问:
How to implement a Weighted shuffle
I recently wrote some code that I thought very inefficient, but since it included only a few values, I accepted it.  However, I'm still interested at a better algorithm for the following:

A list of X objects, each of them are assigned a "weight"

Sum up the weights

Generate a random number from 0 to the sum

Iterate through the objects, subtracting their weight from the sum until the sum is non-positive

Remove the object from the list, and then add it to the end of the new list

Items 2,4, and 5 all take n time, and so it is an O(n^2) algorithm.

Can this be improved?

As an example of a weighted shuffle, an element has a greater chance at being at the front with a higher weight.

Example (I'll generate random numbers to make it real):

6 objects with weights 6,5,4,3,2,1; Sum is 21

I picked 19: 19-6-5-4-3-2 = -1, thus 2 goes in the first position, weights are now 6,5,4,3,1; Sum is 19

I picked 16: 16-6-5-4-3 = -2, thus 3 goes in the second position, weights are now 6,5,4,1; Sum is 16

I picked 3: 3-6 = -3, thus 6 goes in the third position, weights are now 5,4,1; Sum is 10

I picked 8: 8-5-4 = -1, thus 4 goes in the fourth position, weights are now 5,1; Sum is 6

I picked 5: 5-5=0, thus 5 goes in the fifth position, weights are now 1; Sum is 1

I picked 1: 1-1=0, thus 1 goes in the last position, I have no more weights, I finish

答:
First, lets work from that the weight of a given element in the list to be sorted is constant.  It is not going to change between iterations.  If it does, then... well, thats a bigger problem.

For illustration lets use a deck of cards where we want to weight the face cards to the front.  weight(card) = card.rank.  Summing these, if we don't know the distribution of weights is indeed O(n) once.

These elements are stored in a sorted structure such as a modification on an indexable skip list such that all of the indexes of the levels can be accessed from a given node:

```
   1                               10
 o---> o---------------------------------------------------------> o    Top level
   1           3              2                    5
 o---> o---------------> o---------> o---------------------------> o    Level 3
   1        2        1        2                    5
 o---> o---------> o---> o---------> o---------------------------> o    Level 2
   1     1     1     1     1     1     1     1     1     1     1
 o---> o---> o---> o---> o---> o---> o---> o---> o---> o---> o---> o    Bottom level

Head  1st   2nd   3rd   4th   5th   6th   7th   8th   9th   10th  NIL
      Node  Node  Node  Node  Node  Node  Node  Node  Node  Node
```

However in this instance, each node also 'takes up' as much room as its weight.

Now, when looking up an card in this list one can access its position in the list in O(log n) time and remove it from the associated lists in O(1) time. Ok, it might not be O(1), it might be O(log log n) time (I'd have to think about this much more).  Removing the 6th node in the above example would involve updating all four levels - and those four levels are independent of how many elements there are in the list (depending on how you implement the levels).

Since the weight of an element is constant, one can simply do sum -= weight(removed) without having to traverse the structure again.

And thus, you've got a one time cost of O(n) and a lookup value of O(log n) and a remove from list cost of O(1).  This becomes O(n) + n * O(log n) + n * O(1) which gives you an overall performance of O(n log n).

Lets look at this with cards, because thats what I used above.

```
      10
top 3 -----------------------> 4d
                                .
       3             7          .
    2 ---------> 2d ---------> 4d
                  .             .
       1      2   .  3      4   .
bot 1 --> Ad --> 2d --> 3d --> 4d
```

This is a really small deck with only 4 cards in it. It should be easy to see how this can be extended.  With 52 cards an ideal structure would have 6 levels (log2(52) ~= 6), though if you dig into the skip lists even that could be reduced to a smaller number.

The sum of all the weights is 10.  So you get a random number from [1 .. 10) and its 4  You walk the skip list to find the item that is at ceiling(4).  Since 4 is less than 10, you move from the top level to the second level.  Four is greater than 3, so now we're at the 2 of diamonds.  4 is less than 3 + 7, so we move down to the bottom level and 4 is less than 3 + 3, so we've got a 3 of diamonds.

After removing the 3 of diamonds from the structure, the structure now looks like:

```
       7
top 3 ----------------> 4d
                         .
       3             4   .
    2 ---------> 2d --> 4d
                  .      .
       1      2   .  4   .
bot 1 --> Ad --> 2d --> 4d
```

You will note that the nodes take up an amount of 'space' proportional to their weight in the structure.  This allows for the weighted selection.

As this approximates a balanced binary tree, lookup in this doesn't need to walk the bottom layer (which would be O(n)) and instead going from the top allows you to rapidly skip down the structure to find about what you are looking for.

Much of this could instead be done with some sort of balanced tree.  The problem there is the rebalancing of the structure when a node is removed gets confusing since this isn't a classic tree structure and the housekeeping to remember that the 4 of diamonds is now moved from positions [6 7 8 9] to [3 4 5 6] may cost more than the benefits of the tree structure.

However, while the skip list approximates a binary tree in its ability to skip down the list in O(log n) time, it has the simplicity of working with a linked list instead.

This isn't to say that it is easy to do all this (you still need to keep tabs on all the links you need to modify when you remove an element), but it means only updating however many levels you have and their links rather than everything to the right on the proper tree structure.

Title: How to implement a Weighted shuffle

Body:
First, lets work from that the weight of a given element in the list to be sorted is constant.  It is not going to change between iterations.  If it does, then... well, thats a bigger problem.

For illustration lets use a deck of cards where we want to weight the face cards to the front.  weight(card) = card.rank.  Summing these, if we don't know the distribution of weights is indeed O(n) once.

These elements are stored in a sorted structure such as a modification on an indexable skip list such that all of the indexes of the levels can be accessed from a given node:

   1                               10
 o---> o---------------------------------------------------------> o    Top level
   1           3              2                    5
 o---> o---------------> o---------> o---------------------------> o    Level 3
   1        2        1        2                    5
 o---> o---------> o---> o---------> o---------------------------> o    Level 2
   1     1     1     1     1     1     1     1     1     1     1
 o---> o---> o---> o---> o---> o---> o---> o---> o---> o---> o---> o    Bottom level

Head  1st   2nd   3rd   4th   5th   6th   7th   8th   9th   10th  NIL
      Node  Node  Node  Node  Node  Node  Node  Node  Node  Node

However in this instance, each node also 'takes up' as much room as its weight.

Now, when looking up an card in this list one can access its position in the list in O(log n) time and remove it from the associated lists in O(1) time. Ok, it might not be O(1), it might be O(log log n) time (I'd have to think about this much more).  Removing the 6th node in the above example would involve updating all four levels - and those four levels are independent of how many elements there are in the list (depending on how you implement the levels).

Since the weight of an element is constant, one can simply do sum -= weight(removed) without having to traverse the structure again.

And thus, you've got a one time cost of O(n) and a lookup value of O(log n) and a remove from list cost of O(1).  This becomes O(n) + n * O(log n) + n * O(1) which gives you an overall performance of O(n log n).

Lets look at this with cards, because thats what I used above.

      10
top 3 -----------------------> 4d
                                .
       3             7          .
    2 ---------> 2d ---------> 4d
                  .             .
       1      2   .  3      4   .
bot 1 --> Ad --> 2d --> 3d --> 4d

This is a really small deck with only 4 cards in it. It should be easy to see how this can be extended.  With 52 cards an ideal structure would have 6 levels (log2(52) ~= 6), though if you dig into the skip lists even that could be reduced to a smaller number.

The sum of all the weights is 10.  So you get a random number from [1 .. 10) and its 4  You walk the skip list to find the item that is at ceiling(4).  Since 4 is less than 10, you move from the top level to the second level.  Four is greater than 3, so now we're at the 2 of diamonds.  4 is less than 3 + 7, so we move down to the bottom level and 4 is less than 3 + 3, so we've got a 3 of diamonds.

After removing the 3 of diamonds from the structure, the structure now looks like:

       7
top 3 ----------------> 4d
                         .
       3             4   .
    2 ---------> 2d --> 4d
                  .      .
       1      2   .  4   .
bot 1 --> Ad --> 2d --> 4d

You will note that the nodes take up an amount of 'space' proportional to their weight in the structure.  This allows for the weighted selection.

As this approximates a balanced binary tree, lookup in this doesn't need to walk the bottom layer (which would be O(n)) and instead going from the top allows you to rapidly skip down the structure to find about what you are looking for.

Much of this could instead be done with some sort of balanced tree.  The problem there is the rebalancing of the structure when a node is removed gets confusing since this isn't a classic tree structure and the housekeeping to remember that the 4 of diamonds is now moved from positions [6 7 8 9] to [3 4 5 6] may cost more than the benefits of the tree structure.

However, while the skip list approximates a binary tree in its ability to skip down the list in O(log n) time, it has the simplicity of working with a linked list instead.

This isn't to say that it is easy to do all this (you still need to keep tabs on all the links you need to modify when you remove an element), but it means only updating however many levels you have and their links rather than everything to the right on the proper tree structure.


问:
Should We Use Surrogate Primary Keys for Every Table?
We are developing a data model for a marketing database that will import transaction, customer, inventory, etc. files and the directive is ONE process that works for every client. We have been told every client will have different import layouts and different columns that identify a table's primary key.

Our initial idea is to get definitions from the client on what columns make each record unique, store those in a mapping table, and then have lookup tables that translate those primary keys to an internal surrogate keys automatically for every destination table so that every table conforms to an integer primary key no matter how many columns/types are used to make up the real pk.

The first major problem I saw was when/if have to map back to the lookup tables to get data that we did not store in the main data model, but I have ben assured that anything we ever want to query will be duplicated in the lookup and main tables so that should not be a concern.

This kind of flexibility seems like it will cause some serious limitations on:

Technology stack (no way to dynamically map these import files in
SSIS, need lot of dynamic SQL or java/c#)

Scalability (based on previous concern and initial testing, this
would be difficult to scale without speed concerns)

Complexity (we are already running into some complex code changes
when we try to implement all these tables with historical change
logging while maintaining mapping to the lookup tables for example)

My question - Is this feasible or is there another obvious solution we are missing?

答:
We have been told every client will have different import layouts and different columns that identify a table's primary key.

Dear lord in heaven, DO NOT let this go into production without establishing a clear standard process for giving each record of importance a single, system-wide, actual key.  A key that is of the same format for all customers, that you can return their imports with the system key appended to if necessary.

User-specified columns for uniqueness is just asking for data problems, unless your clients are tech-savy--and if they're tech-savy, they can build their own db.  Mammoth "map" tables are just a headache waiting to happen; what happens when your client eventually has two "John M Smith" customers, who both have the same phone number and address because a grandfather moved in with the grandson who was named after him?

As for "what to do with fields not added to our main data-set", this is what databases have XML support for.  (Or JSON, or an EAV table.)   XML is better than JSON in this regard, as most database types with an explicit "XML" data type also have ways to index and slice XML content.  (assuming you don't have a database that speaks JSON, that is.)

ContentLicense: CC BY-SA 3.0


答:
EDIT: This answer doesn't interpret the weights in the way that would be expected. I.e. an item with weight 2 isn't twice as likely to be first as one with weight 1.

One way to shuffle a list is to assign random numbers to each element in the list and sort by those numbers. We can extend that idea, we just have to pick weighted random numbers. For example, you could use random() * weight. Different choices will produce different distributions.

In something like Python, this should be as simple as:

```<code>items.sort(key = lambda item: random.random() * item.weight)
</code>```

Be careful that you don't evaluate the keys more then once, as they'll end up with different values.

Title: How to implement a Weighted shuffle

Body:
I recently wrote some code that I thought very inefficient, but since it included only a few values, I accepted it.  However, I'm still interested at a better algorithm for the following:

A list of X objects, each of them are assigned a "weight"

Sum up the weights

Generate a random number from 0 to the sum

Iterate through the objects, subtracting their weight from the sum until the sum is non-positive

Remove the object from the list, and then add it to the end of the new list

Items 2,4, and 5 all take n time, and so it is an O(n^2) algorithm.

Can this be improved?

As an example of a weighted shuffle, an element has a greater chance at being at the front with a higher weight.

Example (I'll generate random numbers to make it real):

6 objects with weights 6,5,4,3,2,1; Sum is 21

I picked 19: 19-6-5-4-3-2 = -1, thus 2 goes in the first position, weights are now 6,5,4,3,1; Sum is 19

I picked 16: 16-6-5-4-3 = -2, thus 3 goes in the second position, weights are now 6,5,4,1; Sum is 16

I picked 3: 3-6 = -3, thus 6 goes in the third position, weights are now 5,4,1; Sum is 10

I picked 8: 8-5-4 = -1, thus 4 goes in the fourth position, weights are now 5,1; Sum is 6

I picked 5: 5-5=0, thus 5 goes in the fifth position, weights are now 1; Sum is 1

I picked 1: 1-1=0, thus 1 goes in the last position, I have no more weights, I finish

Body:
EDIT: This answer doesn't interpret the weights in the way that would be expected. I.e. an item with weight 2 isn't twice as likely to be first as one with weight 1.

One way to shuffle a list is to assign random numbers to each element in the list and sort by those numbers. We can extend that idea, we just have to pick weighted random numbers. For example, you could use random() * weight. Different choices will produce different distributions.

In something like Python, this should be as simple as:

items.sort(key = lambda item: random.random() * item.weight)

Be careful that you don't evaluate the keys more then once, as they'll end up with different values.


问:
CoffeeScript and Named Functions
Elsewhere, an argument has arisen over the terminology of a named function in CoffeeScript. In particular someone referred to something like this:

```<code> foo = ->
    console.log("bar")
</code>```

as a named function. But its been objected that everything in CoffeeScript is anonymous functions and there are no named functions. This is certainly true, CoffeeScript only has function expressions which can then be stored in a variable. But I don't think that means it is wrong to call this a named function.

As I see it, it is a named function because its a function that has been given a name. True, its not a named function in the same way that some other languages have named functions, but I think its close enough that it's not inappropriate to call it a named function. To insist otherwise just seems to be nitpicking.

Am I out to lunch in thinking that insisting that this isn't a named function is just nitpicking?

答:
Don't waste time arguing with pedants.  It's never fruitful.  Yes, everyone knows what you mean by a "named function" in CoffeeScript, even if it's technically incorrect.  No, using technically incorrect but widely understood terminology has no bearing on the correctness or incorrectness of the proposed solution.  Is it possible to be more precise without gaining some awkwardness of phrasing?  Probably not.  However, that doesn't mean people will let it slide.  Just imagine this guy on the other end of the conversation.

The reason it's technically incorrect is because you haven't named the function, you've named a reference to the function.  Consider:

```<code>foo = bar = ->
  console.log "What's my name?"
</code>```

What's the function's name?  foo and bar are both referencing the same function, but have different names.  Also, either foo or bar could be reassigned at any time to reference a different function, or even a different type altogether, without changing the function itself.

Title: CoffeeScript and Named Functions

Body:
Don't waste time arguing with pedants.  It's never fruitful.  Yes, everyone knows what you mean by a "named function" in CoffeeScript, even if it's technically incorrect.  No, using technically incorrect but widely understood terminology has no bearing on the correctness or incorrectness of the proposed solution.  Is it possible to be more precise without gaining some awkwardness of phrasing?  Probably not.  However, that doesn't mean people will let it slide.  Just imagine this guy on the other end of the conversation.

The reason it's technically incorrect is because you haven't named the function, you've named a reference to the function.  Consider:

foo = bar = ->
  console.log "What's my name?"

What's the function's name?  foo and bar are both referencing the same function, but have different names.  Also, either foo or bar could be reassigned at any time to reference a different function, or even a different type altogether, without changing the function itself.


答:
So, the way I read this is like this:

When you declare a function in a JavaScript console using

```<code>var foo = function() { ... }
</code>```

and then invoke foo without parentheses, it returns

```<code>function() { ... }
</code>```

However, if you define it using

```<code>function foo() { ... }
</code>```

and then invoke foo again without parentheses, it returns

```<code>function foo() { ... }
</code>```

In the first case, I'd say you're declaring a variable named "foo" storing an anonymous function in it. In the second case, I'd say you're actually declaring a named function called "foo".

Because CoffeeScript uses the first pattern, I'd agree that it's technically correct that CoffeeScript's functions are all anonymous functions being stored in named variables.

Title: CoffeeScript and Named Functions

Body:
Elsewhere, an argument has arisen over the terminology of a named function in CoffeeScript. In particular someone referred to something like this:

```<code> foo = ->
    console.log("bar")
</code>```

as a named function. But its been objected that everything in CoffeeScript is anonymous functions and there are no named functions. This is certainly true, CoffeeScript only has function expressions which can then be stored in a variable. But I don't think that means it is wrong to call this a named function.

As I see it, it is a named function because its a function that has been given a name. True, its not a named function in the same way that some other languages have named functions, but I think its close enough that it's not inappropriate to call it a named function. To insist otherwise just seems to be nitpicking.

Am I out to lunch in thinking that insisting that this isn't a named function is just nitpicking?

Body:
So, the way I read this is like this:

When you declare a function in a JavaScript console using

var foo = function() { ... }

and then invoke foo without parentheses, it returns

function() { ... }

However, if you define it using

function foo() { ... }

and then invoke foo again without parentheses, it returns

function foo() { ... }

In the first case, I'd say you're declaring a variable named "foo" storing an anonymous function in it. In the second case, I'd say you're actually declaring a named function called "foo".

Because CoffeeScript uses the first pattern, I'd agree that it's technically correct that CoffeeScript's functions are all anonymous functions being stored in named variables.


问:
What are some famous one-liner or two-liner programs and equations?
I'm experimenting with a new platform and I'm trying to write a program that deals with strings that are no longer than 60 characters and I'd like to populate the data store with some famous or well-known small chunks of code and equations, since programming and math goes along with the theme of my software. The code can be in any language and the equations from any discipline of mathematics, just so long as they're less than a total of 60 characters in length. I suspect people are gonna break out some brainfuck for this one.

For example,

```<code>#include<stdio.h>
int main(){printf ("Hi World\n");return 0;}
</code>```

60 characters exactly!

Thanks so much for your wisdom!

答:
Infinite Fibonacci Sequence in Scala:</p>

```<code>val fibs: Stream[BigInt] = 0 #:: 1 #:: { for((x, y) <- fibs.zip(fibs.tail))
                                           yield x + y }
</code>```

ContentLicense: CC BY-SA 2.5

Body:
Infinite Fibonacci Sequence in Scala:

val fibs: Stream[BigInt] = 0 #:: 1 #:: { for((x, y) <- fibs.zip(fibs.tail))
                                           yield x + y }


问:
Forking a repo on GitHub but allowing new issues on the fork
I have previously forked other people's repos on GitHub, and I have noticed that issues stay with the original repo, and that I can't file issues on the forked repo.

I now have the following task.  I am working for a small business where development was being done by one of the principals on his personal account.  He has amicably left the project, and we would like to migrate that project away from his personal account to a new "role" account on GitHub.

I would naturally fork the repo, in order to preserve the code history, but then I'll end up with a repo where we can't file new issues, which is quite undesirable.

How can I make a copy of this original repo into our new account, ideally still preserving code history, but be able to file new issues within this new account?

答:
There is also the option to transfer (ownership of) a repository from one account to another (e.g. from an ex-employee to an 'organization' account).

The "Transfer Ownership" button is at the bottom of the Settings page of the repository, in the "Danger Zone" section.

The current owner of the repository must have administrative privileges to the destination organization (though this could just be temporary).


答:
Swapping the values of two variables without using a third variable. This is one of the first things in programming that I was told and thought "Hmm... that's cool"</p>

```<code>int a,b;
b=a-b;
a=a-b;
b=a+b;
</code>```

Title: What are some famous one-liner or two-liner programs and equations?

Body:
I'm experimenting with a new platform and I'm trying to write a program that deals with strings that are no longer than 60 characters and I'd like to populate the data store with some famous or well-known small chunks of code and equations, since programming and math goes along with the theme of my software. The code can be in any language and the equations from any discipline of mathematics, just so long as they're less than a total of 60 characters in length. I suspect people are gonna break out some brainfuck for this one.

For example,

```<code>#include<stdio.h>
int main(){printf ("Hi World\n");return 0;}
</code>```

60 characters exactly!

Thanks so much for your wisdom!

Body:
Swapping the values of two variables without using a third variable. This is one of the first things in programming that I was told and thought "Hmm... that's cool"

int a,b;
b=a-b;
a=a-b;
b=a+b;


问:
scipy.stats.percentileofscore() wrong?
i'm a data scientist and python noob, but I seem to have found a bug with scipy.stats.percentileofscore.  it may be "by design" but please bear with me.

if you have an array,  you will get an upper bound of 100, but never a lower bound of 0.  The lowest percentile you will get is 100/len  so if I have an array of 30 items the lowest percentile I'll get is 100/30 ==> (3)

so I have a workaround to allow a zero percentile result.   is my workaround valid?  is there something I"m doing wrong?  please suggest.

also note the following i put the numbers in the 0.0 to 1.0 range (I don't like using 0 to 100 for percentages)

```<code>stochState.kSlopePercentile = scipy.stats.percentileofscore([stochHist.kSlope for stochHist in stochState.history],stochState.kSlope)  / 100.0
invHistLen= 1.0/len(stochState.history)
if(stochState.kSlopePercentile < 1.0):
    stochState.kSlopePercentile -= invHistLen * (1-stochState.kSlopePercentile+invHistLen)
</code>```

the above code subtracts up to 1/len from the percentile (more the closer the percentile is to zero)

答:
I think this is likely by design.  In my opinion, calling something the 0th percentile when you have only 30 values is dubious.  If something is the bottom value out of 30, that doesn't give you confidence that it would still be the bottom value if you had a much larger population.  And in my mind, this is what percentile would be used for--saying something about the likely distribution of the population you are trying to represent, not the 30 values themselves.

However, there is no standard "correct" way of calculating percentile.  There are several different ways, and their differences will be most apparent when used on small samples. Wikipedia has a good overview.

If you are not happy with the algorithm Python uses, I would recommend finding a package that implements your preferred algorithm, or implementing your own, rather than hacking the results at the end.  This hack is likely to be problematic.

Title: scipy.stats.percentileofscore() wrong?


问:
Open source: what is the definition of "derivative work" and how does it impact copy-left
I am a commercial software developer and I want to make use of open-source in my proprietary software.

As I understand the concept of copy-left, it uses the original authors copyright to ensure that their ultimate end users (which would include my customers) are not deprived of benefits of the original work that the original authors of the OS components intended for them to have.

I also understand that there is an incentive to produce more free software and I often find that sites that clarify and recommend various licensing terms are mixing the legalities with the ideology.

All I am asking for is a clear picture. The people who want to create OS exclusively for other OS projects should be allowed to do so. The people who want to put code out there for anybody to use should be allowed to do so. Also, there are many claims which have no legal precedence and are not as clear cut as authors of OS interest sites would like them to be.

And we all know that code is not just code.

There is a difference between:

Copying somebodys source code into your source code.

Consuming a library compiled as-is from github.

Consuming a library compiled from a locally altered version from github.

Let's pretend that I use an open source library for accessing Excel spreadsheets. It makes sense that I would contribute back bugfixes/additions etc that had anything to do with the general problem of accessing excel spreadsheets. This is to make an excel plugin for an application that already accepts XML, SQL db etc as alternative input mechanisms for the same data.

** Does this mean that the application is considered "derivative" even when it does not expand into the problem domain of importing excel sheets? **

答:
From a copyright standpoint, a program that is statically linked to a library is a derived work of that library. The reasoning to reach that conclusion is as follows:

The (binary) code of the library is physically contained in the program when the library is statically linked. This makes the (binary) program a derived work of the (binary) library.

The (binary) code of the library is derived from the library source code by way of translation. This makes the binary code a derived work of the source code.

For dynamically linked libraries, it is less clear if a program that uses them is legally a derived work under copyright law. To my knowledge, even the law experts don't agree on that, but at least the copyleft proponents claim that it is.

What all of this means for using programs using a library in a program depends on the copyright license that the library is distributed under and the amount of legal risk that you are willing to take.

If the library is distributed with a copyleft license, then the license applies terms to the distribution of all derived works, including the binary programs that use the library and one of those terms is that source code must be provided.

If the library is distributed with a non-copyleft license, then the license only applies terms to the distribution of the library itself (and machine-translated derived works, like the binary version).

This means that you can typically use a non-copyleft library in a closed source project without problem. There is no need to disclose the source of the application using the library. Whether you need to distribute the source code for changes you made to the library depends on the exact license that the library is distributed under.

If you do the same with a copyleft library, then you had better seek good legal council to determine if you are or are not violating the license terms.


问:
Slight extension for SQL prepared statements syntax. Need advice
In my database abstraction library I am extending SQL prepared statements syntax to hint a parser with expected literal type. I take it as a very essential improvement, my reasoning you can read here. If you want to question the idea itself, please let me know in the comments - I'd like to start another question instead of mixing it here.

The advice I want is on the syntax. I am quite ignorant of all the languages and dialects beside php and mysql, and may be there already a general purpose solution I am unaware of. If not - then I want to know your personal opinion or suggestion.

At the moment, only positional placeholders supported. Yet I was asked many times to add support for the named ones. However, I cannot decide which syntax to choose for that.

At the moment I mark a conventional question mark with single letter, i.e. ?s - string, ?i - int, ?n - name (identifier) and so forth.

Yet for the named placeholder (:name style) the only sane option to me is

```<code>i:name
</code>```

or, if I decide to add more verbose modifiers, even

```<code>int:name
</code>```

so, the query would look like

```<code>SELECT * FROM ident:table WHERE id IN (int:id)
</code>```

The question is: do you see any drawbacks for such a syntax? Do you have a suggestion for any other style? Do you think it's readable at all?

Another question is on repeating things. At the moment I have two placeholders for the arrays - ?a for the comma separated string list and ?u for the ?n=?s pairs. It bugs me a long time already, that such a syntax is superfluous, yet insufficient. What if I need a set of comma-separated identifiers? Or even a complex statement like whole VALUES clause? With some sort of repetition operator I can make SQL query building dramatically better. Here are examples of what I am thinking of:

```<code>SELECT * FROM table WHERE id IN([?i])
SELECT [?n] FROM table
INSERT INTO table VALUES [(?i,?s,?s,?s)]
UPDATE table SET [?n=?s]
</code>```

As you can see, I use square brackets to designate a repetition. However, I am still not sure if I should use them. First objection is that they will collide with SQL server identifier syntax. Next is rather philosophical one - it is another syntax element and I want to introduce as less changes to the syntax as possible.

Also, this syntax will require much more complicated parsing logic, which I am trying to avoid too. So - another option is just to extend the set of types, either with distinct placeholders like ?k for the list of numbers, ?o for the list of identifiers, of with adding a single=letter modifier to the existing type like ?as (or ?astr or astr:name) is an array of strings, ?an and the like.

There is another option - to detect repetitions automatically. If we have a scalar - format it as a single value. If it's array coming - format as a comma-separated list. However, many people find this approach unacceptable, as it can lead to unpredictable results and erroneous (however still safe) query. I am still in doubts if I may choose this way.

答:
I suggest making all parameters start with ?.  The advantages of this are:

It extends an existing familiar paradigm.

There won't be any syntax clashes or ambiguities.

There is a clear visual indicator of what things are placeholders.

So name identifiers would look like:

```<code>SELECT * FROM ?ident:table WHERE id IN (?int:id)
</code>```

If you want to implement more complex placeholders, I suggest you start by defining a general construct such as ?{...}.  Then you can use whatever is easiest and clearest within that, without fear of clashing with SQL.  And, again, there is a very clear visual indicator in the query of what is SQL and what is a parameter.

```<code>insert into table values ?{array:(?i,?s,?s,?s)}
update table set ?{array:(foo=?i,bar=?s)}
</code>```

The trick in this whole project is implementing the right level of complexity, so that it helps rather than making things more complicated. I think it is an idea with potential, though.

Body:
I suggest making all parameters start with ?.  The advantages of this are:

It extends an existing familiar paradigm.

There won't be any syntax clashes or ambiguities.

There is a clear visual indicator of what things are placeholders.

So name identifiers would look like:

SELECT * FROM ?ident:table WHERE id IN (?int:id)

If you want to implement more complex placeholders, I suggest you start by defining a general construct such as ?{...}.  Then you can use whatever is easiest and clearest within that, without fear of clashing with SQL.  And, again, there is a very clear visual indicator in the query of what is SQL and what is a parameter.

insert into table values ?{array:(?i,?s,?s,?s)}
update table set ?{array:(foo=?i,bar=?s)}

The trick in this whole project is implementing the right level of complexity, so that it helps rather than making things more complicated. I think it is an idea with potential, though.


答:
You asked for a definition: In copyright law, a derivative work is an expressive creation that includes major, copyright-protected elements of an original, previously created first work (the underlying work).

If you either (a) merge an OSS work into yours or (b) modify an OSS work and then distribute the result with yours, you are caught by this definition. That includes if you link in an OSS library, even if you have never seen the source code for it.

The GPL copy-left provisions can (probably) be avoided if you distribute your app and the library separately, and link at install or runtime. You'll need a notice.

The LGPL copy-left provisions can (probably) be avoided if you link your app to the library with no changes to the original source code. You'll still need a notice.

Edit: Ideally you find a permissive licence (eg MIT, BSD)  but you may still need a notice.

If the library is tiny but you distribute it, you are bound by the terms of the licence. You simply cannot distribute other people's code without their licence, so the issue is around what other terms and conditions are in the licence that might cause you grief. The terms you care about are the requirement for a notice, and the copy-left, so that's what I've focussed on.

As I tell people repeatedly, if you make no money out of it and harm no-one then just do your best and don't worry too much. If you make money out of your product or services and/or if you may cause damage to someone, you must take competent legal advice. That won't protect you, but it will warn you how much it will cost to defend a suit.

Title: Open source: what is the definition of "derivative work" and how does it impact copy-left

Body:
I am a commercial software developer and I want to make use of open-source in my proprietary software.

As I understand the concept of copy-left, it uses the original authors copyright to ensure that their ultimate end users (which would include my customers) are not deprived of benefits of the original work that the original authors of the OS components intended for them to have.

I also understand that there is an incentive to produce more free software and I often find that sites that clarify and recommend various licensing terms are mixing the legalities with the ideology.

All I am asking for is a clear picture. The people who want to create OS exclusively for other OS projects should be allowed to do so. The people who want to put code out there for anybody to use should be allowed to do so. Also, there are many claims which have no legal precedence and are not as clear cut as authors of OS interest sites would like them to be.

And we all know that code is not just code.

There is a difference between:

Copying somebodys source code into your source code.

Consuming a library compiled as-is from github.

Consuming a library compiled from a locally altered version from github.

Let's pretend that I use an open source library for accessing Excel spreadsheets. It makes sense that I would contribute back bugfixes/additions etc that had anything to do with the general problem of accessing excel spreadsheets. This is to make an excel plugin for an application that already accepts XML, SQL db etc as alternative input mechanisms for the same data.

** Does this mean that the application is considered "derivative" even when it does not expand into the problem domain of importing excel sheets? **


问:
Is "Explain the RAII idiom" a good C++ screening question?
A company that I work with has asked me to do candidate phone screenings to make sure they aren't completely embarrassed when sending over someone to a potential client.

It turns out that a fair number of people were being placed for a C++ developer role. I don't spend much time in C++, but I have done a few trivial and non-trivial projects in the language. I figured that "Explain the RAII idiom" would be a nice softball question that most serious C++ developers could answer while half asleep, and would allow me to move on to more interesting questions about experience. But it turns out people who have 10+ years C++ experience don't recognize the term, even if I expand the acronym to "Resource Acquisition is Initialization." One candidate went so far as to say he felt it wasn't always practical to apply the technique in Windows development, which I thought was an odd sentiment, but I could see a couple of examples that arguably support that line of thought. (But really only arguably).

Even a couple of C++ developers I know well enough to judge their competence said they didn't recognize the term, but upon reading a summary of the technique, said "Oh, yeah, I didn't know that had a name. I just thought of those things as something you just have to do." I remember the term from the second edition of Stroustrup's book, even though the full impact didn't sink in at the time.

So, is "Can you explain the RAII idiom to me?" a fair screening question? Is it reasonable to expect all competent C++ developers to understand it? Is the term more esoteric than I would think? Assuming a candidate doesn't know the term, are there follow up questions that could help me tease out whether they have at least internalized the practices that make RAII work? Are there better alternative "weeder" questions that give the candidate some latitude in answering, and help the candidate demonstrate their understanding of C++ development?

Editing to add: To clarify, I'm not the sort of interviewer that disqualifies people because they don't know buzzwords and acronyms. However, I do think it's reasonable to expect that an experienced C++ programmer has internalized good practices for resource management. I also think that it's important to verify that a candidate understands some "basics" about the technology they claim expertise in before moving on to more interesting questions about design, problem solving, etc. I think what I'm looking for is a good way to ask an open-ended question, suitable for use in a short telephone screening, that I can use to judge a candidate's basic understanding of good resource management practices in C++, before I ask "hard" questions.

答: It's a valid question, but not for screening. I used it as a written question, to be discussed at interview. You can get a lot of insight into thinking patterns given advance notice. As a screening question it's just a nasty trap.</p>


问:
When and Where should we use hoisting in Javascript
I'm new to Javascript. I'm learning the concept of hoisting in Javascript.

Based on the Javacsript tutorials in Mozilla website, I came across this word hoisting. According to those tutorials, variables in JavaScript is that you can refer to a variable declared later, without getting an exception. But, my question is on what circumstances is it suitable to use hoisting in a  client-side Javascript or why should we use hoisting in Javascript. What are its advantages.

答:
Why?

JavaScript doesn't have Block Scope, that should explain why things should hoist to the top.

Is it useful?

If you prefer this:

```<code>var someVariable = someVariable || {};
</code>```

Instead of this:

```<code>if ( "undefined" !== typeof someVariable ) {
    someVariable = someVariable;
} else {
    someVariable = {};
}
</code>```

Then it is useful. Even if you don't notice it!

Clearification

First example will translate to something like this:

```<code>var someVariable = someVariableValue;

if ( "undefined" !== typeof someVariable ) {
    var someVariableValue = someVariable;
} else {
    var someVariableValue = {};
}
</code>```

Body:
Why?

JavaScript doesn't have Block Scope, that should explain why things should hoist to the top.

Is it useful?

If you prefer this:

var someVariable = someVariable || {};

Instead of this:

if ( "undefined" !== typeof someVariable ) {
    someVariable = someVariable;
} else {
    someVariable = {};
}

Then it is useful. Even if you don't notice it!

Clearification

First example will translate to something like this:

var someVariable = someVariableValue;

if ( "undefined" !== typeof someVariable ) {
    var someVariableValue = someVariable;
} else {
    var someVariableValue = {};
}


问:
Which extreme-programming techniques are appropriate to use in a research environment?
Which (if any) extreme-programming techniques would be appropriate to use in a research environment - where the goal is to produce prototypes, patentable, and/or publishable work?</p>

答:
Speaking from a background of algorithm research:

Keep a long backlog of ideas

Re-prioritize aggressively and frequently (e.g. every day)

Mark down backlog items that are no longer viable

Maintain an up-to-date picture of inter-dependencies between backlog items

Unlike regular software development, there is a lot more dependencies in research work.

Always measure, visualize and track algorithm performance (accuracy, etc)

Don't work alone.

Discuss, collaborate and share frequently.

Keep a wiki, and spend lots of effort to extract "wisdom" from your work.

Use version control. However, keep good algorithm candidates in the current system, even if they are not actively used.

It allows you to tinker with an older algorithm at the spur of the moment.

Stale performance data could be error-prone.

For example, the old data may be based on a less accurate metric

To get fresh performance data, re-run the algorithm(s).

Prefer dynamic typing and flexibility.

Use the right language.

If almost all successful researchers in the field use one particular language, then use it. Don't fight the wisdom of the crowd.

Instead, find ways to integrate smaller components into that language, if the smaller components can be developed in a language suitable for computation such as C/C++, or if existing open source code is available.

Ask fellow researchers for their source code.

Many researcher are actually quite friendly to such requests with proper credits and data sharing.

This will save a lot of trouble because their published papers will only cover the high level picture, yet the devil is in the details.

Always push yourself, but don't timebox.

Timebox don't work because of unpredictability in research work.

An example of how to use backlog in research: Suppose in the beginning there are items A, B, C, ..., X, Y, Z.

A

B

C

...

Over time, you worked on a number of items, and you have a sense of how promising each item is, not just the items you have worked but also those you don't. The updated backlog becomes:

A (promising: 90, progress: 70% done)

B (promising: 70, progress: 60% done)

Z (promising: 65, not started)

...

C (seems it won't work, don't bother)

Notice how item C sinked to the bottom because of research insights gained from working on A and B. Also notice how Z floats to the top. Learning about what other researchers are doing will also help floating items to the top.

At the end of one semester, do a backlog cleanup.

A (done, working)

B (done, working)

Z (done, some bugs)

-----

Y (50% coded, kept in the system, not actively used)

X (10% coded, removed from the system in revision 123)

-----

C (dropped)

The ones that are working will be the result you publish.


问:
When is my code auto GPL'ed?
I'm currently working with Wordpress (GPL).
I understood basically when you write a plugin/module/etc. it becomes GPL since it's considered dependent of Wordpress.

But on the contrary images and css from themes, are not due to be GPL (they are considered independent data files that could have meaning even without Wordpress)

And that just blurs things a little bit for me.

What if I create a mathematical library non GPL. Then I create a Wordpress plugin that use that library?

Will it makes my library GPL? Would it means I cannot bundle them together? Not even put them on a single zip file?

What if my library is a Web service? And what if the web service is self hosted? May I bundle it with the plugin code altogether?

If I can't make any kind of bundle without GPL being propagated, how comes one can bundle a theme (feat. css + images) for Wordpress?

答:
When you create a plugin for a product that uses the GPL license, then the plugin itself and any libraries that the plugin uses do not need to use the GPL license themselves.

However, you are not entirely free in your choice of license. As the GPL terms apply to the entire product and spread out to all plugins as well, your plugin and all the libraries it depends on must use a license that is compatible with the GPL. The easiest way to be compatible is to use the same license, but most popular open-source licenses are compatible.

What this means for the concrete example you give, if your mathematical library uses a compatible open-source license (for example, the MIT license), then there is no problem with using it in a Wordpress plugin and you can distribute it together with that plugin.

When it comes to completely unrelated programs, you can always combine those in a distribution without having the copyright licenses affect each other. In legal terms this is called "Mere Aggregation" and allows you even to distribute Wordpress with unrelated commercial (closed source) programs as long as they are completely independent of each other.

If themes are legally considered to be independent of Wordpress, then they can be distributed alongside Wordpress itself, even when they have incompatible licenses, under the principle of Mere Aggregation.

Title: When is my code auto GPL'ed?


问:
Unit testing of non-atomic methods
I'm new in unit testing. For last two days I'm thinking how to test non-atomic methods with unit tests.
When i need to write tests for some simple, atomic method situation in pretty easy - i'm taking all scenarios for this method that i can imagine,  and reforge each of it in unit test.

But what if i have methods that are calling other methods? Should I test each scenarios for tested method AND each methods it is calling?

Maybe some example will be easier to understand:

```<code>    public int makeSomeOperation(int a, int b)
    {
        if (a < 0)
            throw new ArgumentException("a must be greater that 0");
        if (b == 0)
            throw new ArgumentException("b cannot be 0");
        return a/b;
    }

    public bool SomeNonatomicMethod(int number)
    {
        if (number * number % 2 == 1)
            return false;
        int secondNumber = getNumberFromMordor();
        int result = makeSomeOperation(number, secondNumber);
        if (result == "123")
            return true;
        return false;
    }
</code>```

In this case, makeSomeOperation is easy to test - one test for each exception, one to check in returning result is equals with expectations.

But what about SomeNonatomicMethod? Did I need to write not only test for each case in this method (so: power of number is odd, result is equal 123, and result is diffrent), but also each possible flow of things that may happen in getNumberFromMordor and makeSomeOperation?

Things that may happen in makeSomeOperation are already tested, so are they should be tested second time?

答:
If getNumberFromMordor and makeSomeOperation are public, they should be tested by themselves, so your unit test should not doublecheck that getNumberFromMordor works correctly.

Only test what SomeNonatomicMethod does. Don't re-test public methods it relies on.

If getNumberFromMordor is private, you should test SomeNonatomicMethod against the possibility that getNumberFromMordor fails to work properly.

If SomeNonatomicMethod itself does so many things that you end up with dozens of assertions, it is a signal that it doesn't follow the single responsibility principle and should be broken down.

Title: Unit testing of non-atomic methods


问:
How does user confirmation box work?
How does the client know to send request to server only when the confirmation box result is ok and stay on page if cancelled? Also, is this mechanism any different in ASP.Net and ASP.Net MVC?

I want to know the internal working of when user clicks OK/cancel what happens internally. How does browser come to know it has to proceed to server call or close itself and do nothing?

What I have researched so far tells me, that on a web forms page, the Page.IsValid property is somehow responsible for browser to determine the outcome.Is it correct? Also what happens with MVC?

答:
If you want a request sent after a confirmation dialog is shown it's up to you, via client code, to do that. The browser will not take any initiatives for you there. On its own it only can tell it must send a request when a form is submitted, a link is clicked or a new address or search query is submitted. That's it. Other than that, it never knows.

So the answer to your question really is: Whatever happens after a user makes a choice in a confirmation box is on you. It's your code's responsibility to take appropriate action.

Usually your presentation layer will show confirmation dialogs with javascript and wait for input. When the user makes a choice, it gets processed by the code and the next step is executed depending on the choice. Again, remember that whatever happens then is up to you. For all there is, you could very well end up having the "Cancel" button click making a server request. There might be a very good reason for that: rollbacking an on-going transaction, going back to a specific page, etc...

It really all depends on your app design and requirements. If anything, pressing either OK or Cancel may even not lead to a query being made at all!

Now, on Page.IsValid, if you look at the documentation you'll find out that this tells if the validation server controls are all valid within the page. Depending on what you're trying to do here this might not even be related at all.

I hope you find that information useful.

Title: How does user confirmation box work?


问:
Sell product containing purchased GPL software
I recently purchased a product (a website template, licensed by GNU GPL 2.0). My product, which is a web software, coded in PHP, uses that web template as its appearance.

The question is: How can I sell a software which includes some parts of a GNU GPL 2.0 commercial website template? Do I have to pay a license for the website template each time I sell mine?

Thanks.

答:
It is fine to buy GPL licensed software, many developers sell their own GPL licensed software which they are perfectly entitled to do. You are entitled to incorporate GPL licensed software within your own software and redistribute it, provided that your own software is also GPL licensed. You should not have to pay a license fee.

However, one very important thing to be careful about is that the GPL license may only apply to the PHP code, it may not apply to any images or other file types, which may well be copyrighted. You should check the license under which they are available otherwise you could face legal action for using these without permission.


答:
Black magic from John Carmack</p>

```<code>float Q_rsqrt( float number )
{
    long i;
    float x2, y;
    const float threehalfs = 1.5F;

    x2 = number * 0.5F;
    y  = number;
    i  = * ( long * ) &y;                       // evil floating point bit level hacking
    i  = 0x5f3759df - ( i >> 1 );               // what the ****?
    y  = * ( float * ) &i;
    y  = y * ( threehalfs - ( x2 * y * y ) );   // 1st iteration
//  y  = y * ( threehalfs - ( x2 * y * y ) );   // 2nd iteration, this can be removed

    return y;
}
</code>```

Body:
Black magic from John Carmack

float Q_rsqrt( float number )
{
    long i;
    float x2, y;
    const float threehalfs = 1.5F;

    x2 = number * 0.5F;
    y  = number;
    i  = * ( long * ) &y;                       // evil floating point bit level hacking
    i  = 0x5f3759df - ( i >> 1 );               // what the ****?
    y  = * ( float * ) &i;
    y  = y * ( threehalfs - ( x2 * y * y ) );   // 1st iteration
//  y  = y * ( threehalfs - ( x2 * y * y ) );   // 2nd iteration, this can be removed

    return y;
}


答:
It is improbable that you have bought a Website template that is licensed to you, in its entirety under the GPL 2.0.  Their business, and their livelihood would depend entirely on their first customer not republishing their work on the internet.

However, It is very probable that you have bought a website template that has some components that are covered by the GPL 2.0, with other parts that they have provided that are under a more commercial license.

Your best solution is to talk to the team that produced the template, explain that you have written a product that is improved by their template, and would like to bundle the two together and see if you can come up with a sensible commercial relationship.

Your next best option is to still release your product, but without the template, and point out to your customers that it requires this third party template to look as intended.

Title: Sell product containing purchased GPL software

Body:
I recently purchased a product (a website template, licensed by GNU GPL 2.0). My product, which is a web software, coded in PHP, uses that web template as its appearance.

The question is: How can I sell a software which includes some parts of a GNU GPL 2.0 commercial website template? Do I have to pay a license for the website template each time I sell mine?

Thanks.


问:
Does the GPL allow anyone to obtain GPL software without paying for it?
I've spotted a nice WordPress (GPL) theme for sale.

I know somebody who bought it.

I have 2 questions:

Has the company selling it the obligation to send the source code to whoever (customers or not) ask it?

Can the person who bought it give me a copy for free which I could use in production?

答:
WordPress themes, like the themes for many GPL web applications (including Joomla) are made up of many parts. This may include: PHP, javascript, images, CSS, and LESS.

While the analysis by WP and Joomla as projects is that the PHP in themes must be GPL (I'm not going into an explanation of this), the other parts of the themes, assuming they stand alone, are not necessarily GPL licensed. So theme makers may be able (or even required) to restrict distribution of those parts of the theme. Further those elements may have their own licenses.

For example, a theme maker may have licenses for certain fonts, images or javascript that impose certain restrictions. Further, they may even potentially include some standalone PHP classes or libraries that or not GPL at all.

Without going into all the gory details, depending on the template, your friend may or may not be  able to give you the full source code for every single thing or all elements.  Likely the friend can give you some pieces of the source code.

Of course, if all elements of the theme are under the GPL then the GPL applies to everything. In that case you friend can pass on everything.


问:
Is displaying an HTML email a security risk?
I am writing a simple webmail where I want (obviously) to display the emails.

I'm wondering if I should take any precaution while displaying HTML emails: is dumping the email content into a
 a security risk?

I'm guessing that yes since the email could contain anything (could it contain Javascript?). But then how should I proceed? How do other webmails do?

I'm thinking that stripping dangerous HTML tags would be a bad solution since it's impossible to think of all the cases.

Body:
Yes it is insecure and problematic in many ways:

JavaScript inside the mail could hijack the session (XSS) or do other things

CSS in the mail could break your layout

Images and other resources loaded from remote sites can e used for tracking and thus have privacy issues

Links in mails might carry private info in the referrer

Filtering against these things is actually the key trouble for a web mailer. Filtering is not easy as you not only have to filter out <script> tags but also a bunch of attributes (like javascript event handlers)

A plain whitelist will break too many mails, though.

What you need is to collect a huge amount of sample mails from different sources and see what elements they actually need and provide these.


问:
Storing plaintext passwords for detecting fraud
I am well aware of best practices for storing user passwords:

Never store passwords in plaintext

Never store encrypted passwords; always store password hashes

Always salt your password hash to deter brute force attacks

Always use unique salts to deter attacks using rainbow tables.

However, I have recently came upon on a potentially legitimate use case for keeping plaintext (or plaintext-accessible encrypted) user passwords: fraud detection. For example, if we have a system that needs to restrict purchases to 1 (or a small number) per person, we have observed that fraudsters often use the same password over and over, so if we have detected fraudulent purchases on one account, we can use the fact that password matches as a useful signal in a fraud detection system.

But implementing such a system requires breaking all the best practices for password storage.

Question: If it is determined that the fraud-detection ability of being to retrieve passwords is necessary, what are the best practices for storing passwords securely but in a way that is plaintext-accessible?

答:
If you are set on doing this, the ideal solution seems to me to use a Bloom filter of the known "bad passwords".

The advantage is that even in a compromise, you only leak information about the passwords of known/suspected bad actors, and you never directly leak any password hashes.  In addition, a dense Bloom filter is very fast to search and can be sized to have a low false positive rate.  Also, if the Bloom filter is sized for a 1 in a million false positive rate, then even an attacker who has been able to steal your Bloom filter will find all of the real "bad passwords" plus one out of a million of his/her random password guesses.

Let's say you have a 65,536 entry Bloom filter using 8 different hash functions.  This will require just 8 kilobytes to store, and will hold more than exp(ln(1e-6)/8) * 65536 / 8 = 1,457 "bad" passwords before you hit a 1 in a million false positive rate.

The downside is that after you mark an account as bad, you'll need to wait until the next login into that account to add the password to the Bloom filter (this only time you see cleartext passwords), and after you add a "bad password" to the Bloom filter, you won't discover other accounts sharing the "bad password" until the next time they login.

The first problem can be easily overcome by expiring the cryptographic tokens/login cookies of a bad account, tricking the attacker into logging in immediately.  Crypto tokens/login cookies should always contain a message-authentication-code-protected creation timestamp.  This allows you to force periodic login and also keep a per-user earliestValidToken timestamp that you can bump up to the current time when they change their password (or if you need to expire their existing tokens for some other reason).

The second problem can be overcome using a combination of several methods.  (1) It's good to make users login every 2 weeks to keep them from forgetting their passwords (2) you probably mostly care about new account creation using "bad passwords" (3) assuming most accounts become spammy soon after creation, when you discover a spammy account, you can expire the crypto tokens/login cookies of all accounts created in the past N days (or maybe all accounts created after the spammy account).

As far as how to get your 8 hash functions, you need 8 16-bit hashes, or 128 bits of hash output to cut into 16-bit chunks.  You'll want your hash functions to use site-specific keys, to minimize the possibility of cross-site use of a stolen Bloom filter.  Two invocations of Siphash-2-4 using two different keys is probably the fastest way to get your 128 bits of hash values.  SHA-1 HMAC (truncate MAC to 128 bits) or AES CMAC are also perfectly acceptable.


问:
mysql, store a single piece of data per row
I am preparing to write a database system using PHP and MYSQL which will store every piece of info sent to it as an individual row.  Each row will store several piece of meta data (time stamp, who created it, version number, attribute number) and one piece of 'true' data (file name, phone number, username, etc.)  Rows my also be used to store serialized data.  The goal is to create a system that is easy to incrementally back up, search on single rows,  and review based on its state at a particular date.  Is this an effective design or should I alter my approach?

The database will be used to drive a custom CMS system which is intended to store a interconnected system of data.  It will involve customer data, location data and job data.  We want to be able to track individual database changes based on time so that we can maintain an on-site backup (the system will be cloud based) which we can use in the event that we lose internet connectivity.  The system will be strongly permission based, only allowing people to see/change information that they are authorized to see.  Most of the data will be viewed in a timeline format, based on the time that the info is entered into the system.

答:
Based on the information provided:

The database will be used to drive a custom CMS system which is
  intended to store a interconnected system of data.

'Interconnected' implies relational, which is why you should use a traditional relational database design.

It will involve customer data, location data and job data.

Already there's three tables at least -- customer table, location table with a foreign key to customer, and job table with a foreign key to another related table -- user? employee?

We want to be able to track individual database changes based on time
  so that we can maintain an on-site backup (the system will be cloud
  based) which we can use in the event that we lose internet
  connectivity.

Backups for purposes of disaster recovery should probably be handled at a different "layer" (infrastructure) than database design.  Nonetheless, I still don't think a vertical database is the best solution for this -- you could use a separate logging system via extra tables or writing to a file if you want to use an approach like that.  But I think including the created_by, timestamp, start_date, end_date, etc. as metadata in your data tables is the best approach for maintaining history.

The system will be strongly permission based, only allowing people to
  see/change information that they are authorized to see.

I'd recommend building or using a pre-existing role-based authentication system for this.  You could get down to table- or row-level security by storing the role(s) of the individuals that should be able to read/modify the data alongside your data or in separate user/role tables.  How you'd set that up is probably a much deeper discussion than we could have here.

Most of the data will be viewed in a timeline format, based on the
  time that the info is entered into the system.

ORDER BY timestamp   :)

I'd strongly recommend looking into existing CMS systems before you get too far into planning on your own custom one.  Many of them have a lot of the capabilities you've mentioned.


问:
How is 'bolt-on' the same or different from add-on, extension, or module?
I hear the term 'bolt-on' used in many contexts, specifically in my organization where PeopleSoft is used extensively.  I don't know exactly how it differs from an 'extension' of an existing product, a new module within an application, or an 'add-on' like you would purchase for a product you own.  Is there a more formal definition of 'bolt-on' that I'm not familiar with?</p>

答:
Most of those terms only have meaning in a specific context. In particular, I've only heard bolt on used with respect to PeopleSoft, where it means a separate application that integrates with the PeopleSoft ecosystem. Here's an article about the difference between bolt-ons and customizations (tl/dr: a customization is a change to some part of the PeopleSoft system, a bolt-on is a separate thing that uses the PeopleSoft system).

The other terms you used, module, extension, and add-on also need to be considered in a particular context. For example, in some contexts a module could be some source code component that needs to be compiled into a program, while in others it may just be a functional component of the program that can be added without modifying the original.

If you're unsure of what someone in your office means by a particular term, ask them. If you feel you can't do that without looking uneducated, check the documentation for the pieces of software that they're talking about.


答:
As M. Dudley stated in a comment below the answer, "bolt-on" is used to identify a component that is quickly and easily added to another system. This distinguishes it from components that require more sophisticated integration or customization.

I would also add that this is mainly a slang term, and can also mean anything added to a system hastily, without regard for suitability or esthetics.

Title: How is 'bolt-on' the same or different from add-on, extension, or module?

Body: I hear the term 'bolt-on' used in many contexts, specifically in my organization where PeopleSoft is used extensively.  I don't know exactly how it differs from an 'extension' of an existing product, a new module within an application, or an 'add-on' like you would purchase for a product you own.  Is there a more formal definition of 'bolt-on' that I'm not familiar with?</p>


问:
How can I use different versions of an evolving library in different projects?

The problem

I write a lot of exploratory code in my research. As I go along, I put functionality that I'd like to reuse in a central location. A project might look like this:

```<code>./mylib
./exploration
    /experiment_1
    /experiment_2
    /experiment_3
</code>```

Where each experiment uses some functionality from mylib.

Now I come along and start my fourth experiment. In the process, I may need to change my library in some backwards-incompatible way. Now I can't re-run my first three experiments without updating their codes to be compatible with the newest library.

Note: As of now, I keep mylib in version control, and exploration in version control, using git. This means that all of the experiments are in the same repository. This is done so that a single push or fetch and merge in experiments syncs all of my experiments between computers. I feel that there may be a better way, but that might be for another question...

Possible solutions

I could bite the bullet and update the old experiments manually whenever I need to run them (bad, tedious, but straightforward).

I could "vendorize" my library by copying it whenever I make a new experiment. (Bad, bugfixes have to be inserted into each copy).

Since I keep my library in version control, I could tag points in the library's history by whatever is required by an experiment. When I want to run experiment n, I'd checkout tag n. (Better, but what if I want to run two experiments simultaneously? It also seems like there should be a way to automatically use a specific version of the library.)

Whenever I start an experiment, I'll make a new branch in the library. In each experiment folder, I'll clone the library repo and checkout the correct branch. (This seems reasonable, though it is perhaps wasteful of space, since I'm duplicated all branches when I clone. Also, I might have a lot of experiments, meaning that there will be lots and lots of branches in my repository, cluttering things unnecessarily.)

Should I reconsider any of these above solutions?

I have also heard about git's subtrees and submodules, and while they sound like they might be the answer to my problem, I want to get the input of more knowledgeable coders before sinking time into a rabbit-hole.

答:
Use an Adapter.

An adapter is a class that converts from one version of an API to another.  On one side of the adapter is the original API.  On the other side is the API for the newest version of your library.

You could, of course, simply make your library backwards-compatible, retaining the old API calls for the benefit of your existing experiments.


答:
I quite like how http://cocoapods.org/ does it. It can be use publicly or privately.

We have a similar issue where we a developing multiple objective-c controls that will be used in many applications. We couldn't make breaking changes as this would mean possibly breaking a project you know nothing about. This seriously hampers progress / innovation.

So with cocoapods we basically have a repo that lists the names / versions and locations of all of our controls (a list of podspecs). Inside cocoapods we say, for this project use

control1 - v0.0.1

control4 - v0.0.7

control5 - v0.0.2

Then cocoapods will go to each controls repo and pull out a tag with the name of the version number specified e.g. "0.0.1".

This is working quite well for us being able to use specific versions of multiple libraries in many different projects.

Not sure if cocoapods will support your platform, you might need to build something yourself or just come up with your own process, but the idea works well.

Title: How can I use different versions of an evolving library in different projects?

Body:
The problem

I write a lot of exploratory code in my research. As I go along, I put functionality that I'd like to reuse in a central location. A project might look like this:

```<code>./mylib
./exploration
    /experiment_1
    /experiment_2
    /experiment_3
</code>```

Where each experiment uses some functionality from mylib.

Now I come along and start my fourth experiment. In the process, I may need to change my library in some backwards-incompatible way. Now I can't re-run my first three experiments without updating their codes to be compatible with the newest library.

Note: As of now, I keep mylib in version control, and exploration in version control, using git. This means that all of the experiments are in the same repository. This is done so that a single push or fetch and merge in experiments syncs all of my experiments between computers. I feel that there may be a better way, but that might be for another question...

Possible solutions

I could bite the bullet and update the old experiments manually whenever I need to run them (bad, tedious, but straightforward).

I could "vendorize" my library by copying it whenever I make a new experiment. (Bad, bugfixes have to be inserted into each copy).

Since I keep my library in version control, I could tag points in the library's history by whatever is required by an experiment. When I want to run experiment n, I'd checkout tag n. (Better, but what if I want to run two experiments simultaneously? It also seems like there should be a way to automatically use a specific version of the library.)

Whenever I start an experiment, I'll make a new branch in the library. In each experiment folder, I'll clone the library repo and checkout the correct branch. (This seems reasonable, though it is perhaps wasteful of space, since I'm duplicated all branches when I clone. Also, I might have a lot of experiments, meaning that there will be lots and lots of branches in my repository, cluttering things unnecessarily.)

Should I reconsider any of these above solutions?

I have also heard about git's subtrees and submodules, and while they sound like they might be the answer to my problem, I want to get the input of more knowledgeable coders before sinking time into a rabbit-hole.


问:
Should we include external systems in Class diagram?
I want to draw a class diagram that shows the following for an application:

An external content management system that publishes some news items.

The class that represents the news item in my application.

The question is shall I include the external content management system as a class in my diagram (and maybe give it a different color or add a comment that it is an external component) ?

if the answer is no, what shall I include in the class diagram ? the news item class only ? and how to show the relation between the news item class and the external content management system ?

答: Your external API (the connection to the content management system) is not a class, it's an interface.  As illustrated in this Stack Overflow question, it would look something like this:


答:
If the relations with the classes from the external system are relevant for what you want to show in the class diagram, then you should show them by all means.

The standard UML way to show that some classes belong to a different module/system/whatever is to put them in a different package. In your diagram, you can either draw the classes within a package symbol for the external system, or you can use fully-qualified names (<external system name>::<class name>) for those classes.

Title: Should we include external systems in Class diagram?

Body:
I want to draw a class diagram that shows the following for an application:

An external content management system that publishes some news items.

The class that represents the news item in my application.

The question is shall I include the external content management system as a class in my diagram (and maybe give it a different color or add a comment that it is an external component) ?

if the answer is no, what shall I include in the class diagram ? the news item class only ? and how to show the relation between the news item class and the external content management system ?


答:
The basic problem is that you are asking the end user to place the same trust they  give your web domain to the content of the HTML email, the content of which, you have limited control over.

The only safe way that I know for sure is reliable is to strip the HTML email down to pure and simple text and text formatting options such as p, em tags.   Although this is hardly what people would consider HTML email.

Start allowing anything beyond presentational tags and you are making assumptions that you know more about how these tags can be misused than the mal-ware writers.  And believe me, that is a brave claim for anyone to make.

Title: Is displaying an HTML email a security risk?

Body:
I am writing a simple webmail where I want (obviously) to display the emails.

I'm wondering if I should take any precaution while displaying HTML emails: is dumping the email content into a
 a security risk?

I'm guessing that yes since the email could contain anything (could it contain Javascript?). But then how should I proceed? How do other webmails do?

I'm thinking that stripping dangerous HTML tags would be a bad solution since it's impossible to think of all the cases.


答: Keep your library in one git-repository and your experiments in an other. Use git submodules to keep track of versions of the library. It's actually built for this...</p>


答:
I think what you need is somewhere to store and managed versioned artifacts. As you have noticed, this is slightly different from keeping the librar under source control. How to do this depends on the language: usually all language communities tend to reinvent this sort of thing. For instance I would use:

SBT for Scala

Maven for Java

Bower for client-side JavaScript or CoffeeScript

NPM for node JavaScript or CoffeeScript

All of these tools work both with a remote repository or in local mode, where packages are cached somewhere on your filesystem. Bower works with git and tags, but makes local checkouts on each project.

Since you mention Python, the closest equivalent I can think of is Pip, but I am not sure wheter Pip allows you to use local packages.


问:
How to simplify unit testing with higher order functions?

this is not a question on how to write unit tests

this is not a question on what to test

this is a question on reducing the typing needed overall for a personal testing framework

I know you can send function pointers as arguments to functions in C.

Is there a c++98 version?  Or, since c++ can work backwards, should I just use the C function pointer method?

I am trying to write a function that tests functions for me.  I don't want to write a long list of:

```<code>try {
  func1()
  out << fail
} except e {
  out << pass
}

if (func2(arg2) == expected_val) {
  out << pass
else
  out << fail

try/catch...
try/catch...
if/else...
try/catch...
...etc
</code>```

but maybe instead:

```<code>test_this(func1, passes_on_exception)
test_this(func2, ! passes_on_exception, expected_val2, arg2)
test_this(func3, passes_on_exception)
test_this(func4...
test_this(func5...
...etc

void test_this(func_name, pass_on_exception, expected_value, arg1, ..., argn) {
  if pass_on_exception {
      try {
          func_name(arg1)
          out << fail
      } catch e {
          out << pass
      }
  } else {
      if func_name == expected_value {
          out << pass
      } else {
          out << fail
      }
  }
}
</code>```

Virtual functions seems out of the question since, if I recall correctly, the function names have to be overridden/hardcoded; as in, I would need to create a new class to inherit and override the functions, in which case, I would redeclare the function, and also retype all of those try/catch... the chain of try/catch/if/else seems better.

If there was a way to pass function names to other functions, I think I can figure it out from there.  Unless the above is actually impossible in C++, then please stop me before I start, and I'll just bear with that long list of try/catch/if/else unit testing method.  So, main question: is there a way to do the above?  If not, alternatives?

答:
Yes you can use function pointers in C++, more generally you can use std::tr1::function for any sort of callable thing (function, method or lambda)
e.g.</p>

```<code>// Use <functional> for C++11
#include <tr1/functional>
#include <iostream>

using namespace std;
using namespace std::tr1;

void first(function<void()> f)
{
  f();
}

void second()
{
  cout << "second\n";
}

int main()
{
  first(second);
}
</code>```

Body:
Yes you can use function pointers in C++, more generally you can use std::tr1::function for any sort of callable thing (function, method or lambda)
e.g.

// Use <functional> for C++11
#include <tr1/functional>
#include <iostream>

using namespace std;
using namespace std::tr1;

void first(function<void()> f)
{
  f();
}

void second()
{
  cout << "second\n";
}

int main()
{
  first(second);
}


答:
This is not so much a question of the version control system you are using, but more of your general configuration management strategy. First think about your strategy, then check how you map this to your VCS.

Each version of your library you release into "production" should have a unique version number. You should keep track which of your "experiments" uses which version of the lib, and which experiments you still have "under maintenance". This lets you find out for which older versions of your lib you may need "maintenance releases", and for which you can omit them. The different version numbers can be included in the file name of your lib if that helps you to use them in parallel (if that's necessary depends on your physical library management / resolving strategy).

Lets say you have 3 versions lib_v1.0, lib_v2.0 an lib_v3.0, each one used by experiment1, experiment2 and experiment3. Now, during development of experiment4, you made incompatible changes to lib_v4 and find a bug which affects all former versions. Lets further assume you immediately fix that bug in V4. Now you have the following alternatives

don't fix the bug in older versions. For example, experiment1 is not "in production" any more - then there is no need to fix the bug in V1.0. Or you know for sure experiment1 is not affected by the bug, and you know "experiment1" is the only program using your lib, then there is also no need to fix the bug in V1.0

upgrade all affected experiments to your current lib_v4. This can become tedious, but with @RobertHarveys suggestion using an Adapter (or to avoid breaking changes) it may be a feasible solution

if upgrading the affected experiments is too much effort, consider to port the bugfix down to your older lib versions (so creating lib V1.1, V2.1, V3.1)

Of course, you can mix that strategies: experiment 2 and 3 may be easily switched to V4, while experiment1 needs to stick to lib V1, then you will only have to port the bugfix down to V1. That leaves you with lib_V1.1 in maintenance and lib V4 in active development, but no need to maintain V2 and V3 any more.

What you should avoid is to have more than one version tree of your lib under "active development". When you decide to improve an older experiment, either stick with the library version it is currently linked to, or switch to the newest library version for this older experiment.

A remark about version control: this development model maps easily to each VCS which supports tagging and maintenance branches (in other words: basic features supplied by any decent software worth the title "VCS").


答:
You could keep binaries for each library with a version name in each, e.g.

```<code>mylib/thelibname-alpha.dll
mylib/thelibname-beta.dll
</code>```

Your tests then reference the relevant version. If you need to patch a library, all tests using it will benefit, but other tests will be unaffected.

The reason for doing this is the same as for embedding a version string in any library - you can control precisely which one you are using, and control what is the "active" version using symbolic links if you want. Take a look in /lib on a Linux host and you'll see exactly this arrangement being used:

```<code>$ ls -l /lib/libaudit.so.*
lrwxrwxrwx 1 root root     17 Feb  8 14:24 /lib/libaudit.so.1 -> libaudit.so.1.0.0
-rwxr-xr-x 1 root root 112224 Mar 14  2012 /lib/libaudit.so.1.0.0
</code>```

Body:
You could keep binaries for each library with a version name in each, e.g.

mylib/thelibname-alpha.dll
mylib/thelibname-beta.dll

Your tests then reference the relevant version. If you need to patch a library, all tests using it will benefit, but other tests will be unaffected.

The reason for doing this is the same as for embedding a version string in any library - you can control precisely which one you are using, and control what is the "active" version using symbolic links if you want. Take a look in /lib on a Linux host and you'll see exactly this arrangement being used:

$ ls -l /lib/libaudit.so.*
lrwxrwxrwx 1 root root     17 Feb  8 14:24 /lib/libaudit.so.1 -> libaudit.so.1.0.0
-rwxr-xr-x 1 root root 112224 Mar 14  2012 /lib/libaudit.so.1.0.0


问:
Does the Composite design pattern implement recursive behavior?
The Composite design pattern allows us to call an operation() on a 'composite' node in a tree structure, and this operation() will be called on all of the children, subchildren and so on.

When an element's operation() is invoked, it is it's responsibility to call operation() on all of it's children, and so on. Each child responsible to invoke the operation on it's own direct children.

I understand why this has a recursive nature. When we learn of this design, the word 'recursion' is inside our heads all the time.

But can this be considered 'recursive behavior' in the strict sense of the word?

I always thought that recursion simply means a process where 'a function calls itself'. ('function' or 'method' or 'procedure' etc).

However, in the Composite design pattern, no method calls itself. A method calls the identically-named method in the objects composed with it (serving as it's 'children') - but it never calls itself (aka void operation(){ this.operation(); } never happens).

So, does the Composite design pattern create recursive behavior? Or does it create behavior resembling the nature of recursion? Is my definition of recursion wrong because it's too strict? If so, how would you define recursion?

答:
To complement the other answers, I'll add a historical aspect.

In traditional CS definition, recursion means as you say, "a function calls itself." But object member methods and polymorphic functions were probably not well understood or even known at the time of that definition. Now let's take the Composite pattern:

operation() is (traditionally) recursive in the Composite pattern because it gives the illusion at a certain level of abstraction that it's a "function calling itself" (that illusion is key because it's a kind of information hiding).

But in reality (as you so well pointed out with your code example void operation(){ this.operation(); }), we know that composite's operation isn't the same function calling itself.

This is a great example of how computer science is a science of abstractions. Definitions that apply at one level might not apply precisely at others, but that doesn't mean they're suddenly wrong.

Recursive algorithms to solve problems don't need to have a function call itself, but often they do. There are strengths and weaknesses to the approach. You could use that recursive approach in a composite structure at the right level of abstraction to solve problems recursively. Base cases in recursion with Composite would be the Leaf classes. Recursive cases are obviously the Composite classes.


问:
Why does the Mailbox app need their own backend?
I am only coding in Objective-C and I have no experience with backend coding, only a high-level understanding.

I understand why a lot of programming projects require backend servers but I'm not absolutely clear on a high-level perspective why Mailbox needs their own.

They get their data from the Gmail API,

It is my understanding that most iOS client app receive data from a backend from a public API (like Gmail), download in the iOS app and show it in their app. Therefore they have no need for their own servers in order to receive the appropriate data to show it to their users.

My only explanation is that Mailbox follows this logic:

Gmail data --> Mailbox's app AND servers --> users interact with app --> save changes on their own servers and Google's via the API

The last part to me would mean that they would basically keep the data of all the Archived, Delayed, Deleted, and Listed emails on their own servers rather than Google's.

Is my understanding correct?

Thank you

答:
Your suspicion is about right.  There really should be nothing that the client couldn't be able to take care on its own unless the server also offered to save information that otherwise could not be saved using Gmail.  It could be that, in fact, this is the reason and that Mailbox requires to store additional information.

However, I'm more inclined to think that the true reason is the same reason why the application is free.  In this way, they offer you the services of their app in exchange for free information.  This is not that unusual, but I think often people tend to forget that free apps get their money elsewhere.

Make no mistake, Google does this too, however they tend to use it to know what types of advertisements you'd click on.  Mailbox may use it for this purpose as well, but more likely the information is sold to the highest bidder.  My advice is to interface directly with Gmail if it is possible.


问:
Should an API be aware of client versions?
Should an API be aware of a client version?

The idea of that really goes against the grain for me, but it seems like it is being pushed for in my current project.

Am I wrong? Can I get some reasons for or against this that I can present or understand why it might be good.

The API is a RESTful API.

答:
An API should be as consistent as possible.  Making the same call to the API should always do the same thing.  Responding differently based on the client version would be unexpected and confusing.  It may lead to subtle errors, as someone who upgrades a client would get different results and not know why.

Of course, you can make functions that provide different levels of data available to meet different needs.  But they should be offered to everyone, and the users of the API can decide what level they want.


问:
Why don't HTTP headers include device resolution, pixel density, etc.?
I'm currently developing a responsive website with CSS media queries. It would be much easier if the server returned a different HTML/CSS for each viewport.

I was wondering why couldn't the client include its viewport information when requesting an HTML file. This behavior is already common for returning websites in the correct language using the Accept-Language header.

答:
In short, that was not how the Wild Wild Web was designed to work.

The original design was simply that the HTML gave the browser hints about the document.  Which bits to emphasise, where to go to get image files.  Decisions about the font (as well as what size) was the job of the browser and local configuration settings.

Yes, I know the world has moved on, and now web designers expect to control every pixel our eyes get to see.  In the bygone past, that was the desktop theme's job to do that.


问:
ReSharper's effect on coding interviews
Anyone who has used R# or CodeRush knows how fast you can put together simple constructs (and refactor complex ones) with a simple keyboard shortcut.  However, do these productivity plugins cause a false evaluation of ability during interviews?

Part of being a productive code writer (and making a good first impression in an interview) is writing good code - fast.

If I had two candidates:

Doesn't use plugins.  She thinks about the problem, sits down at a stock IDE at the interview PC that looks exactly like hers and types out the code in a minute or two, as usual.  Done.  Pass.

Uses plugins.  He thinks about the problem, sits down at a stock IDE at the interview PC and realizes "fe + tab" no longer writes a foreach loop automatically, and all the shortcuts are gone.  He then bumbles around the keyboard hitting his normal hotkeys and popping up strange windows and getting flustered.  It takes him 3 minutes to write what normally would take 30 seconds.  Done.  Looked like they didn't know their way around the IDE at times.  Must be new to this IDE and thus not had much experience with it or maybe the language.  Pass, but a 'meh' mark beside their name.

In your experience, how do you handle plugins during interviews as the interviewer or interviewee?  What are the best practices to getting what the candidate really knows?  There can be candidates who don't understand code, and use R# as a crutch.  There can also be candidates who know the code in and out and use R# because it's just plain faster than the built in VS or Eclipse templates.  Is it best to just not use an IDE at all?  Let them bring their own PC?  Others?

答:
Great question BTW - I've often pondered this.

Mastery of tools is a skill that is central to being a good developer. I have always felt alarm bells ring when a developer claims he prefers coding in notepad to using an IDE. It suggests he's more interested in the process than the product.

It's like preferring to till the soil with a hoe vs a tractor - fine if you're a hobby gardener, but insupportable as an industrial farmer in a competitive economy.

However, we do become dependent on our tools. People do seem to freak out about how we would cope in the hypothetical situation where our tools were suddenly taken away. There was the same argument about allowing calculators into exams.

The reality is that tools get better and better and cheaper and cheaper each year and there is no reason why you should ever suppose you will be without them. And tools are great at doing repetitive things with a high degree of quality - which means we can focus the full force of our incredible homo-sapien intellects on the difficult (and interesting) parts.

ReSharper is an awesome addition to Visual Studio. My current company didn't have ReSharper when I was interviewed - but I was so evangelical about it in my interview that they bought me a copy when I accepted the position as well as one for the developer who interviewed me. It is now being rolled out across the company. Good tools pay for themselves in no time at all.

So to answer the question: your dependency on tools may cause a false evaluation of your abilities in an interview, but they will always give a correct evaluation of the interviewer's abilities. If a company doesn't recognise the value of tool support in your interview - you've got to show them the light. And if they still won't see it, then I'd be very concerned about accepting a position there.

Title: ReSharper's effect on coding interviews


答: One good reason to build things with an intermediary service you control is so that you can control your own destiny and control when you need to change the app. For example, if your mobile app was talking directly to google and then they change the API surface you would have to push out an emergency update. This would be doubly bad if the change broke key features of your app. Another case is if google cut off your API access -- at least your app would have whatever you stored in your cloud. There are many other use cases but if I were building something like this I would certainly strongly entertian the idea of at least building my own proxy service.</p>

Title: Why does the Mailbox app need their own backend?

Body:
I am only coding in Objective-C and I have no experience with backend coding, only a high-level understanding.

I understand why a lot of programming projects require backend servers but I'm not absolutely clear on a high-level perspective why Mailbox needs their own.

They get their data from the Gmail API,

It is my understanding that most iOS client app receive data from a backend from a public API (like Gmail), download in the iOS app and show it in their app. Therefore they have no need for their own servers in order to receive the appropriate data to show it to their users.

My only explanation is that Mailbox follows this logic:

Gmail data --> Mailbox's app AND servers --> users interact with app --> save changes on their own servers and Google's via the API

The last part to me would mean that they would basically keep the data of all the Archived, Delayed, Deleted, and Listed emails on their own servers rather than Google's.

Is my understanding correct?

Thank you