问:
Logging private data
In general, I write a debug log whenever one of my functions is entered, including the parameters.

For instance:

```<code>    function execute_query($query, $conn_string)
    {
        $this->log->debug(sprintf('Entering execute_query(query=%s, conn_string=%s)', $query, $conn_string));
        //Do Stuff
    }
</code>```

The potential problem that I see is that the parameter could contains private data (e.g. connection string could contain a username and password) and it will be written to the log.

That being said, when developing the application I have the logger set to include the debug level, and I would actually find this helpful. When deploying to production I would expect the level to be set to info or error, and so the username/password would never be written to the log.

Is there a best practice around this?

答:
We had a highly escalated support case once about passwords being printed in the log file and as you can imagine, management jumped into fire-fighting mode, directing the devs to fix it 'by all means necessary.'

I'm not sure which language you're using, but here are the several measures that can be taken:

Some logging frameworks themselves have filtering capabilities, tailored to filter out passwords (example) - see if yours has such a feature

If you can isolate the password-printing culprits to a set of packages/classes, then disable them entirely for INFO/higher levels (log4j allows doing this easily). For instance, disabling logging for the Hibernate package(s) gets rid of all the ORM-related logs that may contain connection strings having passwords in them.

If you use internationalization (I10n), then strip all the password-printing messages from the resource file

In cases where you want to only obfuscate the password and continue printing the rest of the log message,

a. Create a custom log handler/formatter in whichever logging library you're using such that all logs pass through your own function

b. Add some logic here to replace the password string (identified in various ways in the log message, such as searching for "password=..." or matching a regex) with asterisks

c. Ensure that this 'filter' function is only called for a particular log level (preferably DEBUG only) and only when the configured log level is <= to that. This is likely going to be a performance hit and you wouldn't want to run ALL log messages through this filter)

(4) above can be easily done in Python as follows:

```<code>class PasswordSafeLogFormatter(logging.Formatter):
""" Custom formatter that obfuscates passwords """

def format(self, record):
    """
    Search the log message for a password-like string and obfuscate it

    :param record: Logging record
    :return: Formatted message
    """
    PASSWORD_REGEX = r'password=.*' # Regular expression that matches a password present in a log
    PASSWORD_SUBSTITUTION = r'password=****' # Obfuscated text to be inserted in the log

    record.message = re.sub(PASSWORD_REGEX,PASSWORD_SUBSTITUTION, record.message)

    return super(PasswordSafeLogFormatter, self).format(record)

def initialize_logger():
    """ Initializes the logging module for the application """
    root_logger = logging.getLogger()

    file_log_handler = RotatingFileHandler(log_file_path, maxBytes=LOG_FILE_ROTATION_BYTES,
                                           backupCount=LOG_FILE_RETENTION_COUNT)
    formatter = PasswordSafeLogFormatter(LOG_FORMAT_SPECIFIER)
    file_log_handler.setFormatter(formatter)
    root_logger.addHandler(file_log_handler)
</code>```

Note: This code snippet filters all log messages and blatantly ignores (4)c above - don't use it AS-IS!

Title: Logging private data

Body:
We had a highly escalated support case once about passwords being printed in the log file and as you can imagine, management jumped into fire-fighting mode, directing the devs to fix it 'by all means necessary.'

I'm not sure which language you're using, but here are the several measures that can be taken:

Some logging frameworks themselves have filtering capabilities, tailored to filter out passwords (example) - see if yours has such a feature

If you can isolate the password-printing culprits to a set of packages/classes, then disable them entirely for INFO/higher levels (log4j allows doing this easily). For instance, disabling logging for the Hibernate package(s) gets rid of all the ORM-related logs that may contain connection strings having passwords in them.

If you use internationalization (I10n), then strip all the password-printing messages from the resource file

In cases where you want to only obfuscate the password and continue printing the rest of the log message,

a. Create a custom log handler/formatter in whichever logging library you're using such that all logs pass through your own function

b. Add some logic here to replace the password string (identified in various ways in the log message, such as searching for "password=..." or matching a regex) with asterisks

c. Ensure that this 'filter' function is only called for a particular log level (preferably DEBUG only) and only when the configured log level is <= to that. This is likely going to be a performance hit and you wouldn't want to run ALL log messages through this filter)

(4) above can be easily done in Python as follows:

class PasswordSafeLogFormatter(logging.Formatter):
""" Custom formatter that obfuscates passwords """

def format(self, record):
    """
    Search the log message for a password-like string and obfuscate it

    :param record: Logging record
    :return: Formatted message
    """
    PASSWORD_REGEX = r'password=.*' # Regular expression that matches a password present in a log
    PASSWORD_SUBSTITUTION = r'password=****' # Obfuscated text to be inserted in the log

    record.message = re.sub(PASSWORD_REGEX,PASSWORD_SUBSTITUTION, record.message)

    return super(PasswordSafeLogFormatter, self).format(record)

def initialize_logger():
    """ Initializes the logging module for the application """
    root_logger = logging.getLogger()

    file_log_handler = RotatingFileHandler(log_file_path, maxBytes=LOG_FILE_ROTATION_BYTES,
                                           backupCount=LOG_FILE_RETENTION_COUNT)
    formatter = PasswordSafeLogFormatter(LOG_FORMAT_SPECIFIER)
    file_log_handler.setFormatter(formatter)
    root_logger.addHandler(file_log_handler)

Note: This code snippet filters all log messages and blatantly ignores (4)c above - don't use it AS-IS!


问:
Why does the TRACE level exist, and when should I use it rather than DEBUG?
In Log4J, Slf4J and a couple other logging frameworks in Java, you have two "developper" level for logging:

DEBUG

TRACE

I understand what DEBUG does, because the explanation is clear:

The DEBUG Level designates fine-grained informational events that are most useful to debug an application.

But the TRACE level is not very specific about its use case:

The TRACE Level designates finer-grained informational events than the DEBUG

(Source: the log4J JavaDoc)

This does not tell me how or when to use TRACE. Interestingly, this is not a severity level defined in the syslog standard. Googling for the difference between TRACE and DEBUG only seem to return "use DEBUG, oh, and there is TRACE too". I couldn't find a specific use case for the TRACE level. The best I could find was this old wiki page debating the merit of the existence of the level.

This, as an architect, raises a lot of flags and questions in my head. If a young developer asked me to add TRACE to my architecture, I would bombard him with questions:

What are some examples of information that should be logged with TRACE and not with DEBUG?

What specific problem do I solve by logging that information?

In those examples, what are the properties of the logged information that clearly discriminate between logging at the TRACE level rather than the DEBUG level?

Why must that information go through the log infrastructure?

What are the benefits of persisting that information in a logs journals rather than just using System.out.println ?

Why is it better to use log for this rather than a debugger?

What would be a canonical example of logging at the TRACE level?

What are the specific gains that have been made by logging at the TRACE level instead of DEBUG in the example?

Why are those gains important?

In reverse: What problems did I avoid by logging it at TRACE instead of DEBUG?

How else could I solve those problems? Why is logging at the TRACE level better than those other solutions?

Should TRACE level log statement be left in the production code? Why?

But given that it is present in most major framework, I am guessing it is useful for something? So... what is TRACE for, and what distinguishes it from DEBUG?

答:
What would be a canonical example of logging at the TRACE level?

ENTRY/EXIT  logs from a method. These logs help you trace the flow of the program and tend to be very useful when:

The program abruptly crashes - you know exactly which function it crashed in by looking at the last line of the log

Some rogue function silently fails by absorbing an exception

They warrant a separate TRACE level rather than just using DEBUG because enabling ENTRY/EXIT logs for every method in your code base is going to generate a tremendous amount of extra logs that are unreasonable to be always on, even in a DEBUG context.

ContentLicense: CC BY-SA 3.0


问:
How to handle design changes for auto_ptr deprecation in C++11?
We are testing a library under C++11 (i.e., -std=c++11). The library uses auto_ptr and this pattern:

```<code>Foo* GetFoo()
{
    autoptr<Foo> ptr(new Foo);

    // Initialize Foo
    ptr->Initialize(...);

    // Now configure remaining attributes
    ptr->SomeSetting(...);

    return ptr.release();
}
</code>```

C++11 deprecated auto_ptr, so we want to move away from it.

However, the code supports both C++03 and C++11, so its not a simple as yanking auto_ptr. It's also worth mentioning the library has no external dependencies. It uses C++03; and does not use Autotools, Cmake, Boost, ...

How should we handle the design changes to move away from auto_ptr for C++11 while retaining compatibility with C++03?

答:
In most respects the std::unique_ptr was made to be drop in (but safer) replacement for std::auto_ptr, so there should be very few (if any) code changes required other than (as you ask) directing the code to use either unique_ptr or auto_ptr.

There a few ways to do this (and each comes with its own list tradeoffs) below. Given the code sample provided, I would favour either of the first two options.

Option 1

```<code>#if __cplusplus >= 201103L
template <typename T>
using auto_ptr = std::unique_ptr<T>;
#else
using std::auto_ptr;
#endif
</code>```

Tradeoffs;

You introduce the auto_ptr name into the global namespace; you can mitigate this by defining it in your own "private" namespace

Once you migrate to C++17 (I believe auto_ptr will be completely removed) you can more easily search and replace

Option 2

```<code>template <typename T>
struct my_ptr {
    #if __cplusplus >= 201103L
    typedef std::unique_ptr<T> ptr;
    #else
    typedef std::auto_ptr<T> ptr;
    #endif
};
</code>```

Tradeoffs;

Probably more cumbersome to work with as all the current auto_ptr references need to be changed in the code to something like my_ptr<T>::ptr

Better safety because the names are not being introduced into the global namespace

Option 3

Somewhat controversial, but if you are prepared to put up with the caveats of having a std class as a base

```<code>#if __cplusplus >= 201103L
template <typename T>
using my_ptr = std::unique_ptr<T>;
#else
template <typename T>
class my_ptr : public std::auto_ptr<T> {
  // implement the constructors for easier use
  // in particular
  explicit my_ptr( X* p = 0 ) : std::auto_ptr(p) {}
};
#endif
</code>```

Tradeoffs;

Don't try to use the inherited class where a virtual base (in particular w.r.t. the non-virtual destructor) would be expected. Not that this should be an issue in the case - but be aware of it

Again, code changes

Potential namespace mismatches - it all depends on how the pointer class is used to begin with

Option 4

Wrap the pointers in a new class and aggregate the required functions to the member

```<code>template <typename T>
class my_ptr { // could even use auto_ptr name?
  #if __cplusplus >= 201103L
  std::unique_ptr<T> ptr_;
  #else
  std::auto_ptr<T> ptr_;
  #endif

  // implement functions required...
  T* release() { return ptr_.release(); }
};
</code>```

Tradeoffs;

A little extreme when all you really want is to "swap" the implementations out

Body:
In most respects the std::unique_ptr was made to be drop in (but safer) replacement for std::auto_ptr, so there should be very few (if any) code changes required other than (as you ask) directing the code to use either unique_ptr or auto_ptr.

There a few ways to do this (and each comes with its own list tradeoffs) below. Given the code sample provided, I would favour either of the first two options.

Option 1

#if __cplusplus >= 201103L
template <typename T>
using auto_ptr = std::unique_ptr<T>;
#else
using std::auto_ptr;
#endif

Tradeoffs;

You introduce the auto_ptr name into the global namespace; you can mitigate this by defining it in your own "private" namespace

Once you migrate to C++17 (I believe auto_ptr will be completely removed) you can more easily search and replace

Option 2

template <typename T>
struct my_ptr {
    #if __cplusplus >= 201103L
    typedef std::unique_ptr<T> ptr;
    #else
    typedef std::auto_ptr<T> ptr;
    #endif
};

Tradeoffs;

Probably more cumbersome to work with as all the current auto_ptr references need to be changed in the code to something like my_ptr<T>::ptr

Better safety because the names are not being introduced into the global namespace

Option 3

Somewhat controversial, but if you are prepared to put up with the caveats of having a std class as a base

#if __cplusplus >= 201103L
template <typename T>
using my_ptr = std::unique_ptr<T>;
#else
template <typename T>
class my_ptr : public std::auto_ptr<T> {
  // implement the constructors for easier use
  // in particular
  explicit my_ptr( X* p = 0 ) : std::auto_ptr(p) {}
};
#endif

Tradeoffs;

Don't try to use the inherited class where a virtual base (in particular w.r.t. the non-virtual destructor) would be expected. Not that this should be an issue in the case - but be aware of it

Again, code changes

Potential namespace mismatches - it all depends on how the pointer class is used to begin with

Option 4

Wrap the pointers in a new class and aggregate the required functions to the member

template <typename T>
class my_ptr { // could even use auto_ptr name?
  #if __cplusplus >= 201103L
  std::unique_ptr<T> ptr_;
  #else
  std::auto_ptr<T> ptr_;
  #endif

  // implement functions required...
  T* release() { return ptr_.release(); }
};

Tradeoffs;

A little extreme when all you really want is to "swap" the implementations out

ContentLicense: CC BY-SA 4.0


问:
Design Patterns: What design pattern should I use for the following?
I am trying to write an utility which traverses through a list of files and searches for a string in each file. On finding the string in a file, I will add it to a list and display the list. Which design pattern should I use for the same?</p>

答:
You shouldn't.

Design patterns are named, recurring solutions to recurring problems that involve complex workflows, typically involving many classes with systematic relationships to each other. What you have here is a simple task that calls for a loop or two and a simple list data structure.

Ask again when you have to write a complex system with dozens of requirements that have complex interconnections with each other.


问:
Implementing a Generic List in Java
In an effort to understand Generics in Java (and how to use them), I am trying to implement a list structure using them but have hit a wall.

Scenario:

Suppose there is some classes (we'll call them ClassA, ClassB, and ClassC) which all extend ClassBase. ClassBase is abstract, and simply contains an ID code with appropriate getters and setters. The subclasses add additional attributes, but those aren't important.

The list is designed to be able to hold a number of the above sub-classes, and manipulate the list using the common ID attribute. The list needs to be growable, and each list will only contain one type of sub-class (so a list of ClassA, ClassB, or ClassC. No mixed combinations of those).

Attempt 1:

I set up my List class like so:

```<code>ClassList<T extends ClassBase>
</code>```

I then declare an array of elements as "private T list[]", and write the remainder of the class. The signatures for the element getters and setters are as follows, since those might be important:

```<code>public T get(int index)
public void set(int index, T item)
</code>```

Everything appears to be good, except when I go to compile it complains about every instance where I try to recreate the underlying array (in order to shrink/grow it).

```<code>.\test\ListClass.java:10: error: generic array creation
        list = new T[0];
               ^
</code>```

So after some thought and reading the error makes sense, as the compiler doesn't know what constructors are going to be available (at least that's how I understand it), so it doesn't appear that this way will work.

Attempt 2:

I keep the same class declaration, but change the internal array to "private ClassBase list[]", and then adapt my code accordingly. The main change is casting from ClassBase to T and back when necessary. So the getter for instance looks like this:

```<code>public T get(int index)
{
    return (T)(list[index]);
}
</code>```

So now my code compiles and executes, but every instance where I have done the above casting now throws the infamous unchecked warning:

```<code>.\test\ListClass.java:16: warning: [unchecked] unchecked cast
        return (T)(list[index]);
                  ^
</code>```

I can see why the warning is appearing, but at the same time the ListClass controls all means of accessing and manipulating the list, so I can guarantee that only elements of type T are placed in there.

Problem:

I suppose I could suppress the warnings. But I am of the belief that they are there for a reason and would prefer to get rid of them the proper way. The problem is I can't work out what the 'proper' way is (or whether infact suppressing the error is the proper way in this case).

So that's my question. What is wrong with my design, and how do I fix it?

Thanks in advance.

Note:

Before anyone tells me to use one of the existing generics and stop reinventing the wheel, that's not the point. My aim isn't to recreate a replacement for the generic lists, it is to understand generics, and a list like above is about the best example I can think of which clearly shows how they work.

答:
The only working solution is to suppress the warnings. That's what the existing generic collections also do.

So it doesn't mean there's anything wrong with your design - if there is anything wrong, it's with the design of Java generics (which had to make some compromises to achieve downwards compatibility).

Title: Implementing a Generic List in Java


答:
It is a sort of catch 22, I agree.  However if you know that only instances of type T are added to the list, then you can surpress the warning without repercussions.  The compiler isn't intelligent enough to derive this information on its own.

However, also know that should you create another method that allows the insertion of instances of type ClassBase, the compiler will let you do it, and the warning that you surpressed would be warning you exactly of this type of problem and will cause a ClassCastException for types that are not T, so be mindful of this fact!

Title: Implementing a Generic List in Java

Body:
In an effort to understand Generics in Java (and how to use them), I am trying to implement a list structure using them but have hit a wall.

Scenario:

Suppose there is some classes (we'll call them ClassA, ClassB, and ClassC) which all extend ClassBase. ClassBase is abstract, and simply contains an ID code with appropriate getters and setters. The subclasses add additional attributes, but those aren't important.

The list is designed to be able to hold a number of the above sub-classes, and manipulate the list using the common ID attribute. The list needs to be growable, and each list will only contain one type of sub-class (so a list of ClassA, ClassB, or ClassC. No mixed combinations of those).

Attempt 1:

I set up my List class like so:

```<code>ClassList<T extends ClassBase>
</code>```

I then declare an array of elements as "private T list[]", and write the remainder of the class. The signatures for the element getters and setters are as follows, since those might be important:

```<code>public T get(int index)
public void set(int index, T item)
</code>```

Everything appears to be good, except when I go to compile it complains about every instance where I try to recreate the underlying array (in order to shrink/grow it).

```<code>.\test\ListClass.java:10: error: generic array creation
        list = new T[0];
               ^
</code>```

So after some thought and reading the error makes sense, as the compiler doesn't know what constructors are going to be available (at least that's how I understand it), so it doesn't appear that this way will work.

Attempt 2:

I keep the same class declaration, but change the internal array to "private ClassBase list[]", and then adapt my code accordingly. The main change is casting from ClassBase to T and back when necessary. So the getter for instance looks like this:

```<code>public T get(int index)
{
    return (T)(list[index]);
}
</code>```

So now my code compiles and executes, but every instance where I have done the above casting now throws the infamous unchecked warning:

```<code>.\test\ListClass.java:16: warning: [unchecked] unchecked cast
        return (T)(list[index]);
                  ^
</code>```

I can see why the warning is appearing, but at the same time the ListClass controls all means of accessing and manipulating the list, so I can guarantee that only elements of type T are placed in there.

Problem:

I suppose I could suppress the warnings. But I am of the belief that they are there for a reason and would prefer to get rid of them the proper way. The problem is I can't work out what the 'proper' way is (or whether infact suppressing the error is the proper way in this case).

So that's my question. What is wrong with my design, and how do I fix it?

Thanks in advance.

Note:

Before anyone tells me to use one of the existing generics and stop reinventing the wheel, that's not the point. My aim isn't to recreate a replacement for the generic lists, it is to understand generics, and a list like above is about the best example I can think of which clearly shows how they work.


问:
Best practice for a REST-ful API where objects would naturally have a "/" in their identifier
I am designing a REST api for a document management system. To make the API more natural, I thought about using the natural identifier for a file, which is it's path (usually having forward slashes "/" in it), and not something like an artificial id such as a UUID.

Naturally, a user would identify a file by it's path:

```<code>/path/to/file.txt
</code>```

Unfortunately, this clashes with common, good API design.

This would work:

```<code>Retrieving a file: GET /api/v1/files/<path/to/file.txt>
</code>```

However, other methods you would like to have, will become a bit problematic:

```<code>Retrieving a file list of a folder: GET /api/v1/folders/<path/to/folder>/files
</code>```

My thoughts so far:

avoid unique identifiers with "/" in it entirely, and use an artificial UUID (such as Alfresco is using NodeId / NodeRefs). This would add another layer of abstraction to it, where a unique id is just not very natural from a business domain perspective

don't use the identifier in the url path but in a parameter (against good API design patterns)

(requesting the API users to replace the / with another character is of course also not an option)

Of course, files and folders as we know it from a file system, are naturally identified by it's path. In that particular case, one could argue that if someone wants to use the path as the identifier, than the correct way for doing:

```<code>Retrieving a file: GET /api/v1/files/<path/to/file.txt>
</code>```

would actually be:

```<code>Retrieving a file: GET /api/v1/folders/<path>/folders/<to>/files/<file.txt>
</code>```

if we want to be really correct here.

Update: I want to ask the community about best practices and experiences here - especially when Dropbox and Google Drive both use two different approaches (see first answer and comments below): DropBox is using the path while Google Drive is using IDs.

答:
First of this

```<code>/api/v1/someresource
</code>```

is not actually good REST api design. The version of the api should not be in the path of a resource. A resource is just a resource. The version of the data structure representing the resource should be in the MIME time. For example when you go to a webpage you don't have URLs like this

```<code>www.newyorktimes.com/html5/headlines
www.newyorktimes.com/html2.1/headlines
</code>```

you just have this

```<code>www.newyorktimes.com/headlines
</code>```

And the browser figures out if it can display HTML5 or HTML2 or XML or what ever the search reports it can return for that resource. The version of HTML used is in the meta information for the representation of the resource headlines.

So don't do that with your API either. If there is a version 1 of a resource and a version 2 of that resource record that in the mime time of the resource. If you are expecting the client to know the location of resources based on the version of the API you are also not following REST. You should be able to move a resource to another location without having to up the API version.

There is nothing wrong then with the URI

```<code>www.myserver.com/files/path/to/file.txt
</code>```

or even just

```<code>www.myserver.com/path/to/file.txt
</code>```

if that makes sense with regard to how you want to structure your resources. This is how static files are served on a web server and it has worked fine for decades.

Body:
First of this

/api/v1/someresource

is not actually good REST api design. The version of the api should not be in the path of a resource. A resource is just a resource. The version of the data structure representing the resource should be in the MIME time. For example when you go to a webpage you don't have URLs like this

www.newyorktimes.com/html5/headlines
www.newyorktimes.com/html2.1/headlines

you just have this

www.newyorktimes.com/headlines

And the browser figures out if it can display HTML5 or HTML2 or XML or what ever the search reports it can return for that resource. The version of HTML used is in the meta information for the representation of the resource headlines.

So don't do that with your API either. If there is a version 1 of a resource and a version 2 of that resource record that in the mime time of the resource. If you are expecting the client to know the location of resources based on the version of the API you are also not following REST. You should be able to move a resource to another location without having to up the API version.

There is nothing wrong then with the URI

www.myserver.com/files/path/to/file.txt

or even just

www.myserver.com/path/to/file.txt

if that makes sense with regard to how you want to structure your resources. This is how static files are served on a web server and it has worked fine for decades.


问:
Is there any reason to use C++ instead of C, Perl, Python, etc.?
As a Linux (server side) developer, I don't know where and why should I use C++.

When I'm going for performance, the first and last choice is C.

When "performance" isn't the main issue, programming languages like Perl and Python would be good choices.

Almost all open source applications I know in this area have been written in C, Perl, Python, Bash script, AWK or even PHP, but no one uses C++.

I'm not discussing other areas like GUI or web applications, I'm just talking about Linux, CLI and daemons.

Is there any satisfactory reason to use C++?

答:
I don't think there's any compelling reason to use C++. If you want to do OO programming, you can use Python instead and write the parts that need fast performance in C.

EDIT: There are other languages that interface well with C, so if you don't like Python, there are alternatives.


答:
The unchecked cast warning is one of the most problematic, annoying, and ultimately useless warnings issued by java.  I say "ultimately useless" instead of just plain "useless" because it is not entirely without merit, it is good to know that you have an iffy conversion somewhere, but it just so turns out that if you do any work whatsoever with generics in java, you will want to add @SuppressWarnings("unchecked") as a macro to your keyboard, that's how often you will have to be suppressing this warning.

Essentially, the value of the unchecked warning is that all your iffy conversions will be easily identifiable in your source code because of the @SuppressWarnings("unchecked") statements attached to them.

So, there is nothing wrong with suppressing the unchecked warnings, as long as you know what you are doing.  If you later come across a class cast exception at runtime, you will know that the cause of the problem is probably in the nearest @SuppressWarnings("unchecked") statement.

Just be sure whenever possible to suppress unchecked warnings at the statement level, instead of at the function or at the class level. For some weird reason, java will not allow this:

```<code>@SuppressWarnings("unchecked")
return (T)x;
</code>```

so this might tempt you to suppress the warning at the function level and be done with it.  However, this will work:

```<code>@SuppressWarnings("unchecked")
T temp = (T)x;
return temp;
</code>```

This way, the warning is localized to the exact statement that contains the iffy conversion, so you know precisely where every single iffy conversion is.  If you suppress at the function or at the class level, then iffy conversions could be anywhere, you would not know.

That having been said, another very good option that you have is to abandon the idea of creating and manipulating your own array of generic objects, and have your home-grown list class contain Java's ArrayList<T> instead.  This class exists precisely in order to encapsulate generic arrays, and as Michael Borgwardt has already stated, if you look at its source code, you will see that it contains an array of java.lang.Object, and that it is choke full of @SuppressWarnings("unchecked") clauses.  The benefit of using it is that it has been thoroughly tested, so all these conversions are known to be good, so you can't go wrong with it.

Title: Implementing a Generic List in Java

Body:
The unchecked cast warning is one of the most problematic, annoying, and ultimately useless warnings issued by java.  I say "ultimately useless" instead of just plain "useless" because it is not entirely without merit, it is good to know that you have an iffy conversion somewhere, but it just so turns out that if you do any work whatsoever with generics in java, you will want to add @SuppressWarnings("unchecked") as a macro to your keyboard, that's how often you will have to be suppressing this warning.

Essentially, the value of the unchecked warning is that all your iffy conversions will be easily identifiable in your source code because of the @SuppressWarnings("unchecked") statements attached to them.

So, there is nothing wrong with suppressing the unchecked warnings, as long as you know what you are doing.  If you later come across a class cast exception at runtime, you will know that the cause of the problem is probably in the nearest @SuppressWarnings("unchecked") statement.

Just be sure whenever possible to suppress unchecked warnings at the statement level, instead of at the function or at the class level. For some weird reason, java will not allow this:

@SuppressWarnings("unchecked")
return (T)x;

so this might tempt you to suppress the warning at the function level and be done with it.  However, this will work:

@SuppressWarnings("unchecked")
T temp = (T)x;
return temp;

This way, the warning is localized to the exact statement that contains the iffy conversion, so you know precisely where every single iffy conversion is.  If you suppress at the function or at the class level, then iffy conversions could be anywhere, you would not know.

That having been said, another very good option that you have is to abandon the idea of creating and manipulating your own array of generic objects, and have your home-grown list class contain Java's ArrayList<T> instead.  This class exists precisely in order to encapsulate generic arrays, and as Michael Borgwardt has already stated, if you look at its source code, you will see that it contains an array of java.lang.Object, and that it is choke full of @SuppressWarnings("unchecked") clauses.  The benefit of using it is that it has been thoroughly tested, so all these conversions are known to be good, so you can't go wrong with it.


问:
Is there a better algorithm to distribute integer to X integers minimizing their difference?
Is there a better algorithm to distribute values from one source to X destinations minimizing their difference?

I have some source integer. I need to know how much of that value I need to distribute among some other values the proportion of that source to be distributed among other ordered integers in order to align make them equal as much as possible.

Example:

  source = 20

  destinations = [10, 20, 30, 40]

  result should = [15, 5]

  this will make final destinations look like [25, 25, 30, 40]

Here the source "20" was divided among first 2 destinations in attempt to compensate their difference as much as possible. So the result is the list of integers: [15, 5].

Each destination has some common limit but it never overflows.
  If source value exceeds sum of destinations' "free room", than I just fill destinations up to it: sharing isn't needed. But if source is smaller then some sharing logic is needed.

```<code># Other test cases (each destination's capacity is limited with 100):

# nothing to share:
share(0, [10, 20, 30, 40]) == []
# finally keeps dests the same: [10, 20, 30, 40]

# source exceeds total destinations' capacity (999 > 90+80+70+60==300)
# no special algo is required:
share(999, [10, 20, 30, 40]) == [90, 80, 70, 60]
# finally top-fills dests: [100, 100, 100, 100]

# source is smaller than first 2 items diffs (5 < 20-10=10)
share(5, [10, 20, 30, 40]) == [5]
# finally fills just the most poor dest: [15, 20, 30, 40]

# source is larger than first 2 items diffs (15 > 20-10=10)
# 1 indivisible point is left unshareable
share(15, [10, 20, 30, 40]) == [12, 2]
# finally fills 2 most poor dests also equalizing them: [22, 22, 30, 40]

# and so on...
</code>```

I can't figure out better naming and description of that problem.

Here is the code in python that I managed to implement.
But I feel the possibility of some better idea though:

```<code>def share(available, members):
    avail = available
    imembers = iter(members)
    member_ = next(imembers)
    i = 1
    distr = []
    for member in imembers:
        avail -= (member.value - member_.value) * i
        if avail < 0:
            distr = list(member_.value - imember.value for imember in members[0:i])
            equal_share = int((source.value - sum(sharing)) / i)
            distr = list(share + equal_share for share in distr[0:i])
            break
        member_ = member
        i += 1
    return distr
</code>```

The final solution / with help of @Euphoric

```<code>def diff(values, target):
    # return the difference list of values and target
    return [target - v for v in values]

def distribute(available, members, strict_equal=False):
    # find across how many 'members' we must distribute 'available'
    # and discover the total sum of those values
    # in order to get diff list for them and the target value
    total = available
    idx = None
    for idx, member in enumerate(members):
        total += member
        if idx >= len(members)-1 \
        or total // (idx+1) <= members[idx+1]:
            break
    count = idx+1
    dist = diff(members[0:count], total // count)
    if not strict_equal:
        for r in range(total % count):
            dist[r] += 1
    return dist
</code>```

答:
I made a slightly different algorithm:

```<code>def share(available, members):

    # find across how many members we must distribute and what the total sum of those values is
    total = available
    for idx, member in enumerate(members):
        total += member
        count = idx+1
        if (idx >= len(members)-1):
            break
        if (total / (idx+1) <= members[idx+1]):
            break

    # distribute the total value among 'count' first value
    distr = []
    for member in members[0:count]:
        target = total//count
        diff = target - member
        distr.append(diff)

        total -= target
        count -= 1

    return distr
</code>```

It works in two steps. First step calculates across how many members the available value needs to be distributed along with total sum of all those values after being distributed.

In the second step, the differences are calculated based on value that would be if it was distributed.

But handling the edge cases complicates the whole algorithm.

Body:
I made a slightly different algorithm:

def share(available, members):

    # find across how many members we must distribute and what the total sum of those values is
    total = available
    for idx, member in enumerate(members):
        total += member
        count = idx+1
        if (idx >= len(members)-1):
            break
        if (total / (idx+1) <= members[idx+1]):
            break

    # distribute the total value among 'count' first value
    distr = []
    for member in members[0:count]:
        target = total//count
        diff = target - member
        distr.append(diff)

        total -= target
        count -= 1

    return distr

It works in two steps. First step calculates across how many members the available value needs to be distributed along with total sum of all those values after being distributed.

In the second step, the differences are calculated based on value that would be if it was distributed.

But handling the edge cases complicates the whole algorithm.


问:
Upgrading from XP Pro to Win 7, anything I should worry about?
I do mainly .NET work so I assume that the framework is all fine and that.  But have there been reports of various tools like .NET Reflector and the like not working properly with Win 7?  This is a company-wide thing so there isn't much I can do about it, but once everything is reinstalled I'm hoping to not find anything shocking.

Cheers.

答:
I've been developing on Windows 7 for the better part of the year and haven't had any problems. You will need to reinstall your applications, since there is no graceful upgrade from XP to Win7, but your documents (from "My Documents") and such will be preserved.

If you're going from 32-bit to 64-bit at the same time, you might need to watch out for assembly versions. Some things (such as SQLite) have separate 32- and 64-bit builds. Other than that, it's business as usual.

Oh, one more thing: the C: drive is now more protected than it used to be. You can't freely write to Program Files and user permissions are more closely observed. If your application needs administrative rights, you will either need to ensure that it asks for them on startup or disable UAC on your machine for testing, depending on what target platforms you support. I also tend to keep my files and code off of C: just to further avoid potential permission issues.

ContentLicense: CC BY-SA 2.5


答:
Kilian Foth's answer is excellent, so please upvote it, accept it, go by it.

This answer is simply meant to show the fallacy of trying to shoehorn patterns into everything.

First of all, you will need inversion of control.  Your main application logic should not go out there on its own to access the filesystem and query files, it should be passed some interface that it can invoke to do the job.  So, you should have a "SearchableEntity" interface and a class which implements it on java files, and you should have a "SearchableEntityProvider" interface to enumerate instances of "SearchableEntity" and a class which implements it for this particular application by "traversing through a list of files".  So, your main application logic should be given a "SearchableEntityProvider" to work with.

Alternatively, you can use the visitor pattern, so the "SearchableEntityProvider" could invoke some "SearchableEntityConsumer" interface for each file, and your application could provide an implementation of "SearchableEntityConsumer" which performs each search, and if there is a match, adds the searchable entity to its list.

Then, of course, your main application logic should not be concerned with string-search specifics, so you should hide your strings behind some "SearchPattern" interface, and all the specifics of searching for a string behind some "SearchStrategy" interface.

You see where this is going: what could be done with 30 lines of code that fit in a single screen now takes 10,000 lines of code, a design document, and a quarter of your brain capacity to just maintain a grasp of the whole thing.

That having been said, let me add that if this is a homework assignment, where the teacher wants you to artificially force the use of a design pattern on an extremely simple problem which would not normally require the use of a design pattern, then the visitor pattern is probably what your teacher wants to see.

Title: Design Patterns: What design pattern should I use for the following?

Body: I am trying to write an utility which traverses through a list of files and searches for a string in each file. On finding the string in a file, I will add it to a list and display the list. Which design pattern should I use for the same?</p>


问:
Can fast, optimized server calls collapse a server?
I've followed a series of optimizations to make our APIs faster. We microoptimized a lot of PHP code to faster, native methods, we unset variables where they were not being used anymore, and basically improved anything that could be improved in the server code (MySQL queries were left untouched).

We improved the time a request takes by about 10%, everything works the same and passes the tests, but we noticed that the servers started stacking and our cores load average went from roughly 0.3 to 2.5

The MySQL usage also raised from 10 to 25 concurrent connections, which essentially should mean that more concurrent users can be using the API.

Could it be that optimizing the server side code killed the server?

答:
By optimizing your API calls, you have changed the execution profile of your service/app. That isn't always for the better. Possibly you have made the (un-optimized) MySQL pieces a larger part of the execution and therefore created a larger overall load. Any major optimization effort really needs to be tested to make sure you didn't just move the problem somewhere else or create a new problem.

In a multi-tiered application, changes in one layer can have drastic impacts on other layers.  When attempting to optimize, you need to have a coordinated effort across layers.


问:
How to avoid god controller classes and keep single responsibility principle?
The task is to make a migrator from Old DB to New DB using OOP Single Responsibility Principle.

My problem is how can I make this without making the controller a God Class or breaking the single responsibility.

I've thought of two methods of implementing this

Iterate through each property row and cascading to Subdivisions and Owners in the controller and call a Row Migrator for each entity type

Been told that is giving too much responsibility to the controller and would make it a God Class

Add the iterations inside each Entity (E.g. Property iterates Subdivisions, Subdivisions iterate Owners)

Been told that it is breaking the single responsibility principle

Right now it feels that anything I think of it either over-complicates or breaks rules. Maybe I've understood the principles wrong or there is a third way.

Update 1

Normally I would do this with a script but the requirements are to use an API as the new DB is on a different platform, and the addAddress() and addOwner() logic will be in an API Component.

答:
OOP is not always the best choice for ETL tasks, thus I would not stick to "pure" OOP here. And as long as your model is as simple as shown in your example with just three tables to migrate, I would avoid to overdesign this - having simply one Controller which orchestrates the migration of just three tables, and which uses different "Row Migrator" classes, as you wrote, does not look to me as if the Controller gets "too many responsibilities".

Nevertheless there are some options to distribute the responsibilities. For an ETL program, I would suggest to split the responsibilities between the "E(xtract)", "T(ransform)" and "L(oad)" parts of your migration - the "Extractor" class is the only one which connects to the old DB and provides the data to migrate, the "Load" class the only one which connects to the new database / uses the API, and the "Transform" class which does the transformation work, but does not know anything about the source or the destination of your data. Moreover, when your model is much bigger in reality as shown in your example, you might consider to split the "Transform" class into smaller "sub-transformers".

If your second option makes sense IMHO depends on if you are going to use the entity classes exclusively in the migration context, or if you want to keep them reusable and maintainable for different contexts. For the latter, I would not add any business logic there which is only useful for this very special use case "migration".


问:
Javascript inline event handling versus external jQuery event handlers
Working on a dynamic website that loads information from a JSON file and then populates the page with said elements.

My question has to do with event handling - as of now, I don't see any reason as to why I would need to add event handlers inline if I could just use the equivalent jQuery handler in an external script file. I could see the argument where one would say it allows for more control over events, but would that be true?

Here are the two methods I am looking at:

Inline:

```<code><div class="family" onclick="goToFamilyPage()">This Family</div>
</code>```

External/imported script:

```<code>$(document).on('click', '.family', function() {
    //do stuff
});
</code>```

What would be the benifit of one of these versus the other?

答:
According to me, jQuery Event handler is preferable, when you are working with binding dynamic event on basis of certain condition.
Ex.

On Employee detail form, there are multiple buttons i.e. Cancel and Save and you are enabling Cancel button on document load and Save button on once user will fill all details of Employee.

If you use javascript event handler,

```<code><div class="family" onclick="goToFamilyPage()">This Family</div>
</code>```

in this event handling mechanism, it is difficult to handle conditional event, suppose you want to allow this click event on certain condition then it is difficult to handle this.

But if you use jQuery event handler you can bind() and unbind() events conditionally.

```<code>$("#family").unbind("click");

$("#family").bind("click", function(){
  // handle click
});
</code>```

If you want to enable Save button click event then bind this event other wise unbind so that user won't submit data to server.

Body:
According to me, jQuery Event handler is preferable, when you are working with binding dynamic event on basis of certain condition.
Ex.

On Employee detail form, there are multiple buttons i.e. Cancel and Save and you are enabling Cancel button on document load and Save button on once user will fill all details of Employee.

If you use javascript event handler,

<div class="family" onclick="goToFamilyPage()">This Family</div>

in this event handling mechanism, it is difficult to handle conditional event, suppose you want to allow this click event on certain condition then it is difficult to handle this.

But if you use jQuery event handler you can bind() and unbind() events conditionally.

$("#family").unbind("click");

$("#family").bind("click", function(){
  // handle click
});

If you want to enable Save button click event then bind this event other wise unbind so that user won't submit data to server.


答:
You don't need a "controller", you need a "service."

A Controller controls the flow of the application based on user input and other events that occur in lower layers. A Service just naively goes about its business doing what it was told.

The migration service object would have the intelligence for pulling data from the old schema and persisting it to the new schema via a web service if necessary, or an entirely different API. This service should have the minimum amount of dependencies to get the job done:

Domain model classes for each database

Data access classes for each database

Methods or other classes that map one domain model to another

The PropertyMigrationService has the following responsibilities

Knowing where to pull data from

Knowing where to save data to

Having access to the mapping objects to map one domain model to another

It would need:

OldDataAccess - A class for CRUD operations on the old DB

Property - The domain model for the "property" in the old DB

Subdivision - Domain model for subdivisions in the old DB

Owner - Domain model for owners in the old DB

NewDataAccess - A class for CRUD operations on the new DB/web service

Address - Domain model for properties in the new DB

Owner - Domain model for owners in the new DB

PropertyToAddressMapper - Mapping Property objects in the old DB to Address objects for the new DB

SubdivisionToAddressMapper - Mapping Subdivision objects in the old DB to Address objects for the new DB

OwnerToOwnerMapper - Map owner objects from one DB to another

You'll end up with this object hierarchy:

PropertyMigrationService

OldDataAccess

NewDataAccess

PropertyToAddressMapper

SubdivisionToAddressMapper

OwnerToOwnerMapper

The migration service could have a single public method called void migrate() that performs the migration.

Having dealt with legacy schemas, you never know what manner of madness and chaos you'll encounter. Architecting the solution in this manner, in conjunction with having your data access classes implement an interface, and have the PropertyMigrationService use those objects through their interface, you can make this whole migration process unit-testable.

Now you can throw a bunch of tests at this for known error conditions and really make this thing bullet proof (well, bullet resistant).

After this is wrapped in a service object, you have some flexibility for when and where this gets invoked:

From a "controller" in a web application

From a script kicked off as a cron job in Linux or scheduled task in Windows

The migration process becomes both proactive (user clicks a button on the web page and does the migration) or passive (a schedule task executes at midnight and does these records in batches of, say, 1,000).

Title: How to avoid god controller classes and keep single responsibility principle?

Body:
The task is to make a migrator from Old DB to New DB using OOP Single Responsibility Principle.

My problem is how can I make this without making the controller a God Class or breaking the single responsibility.

I've thought of two methods of implementing this

Iterate through each property row and cascading to Subdivisions and Owners in the controller and call a Row Migrator for each entity type

Been told that is giving too much responsibility to the controller and would make it a God Class

Add the iterations inside each Entity (E.g. Property iterates Subdivisions, Subdivisions iterate Owners)

Been told that it is breaking the single responsibility principle

Right now it feels that anything I think of it either over-complicates or breaks rules. Maybe I've understood the principles wrong or there is a third way.

Update 1

Normally I would do this with a script but the requirements are to use an API as the new DB is on a different platform, and the addAddress() and addOwner() logic will be in an API Component.


问:
Event sourcing – finding aggegate by different property than ID
Is there any mechanism or best practise for finding aggregates by different property than aggregate ID?

I'll try to explain my question on example.

There is Cart aggregate (event-sourced) and Product aggregate. There is a rule that when bussiness cancels sale of Product, it must "disappear" from every Cart aggregate.

How can I find carts with specific product inside without rebuilding all Cart aggregates?

I thought about using Read model to find out which Carts contain specific product and then use their IDs in command.

答:
You could use an index. This is generally not something that you will find in an eventstore, so you will most likely need to use an external indexing engine for this.

This index would then have to be updated everytime that someone changes a carts contents, and this index update would most likely be async. This would mean that you cannot rely on your index to be 100% correct. So what you could do then in your case is:

Product gets cancelled

Do an index lookup for carts containing the product

Issue product removals for these carts

Now, you may still have carts containing the cancelled product, since you may have cart changes that haven't been indexed yet. This is ok, it's inevitable, don't fight it - embrace it.

With the index lookup you will most likely have handled the majority of the problem. But you may still have some stragglers left.

What you will need to do now is handle the case when a customer checks out a cart which contains a cancelled product. At this point, you can silently remove the cancelled products or show a message that this product is unavailable etc. This should take care of even more of the problem.

Of course, as is the problem with most eventually consistent systems, you may still end up with a few customers actually succeeding to buy a cancelled product. In this case, you will most likely notice that in a later step (like when you're packing the order). In that case, issue a correction event which in turn should refund the customer and send an email telling the customer that you are very sorry that the product is no longer in stock.

This may feel shaky and annoying, but sit back, have a cup of coffee and think about it for a moment. You're going to have to handle this case anyway even if you would have had a fully consistent database.

In real life when a product gets cancelled you probably get a notice from the vendor. This notice may come such that the product was actually cancelled 2 days ago when you got the notice in the first place. So when you enter the data into the system that the product no longer exists it might have actually been unable to buy for several days before that. But there is no way that your system could handle that! So you're going to have to go through the checked out orders and issue refunds, just as the process above states.

Or maybe the product is cancelled, but you have 1 left in your warehouse. Awesome! So the customer can buy it anyway! Except while you are packing the thing, your packers drop it on the floor and it's destroyed, or when your packers go get it they see that it's water damaged...or anything else really. So what do you do? "I'm sorry Mr Customer, here is your refund." While this is a pretty rare occurrence, it will happen sooner or later.

As you may have noticed when shopping online, this will happen to you at one point or another. You'll buy something on amazon, then one day later you'll get a "sorry we can't actually get you this thing - here's your money back"-email. And when you get that mail you of course become disappointed, but you generally understand that it can happen and it's not really anyones fault.

It will happen because all information on the computer will always be old and out of date. :) You cannot design that away even if you're not doing eventsourcing, any design that promises to do so will eventually fail because of real-life concerns (like the clumsy packers example above).

Instead embrace it, plan for it, include it in your use cases/flows, write tests for it and you'll have a system that fails gracefully.

(Also, if you are smart, when you send the "sorry you can't buy this, here's your refund"-email, include a 10% voucher or something like that for your next shopping cart in the email! That way the customer might feel inclined to return to your store and buy something else instead.)


问:
Static properties and implicit "self" property in structures and enumerations vs classes in Swift
I am currently reading the Swift language documentation and came across these sentences in the chapter about methods:

Similarly, type methods on structures and enumerations can access
static properties by using the static property's name without a type
name prefix.

Within the body of a type method, the implicit self property refers to the type itself,
rather than an instance of that type. For structures and enumerations, this means that you can use self to disambiguate between static properties and static method parameters.

I was under the impression that these rules are also valid for classes and instances of classes. My question is, why are only structs and enums being mentioned? Is this just an accidental omission in the documentary or do different rules indeed apply for classes and their instances?

答:
I expect the reason is because the example presented is a class, so the authors felt it was important to call out the fact that this works with structs and enums as well.

The latest version of the book has reworded that passage:

More generally, any unqualified method and property names that you use
  within the body of a type method will refer to other type-level
  methods and properties. A type method can call another type method
  with the other method’s name, without needing to prefix it with the
  type name. Similarly, type methods on structures and enumerations can
  access type properties by using the type property’s name without a
  type name prefix.

-- The Swift Programming Language (emphasis added by me.)


问:
Structuring a Python Project: Need some guidance
I currently am working on a project that involves several discrete components that have some common functionality, and I am in need of some advice.

Right now I have a central component responsible for dispatching requests to several components that translate the requests to particular formats for particular data sources. The components are running as separate web applications behind an Nginx server. Communication between all the components is via REST.

One issue I'm running into is the fact that many of the components need to perform similar tasks, necessitating code duplication, which I want to avoid.

For example, the data-source specific components use credentials to authenticate to their respective data sources, but the central component also needs access to this store to add new credentials and update existing ones (credentials are stored in a common database).

Right now each component is its own project/app, in it's own separate folder.

If this was a Java project, I would immediately pull out the common functionality, create a library JAR, and have all the components reference it.

However, I'm not quite sure how to do this in Python. I can't really combine the components into one monolithic unit because I need the flexibility to add new components for new data sources (unless somebody knows of an easy way to handle this). Also I eventually want redundant components to handle heavy loads.

First, should I take out common functionality and put it into it's own project/library at all? Is it worth it? If so, how is this usually done in Python (I'm using version 2.7)?

Do I need to create a distributable, (using pip for instance), or is there a way to define a common library without going through that trouble?

答:
In Python, we have packages and modules.  A module is "just" a .py file, and a package is "just" a directory with an __init__.py file (which is often empty).  You can import any package or module which is in a directory listed in sys.path, modules within such a package, subpackages within such a package, modules within such subpackages, and so on.

While you can put the library in one of the standard system package directories, this is often more trouble than it's worth, since you'll be making the library available system-wide.  You can also put the package directly in the project directory, but this is somewhat fragile depending on how your app gets launched.  In such circumstances, we commonly use the Virtualenv tool.  This allows each app to have its own separate package directory.

Note that the import system was overhauled in Python 3, as described in PEP 328, and is now somewhat more consistently behaved.  Python 2 users can get the new behavior with this:

```<code>from __future__ import absolute_import
</code>```

Body:
In Python, we have packages and modules.  A module is "just" a .py file, and a package is "just" a directory with an __init__.py file (which is often empty).  You can import any package or module which is in a directory listed in sys.path, modules within such a package, subpackages within such a package, modules within such subpackages, and so on.

While you can put the library in one of the standard system package directories, this is often more trouble than it's worth, since you'll be making the library available system-wide.  You can also put the package directly in the project directory, but this is somewhat fragile depending on how your app gets launched.  In such circumstances, we commonly use the Virtualenv tool.  This allows each app to have its own separate package directory.

Note that the import system was overhauled in Python 3, as described in PEP 328, and is now somewhat more consistently behaved.  Python 2 users can get the new behavior with this:

from __future__ import absolute_import


问:
How to promote code review as an employee?
I have just graduated not long ago and started to work in a startup company for almost a year. I have introduced git to my current company and they are now happy to use it for version control. I feel that my boss and the company is open to new stuff.

Recently I have heard about the idea of code review and want to give it a try in our company. However, unlike git, I have never done code review. Also, it adds extra work load and I am not sure if everybody is open to accept comment / complain during code review. Is there any suggestion on promoting code review?

答:
Be the change you wish to see in the world.

           —Ghandi (bumper stickerized)

These sorts of things tend to be much better received when introduced voluntarily, so volunteer.  Put up a gerrit server or similar and start putting your own changes on it.  Tell a few people you're trying to improve your code quality and ask if they wouldn't mind reviewing your code.  When people ask you to informally review their code, request they put it on gerrit.  Make it open for anyone to use.

At the very least, your own code quality will improve.  You will find out who really cares about code quality and who is resistant.  You will see how your colleagues prefer to use it, and can use that to create guidelines if it's later made mandatory.  Company-wide, it might continue indefinitely as volunteer only, or if you already have a disciplined team that does informal reviews you might find out it's not worth the trouble.

What often happens is a release will have a lot of quality problems, management will start freaking out about how to prevent that in the future, and will look around for solutions.  If you have this volunteer process in place that is already working well for some, it's likely to be given management support company-wide at that point.  At my company, our agile process, automated testing, and modularization efforts all basically started as volunteer ideas.


答:
My primary problem has been in upgrading to 64-bit Windows that it does not support the old Windows API's anymore, making some of our legacy software break.

The XP Mode available for download is nice, but does not run Java programs well on multi-monitor computers.

Except for that, Windows 7 has been a very pleasant experience.

Title: Upgrading from XP Pro to Win 7, anything I should worry about?

Body:
I do mainly .NET work so I assume that the framework is all fine and that.  But have there been reports of various tools like .NET Reflector and the like not working properly with Win 7?  This is a company-wide thing so there isn't much I can do about it, but once everything is reinstalled I'm hoping to not find anything shocking.

Cheers.


问:
Should I try to read user input for logger data?
Our logger data has gotten a bit out of hand, so I am trying to find ways to trim out unnecessary log information.

What I've found is that the programmer who implemented the logs (no longer working with us) used a lot of user input to log application activity.

I was under the impression that logging user data was a bad idea - because it increases the chances of it being exposed to a malicious attacker, and because it is just informative, and not all that helpful with actual logging.

Assuming the user input data is non-volatile, and that we do have the space to output as much of it as possible (we don't, but this is hypothetical), is it useful at all to log all user input?  Are there any common sense rules for user input that should not be logged?

答:
"User input data" is a rather broad collection of information, so it is hard to say.  You should review logging at all layers of your system.

As a starting point, I would consider logging all actionable data at the point you take action.  You should use log levels to control the verbosity of your logs.  At the end of the day, logging won't be very useful if you aren't logging the data that led to the failure/exception/bug.


问:
Securing ajax calls to rest api
I need for my app to consume a rest api service and since I will call it from javascript/jquery i need to expose it to the end user.

In this case I would also need to expose credentials to the end user, which is something I would like to avoid. As an alternative I am thinking of using a token that would replace sensitive credentials, but what concerns me is how to prevent an end user to reuse or recall rest api service misuse that same token with different params?

Bottom line, how to successfully protect application so only application can consume rest api and not the end user himself?

EDIT

This question raised a couple of doubts so I would like to make myself clear.
For example:
Javascript from my app contains an ajax call that calls a third party api. For example http://domain.com/api/insert-item?user=username&password=password&userid=1000&itemid=55555&itemvalue=10

What stops any user to change query string to userid=2000&itemid=55555&itemvalue=100

What stops any user to get our credentials for third party api and consumes it without permission?

答:
What stops any user to change query string to userid=2000&itemid=55555&itemvalue=100

Nothing.

As such you should not make this secure call to the 3rd party from the client app.

It should instead be made via your server, as that is the only place you can secure the sensitive authentication information for the 3rd party app.

So the client app calls a URL on your server, and your server makes a HTTP request to the 3rd party app, including your sensitive authentication information. When your server gets a response it returns this data to the client app.

The client app never needs the 3rd party app authentication information because it never talks directly to the 3rd party app.

Title: Securing ajax calls to rest api


答:
I've been using Windows 7 since the beta - about two years, I guess. There are two separate issues here - will the apps you like to use still work for you, and will the apps you're writing work? For the first, by now the answer is generally yes, if you're on the latest version. For example, Visual Studio 2010 is UAC-aware and well-integrated with the Windows 7 taskbar. Visual Studio 2008, not so much.

For the apps you're writing, the stackoverflow Windows-7 and UAC tags are going to be your friend. Lots of people have been through this and there are lots of great answers waiting to be read.


问:
Is there a Haskell idiom for trying several functions and stop as soon as one succeeds?
In Haskell, I can use the type a -> Maybe b to model a function that either returns a value of type b, or returns nothing (it fails).

If I have types a1, ..., a(n+1) and functions f1, ..., fn, with fi :: ai -> Maybe a(i+1) for all i, 1 <= i <= n, I can chain the functions by using the >>= operator of the Maybe monad and write:

```<code>f1 x >>= f2 >>= f3 >>=... >>= fn
</code>```

The >>= operator ensures that each function is applied as long as its predecessor has returned a meaningful value. As soon as a function in the chain fails, the whole chain fails (returns Nothing) and further functions in the chain are not evaluated.

I have a somewhat similar pattern in which I want to try several functions on the same input, and return as soon as one function succeeds. If all functions fail (return Nothing), the whole computation should fail. More precisely, I have functions f1, ..., fn :: a -> Maybe b and I define the function

```<code>tryFunctions :: [a -> Maybe b] -> a -> Maybe b
tryFunctions []       _ = Nothing
tryFunctions (f : fs) x = case f x of
                            Nothing    -> tryFunctions fs x
                            r@(Just _) -> r
</code>```

In a sense this is dual to the Maybe monad in that a computation stops at the first success instead of at the first failure.

Of course, I can use the function I have written above but I was wondering if there is a better, well-established and idiomatic way of expressing this pattern in Haskell.

答:
This sounds a lot like replacing failure by a list of successes

You're talking about Maybe a rather than [a], but in fact they're very similar: we can think of Maybe a as being like [a], except it can contain at most one element (ie. Nothing ~= [] and Just x ~= [x]).

In the case of lists, your tryFunctions would be very simple: apply all of the functions to the given argument then concatenate all of the results together. concatMap will do this nicely:

```<code>tryFunctions :: [a -> [b]] -> a -> [b]
tryFunctions fs x = concatMap ($ x) fs
</code>```

In this way, we can see that the <|> operator for Maybe acts like concatenation for 'lists with at most one element'.

Body:
This sounds a lot like replacing failure by a list of successes

You're talking about Maybe a rather than [a], but in fact they're very similar: we can think of Maybe a as being like [a], except it can contain at most one element (ie. Nothing ~= [] and Just x ~= [x]).

In the case of lists, your tryFunctions would be very simple: apply all of the functions to the given argument then concatenate all of the results together. concatMap will do this nicely:

tryFunctions :: [a -> [b]] -> a -> [b]
tryFunctions fs x = concatMap ($ x) fs

In this way, we can see that the <|> operator for Maybe acts like concatenation for 'lists with at most one element'.


问:
Is it ok to avoid testing base classes?
I have a base class with a fair amount of "meta programming" to give it the flexibility/abstraction it needs to be rather generic.

I do have a lot of subclasses using the common methods in the base class, and I have behavior oriented unit tests covering all of the cases in each subclass.

Is it ok to skip testing the base class?

答:
To verify if you have enough tests or not, you can check your code coverage and your branch coverage induced by the tests (maybe by using a coverage tool, maybe manually by reviewing the code paths or by using a debugger).

If you come to the conclusion the tests for the subclasses give you a high enough coverage for your base classes code, then adding further tests obviously won't bring you much benefit. On the other hand, if there are code paths you can only test by adding specific tests using the base class directly, then you should go this route.

Another possible reason for "testing your base class directly" is that you want to test a specific function of that class "in isolation". Sometimes it can be easier to design test cases directly for a specific method, instead of only testing that method indirectly by calling the methods of your subclasses which use that method.

Note that when you have a generic base class for which the typical usage scenario is to derive a subclass, your base class is probably abstract. So for testing such a class you need to make a derivation anyway. For this situation, testing "the base class directly" could mean to add a special derivation just for testing purposes, of course.

Title: Is it ok to avoid testing base classes?


问:
Could changing the return type from void to string introduce breaking changes?
This SDK have an interface like this:

```<code>public interface Contract {
     void update(..);
     void action(..);
     void delete(..);
}
</code>```

Now, we need to change it to something like this:

```<code>public interface Contract {
     String update(..);
     String action(..);
     String delete(..);
}
</code>```

The interface is implemented internally by the SDK; that is not a problem. The question scope is beyond the case who somebody has implemented this interface too outside the SDK.

Does this change introduce a breaking change?

答:
If you only change the interface as outlined here, then yes you are breaking the code.  Because every implementation of the interface must now return a String, and before the change none of them does.

Assuming you make each implementor actually return a String, then no, this cannot break the code because no caller of any of these methods is using the return value.

One obscure exception: if you are using reflection, this could break things.  Because your reflection code may still be looking for the null-returning methods.


答:
Possibly.  "Classic" existing consumers do not expect a value to be returned, thus would simply ignore the string being returned.  By "classic", I mean something like this:

```<code>public void DoSomething(Contract contract)
{
    contract.update();
    contract.delete();
}
</code>```

Now, there's a possibility that there is some functionality in Java that expects a method to have a void return value.  I believe there's threading-related calls in C# that require methods to return void.  Something like that might exist in Java as well.  This could potentially break something.

Existing implementations will need to be updated to implement the new interface.  However, if this is part of a 3rd party library, where only you provide implementations, then consumers of the library will not be affected.

However, changing the String to, say, Error (or any other type) would be considered a breaking change.

Title: Could changing the return type from void to string introduce breaking changes?

Body:
This SDK have an interface like this:

```<code>public interface Contract {
     void update(..);
     void action(..);
     void delete(..);
}
</code>```

Now, we need to change it to something like this:

```<code>public interface Contract {
     String update(..);
     String action(..);
     String delete(..);
}
</code>```

The interface is implemented internally by the SDK; that is not a problem. The question scope is beyond the case who somebody has implemented this interface too outside the SDK.

Does this change introduce a breaking change?

Body:
Possibly.  "Classic" existing consumers do not expect a value to be returned, thus would simply ignore the string being returned.  By "classic", I mean something like this:

public void DoSomething(Contract contract)
{
    contract.update();
    contract.delete();
}

Now, there's a possibility that there is some functionality in Java that expects a method to have a void return value.  I believe there's threading-related calls in C# that require methods to return void.  Something like that might exist in Java as well.  This could potentially break something.

Existing implementations will need to be updated to implement the new interface.  However, if this is part of a 3rd party library, where only you provide implementations, then consumers of the library will not be affected.

However, changing the String to, say, Error (or any other type) would be considered a breaking change.


问:
Which style to use for features that are not directly driven by humans when using BDD Gherkin language?
Should they be written same way as human workflows, first person "I have entered..." style language etc.? Is the user effectively a gender-less "AI"?

答:
BDD actually started at a unit level, in which the users of the classes were other classes! So it's perfectly appropriate to have one technical element being the user of another. It doesn't matter whether it's a "class" or a "module" or a "library" or a "service"; the concepts are still the same.

Some of the differences between these two different types of scenarios are:

Scenarios are focused on system capabilities, rather than user capabilities

Interaction is through the API, rather than the UI

The end-goal of the scenarios may be something for another system rather than for a user (though it might be worth phrasing the scenarios in terms of the user value in some situations, such as when the value is immediately consumed).

Some things do remain the same; particularly, talking through scenarios with someone who has the necessary expertise and can tell you what the scenarios need to do. Your conversation might look something like this:

"So, when the data engine gets the new trade, it has to ask the risk calculator to recalculate the risk, then it adjusts the counterparty limits for country, organisation and currency accordingly."

"Can you give me an example?"

"Sure. Let's say we're making a trade with the Belgian arm of a commodity trader for $3m worth of iron, and we're already badly exposed to that trader, and close to the counterparty limit..."

Dan North, who came up with BDD in the first place, likes using 1st person in scenarios as he says it helps him imagine what that person, class, system, etc. must do.

I like using 3rd person, as it helps me work out if there are any missing stakeholders whose outcomes are also important.

Both are valid ways to write scenarios. In the one above, the speaker has automatically used "we" to indicate the organisation. In this case "we" actually represents two systems: the trade booking system, and the system that holds the counterparty limits.

A trade booking system normally has its own UI, but you won't be coding from that level; you'll be going through the data engine's API, as that's the system you're interested in.

Also, the end result of the scenario is still that the counterparty limit is updated. No user will ever get to see that until a relevant report is generated or they get close enough to the limits to trigger an alert.

The phrase, "Can you give me an example?" is still a really easy way to get those examples out of people, as well as the natural language in which they express their requirements... for whatever level those requirements are phrased at.


问:
Efficient algorithm for hierarchical traversing? JSON hydration, for example
I'm writing a small library that helps you hydrate JSON data into objects. Given this JSON example:

```<code>{
    "date": "1970-01-01 00:00:00",
    "foobar": "baz",
    "user": {
        "name": "foobar",
        "id": 2
    }
}
</code>```

And the following library ruleset:

```<code>Hydrator hydrator = new Hydrator
hydrator.add("date", DateTime)
hydrator.add("foobar", String)
User user = hydrator.add("user", User)
user.add("name", String)
user.add("type", Integer)

DataSet data = hydrator.parse(jsonInput)
</code>```

So far, it's working great. I have created a Node, and each Node can have children. I just walk through the entire JSON file, create Node instances for each key/value, and create the hierarchy. When i instance the node, i add some metadata. Then, in a big method, i walk through the entire node tree and hydrate depending on the metadata. However, i'm looking for an efficient way of doing this, since it ended up being a little slow.

答:
A fairly-standard post-order depth-first traversal should work nicely, in linear time on the number of nodes.  The main trick is traversing your hydrator tree and data tree together.  Post-order means all the dependencies will be instantiated before they're needed higher up.  In pseudocode, it would look something like this:</p>

```<code>traverse(hydrator_node, json_node)
  for each child of hydrator node
    throw error if json_node doesn't have matching child
    recursively call traverse(hydrator_child, json_child)

  instantiate current node
</code>```

Body:
A fairly-standard post-order depth-first traversal should work nicely, in linear time on the number of nodes.  The main trick is traversing your hydrator tree and data tree together.  Post-order means all the dependencies will be instantiated before they're needed higher up.  In pseudocode, it would look something like this:

traverse(hydrator_node, json_node)
  for each child of hydrator node
    throw error if json_node doesn't have matching child
    recursively call traverse(hydrator_child, json_child)

  instantiate current node


问:
Optional features: default method or separated interface
Dedicated interfaces seems to be a good way to expose the optional features in a domain-specific type hierarchy. However, they impede the use of decorator and composite patterns, which is also common in this kind of hierarchy.

Especially, probably no one wants to implement a decorator/composite for each possible combination of these interfaces, so more often than not they implements all optional interfaces and use type checking to selectively forward the calls, which defeats the purpose of having separated interfaces.

An alternative, which the Java Collection framework uses, is to include all operations in the base type and just fill them with dummy implementations. Default methods in Java 8 further facilitates this usage.

In a way, this feels like the nullable columns debate in the database world. Is there any strong argument against the more practical latter approach?

答:
The challenge with the alternative is that it makes adding/changing/removing optional features more difficult. For example, if we add a new optional feature, we now have to change the base class, and then change all of the subclasses to add the feature or the non-feature. This can be somewhat mitigated if there is a reasonable default, such as a no-op, so only the subtypes that support the feature need to override the necessary parts. If these optional features are few, relatively stable, and unlikely to change, just adding them to the supertype could be sufficient. If not, then maintenance can start to get unwieldy.

The most common design pattern for recovering type from supertype is the visitor pattern. This might be tricky in your situation since a single object may implement multiple interfaces, but it could still be doable with some modifications.


答:
If your credentials are going out with your JavaScript, they can't be kept secret.

However, if your credentials are stored on the server, you can keep them secret, by having a server side function use them.

In this way, you can examine the incoming request from JS using your server side function, and determine if it's legitimate. If it is legit, you can pass it through to the rest API using your credentials, and if your, send back an error message.

Title: Securing ajax calls to rest api

Body:
I need for my app to consume a rest api service and since I will call it from javascript/jquery i need to expose it to the end user.

In this case I would also need to expose credentials to the end user, which is something I would like to avoid. As an alternative I am thinking of using a token that would replace sensitive credentials, but what concerns me is how to prevent an end user to reuse or recall rest api service misuse that same token with different params?

Bottom line, how to successfully protect application so only application can consume rest api and not the end user himself?

EDIT

This question raised a couple of doubts so I would like to make myself clear.
For example:
Javascript from my app contains an ajax call that calls a third party api. For example http://domain.com/api/insert-item?user=username&password=password&userid=1000&itemid=55555&itemvalue=10

What stops any user to change query string to userid=2000&itemid=55555&itemvalue=100

What stops any user to get our credentials for third party api and consumes it without permission?


问:
Which statically typed languages support intersection types for function return values?

Initial note:

This question got closed after several edits because I lacked the proper terminology to state accurately what I was looking for. Sam Tobin-Hochstadt then posted a comment which made me recognise exactly what that was: programming languages that support intersection types for function return values.

Now that the question has been re-opened, I've decided to improve it by rewriting it in a (hopefully) more precise manner. Therefore, some answers and comments below might no longer make sense because they refer to previous edits. (Please see the question's edit history in such cases.)

Are there any popular statically & strongly typed programming languages (such as Haskell, generic Java, C#, F#, etc.) that support intersection types for function return values? If so, which, and how?

(If I'm honest, I would really love to see someone demonstrate a way how to express intersection types in a mainstream language such as C# or Java.)

I'll give a quick example of what intersection types might look like, using some pseudocode similar to C#:

```<code>interface IX { … }
interface IY { … }
interface IB { … }

class A : IX, IY { … }
class B : IX, IY, IB { … }

T fn()  where T : IX, IY
{
    return … ? new A()
             : new B();
}
</code>```

That is, the function fn returns an instance of some type T, of which the caller knows only that it implements interfaces IX and IY. (That is, unlike with generics, the caller doesn't get to choose the concrete type of T — the function does. From this I would suppose that T is in fact not a universal type, but an existential type.)

P.S.: I'm aware that one could simply define a interface IXY : IX, IY and change the return type of fn to IXY. However, that is not really the same thing, because often you cannot bolt on an additional interface IXY to a previously defined type A which only implements IX and IY separately.

Footnote: Some resources about intersection types:

Wikipedia article for "Type system" has a subsection about intersection types.

Report by Benjamin C. Pierce (1991), "Programming With Intersection Types, Union Types, and Polymorphism"

David P. Cunningham (2005), "Intersection types in practice", which contains a case study about the Forsythe language, which is mentioned in the Wikipedia article.

A Stack Overflow question, "Union types and intersection types" which got several good answers, among them this one which gives a pseudocode example of intersection types similar to mine above.

答:
Ceylon has full support for first-class union and intersection types.

You write a union type as X | Y and an intersection type as X & Y.

Even better, Ceylon features a lot of sophisticated reasoning about these types, including:

principal instantiations: for example, Consumer<X>&Consumer<Y> is  the same type as Consumer<X|Y> if Consumer is contravariant in X, and

disjointness: for example, Object&Null is the same type as Nothing, the bottom type.


问:
The use of '#'-sign in haskell program text
What do those #-signs mean? For example,

```<code>data Word = W# Word# deriving (Eq, Ord)
</code>```

I tried to google it but I found nothing.

答:
Those are unboxed types, see the corresponding section of the haskell docs

They are mainly used for performance or interop reasons(along with the primitive operations that work on them, for example +#)


问:
Upgrading from XP Pro to Win 7, anything I should worry about?
I do mainly .NET work so I assume that the framework is all fine and that.  But have there been reports of various tools like .NET Reflector and the like not working properly with Win 7?  This is a company-wide thing so there isn't much I can do about it, but once everything is reinstalled I'm hoping to not find anything shocking.

Cheers.

答:
Main issue we've encountered is that you can't run visual studio 2003.

This means a couple of our old legacy apps get debugged on an old XP machine.

There may be ways around this, like using an xp virtual machine, or windows 7 xp mode, but we've yet to need it enough to spend time sorting it out.


问:
Using the optional 'self' reference in instance methods in Swift as a matter of style
Swift allows optional prefixing of method calls and property references to the current object instance via self. Removing these prefixes can declutter code but, depending on the length of the method and number of parameters and local variables, it can also make variable scope ambiguous.

Perhaps the answer is to refactor into smaller classes and methods, but sometimes that isn't always practical. Common examples are things like UIViewController subclasses and custom viewDidLoad() implementations or complex action handlers for UIGestureRecognizer subclasses. I've thought about this a bit since diving into developing an iOS app in Swift but am still on the fence. My ideal answer(s) would touch on:

If not referencing self has an practical downsides.

Whether mixing implicit and explicit references to self is worse that sticking to one or the other (I'm leaning towards yes).

Overall stylistic concerns with a focus on readability.

Instance variable naming styles versus local variable naming styles to mitigate ambiguity.

References to similar issues in other languages.

答: Not using self will make you think twice any time you use a variable. IMHO writing clean code is a matter of style. The style in Objective-C is to use self with properties. Since the vast majority of Swift programmers come from Obj-C, this style should be kept.</p>


答:
Automated test were created for the programmers benefit, programmers
  were not created to serve the tests.

We have tests to make us more productive and to reduce the number of “issues” customers complain about.

So given that you have behaviour oriented unit tests covering all of the cases in each subclass, there is no benefit to the customer of you also testing the base class directly.    This can be confirmed by changing some code in the base class and seeing if a test fails,  e.g. common out a line of code, or adding a “not” to a “if statement”.  (Just checking that every line of code is covered by the tests is not good enough.)

We are then left with asking if the test would make you more productive.  This can happen in a few ways.

Letting you think clearer about the code - as the code is written this is unlikely in this case.

Letting you test some code in the base class in isolation, so debug it quicker, once again unlikely in the case as the code is already working.

Letting you change the code in the base class without having to understand the details of the logic in the subclasses – maybe if you are refactoring the code???

So given that the sub classes are working, I don’t see any point in writing direct tests for the base class.   This is not to day, that there would not have been benefits to writing these tests at a early state.

Title: Is it ok to avoid testing base classes?

Body:
I have a base class with a fair amount of "meta programming" to give it the flexibility/abstraction it needs to be rather generic.

I do have a lot of subclasses using the common methods in the base class, and I have behavior oriented unit tests covering all of the cases in each subclass.

Is it ok to skip testing the base class?


问:
Does low latency code sometimes have to be "ugly"?
(This is mainly aimed at those who have specific knowledge of low latency systems, to avoid people just answering with unsubstantiated opinions).

Do you feel there is a trade-off between writing "nice" object orientated code and writing very fast low latency code? For instance, avoiding virtual functions in C++/the overhead of polymorphism etc- re-writing code which looks nasty, but is very fast etc?

It stands to reason- who cares if it looks ugly (so long as its maintainable)- if you need speed, you need speed?

I would be interested to hear from people who have worked in such areas.

答: You can write ugly code that is very fast and you can also write beautiful code that is as fast as your ugly code. The bottleneck will not be in the beauty/organization/structure of your code but in the techniques you chose. For example, are you using non-blocking sockets? Are you using single-threaded design? Are you using a lock-free queue for inter-thread communication? Are you producing garbage for the GC? Are you performing any blocking I/O operation in the critical thread? As you can see this has nothing to do with beauty.</p>


问:
Handling exceptions in a loop without breaking the loop (try to process all members)
Scenario:

I have a loop that iterates over an Array of COM objects and does some work using them.

My fear, working with COM objects, is that some exception will creep up (possibly on another user's environment) and cause the loop to break mid-way through processing these objects.

So, let's say (hypothetically) an exception occurs on file 32 of 173.

I see three options:

Show the exception, inform the user that only 32 files were
processed, and we then have to manually do the work on the remaining 141 files.

Undo all the work done on the first 32 files, inform the user the
request couldn't be completed and show the exception. This is less
than ideal because by the time we are at this procedure, a lot of
up-front work has been done (creating files, incrementing serial
numbers, etc.) which would be cumbersome and difficult to undo.  In the end, we end up with all 172 files needing manual work.

Catch the exception, store it in a List, continue to try to
process the rest of the files, then after trying to process all files,  inform the user of any exceptions that occurred and any files which couldn't be processed. Best case we only have one file to manually do work on, and worst
case we are left with 141 files - same as the first option.

Event horizon:

I'm new to programming. In fact I just wrote (am writing) my first add-in which I posted up on SE::Code Review.

Now, I'm of the mindset that option three makes the most sense - let's at least give hope a chance and see what happens with the rest of them, no?

So here's my implementation (well simplified, but this is the pattern):

```<code>Sub Main()
    Dim Exceptions as New List(of Exception)
    Try
        TryThatFunkyCOMthing (Exceptions)

        If Exceptions.Count>0 Then
            For Each ex As Exception in Exceptions
                MessageBox.Show(ex.ToString)
            Next
        End If

    Catch ex As Exception
        MessageBox.Show(ex.ToString)
    End Try
End Sub

Private Sub TryThatFunkyCOMthing (ByRef ExceptionBuffer as List(of Exception))
    For each COMthingy in COMthings
        Try
           COMthingy.DoSomething
        Catch ex As SpecificException
            COMthingy.WeAreBlewedUp
        Catch ex As Exception
            ExceptionBuffer.Add(ex)
        End Try
    Next
End Sub
</code>```

One of the reviewers on CR gave me some feedback saying I should NOT be doing this.  He said I should want the loop to stop if an exception occurs.

He linked to this SO Q&A regarding handling general exceptions, which I read (a few times now) and I think this solution falls under "failing gracefully".  As mentioned above, I'm not trying to swallow exceptions, just control how/when they are handled so that my program behaves in a manner I can predict and depend on, even in the event of a catastrophic or unexpected exception.

What I'd like to know:

If this is bad practice, why?

Out of the three options I provided, which would you choose? - OR - Is there a mysterious and much better fourth option I'm missing?

答:
You could also provide the best of both worlds, and just let the user decide what he prefers.

There are many software that provides through their settings these features:

stop on error

ignore error

an application-level undo

The first two options being mutually exclusive should be presented to the user using radio buttons.

For the undo/redo, a web search brought out the following (untested):

https://muf.codeplex.com/

http://undo.codeplex.com/

https://www.nuget.org/packages?q=undo

Implementing these 3 options shouldn't significantly bloat your method.