答:
What you need is a non-member (static utility or base class) generic helper function for concatenating the NextPage results from different IEnumerable objects.

Once that is done, approximately five lines of code (in each class) can be condensed down to one line. This will clear up the clutter and IMHO no further refactoring is needed.

It would be best if NextPage is an interface method on the response object. Likewise, it would be best if the response object implement IEnumerable<T> for the respective return type T.

If that is not the case, you may consider:

Fix the upstream library or code

Use type dynamic

But this is a very slippery path.

Title: Refactoring three very similar classes using inheritance?

Body:
I'm currently working on refactoring the code-base for one of our services. I'm been going through reviewing everything, and I feel it's a bit scattered, and could probably adhere to OOP principles better.

I have three classes that are all derivative of another class Cache. All three of these classes perform the exact same operations, the only difference is the type of object they are querying for and what method call they use to query them. What would be the best method of making these classes even more simple?

```<code>public static class ZenDeskCache
{
    public static ZendeskApi Api = new ZendeskApi(GlobalVariables.ZendeskUrl, GlobalVariables.ZendeskUser,
        GlobalVariables.ZendeskPass);

    public class Users : Cache<Users, List<User>>
    {
        protected override List<User> GetData()
        {
            var users = Api.Users.GetAllUsers();
            var allUsers = new List<User>(users.Users);

            while (users.NextPage != null)
            {
                users = Api.Users.GetByPageUrl<GroupUserResponse>(users.NextPage);
                allUsers.AddRange(new List<User>(users.Users));
            }

            allUsers = allUsers.OrderBy(n => n.Name).ToList();

            return allUsers;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromDays(1);
        }
    }

    public class Organizations : Cache<Organizations, List<Organization>>
    {
        protected override List<Organization> GetData()
        {
            var organizations = Api.Organizations.GetOrganizations();
            var allOrgs = new List<Organization>(organizations.Organizations);

            while (organizations.NextPage != null)
            {
                organizations = Api.Users.GetByPageUrl<GroupOrganizationResponse>(organizations.NextPage);
                allOrgs.AddRange(new List<Organization>(organizations.Organizations));
            }

            allOrgs = allOrgs.OrderBy(n => n.Name).ToList();

            return allOrgs;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromDays(1);
        }
    }

    public class Groups : Cache<Groups, List<Group>>
    {
        protected override List<Group> GetData()
        {
            var groups = Api.Groups.GetGroups();
            var allGroups = new List<Group>(groups.Groups);

            while (groups.NextPage != null)
            {
                groups = Api.Groups.GetByPageUrl<MultipleGroupResponse>(groups.NextPage);
                allGroups.AddRange(new List<Group>(groups.Groups));
            }

            allGroups = allGroups.OrderBy(n => n.Name).ToList();

            return allGroups;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromSeconds(600);
        }
    }
}
</code>```


问:
Java - Using a Function variable to set the toString() method's return value
Lately I've started adding this to certain classes in an in-house API:

```<code>public class MyClass {

  // I usually do this with classes I expect to
  // be printed out or tested a lot (particularly
  // in the early stages of creating the class/package).
  //
  // Having one field is not a criteria for doing this,
  // just a simple example.  And of course there is always
  // a default value for the toString field.

  private Object oneOtherFieldExample;

  private Function<MyClass, String> toString =
      myClass -> String.valueOf(oneOtherFieldExample);

  ...

  public void setToString(Function<MyClass,String> toStringFunction) {
    toString = toStringFunction;
  }

  public String toString() {
    return toString.apply(this);
  }
</code>```

This has come in handy a couple times but since I'm working on an in-house API I'm wondering

Do you all foresee any potential issues I'm missing?

Is this reasonably legible and intuitive?

Does this or something similar already exist as some kind of pattern (and if so, what is it called)?

Since this is especially used for testing and early building, should I add a static way to set the default toString variable to avoid having to set it manually every time I instantiate a new MyClass Object (in the case where thousands are being created)?

答:
In general, one would expect the toString() method to be deterministic. Invoking it multiple times on the same object without changing any object state should produce the same results. While not a part of the general contract for toString(), many implementations of libraries and frameworks I have worked with expect this.

By using a lambda or other functional approach to "reach in" and change the output you violate that unwritten expectation.

It would be better to use a decorator or a variant on it to alter the behavior.

How this works is your core object remains the same. It always produces the same toString() output.

If you need different output, construct a different object containing the first one as a parameter. Calling toString() on this outer object produces different results.

Consider the following example:

```<code>public interface Widget { ... }

public class MyWidget implements Widget { ... }

public class HtmlWidget implements Widget {
  public HtmlWidget(Widget w) { ... }
}

public class CsvWidget implements Widget {
  public CsvWidget(Widget w) { ... }
}
</code>```

The class MyWidget will truck along as it always has, having a basic toString() implementation. The HtmlWidget and CsvWidget classes wrap another widget. They pass through all of the method calls to the underlying object except for toString(): they output a Widget as (HTML and CSS) or CSV, respectively.

They key benefit here is separation of concerns: each object is responsible for one concern. The Widget does Widget things, the decorator Widgets decorate.

Assuming the underlying data is stable, you can even have multiple threads to-stringing the same object using different decorators at the same time, because the original object is unchanged.

ContentLicense: CC BY-SA 3.0

Body:
In general, one would expect the toString() method to be deterministic. Invoking it multiple times on the same object without changing any object state should produce the same results. While not a part of the general contract for toString(), many implementations of libraries and frameworks I have worked with expect this.

By using a lambda or other functional approach to "reach in" and change the output you violate that unwritten expectation.

It would be better to use a decorator or a variant on it to alter the behavior.

How this works is your core object remains the same. It always produces the same toString() output.

If you need different output, construct a different object containing the first one as a parameter. Calling toString() on this outer object produces different results.

Consider the following example:

public interface Widget { ... }

public class MyWidget implements Widget { ... }

public class HtmlWidget implements Widget {
  public HtmlWidget(Widget w) { ... }
}

public class CsvWidget implements Widget {
  public CsvWidget(Widget w) { ... }
}

The class MyWidget will truck along as it always has, having a basic toString() implementation. The HtmlWidget and CsvWidget classes wrap another widget. They pass through all of the method calls to the underlying object except for toString(): they output a Widget as (HTML and CSS) or CSV, respectively.

They key benefit here is separation of concerns: each object is responsible for one concern. The Widget does Widget things, the decorator Widgets decorate.

Assuming the underlying data is stable, you can even have multiple threads to-stringing the same object using different decorators at the same time, because the original object is unchanged.


问:
Refactoring three very similar classes using inheritance?
I'm currently working on refactoring the code-base for one of our services. I'm been going through reviewing everything, and I feel it's a bit scattered, and could probably adhere to OOP principles better.

I have three classes that are all derivative of another class Cache. All three of these classes perform the exact same operations, the only difference is the type of object they are querying for and what method call they use to query them. What would be the best method of making these classes even more simple?

```<code>public static class ZenDeskCache
{
    public static ZendeskApi Api = new ZendeskApi(GlobalVariables.ZendeskUrl, GlobalVariables.ZendeskUser,
        GlobalVariables.ZendeskPass);

    public class Users : Cache<Users, List<User>>
    {
        protected override List<User> GetData()
        {
            var users = Api.Users.GetAllUsers();
            var allUsers = new List<User>(users.Users);

            while (users.NextPage != null)
            {
                users = Api.Users.GetByPageUrl<GroupUserResponse>(users.NextPage);
                allUsers.AddRange(new List<User>(users.Users));
            }

            allUsers = allUsers.OrderBy(n => n.Name).ToList();

            return allUsers;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromDays(1);
        }
    }

    public class Organizations : Cache<Organizations, List<Organization>>
    {
        protected override List<Organization> GetData()
        {
            var organizations = Api.Organizations.GetOrganizations();
            var allOrgs = new List<Organization>(organizations.Organizations);

            while (organizations.NextPage != null)
            {
                organizations = Api.Users.GetByPageUrl<GroupOrganizationResponse>(organizations.NextPage);
                allOrgs.AddRange(new List<Organization>(organizations.Organizations));
            }

            allOrgs = allOrgs.OrderBy(n => n.Name).ToList();

            return allOrgs;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromDays(1);
        }
    }

    public class Groups : Cache<Groups, List<Group>>
    {
        protected override List<Group> GetData()
        {
            var groups = Api.Groups.GetGroups();
            var allGroups = new List<Group>(groups.Groups);

            while (groups.NextPage != null)
            {
                groups = Api.Groups.GetByPageUrl<MultipleGroupResponse>(groups.NextPage);
                allGroups.AddRange(new List<Group>(groups.Groups));
            }

            allGroups = allGroups.OrderBy(n => n.Name).ToList();

            return allGroups;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromSeconds(600);
        }
    }
}
</code>```

答:
The problem is that the design of the underlying API loves to repeat type information in all property names:

```<code>... Api.Groups.GetGroups();
... groups.Groups ...

    ... Api.Groups.GetByPageUrl<MultipleGroupResponse>(...);
    ... groups.Groups ...
</code>```

This misdesign makes it difficult to abstract over all otherwise identical Api.X objects. In particular, your methods differ in these points:

the Api.X object that methods are called on

the name of the Api.X.GetX() method to get the inital response

the name of the property x.X that accesses the data in one response

the type of the response from GetPageByUrl

The solution is to introduce an appropriate layer that levels away these differences. E.g. you could define a common function CommonGetData that could be invoked like this:[1]

[1]: Please note that I'm not fluent in C#, so only take note of the conceptual design rather than the specifics of syntax.

```<code>protected override List<User> GetData()
{
    return CommonGetData(
        Api.Users,
        (api) => api.GetAllUsers(),
        (response) => response.Users,
    );
}
</code>```

With CommonGetData being defined approximately like this:

```<code>private static <T, ResponseT, ApiT> List<T> CommonGetData(
        ApiT api,
        Function<ResponseT, ApiT> getInitialResponse,
        Function<Collection<T>, ResponseT> itemsFromResponse,
    )
{
    ResponseT response = getInitialResponse(api);
    var allItems = new List<T>(itemsFromResponse(response);

    while (response.NextPage != null)
    {
        response = api.GetPageByUrl<ResponseT>(response.NextPage);
        allItems.AddRange(new List<T>(itemsFromResponse(response));
    }

    allItems = allItems.OrderBy(n => n.Name).ToList();

    return allItems;
}
</code>```

If using lambdas is not your thing, you could also note that this looks remarkably like a candidate for either the Strategy Pattern (in CommonGetData, the callback parameters represent strategies), or for the template method pattern. We could then define an abstract Api like this:

```<code>abstract class CommonApi<T, ResponseT>
{
    protected abstract ResponseT GetInitialResponse();
    protected abstract Collection<T> ItemsFromResponse(ResponseT response);
    protected abstract GetPageByUrl(Url url);

    private List<T> GetData()
    {
        ResponseT response = GetInitialResponse();
        var allItems = new List<T>(ItemsFromResponse(response);

        while (response.NextPage != null)
        {
            response = GetPageByUrl(response.NextPage);
            allItems.AddRange(new List<T>(ItemsFromResponse(response));
        }

        allItems = allItems.OrderBy(n => n.Name).ToList();

        return allItems;
    }
}

class UsersApi : CommonApi<User, MultipleUserResponse>
{
    protected override MultipleUserResponse GetInitialResponse()
    {
        return Api.Users.GetAllUsers();
    }

    protected override Collection<User> ItemsFromResponse(MultipleUserResponse response)
    {
        return response.Users;
    }

    protected override GetPageByUrl(Url url)
    {
        Api.Users.GetPageByUrl<MultipleUserResponse>(url);
    }
}
</code>```

which would be used like

```<code>private UsersApi usersApi = new UsersApi();

protected override List<User> GetData()
{
    return usersApi.GetData();
}
</code>```

Ideally, the existing APIs could be refactored to implement common interfaces, so that wrapping them in common interfaces that delegate to the incompatible methods would not be necessary.

Also note that your very high use of static classes probably gets in the way of code reuse, since it makes it difficult to pass these around as values. If only one instance may exist, prefer the Singleton Pattern which also makes your classes easier to test when compared with static classes.

Body:
The problem is that the design of the underlying API loves to repeat type information in all property names:

... Api.Groups.GetGroups();
... groups.Groups ...

    ... Api.Groups.GetByPageUrl<MultipleGroupResponse>(...);
    ... groups.Groups ...

This misdesign makes it difficult to abstract over all otherwise identical Api.X objects. In particular, your methods differ in these points:

the Api.X object that methods are called on

the name of the Api.X.GetX() method to get the inital response

the name of the property x.X that accesses the data in one response

the type of the response from GetPageByUrl

The solution is to introduce an appropriate layer that levels away these differences. E.g. you could define a common function CommonGetData that could be invoked like this:[1]

[1]: Please note that I'm not fluent in C#, so only take note of the conceptual design rather than the specifics of syntax.

protected override List<User> GetData()
{
    return CommonGetData(
        Api.Users,
        (api) => api.GetAllUsers(),
        (response) => response.Users,
    );
}

With CommonGetData being defined approximately like this:

private static <T, ResponseT, ApiT> List<T> CommonGetData(
        ApiT api,
        Function<ResponseT, ApiT> getInitialResponse,
        Function<Collection<T>, ResponseT> itemsFromResponse,
    )
{
    ResponseT response = getInitialResponse(api);
    var allItems = new List<T>(itemsFromResponse(response);

    while (response.NextPage != null)
    {
        response = api.GetPageByUrl<ResponseT>(response.NextPage);
        allItems.AddRange(new List<T>(itemsFromResponse(response));
    }

    allItems = allItems.OrderBy(n => n.Name).ToList();

    return allItems;
}

If using lambdas is not your thing, you could also note that this looks remarkably like a candidate for either the Strategy Pattern (in CommonGetData, the callback parameters represent strategies), or for the template method pattern. We could then define an abstract Api like this:

abstract class CommonApi<T, ResponseT>
{
    protected abstract ResponseT GetInitialResponse();
    protected abstract Collection<T> ItemsFromResponse(ResponseT response);
    protected abstract GetPageByUrl(Url url);

    private List<T> GetData()
    {
        ResponseT response = GetInitialResponse();
        var allItems = new List<T>(ItemsFromResponse(response);

        while (response.NextPage != null)
        {
            response = GetPageByUrl(response.NextPage);
            allItems.AddRange(new List<T>(ItemsFromResponse(response));
        }

        allItems = allItems.OrderBy(n => n.Name).ToList();

        return allItems;
    }
}

class UsersApi : CommonApi<User, MultipleUserResponse>
{
    protected override MultipleUserResponse GetInitialResponse()
    {
        return Api.Users.GetAllUsers();
    }

    protected override Collection<User> ItemsFromResponse(MultipleUserResponse response)
    {
        return response.Users;
    }

    protected override GetPageByUrl(Url url)
    {
        Api.Users.GetPageByUrl<MultipleUserResponse>(url);
    }
}

which would be used like

private UsersApi usersApi = new UsersApi();

protected override List<User> GetData()
{
    return usersApi.GetData();
}

Ideally, the existing APIs could be refactored to implement common interfaces, so that wrapping them in common interfaces that delegate to the incompatible methods would not be necessary.

Also note that your very high use of static classes probably gets in the way of code reuse, since it makes it difficult to pass these around as values. If only one instance may exist, prefer the Singleton Pattern which also makes your classes easier to test when compared with static classes.


问:
Issues deciding on approach to create object
I'm trying to decide what's the best approach to instantiate a particular class. Basically there are two use cases for it: instantiate it in order to save a new entry to the database and fetch an existing entry from the database (and maybe edit the fetched entry and save it back to the database).

The issue I'm having right now is that I can't decide which mechanism for instantiating that class and populating its fields to choose. Say I have this class

```<code>public class Student
{
    public int Id { get; set; }
    public string FirstName { get; set; }
    public string LastName { get; set; }
    public Address Address { get; set; }
}
</code>```

And here are the usecases. If you want to fetch a student for the database, the code looks something like:

```<code>Student student = MyLibrary.GetStudent(id);
</code>```

And if you want to create a new student and add it to the database:

```<code>Student student = new Student();
student.FirstName = "James";
student.LastName = "Jackson";
// etc
MyLibrary.CreateStudent(student);
</code>```

The massive issue with this approach is that all the setters are public and I absolutely do not want this. But at the same time I want the user to be able to populate most of the Student fields freely (maybe with the exception of Id.

I'm thinking the builder pattern could be employed in here. This way I can keep the setters private and force the user to create read-only students via the builders. However it then becomes really awkward if the user wants to update a field and save it to the database:

```<code>var student = MyLibrary.GetStudent(id);
var newStudent = new Student.Builder(id).FirstName("NewFirstName").LastName(student.LastName)...etc...Build();
MyLibrary.CreateStudent(newStudent);
</code>```

Basically my only issue with the builder approach is that the code can get quite awkward and tedious if you want to update an existing entry. Some of the classes I have can have around 10 fields and it's not great having to copy 9 of the fields and update one. But it may be much nicer than having a class with public setters.

What other options do I have?

答:
As far as I can see, your Student is a composite struct of related fields.

From my preliminary experience with these, I highly recommend trying to make these fully immutable, which is also what you seem to have in mind(?)

As for your concern wrt. Builder Pattern:

Some of the classes I have can have around 10 fields and it's not
  great having to copy 9 of the fields and update one.

You have to give your builder a ctor that takes a Student, then the Builder can copy an existing Student and you can change only the update fields.


问:
Do TODO comments make sense?
I am working on a fairly big project and got the task to do some translations for it. There were tons of labels that haven't been translated and while I was digging through the code I found this little piece of code

```<code>//TODO translations
</code>```

This made me think about the sense of these comments to yourself (and others?) because I got the feeling that most developers after they get a certain piece of code done and it does what it's supposed to do they never look at this until they have to maintain it or add new functionality. So that this TODO will be lost for a long time.

Does it make sense to write this comments or should they be written on a whiteboard/paper/something else where they remain in the focus of developers?

答:
In my experience, TODO should be used to indicate that a piece of code is not usable and tells the reader what's needed to make it usable (either locally or elsewhere).

TODO annotations should not be used to indicate that some piece of code would be nicer if modified in some way. Examples include dirty code that would be more maintainable if rewritten or an extra feature that nobody needs yet. Those annotations tend pile up and make a grep TODO return useless results.

Title: Do TODO comments make sense?


问:
What is the supposed productivity gain of dynamic typing?
I often heard the claim that dynamically typed languages are more productive than statically typed languages. What are the reasons for this claim? Isn't it just tooling with modern concepts like convention over configuration, the use of functional programming, advanced programming models and use of consistent abstractions - all of which could be used in statically typed languages as well? Admittedly there is less clutter because the (for instance in Java) often redundant type declarations are not needed, but you can also omit most type declarations in statically typed languages that use type inference, without losing the other advantages of static typing. And all of this is available for modern statically typed languages like Scala as well.

So: what is there to say for productivity with dynamic typing that really is an advantage of the type model itself?

Clarification: I'm more interested in big / medium sized projects than in quick hacks. :-)

答:
Q: I often heard the claim that dynamically typed languages are more productive than statically typed languages. What are the reasons for this claim?"

This has historical reasons. If you go back a few decades, dynamic languages were indisputably vastly more productive than static languages (while also significantly slower). Perl is clearly much more productive than C if you know both and the task at hand allows either. But over time languages have borrowed a lot from each other, and newer languages are narrowing the gap (both in productivity and performance).

Here are some points to consider:

Garbage collection: Garbage collection is a huge productivity boost. I believe Java was the first mainstream static language with GC. Before this, static basically meant manual memory management. (Note: Here and in the following I'm only considering mainstream languages. Lots of experimental and niche languages exists which will provide counterexamples to any point I make.)

Memory safety: It is a productivity improvement that you don't have to worry about shooting yourself in the foot. Before "managed" static languages like Java, static typically meant direct memory access. Debugging is also a part of productivity, and unsafe memory access can lead to really obscure bugs.

Cumbersome type systems. Before the introduction of parameterized types (like templates or generics) in static languages, the limitations of the static types systems were often a burden. For example in Java you had to explicitly downcast every time you picked an item from a collection. So you got the syntactic overhead of a cast and no type safety. Considering how ubiquitous collections are in programming, this was a major drawback.

Having to declare the type of everything is a lot of redundant typing, but with modern type inference, this can be reduced significantly.

Big standard library. Python was famously advertised as "batteries included" because of the large standard library. This in comparison with C which have a very minimalist standard library. But with platforms like Java and .net, a vast standard library is becoming standard, and newer languages like Scala and F# are inheriting this "for free".

First class data structures. Dynamic languages like Perl and Python have built-in first-class data structures like lists and maps with convenient syntactic shortcuts for common operations. Compared to this, C have no built-in collections except fixed-size arrays.

Closures and lambda syntax - dynamic languages typically have had this from the beginning, but static languages have adopted this, most recently Java.

REPL the ability to quickly test code snippets interactively is a huge boon. But though IDE tools, like the "immediate" window in Visual Studio, static languages can emulated this to some extent.

Advanced tooling - in addition to the above points where static languages are getting closer to the convenience of dynamic languages, modern editors are taking advantage of static analysis in a way that dynamic languages have a hard time matching. For example editors can provide safe automatic refactorings, something that is strictly speaking impossible in a dynamic language.

Bottom line: Historically it was true, but today the answer is less clear cut.

Q: So: what is there to say for productivity with dynamic typing that really is an advantage of the type model itself?

It is somewhat hard to separate the dynamic typing model from dynamic languages, but as an example C# have adopted more an more dynamic features over time, even though it as its core is a static language. This is really a proof of benefit of the dynamic type model. Examples:

Reflection
Reflection is fundamentally a dynamic typing feature. You inspect object types at runtime rater than compile time. When it was introduced it was kind of frowned upon, but in C# the use of reflection gets more and more ubiquitous, for example ASP.Net MVC uses reflection heavily.

Attributes
Attributes are an example of dynamic typing. You can add arbitrary attributes to a class at compile time, and then you inspect at runtime (through reflection) and manipulate objects based on it. Something like MEP is basically an extension framework based on a dynamic type model.

Linq to SQL, EF mv.
The various Linq transformers inspect queries as runtime objects and generate sql on the fly. It doesn't get more dynamic than inspecting code at runtime. CodeDom is the other side of the coin, where code can be generated at runtime

Roslyn
Roslyn basically implements eval, which was once considered the defining feature of a truly dynamic language.

Dynamic
The dynamic-type is the most explicitly dynamic feature in C#, and is advertised at making interaction with external objects and languages simpler and more productive. But it is also used in Asp.net MVC for convenience.

The benefit of all the above features shows that the dynamic model have definite advantages even in a static language with parameterized types, structural types and type inference.

ContentLicense: CC BY-SA 4.0


问:
What is a good security practice for storing a critical database on developer's laptops?
We have a few givens:

Developers need a replica of the production database on their machines.

Developers have the password to said database in the App.config files.

We don't want the data in said database compromised.

A few suggested solutions and their drawbacks:

Full-disk-encryption. This solves all problems, but degrades the laptop's performance, and we are a start-up, so don't have money for powerhorses.

Creating a VM with encrypted hard disk, and store the database on it. It works well, but it doesn't help too much, since there's a password in Web.Config.

Solution number 2 + requiring the developer to type the database password every time he runs anything. It solves all problems, but it is really cumbersome for developers that sometimes fire up the application multiple times a minute. Also, we have multiple applications that connect to the same database, and implementation of a password screen will have to differ in each.

So, my question is, if there's any common solution to such problem, or any suggestions on how to make any of the above solutions workable?

答: Can you at least give the developers VMs in your datacenter that they can RD into for this work?  While they really should be working off of non-production data, this would be safer until you can get there since the data wouldn't be stored on easily stolen laptops.</p>


问:
What is better to design or discover interface
Let's say you have some issue to develop. And as recommended practice it is good idea to use interfaces ( I don't mean GUI, I mean interface or abstract class ). And you can apply two ( I'm pretty sure, but for now I noticed I apply two ) ways:

Design interfaces upfront and then implement them.

Implement classes and then on basics of classes discover interface.

Personally I prefer second option, but during discussions with other developers I noticed that somebody prefers first approach. I can say that I prefer second approach for the following reasons:

I can faster write code
I avoid unnesessary code ( something that I never will use )
Interfaces in that case are more binded to "real" life
For me it is more convenient. I'd like to hear other advices why somebody prefers option 1 or option 2. As usually I code in C#, but AFAIK java also have idea of interfaces

There is also third way:

Design interfaces upfront, then write implementing classes, then finally discover all of your interfaces were wrong in the first place.

答:
Your question is tantamount to saying "I know I need a plan, but I also know the plan will change, so it's better to not have a plan at all."

There's no question that, during the software development process, you discover things that have to be changed to make them work.  We all deal with that.  But that's what refactoring is for, what design reviews are for, what code reviews are for, what acceptance tests are for.  If we were all perfect human beings, we could design the interfaces once and never have to change them.  But we're not perfect human beings.  That doesn't mean you throw out the design process entirely, and having proper interfaces is an important step in the architectural design process.

One way that you can discover how your API is supposed to look is by practicing Test-Driven Development.  Writing your tests first will force you to think about how the interfaces need to look, and you will eventually get highly testable, well-architected code implementations as a primary benefit.  You still have to perform the design work, though; a proper architecture does not naturally emerge from simply writing tests and making them pass.


问:
Integrate NuGet Package Restore feature into checkout process
There are some situations where I have no internet connection and so I am forced to work offline. Usually it would look like this: I get connected, do a checkout from source control server, and move out of office.
The NuGet packages stay on the server, because I have enabled Package Restore and should have opened Visual Studio and fired a build at least once, to download them.

Before using NuGet we had the package management integrated using SVN externals. The required assemblies were automatically downloaded during checkout. But this system has some limitations, I'd like to get rid off.

The prefered way to use Package Restore would be to execute it on checkout or update.
Is there a way doing so, using hooks for SVN (TortoiseSVN) or GIT (TortoiseGIT, Github for Windows) as version control system?

答:
The following is not a direct answer to your question, but might solve the issue that led to the question.

We have a single directory in source control where we put all the .nupkg used by our projects. (Being a relatively small team, this directory is not too cluttered.)

We link this directory in source control to project directories, in your case this would be a SVN external.

Additionally, we put a Nuget.Config file in the same directory as the .sln file where we add the checked-out directory with the packages as package source:

```<code><!-- ... -->
<packageSources>
  <add key="LocalPackages" value="relative/path/to/checked/out/directory" />
  <!-- ... -->
</code>```

To make sure package restore will always use this directory, one can add

```<code><activePackageSource>
  <add key="LocalPackages" value="relative/path/to/checked/out/directory" />
</activePackageSource>
</code>```

but this has the drawback that searching/installing new packages from nuget.org from within a project using such a NuGet.Config requires some more clicks.

As a result, checking out a project will check out all required NuGet packages (and some more, what could be a con), and NuGet/Visual Studio will happily restore them without a network connection.

Body:
The following is not a direct answer to your question, but might solve the issue that led to the question.

We have a single directory in source control where we put all the .nupkg used by our projects. (Being a relatively small team, this directory is not too cluttered.)

We link this directory in source control to project directories, in your case this would be a SVN external.

Additionally, we put a Nuget.Config file in the same directory as the .sln file where we add the checked-out directory with the packages as package source:

<!-- ... -->
<packageSources>
  <add key="LocalPackages" value="relative/path/to/checked/out/directory" />
  <!-- ... -->

To make sure package restore will always use this directory, one can add

<activePackageSource>
  <add key="LocalPackages" value="relative/path/to/checked/out/directory" />
</activePackageSource>

but this has the drawback that searching/installing new packages from nuget.org from within a project using such a NuGet.Config requires some more clicks.

As a result, checking out a project will check out all required NuGet packages (and some more, what could be a con), and NuGet/Visual Studio will happily restore them without a network connection.


问:
Can a business application be developed / enhanced with more than one language?
Please excuse my lack of knowledge in programming, but it is true that a business application, e.g. CRM, can be developed using one language (e.g., C++) and later enhanced using a different language (e.g., C#.NET)?

Can we use multiple languages when developing an application?

答: All .NET frameworks permit you to merge different languages when they are built using separate in code modules… Depending on which library you include in the framework (.net framework) fuji  some third party product (language) permit you to do this…  Using good configuration. </p>


答:
My straight forward answer would be: for sure.

I don't know exactly from where your concerns come, but if you think about web software development, you are in a place with potentially a bunch of languages working together.

There are many ways to think about your question, but it's very common (and sometimes desired) to use the "right language for the right problem". So it's perfectly normal to have an business application built on top of various minor parts, many times in various languages.

Title: Can a business application be developed / enhanced with more than one language?

Body:
Please excuse my lack of knowledge in programming, but it is true that a business application, e.g. CRM, can be developed using one language (e.g., C++) and later enhanced using a different language (e.g., C#.NET)?

Can we use multiple languages when developing an application?


问:
Where to describe architectural problems?
I joined the middle of a middle size project, which runs already for several years. One of problems is that the document describing the architecture was never written. Now I was assigned a task to write the architecture description.

During the time I working on this project, I gathered all information I needed to write the document. Since I also added some features, I identified some pieces of code, which are clearly breaking the architecture as it is described.

For example, the GUI was supposed to be a thin layer, without business logic. That is what I was told. The implementation contains lots of logic.

My boss assigned me the task, to write the document describing the architecture of the system. The target audience are current and future developers working on the project. I need to describe what should be, but I also need to describe the deviations somehow.

So, where should I describe these problems? Bugs tracking software? Or should I describe implementation's deviations from the architecture in the document describing the architecture of the system?

答:
You really do need to decide whether you're supposed to be documenting the current structure of the project, or the desired structure of the project, or both.

You could document the goal, for the purpose of guiding future development along the desired lines, and raise the deviations as bugs (perhaps link to these bugs from the relevant parts of the document). Or you could document the reality in order to provide an introduction/overview to the code. Or you could document both side-by-side, so that you simultaneously have a guide for future development and an accurate description of the current code in one place. All are reasonable depending what the document is supposed to be for, so I don't think we can usefully tell you which one to do.

You should also bear in mind that the desired architecture might not be universally agreed among those involved (either because they want different things, or because some of them have realised that some original shared desires were impossible or impractical and therefore resorted to writing the existing code that deviates from the goal). So you also need to know whether or not you have authority to decide what's desired, and if not who does. The existing structure does at least have the virtue that there's only one of it to document!


答: Lots of iOS applications started out as Objective-C or possibly a mix of Objective-C and C++, and now get enhanced using Swift. So it's quite possible and not at all uncommon in a single application. </p>


答:
It's extremely common to work on a project with multiple programming languages. A very typical example is combine C++ with a more front-end friendly programming language.

For example, it'd be awful to code the front-end for a web application with C++. JavaScript would be a better langugage. While the computation algorithm can also be done in JavaScript, C++ offers better performance power and flexibilty.


问:
Do I need any special approval to operate my own MLS or IDX system?
I'm currently building a enterprise MLS / IDX system and I'm just wondering if there is any type of special considerations to be taken outside of outputting the data in the forms that external web services want to use/consume etc.

I'm wondering if I need to register the system or have it approved by anything?  Right now planned integration will integrate with a number of system.  These systems ask for a MLS number often.

Right now we have a Listing ID in our system as well as a UID for our records.  Is there some sort of global listing ID service or does my specific MLS software system supply our listing ID's and UID's for these data requirements?

If you would like to know more about MLS or IDX I've included a couple links:

https://en.wikipedia.org/wiki/Internet_Data_Exchange

https://en.wikipedia.org/wiki/Multiple_listing_service

My main concern is integrating with these external services and ensuring the data we are providing is accurate to the MLS / IDX ecosystem.

答:
Yes, real estate boards have strict requirements if you are to be given access to the MLS data. If you already have access, that means you had to sign a contract which should clearly outline these requirements.

For example, the Canadian Real Estate Agency (CREA) requires some of the following:

You cannot allow consumers to write comments or reviews about a particular listing or display a link to such comments or reviews.

You must monitor your websites for signs of "scraping," which is the use of a software program or other method to extract Listing Content, such as photographs and/or text from a website

You must implement web traffic monitoring and recording code which allows CREA to collect traffic information.

You must display trademark information on every page, such as: "The trademarks MLS®, REALTOR®, and the associated logos are owned or controlled by The Canadian Real Estate Association. Used under license."

There are many more rules, which will be unique to whatever real estate board you're getting your MLS data from.


答:
Write in the architecture design document what was supposed to be, and for each conflict you find open a ticket in the bug tracker describing the conflict. The ticket's comments section will offer a platform for the relevant people to discuss that particular conflict.

Note that the resolution of each of these tickets can be to change the implementation to match the design - but it can also be to change the design to match the implementation. Ideally the former is preferred, but sometimes there are technical and/or business constraints that makes it more efficient/pragmatic/possible to choose the later. In that case, it might be a good idea to refer to the ticket from the architecture design document, so that future readers who don't understand why that particular inferior design choice was chosen can read the discussion in the ticket and understand the reasoning behind it.

Title: Where to describe architectural problems?

Body:
I joined the middle of a middle size project, which runs already for several years. One of problems is that the document describing the architecture was never written. Now I was assigned a task to write the architecture description.

During the time I working on this project, I gathered all information I needed to write the document. Since I also added some features, I identified some pieces of code, which are clearly breaking the architecture as it is described.

For example, the GUI was supposed to be a thin layer, without business logic. That is what I was told. The implementation contains lots of logic.

My boss assigned me the task, to write the document describing the architecture of the system. The target audience are current and future developers working on the project. I need to describe what should be, but I also need to describe the deviations somehow.

So, where should I describe these problems? Bugs tracking software? Or should I describe implementation's deviations from the architecture in the document describing the architecture of the system?


答:
Of course it can. Many languages actually encourage this. It goes well beyond C++/C#. There are actually fairly good examples such as the Qt Clases for Python/Java whic use C, Spark/Hadoop when used with PySpark, and the interoperability of Scala and Java. Python itself is practically a living example of this interchange with CPython now used for the standard flavor and Jython (which interacts with Java). In the case of Java, the JNI actually makes it fairly simple to access C/C++ code. The C# equivalent would be the invoke command. There are some things to keep in mind though.

Don't destroy the understandability or performance of a program because you simply understand something else more easily because, chances are, you will not be the only one who needs to be involved on the project.

Is the addition logical. Does it add functionality beyond being just
easier to program. If the code is just going to require more skill to
read and change, then there is an issue. If there is a performance
upgrade, then it is useful.

Can the main language be used to run the code. If so, it would be
easier to understand and use. The JNI is an example of how to run C
code in Java.

Are there similar tools with APIs that can ease your programming that
are written in the native langauge or use the target language. This
always makes things easier to understand and the right tool is often
better maintained for that purpose.


问:
Does Python have any features which can be used for encapsulating private data?
Usually in OOP world we are told that modularity is a good practice and keeping loose coupling between module is a great thing. Encapsulation helps us achieve this loose coupling.

In Java encapsulation is achieved via access modifiers, in Ruby we have stricter rules via attr_accessor.

But what about Python? I see that I can't hide my fields or methods except using tricks like __ in front of names. Is this the correct / only way to achieve encapsulation in Python?

答:
You can use @property annotations to implement getters and setters à la Java or Ruby. These provide some form of encapsulation while still allowing users of your class to access attributes in a Pythonic way.

Say you have a class with a public-facing name attribute, but names needed to be under a certain length.

```<code>class Foo(object):

    def __init__(self, name: str):
        if len(name) <= 3:
            self.name = name
        else:
            raise TypeError
</code>```

In this case, the name value length is checked at instantiation but not thereafter; you could use a _name attribute and ugly get_name() and set_name() methods, but by using @property annotations as below, you can do validity checking for the attribute whenever it's set while still letting it be accessed in the conventional Python way, i.e. by means of expressions like foo.name and foo.name = 'xyz'.

```<code>class Foo(object):

    def __init__(self, name: str):
        self.name = name

    @property
    def name(self):
        return self._name

    @name.setter
    def name(self, new_name: str):
        if len(new_name) <= 3:
            self._name = new_name
        else:
            raise TypeError
</code>```

As Idan mentioned, _-prefixing of private methods/attributes is just a (strongly followed) convention and a user could still mangle the attribute value if they really wanted to, e.g. by foo._name = 'abcdef'.

Body:
You can use @property annotations to implement getters and setters à la Java or Ruby. These provide some form of encapsulation while still allowing users of your class to access attributes in a Pythonic way.

Say you have a class with a public-facing name attribute, but names needed to be under a certain length.

class Foo(object):

    def __init__(self, name: str):
        if len(name) <= 3:
            self.name = name
        else:
            raise TypeError

In this case, the name value length is checked at instantiation but not thereafter; you could use a _name attribute and ugly get_name() and set_name() methods, but by using @property annotations as below, you can do validity checking for the attribute whenever it's set while still letting it be accessed in the conventional Python way, i.e. by means of expressions like foo.name and foo.name = 'xyz'.

class Foo(object):

    def __init__(self, name: str):
        self.name = name

    @property
    def name(self):
        return self._name

    @name.setter
    def name(self, new_name: str):
        if len(new_name) <= 3:
            self._name = new_name
        else:
            raise TypeError

As Idan mentioned, _-prefixing of private methods/attributes is just a (strongly followed) convention and a user could still mangle the attribute value if they really wanted to, e.g. by foo._name = 'abcdef'.


问:
Use of project-specific values with enum defined in class library
We have an enum in a class library:

```<code>Public Enum FieldType
    Phone
    Span
    Gender
    DrawPath
    ....
End Enum
</code>```

which we use with an attribute applied to properties, for multiple scenarios: HTML/CSV rendering, onscreen display formatting among them.

Multiple projects use this class library, and we want to use project-specific values with this enum. The class library could have extension points (e.g. Public Shared FieldTypeAsHtml As Func(Of FieldType,String)) which specific projects could override.

Each project could have its own additional enums or constants, and the conversions would be automatic (at least in VB.NET which is what we are using; C# would require explicit conversions).

Aside from the obvious -- the intention of this enum is to be "open" and not limited to a specified set of values, therefore no compile-time safety on a given value -- is this a valid design? Are there any downsides? Since there are no partial enums in .NET, what other alternatives might be better, and why?

答:
You could use the "Smart Enum" pattern. It is intended to be extended and typesafe. Although I have C# posts about it, but I think it would be helpful anyway. See:

Introducing the Type-Safe Enum Pattern

Jon Skeet's warning of misusings

Smart Enums

Generic Approach


问:
Declarative parser for JSON and DOM
I am parsing many JSONs and DOMs in PHP. The problem is that the my knowledge about the structure of the JSON/DOM is mixed with code. For example, suppose that I have few sources of first and last names. Each data source can look different and have its own tricks, for example:

```<code>[
  {"firstname": "FirstName1", "lastname": "LastName1"},
  {"firstname": "FirstName2", "lastname": "LastName2"}
]
</code>```

```<code>{
  "firstnames": ["FirstName1", "FirstName2"],
  "lastnames": ["LastName1", "LastName2"]
}
</code>```

```<code>{
  "firstnames":
  [
    {"firstname": "FirstName1", "id": 1},
    {"firstname": "FirstName2", "id": 2}
  ],
  "lastnames":
  [
    {"lastname": "LastName2", "id": 2},
    {"lastname": "LastName1", "id": 1}
  ]
}
</code>```

So for each data source I write code that turns the JSON into my objects. If the JSON is very complex then the code also is very complex and it is impossible to see the JSON structure in my code. Looking for bugs is very hard.

I want to solve the problem in declarative way, something like a JSON regex where I can tell "first names are in 'firstnames', second names are in 'secondnames', and they are linked by 'id'".

How can I achieve that? Does JSON have some kind of declarative transformation language (like XSLT/XPath for XML)? Are there any strategies or patterns that can be used to make this JSON → Model transformation more declarative?

答:
So, you are trying to invent a DSL to navigate JSON, right? Something like XML's XPath.

Well, what JSON document represents is actually a tree or a multidimensional multidimensional multi... well, you got me... array / list (PHP arrays are lists also).

So, the very simple JSON DSL parser may look like this:

Convert input JSON into array / list.

Take DSL like "firstnames.innerfolder.0" and parse it the following way:

Split by .

Foreach part of the DSL try to dive into array element with the given name

When you reach the end of DSL, that will be the target element, containing what you've found.

Title: Declarative parser for JSON and DOM


答:
Change your way of working if possible.

As others have pointed out:

Using production data for development is not good practice.

Having a password stored in plain text is not good practice.

Both of these expose you to significant risk and should be changed if possible.  You should at least seriously assess what the cost of making these changes would be.  If this is an external dependency that you don't have power to change, consider raising this as a concern to whoever does have that power.

In the real world, though, it may really not be possible to change this.  Assuming that what you are doing is legal, you may have to live with this arrangement (at least temporarily).

If this is really necessary, you just need to do full-disk encryption.

Given the risks, you need to use the best-available security option, and this is it.  If there is a performance hit, live with it.  It is a cost of working with sensitive data.

If I were your customer, I would not be impressed that you decided not to use the best available security option with  my data, because it made your laptops slightly slower.

Title: What is a good security practice for storing a critical database on developer's laptops?

Body:
We have a few givens:

Developers need a replica of the production database on their machines.

Developers have the password to said database in the App.config files.

We don't want the data in said database compromised.

A few suggested solutions and their drawbacks:

Full-disk-encryption. This solves all problems, but degrades the laptop's performance, and we are a start-up, so don't have money for powerhorses.

Creating a VM with encrypted hard disk, and store the database on it. It works well, but it doesn't help too much, since there's a password in Web.Config.

Solution number 2 + requiring the developer to type the database password every time he runs anything. It solves all problems, but it is really cumbersome for developers that sometimes fire up the application multiple times a minute. Also, we have multiple applications that connect to the same database, and implementation of a password screen will have to differ in each.

So, my question is, if there's any common solution to such problem, or any suggestions on how to make any of the above solutions workable?


问:
Why do you need "self." in Python to refer to instance variables?
I have been programming into a number of languages like Java, Ruby, Haskell and Python. I have to switch between many languages per day due to different projects I work on. Now, the issue is I often forget to write self as the first parameter in the function definitions in Python same is with calling methods on the same object.

That said, I am quite amazed by this approach of Python. Basically we have to type more to get the things done, in the languages like Java and Ruby things are made simple by automatically referencing the variables in the current object.

My question is why is this self necessary? Is it purely a style choice, or is there a reason why Python can't let you omit self the way Java and C++ let you omit this?

答:
1) Why is self required as an explicit parameter in method signatures?

Because methods are functions and foo.bar(baz) is just syntactic sugar for bar(foo, baz). Classes are just dictionaries where some of the values are functions. (Constructors are also just functions, which is why Python doesn't need new) You can say that Python makes it explicit that objects are built from simpler components. This is in accordance with the "explicit is better than implicit"-philosophy.

In contrast, in Java objects really are magic and cannot be reduced to simpler components in the language. In Java (at least until Java 8) a function is always a method owned by an object, and this ownership cannot be changed due to the static nature of the language. Therefore there is no ambiguity about what this refers to, so it makes sense to have it implicitly defined.

JavaScript is an example of a language that has an implicit this like Java, but where functions can exist separately from objects like in Python. This leads to a lot of confusion about what this refers to when functions are passed around and called in different contexts. Many instinctively think this must refer to some intrinsic property of the function, while it is actually purely determined by the way the function is called. I believe having this as an explicit parameter like in Python would make this much less confusing.

Some other benefits of the explicit self-parameter:

Decorators are just functions which wraps other functions. Since methods are just functions, decorators works just as fine on methods. If there were some kind of implicit self, decorators would not work transparently on methods.

Classmethods and static methods does not take an instance parameter. Classmethods take a class as the first argument (typically called cls). The explicit self or cls parameters makes it much clearer what is going on, and what you have access to in the method.

2) Why must instances variables always be qualified with"self.?

In Java, you don't need to prefix member variables with "this.", but in Python "self." is always required. The reason is that Python does not have an explicit syntax for declaring variables, so there would be no way to tell if x = 7 is supposed to declare a new local variable or assign to a member variable. Specifying self. solves this ambiguity.


问:
Are there CPUs that perform this possible L1 cache write optimization?
When the CPU with an L1 cache does a write, what normally happens is that (assuming that the cache line that it is writing to is already in the L1 cache) the cache (in addition to updating the data) marks that cache line as dirty, and will write the line out with the updated data at some later time.

One possible optimization would be to have the cache compare the contents of the write and the previous contents of the cache, and if they're the same, don't mark the line as dirty.  Because this might allow the cache to avoid write-backs on occasion, I can see how the CPU manufacturer might see this as worth the gates needed to do this logic.

My question: are there CPUs that perform this optimization?

Background as to why I'm asking: I'm writing some code that needs to have constant memory accesses; that is, someone who is able to listen into the behavior of the cache should not be able to deduce what I'm doing.  Some of my accesses are writes, and in the obvious way to implement this code, a lot of the writes will be writing the same data that's already there. I need to do the writes because, depending on the data, the data I'm writing may or may not be the same, and it's important to perform the same action regardless.  If the CPU optimizes by not actually writing a 'no-change-write', that would mean that the behavior of the cache would vary depending on what I'm doing, which would subvert my goal.

So, is there a CPU that tries to optimize writes in this way?

答:
One possible optimization would be to have the cache compare the
  contents of the write and the previous contents of the cache, and if
  they're the same, don't mark the line as dirty

Won't such optimization double the time CPU needs to write something into cache? Because each cache line write will now be accompanied with a compare operation, which is not free.

So, actually the optimization now will depend on the very vague factor: how many times an average software rewrites its cacheable memory with the same data.


问:
Why do you reduce multiple inheritance to the diamond problem?
Whenever I read something like this:

Many programmers exhibit a slight, involuntary shudder whenever
  multiple inheritance is mentioned. Ask them to identify the source of
  their unease and they will almost certainly finger the so-called
  Deadly Diamond of Death inheritance pattern. In this pattern, classes
  B and C both inherit from class A, while class D inherits from both B
  and C. If B and C both override some method from A, there is
  uncertainty as to which implementation D should inherit.

I cannot come back and not to ask: why do you reduce multiple inheritance problem to the Diamond problem? Do you understand that problem is the name conflict that stems from convergence of classes, rather than their reconvergence (diamond)? You do not need the common root A class/interface for the naming conflict to happen, as the diagram shows

It is MI which enables the class convergence and, thus, naming conflicts, which are the problem we are talking about. Why do you pff like it is not the case and keep calling it a diamond problem rather than MI problem?

答:
You're partially right: the problem exists in the case of the multiple inheritance too, but can easily be solved in some languages; diamond, on the other hand, cannot be solved that easily.

In C#, multiple inheritance is forbidden, but a class can implement multiple interfaces. Imagine that the class Example implements IModifiable and ITransformable. Those two interfaces have both a method Transform(string) : string. How would you implement this?

public class Example
{
    public string IModifiable.Transform(string value);
    public string ITransformable.Transform(string value);
}
```

<p>This means there is no ambiguity. You have not one, but two methods with clearly distinct signatures.</p>

<p>Now, imagine the diamond case:</p>

<pre class="lang-cs prettyprint-override"><code>public abstract class Parent
{
    public abstract void DoSomething(string value);
}

public class Child1 : Parent
{
    public override void DoSomething(string value)
    {
        // Do something here.
    }
}

public class Child2 : Parent
{
    public override void DoSomething(string value)
    {
        // Do a completely different thing.
    }
}

public class Example : Child1, Child2
{
}
</code>```

Now, when we call the method DoSomething on Example, we actually want to invoke the method declared in Parent. So how would the runtime decide which one of the implementations to run?

Body:
You're partially right: the problem exists in the case of the multiple inheritance too, but can easily be solved in some languages; diamond, on the other hand, cannot be solved that easily.

In C#, multiple inheritance is forbidden, but a class can implement multiple interfaces. Imagine that the class Example implements IModifiable and ITransformable. Those two interfaces have both a method Transform(string) : string. How would you implement this?

public class Example
{
    public string IModifiable.Transform(string value);
    public string ITransformable.Transform(string value);
}

This means there is no ambiguity. You have not one, but two methods with clearly distinct signatures.

Now, imagine the diamond case:

public abstract class Parent
{
    public abstract void DoSomething(string value);
}

public class Child1 : Parent
{
    public override void DoSomething(string value)
    {
        // Do something here.
    }
}

public class Child2 : Parent
{
    public override void DoSomething(string value)
    {
        // Do a completely different thing.
    }
}

public class Example : Child1, Child2
{
}

Now, when we call the method DoSomething on Example, we actually want to invoke the method declared in Parent. So how would the runtime decide which one of the implementations to run?


问:
Is there any danger in rendering user-entered HTML and can it be mitigated?
I'm guessing the answer is no because there's quite a few examples, including right here. If I let users submit their own HTML text and then render it side by side, what could the user do that would break the rest of the page and how can I guard against it?

I imagine escaping the input as soon as they enter it would be a good idea, then un-escaping as I'm rendering, as well as stripping out

答:
You should consider sanitizing the input html data by the user before rendering on the webpage.

Strip out the script tags or HTML encode them, so that the user is
aware that he has entered the undesirable tags.

Strip|HtmlEncode out the iframe tags also. They might get mischievous, if the end user is trying to malign your webpage.

Strip|HtmlEncode out the input tags

Probably you can use regex on the server side to weed out these special tags also. OR use the HTML Agility Pack to navigate within the html elements & cleanse them from the server side.

Render the html in the new page rather than the existing page in your application. At least this will protect your existing web pages. OR render this custom html in the iframe within your existing webpage. This would help you contain any unknown implications within the confined area.


答:
You want to use a whitelisting approach, where you only accept known good html syntax, instead of stripping out known malicious content. There is no reliable way to strip out malicious content except by rejecting everything that you don't know for sure is safe. Do not use regexes, do not try to roll your own code, use a good html sanitization library. Libraries that do this typically parse the HTML into a DOM, remove all non-whitelisted tags and attributes, and then serialize the DOM to HTML again.

Examples of html sanitization libraries that use a whitelisting policy are the OWASP Java HTML Sanitizer and PHP HTMLPurifier.

Title: Is there any danger in rendering user-entered HTML and can it be mitigated?

Body:
I'm guessing the answer is no because there's quite a few examples, including right here. If I let users submit their own HTML text and then render it side by side, what could the user do that would break the rest of the page and how can I guard against it?

I imagine escaping the input as soon as they enter it would be a good idea, then un-escaping as I'm rendering, as well as stripping out


答:
There is a rather simple reason that AFAIK hasn't really been touched upon in the cross-site duplicate, nor here: Python started out as a procedural language. It was based on ABC, also a procedural language.

Object-Orientation was added later, and when it was added, Guido van Rossum wanted to add the minimal amount of features possible, in order to keep the design of Python simple. Python already had dicts and functions, so why add something entirely new to the language, when an object can simply be a dict of slots and a class can simply be a dict of functions? A method can be interpreted as a partially-applied function that closes over a single distinguished argument. And that's precisely how methods are implemented in Python: they aren't. They are just functions which receive an extra distinguished argument.

Title: Why do you need "self." in Python to refer to instance variables?

Body:
I have been programming into a number of languages like Java, Ruby, Haskell and Python. I have to switch between many languages per day due to different projects I work on. Now, the issue is I often forget to write self as the first parameter in the function definitions in Python same is with calling methods on the same object.

That said, I am quite amazed by this approach of Python. Basically we have to type more to get the things done, in the languages like Java and Ruby things are made simple by automatically referencing the variables in the current object.

My question is why is this self necessary? Is it purely a style choice, or is there a reason why Python can't let you omit self the way Java and C++ let you omit this?


问:
Automated Testing: Explaining its Business Value
To start I don't think this is a repeat of other questions on unit testing. What I'm looking for help with is articulating its value to a team of programmers, analysts, managers and testers. By automated tests, I don't think I need to make a distinction between unit tests (e.g. JUnit), BDD (e.g. JBehave, Fitness) and UI (Selenium , Watir) because I think they all provide similar value (but feel free to write an answer that disagrees :))

The following is a list I've identified, I'm looking for answers that help expand or refine:

Time/Cost Savings: writing automated tests can take more time than written test cases. However, considering tests are run multiple times, the marginal work (i.e. cost/time) to execute automated tests is several orders of magnitude less. That the automated tests are cheap to run facilitates changing the system over time.

Documentation: there is no truer way to know how a system works than its tests. Any other documentation is usually out of date the moment its written, but tests (at least those that pass) reveal how things actually work. This is true for both end-user AND API documentation.

Code Quality: test writing forces you to:

consider clients because tests are a client

breaks dependencies where making code testable often means figuring out how to make that code not require some other large system be available

答:
I think the key is to talk about specific categories of tests you will create, not 'automated testing' as a whole. The latter can be a bit nebulous and worrying, and it's too easy to come up with examples of where it would be waste of time.

I always recommend splitting your tests up into 4 groups (more detail here). Stick with me here, I'll get to how this helps you sell testing to others in a moment.

Tests of your core functionality. Ie, for a website monitoring tool this would be tests of alerts which should fire for websites you're monitoring. These tests make sure this stuff never breaks.

Smoke tests of your whole application. For example, using Selenium to navigate all links/buttons in a web app and make sure there are no errors from the server. These tests avoid you wasting testers time with obviously broken builds.

Tests of any fragile code. Ie, for that old module no one ever wants to touch, or the complex piece of code which seems to always have bugs in it.

Tests which devs wanted to write to support their work. Because sometimes tests are useful when you're writing something, but don't fall into the categories above.

By splitting your tests out into these categories you can now have a different discussion. Take the first three groups (the forth is at individuals discretion anyway) and ask if people think tests for those pieces of code would be worthwhile? If you can't get agreement, maybe you don't include those tests for now. If you can, ie if people agree that tests around core functionality which get executed on each commit are useful, then start adding those.

The other group which can be useful is tests which are hard or time consuming to do manually. There should be a pretty easy to explain benefit here in terms of saving manual testing time, or getting things tested which get skipped because of a lack of time.

OwnerDisplayName: orangepips


问:
MInimum tree coverage
I would like to understand what would be the optimal method of finding minimum tree coverage of tree nodes. Let me explain.

I have a self-referencing structure that represents a tree, with a limited depth of X.

Nodes in the tree can be logically "selected". From the application perspective, it means that user would like to have some aggregate information about the selection.

Let's say user picks nodes A, D, I, J, L and M.

What I would like to do is to be able to restructure the users selection in order to pick the minimum set of nodes that cover the entire selection.

For this example:

nodes I and J can be covered by their common parent node F, so I pick F and remove I and J

node M can be covered by it's parent node H, so I pick H and remove M

node D is already covered by node A, so I remove D

After that, nothing can be restructured further - algorithm stops and I should get the following selection.

First, I don't know if "minimum coverage" is the good name.
Second, I can't find any better phrase, so Google is not my best friend here.

Another thing to note is that the tree itself can be stored:

in-memory

in transactional database

in OLAP database (not exactly self-referencing any more)

I'm stuck :(

EDIT

I have been thinking a lot about this problem, and there might be a solution that I have to analyse.

Following can be introduced:

let's call tree itself the "template tree"

let's call selection the "selection tree"

each node of the template tree has a precalculated redundant attribute - number of children nodes

the selection tree can be "dirty" or "clean"

after a node is added, if nothing is done yet, it's in the dirty state

after the restructuring is done, it's in the clean state

each node of the selection tree has redundant attributes - number of children nodes selected and state: selected or ghost

selection tree is a variant of in-memory doubly linked tree (child knows its parent, parent knows its children)

After that, adding a node in the selection tree (selection-node) would work like this.
Let's call the new parent of the new node in selection tree a selection-parent, and parent of the new node in template tree a template-parent.
Let's call the children of the selection tree node selection-children, and children of the template tree node template-children.

Set dirty state of selection tree

Remove all selection-children of selection-node

If unexistent in selection tree, fetch template-parent of selection-node, along with its number of children attribute; add selection-parent as a ghost node, with selected number of children = 1

If existent in selection tree, access selection-parent of selection-node and increment its selected number of children

If selection-parent has selected number of children equal to number of template-children, promote its state from ghost to selected; treat that selection node as a new node and start at 1

Set clean state of selection tree

I'm curious whether this algorithm already exists as an implementation somewhere. It's behavior wouldn't obviously be worse than O(log(n)), right? Of course, if it doesn't lack something in the logic.

答:
The effect you want can be achieved with a single pass over the tree, using a depth-first iteration.

When visiting a node, you perform two conditional actions

if all children of the node are selected, then you mark the current node as selected.

if the current node is selected, then you deselect all children of the node

In your example, these tests let the selection of the nodes I, J and M bubble up to F and H respectively and the second test causes node D to be deselected.

This algorithm does not make any assumptions on how the tree is stored, but only assumes that you can reach each node and that you can process the children of node X before node X itself.

If the process is interactive, the process can be even simpler:

Check if any (direct or indirect) parent of the selected node is already selected. If so, deselect the node again.

If the node is still selected, go over the tree under the node and deselect all (direct and indirect) children of the node.

If the node and all its siblings are selected, then select the parent and deselect the parent's children. Repeat this step until you reach a node that doesn't have all siblings selected.

This is generally more efficient, because on each selection you usually only have to walk a small part of the tree.

Title: MInimum tree coverage


问:
Permuting and combining the values based on the key
I am trying to generate a table which would show all possible combinations based on the key. To make it more clear lets say I have a kind of Key, Value pair set(Its mentioned kind of because there are unique keys and different values).  I need to fill the table with all possible combinations of the values with different keys.

Now i need to make the key as the heading of the table and add the values accordingly so that there are no duplicate rows and all combinations are present. I am doing it in C#. I could only retrieve these key value pairs from my database based on conditions, but I have no idea how the table can be built.

Are there any examples someone could provide? Or a basic approach I should follow to achieve it?

So far my ideas:

To create an array with size equals number of distinct parameters of key. Add values to the array and then pass a list of the Array to the View.

P.S : My data model is complex. Reference to this question would give an idea of a part of my Data model. The value I am talking about comes from the SetValue described in the model and the key from another class which is not described (I feel this information is irrelevant as I have already the list of my Key value pairs). I think I have posted the question in the right forum, as I am not asking for any code. If not please let me know the right forum where this question will belong to.

答:
If you have a fixed number of types like you do in this case (color, fruit, vegetable), then you can do it easily with nested loops. For example:

```<code>foreach (var color in colors)
{
    foreach (var fruit in fruits)
    {
        foreach (var veg in vegetables)
        {
            rows.Add(new Row(color, fruit, vegetable));
        }
    }
}
</code>```

That gets unwieldy if your number of different things grows, though.

You can, however, generalize that to a class that will generate permutations for any number of different things.

Body:
If you have a fixed number of types like you do in this case (color, fruit, vegetable), then you can do it easily with nested loops. For example:

foreach (var color in colors)
{
    foreach (var fruit in fruits)
    {
        foreach (var veg in vegetables)
        {
            rows.Add(new Row(color, fruit, vegetable));
        }
    }
}

That gets unwieldy if your number of different things grows, though.

You can, however, generalize that to a class that will generate permutations for any number of different things.


问:
Do gantt charts have a role in agile software development?
I've heard it said that gantt charts are a relic of waterfall project management techniques.

I typically use an agile-like approach to project planning and tracking progress which provides good visibility into feature-time trade-offs as the project progresses.

We're at the outset of a project in in which, while the exact front-end user interaction design is somewhat unclear at this early stage, the back-end requirements are fairly clear (components that communicate with various third-party APIs, the server infrastructure, etc).

We'll be going through a process to develop good user interaction design for the front-end (starting with user stories and working forward from there), but we also wanted to get an idea of how long the back-end would take.

I decided the best approach was to break it down into sub-components, where each component consisted of tightly coupled code that should probably be worked on in a contiguous period of time.

I assigned rough time estimates to each component and sub-component, typically ranging from 1 to 10 days.  I then used OmniPlan to indicate dependencies between these various components, and assigned developers to each task, with the goal of distributing effort as equally as possible.

I then used OmniPlan's leveling tool. All, I think, a fairly standard way to use OmniPlan, and I thought reasonable way to come up with a rough time estimate.

I should clarify that the intention was not to come up with a rigid blueprint about who would work on what and when, but more come up with at least one plausible way that we could build what we needed to build in a two month period.  The gantt chart suggested that this was feasible.

To my surprise, I received quite strong pushback from another team-member familiar with the agile development process, who accused me of adopting a waterfall methodology.

Their more specific criticism was that the gantt chart was specified in terms of architectural components, rather than on user-visible features.  They were frustrated that it didn't lend itself to saying "we should have functionality X by Y date".

Where, if anywhere, did I go wrong?

答:
What you want here is to have an idea of a end-date, with a fixed set of resources, and a fixed scope. That's typically what Gantt charts are used for, but that's definitely not agile.

The agile manifesto states that :

We have come to value:

Responding to change over following a plan

That is, while there is value in the items on the right, we value the
items on the left more.

Source : http://www.agilemanifesto.org/

This means that agile practitioners prefers being able to respond easily to multiple and important scope changes rather than being able to provide (and committed to) forecasts more than one month ahead (which other methods didn't do well anyway, but their goal is to address this concern).

If your clients/management value the items on the left more, then doing both agile and addressing their concerns will be tricky.

If you have a fixed set of requirements for a component with clear and fixed specifications, and you need to provide a delivery date, then maybe agile methodologies are not the best fit for your case.

So, to answer your question, you are not doing anything wrong, but you are not doing it in a agile way. As said quickly_now in a comment, it's bad to get stuck in a methodology, so everything is ok, you're just pragmatic.

For the front-end user interaction, you seems to be not expected to provide a delivery date, and the scope is unclear, then here, undoubtedly, agile seems the right thing to do.

OwnerDisplayName: sanity


答:
In the real world rigid time lines are compulsory!

How would you feel is you took your car in for an oil change and the guy at the shop said "it will be done when its done" or "I can get it back to you tomorrow at 4 p.m. but I may only have had time to drain the old oil".

Deadlines are a must for management. They have to plan, coordinate and budget all sorts of stuff besides your project and they need to know when its going to be ready!

As its pretty much impossible to provide an accurate estimate for any reasonably large software project this puts you in an impossible situation.

The best tools are still experience and gut feeling. Gannt charts, project plans etc. are necessary smoke and mirrors to keep the management off your back.

Title: Do gantt charts have a role in agile software development?

Body:
I've heard it said that gantt charts are a relic of waterfall project management techniques.

I typically use an agile-like approach to project planning and tracking progress which provides good visibility into feature-time trade-offs as the project progresses.

We're at the outset of a project in in which, while the exact front-end user interaction design is somewhat unclear at this early stage, the back-end requirements are fairly clear (components that communicate with various third-party APIs, the server infrastructure, etc).

We'll be going through a process to develop good user interaction design for the front-end (starting with user stories and working forward from there), but we also wanted to get an idea of how long the back-end would take.

I decided the best approach was to break it down into sub-components, where each component consisted of tightly coupled code that should probably be worked on in a contiguous period of time.

I assigned rough time estimates to each component and sub-component, typically ranging from 1 to 10 days.  I then used OmniPlan to indicate dependencies between these various components, and assigned developers to each task, with the goal of distributing effort as equally as possible.

I then used OmniPlan's leveling tool. All, I think, a fairly standard way to use OmniPlan, and I thought reasonable way to come up with a rough time estimate.

I should clarify that the intention was not to come up with a rigid blueprint about who would work on what and when, but more come up with at least one plausible way that we could build what we needed to build in a two month period.  The gantt chart suggested that this was feasible.

To my surprise, I received quite strong pushback from another team-member familiar with the agile development process, who accused me of adopting a waterfall methodology.

Their more specific criticism was that the gantt chart was specified in terms of architectural components, rather than on user-visible features.  They were frustrated that it didn't lend itself to saying "we should have functionality X by Y date".

Where, if anywhere, did I go wrong?


问:
Refactoring three very similar classes using inheritance?
I'm currently working on refactoring the code-base for one of our services. I'm been going through reviewing everything, and I feel it's a bit scattered, and could probably adhere to OOP principles better.

I have three classes that are all derivative of another class Cache. All three of these classes perform the exact same operations, the only difference is the type of object they are querying for and what method call they use to query them. What would be the best method of making these classes even more simple?

```<code>public static class ZenDeskCache
{
    public static ZendeskApi Api = new ZendeskApi(GlobalVariables.ZendeskUrl, GlobalVariables.ZendeskUser,
        GlobalVariables.ZendeskPass);

    public class Users : Cache<Users, List<User>>
    {
        protected override List<User> GetData()
        {
            var users = Api.Users.GetAllUsers();
            var allUsers = new List<User>(users.Users);

            while (users.NextPage != null)
            {
                users = Api.Users.GetByPageUrl<GroupUserResponse>(users.NextPage);
                allUsers.AddRange(new List<User>(users.Users));
            }

            allUsers = allUsers.OrderBy(n => n.Name).ToList();

            return allUsers;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromDays(1);
        }
    }

    public class Organizations : Cache<Organizations, List<Organization>>
    {
        protected override List<Organization> GetData()
        {
            var organizations = Api.Organizations.GetOrganizations();
            var allOrgs = new List<Organization>(organizations.Organizations);

            while (organizations.NextPage != null)
            {
                organizations = Api.Users.GetByPageUrl<GroupOrganizationResponse>(organizations.NextPage);
                allOrgs.AddRange(new List<Organization>(organizations.Organizations));
            }

            allOrgs = allOrgs.OrderBy(n => n.Name).ToList();

            return allOrgs;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromDays(1);
        }
    }

    public class Groups : Cache<Groups, List<Group>>
    {
        protected override List<Group> GetData()
        {
            var groups = Api.Groups.GetGroups();
            var allGroups = new List<Group>(groups.Groups);

            while (groups.NextPage != null)
            {
                groups = Api.Groups.GetByPageUrl<MultipleGroupResponse>(groups.NextPage);
                allGroups.AddRange(new List<Group>(groups.Groups));
            }

            allGroups = allGroups.OrderBy(n => n.Name).ToList();

            return allGroups;
        }

        protected override TimeSpan GetLifetime()
        {
            return TimeSpan.FromSeconds(600);
        }
    }
}
</code>```

答:
If you really want to refactor these classes using inheritance, then fine, go ahead, amon's answer is right on the money.

However, be advised that eliminating a little code duplication is one of the least legitimate reasons for complicating a design by using inheritance.  If the resulting code is more verbose than the original, then you have a net loss in readability, understandability, and maintainability.

This might actually be worse than a bit of code duplication.


问:
Is C programming language low level or high level?
What do you think, is C programming language low or high level?

There are some information, in one is said that C is low level, and another C is high level? When I read book of Dennis Ritchie and Brian Kernighan, there is written "C is a relatively "low level" language"?

答:
It's completely context dependent.

Compared to PHP, C is low level;

Compared to x86 assembly, C is high level;

Compared to the instructions I used to construct this universe in which you reside, C is so high level you can barely see it.

It depends who you're talking to, and about what, as to what the answer is. C is a bit of a unique beast, though, because (as Mike pointed out in comments), it's the lowest-level of all general-purpose, architecture-independent programming languages, and these are the languages you're most likely to encounter in modern reality. So, in practice, you're likely to hear C being deemed "low level" unless you're talking to someone who fiddles bits in registers with a soldering iron for a living.


问:
Write C line by line
Is there any conceptual limitation that would make impossible to create a C program line by line as in 'Mathematica notebooks'[1]?

[1] One key aspect of Mathematica is that you can create your code line by line in a format called 'notebook'. This makes it much easier to debug the code during the development phase. After most of the code has been developed and debugged, is just a matter of copy and paste your code from the notebook format to a batch format (currently it's not possible to compile Mathematica codes).

答:
In practice, compile your C code with all warnings and debug info (e.g. gcc -Wall -Wextra -g if using GCC...) then use a debugger (such as GDB).

With a debugger you can run your C code line by line. For gdb use the step and/or next commands.

Once you are sure there is almost no bugs in your code, and no simple bug, you'll compile with gcc -Wall -Wextra -march=native -O2 -g to get a production executable (don't forget to test it too!) and/or for benchmarking purposes.

You could use a good editor such as emacs and configure it to compile your code with one key, and start the debugger with another key.

BTW, several language implementations are able to compile on the fly to machine code, in particular the SBCL implementation of Common Lisp.

On some systems (in particular Linux), you could write a program which generates at runtime some C code in a temporary file /tmp/mytemp.c, compile that file as a plugin (by forking a gcc -Wall -shared -O -fPIC /tmp/mytemp.c -o /tmp/mytemp.so command), dynamically load that plugin (dlopen(3)), find function pointers from its name inside it (dlsym(3)) and run these functions (in the same process that generated their C source code). My GCC MELT tool (free software, GPLv3) is doing this. In practice compilers are fast enough to make that usable for interactive purposes.

It could be difficult to write C code line by line, since C is not a line oriented language (most newlines -outside of macro definitions- in C are understood by the compiler as a space). Actually a C compiler handles only translation units (which you could generate in some /tmp/mytemp.c file).

But you could, in your program, read some lines, pack them inside a function source, emit that generated C code in a temporary file, and compile and load that as a plugin as I explained above (system on the compilation command building the plugin, dlopen + dlsym on the plugin).

(Of course, some undefined behavior inside the generated plugin would often crash the entire process, so in practice it would be better to generate the plugin C code from something higher level, and be sure that the generated C code is reasonably correct and won't crash.)

Of course, it uses operating system features: dynamic loading with dlopen is standardized by POSIX (and the command to compile a plugin is often OS specific), not by C99.

You might instead consider embedding some interpreter like Guile or Lua in your program. Or perhaps consider a JIT compiling approach, using libraries like libjit, asmjit, GCCJIT, LLVM, etc....

I am not saying that C (in its usual implementations) has any Read Eval Print Loop (like Common Lisp has). It does not (see this, as commented by MichaelT). And a REPL implementation might not reproduce faithfully the undefined behavior and faults (segmentation violation ...) that a compiled program has.

If you code in C (in particular on Linux, which I recommend), you'll use several tools (sometimes branded in some IDE combining them): an editor (emacs), a version control system (git), a builder (GNU make, see my hints here) which would run the gcc compiler etc etc, a debugger (gdb), and others (etags, grep, valgrind...). With some habit, you'll be very productive by using them together. And since your translation units will remain small (no more than a few thousand lines per source file), compilation is going fast today (less than a few seconds), unless you work on some huge free software project (like the GCC compiler, the Linux kernel, the Mozilla browser in C++, ...) of many millions of source code lines. But trying to contribute to huge project without any prior C experience is insane; so start with your own small C project (two dozens of thousands lines would require you a full year of work).

Since compilation is quick -typically less than a couple of seconds- you can afford compiling very often (e.g. several times each minute) and run your current test in the debugger; in rare cases -huge projects like GCC or the Linux kernel, compilation is much slower, but you won't be in that case without being very experimented in C coding, and then you'll have developed your own skills, tips and tricks to overcome the slowness of the build. So just be sure that your project is compiled quickly: use several translation units, so don't have source files bigger than a few thousand lines each, and master some builder (e.g. have a good Makefile for GNU make). Hence a REPL for C is practically useless, the compiler is fast enough ... Configure your editor, e.g. emacs, to be able to rebuild your program at a keystroke in a few seconds at most (perhaps with a parallel build, à la make -j).

Notice that coding in C is hard, probably much harder than coding in Mathematica, not because of tools deficiency, but intrinsically because the semantics of C99 is difficult to master (notably, you'll need to understand precisely the potential undefined behavior and know how the computer works). Even with the right tools you'll spend days or weeks hunting some of your bugs; and it is not a matter of syntax (the syntax of C99 is relatively simple).

IMHO, it is the semantics of C99 which makes it hard to learn, and which makes REPL implementations of C rather useless. In practice, you won't be slowed by the compilation time (probably a second or two for you, if you are working on a fresh project), so you practically won't need any REPL. But you'll experiment that coding in C is difficult (but you'll learn a lot)

Title: Write C line by line