问:
What was the earliest use of cryptographic tokens in URLs?
I was wondering: it now seems to be more and more common to see people/framework putting cryptographic tokens in the URLs their webapps are generating (to prevent quite effectively against quite some attacks).  It is advised by OWASP etc.

However I was wondering: what was the earliest known usage of this technique (specifically inside Web URLs)?

I've found a message on Usenet dating from 2003 (for a Java webapp) describing the technique by someone who, obviously, independently discovered it (he's asking for know "prior art"):

```<code>Every single link in any of the jsp page transmitted to the client is
generated with a checksum that act as a signature for the URL
</code>```

The description clearly shows it's a cryptographic checksum being used (and the way it works seems very close to the modern "tokens" OWASP advocates etc.).

Interestingly enough the person describing it says that "it cannot hurt" but that it may not be that useful since that Java is relatively immune to buffer overflow.  The author couldn't have imagined that this technique would has stopped most XSS and CSRF exploits dead in their track way before these techniques were even invented...

So my question is simple: what are the oldest know usage of this technique you know of?

EDIT Upon re-reading the old description, I think in that message from 2003 the technique is even more advanced than the "per-session tokens" that OWASP advocates in that every single parameters are checked against forgery (but I'm not sure)

答:
PHP (as non JAVA) language that was developed for web applications uses cryptographic hashes in URLs to identify and track a user since 1998. It is known as session ID.

Java Enterprise 1.0 was released in December 1999 and also uses session IDs in URLs.

But I am still unsure what you EXACTLY want to know.


问:
Suggesting albums based on friends' top ten lists
Just wondering if someone could suggest a good algorithm in the collaborative filtering vein that I could use to suggest music choices based on top ten lists.

This is a personal project, I am a member of a private music blog where most of the users recently submitted "best of 2011" lists.  The lists range in size (say 10-50 albums) and are not ranked.  Have around 100 lists.

Basically hoping to give each user some recommendations based on the correlation of their list with everyone else's.

答:
Quite simple really -

Firstly represent each user with a uid, and each track in the list as a song id. You will now have your user / item matrix representation.

For each user in your dataset run jaccard similarity.  It's very simple, it just looks at intersections of songs between users.

Then take the X most similar users which can form the users nearest neighbourhood. After which  you just do a weighted count for each song that exists. The weighting for each count is based on the similarity score. The songs with the highest scores are what you should recommend.

This approach doesn't require rankings or scores associated with each song.

ContentLicense: CC BY-SA 3.0


问:
Make a big deal out of == true?
There is a colleague of mine who constantly writes:

```<code>if (someBool == true)
</code>```

It drives me up the wall!  Should I make a big deal of it or just drop it?

答:
Typically, you don't want to make a big deal out of coding conventions unless said convention is somehow impeding the project in a significant way.  I've seen many a heated argument escalate over things as small as code regions and leading underscores.

That being said, I see no issue with adding == true to a conditional statement.  As a matter of fact, I am in the habit of using == false as opposed to a leading exclamation point when testing for negative conditions.  I think it's more readable.

If there is an established convention, I say follow it unless there is reason to change.  However, it's not really worth raising a big stink about.

ContentLicense: CC BY-SA 2.5

Title: Make a big deal out of == true?


问:
What to do with estimation of incomplete story?
I am part of a development team that is relatively new to Scrum, suppose that at the end of the sprint a few large stories are either in progress or were not accepted by the PO.

Firstly, what happens with those user stories? Do you just carry them over into the next sprint?

If so, should they be re-estimated? In my view the work remaining on these user stories can be minimal or a lot? If not, why not?

EDIT: In my specific case, the stories were not completed because of an impediment that was a few days long, not because of user story underestimation. For those of you that it may help, we are using VersionOne

答:
Firstly, what happens with those user stories? Do you just carry them over into the next sprint?

It depends.

The Scrum Guide states that, at the end of a Sprint, unfinished Product Backlog Items are moved back into the Product Backlog and the Product Owner ensures the correct ordering of the work. However, practically speaking, if the work remains ordered high in the Product Backlog and the work is also consistent with the Product and Sprint Goals, it would be highly likely to be selected for the next Sprint at Sprint Planning.

Since one of the purposes of agile methods like Scrum is to maximize the delivered value while reducing the time, it all comes down to how much value is added by finishing those stories.

Regardless of what happens, you still need to strive for a potentially shippable product at the end of the sprint. This might mean rolling back to ensure that the end-of-sprint product passes all tests and the completed features are fully usable by the user without any significant problems.

If so, should they be re-estimated? In my view the work remaining on these user stories can be minimal or a lot? If not, why not?

I would not reestimate because, in Scrum, a Product Backlog Item is either done (designed, developed, tested, and acceptable) or it's not done. If there's no concept of partially complete, there's no way to determine how much work is remaining on the story. You estimated the work that you thought you can do, so leave this data point in and make it a point to discuss why the estimate was off in your Sprint Retrospective and try to avoid making that mistake for future sprints.

ContentLicense: CC BY-SA 4.0


答:
Typically, it is up to the elected Scrum master to decide what is to become of the tasks that have overrun a sprint, obviously after consulting the rest of the team and the project sponsor/product owner. At the end of a sprint, it's a time to review what the priorities are. It's possible the story in question is of a lesser priority than a new/existing story and it is to be put back on the tracker as 'ongoing' or whatever label your tracker uses, indicating that this story is to be followed up at another point in time. Alternatively the story may be descoped completely.  You haven't mentioned what tracker you are using, but most of the ones I've seen allow you to set a story to 'descoped' if it's no longer part of the project.

Secondly, since your team is new to Scrum, this is all part of the learning process. You've now recognised that some stories are too large, so your team will take more time to break the stories down. It's typically the onus of the scrum master to make sure this happens.  The Scrum master will also need to consult the project sponsor/product owner with incomplete stories to try and break them down further or get the final say on descoping them entirely.

In my team, a new Scrum master is elected every 2 weeks (sprint), so everyone gets a shot at managing tasks, organising Scrum meetings and ensuring everyone submits progress reports. I'm hoping that's the case in your own team, it's certainly a good experience.

Title: What to do with estimation of incomplete story?

Body:
I am part of a development team that is relatively new to Scrum, suppose that at the end of the sprint a few large stories are either in progress or were not accepted by the PO.

Firstly, what happens with those user stories? Do you just carry them over into the next sprint?

If so, should they be re-estimated? In my view the work remaining on these user stories can be minimal or a lot? If not, why not?

EDIT: In my specific case, the stories were not completed because of an impediment that was a few days long, not because of user story underestimation. For those of you that it may help, we are using VersionOne


问:
What is the difference between user stories and features?
Playing with icescrum, I realised that I do not understand the difference between user stories and user features.

Can someone explain the difference?

答:
The two terms are closely related, but there are some differences.

First, they come from different domains. The term "feature" is a fairly general term for some part of the functionality of a software, whereas "user story" was invented for and is really only used in the context of agile software development.

In practice, they very often coincide, in that one user story consists of implementing a certain feature.

However, in some situations they can be different:

Often, a feature is too much work for a single user story. User stories should not be too big (generally not more than a few days, max 1-2 weeks of work). Obviously many features are much larger. In that case a feature will be implemented across many user stories. Some people use "epics" to group user stories together, in that case you could say that the feature is an epic.

Non-functional requirements (performance, security, compatibility etc.) can also be handled as user-stories (though this is not universally accepted). In that case the result of the user story would not normally be called a feature (unless you call "our application rarely crashes" a feature).

OwnerDisplayName: VJo


问:
How do you prevent the piracy of your software?
Is it still worth it to protect our software against piracy? Are there reasonably effective ways to prevent or at least make piracy difficult?</p>

答: I think, the solutions is placing all interested code in the server side and use thin client.  </p>


问:
Is this the correct approach to an OOP design structure in php?
I'm converting a procedural based site to an OOP design to allow more easily manageable code in the future and so far have created the following structure:

```<code>/classes
/templates
index.php
</code>```

With these classes:

```<code>ConnectDB
Games
System
User
User   -Moderator
User   -Administrator
</code>```

In the index.php file I have code that detects if any $_GET values are posted to determine on which page content to build (it's early so there's only one example and no default):

```<code>function __autoload($className) {
    require "classes/".strtolower($className).".class.php";
}

$db = new Connect;
$db->connect();

$user = new User();

if(isset($_GET['gameId']))
{
    System::buildGame($gameId);
}
</code>```

This then runs the BuildGame function in the system class which looks like the following and then uses gets in the Game Class to return values, such as $game->getTitle() in the template file template/play.php:

```<code>function buildGame($gameId){

    $game = new Game($gameId);
    $game->setRatio(900, 600);

    require 'templates/play.php';
}
</code>```

I also have .htaccess so that actual game page url works instead of passing the parameters to index.php

Are there any major errors of how I'm setting this up or do I have the general idea of OOP correct?

答:
You might want to employ an autoloader to load all your classes for you.

You could see how I tried to do it in my (m)vc.

OwnerDisplayName: Neal


答:
As far as OOP goes, there's never really a right or wrong way. There's always more roads that lead to Rome.

However, there are some caveats to avoid. Your System class looks like a God object, which is a so-called  'anti-pattern'. Best to avoid those. Also, I suspect that you're using $db and $user as global variables -- those are not encouraged in OOP. It's best to pass the DB handle to the classes that need it, either upon construction or for instance with a setDatabase() method (this is called Dependency Injection, and makes your classes easier to oversee, maintain and debug).

Finally, an autoloader might make your job as a programmer a little bit easier. This will take the job of doing the require calls out of your hands -- and also forces you to structure your code in a logical manner :)

Title: Is this the correct approach to an OOP design structure in php?

Body:
I'm converting a procedural based site to an OOP design to allow more easily manageable code in the future and so far have created the following structure:

```<code>/classes
/templates
index.php
</code>```

With these classes:

```<code>ConnectDB
Games
System
User
User   -Moderator
User   -Administrator
</code>```

In the index.php file I have code that detects if any $_GET values are posted to determine on which page content to build (it's early so there's only one example and no default):

```<code>function __autoload($className) {
    require "classes/".strtolower($className).".class.php";
}

$db = new Connect;
$db->connect();

$user = new User();

if(isset($_GET['gameId']))
{
    System::buildGame($gameId);
}
</code>```

This then runs the BuildGame function in the system class which looks like the following and then uses gets in the Game Class to return values, such as $game->getTitle() in the template file template/play.php:

```<code>function buildGame($gameId){

    $game = new Game($gameId);
    $game->setRatio(900, 600);

    require 'templates/play.php';
}
</code>```

I also have .htaccess so that actual game page url works instead of passing the parameters to index.php

Are there any major errors of how I'm setting this up or do I have the general idea of OOP correct?

OwnerDisplayName: Rijk


答: You might take a look at an MVC... you're already splitting your templates and classes for the View and Model/Controller) components, but look at splitting your classes into models and controllers</p>

OwnerDisplayName: Mark Baker


问:
Overcome clumsiness in writing code
I believe this is a little related with this question: How to be a zero-bug programmer?.
But I believe this is more regarding clumsiness in programming because I know it is impossible to become a zero bug programmer.

Often, I write a very buggy code caused by my own clumsiness. For example in writing a currency rate conversion function, a trivial function. I can code the function that running well given the correct value. But sometime I just forgot to validate some unexpected-but-reasonable values.

So are there any ways for clumsy programmer like me to write and test the code more thoroughly?

Additional
I see a lot of people suggesting to write unit test or using TDD approach. But writing unit-test not always goes well because of clumsiness isn't it? I don't because I once tried to write unit-test, but still often bumps with bugs.

答:
Think more about the requirements. Few people are really clumsy or unable to think of bugs; most just don't take the time to think about the appropriate aspects. If you take a little time and just think about the requirements of a function, you'll discover most of the necessary aspects.

Test-driven development is a hip and well-documented approach to get you focused on thinking about low-level requirements first.

Title: Overcome clumsiness in writing code


答:
Try a different development approach: Test-Driven Development (TDD).

a software development process that relies on the repetition of a very short development cycle: first the developer writes an (initially failing) automated test case that defines a desired improvement or new function, then produces the minimum amount of code to pass that test, and finally refactors the new code to acceptable standards...

Test-driven development is related to the test-first programming concepts of extreme programming, begun in 1999, but more recently has created more general interest in its own right.

Programmers also apply the concept to improving and debugging legacy code developed with older techniques...

Write test cases and use unit tests to prevent bugs from materializing.

Title: Overcome clumsiness in writing code

Body:
I believe this is a little related with this question: How to be a zero-bug programmer?.
But I believe this is more regarding clumsiness in programming because I know it is impossible to become a zero bug programmer.

Often, I write a very buggy code caused by my own clumsiness. For example in writing a currency rate conversion function, a trivial function. I can code the function that running well given the correct value. But sometime I just forgot to validate some unexpected-but-reasonable values.

So are there any ways for clumsy programmer like me to write and test the code more thoroughly?

Additional
I see a lot of people suggesting to write unit test or using TDD approach. But writing unit-test not always goes well because of clumsiness isn't it? I don't because I once tried to write unit-test, but still often bumps with bugs.


答: I prefer not placing the extra == true, but sometimes I accidentally include it and don't notice it.  The person may not have noticed and accidentally placed them.  I reread my code and sometimes notice that I placed the extra == true so I remove that == true.  I sometimes don't notice it and would happily welcome someone telling me I placed it redundantly. </p>

Title: Make a big deal out of == true?

Body:
There is a colleague of mine who constantly writes:

```<code>if (someBool == true)
</code>```

It drives me up the wall!  Should I make a big deal of it or just drop it?


答:
Spend a little time as a tester - it will teach you to get into the "edge-case" mentality

Then put all your edge cases into unit tests for a TDD approach..

In addition to TDD, I think reading about Defensive Programming would be helpful too. Learning to assert your preconditions and postconditions in every method is a good practice, and be strict! :)

Title: Overcome clumsiness in writing code


问:
Sort algorithms that work on large amount of data
I am looking for sorting algorithms that can work on a large amount of data, i.e. that can work even when the whole data set cannot be held in main memory at once.

The only candidate that I have found up to now is merge sort: you can implement the algorithm in such a way that it scans your data set at each merge without holding all the data in main memory at once. The variation of merge sort I have in mind is described in this article in section Use with tape drives.

I think this is a good solution (with complexity O(n x log(n)) but I am curious to know if there are other (possibly faster) sorting algorithms that can work on large data sets that do not fit in main memory.

EDIT

Here are some more details, as required by the answers:

The data needs to be sorted periodically, e.g. once in a month. I do not need to insert a few records and have the data sorted incrementally.

My example text file is about 1 GB UTF-8 text, but I wanted to solve the problem in general, even if the file were, say, 20 GB.

It is not in a database and, due to other constraints, it cannot be.

The data is dumped by others as a text file, I have my own code to read this text file.

The format of the data is a text file: new line characters are record separators.

One possible improvement I had in mind was to split the file into files that are small enough to be sorted in memory, and finally merge all these files using the algorithm I have described above.

答:
External R-Way merge as in the UNIX sort command is a good alternative.
From your formulation, I'm not sure if that is the algorithm you meant with "merge sort", and if you don't know it, have a look.


答:
Testing is important but the testing itself will require a patience and an attention to details and so it does not go well with clumsiness, to start with. I'd rather suggest using languages with stricter type systems (in addition to the testing, not instead of it).

Stupid coding mistakes are very rare even for languages like Haskell - if it compiles at all, it is likely to run as expected. And such an errors are nearly impossible for the languages with stricter type systems, like Agda or Coq.

Title: Overcome clumsiness in writing code


问:
Developing using a non-official kit on the Android?
I have been doing some research on developing on the Android platform and found that the only way to develop an app using C++ is using the NDK. I also came to know that the NDK has limited support to C/C++, with C++ having even lesser support than C.
Here's the problem. I need to develop using C++ as I'm not very familiar with Java. In fact, not familiar at all. I'm still 18, so I don't have much experience with many programming languages. After doing some more research I have found a non-official NDK, called the NDK-CrystaX that implements more support for C/C++ than the official NDK. Before I start using I have to know if it would be legal to use this custom NDK in an Android app and still be able to sell it on the Android Marketplace. Is it? Or is it not?
Another solution would be if the newer releases of the NDK had full support for C/C++. But I'm not sure of that either, so I'm seeking your generosity again and asking you to share your knowledge on this too.</p>

答:
I think you'll be better off just learning Java as you learn to make Android apps. The stuff you know of C++ won't really get in your way of understanding Java.

I know it seems hard to learn a new language AND a new platform all in one go, but if you try to do it in C++, you have have an third problem: understanding the mapping from Java (which the platform is designed to support) to C++ (which it isn't). I've no idea, for instance, how memory management is handled in C++ apps for Android, as it relates to the base API.

Support will be easier for you if you stick to Java as well - most developers tend to use the 'default' toolchain (due to laziness more than anything, I suspect), so you'll have the most help available if you are also using the default toolchain.


答:
Here's some good practises:

Step outside of the system

Enumerate all alternatives

Find the border of the system

Consider whole state space

Accuracy in deciding types - only allow exactly what was required

Consider path from input to output -- don't break the path.

Title: Overcome clumsiness in writing code


答:
In addition to TDD, I'd advise going back to the code a day or two after you've written it, and take a look at what your tests check for and what the function itself checks for.  When coding, you may have a very specific idea of how the function will be called, which may become vaguer if you take some time.  In addition to that, this is a great chance to take a look at how well-documented the function is, and add comments if you don't understand why it works.

You could also try coding with a Design by Contract framework, which can help catch some errors -- in your example, perhaps checking that the sign of the result is equal to the sign of the input, and that the result (if it's a float) is not NaN or infinity.

Title: Overcome clumsiness in writing code


问:
Is it worth learning C++ in depth JUST for a career in low latency trading?
I am interested in ultra high frequency trading and Java is the language I know best.

I was always under the impression I would have to perfect my C++ skills in order to work within the ultra high frequency domain (no pun intended) because a lot of job specs seemed to ask for this.

Elsewhere on the internet i have seen people comment that Java is actually preferred because you can find Java developers much easier. However, I thought this a bad argument because in terms of ultra high frequency, you need to grab an order as soon as possible and designing your system based upon the ease of finding programmers isn't going to achieve what you need in terms of latency.

So, would you say I would be best off concentrating on Java, or is it unavoidable to specialise in C++ in order to get into this career?

答: Hardware is getting faster, but the demand for computing power by big finance institution is growing even faster. I know someone (not that well) who writes low-latency trading systems in C++. Those are not general-purpose systems. They buy the best hardware there is, max out RAM and study the details of the particular architecture each time. If it had to work any faster, they would have to do it as a specialized FPGA. So, ultra low latency trading will force you to learn new hardware all the time, which is transient knowledge IMO. Look for Java positions perhaps? You'll still need to know C++.</p>


答:
Without more specifics "Merge Sort" is probably the best answer you will get, however you can implement something much smarter depending on your requirements.

For instance, can you simply create an in-memory index of the file then copy all the values at once, caching the location of various key values?  Does 1/2 fit in memory at once, or 1/1000000?  If it's the second one then you might not be able to fit an index in memory, if the first then you could sort both halves more efficiently then merge them together in a single last step.

Hell, since you didn't specify it it's possible that your data is all in a database, if so you can just create an index table and call it good (I'm guessing this isn't the case, but just pointing out that your situation is critical to resolving a complicated problem like this).

If you want to do it just once and are looking for a very quick hack it sounds like that external merge sort would be a good start if you are running unix (since it's apparently built in)

If you have to keep it in order and are always adding a single record then an insertion sort will be necessary (Adding a single record to sorted data is always an insertion sort).

Can you control the code that "Reads" the data?  If so then many forms of indexing (rather than sorting by moving data around on the disk) will help A LOT (will actually be an absolute requirement).

So:

In place or multiple file?

One time, periodical or keep it sorted at all times?

How much bigger than memory (How many memory-loads to get through the entire data set)?

Is it in a database?  Can it be?

Do you control the code that reads the data, or will others be dumping a file directly?

File format? (Text?  Fixed record?)

Any other special circumstances I didn't ask about?

Title: Sort algorithms that work on large amount of data

Body:
I am looking for sorting algorithms that can work on a large amount of data, i.e. that can work even when the whole data set cannot be held in main memory at once.

The only candidate that I have found up to now is merge sort: you can implement the algorithm in such a way that it scans your data set at each merge without holding all the data in main memory at once. The variation of merge sort I have in mind is described in this article in section Use with tape drives.

I think this is a good solution (with complexity O(n x log(n)) but I am curious to know if there are other (possibly faster) sorting algorithms that can work on large data sets that do not fit in main memory.

EDIT

Here are some more details, as required by the answers:

The data needs to be sorted periodically, e.g. once in a month. I do not need to insert a few records and have the data sorted incrementally.

My example text file is about 1 GB UTF-8 text, but I wanted to solve the problem in general, even if the file were, say, 20 GB.

It is not in a database and, due to other constraints, it cannot be.

The data is dumped by others as a text file, I have my own code to read this text file.

The format of the data is a text file: new line characters are record separators.

One possible improvement I had in mind was to split the file into files that are small enough to be sorted in memory, and finally merge all these files using the algorithm I have described above.


答:
You should definitely stop this bad habit. Gently...

It's easy to forget to write the double equal signs, turning the code into:

```<code>if (someBool = true)
</code>```

In C# for example this will only produce a warning, not an error. So unless you treat warnings as errors the code will run, set the variable to true and always enter the condition.

Title: Make a big deal out of == true?

Body:
You should definitely stop this bad habit. Gently...

It's easy to forget to write the double equal signs, turning the code into:

if (someBool = true)

In C# for example this will only produce a warning, not an error. So unless you treat warnings as errors the code will run, set the variable to true and always enter the condition.


问:
Best Practices for Redesigning a Database
I'm aware of some general best practices when designing a database for an application, but what about redesigning?

I'm on a team tasked with re-designing an internal business application, though despite me saying "internal," I'm unfortunately many, many layers of people away from contact with the actual users of the system.

The current program is in Oracle Forms, scattered across a bunch of non-normalized tables, sometimes with multiple near-duplicate tables holding slight variants on each others' data.  The constraints are often in the form of poorly-enforced stored procedures.  Even the types don't seem to be stored right.  I've encountered all sorts of bad data that Oracle seems to ignore but gave fits (and rightly so) to SQL Server's Import/Export Wizard.  (For example, two digit integers do not constitute a complete datetime!)

The original program probably goes back twenty years, and all of the original developers have retired so long ago that even the older people here have no idea who they were.  As a result, there also aren't really any clean requirements to go off of--we're just supposed to duplicate the existing application's functionality and keep its existing data.

The end result of the rewrite is going to be a web-based version running on ASP.NET with MS SQL Server for the back end.

My other two developer teammates are much, much older than me, both with business/MIS backgrounds whereas mine is CS.  The senior member's experience has been almost exclusively Oracle forms and the other member has mostly done business applications work in Visual Basic.  Although my database background has been limited to designing new databases for projects in MySQL or SQLite, mostly for my undergrad classes, I seem to be the only one with experience actually designing databases at all.

I've already written a little program in C# that reads in all the existing data to a neutral format, ready to be re-cast and placed into a new database.  I plan to write the load-in code after the destination database is designed, so that data can be properly split across the new normalized tables, added in the correct order to follow new constraints, etc.  The same program could then be run again later to copy the production data to the real newly deployed finished redesign.  This leaves the actual redesign of the database as the main thing to figure out.

So the heart of my question: what are some best practices for doing a redesign from the database level up of an existing application?

答:
I think you already know how to normalize a database.

What you need are strategies for minimizing the risk when moving all of the software to the new database.

What I'm suggesting is more work as a trade-off for less risk.

Normalize the database, and create a process to populate the normalized database with data from the original database.  The original database will be the database for inserts, updates, and deletes.  The normalized database will be the query database only during the conversion.

Your populate process will have to run as often as the need for query data.  If day old data is acceptable, you can run a nightly populate process.  If you need more current data, you have to run a continuous populate process.

Build the query portion of your new ASP.NET system, pointing to the new normalized database.

The query results from your new system should compare with the query results from the original system.

You could stop at this point.  That's a business decision, not a technical decision.

At your leisure, you create new insert / update / delete functionality in your new ASP.NET system.  As you create the new functionality, you turn off the parts of the original system that correspond.  At some point, nothing of the original system remains.

The advantages of converting in this manner are reducing risk by building the query portion first.  Generally the query functions are simple compared to the business logic embedded in insert / update / delete functionality.

You convert the insert / update / delete functionality one process at a time.  If there's a problem with misunderstanding the business logic, it can be fixed while your users are using the original system.

It should go without saying that your populate process better be absolutely consistent.


问:
What's the real benefit of meta-modeling?
After reading several texts about meta-modeling I still do not really get the practical benefit. Sometimes I think it is only an interesting mind game but no useful tool. Sure it is wise to clarify your modeling vocabulary: some may say class where others say entity or concept, but this is just simple documentation your modeling terminology. Meta-modeling, as I understand it, is more complex, as it tries to formalize and abstract modeling. Some good examples are  Keet's formal comparison of conceptual data modeling languages (UML, ERM and ORM) from academia and the Meta Object Facility (MOF) from industry. To me MOF looks as impractical as CORBA, which was also created by OMG. In theory you could use meta-modeling to transform and integrate models in different modeling languages, but is anyone actually doing this?

答:
I can give you an example of when meta-modeling was useful at my workplace. In the 1990s, the company where I worked grew quickly by acquisition. With each acquisition, new staff, systems, databases and data were added. By 2004, the IT department employed almost 5,000 people and had a yearly budget of 10^9 USD. Many of the smaller companies we merged with had their data in MS Access, MS Excel, Fox Pro. Many of the large companies had flat files on the mainframe, hierarchical databases, huge DB2 installations running on OS/2... and everything else under the sun. Other than the general ledger, no serious attempt was made to consolidate any of this data.

At some point in time, someone woke up and realized there little control of corporate data and that the lack of control represented a huge risk to the company. It was time to clean house! But where to begin? Even a simple idea like "customer" meant something different to every group. The "customer" entity used by the legal department had almost no overlap with the "customer" used by the sales office, and those "customers" had nothing to do with the "customer" used by finance. How do you sort out a mess like that?

The approach we took started with backing up a step. Rather than put 30 people in a room and watch them fight for their own definition of what "customer" meant, we started with meta-modeling. We tackled questions like "what is a semantic attribute?" or "what are entities and how should their names be formatted?".

It was easier to gain consensus about abstractions like "class" and "relationship" than about actual operational data. But once the stakeholders had consensus on fundamental terms, we could move down the latter of abstraction, gradually getting more and more concrete. Eventually we had a common framework for describing corporate data and were working toward a common data dictionary.


答:
Try to convince them to contract the development of the new system to an outside company, there are a lot of good development companies that have the resources to properly develop applications faster and better than your limited team. A good development company will also be able to force your superiors into doing things they may not do if you requested to do them, the PM of the company getting paid a lot of money to develop an app has a lot more pull to get user involvement than the IT guy many levels below the management authority to arrange such things.

It costs a lot of money up front, but it will pay off big time to have the proper resources for development and implementation. If you do manage to get an RFP put out I would wager that the bids you get indicate that what you are trying to do is far more complicated than your managers realize.

Title: Best Practices for Redesigning a Database

Body:
I'm aware of some general best practices when designing a database for an application, but what about redesigning?

I'm on a team tasked with re-designing an internal business application, though despite me saying "internal," I'm unfortunately many, many layers of people away from contact with the actual users of the system.

The current program is in Oracle Forms, scattered across a bunch of non-normalized tables, sometimes with multiple near-duplicate tables holding slight variants on each others' data.  The constraints are often in the form of poorly-enforced stored procedures.  Even the types don't seem to be stored right.  I've encountered all sorts of bad data that Oracle seems to ignore but gave fits (and rightly so) to SQL Server's Import/Export Wizard.  (For example, two digit integers do not constitute a complete datetime!)

The original program probably goes back twenty years, and all of the original developers have retired so long ago that even the older people here have no idea who they were.  As a result, there also aren't really any clean requirements to go off of--we're just supposed to duplicate the existing application's functionality and keep its existing data.

The end result of the rewrite is going to be a web-based version running on ASP.NET with MS SQL Server for the back end.

My other two developer teammates are much, much older than me, both with business/MIS backgrounds whereas mine is CS.  The senior member's experience has been almost exclusively Oracle forms and the other member has mostly done business applications work in Visual Basic.  Although my database background has been limited to designing new databases for projects in MySQL or SQLite, mostly for my undergrad classes, I seem to be the only one with experience actually designing databases at all.

I've already written a little program in C# that reads in all the existing data to a neutral format, ready to be re-cast and placed into a new database.  I plan to write the load-in code after the destination database is designed, so that data can be properly split across the new normalized tables, added in the correct order to follow new constraints, etc.  The same program could then be run again later to copy the production data to the real newly deployed finished redesign.  This leaves the actual redesign of the database as the main thing to figure out.

So the heart of my question: what are some best practices for doing a redesign from the database level up of an existing application?


答:
The canonical reference on sorting and searching is Knuth, Vol. 3.  Start there.

The book was originally written back when computers were a lot smaller and slower than they are now, which made out-of-memory sorting techniques more important than they are perceived to be today.


问:
Wrapping a 3rd party API - Gateway Pattern connections
Given a 3rd party API with a very cumbersome object with many different responsibilities-- we decide to wrap using small, manageable, single-responsibility objects.  This is the gateway pattern (I think).

So any time you do this there is going to be some kind of "connection" where you have to connect to the resource.  Furthermore, calling applications may want to keep a single connection open and use it with multiple objects (those small, manageable, single-responsibility ones we created).

What form should this connection take?  Should this connection be another object?  Should it be passed it to the constructor of the small wrapper objects?  Or, should the wrapper objects inherit from a connection object?  Or aggregate it?

What about the special case where we can have only have only one connection per application?

答: Make a connection class with a public constructor. It should initialize an instance of the 3rd party object as a private field. The connection class should have factory methods that call private constructors of your other wrapper classes, passing its instance of the 3rd party object as a parameter.</p>


答:
I agree with you, but I'm going to play devil's advocate here:

Depending on the language and the variable's name, x==true is appropriate:

Consider the following situation in a language with static typing and type coercion for integral types:

```<code>if (actionsAllowed){
    //do actions, since they are allowed
    //...
}
</code>```

Someone reading this section of the code might not realize immediately that actionsAllowed is a boolean variable - it could also be an integer, representing the number of allowed actions. So by adding == true, it becomes clear that x is a boolean, and not an integer being coerced to a boolean:

```<code>if (actionsAllowed == true){
    //do actions, since they are allowed
    //...
}
</code>```

Title: Make a big deal out of == true?

Body:
I agree with you, but I'm going to play devil's advocate here:

Depending on the language and the variable's name, x==true is appropriate:

Consider the following situation in a language with static typing and type coercion for integral types:

if (actionsAllowed){
    //do actions, since they are allowed
    //...
}

Someone reading this section of the code might not realize immediately that actionsAllowed is a boolean variable - it could also be an integer, representing the number of allowed actions. So by adding == true, it becomes clear that x is a boolean, and not an integer being coerced to a boolean:

if (actionsAllowed == true){
    //do actions, since they are allowed
    //...
}


问:
I would like to improve in writing goal-oriented user stories/features
I would like to improve my user stories writing abilities so I need your experience and guidance. I think that each variable part of a user story can be improved by following certain guidelines.

1. Role

Defining possible roles may be the easiest part. The only problem is that user stories usually  just describe functional features that need development.

Do you write non-functional stories? And I'm not thinking about technical stories that are related to other aspects of product planning like administrative things. I'm more thinking of additional supporting stories that support the same high-level goal. Like advertising related stories that are related to features?

2. Feature

Defining features seems to be easy but it turns out it's not. Because I can see stories that are heavily related so certain roles can't be developed until others are finished. Example: User registration is a pillar user story that needs to be done first in order to develop other user stories that are related to registered user roles (logged in users and/or admins etc.). This one is very obvious but sometimes relationships are much more subtle.

How do you avoid relationships between user stories? Is there a technique to break related stories apart so we can have better development parallelism? Breaking relationships also helps better sprint cycles because one story can't stall the whole sprint.

3. Benefit

This one is the hardest part that I think I have least knowledge how to write good user stories with clear benefits.

Do you actually write benefits per story or do you rather provide high level goals instead? Providing these instead of benefits makes it easy to see why certain user story is more important than the other? So it helps prioritisation.

Is it wise to have shared benefits/goals between set of user stories?

Do you write user stories without benefits part? Is that wise and what do you do instead?

Do you write benefits in a way so they can be measurable? Can we do that and is it beneficial?

4. User stories as a whole

Have you ever defined all user stories as epics? This would help filter out/prioritise those that give more to the common goals. Then split them into digestible chunks or per single feature user-stories.

What additional metadata do you add to user stories? Also talking about user story grouping per higher feature or goal...

答:
The user story format is pretty flexible.

“As a (type of user), I want (some feature), so that (some goal)”

I've seen this format used successfully at my workplace. For example:

"As a System Administrator, I want copies of the product catalog sent daily to our Sales Partners so that these partners always have the most current version of our product catalog"

In this example:

A feature is defined. The feature might take the name Partner Extract, for instance. It might be implemented as an ETL job that runs nightly to create data files that are made available to Sales Partners via SFTP.

The user story embeds the roles. The two roles identified are System Administrator and Sales Partner.

Incorporating non-functional requirements is easy. The above example includes one non-functional requirement: the product catalog updates must be daily. Requirements that address how much, how fast or how often are non-functional requirements. I like to refer to these requirements as "quality attributes". Here is another example of a user story that expresses a quality attribute:

As a Call Center Representative, I want customer search to return the result in 2 seconds or less (on average) so that customers are not left waiting on the phone.

Write user stories for reliability, security, capacity or any other quality that is deemed important.

Feature Dependencies

You have identified some legitimate limitations of user stories. They are unordered and there is no guarantee they will be independent. In fact, the might be interdependent-- a chicken-and-egg problem. I believe that all non-trivial projects require documentation to supplement the user stories. I watched the agile team here at work create activity diagrams (flow charts) of the business process. These diagrams were used to analyze the feature dependencies. Another approach might be to create PERT diagram in a big all-day session with the customer. In the end, some other artifacts will be necessary to support the user stories.

Epic!

A narrative that describes the scope of a project is a good idea. There should be something like a statement-of-work or a project charter. No serious project should be without one. These documents provide a starting place for identifying user stories. These document help answer tough questions like "What should be the priority of this feature?"

Metadata

After 15 years in the business, I have an opinion about meta-data. In general, it should be avoided. A few reasons include: after a month, no one knows if it is accurate; no one knows if it was updated; it is extra work to create it; you can't predict what metadata will be useful. Most meta-data is a distraction. I like to track owner, author, priority, estimate of effort, and date of last modification. Beyond that, I fight hard to keep meta-data out user stories and use cases.

Benefits (so that...)

I have an opinion about this as well. :-) Including the benefits is vital. Often, users will request a feature without having though about its value. No matter how good an agile team is, the project will fail if it implements unimportant stuff at the expense of more critical functionality. Also as a developer, I do a better job coding a feature if I know how it fits into the big picture. Here is a real-life example of a requirement without justification: "The system shall prevent transactions with EIP and a gift card from occurring.". Huh? What is EIP? Why do I care? Why does anyone care? I don't know. Understanding the context would have been helpful before I went to the business analyst for clarification.

Even worse is when no one remembers why the user story was written. Do we still need this one? Has the business process evolved to the point where this user story is invalid? Does anyone know? These conservations waste time. It gets suckier if the the author of the user story has left the company.

Measurement

Here is an example of user story that is not measurable:

As a Call Center Representative, I want the system to be fast so that customers are not left waiting on the phone.

How fast is fast? A millisecond? A tenth of a second? Ten seconds? Nobody knows. Nobody wants to be wrong so no one every even makes a guess.

Compare that user story to this one:

As a Call Center Representative, I want customer search to return the results in 2 seconds or less (for average daytime call volumes) so that customers are not left waiting on the phone.

This user story is testable. Average day time call volume can be determined from log files. Performance testing can be conducted to determine if the requirement has been met. Even better, the users and developers have agreed on the success criteria well in advance of the end of the project. Testable requirements are a beautiful thing.


答:
Design the normalized database you need with the data types you need.

Then the hardest part is migrating the data.

First you need to have a plan for how you are going to map from the old to new

What you are going to do with data that doesn't meet the new structure?

For instance you may have data is that is now unidentifiable if you didn't have proper integrity constraints. You may want to simply not move that data or you may need to move it but attach it to a new parent record called "Unknown".

If a date isn't really a real date, can you put a null in the field when migrating? You will need answers to those sorts of questions.

I would suggest that you have some of the developers work on changing the gui to use the new database struture and others to work strictly on the migration. The migration is a huge task, it will take a lot of skill and a lot of time. Don't leave it as an afterthought.

Since you are using SQL Server, you can do the actual migration through SSIS (SQL Server Integration Services).

Create a good solid set of test cases so that you can compare that results with the old system are the same with the new system.

Because you have so many years of data you may want to migrate in two parts. First migrate most of the data and then when it is time to go live, only migrate changed data. Of course you would need to put controls in place on the database to be able to find changed data which you may not yet have. You may also comsider at this time if you want to archive some data.


问:
What should I do to scale out a high-traffic website?
What best practices should be undertaken for a website that needs to "scale out" to handle capacity?  This is especially relevant now that people are considering the cloud, but may be missing out on the fundamentals.

I'm interested in hearing about anything you consider a best practice from development-level tasks, to infrastructure, to management.

答:
Secure, Fast, Reliable DNS

I found a few high-capacity websites using the registrar's DNS server, which had no SLA for uptime or performance.  In addition, their servers were located in India and the latency alone increases the chance that a DNS spoofer could poison your customer's, or intermediate ISP's cache.  This would cause even your SSL-protected traffic to be redirected without anyone knowing.

DNS speed also affects the initial load time of your server, before the records are cached.

I use DynDNS or Neustar to most of my customers since they have a pretty solid DNS infrastructure (though it's expensive and I have no other affiliation to those companies).


问:
How common are "bandage" fixes?
Imagine the following scenario:

You've detected that your (or someone else's) program has a bug - a function produces the wrong result when given a particular input. You examine the code and can't find anything wrong: it just seem to bog out when given this input.

You can now do one of two things: you either examine the code further until you've found the actual cause; or you slap on a bandage by adding an if statement checking if the input is this particular input - if it is, return the expected value.

To me, applying the bandage would be completely unacceptable. If the code is behaving unexpectingly on this input, what other input that you've missed will it react strangely to? It just doesn't seem like a fix at all - you're just shoveling the problem under the rug.

As I wouldn't even consider doing this, I'm surprised at how often the professors and books keep reminding us about how applying "bandage" fixes is not a good idea. So this makes me wonder: just how common are these kinds of "fixes"?

答:
I would say it's very common.

Check out Joel Spolsky's blog post: The Duct Tape Programmer

I can easily say that just about every project I've ever been on I've had to apply some kind of bandage or duct tape to meet deadlines and complete a task.  It's not pretty, it's not clean, but it gets the job done so a business can continue to run, and the project can move forward in some way.

There's a difference between the academic world, and the real world where software actually needs to ship under time and business contraints.

In a way it is putting it under the rug, to defer a fix, until hopefully, later.  Sadly, too often, the deferred fix never happens and this code finds its way into production.

Title: How common are "bandage" fixes?


问:
What does a code review look like?
I'm writing a code review process document for our team; we've never had a formal process in place although we do do some code review.

I've found lots of articles talking about how important code review is, but I have one question in particular that I haven't found the answer to on the web... is the programmer part of the code review? In other words, should a code review be 2 people sitting together, going over what's in the code, or should it be 1 person looking at another person's code?

Most often, our projects are done by a team of 2 people, so before it is sent to QA, should those 2 people just sit together and go over the entire project, including what each of them have written? Or, should they just both look at each other's code? I can see advantages to each.

Finally, what happens with issues found during code review? Are they noted, and then sent back to the programmer? Or should the reviewer note them and then just fix them? Or is it ever ok to make a change and not even tell the programmer specifically what you found?

答:
A formal code review could go like this:

Programmer sends material to reviewer

Reviewer goes over material

Programmer and reviewer sit down go through the material. Programmer takes notes. Design discussion are postponed.

The programmer corrects whatever came out of the review.

The programmer should always talk to the reviewers, otherwise way too much information will be lost.

Note that since you are just two people on the team, you can probably get by with something very informal, like walkthrough of the code on the programmers screen.

Also note the pair programming is a great alternative to reviewing.

Title: What does a code review look like?


答:
The basic process should involve the developer sitting down with his peers and going through his code in some depth. How deep depends on the size of the project, how important it is etc. The reviewers should have access to the code before the meeting so that they  can concentrate on discussing the defects rather than reading teh code.

Each meeting shouldn't be too long - an hour or so, so if there's a lot of code split it up into more manageable chunks. It's also perfectly acceptable to just review a proportion of the code, though again this will depend on how important the code is etc.

You can either go through the code online or offline - but no changes should be made during the meeting. Just note the defects either as annotations on the print out or in a separate file.

The developer then goes back and fixes the defects, re-running any tests etc as required. Depending on the number and severity of the defects there may be another review - though this might only be a sample of the code.

Title: What does a code review look like?

Body:
I'm writing a code review process document for our team; we've never had a formal process in place although we do do some code review.

I've found lots of articles talking about how important code review is, but I have one question in particular that I haven't found the answer to on the web... is the programmer part of the code review? In other words, should a code review be 2 people sitting together, going over what's in the code, or should it be 1 person looking at another person's code?

Most often, our projects are done by a team of 2 people, so before it is sent to QA, should those 2 people just sit together and go over the entire project, including what each of them have written? Or, should they just both look at each other's code? I can see advantages to each.

Finally, what happens with issues found during code review? Are they noted, and then sent back to the programmer? Or should the reviewer note them and then just fix them? Or is it ever ok to make a change and not even tell the programmer specifically what you found?


答:
The review process I am familiar with goes as follows:

The source code is managed using a version control system (e.g. SVN).

Any change to the software is tracked by a change request system (e.g. Bugzilla).

When a developer checks in some changes, these are attached to the change request.

Before the change request can be closed, the change must be reviewed by another developer. This can happen either directly (one developer explains the changes to the reviewer), or through a tool (e.g. http://www.reviewboard.org/) after these have been checked-in already. In the both cases, the reviewer can approve the changes or suggest further modifications.

In both cases (direct review or through a tool), if the reviewer approves the changes, the change request can be set to 'FIXED'. If the reviewer requires further changes, the developer implements them and a new review is needed.
It is the original developer who implements these additional changes.

For bigger changes (e.g. implementation of new features) the developer does not explain the change down to the smallest detail: the main ideas and implementation techniques are illustrated on the code. For smaller changes (e.g. bug fixes), there is time to have a more detailed discussion.

Title: What does a code review look like?


答:
You might be interested in a bucket sort.  The average case performance is linear time.

= O(n+d) n: number of elements and d = length of largest number
if you have an intuition about your data ie. If you know how many 'digits' long is your largest number. So if you have 2 million 6 digit numbers => 0(n) thus linear.


答: In my experience, making a code review a formal physical meeting usually results in way too little code getting reviewed, or the reviews being sub-par.  I much prefer a tool like code collaborator, gerrit, or the built-in review features of some version control hosting like github or kiln.  That lets you inform as many people as you need or want, then they can review on their own time (I reserve the last hour of the day).  The original author then makes, tests, and uploads any corrections and whoever found the defect signs off on the correction.  This lets you have a more agile, iterative approach to doing reviews, rather than it being one big event at the "end."  </p>

Title: What does a code review look like?


答:
In the company I work for, the process is pretty simple: the person responsible asks for the support of a colleague (informally). The colleage should be someone who knows the releavant functionality (but this is not a must).

We do "conceptual solution reviews" and "implementation" reviews.

In the "implementation" review, the responsible explains the problem (if it is not known yet) and the solution (if it is not known yet) and then goes through the code and internal documentation. This happens on the developer's machine (before any code is committed). During this phase, the reviewer can make any suggestions to improve the code or documentation. It is also common for the responsible to ask feedback on specific implementation issues (i.e. show two implementations of the same function and discuss which one is "better").

Ideally, the responsible should show some tests being performed with the new code (and the reviewer can also suggest other test cases).

This is a simple process, but it often finds small problems.

Sometimes there are two review requests / reviewers (but this is due to the company's organization: the code is divided by specialised teams and sometimes you need to change someone else's code).

Title: What does a code review look like?


问:
Keeping a connection string secure when working with others
Say you've started an open source project and are posting it on a public repository.  (like I have, using Codeplex.)

One of the key files just makes the connection to the database, contains the login/password, and is just included from any other source file that needs a database connection.

What's the best way to share the project without giving out your password?

So far I've specifically removed it before committing any changes, but I'm thinking there has to be a better way.

答: If you are sharing the uname and pwd,  you should probably consider saving them in encrypted form.</p>


答:
What you seem to be talking about is what people call "Pair Programming," sitting together and discussing your code to make sure that it's free of defects. This is always a great idea, and one that is normally encouraged. However, it doesn't rule out the need for a formal review. Formal reviews get everyone on your team familiar with the code, plus more eyes is always a plus!

A formal review should always, always include the author so that they are free to make clarifying comments as needed. However, they should never be the lead in the review. This prevents them from having to much control over the process and possibly skipping important aspects of their code.

Many of the other answers cover how to track the defects that are encountered during a code review, so I won't re-enumerate them here, but it is always important to take notes during these meetings and report them back to the author. The author should almost always ultimately be responsible for implementing the changes found during the inspection.

At my school, my professors created a video of what a code inspection should look like and what the major roles should be. We all find it pretty cheesy, but it does cover some good points. You can watch it here: http://www.se.rit.edu/~kurt/videotest/

Title: What does a code review look like?


答:
Short answer: No, you have opportunities in the HFT world with your Java skills.

Caveat: Learning any new language will force you to think/code/communicate in new ways, this is usually a good thing.

Personal experience: When I worked in bulge-bracket IB I interviewed for a Java role in an HFT group. I knew no C++ but this didn't deter my interviewers, their team wrote Java for most pricing and trading, C/C++ to optimize network and disk IO. My Java experience would "confine" me to the pricing/trading space, which is a very, very large space in which to be confined.

How the story ends/advice to OP: I didn't take the job, opting instead to try out the small company scene. Was the best choice for me at the time, but had I wanted to stay in IB, HFT would have been challenging and enlightening. Take your Java skills and apply to HFT/low-latency positions. There's plenty for you to do, and you'll work alongside some awesome C++ developers too.

Title: Is it worth learning C++ in depth JUST for a career in low latency trading?

Body:
I am interested in ultra high frequency trading and Java is the language I know best.

I was always under the impression I would have to perfect my C++ skills in order to work within the ultra high frequency domain (no pun intended) because a lot of job specs seemed to ask for this.

Elsewhere on the internet i have seen people comment that Java is actually preferred because you can find Java developers much easier. However, I thought this a bad argument because in terms of ultra high frequency, you need to grab an order as soon as possible and designing your system based upon the ease of finding programmers isn't going to achieve what you need in terms of latency.

So, would you say I would be best off concentrating on Java, or is it unavoidable to specialise in C++ in order to get into this career?


问:
How to verify/prove orthogonality of a programming language?
I know the concept of orthogonality, but from a programming language point of view, is there a way to verify/prove it?

For instance in C#, one can use public or static for a method signature. You can use either or both and they wouldn't interfere with each other, so they are orthogonal to each other, right?

My question is, how do I go about the rest of features, particularly features that are not related to each other?

Do all the features have to coexist/stack together?

Is there a programming language that is 100% orthogonal?

答:
Warning, I don't know anything about this topic.

A quick glance at Wikipedia seems to indicate that Orthogonality is mostly directed at design patterns and systems design. In terms of programming languages, the entry indicates that instruction sets are orthogonal if there is one and only one instruction for each possible action, or rather, no instruction overlaps another.

For C#, I'd imagine that it is orthogonal, in that most syntax tricks (foreach comes to mind) are simply front-ends to specially formed versions of the base construct (foreach becomes for loops). Overall, the language only truly supports doing things in a single way, even though syntactic sugar provides additional ways to do them. And lastly, it all compiles down to MSIL (or whatever it's called these days) and MSIL is likely orthogonal.

If you make the caveat that syntactical sugar stuff is essentially a "wrapper" around doing it the "hard way" you can analyze the various features of the language, omitting sugar, and see if there are any constructs that truly overlap. If not, I'd imagine you could declare the language orthogonal.

My two cents.

OwnerDisplayName: Joan Venge

OwnerDisplayName: Digitlworld


问:
Are detailed style requirements inappropriate from Marketing?
I'm working on the UI-side of a project which is under intense scrutiny by our Marketing group.  Most of the time, we're reviewing functionality requirements.

Once in a while, however, they will get very in-depth regarding colors, styles, etc.  For example, I've been tasked by Marketing to make one particular button a very specific color and a very specific size,

In other projects I've worked on, however, these types of requirements have been quietly ignored or rejected when they came from Marketing.  Managers and tech leads have insisted Marketing shouldn't be specifying details like colors, styles, control layouts, etc., but I've never really been told why.

Is it inappropriate for Marketing to list detailed style requirements for a UI, including colors, shades, layout, sizes, etc.?  If so, why?  Is this just a case of conflicting philosophies regarding Marketing responsibilities?

(I should probably mention that we're not working with a unified style guide for company-wide applications.  In the past, other projects I've worked on have "winged it" when assembling their UIs.)

Edit: I removed an editorial comment I made which probably implied this post was a complaint couched in a question. I'm not really concerned with what I should do, but rather I would like better understanding as to what Marketing's responsibility is regarding these types of requirements.  I've had very little exposure to Marketing (I've been more distanced from them in previous projects) and I don't understand their role as it pertains to UI styling.

答:
Heck, no, it's not inappropriate.  In the modern world of web-based consumer-focused IT, you should never assume that the product stands alone.  Marketing (including the product owner, who is often a Product Manager in the Marketing department) may very well have non-product reasons for the choice of styling.  Does a particular shade of blue display well in printed materials, like ads and brochures (yes, some do).  Does your target market respond particularly well to orange (yes, if they're Dutch).

After all, Target stores are so closely aligned in people's minds with bright red concentric circles that its name is often downplayed in its advertising.


问:
How to properly validate your code?
I have about 4000 lines of code for a web-application in JavaScript / PHP / CSS / HTML.  How can I test it properly?

I only support the latest version of IE and Safari.  I've worked out all the bugs. Is there a good way to test it so that I could go so far as to call the code robust?

I've considered using perl Mechanize to auto fill in forms or do something similar.

I also have a PHP test class to test the inner working of my PHP classes.  However is there some sort of standard or conformance guidelines to be met? Is there a way to say this code passes IEEE xxx foo standards for code robsustness etc.?

I have validated my HTML using W3 validators and I've validated my JavaScript using jslint.com.

Here is list of dilligence items:

HTML / CSS passes W3 validation

JavaScript passes jslint

PHP passes internal PHP Test Class

User Testing

Create a set of User Actions and Implement using perl mechanize or similar.

Are there standards or procedures for releasing code to the web?

答:
Standards are only as good as the people that enforce them.
(especially true with ISO quality standards...)

If you'd like to fully test your software, you need a good requirements spec that can be used to verify the fact that you've accomplished/implemented all the tasks/features/etc as they should be implemented. Also it helps to have someone else to look at the project from just a quality assurance/software testing perspective (from code reviews to exploratory user testing).

Another note you might want to consider is that fact that without a clear requirements spec as the developer you will probably more often than not assume things as 'features' instead of 'bugs' :)

There are IEEE standards for requirements specs (IEEE 830) and test plans (IEEE 829). However I think they're a bit OTT for a lot of projects.

(I'm also slightly surprised you don't have a database?)

Title: How to properly validate your code?


答:
My question is, how do I go about the rest of features, particularly features that are not related to each other?

You continue doing what you're doing, enumerating all the combinations that work or are forbidden.

That's all.  It's quite painful to do.

Do all the features have to coexist/stack together?

If all features can partitioned into disjoint subsets that don't interfere with each other, then sure, all would be sensible.

All data structures work with all primitive types.  All expression operators work with all types.  Those are common definitions of orthogonality.  But you may want more (or less)

Sometimes, however, there are special cases because of operating systems or legacy libraries that aren't orthogonal.

Also, some types aren't really very conformable at all.  For example Python allows you to compare two dictionary objects for "ordering".  But there's almost no sensible definition of "ordering" among dictionaries.  Python defines one, but it's pretty debatable.  Does that special case make dictionaries fail an orthogonality test?

How orthogonal is "orthogonal enough"?  What do you need to see to be happy with the degree of orthogonality in your language.

Title: How to verify/prove orthogonality of a programming language?

Body:
I know the concept of orthogonality, but from a programming language point of view, is there a way to verify/prove it?

For instance in C#, one can use public or static for a method signature. You can use either or both and they wouldn't interfere with each other, so they are orthogonal to each other, right?

My question is, how do I go about the rest of features, particularly features that are not related to each other?

Do all the features have to coexist/stack together?

Is there a programming language that is 100% orthogonal?


答:
Software validation is a huge area, there is no one definite answer to your question. Moreover, software validation engineer is usually a special position requiring much more knowledge than development and many skills (like for example "debugging specification" that is really very non-trivial) that are now common in developer community.

Second, software validation (and code validation as an essential part of it) is not testing. There is a famous quote by Dijkstra:

Testing shows the presence, not the absence of bugs

So, this is the main difference from software validation (i.e. stating that your software is valid, contains no errors) and testing (for potential errors or bugs).

If we reduce your question to "how to properly validate a PHP-based web application?" I can give the following answer:

Taint analysis.

There are some neat tools(1,2) to perform taint analysis on PHP. This is a static analysis (that means it is done without, running your code) that identifies possible sinks (leaks) of confidential information.

I have used some of these tools (Pixy) in my own practice and found out that they, as all other tools in static analysis, seem to overestimate the potential danger. Nonetheless, they can help you to identify some security problems you might not be aware. This is especially important for web applications dealing with some sensitive data.

This won't exclude all possible vulnerabilities, like XSS, but will cover many common ones, like PHP code and SQL injections etc.

Conformity validation.

This step you already did by having run JSLint and CSS/HTML validators against your complete website.

Load tests.

If availability of your web application is an issue (or even a part of your SLA) then I would also perform some load tests. Those can be generated by some IDEs, like Visual Studio, or you can also use the open-source JMeter framework for this purposes.

Title: How to properly validate your code?

Body:
I have about 4000 lines of code for a web-application in JavaScript / PHP / CSS / HTML.  How can I test it properly?

I only support the latest version of IE and Safari.  I've worked out all the bugs. Is there a good way to test it so that I could go so far as to call the code robust?

I've considered using perl Mechanize to auto fill in forms or do something similar.

I also have a PHP test class to test the inner working of my PHP classes.  However is there some sort of standard or conformance guidelines to be met? Is there a way to say this code passes IEEE xxx foo standards for code robsustness etc.?

I have validated my HTML using W3 validators and I've validated my JavaScript using jslint.com.

Here is list of dilligence items:

HTML / CSS passes W3 validation

JavaScript passes jslint

PHP passes internal PHP Test Class

User Testing

Create a set of User Actions and Implement using perl mechanize or similar.

Are there standards or procedures for releasing code to the web?


答:
Proving orthogonality is proving a negative.  It means you don't have any constructs that are not orthogonal, which means it's a lot easier to prove something isn't orthogonal than is.

In practice, most people talk about orthogonality of programming languages in terms of degrees rather than either being completely orthogonal or not.  When knowledge from doing something in one context translates to another context and "does what you expect," that language is said to be more orthogonal.  LISP is regarded as highly orthogonal because everything is a list, but I don't think it can be said it is 100% orthogonal because of some redundancies that make it easier to use.  C++ is regarded as not very orthogonal because there are a lot of little "gotchas" where it doesn't quite work the way you think it would.


答:
My view on a code review process.

First, there are two basic rules:

no one can commit unreviewed code

no one can review a change which she contributed to

I. When a colleague is about to commit a change we sit together and

check that every test case is green on his computer

check that she wrote/modified test cases

check that his code matches the existing coding guideline

check his changes and focusing on Jeff Atwood’s Top 25 list

we go through her changes and discuss it

This is a quick check, can be done in 5 minutes. It is a good way to get a fast feedback, learn about the new change and nothing gets broken

II. The senior developer/team leader should cherry pick from the commits on a daily basis and thoroughly review them and share his thoughts and findings with the team (those shall implement the findings who wrote the wrong code)

III. during retrospective (if you have any) check each other's code for learning

I blogged about the topic here and here.

Title: What does a code review look like?


答:
I am confronted with re-designing of database schema almost daily due to support and further development of several legacy applications that were born as MS Access files (.mdb) and then grew up to large databases with several hundreds of tables now located on MS SQL Server but still having the "infant deceases" of the original design. Here are some practices I found useful for me:

Try to minimize the publicly available surface of your database schema.

This means that you should try to design some public API that you make available to external applications. I normally try to implement the static data as views (even if they are just based on a single table) and dynamic data as parameterized views or as stored procedures. For data queries where only a single value is enough one can also use scalar functions.

Only these (views, stored procedures and scalar functions) are visible to external applications (via ORM or directly) and used for all CRUD operations. This schema is then frozen completely, whereas internally you might change the underlying tables, improve your procedures etc. -- this won't break the compatibility to your application.

Try to optimize for real-world criteria, not for those from books.

Normalization is a big topic in every book on database design. But in real life there are  cases when normalization won't bring you much or even slow-down your database, for example if you have some data that is repeated, but the percentage of repetitions is very low etc. I am not against normalization, what I am trying to say here is that you have to tackle it with some skepticism and prudence.

Record profiling session and analyze them.

Database re-design based solely on the database schema is not complete. Look at your database in its dynamics, try to find the bottlenecks during load tests and address those. In case of MS SQL Server there is a special Tuning Advisor that can generate some recommendations upon the recorded activity trace.


答:
I am not sure that orthogonality can serve as useful or valid metric in case of general purpose high-order languages like C#, because it requires the distinction of "operations" and "operands" -- the small parts of the language that are not easily distinguishable in such high-order languages like C#.

My understanding of orthogonality is based upon the Assembler language where the orthogonality of the instruction set of a certain particular CPU or microcontroller indicated whether there are some constrains on operations performed by this CPU or controller depending upon the data types. In early times this was important because not every CPU supported operations on fractional numbers or numbers of different length etc.

In this respect I would rather check for the orthogonality of the Common Intermediate Language using Stack Machine language as the target for C# compiler, not C# itself.

If you are really interested in orthogonality of C# and I am not mistaken here (for whatevery purpose) I would suggest looking towards some genetic programming algorithms. You can use those to generate different programs from the given set of keywords (even the meaningless ones) and you can just automatically check if those are compilable. This would help you to automatically see what elements of the language can be combined together and derive some aspects of your orthogonality metric.


答:
There are very few people who can write the error-free code just from scratch. I personally feel always uneasy if rather long chunk of my code compiles and runs immediately and my intuition fails only seldom.

As long as you accept the these that you can not write the error-free code directly it is easier to find a trade-off between the efforts you invest into your code and the (potential) frequency of bugs in it.

One very good approach to minimizing the bugs in your code is the already mentioned Test-driven development. I use it often when I speak in public by adapting it in the following way.

Every independent piece of code is written and re-written in several iterations consisting of the following:

Design the main idea of what you code should do.

Write down the schematic representation of your algorithm.

Re-write the schematic representation so that it is syntactically correct.

Write some most important unit tests for your code (smoke test, for example).

Implement the algorithm to satisfy your existing test(s).

Refactor your code to improve it.

Repeat from 1-4 (depending upon the code maturity) for every iteration and every new feature.

Here are some examples.

(1) I start with something like

I want to calculate pi, so I will simulate a target being a circle
  with diameter d and use random numbers to cast arrows to it. I will
  then use the proportion of circle area to the total target size to
  calculate pi.

(2) Then I move to

Request size of the target.

  Request number of arrows.
  Cast arrows randomly to the target.

  Calculate the arrows that met the target.

  Calculate the pi value.

(3) I re-write it in C# (just an example):

```<code>var Radius = RequestFromUser<double>("Radius of Target");
var NumberOfShots = RequestFromUser<long>("Number of shots");
long GoodShots = 0; long TotalShots = NumberOfShots;
while (--NumberofShots > 0)
{
  if (ShootTarget(Radius)) GoodShots++;
}
Output(CalculatePi(GoodShots, TotalShots));
</code>```

(4) I create all method stubs in IDE (automatically). This allows me to write my unit tests in semi-automated way (get some templates automatically created for them)

(5) I design the smoke test:

```<code>var computed = ComputerPi(Radius: 10.0, NumberOfShots: 10000);
Assert.IsTrue(computed > 3.0 && computed < 3.5);
</code>```

(6) I quickly (meaning without polishing the code) implement all stubs to start testing.

(7) As long as my tests shows green I re-factor my implementation trying to make it "nicer".

(8) I repeat from (5) if my implementation is not complete, or from an earlier step if I want to extend it.

This helps me to keep my code rather clean, and the slowly emerging unit tests serve as regression tests if I do too dramatic changes to my code.

Title: Overcome clumsiness in writing code

Body:
There are very few people who can write the error-free code just from scratch. I personally feel always uneasy if rather long chunk of my code compiles and runs immediately and my intuition fails only seldom.

As long as you accept the these that you can not write the error-free code directly it is easier to find a trade-off between the efforts you invest into your code and the (potential) frequency of bugs in it.

One very good approach to minimizing the bugs in your code is the already mentioned Test-driven development. I use it often when I speak in public by adapting it in the following way.

Every independent piece of code is written and re-written in several iterations consisting of the following:

Design the main idea of what you code should do.

Write down the schematic representation of your algorithm.

Re-write the schematic representation so that it is syntactically correct.

Write some most important unit tests for your code (smoke test, for example).

Implement the algorithm to satisfy your existing test(s).

Refactor your code to improve it.

Repeat from 1-4 (depending upon the code maturity) for every iteration and every new feature.

Here are some examples.

(1) I start with something like

I want to calculate pi, so I will simulate a target being a circle
  with diameter d and use random numbers to cast arrows to it. I will
  then use the proportion of circle area to the total target size to
  calculate pi.

(2) Then I move to

Request size of the target.

  Request number of arrows.
  Cast arrows randomly to the target.

  Calculate the arrows that met the target.

  Calculate the pi value.

(3) I re-write it in C# (just an example):

var Radius = RequestFromUser<double>("Radius of Target");
var NumberOfShots = RequestFromUser<long>("Number of shots");
long GoodShots = 0; long TotalShots = NumberOfShots;
while (--NumberofShots > 0)
{
  if (ShootTarget(Radius)) GoodShots++;
}
Output(CalculatePi(GoodShots, TotalShots));

(4) I create all method stubs in IDE (automatically). This allows me to write my unit tests in semi-automated way (get some templates automatically created for them)

(5) I design the smoke test:

var computed = ComputerPi(Radius: 10.0, NumberOfShots: 10000);
Assert.IsTrue(computed > 3.0 && computed < 3.5);

(6) I quickly (meaning without polishing the code) implement all stubs to start testing.

(7) As long as my tests shows green I re-factor my implementation trying to make it "nicer".

(8) I repeat from (5) if my implementation is not complete, or from an earlier step if I want to extend it.

This helps me to keep my code rather clean, and the slowly emerging unit tests serve as regression tests if I do too dramatic changes to my code.


答: Stop and read your code very carefully before you even compile it.  Think like the compiler- find any syntax errors (once you've gotten good, the compiler should never find a syntax error).  Also work through the code in your head very thoroughly, play computer.  View it as if you only have one chance to hit compile, and everything better work (in other words, be very careful about what you do, don't mash the build command and then fix what pops out).  This is a simple technique that is surprisingly effective.</p>

Title: Overcome clumsiness in writing code


答:
Learn other languages, preferably of different paradigms.

For instance if you've been using an imperative/OOP language like Java/C#/C++, try a functional language like Scala/Haskell/F#. (I suggest Haskell for your purpose since it's the most faithful to the paradigm.)

The advantage of learning a new language or new paradigm is that you will start seeing conceptual patterns that these other languages would have defined rigorously, and then when you go back to working in your language of choice, you can apply these patterns to your code and thus avoid bugs that used to be common otherwise.

TDD isn't the same thing as unit testing. In fact, many TDD practitioners will insist that TDD should not be used to catch bugs or regressions -- and that if you're writing TDD tests to catch bugs, you're losing the design benefits of TDD.

If you want to do testing to improve code quality, do unit testing and integration tests -- not TDD. Sure with TDD you'll develop a habit of spotting bugs up front, but that aspect of TDD really isn't much different from normal unit tests.

Title: Overcome clumsiness in writing code


问:
Simple issue tracker for 1-2 developers
I'm currently working mostly alone on a project (in Java). I'm mostly alone as I have an advisor that gives me high level instructions on what to do, and will seldom make any code contribution. She will code in a couple of acceptance tests from time to time, though.

I've never used an issue tracker before, and was thinking about starting to use one now, as I'd like to have a place where I can log possible bugs I find and keep track of them in a centralized manner. Would it be possible to integrate the issue tracker with Eclipse, better yet.

So here are the constraints:

It's NOT a open-source project. Our code is not to be shared with anyone!

we are and will be using Subversion;

we have our own Subversion server and we will keep using this same Subversion server;

it must be free;

it must allow at least 2 users.

What is your advice on what to pick? I'm looking for the simplest solution available.

答:
If you don't expose sensitive information in bug reports and comments so I'd recommend Google Code. We used its Issues feature in the past for one of our projects with a team of 8 devs. It's really simple, easy, and good enough for a small team.

Note that although you need start an open source project but you don't have to upload your code to Google, jus using Issues feature. And of course, anyone can see your bugs if they accidentally found your project, or you share project link with them.

Title: Simple issue tracker for 1-2 developers


答:
If you're using windows you can encrypt the connection string (e.g. like this) and share that but not the encryption key. I dare say that other platforms have similar capabilities.

Of course it'll be a waste of time unless that account is also locked down with limited privilages.

Title: Keeping a connection string secure when working with others

Body:
Say you've started an open source project and are posting it on a public repository.  (like I have, using Codeplex.)

One of the key files just makes the connection to the database, contains the login/password, and is just included from any other source file that needs a database connection.

What's the best way to share the project without giving out your password?

So far I've specifically removed it before committing any changes, but I'm thinking there has to be a better way.


答:
I agree with pretty much everything @Karl Bielefeldt said but I'll add one point which I think is important:

Code review is (or should be) asynchronous pairs programming.

The asynchronous part is obviously only true if the coder and the reviewer are not in the same room at the same time. To me, this is best enabled by a tool such as github's pull request. There are certainly other ways of automating the process, and I've seen a variety of them work across domains from medical devices to open source; however, what separates them is the wide variance in efficiency. I don't know anybody who isn't concerned about the time commitment involved these days; therefore, I think it's best to automate the process from the outset.

Github's pull request gets my vote because it's discoverable and easily approachable by beginners via the web interface, and yet, also handles more advanced users who prefer the command line.

The other thing that I like about this system is that it does a good job of separating review metadata (comments about code) from the code itself and focuses the reviewer on providing patches which increase the rate of acceptance.

If you think about it, the economics of code review are something like: quality derived from review is a function of iteration: reviewer's attitude and aptitude plus coder's openness and responsiveness. Anything you can do to increase the ease and rate at which these review iterations take place yields better quality and a more cohesive experience for the team.

I'd also see How should code reviews be Carried Out?

Title: What does a code review look like?


问:
Is it good practice to store framework runtimes under source control?
I know a lot of software shops keep binaries under source control. However, our shop had come to store entire frameworks on the repository: DirectX runtime, CUDA, nVidia Optix, whatever.

It is said to make a dev machine setup easier (supposedly, get latest and start coding). However, it considerably bloats the repository and burdens it with irrelevant history.

I've never seen such a usage pattern. Do you consider it a good practice?

[EDIT:] I have no problem with source-controlling isolated 3rd party binaries. The question refers to entire framework runtimes, typically consisting in 10+ binaries.    As an extreme example, take Windows SDK (which we don't keep on the repository, thank god, but I see no difference in principle).

答:
I think that the binaries should be stores somewhere. I would suggest storing them outside of a repository, especially if they are big and lead to large check out times. I'm not going to see it's poor practice, but it's also not one I've seen.

This may actually be a good idea if your organization has lots of projects that target different runtime versions. It ensures that you have the right runtime binary when you're working on the right projects.

OwnerDisplayName: Ofek Shilon

OwnerDisplayName: nmjohn


问:
Graduate expectations versus reality
When choosing what we want to study, and do with our careers and lives, we all have some expectations of what it is going to be like. Now that I've been in the industry for almost a decade, I've been reflecting a bit on what I thought (back when I was studying Computer Science) programming working life was going to be like, and how it's actually turning out to be.

My two biggest shocks (or should I say, broken expectations) by far are the sheer amount of maintenance work involved in software, and the overall lack of professionalism:

Maintenance: At uni, we were all told that the majority of software work is maintenance of existing systems. So I knew to expect this in the abstract. But I never imagined exactly how overwhelming this would turn out to be. Perhaps it's something I mentally glazed over, and hoped I'd be building cool new stuff from scratch a lot more. But it really is the case that most jobs are overwhelmingly maintenance, bug fixing, and support oriented.

Lack of professionalism: At uni, I always had the impression that commercial software work is very process-oriented and stringently engineered. I had images of ISO processes, reams of technical documentation, every feature and bug being strictly documented, and a generally professional environment. It came as a huge shock to realise that most software companies operate no differently to a team of students working on a large semester-long project. And I've worked in both the small agile hack shop, and the medium sized corporate enterprise. While I wouldn't say that it's always been outright "unprofessional", it definitely feels like the software industry (on the whole) is far from the strong engineering discipline that I expected it to be.

Has anyone else had similar experiences to this? What are the ways in which your expectations of what our profession would be like were different to the reality?

答:
Development is mainly teamwork. That means that communication (spoken and read), reading other's code and reusing previous modules (both in-house and external) is something to face almost everyday. In my college, at least I had to code with more people in very few occasions, so I thought that the main part of the work was to code alone, in the wilderness. It is not.

Explaining things to non-developers is hard (also covered for the first point), and is your responsibility to make your points (not of the other 99% of the world).

The good test is the test that fails. (the first time, at least) And, of course, there is no such thing as a bug-free code. You're not a bad programmer if you have bugs. Bugs are just a (very important and time-consuming) part of your job.

There are no silver bullets. Each technology has it's advantages and disadvantages.

College doesn't teach you state-of-the-art technologies. But also, 90% of the works uses pretty old technologies. Which, by the way, sometimes is what is needed.

Non-technical people make decisions about technical solutions, mostly for esoteric reasons like maintenance, partnership, worker's availability...

You're just beginning, young padawan.

I've begun to realize since then about the fact that coding is a work you do in conjunction with more people, specially now that open-source is more prominent. But when I was at college (late nineties), I was convinced that I was going to be doing things from scratch and not ever looking into other's code or having to coordinate with others...

Looking back, to me one of the best parts is learning and teaching others.

Title: Graduate expectations versus reality


答: I personally consider this a very bad practice. I prefer setting up a wiki with installation instructions and uploading necessary binaries to it. These files are needed only by new devs, there's no need to bloat repositories of everyone else.</p>

Title: Is it good practice to store framework runtimes under source control?

Body:
I know a lot of software shops keep binaries under source control. However, our shop had come to store entire frameworks on the repository: DirectX runtime, CUDA, nVidia Optix, whatever.

It is said to make a dev machine setup easier (supposedly, get latest and start coding). However, it considerably bloats the repository and burdens it with irrelevant history.

I've never seen such a usage pattern. Do you consider it a good practice?

[EDIT:] I have no problem with source-controlling isolated 3rd party binaries. The question refers to entire framework runtimes, typically consisting in 10+ binaries.    As an extreme example, take Windows SDK (which we don't keep on the repository, thank god, but I see no difference in principle).

OwnerDisplayName: Sergio Tulentsev


答:
I'm okay with version controlling binary assets. I'm against version controlling generated files.

Also, environment setup is something different from development. We mostly develop in Python and it has a tool called virtualenv which allows you to create a lightweight isolated environment (including libraries) for a project. When we check out our sources, we have a setup script in there which builds this virtualenv. Using a manifest, this specifies what versions of libraries are needed and other such things. None of this is version controlled. Only the setup script is.

Throwing the whole framework under your main project will clutter your history and seriously mess things up. It's not part of your project and should be treated differently.

OwnerDisplayName: Noufal Ibrahim