcing sites
I have been looking at RentACoder, Freelancer and eLance from last few years but I always hesitated to register at these site. Hesitation includes little worry too. These questions fill me:

(1) Is there a legal contract between the bidder and the coder? Just in case my delivery date extends, what happens?

(2) After delivery, payment reach without trouble or not.

(3) In case the customer didn't find the project useful, then? Probably he might say that it is not useful to me and you return money. He might copy the source code and return another copy to me.

(4) What are further recommendations? How should I start?

答:
As with anything, you need to use common sense. The odds are somewhat stacked in favour of the buyer, but if you work with buyers that have a higher reputation, then you'll usually be fine. If the buyer has never awarded a job before, you need to be careful that the job they're posting is reasonable and they're not asking you to re-write Facebook for < $500 or something silly like that.

You also need to remember that you're generally competing with teams of people in developing countries who will be happy working for 1/10 the rate you would expect. The regular buyers will have come to expect those rates and if your bids are significantly higher, your bids will be discarded out of hand.

Having said that, these websites can be a good way to get your name out there on a couple of projects. But don't expect to be able to make a living exclusively from them...


问:
Is it common for a programmer not to know the difference between C and C++?
During an interview, I was asked whether I knew the difference between C and C++.

I was wondering why such question being asked?

答:
Edit

As a foreward, note that this answer is not meant to declare that there are no differences or that I profess to know the differences, or even that I know than "Hello World" in either C or C++. It is an answer to the question by framing the terms of reference, pointing out that plenty of people know the elementary differences (e.g. one has some + characters in its name) and very few people will know all or even most of the differences.

It depends what you mean by 'programmer' and what you mean by 'difference'.

I'm a 'programmer' (although I call myself a developer) and I'd struggle to give any real differences between C and C++. If pressed I'd probably say that C++ is a superset of C that has namespaces and inheritence; different ways of dealing with memory. I know enough to patch some bugs or make some changes in your existing program but I can't imagine writing anything more than a simple utility in C or C++. I know enough to get by, but I don't paint myself as "knowing" either of those languages.

I know other 'programmers' (also developers) who wouldn't even tell you the difference between Java and FORTRAN, or Javascript and Pascal. They are good at what they do and they don't do procedural languages.

Then there are millions of mediocre programmers who barely know the single language they work with every day.

The term 'difference' is ambigious. I've pointed out what I see as some differences above, but I know they aren't definitive and complete. Very few people are going to know every difference - a lot more people are going to be able to give some vague answers (as I have) about object orientation.

ContentLicense: CC BY-SA 3.0


问:
I'm doing 90% maintenance and 10% development, is this normal?
I have just recently started my career as a web developer for a medium sized company. As soon as I started I got the task of expanding an existing application (badly coded, developed by multiple programmers over the years, handles the same tasks in different ways, zero structure).

So after I had successfully extended this application with the requested functionality, they gave me the task to fully maintain the application. This was of course not a problem, or so I thought. But then I got to hear I wasn't allowed to improve the existing code and to only focus on bug fixes when a bug gets reported.

From then on I have had three more projects just like the above, that I now also have to maintain. And I got four projects where I was allowed to create the application from scratch, and I have to maintain those as well.

At this moment I'm slightly beginning to get crazy from the daily mails of users (read managers) for each application I have to maintain. They expect me to handle these mails directly while also working on two other new projects (and there are already five more projects lined up after those). The sad thing is I have yet to receive a bug report on anything that I have coded myself. For that I have only received the occasional let's-do-things-180-degrees-different change requests.

Anyway, is this normal? In my opinion I'm doing the work equivalent of a whole team of developers.

Was I an idiot when I initially expected things to be different?

I guess this post has turned into a big rant, but please tell me that this is not the same for every developer.

P.S. My salary is almost equal if not lower than that of a cashier at a supermarket.

答:
This is a project management problem. Use some kind of project management to decide what is of highest priority to work on.

a) You need a backlog of items to work on. You put your plan for improving the code in the backlog.

b) All the bugs go into the backlog

c) The backlog gets prioritized.

d) You do it all in priority order.

Bugs may very well be a higher priority, but if once you fix all that you have cycles to spend on new features or on refactoring design.

It's easiest if you just do refactoring improvements incrementally, as you pass over sections that have issues/bugs to fix. Then you can tell management, "I had to fix A, but B was fundamentally broken and I had to do solution C to fix it all so that D will be easier/cheaper in the future" Where A=The bug, B=The anti-pattern, C=Solution, D=Future Gains

If you can't justify work as an investment worth doing, business people will never accept it.


问:
Should I tell a departed coworker about their "sev 1" defect?
I had a co-worker leave our company recently. Before leaving, he coded a component that had a severe memory leak that caused a production outage (OutOfMemoryError in Java).  The problem was essentially a HashMap that grew and never removed entries, and the solution was to replace the HashMap with a cache implementation.

From a professional standpoint, I feel that I should let him know about the defect so he can learn from the error.  On the other hand, once people leave a company,  they often don't want to hear about legacy projects that they have left behind for bigger and better things.

What is the general protocol for this sort of situation?

答: It may not be legal to tell someone.  Unless the code is open source, let sleeping dogs lie.</p>


答:
Probably Not

Seems mostly pointless to me, whether friends or colleagues. And, in some circumstances, possibly harmful to them, to you, and to your relationship with them.

We all make occasional mistakes.

In fact, the only factor that would make me want to tell said colleagues is this: is this a mistake that I know they wouldn't usually do / a situation that I know they would know how to handle?

If the answer is yes, there's no need to bug them as there's probably no educational value for them, so I don't see a duty to inform them. If you run across them one day or plan to have drinks on their last day and you have a good rapport with them as peers and fellow professionals, sure, you could mention it, more to feed some friendly or harmless banter than anything else.

If the answer is no, then there might be an obligation (wouldn't call it a "professional" one, though) to reach out and help them understand their error.

Keep it Civil

Most people don't like criticism about their job in general, developers/programmers even less so, and departing programmers would probably have even a lower tolerance. Why take the risk of annoying them, and giving them the impression that they leave on a bad note?

Sure, if they were bad employees throughout, this doesn't apply, but if they were otherwise sufficiently skilled fellow progammers, I don't see why I would go out of my way to emphasize their mistakes, except if I can be sure we can both laugh it off. Again, assuming they wouldn't learn much from it and just be mortified that they left that behind.

Legal?

From a different approach angle, if they have left the company, it really depends on your contract and on your company's security policies. You may not be allowed to take about the code (or other things, for that matter) to former colleagues.

Think Positive

Finally, I think that the only situations where I reached out to former colleague to discuss a codebase they left behind were:

to request a confirmation on something shady while researching a particular area of the code,

to congratulate them on some bit of code I found particularly masterful and that would have made my life worse if it weren't there,

to share the good news of a successful launch with them if they left before it happened (or similar big announcements relating to a product they used to work on).

Learn From Their Mistakes

What you can surely do is point out the error to the rest of the team, to ensure it doesn't happen again with the remaining members. No need to point to the actual error in SCM or to the author, it's not a blame game.

It's outside the scope of the question, but I'd still point out that you should make sure  to fix the error, document its origins, impacts, and resolutions, and implement a test for it to not show up again, if possible.

Title: Should I tell a departed coworker about their "sev 1" defect?

Body:
I had a co-worker leave our company recently. Before leaving, he coded a component that had a severe memory leak that caused a production outage (OutOfMemoryError in Java).  The problem was essentially a HashMap that grew and never removed entries, and the solution was to replace the HashMap with a cache implementation.

From a professional standpoint, I feel that I should let him know about the defect so he can learn from the error.  On the other hand, once people leave a company,  they often don't want to hear about legacy projects that they have left behind for bigger and better things.

What is the general protocol for this sort of situation?


答:
You're dealing with multiple issues here... Let's start with the obvious...

Is This Normal?

Hell no. But... is it common? Unfortunately, yes.

Regarding Bug-Fixing Frustration

While that doesn't excuse the rest of the mess you have to deal with and the multiple projects they overload you with, I just want to make a quick note that the "bug-fix" only approach, while frustrating for you as a developer, can be a perfectly sensible approach for the company and its management.

Surface for More Bugs and Costs

The more code you touch, the more likely you are to introduce bugs, even if your intent is to improve it. That means extended dev time, test time, and costs. And if it slips through to a service release with a medium to high-defect, that's a big mess for them.

Noise / Fog in your Logs

From an SCM-perspective, it also makes a bit of sense if you work directly off a service release's branch, as you want to have a clean view of changes relating to bugfixing. If there are 15 commits with thousands of changes surrounding a bugfix that actually required maybe a 1 line code change, it's a tad annoying.

So, being a new hire, it's even more sensible to ask you to refrain from refactoring and/or enhancing the software, and quite OK in my sense to be as "surgical" as possible with your bugfixes. It just keeps headaches at bay.

Can You do Something About It?

Now, it does NOT mean that there would be ways of achieving both sanity of the code and sanity of the involved people's minds. Being junior, they should have someone review your changes, especially bugfixes, and make sure they are approved before making it to the service release builds. That would prevent or limit radical changes, and be safer.

The Project From Hell

Crap Code, Herd of Programmers, Duplication, Crap Architecture

Again, devil's advocate here, but just showing that your initial request contains a few non-consequential bits.

My point is this: I really really really rarely took over a codebase that wasn't in this state. And on the off-chance that I did, they were recently started projects or prototypes that had been kick-started by pretty stellar programmers. But the astonishingly vast majority of them looked like crap, and a scary number of these were actual crap. Even the ones started by good or great programmers can end up being crap, deadlines and other engagements helping...

Welcome to real-life industrial software engineering!

And you know what's fun? It's often way worse in the web-development world. Enjoy! :)

Too Many Projects & Requests, Not Enough Hands & Time

The problem lies here probably in:

your management (maybe unconsciously) abusing you,

your colleagues (maybe unconsciously) abusing you,

your (maybe unknowingly) not covering your ass and fighting your battles enough.

Your managers should be aware that you are working on too many projects to manage. If they aren't, make sure they are ASAP. Make also sure they know it wasn't all a pick-nick in the park and that you felt pressured, and that it needs to stop.

Try to have a look around and make sure your colleagues do not deflect more tasks and projects on you, directly (by really saying "X will be able to take care of that") or indirectly ("I'm not the right person for this, find someone else" -> ends up being you).

Personal anecdote here: I did an internship a few years back, and just on my very last day, when I got my evaluation, my boss told me, despite being very satisfied with my work overall, that one of the managers had the feeling I had been unloading some "not so fun tasks" on another intern when they would have expected me to pick them up. I was mortified of having them felt let down, and at the idea that I would look like I was slacking off, when my intent was the exact opposite: I was trying to grab the harder tasks and have the other younger intern deal with less hair-pulling issues. Little did I realize that, had I been in his position, I would have been bored by the lack of challenge and probably felt the way he did. The point is, you need to communicate to make sure nobody makes false assumptions about 3 very distinct things:

what you can do,

what you want to do,

and what you are willing to do.

So it's also partly your fault for letting it become this way. But it's normal, it's a lesson everybody needs to learn. It holds in two letters: N - O.

You usually employ it as a prefix for a more lengthy but not so much more charged answer: No, I can't do this. No, I don't know how to do this. No, I'm not sure I'm the right person for this. No, I've never done that.

At first, it's very easy to feel like you can just say "yes, I'll (eventually) do it", and pile things up and get them done, maybe by putting some extra hours in. That's all wrong. You need to understand that your time is, after your skills, your most valuable asset, to you and to your company. If it is misused, it impacts projects, deadlines, and budgets. As simple as that.

Also, it looks a bit worrying that you would have too many people to report to. It's OK to have multiple customers to deal with, and multiple project owners or even principal stakeholders you need to communicate with. But, overall, especially as you're a new hire, you should mostly report to a few managers only (and most likely only your direct manager, and possibly a lead or senior developer). How did it get this way? I don't know. It can be an organizational issue at your company, or it can be the result of you doing a favor and of then being contacted directly, and failing to say "no". Or it can be that your direct manager as issues with dispatching tasks, for all I know (I'm really guessing, but the pattern are recognizable and well-known).

I'd recommend you do the following rather quickly: go talk to your direct manager in person, explain that other managers might be a bit pushy, or (probably less whiny) that you
have too many stuff piling on from too many people, and that you need his input (and possibly theirs as well) to know which ones to prioritize.

180-degrees Change Requests

These are another big issue. They're probably not your fault, but you can try to help them address it.

"180-degress change requests", as you beautifully and acurately call them, are a clear sign that requirements are fuzzy from the get go, and that nobody tries hard enough to have them chiseled and cleared up over time.

That's usually when someone needs to get on the phone (or better, on their feet), and grab stakeholders by the hand and tell them clearly: "that's where we are, that's where you want us to go, do you confirm we're heading in the right direction?". It's OK to not get clear answers at the beginning, but the more time passes, the clearer they should become, or this project is a disaster waiting to happen.

Usually I'd say grab all the stakeholders within reach, put them in a room, drive them through litigious issues and incrementally try to resolve these - and get priorities while you're at it. However in your case, this may not be your call to make already. But you mention they really gave you the responsibility of the projects; so if that's really the case, then do take responsibility and do that. And DO NOT shy away from saying "we CAN'T do that", or even "we WON'T do that". It's really important to limit the scope of a project.

If there's no scope, there are no clear-cut requirements at the end of the discussion.

E-mail Overload

People tend to behave differently based on the communication medium they use. Personally, though I'm a rather soft-spoken person (and have been working mostly in foreign countries, so I also end up not liking to talk on the phone to much), I'd favor in order of preference based on productivity:

talking to people face-to-face,

talking to people on the phone,

talking to people via IM,

talking to people via email.

E-Mails are nice for tracking, for getting confirmations, for sending notes.

For scheduling, planning and discussing problematic points, they're close to useless. Go knock on the guy's door until he/she opens it and sit down with a notepad and a copy of your documentation to clarify things. Once you're done, then send an email and ask for confirmation. If it comes back with a negative answer or a slightly hidden attempt at sneaking something else in the envelope, go make the siege of your interlocutor's office again.

This is software engineering. It's often more productive when you don't type away on a keyboard, and can actually cut down upfront on the crap you'll need to deal with.

Doing a Team's Worth of Work

Are you doing the equivalent of a team's worth of work? Maybe.

Are you doing the equivalent of your team's worth of work? Probably not.

What I mean is that your team is probably busy working, and you are overworked. And that's the issue: you're overloaded with things that should be pushed out of the current project timelines, or given to someone with time on their hands.

Was I an idiot when I initially expected things to be different?

No; just new to the party. It's like a first hung-over or relationship. You'll get over it.

I guess this post has turned into a big rant, but please tell me that this is not the same for every developer.

This is the same for every developer in chaotic organizations, be them startups or well-established giants, and with no experience or confidence to get things to move one bit to tip your chances of survival on the right side of the scale.

P.S. My salary is almost equal if not lower then that of a cashier at a supermarket.

I did decent salaries on jobs that would appear crappy. It's not the number on the check that counts, it's the context. What you do, your age, where you live and work, etc...

That being said, if you are grossly underpaid, working too much, and not entirely junior, go ask for that raise or get a new job!

It's simple:

if they value what you do, they'll gladly agree to a raise,

if they don't, future in this company doesn't look very rosy (for you, at least, which is what matters), so don't feel bad about leaving.

Be aware that asking for a raise is a good thing, even though you wouldn't be enclined to think so at first. It proves you keep track of what you do, and hints that you keep an eye on other option while still being willing to stay onboard. And it's a good thing to get used to request them, as they are like job interviews or bargaining in general: it's something that requires practice, and they don't fall from the sky if you don't reach for them yourself. Some companies will distribute raises regularly without being requested to, but that's only because they are clever enough to know that it keeps you half-happy and less willing to change, and they want to cut the grass under your foot (most people would feel a bit uneasy about upping a raise offer they've been offered directly).

How to proceed with this request is a bit out of the scope of THIS project right here, so I won't go into the details. But I'd recommend you prepare a record of your SCM commit IDs, of your fixed bugs and achievements, and that you also prepare reports comparing them to the team's overall effort. This way:

you can measure for yourself if you effectively did a lot more than your peers or not,

you can stand your ground if they say your request is not justified.

Title: I'm doing 90% maintenance and 10% development, is this normal?

Body:
I have just recently started my career as a web developer for a medium sized company. As soon as I started I got the task of expanding an existing application (badly coded, developed by multiple programmers over the years, handles the same tasks in different ways, zero structure).

So after I had successfully extended this application with the requested functionality, they gave me the task to fully maintain the application. This was of course not a problem, or so I thought. But then I got to hear I wasn't allowed to improve the existing code and to only focus on bug fixes when a bug gets reported.

From then on I have had three more projects just like the above, that I now also have to maintain. And I got four projects where I was allowed to create the application from scratch, and I have to maintain those as well.

At this moment I'm slightly beginning to get crazy from the daily mails of users (read managers) for each application I have to maintain. They expect me to handle these mails directly while also working on two other new projects (and there are already five more projects lined up after those). The sad thing is I have yet to receive a bug report on anything that I have coded myself. For that I have only received the occasional let's-do-things-180-degrees-different change requests.

Anyway, is this normal? In my opinion I'm doing the work equivalent of a whole team of developers.

Was I an idiot when I initially expected things to be different?

I guess this post has turned into a big rant, but please tell me that this is not the same for every developer.

P.S. My salary is almost equal if not lower than that of a cashier at a supermarket.


问:
Reasons NOT to open source not-for-profit code?
I am a big fan of open source code. I think I understand most of the advantages of going open source. I'm a science student researcher, and I have to work with quite a surprising amount of software and code that is not open source (either it's proprietary, or it's not public). I can't really see a good reason for this, and I can see that the code, and people using it, would definitely benefit from being more public (if nothing else, in science it's vital that your results can be replicated if necessary, and that's much harder if others don't have access to your code).

Before I go out and start proselytising, I want to know: are there any good arguments for not releasing not-for-profit code publicly, and with an OSI-compliant license?

(I realise there are a few similar questions on around, but most focus on situations where the code is primarily used for making money, and I couldn't much relevant in the answers.)

Clarification: By "not-for-profit", I am including downstream profit motives, such as parent-company brand-recognition and investor profit expectations. In other words, the question relates only to software for which there is NO profit motive tied to the software what so ever.

答:
Warning: I Am Not A Lawyer.

Well, if it's a not-for-profit and its intellectual property is strongly tied to the software's code, then some may want to protect it from being commercially re-used, or even abusively exploited to create carbon-copies of your software.

Some other reasons - which are probably deep-rooted in the first one, actually - are that in your case a lot of the high-end research happens with private funding, and usually the investors want to see ROI. And so far, no all actors of the software industry (or newcomers) have been fully persuaded of the viability of the open source model (most likely by lack of knowledge and understanding of licensing, or by simple fear that licensing won't prevent malicious uses and copies).

Additionally, these companies don't want to get sued back by the ones who attempted to make a profit on their backs, and licensing is seen as a safeguard in this regard as well, with good reason or not.

It may not appear so, but maybe not-for-profit organizations ARE profitable for their founders or investors. The benefits just aren't direct. So they have a great interest in the NFPs going strong and not being beaten to the curb by competitors (even though you also wouldn't often think of "competitors" in the not-for-profit market), and they want to preserver their IP, even if it's at the cost of not getting more free eye-balls to review their code to find problems and improve it early on.

Note as well that copyright laws differ from country to country. Many European countries consider US copyright laws and the US patent system to be rather dumbstruck, for instance, so there's a cultural background and weight that is hard to shake off.

Jut my 2 cents on the subject.

(I've worked with universities a lot, and recently in bioinformatics and healthcare... It's a recurrent question for me and my colleagues :) )


答:
You need to be careful with how you choose your license to avoid potential liability issues.

A  lawyer may be a better person to talk to about this, but the general idea is what happens if someone uses (or misuses) the application and it causes some harm? Are you responsible? Obviously this would depend on what type of software you are writing, but you always need to be careful with what your license says about your liability. This can be a tricky thing to get right, so it may be easier to just not release the source code.

Title: Reasons NOT to open source not-for-profit code?

Body:
I am a big fan of open source code. I think I understand most of the advantages of going open source. I'm a science student researcher, and I have to work with quite a surprising amount of software and code that is not open source (either it's proprietary, or it's not public). I can't really see a good reason for this, and I can see that the code, and people using it, would definitely benefit from being more public (if nothing else, in science it's vital that your results can be replicated if necessary, and that's much harder if others don't have access to your code).

Before I go out and start proselytising, I want to know: are there any good arguments for not releasing not-for-profit code publicly, and with an OSI-compliant license?

(I realise there are a few similar questions on around, but most focus on situations where the code is primarily used for making money, and I couldn't much relevant in the answers.)

Clarification: By "not-for-profit", I am including downstream profit motives, such as parent-company brand-recognition and investor profit expectations. In other words, the question relates only to software for which there is NO profit motive tied to the software what so ever.


答:
There are at least two different kinds of open source.

If your attitude is "here's something useful, I'm done with it" (and that turns out to be accurate) then there's little downside.

On the other hand, if your attitude is "I'm really excited and I want some real users to help drive future development" then think very carefully.   You will have to spend time supporting users, many of whom are clueless.  You will have to consider conflicting requests for features and enhancements.   You will find it increasingly difficult to make changes, to preserve backward compatibility.


问:
Making Modular, Reusable and Loosely Coupled MVC Components
I am building MVC3 application and need some general guidelines on how
to manage complex client side interaction between my components.

Here is my definition of one component in general way:

Component which has it's own controller, model and view. All of the
component's logic is placed inside these three parts and component is
sort of "standalone", it contains it's own form, data needed for
interaction, updates itself with Ajax and so on.

Beside this internal logic and behavior of the component, it needs to
be able to "Talk" to the outside world. By this I mean it should
provide data and events (sort of) so when this component gets embedded
in pages can notify other components which then can update based on
the current state and data.

I have an idea to use client ViewModel (in java-script) which would
hookup all relevant components on page and control interaction between
them. This would make components reusable, modular - independent of
the context in which they are used.

How would you do this, I am a bit stuck as I do not know if this is a
good approach and there is a technical possibility to achieve this
using java-script/jquery. The confusing part is about update via Ajax,
how to ensure that component is properly linked to ViewModel when
component is Ajax updated (or even worse removed or dynamically
added). Also, how should this ViewModel be constructed and which
technicalities to use here and in components to work as synergy???

On the web, I have found the various examples of the similar approach,
but they are oversimplified (even for dummies) or over specific and do
not provide valuable resource or general solution for this kind of
implementation. If you have some serious examples it would be, also,
very helpful.

Note: My aim is to make interactions between many components on the
same page simpler and more robust and elegant.

答:
It sounds like you're struggling with :

Maintaining a "rich" UI

Doing most of your interactions via AJAX to the controller

Keeping the front-end in sync with results of AJAX actions

If I've understood your issue correctly, you may want want to check out KnockoutJS, which is a javascript framework built for handling just these kind of scenarios. Take yourself through the interactive tutorial examples, it'll build the concepts you need slowly and logically. Quite a nice framework.


答:
Yes, you will always have to maintain applications, written both by you and other people. The only exception is if you write a program which never, ever needs any maintenance. So you better get good at maintenance.

I think there is a subtle hint in your question of a flaw in your approach. That is, that fixing bugs does not involve improving code.

But then I got to hear I wasn't allowed to improve the existing code
  and to only focus on bug fixes when a bug gets reported.

I can't believe someone has told you "you must fix bugs without improving the code." This is both difficult and impossible. What you can't do is re-write the application just because you don't like, or find it hard to understand, the approach used in the existing code-base.

My advice is to learn to refactor. Any time you are fixing a bug, you have an opportunity to improve at least some of the code. How much of the code-base gets refactored depends on what the bug is and how good or bad the code is. But if you're fixing bugs and knowingly leaving code smells all over the place, then you're not doing your job and you're building up technical debt.

Some bugs are actually fixed simply by refactoring, and sometimes it's useful to refactor in order to help you understand code. This is because refactoring ought to improve maintainability and coherence of the code.

When I estimate a bug fix, I will usually make a decision about whether a major refactor will be the best way to do it, and take that into account. The same with unit tests. Both these things should be part of the way you write code, not something optional which involves extra time.

So you shouldn't be asking "can I improve the code when I fix the bug?" Because you should be anyway. You shouldn't be asking "can I use refactoring to fix the bug?" Because if the code which is causing the application to bug out is in dire need of refactoring, you should do it anyway. You shouldn't be asking "can I write unit tests when I fix this bug?" Because you should write a regression test before you even start trying to fix the bug.

NB: I feel some attribution for this answer should go to Jeff Atwood, seeing as I linked 3 of his articles.


答:
Security.

For example, say you build a web framework and you yourself use it.

As a not-for-profit project, you haven't had the time to dedicate to inspecting every bit of code for vulnerability to one attack or another:

CSRF

XSS

SQL injection

Session fixation

Use of buggy third-party libraries or even languages

Now, having open-sourced the project, you allow friendly eyes to contribute, but you also allow malicious eyes full insight into your work, and, if they find a server that is running your code, you've eliminated your ability to hide your imperfections in obscurity.

Of course, this may not apply to the type of software you are working on; and as always obscurity is no excuse for laziness in security.

However, just like I found in the couple of the levels that I got through in the Stripe capture the flag game, knowing the code is the among the easiest ways to find vulnerabilities (and sometimes it can be the only way).


问:
Is there a point to writing in C or C++ instead of C# without knowing specifically what would make a program faster?
I wrote a small library in Python for handling the xbox 360's STFS files to be used on my web applications. I would like to rewrite it for use in the many desktop programs people are writing for 360 game modding, but I'm not quite if I should continue using C# or delve into C++ or even C. </p>

<p>STFS is an in-file file system used by the xbox 360 and the job of the library would be extracting/injecting files, which could take noticeable amounts of time to do. What I know in C# comes from internet tutorials and resources, as would anything I learn about C++, so what I'm asking is if it's better to bring myself to a slightly lower-level language without knowing beforehand the features of the language that increase performance, or continue assuming that compiler optimizations and that my lack of experience will mean that the language I choose won't matter. </p>

答:
You should first consider if the languages you're already comfortable with are suitable for the task. If you conclude that you know no languages that are well-suited for the task, then you should investigate which would be the best to learn.

From the brief description you gave, I'd say C# is well suited for desktop development and XBOX integration. So why waste time and effort learning C++ (with its steep learning curve)? But if your requirement is for the program to be potentially portable, for example, C# immediately loses points. So make sure you define your requirements to yourself properly.


问:
displaying multi-section html documents - best practices
I work at a research organization and we publish a lot of large-ish documents, usually organized in sections. What I want to know is how best to present these multi-section documents on our website.

Presently, what I do is load the entire document as a single page, with each section as its own div. Then I show and hide divs as needed via a table of contents and "next" and "prev" buttons.

The advantages to this are mainly: 1) that you can move between sections very quickly, 2) it produces consistent analytics (when a page is loaded, I know a report is being read).

The disadvantages, however, are real:

Readers can't take advantage of browser back/forward buttons to move between sections.

It's complicated to create direct links to individual sections (I can do it with javascript but it's not easy for other people to grab and share).

For long reports, you have to wait for the full report to load before you can move around (and that can include hordes of images and charts).

Do other people have thoughts on better ways to organize this? Here's an example of the current system: http://massbudget.org/825

答:
I have gone through the link http://massbudget.org/825 and according to my observation..
1) Size of Intended data is very huge and it's taking a long time in loading the complete content of the page.
2) Navigation approach is not bad but can be more Readable and continent.
3) No need to deal with the content of the history.

Recommendations.
1) Don't load the complete document on onload event best practice will be either to use pagination or to use Ajax to dynamically change the content of div or page...

2) To enhance the readability you can provide Anchor tags that will provide the hyperlinks to browse incontinently between the content of the document.
example: Approach used by most common Wikipedia (content section).

3) In current scenario as a user if an going through a div or page with heavy content the i have to scroll a lot so i will rec-amend that a particular div must be scrollable not the complete page suppose only a div of about 900X700 dimension will be scrollable the i will be having complete control over Navigation Bar, Content Bar(as suggested in 2nd point), Header and Footer as well.

Thanks


答:
The advantage of C# over C++ is the speed and momentum in development (unless you're one of the very few C++ gurus, who can claim to do competitive RAD in C++ and not hurt themselves in the process; but then again good luck finding teammates who can reasonably claim the same thing). Compiler optimizations won't help you code faster, and with fewer errors, especially coming from a Python background.

You can tweak your performance if it is really an issue, by writing critical portions of code in C++/CLI, or even C with PInvoke, but - if you're in the Microsoft world - there will usually be a place for C# code high up on your stack, while C/C++ may be completely absent in some solutions. Therefore, perhaps you should start with C#, and complement with C++, not viceversa.

Title: Is there a point to writing in C or C++ instead of C# without knowing specifically what would make a program faster?

Body:
I wrote a small library in Python for handling the xbox 360's STFS files to be used on my web applications. I would like to rewrite it for use in the many desktop programs people are writing for 360 game modding, but I'm not quite if I should continue using C# or delve into C++ or even C. </p>

<p>STFS is an in-file file system used by the xbox 360 and the job of the library would be extracting/injecting files, which could take noticeable amounts of time to do. What I know in C# comes from internet tutorials and resources, as would anything I learn about C++, so what I'm asking is if it's better to bring myself to a slightly lower-level language without knowing beforehand the features of the language that increase performance, or continue assuming that compiler optimizations and that my lack of experience will mean that the language I choose won't matter. </p>


答:
This sounds like an extreme form of premature optimisation to me. Don't do it. As @vski said - (Assuming the choice is C#,C++ or C) stick with C# and use to C++ in the one place of code where  (in the extremely unlikely event ) that it might make a difference.

Edit : In response to the comment by @gbjbaanb :

This also leads to the question - "Is rewriting you Python App really required or is it optimizing prematurely."


答:
A good reason not to open source is that some of your source might be copyrighted. How often don't you search the web for a quick solution to a problem and just take the snippet of code you find?

Well, those might be copyrighted and I don't know if the author would like finding his code being relicensed under a different license.


答:
You need to take into account that open sourcing your code might require additional effort.

As an example, in this blog entry Sun/Oracle engineer describes efforts they had to take when open sourcing their code: Open Source or Dirty Laundry?

As we get ready to dive into the open source world, one of the many activities that's occurring is the preparation of the code for being open sourced. There are some obvious things that need to be done. For instance, our source code includes a mixture of code that we've written and code that we've licensed from others. We'll need to separate out the latter and open source only the appropriate pieces of code.

Another preparation activity is "scrubbing" the code of proprietary information, mentions of particular customers, developers, technologies etc. This is a little less obvious, but consider the following example:

```<code>/\*
 \* HACK - insert a time delay here because the stupid Intertrode
 \* Technologies framebuffer driver will hang the system if we
 \* don't. Those guys over there must really be idiots.
 \*/
</code>```

While all of the above might be true, we probably have a relationship of some sort with Intertrode Tech and having comments like this in the code could hurt our business somehow and so it should be removed. Arguably it shouldn't have been there in the first place, but now's the time to take it out.

Another part of the "scrubbing" activity is to remove profanity and other "undesirable" words...

Note all above changes had to be made to code that has been considered perfectly OK as closed source - that makes it pure extra effort so to speak.

Body:
You need to take into account that open sourcing your code might require additional effort.

As an example, in this blog entry Sun/Oracle engineer describes efforts they had to take when open sourcing their code: Open Source or Dirty Laundry?

As we get ready to dive into the open source world, one of the many activities that's occurring is the preparation of the code for being open sourced. There are some obvious things that need to be done. For instance, our source code includes a mixture of code that we've written and code that we've licensed from others. We'll need to separate out the latter and open source only the appropriate pieces of code.

Another preparation activity is "scrubbing" the code of proprietary information, mentions of particular customers, developers, technologies etc. This is a little less obvious, but consider the following example:

/\*
 \* HACK - insert a time delay here because the stupid Intertrode
 \* Technologies framebuffer driver will hang the system if we
 \* don't. Those guys over there must really be idiots.
 \*/

While all of the above might be true, we probably have a relationship of some sort with Intertrode Tech and having comments like this in the code could hurt our business somehow and so it should be removed. Arguably it shouldn't have been there in the first place, but now's the time to take it out.

Another part of the "scrubbing" activity is to remove profanity and other "undesirable" words...

Note all above changes had to be made to code that has been considered perfectly OK as closed source - that makes it pure extra effort so to speak.


问:
Is making my own copyright licence safe?
I've seen various open source libraries (actually I've seen it for assets as well) having a home-baked license in the following manner :

SomeGuy's License:
1. You can use this code freely in commercial projects and modify it as you wish, but not sell it
2.
  If you want to sell a modified version, drop me an email first, or give credits to me

Edit:

The above example is ambiguous, so I am giving another one, I want to know if 3 lines of license will hold some ground:

SomeGuy's License:
1. You can use this code in a commercial project as a 3rd party library
2.
  You can't sell it as a derivative work

I know that such license is not polished at all, for example the Creative Commons set of licenses seem to be short, but actually have some large legal stuff underneath it, but I wonder if at least some level of protection can be gained with a hobby license like that ?

My question is, could this hold any ground in the court, or would the corporative lawyers of the company X tear it apart ?

答: Licence alone (custom or GPL or whatever) doesn't provide safety. Only the means you put in fighting for it does.</p>


问:
Is embedded programming closer to electrical engineering or software development?
I am being approached with a job for writing embedded C on micro controllers. At first I would have thought that embedding programming is too low on the software stack for me, but maybe I am thinking about it wrong.

Normally I would have shrugged off an opportunity to write embedded code, as I don't consider myself an electrical engineer. Is this a bad assumption? Am I able to write interesting and useful software for embedded systems, or will I kick myself for dropping too low on the software stack?

I went to school for computer science and really enjoyed writing a compiler, thinking about concurrent algorithms, designing data structures, and developing frameworks. However, I am currently employed as a web developer, which doesn't scream the interesting things I just described. (I currently deal with issues like: "this check box needs to be 4 pixels to the left" and "this date is formatted wrong".)

I appreciate everyone's input. I know I have to make the decision for myself, I just would like some clarification on what it means to be a embedded programmer, and if it fits what I find to be interesting.

答:
I haven't done any business level embedded programming, but my Bachelor's was mostly about embedded systems, from which I have a few years of real experience. We used C on Atmel AVR and touched some Texas Instruments chips with VHDL, and had some theoretical stuff on ARM.

In what we had, it was roughly 50-60 percent programming (C), 20 percent planning/design (UML), and the rest was physical electronics (soldering, measuring, wiring, making cables, etc). I also agree it was very interesting and fun to do, and I actually wish I would also have a career in embedded systems. Alas, with a very small market in embedded systems, I had to resort to plain old Java EE.

But I digress; I would say the above mentioned percentages are quite close to real world jobs, since our teachers have their own enterprises, and also mentioned they will try to make it as realistic as possible. We even had random 180 degree turns in requirements mid-project, heh heh.

As for the stack. Knowing embedded programming will give you vast chances for creating your own and very real hardware products that you could have manufactured in real plants in Asia, then assembling them at your premises (be it at home or at your own company). It's highly interesting! You can also make many gadgets that will be helpful at home, such as movement controlled houselights, timer for a coffee machine to automatically prepare your morning joe, and so on. Exciting stuff indeed!


问:
scalablity of Scala over Java
I read an article that says Scala handles concurrency better than Java.

http://www.theserverside.com/feature/Solving-the-Scalability-Paradox-with-Scala-Clojure-and-Groovy

...the scalability limitation is confined specifically to the Java programming language itself, but it is not a limitation of the Java platform as a whole...

The scalability issues with Java aren't a new revelation. In fact, plenty of work has been done to address these very issues, with two of the most successful projects being the programming languages named Scala and Clojure...

...Scala is finding ways around the problematic thread and locking paradigm of the Java language...

How is this possible? Doesn't Scala use Java's core libraries which brings all the threading and locking issues from Java to Scala?

答:
The main thought of the referenced article is:

the scalability limitation is confined specifically to the Java programming language itself, but it is not a limitation of the Java platform as a whole. In fact, when programs are written to properly take advantage of the underlying Java platform, linear scalability isn't an issue.

If massive scalability is what you need, you can always take advantage of peripheral JVM languages like Scala and Clojure

I cannot agree with this. Using JVM languages like Scala implies:

using specific runtime support. This support can well be accessed from Java programs directly.

specific syntax, allowing concise expressions to make access to runtime support easy and less error-prone. This is true, and writing in pure Java is more verbose and requires more discipline, but the gap is not that dramatic.

In short, Scala handles concurrency better than Java because of using Actor model. Actor model can well be employed in Java. There are several actor libraries for Java, including Akka (used by Scala), so switching to Scala is not an imperative.

Using Actor model via pure Java has its own advantages:

easier debugging

possibility to customize the actor library used. This is especially true when the library is compact and thus understandable, like this one of mine: df4j

Title: scalablity of Scala over Java


问:
How would one start a website with robust and scaleable hosting?
This question is about hardware and hosting, and how to "bootstrap" them.

If you built a really great website, how could you have it hosted at low cost but so that it reassures customers that their data is safe and available.

As an example, what if I have a web application I developed for small companies to use for their accounting, a replacement for Quickbooks. Aside from getting a bunch of money from VCs or Angels, how would you be able to host this so that you could guarantee your customers that their data won't be lost, and the site will always be up so that they can always get to their data?

答: As a side note, I don't think you can guarantee the site will always be "up", even the biggest sites fail occasionally.  I personally think the cloud is the way to go, but it's not without its failures (Amazon EC2 is perhaps the most famous downtime so far).  See clouds down again for an idea.</p>

OwnerDisplayName: Richard DesLonde


答: I will choose first the tool that will make it easier to develop and to maintain (C#). As other said, there are options to optimize later on if needed (and you can optimize inside C#).


问:
For what problems is object oriented programming not a good choice?
Somewhat inspired by this question: For what common problems is functional programming not a good fit? - but nevertheless a question which I always wanted, but was too afraid to ask.

I've been in ... well, let's call it engineering software development practically all my life, and in all that time, although OO had always been there (well, most of that time) I've never had the need to use "its ways", nor to learn that paradigm. We've always used rather simple program structures, routines/functions/modules and although it is opposite to today's best practices managing those programs (programs up to roughly 300k LOC, nothing too big) never proved to be difficult, let alone impossible.

So I wanted to ask you, what would be the sorta problems for which object oriented paradigm would not be a good choice? In comparison to procedural programming ?

答:
Object oriented programming is procedural programming. The thing that makes OO object oriented is, as Robert Harvey mentions in a comment, that OO abstracts data in a particular way (to wit: bundling the functions that operate on a structure with that structure).

William Cook explains the difference between objects and abstract data types nicely.

So at the risk of sounding facile, I'd say that objects are not a good fit for when you need to easily extend the (number of) operations that perform on your data, and you don't need to have varying implementations of your data. Having said that, there are things you can do to bring the two closer together.


问:
Optimize strategies for xml parsing?
I am looking for general optimization tips and guidelines for xml parsing.

One of the optimization strategies is of course selecting the "right" parser. A detailed comparison between the available parsers for ios can be found here http://www.raywenderlich.com/553/how-to-chose-the-best-xml-parser-for-your-iphone-project.

However, I am currently trying to investigate general guidelines and tips on how to optimize by payloads to increase the performance as possible.

This question is similar to  (a question I have posted in the context of ios) but I have not got a sufficient answer. So this question is not in the context of any particular programming language.

答:
Firstly, do you need to use XML?  Or can you go with the more compact JSON format?

Another design principle is that you often don't need to send an entire document, just a snippet - you want to do as little serialising/de-serialising as possible.

If you're really looking into this in depth you can start investigating things like the shape/size of network packets and aligning your data to that etc.

Title: Optimize strategies for xml parsing?


问:
Save match details to SQLite or XML?

Possible Duplicate:

  XML vs SQL for small projects?

I'm making a (conceptual) system to simulate any kind of sports match (like soccer,basketball,etc) with actions (for example pass,pass,out,pass,score) so it will be like a real report. The main statistics (play time, number of actions etc.) I'm saving to a MySQL database, but the report itself, can contain more than 1000 actions per match.

To avoid millions of records in my database I'm thinking of saving the detailled report in a SQLite database or a XML file. For every match played, a file will be created. When a user request the match details, I read the file for details.

What is the best choice for this purpose? SQLite or XML?

答:
The thing with databases is, they are built for storing millions of records. Unless you have good reason not to, simplest solution would be... to store detailed match information in MySQL database itself.

SQLite is most likely good option if your application doesn't need one, global database but instead realies on local data stores (which doesn't seem to be the case). Something like application configuration, local user settings or private data. Being database aswell, SQLite is also good at storing millions of records. If you wish to, you might just aswell migrate entire thing to SQLite.

Finally, I'd advice against storing match data in XML. XML files usually take longer to process (but are more user-friendly), but indeed are often used to store generated reports. However, those reports base on some existing data - in your case that would be match details, which has to be stored somewhere. Generating XML report from data in XML doesn't really sound like thing to do, hence my advice.

Also, using database as storage (as opposed to XML file) will enable you to easily generate different content from the same data. Now you want reports - fine, this can be easily built (even to XML file) using content stored in database. Later you might need shortened report, or only report from first 15 minutes, or split in halves, anything. It might be easier to build those things using data from database, than in XML. Think of a XML in this case as end product (report for user), while raw database rows - something that lets you create those end products.

Title: Save match details to SQLite or XML?


答:
It's not given that your code will run faster all by itself just by using a lower level language like C or C++. Python or C# should fare just fine, and with good code can be nearly as fast as C or C++ code. If your code is too slow, then you can profile it to see what parts to optimize, but don't worry about that when choosing what language to use for implementation.

Instead of switching languages you'd probably fare much better spending some effort on buying a book for further education on the one you already know or best practices, profiling etc.

One thing that may be worth consideration though, is portability. Using C or C++ your code can be more portable, and have less dependencies on runtime environments etc. This may be of value to others using your code, as they don't have to install a big runtime environment or language just to run your program. If you assume most of your users will have these parts in place anyways, this also becomes a moot point.


答:
If your app deals with a lot of handles and connections you may prefer C++ for it's RAII resource management. Garbage collectors don't work for handles to shared resources. If you are using C# or java you are forced to de-volve into the old "malloc" style all over again with explicit release calls.

C++ deals with resource management in a cleaner and more elegant way that is not possible in other languages. C++ is light years ahead of C#. And there's no sign of C# or Java catching up as their best answer to RAII is "using" blocks which are not RAII, just a syntactic sugar over an explicit try/finally/close. It does not have the built in fail-safe of popping off the stack. ie you must remember to try/close it just as you always did, but with a nicer syntax.

I've seen countless C# and java systems fail because developers left connections and handles to the garbage collector...


答: A  solution that is scalable would be best suited for your case.Among the top solutions are Amazon EC2.You should examine every aspect of your application i.e database servers,bandwidth,application server and get an accurate picture of the resources you are using.This will help you plan your budget on what exactly you need presently and if in the future when your users increase.</p>

Title: How would one start a website with robust and scaleable hosting?

Body:
This question is about hardware and hosting, and how to "bootstrap" them.

If you built a really great website, how could you have it hosted at low cost but so that it reassures customers that their data is safe and available.

As an example, what if I have a web application I developed for small companies to use for their accounting, a replacement for Quickbooks. Aside from getting a bunch of money from VCs or Angels, how would you be able to host this so that you could guarantee your customers that their data won't be lost, and the site will always be up so that they can always get to their data?


答:
I find these answers that suggest EC2 (or other cloud solution) as an answer rather strange. Firstly, EC2 isn't a web-hosting environment. It will provide you with instances of virtual machines, from there you can build a platform to host your web application, e.g. install apache httpd or tomcat. This in itself will do nothing for resilience of your web application - you'd need to build a high-availability environment using multiple EC2 instances, including load balancers etc. as appropriate - this is not a simple deploy and forget scenario.

You really need to state what languages and frameworks you'll be using as this will affect how people answer your question.


问:
Why are side-effects considered evil in functional programming?
I feel that side effects are a natural phenomenon. But it is something like taboo in functional languages. What are the reasons?

My question is specific to functional programming style. Not all programming languages/paradigms.

答:
You've got it wrong, functional programming promotes limiting side effects to make programs easy to understand and optimize. Even Haskell allows you to write to files.

Essentially what I am saying is that functional programmers don't think side effects are evil, they simply think limiting the use of side effects is good. I know it may seem like such a simple distinction but it makes all the difference.

ContentLicense: CC BY-SA 2.5


问:
How do "custom software companies" deal with technical debt?
What are "custom software companies"?

By "custom software companies" I mean companies that make their money primarily from building custom, one off, bits of software. Example are agencies or middle-ware companies, or contractors/consultants like Redify.

What's the opposite of "custom software companies"?

The opposite of the above business model are companies that focus on long term products, whether they be deployable desktop/mobile apps, or SaaS software.

A sure fire way to build up technical debt:

I work for a company that attempts to focus on a suite of SaaS products. However, due to certain constraints we sometimes end up bending to the will of certain clients and we end building bits of custom software that can only be used for that client.

This is a sure fire way to incur technical debt. Now we have a bit of software to maintain that adds nothing to our core product.

If custom work is a sure fire way to build technical debt, how do agencies handle it?

So that got me thinking. Companies who don't have a core product as the center of their business model, well they're always doing custom software work. How do they cope with the notion of technical debt? How does it not drive them into technical bankruptcy?

答:
Custom software is not a guarantee of technical debt, but serving two masters is.

A custom software company will build a piece of software exactly fitted to the task at hand, deliver it, and maintain it if necessary. Truly custom software often doesn't need new features added very often.

The problem described in this question is when product companies build custom features into an otherwise generic product. If the product were wholly custom, it would only move when requirements at the one customer changed. If the product were wholly generic, it would move only when new features are added to make it more appealing. But when you have a custom feature in an otherwise generic product, you have two chunks of code, in close contact, that move at different speeds. Like tectonic plates that cause earthquakes, the interface between these code chunks is a "hot spot", ripe for problems.

OwnerDisplayName: andy


答: From your description, it sounds as if the bottleneck for performance here will be in I/O, and when it comes to the reads/writes here, neither language will show any significant difference. So if the performance of the intermediary code of modifying the data is your concern for performance, you could probably be modifying any read data while you continue to read more in a separate thread, making the choice of language here for performance fairly moot, IMO.</p>


答:
When the data that is being generated need to be further processed or used as data (i.e. for more reports or presentation) then store it in a Database. If SQLite isn't faster enough for millions of rows then use another database. SQLite should be ok, ref What are the performance characteristics of sqlite with very large database files?)

If the data you are generated will only ever be viewed and the processing that is performed on this data is styling, layout and filtering then XML is better.

If you are having trouble storing something efficiently in a database then the chances are that your data modelling is faulty.

Databases are really good at storing and indexing large amounts of data, XML isn't.

Title: Save match details to SQLite or XML?

Body:
Possible Duplicate:

  XML vs SQL for small projects?

I'm making a (conceptual) system to simulate any kind of sports match (like soccer,basketball,etc) with actions (for example pass,pass,out,pass,score) so it will be like a real report. The main statistics (play time, number of actions etc.) I'm saving to a MySQL database, but the report itself, can contain more than 1000 actions per match.

To avoid millions of records in my database I'm thinking of saving the detailled report in a SQLite database or a XML file. For every match played, a file will be created. When a user request the match details, I read the file for details.

What is the best choice for this purpose? SQLite or XML?


答:
Few to no languages make it impossible to cause side-effects.  Languages that were completely side-effect free would be prohibitively difficult (near to impossible) to use, except in a very limited capacity.

Why side-effects are considered evil?

Because they make it much more difficult to reason about exactly what a program does, and to prove that it does what you expect it to do.

At a very high level, imagine testing an entire 3-tier web site with only black-box testing.  Sure, it's doable, depending on the scale.  But there is certainly a lot of duplication going on.  And if there is a bug (that is related to a side-effect), then you could potentially break the entire system for further testing, until the bug is diagnosed and fixed, and the fix is deployed to the test environment.

Benefits

Now, scale that down.  If you were fairly good at writing side-effect free code, how much faster would you be at reasoning at what some existing code did?  How much faster could you write unit tests?  How confident would you feel that the code with no side-effects was guaranteed bug-free, and that users could limit their exposure to any bugs it did have?

If code has no side-effects, the compiler also may have additional optimizations that it could perform.  It may be much easier to implement those optimizations.  It may be much easier to even conceptualize an optimization for side-effect free code, which means that your compiler vendor might implement optimizations that are difficult-to-impossible in code with side effects.

Concurrency is also drastically simpler to implement, to automatically generate, and to optimize when code has no side-effects.  This is because all the pieces can be safely evaluated in any order.  Allowing programmers to write highly concurrent code is widely considered the next big challenge that Computer Science needs to tackle, and one of the few remaining hedges against Moore's Law.

Title: Why are side-effects considered evil in functional programming?

Body:
I feel that side effects are a natural phenomenon. But it is something like taboo in functional languages. What are the reasons?

My question is specific to functional programming style. Not all programming languages/paradigms.


问:
what is the term for the class in the bottom of a class hierarchy?
You have a class hierarchy:

D extends C which extends B which extends A, for example.

A would be the top class, but how about D?
I am looking for a short and concise way of describing the position of D within the hierarchy

Is it the most specific class? the deepest class in the hierarchy? the last subclass? final class?

The class might or might not be final (java) or sealed (c#). what matters is that it is the last one of the hierarchy at a particular moment. If a newer class (E) appears that extends D then the proposed term would apply to it. Also, there might be more than one class that fit this description (both D and E extends C), the term should apply to both classes.

答:
How about leaf class? http://en.wikipedia.org/wiki/Leaf_class

If you think of a base class as a "root" class, then the derived classes in the middle as branches, then calling these end/final classes "leaf" classes would make sense, no?


答:
I have received this email five years ago from one of my friend.

```<code>Email body:
</code>```

A newly joined trainee engineer asks his boss "what is the meaning of Appraisal?"

Boss: "Do you know the meaning of resignation?"

Trainee: "Yes I do"

Boss: "So let me make you understand what an appraisal is by comparing it with resignation"

```<code>Comparison study: Appraisal and Resignation
|---------------------------------+----------------------------------|
|       Appraisal                 |       Resignation                |
|---------------------------------+----------------------------------|
|     In appraisal meeting they   |    In resignation meeting they   |
|     will speak only about your  |    will speak only about your    |
|     weakness, errors and        |    strengths, past achievements  |
|     failures.                   |    and success.                  |
|---------------------------------+----------------------------------|
|     In appraisal you may need to|    In resignation you can easily |
|     cry and beg for even 2%     |    demand (or get even without   |
|     hike.                       |    asking) more than 10-20% hike.|
|                                 |                                  |
|---------------------------------+----------------------------------|
|     During appraisal, they will |    During resignation, they will |
|     deny promotion saying you   |    say you are the core member of|
|     didn't meet the expectation,|    team; you are the vision of   |
|     you don't have leadership   |    the company how can you go,   |
|     qualities, and you had      |    you have to take the project  |
|     several drawbacks in our    |    in shoulder and lead your     |
|     objective/goal.             |    juniors to success.           |
|---------------------------------+----------------------------------|
|     There is 90% chance for not |    There is 90% chance of getting|
|     getting any significant     |    immediate hike after you put  |
|     incentives after appraisal. |    the resignation.              |
|---------------------------------+----------------------------------|
</code>```

Trainee: "Yes boss enough, now I understood my future. For an appraisal I will have to resign ... !!!"

Body:
I have received this email five years ago from one of my friend.

Email body:

A newly joined trainee engineer asks his boss "what is the meaning of Appraisal?"

Boss: "Do you know the meaning of resignation?"

Trainee: "Yes I do"

Boss: "So let me make you understand what an appraisal is by comparing it with resignation"

Comparison study: Appraisal and Resignation
|---------------------------------+----------------------------------|
|       Appraisal                 |       Resignation                |
|---------------------------------+----------------------------------|
|     In appraisal meeting they   |    In resignation meeting they   |
|     will speak only about your  |    will speak only about your    |
|     weakness, errors and        |    strengths, past achievements  |
|     failures.                   |    and success.                  |
|---------------------------------+----------------------------------|
|     In appraisal you may need to|    In resignation you can easily |
|     cry and beg for even 2%     |    demand (or get even without   |
|     hike.                       |    asking) more than 10-20% hike.|
|                                 |                                  |
|---------------------------------+----------------------------------|
|     During appraisal, they will |    During resignation, they will |
|     deny promotion saying you   |    say you are the core member of|
|     didn't meet the expectation,|    team; you are the vision of   |
|     you don't have leadership   |    the company how can you go,   |
|     qualities, and you had      |    you have to take the project  |
|     several drawbacks in our    |    in shoulder and lead your     |
|     objective/goal.             |    juniors to success.           |
|---------------------------------+----------------------------------|
|     There is 90% chance for not |    There is 90% chance of getting|
|     getting any significant     |    immediate hike after you put  |
|     incentives after appraisal. |    the resignation.              |
|---------------------------------+----------------------------------|

Trainee: "Yes boss enough, now I understood my future. For an appraisal I will have to resign ... !!!"


答:
the deepest class in the hierarchy

Does it mean , this class can't be extended any further?  If yes, We call that as final class java.

Title: what is the term for the class in the bottom of a class hierarchy?

Body:
You have a class hierarchy:

D extends C which extends B which extends A, for example.

A would be the top class, but how about D?
I am looking for a short and concise way of describing the position of D within the hierarchy

Is it the most specific class? the deepest class in the hierarchy? the last subclass? final class?

The class might or might not be final (java) or sealed (c#). what matters is that it is the last one of the hierarchy at a particular moment. If a newer class (E) appears that extends D then the proposed term would apply to it. Also, there might be more than one class that fit this description (both D and E extends C), the term should apply to both classes.


答: How about the "last descendant" - if you're documenting something, just set out your terminology at the beginning or in a glossary.</p>


问:
Pattern for Accessing MySQL connection
We have an application which is C++ trying to access MySQL database.

There are several (about 5 or so) threads in the application (with Boost library for threading) and in each thread has a few objects, each of which is trying to access Database for its' own purpose. It has a simple ORM kind of model but that really is not an important factor here.

There are three potential access patterns i can think of:

There could be single connection object per application or thread and is shared between all (or group). The object needs to be thread safe and there will be contentions but MySQL will not be fired with too many connections.

Every object could initiate connection on its own. The database needs to take care of concurrency (which i think MySQL can) and the design could be much simpler. There could be two possibilities here.
a. either object keeps a persistent connection for its life OR
b. object initiate connection as and when needed.

To simplify the contention as in case of 1 and not to create too many sockets as in case of 2, we can have group/set based connections. So there could be there could be more than one connection (say N), each of this connection could be shared connection across M objects.

Naturally, each of the pattern has different resource cost and would work under different constraints and objectives.

What criteria should i use to choose the pattern of this for my own application?

What are some of the advantages and disadvantages of each of these pattern over the other?

Are there any other pattern which is better?

PS: I have been through these questions:

mysql, one connection vs multiple
and

MySQL with mutiple threads and processes

But they don't quite answer exactly what i am trying to ask.

答:
First of all I must say that per-thread connections (if its not persistence connections) is absolutely unsuccessful way of making system work faster unless it's a king of CGI application. Connection initialization could cost too much in the way of high-load. So if your question is

What criteria should i use to choose the pattern of this for my own
  application?

my answer is: we should always try to simplify our solutions, thus if your code simple and not suppose to be a high-load application - you can use simple in-place connection initialization operations; but in case of the high load applications persistence connections are preferred.

Are there any other pattern which is better?

Here is my receipt for "how to resolve the question".
For one of my web application I used some king of your 3rd variant mixed with 2nd one in the way of connections were living in the system.
So the strategy was quiet simple: on application init stage you create an Object, lets say a Database Connectors Pool (DCP) that is shared through threads and could serve up to N pre-created persistent connections. It could spawn as much connectors as needed according to application in-time behaviour. Unused connectors could be killed at run-time if needed.

Thus we have self-controlling connectors queue that is pretty fast for any high-load application.

Here is a simple example of how the pattern described myself above is realised in Python http://youdev.co/python-web-development-database-persistent-connections-how-to/

Title: Pattern for Accessing MySQL connection


问:
Mercurial release management. Rejecting changes that fail testing
Researching distributed source control management (specifically mercurial).
My question is more or less what is the best practice for rejecting entire sets of code that fail testing?

Example:

A team is working on a hello world program.  They have testers and a scheduled release coming up with specific features planned.

```<code>Upcoming Release:
   Add feature A
   Add feature B
   Add feature C
</code>```

So, the developers make their clones for their features, do the work and merge them into a QA repo for the testers to scrutinize.

Let's say the testers report back that "Feature B is incomplete and in fact dangerous",  and they would like to retest A and C.

End example.

What's the best way to do all this so that feature B can easily be removed and you end up with a new repo that contains only feature A and C merged together?

Recreate the test repo? Back out B? Other magic?

答:
You can use patch queues to cherry-pick stuff coming in, or you could just use hg backout to remove the changes of just a changeset (see the hg book and look for "hg backout" here).

The difference is that patch queues will allow B from never appearing in the history.

OTOH, you might be better off by encouraging "feature branches" for both features and bug fixes, then select what branches to integrate to the baseline.


问:
What popular "best practices" are not always best, and why?
"Best practices" are everywhere in our industry.  A Google search on "coding best practices" turns up nearly 1.5 million results.  The idea seems to bring comfort to many; just follow the instructions, and everything will turn out fine.

When I read about a best practice - for example, I just read through several in Clean Code recently - I get nervous.  Does this mean that I should always use this practice?  Are there conditions attached?  Are there situations where it might not be a good practice?  How can I know for sure until I've learned more about the problem?

Several of the practices mentioned in Clean Code did not sit right with me, but I'm honestly not sure if that's because they're potentially bad, or if that's just my personal bias talking.  I do know that many prominent people in the tech industry seem to think that there are no best practices, so at least my nagging doubts place me in good company.

The number of best practices I've read about are simply too numerous to list here or ask individual questions about, so I would like to phrase this as a general question:

Which coding practices that are popularly labeled as "best practices" can be sub-optimal or even harmful under certain circumstances?  What are those circumstances and why do they make the practice a poor one?

I would prefer to hear about specific examples and experiences.

答:
Don't reinvent the wheel is a widely mis-used dogma. Its idea is that if a suitable solution exists, use it instead of creating your own; in addition of saving effort, the existing solution is likely better implemented (bug-free, efficient, tested) than what you would come up with initially. So far, so good.

The problem is that a 100 % suitable solution seldom exists. A 80 % suitable solution might exist, and using it is probably fine. But how about 60 % suitable? 40 %? Where do you draw the line? If you don't draw the line, you could end up incorporating a bloated library to your project because you're using 10 % of its features - just because you want to avoid "reinventing the wheel".

If you do reinvent the wheel, you'll get exactly what you want. You'll also learn how to make wheels. Learning by doing shouldn't be underestimated. And in the end, a custom wheel may well be better than off-the-shelf generic wheel.


问:
What is the term for a really BIG source code commit?
Sometimes when we check the commit history of a software, we may see that there are a few commits that are really BIG - they may change 10 or 20 files with hundreds of changed source code lines (delta). I remember that there is a commonly used term for such BIG commit but I can't recall exactly what that term is. Can anyone help me? What is the term that programmers usually use to refer to such BIG and giant commit?

BTW, is committing a lot of changes all together a good practice?

UPDATE: thank you guys for the inspiring discussion! But I think "code bomb" is the term that I'm looking for.

答:
We probably call it a bad commit. :)

Bad Practice

And yes, that would generally be considered bad practice, as it has the negative effects of:

making it difficult to review,

making it difficult to grasp easily and quickly the commit's original intent,

making it difficult to see how it impacted the code to explicitly fix or address an issue,

making it difficult to know if the commit's size is due to noise of other possibly unrelated changes ot not (e.g. small cleanups or other tasks) .

Acceptable Cases

However, you can have cases where large commits are perfectly acceptable. For instance:

when merging across branches,

when adding new sources from another non-versioned codebase,

when replacing a large feature in-place (though you should rather do that in a branch, with smaller commits addressing different parts of the change, and then merge the whole thing back, so you can have a better window on the incremental development of the feature and the problems that may have been encountered along the way),

when refactoring an API impacting many descendent and consumer classes.

So, whenever possible, prefer "surgical strike"-types of commits (and link them to task IDs in your issue tracker!). If you have a valid reason, go ahead.

Apart from that, I actually don't know and don't think I ever heard a special name for a large commit. A monster-commit? A fat-commit?

Update: David Cary's answer links to notable IT actors using the term "code-bomb" (most importantly, Collins-Sussman, original creator of Subversion). Like that (though so far I can't say I heard if often).


答:
BTW, is committing a lot of changes all together a good practice?

Well, it's not good practice to hold onto changes for a long time, and implement a variety of features and bug fixes, and then commit them, which is one way a big commit could happen.

Another way this could happen is if a refactoring changes the signature of a widely-used function, and then all those have to be changed.  This isn't necessarily bad, and I wouldn't want developers to refrain from cleaning up the code for fear of crossing some threshold.

So, there's more to it than just looking at the number of files touched in a commit.

Title: What is the term for a really BIG source code commit?

Body:
Sometimes when we check the commit history of a software, we may see that there are a few commits that are really BIG - they may change 10 or 20 files with hundreds of changed source code lines (delta). I remember that there is a commonly used term for such BIG commit but I can't recall exactly what that term is. Can anyone help me? What is the term that programmers usually use to refer to such BIG and giant commit?

BTW, is committing a lot of changes all together a good practice?

UPDATE: thank you guys for the inspiring discussion! But I think "code bomb" is the term that I'm looking for.


问:
How do you put a database online?
I have a very beginner question regarding web development.

I've had some experience with JSP, Hibernate, and MAMP to create a simple system for tracking inventory and sales. But this was all done locally on one computer.

This time, I want to create a system that could be accessible online. It's to help my mother track her business wherever she goes. So there would be similar aspects like tracking inventory and sales. I understand that you have to have a server in which to host all the files in. But I don't understand how you can access your database online. Or what sorts of applications or products should be used.

Currently the host of my database is localhost. How do put it online such that you can still do CRUD operations? Are there any guides to do this?

答: Many hosting providers will provide you with a database (e.g. MySQL). When you host your application on their server, you will still likely use localhost as the host because the application and database will be on the same server.</p>

Title: How do you put a database online?


答: The term I've heard is "chunky check-ins". And I'm not a fan of them. I like smaller commits that ensure nothing else is broken at reasonable step in a project. The big commit is generally fraught with issues that reverberate for some time out of when that happens.


答:
Writing your functions/methods without side effects - so they're pure functions - makes it easier to reason about the correctness of your program.

It also makes it easy to compose those functions to create new behaviour.

It also makes certain optimisations possible, where the compiler can for instance memoise the results of functions, or use Common Subexpression Elimination.

Edit: at Benjol's request: Because a lot of your state's stored in the stack (data flow, not control flow, as Jonas has called it here), you can parallelise or otherwise reorder the execution of those parts of your computation that are independent of each other. You can easily find those independent parts because one part doesn't provide inputs to the other.

In environments with debuggers that let you roll back the stack and resume computing (like Smalltalk), having pure functions means that you can very easily see how a value changes, because the previous states are available for inspection. In a mutation-heavy calculation, unless you explicitly add do/undo actions to your structure or algorithm, you cannot see the history of the computation. (This ties back to the first paragraph: writing pure functions makes it easier to inspect the correctness of your program.)


问:
Should a server "be lenient" in what it accepts and "discard faulty input silently"?
I was under the impression that by now everyone agrees this maxim was a mistake. But I recently saw this answer which has a "be lenient" comment upvoted 137 times (as of today).

In my opinion, the leniency in what browsers accept was the direct cause of the utter mess that HTML and some other web standards were a few years ago, and have only recently begun to properly crystallize out of that mess. The way I see it, being lenient in what you accept will lead to this.

The second part of the maxim is "discard faulty input silently, without returning an error message unless this is required by the specification", and this feels borderline offensive. Any programmer who has banged their head on the wall when something fails silently will know what I mean.

So, am I completely wrong about this? Should my program be lenient in what it accepts and swallow errors silently? Or am I mis-interpreting what this is supposed to mean?

The original question said "program", and I take everyone's point about that. It can make sense for programs to be lenient. What I really meant, however, is APIs: interfaces exposed to other programs, rather than people. HTTP is an example. The protocol is an interface that only other programs use. People never directly provide the dates that go into headers like "If-Modified-Since".

So, the question is: should the server implementing a standard be lenient and allow dates in several other formats, in addition to the one that's actually required by the standard? I believe the "be lenient" is supposed to apply to this situation, rather than human interfaces.

If the server is lenient, it might seem like an overall improvement, but I think in practice it only leads to client implementations that end up relying on the leniency and thus failing to work with another server that's lenient in slightly different ways.

So, should a server exposing some API be lenient or is that a very bad idea?

Now onto lenient handling of user input. Consider YouTrack (a bug tracking software). It uses a language for text entry that is reminiscent of Markdown. Except that it's "lenient". For example, writing

```<code>- foo
- bar
- baz
</code>```

is not a documented way of creating a bulleted list, and yet it worked. Consequently, it ended up being used a lot throughout our internal bugtracker. Next version comes out, and this lenient feature starts working slightly differently, breaking a bunch of lists that (mis)used this (non)feature. The documented way to create bulleted lists still works, of course.

So, should my software be lenient in what user inputs it accepts?

答:
My UI experience comes mostly from desktop systems.  Web sites are different, though I've seen a few sites that could challenge a desktop system.  But for what it's worth:

I've found that error messages should be the very last resort; an ideal system would not have them at all.  The best thing to do is not allow bad entries in the first place:  the user can't enter "green" if he's selecting from a dropdown list of months.  He can't push a grayed out button.

The next best thing to do is accept the bad data.  Say you're displaying a histogram of daily sales for a month.  After user input, the graph covers a century and the bar a century out is 10 times higher than the others.  The user now knows he did something wrong and, futher, knows a lot more about what he did wrong than any message could tell him.   When entry is graphical--by dragging a mouse, for instance--this kind of feedback still works and is invaluable.  A bunch of the inputs may be invalid, but using this method the user gets instant, detailed feedback on the results of each mouse position.

All that said, sometimes the user needs to know why the button is grayed out so he can't push it.  Then there's no help for it (if there is, let me know) but to ungray the button and, when he clicks on it, give him an good explanation of why the button isn't working at the moment.

OwnerDisplayName: romkyns


问:
Design pattern for an automated mechanical test bench
Background

I have a test fixture with a number of communication/data acquisition devices on it that is used as an end of line test for a product.

Because of all the various sensors used in the bench and the need to run the test procedure in near real-time, I'm having a hard time structuring the program to be more friendly to modify later on. For example, a National Instruments USB data acquisition device is used to control an analog output (load) and monitor an analog input (current), a digital scale with a serial data interface measures position, an air pressure gauge with a different serial data interface, and the product is interfaced through a proprietary DLL that handles its own serial communication.

The hard part

The "real-time" aspect of the program is my biggest tripping point. For example, I need to time how long the product needs to go from position 0 to position 10,000 to the tenth of a second. While it's traveling, I need to ramp up an output of the NI DAQ when it reaches position 6,000 and ramp it down when it reaches position 8,000. This sort of control looks easy from browsing NI's LabVIEW docs but I'm stuck with C# for now. All external communication is done by polling which makes for lots of annoying loops.

I've slapped together a loose Producer Consumer model where the Producer thread loops through reading the sensors and sets the outputs. The Consumer thread executes functions containing timed loops that poll the Producer for current data and execute movement commands as required. The UI thread polls both threads for updating some gauges indicating current test progress.

Unsure where to start

Is there a more appropriate pattern for this type of application?

Are there any good resources for writing control loops in software (non-LabVIEW) that interface with external sensors and whatnot?

答:
This is a good question that relies heavily on context. My approach will be to describe the patterns available for your review. The following is a high-level overview.

I'm looking in the pinnacle book Design Patterns - Elements of Reusable Object-Oriented Software, by Gamma, Helm, Johnson, and Vlissides. It is written for C++ but would be largely applicable in C#.

Anti-Pattern. One down-side to design patterns is the potential to apply them just for the sake of doing so. It is important to realize that these patterns solve specific problems, and should not be implemented unless that problem exists. Doing so would be an anti-pattern.

Facade. 'Provide a unified interface to a set of interfaces in a subsystem.' This sounds potentially useful for you to group all of your disparate Objects into a single interface. This will simplify your ability to access them should they all be grouped into a 'Singleton' called, something like, Sensors or Consumers.

Singleton. Guarantee a single instance of an object. This may be helpful in collaboration with other patterns. This can be commonly used as Manager object, or a Proxy, for example.

Proxy. 'Provide a surrogate placeholder to control access.' This may be helpful to review to abstract your connection points.

Chain of Responsibility, Observer, Publisher Subscriber. These are the notion of decoupling interface dependencies. One of these may be helpful for you between your Producer Consumer so that your producer is not hung up waiting for a consumer to run, or respond. Instead what can happen is the events allow a separation between the two.

Strategy. 'A family of algorithms, encapsulate each one, and make them interchangable.' This may be helpful for you if you have different behaviors that need to change dynamically for different states.

Iterator. This may provide some optimization for your accumulation of loops.

Again, this is a high level overview. I am certain that some of these will not be a good fit for your implementation, but reviewing them can give a good idea of what optimization's are available.

Lastly, keep in mind that these patterns are best applied at Design Time. If you have a rather robust legacy implementation a high level of complex refactoring would be a reasonable expectation.

Also take a look around for C# specific patterns. Often times the original patterns posed above morph as they transcend languages. They may be essentially the same pattern, but with different implementation specific requirements, they can change names. Like PubSub/Observer.

Hope that helps.
All the best!
Nash


答:
In web applications, the database is rarely accessed directly by external clients. Clients interact only with the web frontend, which in turn queries or updates the database. The latter may sit on the same physical server, or (in high traffic sites, to balance the load) on a different - but only locally accessible - server.

This has (at least) the following advantages:

no need to develop a special client - you only need a web browser

tighter security (the only intrusion point is your web app)

Title: How do you put a database online?

Body:
I have a very beginner question regarding web development.

I've had some experience with JSP, Hibernate, and MAMP to create a simple system for tracking inventory and sales. But this was all done locally on one computer.

This time, I want to create a system that could be accessible online. It's to help my mother track her business wherever she goes. So there would be similar aspects like tracking inventory and sales. I understand that you have to have a server in which to host all the files in. But I don't understand how you can access your database online. Or what sorts of applications or products should be used.

Currently the host of my database is localhost. How do put it online such that you can still do CRUD operations? Are there any guides to do this?


问:
What is the main difference between HAS_MANY and BELONGS TO relationship in mysql?
After making little progress in web development and php I figured out if I can make my grip strong on database designing, I will be able to reduce much code and time in developing the application. But I happen to be a dumb in database designing so can anyone please help to differentiate between has many and belongs to relationship. They seems quite same to me</p>

答: A database relationship usually has 2 tables that are linked together. One table (the "belongs to"-side) contains a foreign key to the other table (the "has many"-side). So most relations have both sides.</p>