问:
Any suggestions how it would be good to promote software in a small company ?
Ok, I know if I am Red hat or other giant and offer some support etc. I can be profitable, in fact, Red Hat is doing quite well.

However, what about a small company where I create a small program. e.g. an instant messenger for a windows or linux (just as an illustration) and I want to sell it.

But how can I sell it if it is free and everybody can download it?

Any advice?

I like the idea of FSF by Richard Stallman, however I am missing the way how to sell my software under GNU/GPL licence.

Any advice, how can I solve this problem? Any profitable small business software developers around with their opinion?

Any links or names of small companies taht I can look at and study their model of business?

答:
I would suggest to make your Trial version first and spread it for FREE.
After your product become solid to be commercial (may take 6-12 months) you release a commercial version where you should support your paid customers.

Selling free software is logically non-sense. You may provide support service for open-source free software and charge for it, but not sell it.

Look at my post to a similar question, that might be the thing you look for - How to promote my newly developed software


问:
What's your favourite quote about programming?
What's your favourite quote about programming?

One quote per answer, and please check for duplicates before posting!

答:
Only wimps use tape backup: real men
  just upload their important stuff on
  ftp, and let the rest of the world
  mirror it ;)

-- Linus Torvalds

ContentLicense: CC BY-SA 3.0

LastEditorDisplayName: Roger Pate

OwnerDisplayName: jozilla

ContentLicense: CC BY-SA 2.5


答:
I'd think most of what I say in my answer to "how do I maximize exposure given limited time and no budget" would still be applicable: you basically have a slightly better budget, AND probably at least some time. Some most of the recommendations would apply.

I'm not sure if I should duplicate the content here (seems like a bad idea, especially considering it's a rather large answer), so just follow the link.

Title: Any suggestions how it would be good to promote software in a small company ?

Body:
Ok, I know if I am Red hat or other giant and offer some support etc. I can be profitable, in fact, Red Hat is doing quite well.

However, what about a small company where I create a small program. e.g. an instant messenger for a windows or linux (just as an illustration) and I want to sell it.

But how can I sell it if it is free and everybody can download it?

Any advice?

I like the idea of FSF by Richard Stallman, however I am missing the way how to sell my software under GNU/GPL licence.

Any advice, how can I solve this problem? Any profitable small business software developers around with their opinion?

Any links or names of small companies taht I can look at and study their model of business?


问:
Does it work when a developer is the project manager's boss?
I am in the planning stage of a project and I am looking to hire a project manager. I would like to do some coding and keep eye on all parts of the project. However, i have a feeling that a project manager will get better results. I have the following options:
1) manage the project and not code
2) hire a project manager and code myself

I am worried that the project manager will feel impeded by having the project owner in the development team. If I run the project, the team might fall apart causing the project to fail. To stick within budget, I have to be involved in one capacity or another.

Does anyone have experience with this situation, any suggestions?

more info: 4 in-house developers each responsible for a specific area. The developers can also outsource work if agreed to by the project manager.

答:
From my experience you should not be involved in the development team and have a project manager. The manager's responsibilities are to complete a set number of requirements within a specific time frame and budget.

I have always found when the project owner becomes too involved in the project, the scope increases - they start seeing possibilities half way in and want additional functionality included since they see it as only a small change.


问:
Is there any well-known commercial project which is currently an open source ?
I mean is there some open sourced projects that were started as closed source and were commercially successful also? I am also interested in any story behind open sourcing them.</p>

答:
Some "Formerly Commercial-Only" Projects

The IntelliJ IDE was originally closed-source

A lot of Id Software games, old (like Wolfenstein 3D) and not so old (like Doom 3)

A lot of projects released as open-source by Sun Microsystems started as closed-source experiments or products:

the JDK and JRE themselves,

NetBeans (interesting crossing history lines between the Forte For Java and NetBeans names)

The Star Office suite (later to be super-seded by Open Office, and now forked as Libre Office)

The source of (some versions and some parts of) the Microsoft Windows kernel is actually available for educational purposes and partners.

... and find many more just by using a search on a service like Google News

"Non-Commercial" / Internal Projects

There were also some non-commercial internal projects (used by a company or a group of companies, but not released to the general public) which got open-sourced after their end of life or after a while. For instance, NASA has been known to release a few things.

Notes

Some projects finally publish their source, but do not necessarily make it available under a copyleft or Free Software license.

Some projects are commercial but do publish their source to selected groups of people: in general universities, or partner enterprises. Depending on the licensing terms, you could argue this as being open-source.


问:
How do I convince my team that a requirements specification is unnecessary if we adopt user-stories?
We are planning to adopt user-stories to capture stakeholder 'intent' in a lightweight fashion rather than a heavy SRS (software requirements specifications). However, it seems that though they understand the value of stories, there is still a desire to 'convert' the stories into an SRS-like language with all the attributes, priorities, input, outputs, source, destination etc.

User-stories 'eliminate' the need for a formal SRS like artifact to begin with so what's the point in having an SRS? How should I convince my team (who are all very qualified CS folks by the way - both by education and practice) that the SRS would be 'eliminated' if we adopted user-stories for capturing the functional requirements of the system? (NFRs etc can be captured too, but that's not the intent of the question).

So here's my 'work-flow' argument: Capture initial requirements as user-stories and later elaborate them to use-cases (which are required to be documented at a low level i.e. describing interactions with the UI prototypes/mockups and are a deliverable post deployment). Thus going from user-stories to use-cases rather than user-stories to SRS to use-cases.

How are you all currently capturing user-stories at your workplace (if at all) and how do you suggest I 'make a case' for absence of SRS in presence of user-stories?

答:
Baby steps. Continue to write the SRS for a while. Then call a meeting and discuss whether they still serve a purpose. Does anyone still read them? Is the time spent on them justified? Is there another intermediate step that would be more lightweight?

You never know, you might find that you're wrong. Remember the Agile manifesto, we find more value in "Working software over comprehensive documentation," but there is still value in the latter.

My guess though is that you'll quickly discover that the desire to continue to write heavy documents falls away when they see how closely use cases and user stories relate.


答:
Epics are Placeholders

In just about any Agile methodology the concept of Epics would be as much as you should need for a Requirements Specification, place holders is what you need at that level. Those entries will be prioritized constantly, any more detail is wasted effort if the requirement gets low priority for a long time, or never even gets implemented. Documenting it and managing the documentation around it would be a complete waste of time. YAGNI extends to requirements activities as well as coding activities.

Tools are your friend!

If you use a proper tool to collect and manage the user stories, then you can generate the Requirements Specification from them. A requirements specification is an temporal artifact document anyway, it isn't a living document, it is a snapshot of requirements in time. And is never in sync with reality.

Automatically Generate Artifacts

User stories that can be exported from a proper tool are way more valuable than any static artifact document anytime. Personally I prefer Pivotal Tracker to track User Stories, I even wrote a suite of MoinMoin plugins in Python to publish all the various Stories and their states in the Wiki ( which contained detailed developer notes and the like about the stories ), live data is always better than static data.

The Wiki became a live document of all the stores/requirements and their state of completion and priority with details and comments and other meta data.

Way better than a huge Word document in Sharepoint that just gets emailed around constantly and never updated, guaranteeing that everyone has a different version and is out of sync with everyone else!

User Stories are Richer than Use Cases

The Use Story is much more valuable than a Use Case because they say WHY.

The User Story format: As a [ROLE] I [ACTIVITY] so that [WHY] is much more expressive than Use Cases that are like The System [shall/shall not/may/must] perform [action] ( where action is a flow chart ).

With a User Story, you have WHO wants to do something, you have WHAT they want to do ( which can point to a more detailed diagram/document for complex tasks ) and you have the most important part WHY they want to do this activity.

If you have the first, the second is completely redundant, and just noise at best. A traditional formal requirements specification from a Waterfall methodology has no place in an Agile environment.

In the End

If your management isn't committed to change you aren't going to be successful with a new methodology. I have worked for a 100+ billion dollar a year company, they didn't take baby steps in moving to Agile/SCRUM, they just said, the entire company is moving to this, here is the new way of doing things, here is when your training on the new way is going to start, here are the new tools we are going to use, here is the date we start doing things this way. It worked for them in less than a year. I have worked on implementing this in smaller companies with the same success.

Commitment

baby steps implementations, regardless of what the change is, is a recipe for failure. It is a code word for management that they quietly don't agree and are passively aggressively setting you up for failure. They are saying I don't believe in this enough to commit to it, so I will let you do just enough to fail/not succeed, that way they can say they tried and it didn't work and they way they were managing worked just fine all along. Partial commitment ultimately leads to failure.

In your case, they probably quietly don't believe in the User Stories, and after a while of doing both they will start to claim it is the User Stories that are useless and not the SRS, and will push to stop writing the User Stories, which will just lead you backwards not forwards.

Title: How do I convince my team that a requirements specification is unnecessary if we adopt user-stories?

Body:
We are planning to adopt user-stories to capture stakeholder 'intent' in a lightweight fashion rather than a heavy SRS (software requirements specifications). However, it seems that though they understand the value of stories, there is still a desire to 'convert' the stories into an SRS-like language with all the attributes, priorities, input, outputs, source, destination etc.

User-stories 'eliminate' the need for a formal SRS like artifact to begin with so what's the point in having an SRS? How should I convince my team (who are all very qualified CS folks by the way - both by education and practice) that the SRS would be 'eliminated' if we adopted user-stories for capturing the functional requirements of the system? (NFRs etc can be captured too, but that's not the intent of the question).

So here's my 'work-flow' argument: Capture initial requirements as user-stories and later elaborate them to use-cases (which are required to be documented at a low level i.e. describing interactions with the UI prototypes/mockups and are a deliverable post deployment). Thus going from user-stories to use-cases rather than user-stories to SRS to use-cases.

How are you all currently capturing user-stories at your workplace (if at all) and how do you suggest I 'make a case' for absence of SRS in presence of user-stories?


问:
Spring MVC vs raw servlets and template engine?

Possible Duplicate:

  Why not Spring framework?

I've read numerous articles about the Spring MVC framework, and I still can't see the benefits of using it.  It looks like writing even a simple application with it requires creating a big hodgepodge of XML files and annotations and other reams of code to conform to what the framework wants, a whole bunch of moving parts to accomplish a simple single task.

Any time I look at a Spring example, I can see how I can write something with the same functionality using a simple servlet and template engine (e.g. FreeMarker, StringTemplate), in half the lines of code and little or no XML files and other artifacts.  Just grab the data from the session and request, call the application domain objects if necessary, pass the results to the template engine to generate the resulting web page, done.

What am I missing?  Can you describe even one example of something that is actually made simpler with Spring than using a combination of raw servlets with a template engine?  Or is Spring MVC just one of those overly complicated things that people use only because their boss tells them to use it?

EDIT: A summarized concrete description would be helpful.  For example, "I used Spring MVC to build an application that did XYZ, and its feature Q saved me from having to do the extra work of A and B and C which would have been necessary with raw servlets and a template engine."  Simply mentioning marketing buzzwords like "dependency injection" doesn't clarify anything.

答:
dependency injection  (you need this for unit tests)

easy to define request mappings makes creating a restful api possible in mins

custom jsp tags

jdbcTemplate

an enourmous library of useful functions (eg security, internationalization, device interceptor etc etc)

Is just a few of the practical benefits you can get off the top of my head.  Its sheer size can be offputting, and the config is somewhat confusing to begin with, and still cause sme problems now and again (after two years).

Yes it promotes to model-view-controller, controllers are so much nicer to write than vanilla servlets (less verbose, more powerful).

It has a learning curve, once that has been passed you can definitely be more productive with spring, than without, imho.


答:
I would try and use humor.

Start with the http://www.halfarsedagilemanifesto.org/

Talk about this for a while (diversion)

and talk about what the conflicts in it really mean (open discussion),

then after a while turn to your organization (pivot)

and examine SRS and whether it makes sense with the new project set-up.

Then I would conclude (or maybe in another meeting) with a discussion about the  change in the approach re: SRS and see if you have more consensus.

At the end of the day you are also constrained by budget and serving the business folks so there may be a point where you are a bit firmer in just what gets used, but this really depends on the industry, company size, organizational factors and many other such factors.


答: Gish, Penumbra, Lugaru and Aquaria were open-sourced following the success of the first Humble Bundle promotion.</p>

Title: Is there any well-known commercial project which is currently an open source ?

Body: I mean is there some open sourced projects that were started as closed source and were commercially successful also? I am also interested in any story behind open sourcing them.</p>


问:
What are the drawbacks of Python?
Python seems all the rage these days, and not undeservingly - for it is truly a language with which one almost enjoys being given a new problem to solve. But, as a wise man once said (calling him a wise man only because I've no idea as to who actually said it; not sure whether he was that wise at all), to really know a language one does not only know its syntax, design, etc., advantages but also its drawbacks. No language is perfect, some are just better than others.

So, what would be in your opinion, objective drawbacks of Python.

Note: I'm not asking for a language comparison here (i.e. C# is better than Python because ... yadda yadda yadda) - more of an objective (to some level) opinion which language features are badly designed, whether, what are maybe some you're missing in it and so on. If must use another language as a comparison, but only to illustrate a point which would be hard to elaborate on otherwise (i.e. for ease of understanding)

答:
Using indentation for code blocks instead of {} / begin-end, whatever.

Every newer modern language has proper lexical scoping, but not Python (see below).

Chaotic docs (compare with Perl5 documentation, which is superb).

Strait-jacket (there's only one way to do it).

Example for broken scoping; transcript from interpreter session:

```<code>>>> x=0
>>> def f():
...     x+=3
...     print x
...
>>> f()
Traceback (most recent call last):
  File "", line 1, in ?
  File "", line 2, in f
UnboundLocalError: local variable 'x' referenced before assignment
</code>```

global and nonlocal keywords have been introduced to patch this design stupidity.

Title: What are the drawbacks of Python?

Body:
Using indentation for code blocks instead of {} / begin-end, whatever.

Every newer modern language has proper lexical scoping, but not Python (see below).

Chaotic docs (compare with Perl5 documentation, which is superb).

Strait-jacket (there's only one way to do it).

Example for broken scoping; transcript from interpreter session:

>>> x=0
>>> def f():
...     x+=3
...     print x
...
>>> f()
Traceback (most recent call last):
  File "", line 1, in ?
  File "", line 2, in f
UnboundLocalError: local variable 'x' referenced before assignment

global and nonlocal keywords have been introduced to patch this design stupidity.


问:
How do I handle a user story that I complete, but with compromise and need to revisit?
I have just fulfilled (is that a good term?) two user stories out of a new project backlog I have just built. These are user registration and password reset, both requiring mail. I need to implement a substitute mail component because my initial choice, and a normally reliable one, wasn't working. Because I was focused on delivering the user stories, not debugging the mail component, I swapped it out to deliver working code at sprint end. Do I now log a new support issue for the mailer, or 're-insert' these stories into the backlog? If I do the latter, am I not introducing too much tech detail into user stories?</p>

答:
Technical Debt is just another Story

If a story is done that means it has passed QA and been accepted by the Product Owner.

Any work that might need to be done to "clean up" or "improve" the implementation is considered Technical Debt and should simply be a new Story.

That way it will be tracked and prioritized by the Product Owner just like everything else.


问:
At what point can I say I've "learned" a language?
In my few years of programming, I've toyed with everything from Ruby to C++.  I've done everything from just learning basic syntax (Ruby) to completing several major (for me) projects that stretched my abilities with the language.  Given this variety (and the fact that truly learning a language never stops), when can I say I know (or have learned) a language?</p>

答: When you start noticing its flaws. Once you start learning a language you are usually still busy learning now to do stuff or are much involved in it to notice where it fails (of course, this is unless you start learning it from a negative point of view just to see how worse it is compares to your favorite language so far). I'd say you don't truly know a language until you are acutely aware of the areas where it fails.</p>


问:
Overwhelmed by complex C#/ASP.NET project in Visual Studio 2008
I have been hired as a junior programmer to work on projects that extend existing functionality in a very large, complex solution. The code base consists of C#, ASP.NET, jQuery, javascript, html and xml.

I have some knowledge of all these in addition to fair knowledge of object-oriented programming and its fundamental concepts of inheritance, abstraction, polymorphism and encapsulation. I can follow code up through its base classes, interfaces, abstract classes and understand a large part of the code that I read while doing this.

However, this solution is so humongous and so many things get tied together whenever I navigate through the code that I feel absolutely overwhelmed. I often find myself unable to fully follow everything that is going on with objects being serialized, large amounts of C# and javascript operating on the same pages and methods being called from template files that consist mainly of markup.

I love learning about code, but trying to deal with this really stresses me out.

Additionally, I do know that a significant amount of unit testing has been done but I know nothing about unit testing or how to utilize it.

Any advice anyone could offer me regarding dealing with a large code base while using Visual Studio 2008 would be greatly appreciated. Are there tools that I can use to help get a handle on what is going on? Perhaps there are things even in Visual Studio that I am not aware of. How can I follow the code to low level functionality in order to get a better grasp of what is going on at a high level?

答:
Like you, I always step through the lines in the code base to get a basic feel.

I know how you feel, one time I got hired in the 10th iteration of a large scale web project. Its architecture was one of the prototype's for http://webformsmvp.com/ . So it was totally new and we we're using commerce server 2007 too, no one in the country had experience with it! I was thrown in the deep end, writing Rhino Mocking Tests which I too had no clue how to do at the time.

If you're a new starter they will give you three months to prove yourself and you're a junior so aren't expected to know everything.

The trick is do the initial research on anything your tasked with and be prepared to  answer: http://WhatHaveYouTried.com. When other developers see you putting in effort and how your thinking works they will be more likely to give you a hand.

The initial research also requires examining the source control system, as all the info is likely in the history, checkin comments & work items.


答:
Stepping through the code can be great at determining functionality.  But I have found the more complex an application is, the more likely you are to be bounced around in the debugger and get completely lost.

I would focus on understanding the business rules of a particular piece of functionality of the application.  Ideally, focus on the simplest part.  For example, if your web site has users, focus on how the users are registered.  What is required for them to register?  Email?  Zip Code? Blood type?  If the code is not clear, then there is no harm in asking other developers specific questions about the business rules (well unless they are jerks).

Once you have a set of business rules nailed down, look at the code and determine how they are enforced.  Is the input validated on the server?  Client?  Where is that validation stored?  Then look how the data gets inserts/updated/delete/selected from the database/repository?  What class libraries are invoked?  The unit tests are also an excellent place to help figure out business rules.

Unless the other developers are insane, most of the other aspects of the applications will follow a similar process.

As for unit testing, one book that really helped me get a good grasp on unit testing is The Art of Unit Testing.  It lays a good foundation and will give a good start on how to do it correctly.  The best way to learn unit testing is to start doing it.  As you read the book create a test application to try out some of the techniques.

Title: Overwhelmed by complex C#/ASP.NET project in Visual Studio 2008

Body:
I have been hired as a junior programmer to work on projects that extend existing functionality in a very large, complex solution. The code base consists of C#, ASP.NET, jQuery, javascript, html and xml.

I have some knowledge of all these in addition to fair knowledge of object-oriented programming and its fundamental concepts of inheritance, abstraction, polymorphism and encapsulation. I can follow code up through its base classes, interfaces, abstract classes and understand a large part of the code that I read while doing this.

However, this solution is so humongous and so many things get tied together whenever I navigate through the code that I feel absolutely overwhelmed. I often find myself unable to fully follow everything that is going on with objects being serialized, large amounts of C# and javascript operating on the same pages and methods being called from template files that consist mainly of markup.

I love learning about code, but trying to deal with this really stresses me out.

Additionally, I do know that a significant amount of unit testing has been done but I know nothing about unit testing or how to utilize it.

Any advice anyone could offer me regarding dealing with a large code base while using Visual Studio 2008 would be greatly appreciated. Are there tools that I can use to help get a handle on what is going on? Perhaps there are things even in Visual Studio that I am not aware of. How can I follow the code to low level functionality in order to get a better grasp of what is going on at a high level?


问:
Why aren't databases integrated as a language feature?
Are there any programming languages that have a built-in database as a first-class language feature rather than connecting to an external SQL (or other) database? What would be the drawbacks and benefits to such a feature? What would such a feature look like and how would it change the way we program?</p>

答:
As former Visual Foxpro developer, I tough that is odd that no mainstream language define the relational model as part of the language.

Having the full database engine is not good idea, but having the "SQL" language instead could be VERY useful.

In OO, exist the impedance mismatch. This happened because objects and set not like each other. But if a language let me define TABLES, FIELDS, RELATIONS, CONSTRAINS, etc (without tie it to a particular storage) will be very powerful. Plus, making a ORM will be more 1-to-1 mapping.


问:
My boss decided to add a "person to blame" field to every bug report. How can I convince him that it's a bad idea?
In one of the latest "WTF" moves, my boss decided that adding a "Person To Blame" field to our bug tracking template will increase accountability (although we already have a way of tying bugs to features/stories). My arguments that this will decrease morale, increase finger-pointing and would not account for missing/misunderstood features reported as bug have gone unheard.

What are some other strong arguments against this practice that I can use? Is there any writing on this topic that I can share with the team and the boss?

答:
If my boss did that the following would happen, in this exact order:

1) I would immediately start looking for a new job.

2) Every time a bug is reported with a person to blame, my boss's name would appear there, and a comment as to why a bad process in the team is responsible for it. And CC that to his boss (preferably in a batch). Do you have unit tests? If not then it means that the dev process is broken, thus the bug. Do you have constant automated integration testing with all external systems? Then the dev process is broken, thus the bug. Do you have the ability to make every environment identical in production via script to not allow human error? Then the dev process is broken, thus the bug. Is one developer terrible? Then the hiring criteria is badm thus the boss's fault. Are all developers making stupid mistakes due to lack of rest because they are working 12 hrs a day? Then the dev process is broken. As you can see 100% of the bugs are the fault of the boss.

As a side note: Every good development manager is aware of what I wrote above. And Agile strategies are meant to point out to the boss or his/her supperiors why dev is slowing down: Look, we're spending 50% of our time fixing bugs. Lets look at strategies to reduce them so we can spend 40% of the time fixing bugs, and then revisit this problem getting it to 30%. etc.

Unfortunately it sounds like you don't have a good manager because of the field. So I suggest doing (1) and not bringing it up to the manager (except on your exit interview)


答:
You can't trust code that you did not totally create yourself.  (Especially code from companies that employ people like me.)

  — Ken Thompson, "Reflections on Trusting Trust"

Body:
What's your favourite quote about programming?

One quote per answer, and please check for duplicates before posting!


答:
ASP.Net is a complicated stack to understand as you have C# and OOP (which you are already familiar with) but you will also have to grasp the web specific technologies like Page Lifecycle, HTML, CSS, HTTP and  Javascript/jQuery. So it is natural to be overwhelmed and it seems the application is not properly designed as well. But that is the reality in most software systems.

I would approach it in two directions first learn the technical areas you are weak (like jQuery, unit testing) on its own outside the application and second try to trace/debug one transaction end to end from UI to DB. Also try to understand the unit tests, they can be very helpful if written properly. Code navigation using Visual Studio is quite OK but if you can get a tool like Resharper it is better. ASP.Net has built in tracing  to spit out diagnostics as well.


问:
HP openview servicedesk: looking for api information ?
Good day folks.

I am very confused in this situation. I need to implement system which will be based on HP open view service desk 4.5 api. But this system are reached the end of supporting period. On oficial site no information available
I am looking an information about this API(articles, samples etc). Now i have only web-api.jar and javadoc. Methods in javadoc is bad documented.

If you have any info, please share it with me. Thanks.

Second question: there are methods for api(with huge amount of methods) understanding if it not documented or information is not available?

PS:If it question is not belong here i will delete it.

答:
Here is a blog post http://tebest.net/hp-openview-servicedesk-api/50 that came up as the first search result on Google, the second search result was this question. You could probably contact the person who wrote the blog entry to understand more about the API.

I am writing this as an answer because I am not able to comment on the question.


问:
Why is better to use external  JavaScript or libraries ; and is it prefered to use jquery meaning more security?
I read this article Unobtrusive JavaScript with jQuery
and I noticed these points in the slide page 11

some companies strip JavaScript at the firewall

some run the NoScript Firefox extension to protect themselves from common XSS and CSRF attacks

many mobile devices ignore JavaScript entirely

screen readers do execute JavaScript but accessibility issues mean you may not want them to

I did not understand the fourth point. What does it mean?

I need your comment and responses on these points. Is not using JavaScript and switching to libraries like jQuery worth it?

UPDATE 1 :

whats the meaning of Unobtrusive JavaScript with jQuery ?
and yes it does not say we should use libraries but we should have them on external files for that reason i asked my question.

答:
jQuery is written in Javascript. It is Javascript. Anything that blocks Javascript will block jQuery (and all such frameworks).

Almost all mobile devices have full Javascript support.

Screen readers are for sight related disabilities. They read aloud what is on the screen.


答:
All of your points are completely unrelated to the fact if you are using plain JavaScript or a library such as jQuery (which is written in JavaScript, too).

Firewall: If they strip JavaScript, both your library and the code using it will be stripped, too. However, nowadays such a firewall config is extremely unlikely.

NoScript: Also blocks both. And people using it will whitelist a site that they want to use if it needs JS.

Modern devices usually have modern webkit-based browsers which run JavaScript just as fine as a desktop browser.

You simply misunderstood the article you linked to. It's about making pages work without JavaScript, too, so people who do not have JavaScript enabled for some reason can use your page.

Title: Why is better to use external  JavaScript or libraries ; and is it prefered to use jquery meaning more security?

Body:
I read this article Unobtrusive JavaScript with jQuery
and I noticed these points in the slide page 11

some companies strip JavaScript at the firewall

some run the NoScript Firefox extension to protect themselves from common XSS and CSRF attacks

many mobile devices ignore JavaScript entirely

screen readers do execute JavaScript but accessibility issues mean you may not want them to

I did not understand the fourth point. What does it mean?

I need your comment and responses on these points. Is not using JavaScript and switching to libraries like jQuery worth it?

UPDATE 1 :

whats the meaning of Unobtrusive JavaScript with jQuery ?
and yes it does not say we should use libraries but we should have them on external files for that reason i asked my question.


答:
How can I follow the code to low level functionality in order to get a
  better grasp of what is going on at a high level?

Short answer: you can't.

Longer answer:

Any non-trivial application is going to be too big very soon for you to try and understand it in a bottom up manner. This gets worse as soon as a framework and/or patterns like observers are involved. You are either going to miss a lot just reading the code (How the heck did they do this? Where the heck is that coming from?), or will be bounced around in the debugger through heaps of framework code and you will quickly lose track of for which part of your functional code you have entered that piece of framework code.

To get a feel for the application and find your way around the code: focus and don't try to understand the whole thing. At least not all at once.

Start from the user interface.

Identify major chunks of functionality.

Break these up even further. Preferably into what could be considered user stories or use cases. For example listing and filtering 's, entering a , registering a user, listing users, authorising users, loging in, etc.

Take a top-down approach to see how they have been implemented.

Try and map user interface stuff to files in the solution. For example an application page to its html equivalent(s).

Figure out which classes are involved in the implementation of that part of the application.

Ignore any cross-cutting concerns (logging, exception handling, printing, even database operations). They are usually implemented in some kind of framework or library anyway and can "safely" be ignored if you are tracking the actual functionality of an application. If you need to use them, you can make them a seperate subject of your investigation.


问:
Proper way to implement Android XML onClick attribute in Activity
I have used the android:onClick attribute extensively in my XML layouts for my Android application.

Example:

```<code><Button
    android:id="@+id/exampleButton"
    android:onClick="onButtonClick" />
</code>```

Is it proper to create an Interface to enforce the implementation of those onClick methods in Activities that use that layout file?

```<code>public interface MyButtonInterface {
    public onButtonClick(View v);
}
</code>```

答:
```<code><?xml version="1.0" encoding="utf-8"?>
<!-- layout elements -->
<Button android:id="@+id/mybutton"
    android:layout_width="wrap_content"
    android:layout_height="wrap_content"
    android:text="Click me!"
    android:onClick="myFancyMethod" />
<!-- even more layout elements -->
</code>```

The above code just shows the XML implementation. Now in the background Android does nothing else than the Java code calling your method on a click event.

Note that with the XML above, Android will look for the onClick method myFancyMethod() only in the currently active Activity's .java file. This is important to remember if you are using fragments, since even if you add the XML above using a fragment, Android will not look for the onClick method in the .java file of the fragment used to add the XML.

```<code>protected void onCreate(final Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.dialog);
}

public void myFancyMethod(final View view) {
    System.out.println("clicked");
}
</code>```

Body:
<?xml version="1.0" encoding="utf-8"?>
<!-- layout elements -->
<Button android:id="@+id/mybutton"
    android:layout_width="wrap_content"
    android:layout_height="wrap_content"
    android:text="Click me!"
    android:onClick="myFancyMethod" />
<!-- even more layout elements -->

The above code just shows the XML implementation. Now in the background Android does nothing else than the Java code calling your method on a click event.

Note that with the XML above, Android will look for the onClick method myFancyMethod() only in the currently active Activity's .java file. This is important to remember if you are using fragments, since even if you add the XML above using a fragment, Android will not look for the onClick method in the .java file of the fragment used to add the XML.

protected void onCreate(final Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.dialog);
}

public void myFancyMethod(final View view) {
    System.out.println("clicked");
}


答:
Run any method of a librabry writter in javascript, means run javascript. JQuery like library acts as a javascript wrap. If you execute a JQ method on your page, It is going to be executed and translated as a javascript method.

Javascript engine exist in every place you can view a web page.


问:
Does connection pooling work fine to execute 60 DB queries to load a page?
We use Linq2Sql in an ASP.NET application. Unfortunately the eager-loading in Linq2Sql isn't as powerful as in Entity Framework, so a lot of the data has to be lazy loaded as needed.

Taking connection pooling into account, is it OK for a web page to execute 60 queries to load a page?  Executing a single big query probably won't be much better, as those 60 queries will all those connection pooled connections and not open a new connection each time (which I realize is slow).

Any thoughts?

答:
Is it OK for a web page to execute 60 queries to load a page?

I would say this is not usual. Why are there 60 different queries on 1 page? Even if you need 60 different queries, you probably could group them in several result sets where each result set uses its own connection and may be run them in parallel or Asynch. pattern (see Using Parallel Extensions for .NET 4 in ASP.NET apps) but using a connection per query is not good INMO.

Also, it may be worthwhile to consider re-designing the interface so that it uses drill-down style where only relevant data is shown when needed.

ContentLicense: CC BY-SA 4.0


答:
One thing is what it takes to load one page.  Another thing is what it takes to serve X concurrent users per second (which is what the acceptance test hopefully includes).

You will most likely find that the scalability issue will bring the database to its knees and do so very rapidly.  If so, you have three options:

Use fewer queries.

Cache database query responses.

Put a frontend like Varnish in front of your application and rewrite your application to enable Varnish to cache as much as possible transparently to you.

My gut feeling is that 60 queries pr page will become a bottleneck, and that your team should set up a load testing system simulating X users which e.g. could run every night, and let you know as soon as possible when the application becomes too slow to be accepted.

Title: Does connection pooling work fine to execute 60 DB queries to load a page?

Body:
We use Linq2Sql in an ASP.NET application. Unfortunately the eager-loading in Linq2Sql isn't as powerful as in Entity Framework, so a lot of the data has to be lazy loaded as needed.

Taking connection pooling into account, is it OK for a web page to execute 60 queries to load a page?  Executing a single big query probably won't be much better, as those 60 queries will all those connection pooled connections and not open a new connection each time (which I realize is slow).

Any thoughts?


问:
What are the commonly confused encodings that may result in identical test data?
I'm fixing code that is using ASCIIEncoding in some places and UTF-8 encoding in other functions.

Since we aren't using the UTF-8 features, all of our unit tests passed, but I want to create a heightened awareness of encodings that produce similar results and may not be fully tested.

I don't want to limit this to just UTF-8 vs ASCII, since I think issue with code that handles ASN.1 fields and other code working with Base64.

So, what are the commonly confused encodings that may result in identical test data?

答: Windows Codepages and Extended ASCII support are virtually guaranteed to throw you a curveball.</p>


答:
Here is a jQuery method:

```<code>function (deep) {
    if (window.$ === jQuery) {
        window.$ = _$;
    }

    if (deep && window.jQuery === jQuery) {
        window.jQuery = _jQuery;
    }

    return jQuery;
}
</code>```

As you can see, it is plain javascript. jQuery is javascript. It is a set of methods to help you produce code faster.

jQuery is not something magic.

The "unobtrusive" part can be done using simply javascript.

The thing is, a few years ago, people used javascript like this:

HTML:

```<code><a href="#" onclick="javascript:someMethod();"></a>
</code>```

JS:

```<code>function someMethod() {
}
</code>```

This is obtrusive, because the javascript code is in the HTML. This is mixing the content and the behavior. Not very good for many reasons (maintainability, mostly).

However, in javascript, you could also do:

```<code>document.getElementById( 'someId' ).onclick = someMethod;

function someMethod() {
}
</code>```

But javascript was seen as an ugly language for kids, so nobody bothered to do anything pretty.

jQuery kind of democratized javascript, and it quickly allows you to do something like:

```<code>$( '#someId' ).click( function() {
} );
</code>```

Which is why it is "unobtrusive javascript with jQuery".

PS: I'm not mentioning the other issues (firewall, mobile, etc) as they are dealt with in the other answers.

Body:
Here is a jQuery method:

function (deep) {
    if (window.$ === jQuery) {
        window.$ = _$;
    }

    if (deep && window.jQuery === jQuery) {
        window.jQuery = _jQuery;
    }

    return jQuery;
}

As you can see, it is plain javascript. jQuery is javascript. It is a set of methods to help you produce code faster.

jQuery is not something magic.

The "unobtrusive" part can be done using simply javascript.

The thing is, a few years ago, people used javascript like this:

HTML:

<a href="#" onclick="javascript:someMethod();"></a>

JS:

function someMethod() {
}

This is obtrusive, because the javascript code is in the HTML. This is mixing the content and the behavior. Not very good for many reasons (maintainability, mostly).

However, in javascript, you could also do:

document.getElementById( 'someId' ).onclick = someMethod;

function someMethod() {
}

But javascript was seen as an ugly language for kids, so nobody bothered to do anything pretty.

jQuery kind of democratized javascript, and it quickly allows you to do something like:

$( '#someId' ).click( function() {
} );

Which is why it is "unobtrusive javascript with jQuery".

PS: I'm not mentioning the other issues (firewall, mobile, etc) as they are dealt with in the other answers.


答:
A language that doesn't have everything is actually easier to program in than some that do.

  — Dennis M. Ritchie

Title: What's your favourite quote about programming?


问:
Parallelism implies concurrency but not the other way round right?
I often read that parallelism and concurrency are different things. Very often the answerers/commenters go as far as writing that they're two entirely different things. Yet in my view they're related but I'd like some clarification on that.

For example if I'm on a multi-core CPU and manage to divide the computation into x smaller computation (say using fork/join) each running in its own thread, I'll have a program that is both doing parallel computation (because supposedly at any point in time several threads are going to run on several cores) and being concurrent right?

While if I'm simply using, say, Java and dealing with UI events and repaints on the Event Dispatch Thread plus running the only thread I created myself, I'll have a program that is concurrent (EDT + GC thread + my main thread etc.) but not parallel.

I'd like to know if I'm getting this right and if parallelism (on a "single but multi-cores" system) always implies concurrency or not?

Also, are multi-threaded programs running on multi-cores CPU but where the different threads are doing totally different computation considered to be using "parallelism"?

答:
According to Wikipedia:

Parallel computing is a form of computation in which many calculations are carried out simultaneously, operating on the principle that large problems can often be divided into smaller ones, which are then solved concurrently ("in parallel").

That is, parallelism always implies concurrency.

Also, are multi-threaded programs running on multi-cores CPU but where the different threads are doing totally different computation considered to be using "parallelism"?

No. The essence of parallelism is that a large problem is divided into smaller ones so that the smaller pieces can be solved concurrently. The pieces are mutually independent (to some degree at least), but they're still part of the larger problem, which is now being solved in parallel.

The essence of concurrency is that a number of threads (or processes, or computers) are doing something simultaneously, possibly (but not necessarily) interacting in some ways. Wikipedia again:

Concurrency is a property of systems in which several computations are executing simultaneously, and potentially interacting with each other.


问:
What are some easy techniques to scan books for new information?
I find it irresistible to keep purchasing cheap programming and technical e-books in fields such as Drupal, PHP, etc., and also compulsively download free material made available such as those from Microsoft's developer blog...

The main problem with the large library I've developed is that there are many chapters (especially the first few) in these books packed with information I already know, but with helpful tidbits hidden in between. The logical step would be to skip those chapters and read the ones I don't seem to know anything about, but I'm afraid I may lose out on really important information this way. But naturally it is tedious to have to read about variables, functions and objects all over again when you are trying to know more about the Registry pattern, for example.

It's hard to research on the net for this, because my question itself seems vague and difficult to formulate into a single search query. I need people-advice - what do you do in this situation?

答:
I was in your situation some years ago, I couldn't stop buying books to read several times the same concept. I ended up paying more attention to what title to choose: several big editors have books from novice to professional, others suggest a learning path.

ADDENDUM

Better yet, give up on paper and consider other media. If the problem is finding new topics and arguments, a paper book is not the right way to solve it.

For example:

http://my.safaribooksonline.com/

or

www.pluralsight-training.net

The first is an ebook library with all you need, and the second a very good video training suite (more focused on .NET)


答:
At the point when your application or component can read mail, i.e. Zawinski's law, which states:

“Every program attempts to expand until it can read mail. Those
  programs which cannot so expand are replaced by ones which can.”
  Coined by Jamie Zawinski (who called it the “Law of Software
  Envelopment”) to express his belief that all truly useful programs
  experience pressure to evolve into toolkits and application platforms
  (the mailer thing, he says, is just a side effect of that).

This was updated when RSS became popular to "... can read RSS feeds" and probably could be updated these days to "... can read Twitter feeds". ;-)

Title: At what point can I say I've "learned" a language?

Body: In my few years of programming, I've toyed with everything from Ruby to C++.  I've done everything from just learning basic syntax (Ruby) to completing several major (for me) projects that stretched my abilities with the language.  Given this variety (and the fact that truly learning a language never stops), when can I say I know (or have learned) a language?</p>


问:
What popular "best practices" are not always best, and why?
"Best practices" are everywhere in our industry.  A Google search on "coding best practices" turns up nearly 1.5 million results.  The idea seems to bring comfort to many; just follow the instructions, and everything will turn out fine.

When I read about a best practice - for example, I just read through several in Clean Code recently - I get nervous.  Does this mean that I should always use this practice?  Are there conditions attached?  Are there situations where it might not be a good practice?  How can I know for sure until I've learned more about the problem?

Several of the practices mentioned in Clean Code did not sit right with me, but I'm honestly not sure if that's because they're potentially bad, or if that's just my personal bias talking.  I do know that many prominent people in the tech industry seem to think that there are no best practices, so at least my nagging doubts place me in good company.

The number of best practices I've read about are simply too numerous to list here or ask individual questions about, so I would like to phrase this as a general question:

Which coding practices that are popularly labeled as "best practices" can be sub-optimal or even harmful under certain circumstances?  What are those circumstances and why do they make the practice a poor one?

I would prefer to hear about specific examples and experiences.

答: I tend to ignore almost all best practices when doing a relatively small, one-off project, like writing a parser required to migrate files. When all I need is the result, once, I don't care about readablitiy, scalability, maintainability, etc.</p>


答:
Code can be concurrent, but not parallel.

Imagine multiple threads running on single core machine. This single core machine will only process one thread at the time, so there will be no parallelism of operations. But for each thread, thanks to how OS handles multiple threads, then each thread needs to assume all other threads are running at the same time.

Title: Parallelism implies concurrency but not the other way round right?

Body:
I often read that parallelism and concurrency are different things. Very often the answerers/commenters go as far as writing that they're two entirely different things. Yet in my view they're related but I'd like some clarification on that.

For example if I'm on a multi-core CPU and manage to divide the computation into x smaller computation (say using fork/join) each running in its own thread, I'll have a program that is both doing parallel computation (because supposedly at any point in time several threads are going to run on several cores) and being concurrent right?

While if I'm simply using, say, Java and dealing with UI events and repaints on the Event Dispatch Thread plus running the only thread I created myself, I'll have a program that is concurrent (EDT + GC thread + my main thread etc.) but not parallel.

I'd like to know if I'm getting this right and if parallelism (on a "single but multi-cores" system) always implies concurrency or not?

Also, are multi-threaded programs running on multi-cores CPU but where the different threads are doing totally different computation considered to be using "parallelism"?


答:
There are several options:

Buy books for advanced readers: If you think you are already too experienced to read about variables, basic types etc again and again, go on to the next step and buy a book which is written for more experienced people

Read through the chapters: If you are scared to miss something... simply read everything. This way you will also rebuild your old knowledge by repetition. Naturally you can only skim the text when you are proficient in the topics talked about in the chapter, but make sure you read the summary at the end of every chapter most authors provide

Skip to next chapter: If you think you know about the topic in one chapter simply skip it. Good authors will use the things explained in earlier chapters again anyway, so you could check if you missed something

Title: What are some easy techniques to scan books for new information?

Body:
I find it irresistible to keep purchasing cheap programming and technical e-books in fields such as Drupal, PHP, etc., and also compulsively download free material made available such as those from Microsoft's developer blog...

The main problem with the large library I've developed is that there are many chapters (especially the first few) in these books packed with information I already know, but with helpful tidbits hidden in between. The logical step would be to skip those chapters and read the ones I don't seem to know anything about, but I'm afraid I may lose out on really important information this way. But naturally it is tedious to have to read about variables, functions and objects all over again when you are trying to know more about the Registry pattern, for example.

It's hard to research on the net for this, because my question itself seems vague and difficult to formulate into a single search query. I need people-advice - what do you do in this situation?


答:
From experience with other systems, I'd say yes connection pooling will kick in and you'll only open 1 connection for all those queries. You should check this though.

That still doesn't solve your performance problems though, even assuming all those queries run sequentially (and therefore reuse a single connection) you're still hitting the DB 60 times. This puts a load on the single shared resource that is your DB. If 100000 people access your page, that's a whole lot of contention on your DB which will undoubtedly cause some problems. So firstly, make sure your DB locking strategy is good so pure reads don't lock everything up, then work on reducing the complexity of your pages.


问:
Why after each restart, my local .NET sites take time to load for the first time?
I'm developing sites based on .NET platform. I usually deploy these sites on my local IIS, so that I can test them and see their functionality before going live. However, each time I restart windows, it seems that sites take a long time to run for the first time.

I know about JIT and I'm also aware of this question, but it doesn't answer my question.

Does JIT happens every time you restart windows? Is it related to creation of w3wp.exe process? Why sites are so slow for the first request after each restart?

答: Part of the problem is also the GAC. Libraries places there will need to be security checked everytime they are loaded up - that means a whole load of encryption type work being carried out, and this slows things down a lot. There was a talk about WPF performance a while back from MS that described this problem - their answer was "don't put stuff in the GAC if you can't help it"</p>


问:
What's your favourite quote about programming?
What's your favourite quote about programming?

One quote per answer, and please check for duplicates before posting!

答:
```<code>double value; /* or your money back! */
short changed; /* so triple your money back! */
</code>```

cons.c on perl source tree

Body:
double value; /* or your money back! */
short changed; /* so triple your money back! */

cons.c on perl source tree


问:
The design of a generic data synchronizer, or, an [object] that does [actions] with the aid of [helpers]
I'd like to create a generic data-source "synchronizer," where data-source "types" may include MySQL databases, Google Spreadsheets documents, CSV files, among others.  I've been trying to figure out how to structure this in terms of classes and interfaces, keeping in mind (what I've read about) composition vs. inheritance and is-a vs. has-a, but each route I go down seems to violate some principle.

For simplicity, assume that all data-sources have a header-row-plus-data-rows format.  For example, assume that the first rows of Google Spreadsheets documents and CSV files will have column headers, a.k.a. "fields" (to parallel database fields).

Also, eventually, I would like to implement this in PHP, but avoiding language-specific discussion would probably be more productive.

Here's an overview of what I've tried.

Part 1/4: ISyncable

```
class CMySQL implements ISyncable
    GetFields()     // sql query, pdo statement, whatever
    AddFields()
    RemFields()
    ...
    _dbh
```

```
class CGoogleSpreadsheets implements ISyncable
    GetFields()     // zend gdata api
    AddFields()
    RemFields()
    ...
    _spreadsheetKey
    _worksheetId
```

```
class CCsvFile implements ISyncable
    GetFields()     // read from buffer
    AddFields()
    RemFields()
    ...
    _buffer
```

```
interface ISyncable
    GetFields()
    AddFields($field1, $field2, ...)
    RemFields($field1, $field2, ...)
    ...
    CanAddFields()  // maybe the spreadsheet is locked for write, or
    CanRemFields()  // maybe no permission to alter a database table
    ...
    AddRow()
    ModRow()
    RemRow()
    ...
    Open()
    Close()
    ...
```

First Question: Does it make sense to use an interface, as above?

Part 2/4: CSyncer

Next, the thing that does the syncing.

```
class CSyncer
    __construct(ISyncable $A, ISyncable $B)
    Push()          // sync A to B
    Pull()          // sync B to A
    Sync()          // Push() and Pull() only differ in direction; factor.
                    // Sync()'s job is to make sure that the fields on each side
                    // match, to add fields where appropriate and possible, to
                    // account for different column-orderings, etc., and of
                    // course, to add and remove rows as necessary to sync.
    ...
    _A
    _B
```

Second Question: Does it make sense to define such a class, or am I treading dangerously close to the "Kingdom of Nouns"?

Part 3/4: CTranslator? ITranslator?

Now, here's where I actually get lost, assuming the above is passable.

Sometimes, two ISyncables speak different "dialects."

For example, believe it or not, Google Spreadsheets (accessed through the Google Data API "list feed") returns column headers lower-cased and stripped of all spaces and symbols!  That is, sys_TIMESTAMP is systimestamp, as far as my code can tell.  (Yes, I am aware that the "cell feed" does not strip the name so; however cell-by-cell manipulation is too slow for what I'm doing.)

One can imagine other hypothetical examples.  Perhaps even the data itself can be in different "dialects."  But let's take it as given for now, and not argue this if possible.

Third Question: How would you implement "translation"?

Note: Taking all this as an exercise, I'm more interested in the "idealized" design, rather than the practical one.  (God knows that shipped sailed when I began this project.)

Part 4/4: Further Thought

Here's my train of thought to demonstrate I've thunk, albeit unfruitfully:

First, I thought, primitively, "I'll just modify CMySQL::GetFields() to lower-case and strip field names so they're compatible with Google Spreadsheets."  But of course, then my class should really be called, CMySQLForGoogleSpreadsheets, and that can't be right.

So, the thing which translates must exist outside of an ISyncable implementor.

And surely it can't be right to make each translation a method in CSyncer.

If it exists outside of both ISyncable and CSyncer, then what is it?  (Is it even an "it"?)

Is it an abstract class, i.e. abstract CTranslator?

Is it an interface, since a translator only does, not has, i.e. interface ITranslator?

Does it even require instantiation?  e.g. If it's an ITranslator, then should its translation methods be static?  (I learned what "late static binding" meant, today.)

And, dear God, whatever it is, how should a CSyncer use it?  Does it "have" it?  Is it, "it"?

Who am I?  ...am I, "I"?

I've attempted to break up the question into sub-questions, but essentially my question is singular:

How does one implement an object A that conceptually "links" (has) two objects b1 and b2 that share a common interface B, but where certain pairs of b1 and b2 require a helper, e.g. a translator, to be handled by A?

Something tells me that I've overcomplicated this design, or violated a principle much higher up.

Thank you all very much for your time and any advice you can provide.

答: Your translators are a standard use case for the decorator pattern. The translator implements the interface, but uses a hard implementor to do most of the work; shaping the data to be consistent and/or uniform where it needs to.


问:
Is it important to obfuscate C++ application code?
In the Java world, sometimes it seems to be a problem, but what about C++? Are there different solutions?

I was thinking about the fact that someone can replace the C++ library of a specific OS with a different version of the same library, but full of debug symbols to understand what my code does. Is it a good thing to use standard or popular libraries?

This can also happen with some dll library under Windows replaced with the "debug version" of that library. Is it better to prefer static compilation? In commercial applications, I see that for the core of their app they compile everything statically and for the most part, the DLLs (dynamic libraries in general) are used to offer some third party technologies like anti-piracy solutions (I see this in many games), GUI library (like Qt), OS libraries, etc.

Is static compilation the equivalent to obfuscation in the Java world? In better terms, is it the best and most affordable solution to protect your code?

答:
Don't Waste Your Time on Losing Battles

As noted in many other similar answers for C++ and other languages, this is mostly useless.

Further Reading

Selected reads on the topic (not all are C++ specific, but the general principles apply):

StackExchange Answers

The Case for Code Obfuscation?

What Are the Advantages of Obfuscating Release Code?

Decompilers - Myths or Facts?

Can JS Code be Encrypted, Making it Hard for Someone to Copy?

Obfuscate C/C++ Code? (for tools for C++ obfuscation, if you really must...)

Papers

Code (De)Obfuscation (Madou, Anckaert, De Bosschere)

On the Effectiveness of Source Code Transformations for Binary Obfuscation (Madou & al.)

The Effectiveness of Source Code Obfuscation: an Experimental Assessment (Ceccato & al., 2009) [PDF]

The Quality of Obfuscation and Obfuscation Techniques (Witkowska, 2006)

Famous Quotes on Obfuscation:

Then finally, there is that question of code privacy. This is a lost
cause. There is no transformation that will keep a determined hacker
from understanding your program. This turns out to be true for all
programs in all languages, it is just more obviously true with
JavaScript because it is delivered in source form. The privacy benefit
provided by obfuscation is an illusion. If you don’t want people to
see your programs, unplug your server. - Douglas Crockford

Never?

I'm not saying you should never obfuscate and that there aren't any good reasons for it, but I seriously question the need for it in most cases, and its cost-effectiveness.

Furthermore, there are situations where obfuscation is a de-facto requirement. For instance, if you write viruses, obviously obfuscation (and a dynamic one, preferrably) is as good a thing for your program's survival as it's ability to replicate. However, this hardly constitutes a "common" case...


答:
No, this is not worth the effort, and I think it's completely unnecessary. The functions you call can probably be guessed by the functionality you provide.

The reason obfuscators exist for Java is because the mapping between Java byte code and Java source code is fairly well defined, and the names of all functions and member variables are stored in the byte code (regardless of whether they are public, private, or protected) so a Java byte code interpreter can present some generic Java which shows the structure of the original source fairly well for unobfuscated source.

C++ compiles directly to machine language. It can be disassembled, but assembly language is fairly tedious to deal with. Decompilation is much tricker because of all the changes optimizers make to the code during compilation.

Title: Is it important to obfuscate C++ application code?

Body:
In the Java world, sometimes it seems to be a problem, but what about C++? Are there different solutions?

I was thinking about the fact that someone can replace the C++ library of a specific OS with a different version of the same library, but full of debug symbols to understand what my code does. Is it a good thing to use standard or popular libraries?

This can also happen with some dll library under Windows replaced with the "debug version" of that library. Is it better to prefer static compilation? In commercial applications, I see that for the core of their app they compile everything statically and for the most part, the DLLs (dynamic libraries in general) are used to offer some third party technologies like anti-piracy solutions (I see this in many games), GUI library (like Qt), OS libraries, etc.

Is static compilation the equivalent to obfuscation in the Java world? In better terms, is it the best and most affordable solution to protect your code?


问:
Static classes and/or singletons -- How many does it take to become a code smell?
In my projects I use quite a lot of static classes. These are usually classes that naturally seem to fit into a single-instance type of thing. Many times I use static classes and recently I've started using some singletons.

How many of these does it take to become a code smell? For instance, in my recent project which has a lot of static classes is an Authentication library for ASP.Net.

I use a static class for a helper class that fixes ASP.Net error codes so it can be used like

```<code>CustomErrorsFixer.Fix(Context);
</code>```

Or my authentication class itself is a static class

```<code>//in global.asax's begin_application
Authentication.SomeState="blah";
Authentication.SomeOption=true;
//etc

//in global.asax's begin_request
Authentication.Authenticate();
</code>```

When are static or singleton classes bad to use? Am I doing it wrong, or am I just in a project that by definition has very little per-instance state associated with it?

The only per-instance state I have is stored in HttpContext.Current.Items like so:

```<code>    /// <summary>
    /// The current user logged in for the HTTP request. If there is not a user logged in, this will be null.
    /// </summary>
    public static UserData CurrentUser{
        get{
            return HttpContext.Current.Items["fscauth_currentuser"] as UserData; //use HttpContext.Current as a little place to persist static data for this request
        }
        private set{
            HttpContext.Current.Items["fscauth_currentuser"]=value;
        }
    }
</code>```

答: In the case of singletons the answer is one - because a singleton is a global variable.  Sure, it's dressed up to smell a lot nicer than a traditional global variable, and sure, it offers advantages (such as private scoping) that traditional global variables don't have, but a global variable is still what it is.</p>


答:
Why do you want an interface? Is it to enforce at compile time that the activity class has the methods that are defined in the onClick attributes in the XML?

Personally I wouldn't bother.

Who enforces the interface has the right methods?

Who enforces the right interface is used on each activity?

Just accept that due to the flexible nature of the interaction between Android activities & layouts, it's not possible to enforce at compile time that the onClick function actually exists. As far as I know, anyway. Anyone prove me wrong?

Title: Proper way to implement Android XML onClick attribute in Activity

Body:
I have used the android:onClick attribute extensively in my XML layouts for my Android application.

Example:

```<code><Button
    android:id="@+id/exampleButton"
    android:onClick="onButtonClick" />
</code>```

Is it proper to create an Interface to enforce the implementation of those onClick methods in Activities that use that layout file?

```<code>public interface MyButtonInterface {
    public onButtonClick(View v);
}
</code>```


问:
Is it possible to develop an IOS application without a Mac?
I'm a postgraduated student and I had the idea to build an app for elementary school kids.

My question after many days of searching is whether anyone here have ever tried and what was their experience of developing an IOS app on other platforms than Xcode such as Phonegap, Monotouch, flex or others?

答: Even if you use phonegap you need a mac at least to generate the keys to build the app. SO you might not need one every day but you will need access from time to time.</p>


问:
Fix bugs, or wait for the customer to find them?
Do other people fix bugs when they see them, or do they wait until there's crashes/data loss/people die before fixing it?

Example 1

```<code> Customer customer = null;
 ...
 customer.Save();
</code>```

The code is clearly wrong, and there's no way around it - it's calling a method on a null reference. It happens to not crash because Save happens to not access any instance data; so it's just like calling a static function. But any small change anywhere can suddenly cause broken code that doesn't crash: to start crashing.

But, it's also not inconceivable that correcting the code:

```<code>Customer customer = null;
...
customer = new Customer();
try
   ...
   customer.Save();
   ...
finally
   customer.Free();
end;
</code>```

might introduce a crash; one not discovered through unit tests with complete coverage, and manual user testing.

Example 2

```<code>float speed = 0.5 * ((G * mass1 * mass2) / R) * Pow(time, 2);
</code>```

People knowing physics will recognize that it's supposed to be R2 in the denominator.

The code is wrong, it's absolutely wrong. And overestimating the speed will cause the retro-rockets to fire too soon, killing all the occupants of the spacecraft.

But it's also possible perhaps having it over-estimate the speed is masking another issue: the air-bags can't deploy while the shuttle is moving too fast. If we suddenly fix the code:

```<code>float speed = 0.5 * ((G * mass1 * mass2) / Pow(R, 2)) * Pow(time, 2);
</code>```

Now the speed is accurate, and suddenly airbags are deploying when they shouldn't.

Example 3

Here's an example that i had recently, checking if a string contains invalid characters:

```<code>if (StrPos(Address, "PO BOX") >= 0)
{
   //Do something
}
</code>```

What if it turns out there's a bug in the Do something branch? Fixing the obviously incorrect code:

```<code>if (StrPos("PO BOX", Address) >= 0)
{
   //Do something
}
</code>```

Fixes the code, but introduces a bug.

The way I see it there are two possibilities:

fix the code, and get blamed for breaking it

wait for the code to crash, and get blamed for having a bug

What do you politically do?

Example 4 - Today's real world bug

I am constructing an object, but calling the wrong constructor:

```<code>Customer customer = new Customer();
</code>```

Turns out that the "parameterless" constructor is actually an parameterized constructor from  further back in the inheritance chain:

```<code>public Customer(SomeObjectThatNobodyShouldBeUsingDirectly thingy = null)
public Customer(InjectedDependancy depends)
</code>```

Calling it is a mistake, since it bypasses all the subsequent constructors.

I could change the object's lineage to not expose such a dangerous constructor, but now I have to change the code to:

```<code>Customer customer = new Customer(depends);
</code>```

But I can't guarantee that this change won't break anything. Like my Example 1 above, perhaps someone, somewhere, somehow, under some esoteric conditions, depends on the constructed Customer to be invalid and full of junk.

Perhaps the Customer object, now that it is properly constructed will allow some code to run that previously never did, and now I can get a crash.

I can't bet your wife's life on it.

And I can test it from here to Tuesday, I can't swear on your daughter's life that I didn't introduce a regression.

Do I:

Fix the code and get blamed for breaking it? or

Leave the bug, and get blamed when the customer finds it?

答:
Fix it, and have it tested. If you decide to keep known bugs just because you are afraid to find more bugs, your program becomes a minefield of ticking time bombs so fast that it's going to become unrepairable sooner than you think.

Since you are the master and the code is the subordinate, you may not be afraid to change it when you see it's wrong. Fear of the code ("it might retaliate by breaking somewhere else") is simply unacceptable.


问:
DRY, string, and unit testing
I have a recurring question when writing unit tests for code that involves constant string values.

Let's take an example of a method/function that does some processing and returns a string containing a pre-defined constant. In python, that would be something like:

STRING_TEMPLATE = "/some/constant/string/with/%s/that/needs/interpolation/"

def process(some_param):
    # We do some meaningful work that gives us a value
    result = _some_meaningful_action()
    return STRING_TEMPLATE % result
```

<p>If I want to unit test <code>process</code>, one of my tests will check the return value. This is where I wonder what the best solution is.</p>

<p>In my unit test, I can:</p>

<ol>
<li>apply DRY and use the already defined constant</li>
<li>repeat myself and rewrite the entire string</li>
</ol>

<pre class="lang-py prettyprint-override"><code>def test_foo_should_return_correct_url():
    string_result = process()

    # Applying DRY and using the already defined constant
    assert STRING_TEMPLATE % "1234" == string_result

    # Repeating myself, repeating myself
    assert "/some/constant/string/with/1234/that/needs/interpolation/" == url
</code>```

The advantage I see in the former is that my test will break if I put the wrong string value in my constant. The inconvenient is that I may be rewriting the same string over and over again across different unit tests.

答:
This is a good candidate for "Things that shouldn't be unit tested."

What business logic are you testing?

That the constant is set correctly? The test is just repeating the code then (which is a sign you shouldn't be testing it).

That the language is doing string replacement properly? It's not your job to test the language.

Title: DRY, string, and unit testing


答:
First off in your example, you are actually testing two things in a single unit test, a unit test should only test one thing at a time.

What you should be testing:

the constant value is in the format or a proper URL with a single % wildcard position.

the string replacement inside the build_url function actually produces a valid URL given a valid input to the function

in addition you should test

the constant fails to validate the constant value if it is not a valid URL pattern with a % position ( and all the mutations of this )

the string replacement inside function fails to create valid URLs with invalid input

These should be two separate unit tests.

Title: DRY, string, and unit testing

Body:
I have a recurring question when writing unit tests for code that involves constant string values.

Let's take an example of a method/function that does some processing and returns a string containing a pre-defined constant. In python, that would be something like:

STRING_TEMPLATE = "/some/constant/string/with/%s/that/needs/interpolation/"

def process(some_param):
    # We do some meaningful work that gives us a value
    result = _some_meaningful_action()
    return STRING_TEMPLATE % result
```

<p>If I want to unit test <code>process</code>, one of my tests will check the return value. This is where I wonder what the best solution is.</p>

<p>In my unit test, I can:</p>

<ol>
<li>apply DRY and use the already defined constant</li>
<li>repeat myself and rewrite the entire string</li>
</ol>

<pre class="lang-py prettyprint-override"><code>def test_foo_should_return_correct_url():
    string_result = process()

    # Applying DRY and using the already defined constant
    assert STRING_TEMPLATE % "1234" == string_result

    # Repeating myself, repeating myself
    assert "/some/constant/string/with/1234/that/needs/interpolation/" == url
</code>```

The advantage I see in the former is that my test will break if I put the wrong string value in my constant. The inconvenient is that I may be rewriting the same string over and over again across different unit tests.


答:
I usually prefer to manually specify the expected result. While it's unlikely that the string interpolation in your example will break, there might be a case where you use a third party library to build the result. Using manual results will uncover version incompatibilities in these libraries. Also, there's always the danger of strange environmental circumstances that might break the function, like locale, encoding, 32- / 64-bit platforms, or similar. Sometimes, those actually break the function. Other times, they just broke the unit tests with their manually typed results. In either case, it's worthwhile to check.

If you test functions without side effects, you could use data-driven testing, which allows you to keep test inputs and expected outputs close together.

However, in your particular example, it might be a good idea to not hard-code the URL_TEMPLATE, but read it from some configuration file. This will ease the transition between different environments.

Title: DRY, string, and unit testing


问:
Placing of copyright notice in source code
I'm about to release a project of mine that I'm really proud of under the GNU GPL and I have some questions:

Should one attach a copyright notice on each and every source code file from their project? I think it's a bit ridiculous to claim copyright on a 3 line abstract class. Should I attach a copyright notice only to really important source code files?

Can I not attach the whole standard thingy? Because it's big and bulky and gets in the way... If so, is the variant below ok/enough?

Copyright year firstname lastname.
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation.

答:
Near the beginning of every file there should be a copyright notice and the following statement (change Foobar to your program's name):

```<code>This file is part of Foobar.

Foobar is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

Foobar is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with Foobar.  If not, see <http://www.gnu.org/licenses/>.
</code>```

You should also include a copy of the full license text somewhere in the distribution of your program.

http://www.gnu.org/licenses/gpl-howto.en.html

Apparently, 3 line classes are no exception...

Body:
Near the beginning of every file there should be a copyright notice and the following statement (change Foobar to your program's name):

This file is part of Foobar.

Foobar is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

Foobar is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with Foobar.  If not, see <http://www.gnu.org/licenses/>.

You should also include a copy of the full license text somewhere in the distribution of your program.

http://www.gnu.org/licenses/gpl-howto.en.html

Apparently, 3 line classes are no exception...


答:
The last measurement that I saw of those that had JavaScript disabled, was in 2011, and it indicated a continued decline less than 2% of internet users.

Here is a good StackOverflow post that provides similar findings.


问:
Does it work when a developer is the project manager's boss?
I am in the planning stage of a project and I am looking to hire a project manager. I would like to do some coding and keep eye on all parts of the project. However, i have a feeling that a project manager will get better results. I have the following options:
1) manage the project and not code
2) hire a project manager and code myself

I am worried that the project manager will feel impeded by having the project owner in the development team. If I run the project, the team might fall apart causing the project to fail. To stick within budget, I have to be involved in one capacity or another.

Does anyone have experience with this situation, any suggestions?

more info: 4 in-house developers each responsible for a specific area. The developers can also outsource work if agreed to by the project manager.

答: It can work - if you make sure you stick to the rules which are defined by your project manager. You hired him to manage - so if you undermine his task by managing yourself, you shouldn't have hired him in the first place.


问:
Why does DirectX use a left-handed coordinate system?
I considered posting on Stack Overflow, but the question strikes me as being far too subjective since I can't think of a reasonable technical explanation for Microsoft's choice in this matter. But this question has bugged me for so long and the issue keeps coming up in one of my projects, and I have never actually seen an attempt at explaining this:

OpenGL uses a right-handed coordinate system, where the +Z part of the world coordinate system extends toward the viewer.

DirectX uses a left-handed system where the +Z part of the world coordinate extends into the screen, away from the viewer.

I never used the Glide API, so I don't know how it worked, but from what I can gather, it uses a left-handed system as well.

Is there a technical reason for this? And if not, is there some conceptual advantage to a particular handedness of a coordinate system? Why would one choose one over the other?

答:
Providing this as supplementary material to my previous answer here.  From an old OpenGL spec from the 1990s:

OpenGL does not force left-or right-handedness on any of its coordinates systems.

(source: http://www.opengl.org/documentation/specs/version1.2/opengl1.2.1.pdf).

So, since neither D3D nor OpenGL enforce any handedness the real question is: why do people see this as being anything of a big deal?


问:
How to model the components of a non Information System?
I am working on a kernel-related project (specifically related to the TCP/IP stack of the kernel).

I need to build some models to describe the functionality and components of my system.
Initially I thought about using a Class Diagram, as it can describe the general architecture of my system. But it doesn't make sense since my code is VERY structured (written in standard C).

I also thought about DFDs: they'd describe the processes of my system, and how the data is flowing. But they contain something which doesn't really fit in: data-storages.
I have no databases here (at all).

For the functionality, other team members suggested using Activity and Sequence diagrams, which is kinda okay with me, but what about the system components?

So basically my question is: If I want to describe the components of my system, what do you suggest as a meaningful diagram ?

Again, the project is a research low-level systems-oriented project with almost no user-interface at all.

答:
The UML is probably one of the few languages that only supports just one paradigm: an OO paradigm; this is why you simply can't express something like interfaces, the UML can't compute your request.

In my opinion the roots of a good documentation about a project are:

a list of all the typedefs used

a list of types if the language is OO

a list of all the interfaces

a list of all the templates if required ( if supported by the language )

if the design is OO the UML can be considered ok just for expressing the business of your classes.

just with interfaces and types/typedefs you can say a lot about your project.

A diagram also involves the concepts of "relation" and/or "flow", the problem is that you do not seems to be clear what paradigm are you using in your application.

C is intended to support a procedural and a structured programming paradigm, a diagram does not make too much sense in my opinion because you will end up with a series of boxes and arrows one after one, you will basically rewrite the code in a flow chart without describing any logic and, the most important part, without having the chance of abstracting that much.


问:
When to use assertions and when to use exceptions?
Often when I write a functions I want to make sure the inputs to it are valid in order to detect such errors as early as possible (I believe these are called preconditions). When a precondition fails, I've always thrown an exception. But I'm beginning to doubt whether this is the best practice and if not assertions would be more appropriate.

So when should I do which: when is it appropriate to use an assertion and when is it appropriate to throw an exception?

答:
Assertions are used to find programming errors. Your programs must work just as well when all assertions are removed.

Exceptions, on the other hand, are for situations that can happen even when the program is perfect; they are caused by external influences, like hardware, network, users etc.


问:
Modular Database Structures
I have been examining the code base we use in work and I am worried about the size the packages have grown to. The actual code is modular, procedures have been broken down into small functional (and testable) parts. The issue I see is that we have 100 procedures in a single package - almost an entire domain model.

I had thought of breaking these packages down - to create sub domains that are centered around the procedure relationships to other objects. Group a bunch of procedures that have 80% of their relationships to three tables etc. The end result would be a lot more packages, but the packages would be smaller and I feel the entire code base would be more readable - when procedures cross between two domain models it is less of a struggle to figure which package it belongs to.

The problem I now have is what the actual benefit of all this would really be. I looked at the general advantages of modularity:

```<code>1. Re-usability
2. Asynchronous Development
3. Maintainability
</code>```

Yet when I consider our latest development, the procedures within the packages are already reusable. At this advanced stage we rarely require asynchronous development - and when it is required we simply ladder the stories across iterations.

So I guess my question is if people know of reasons why you would break down classes rather than just the methods inside of classes? Right now I do believe there is an issue with these mega packages forming but the only benefit I can really pin down to break them down is readability - something that experience gained from working with them would solve.

答:
Right now I do believe there is an issue with these mega packages forming but the only
  benefit I can really pin down to break them down is readability

Well, IMHO the point you are missing here is better encapsulation. If you are going to add a new feature to a mega package with 100 functions, you may have to check for side effects or similar things in all those 100 functions (YMMV depending on the actual problem). If you split your package before into 5 smaller packages, you can probably handle such a change more easily, since it may impact a smaller area of your code.

However, when you only seldom change your packages and functions, you have to consider if such a refactoring is worth the trouble - a big refactoring should never be applied just for the sake of itself. And I guess you don't have any refactoring browser for PL/SQL which could assists you (does such a thing exist?), so such a restructuring could mean a lot of work.

Title: Modular Database Structures


问:
Is it worth to learn Experimental Languages?
I'm a young programmer who desires to work in the field someday as a programmer.  I know Java, VB.NET and C#.  I want to learn a new language (as I programmer, I know that it is valuable to extend what I know - to learn languages that make you think differently).  I took a look online to see what languages were common.  Everybody knows C and C++ (even those muggles who know so little about computers in general), so I thought, maybe I should push for C.

C and C++ are nice but they are old.  Things like Haskell and Forth (etc. etc. etc.) are old and have lost their popularity.  I'm scared of learning C (or even C++) for this same reason.  Java is pretty old as well and is slow because it's run by the JVM and not compiled to native code.

I've been a Windows developer for quite a while.  I recently started using Java - but only because it was more versatile and spreadable to other places.  The problem is that it doesn't look like a very usable language for these reasons:

It's most used purpose is for web application and cellphone apps (specifically Android)

As far as actual products made with it, the only things that come to mind are Netbeans, Eclipse (hurrah for making and IDE with the language the IDE is for - it's like making a webpage for writing HTML/CSS/Javascript), and Minecraft which happens to be fun but laggy and bipolar as far as computer spec. support.

Other than that it's used for servers but heck - I don't only want to make/configure servers.

The .NET languages are nice, however:

People laugh if I even mention VB.NET or C# in a serious conversation.

It isn't cross-platform unless you use MONO (which is still in development and has some improvements to be made).

Lacks low level stuff because, like Java with the JVM, it is run/managed by the CLR.

My first thought was learning something like C and then using it to springboard into C++ (just to make sure I would have a strong understanding/base), but like I said earlier, it's getting older and older by the minute.

What I've Looked Into

Fantom looks nice.  It's like a nice middleman between my two favorite languages and even lets me publish between the two interchangeably, but, unlike what I want, it compiles to the CLR or JVM (depending on what you publish it to) instead of it being a complete compile.

D also looks nice.  It seems like a very usable language and from multiple sources it appears to actually be better than C/C++.  I would jump right with it, but I'm still unsure of its success because it obviously isn't very mainstream at this point.

There are a couple others that looked pretty nice that focused on other things such as Opa with web development and Go by GOOGLE.

My Question

Is it worth learning these "experimental" languages?  I've read other questions that say that if you aren't constantly learning languages and open to all languages that you aren't in the right mindset for programming.  I understand this and I still might not quite be getting it, but in truth, if a language isn't going to become mainstream, should I spend my time learning something else?  I don't want to learn old (or any going to soon be old) programming languages.  I know that many people see this as something important, *but would any of you ever actually consider (assuming you didn't already know) FORTRAN?  My goal is to stay current to make sure I'm successful in the future.

Disclaimer

Yes, I am a young programmer, so I probably made a lot of naive statements in my question.  Feel free to correct me on ANYTHING!  I have to start learning somewhere so I'm sure a lot of my knowledge is sketchy enough to have caused to incorrect statements or flaws in my thinking.  Please leave any feelings you have in the comments.

The Results...

I'm truly amazed by the amazing responses, most of them so nicely pointing out my misunderstandings and misjudgments.  I've learned quite a lot from this and I'm excited to hopefully utilize everything I've learned!  I'll probably start learning Haskell next (the not so old language, albeit over 20 years old - hahaha) and then start looking at some other options around me.

Thanks

答:
The thing with learning drastically different languages isn't about learning the languages, it's about getting exposure to different approaches to problems. Tools for the toolbox as it were.

One thing to note is that Haskell isn't particularly old and it is actually a very good candidate for someone only familiar with mainstream languages. Even a very old language like Lisp is very useful to learn due to its influence on things.

Also, Java and .Net are not interpreted and I expect you're making some incorrect assumptions based on that mislabeling.