答:
There are many companies that take this approach. It's way to stringent for any reasonable need of the company. Some folks have said it's unenforceable in some localities, and you could check with a lawyer on that aspect.

I'd suggest responding with a proposed alternate version that gives the company anything you develop during work hours, or while using company resources (one can't blame the employer for wanting to get what they've paid you for, nor for stuff you do using their equipment).

Not knowing how much you may need the job, I don't know whether you can afford to try to negotiate or not, nor whether you can afford to walk away. If you have intentions of doing ANYTHING productive outside of work, then this agreement is going to be a big problem for you, because it will taint the ownership of anything that you do on your off hours.

Now, it should be noted that your employer (and especially your prospective boss) probably has no intention of watching what you do on the side and making a grab the instant you do something interesting. The legal department almost certainly authored this with an eye toward maximum protection for the company, and no one else has bothered to pay much attention to it (lawyers, remember, are hired to protect their clients as much as possible. So they tend to reach just as far as they can and only pull back when someone else pushes a bit).

In fact, it's unlikely in the extreme that they'd ever try to enforce it outside of stuff you actually did for them. But it's there, and it COULD become a problem at some random future time, which is a good reason to avoid it.

Title: About Intellectual-Property agreement with employer

Body:
In IP agreement IP is define as below

Intellectual Property (whether or not patentable and whether or not made during working
  hours) is defined as but not limited to: all product specifications, developments, inventions, works of authorship, derivative works, technologies, programs, systems, software, mobile applications and other mobile programming interfaces, designs, methodologies, encryptions, ideas, techniques, patents, formulas, processes, concepts, know-how and date made or conceived or reduced to practice or developed during employment period ,remain the property of XXXXXXX[COMPANY_NAME]XXXX or its affiliates.

This is the first time I have seen any IP agreement. Isn't it too stringent? or its standard practice across industry?


问:
what exactly is system programming?
I have never understood what system programming meant. The usual definition given is "...doing something close to the Os or extending Os features...".

Does using Windows API directly rather than some libraries to say do file i/o make it system programming? Was writing Android OS system programming? If I write something that would expose linux kernel through a console like app on Android am I doing system programming? If I am writing software to control a washing machine am I writing system programming?

I am a beginner in programming and this is confusing me to no end. Please explain contrasting it with "application programming".

答:
I personally like the definition from Wikipedia:

System programming (or systems programming) is the activity of programming system software. The primary distinguishing characteristic of systems programming when compared to application programming is that application programming aims to produce software which provides services to the user (e.g. word processor), whereas systems programming aims to produce software which provides services to the computer hardware (e.g. disk defragmenter). It requires a greater degree of hardware awareness.

ContentLicense: CC BY-SA 3.0

Title: what exactly is system programming?


问:
Is C# becoming harder to read?
As C# has progressed, many language features have been added. It has come to the point where it's becoming unreadable for me.

As an example, consider the following code snip from Caliburn.Micro code here:

```<code>            container = CompositionHost.Initialize(
                   new AggregateCatalog(
                      AssemblySource.Instance.
                             Select(x => new AssemblyCatalog(x))
                               .OfType<ComposablePartCatalog>()
                )
            );
</code>```

Now, this is just a small example.

I have a number of questions:

Is this a common or known problem?

Is the C# community finding the same?

Is this an issue with the language, or is it the style used by the developer?

Are there any simple solutions to better understand others code and avoid writing code in this way?

答:
The code in your example is not easily readable because

It mixes many notions (Composition, Catalogues, Aggregates, Assemblies, ComposableParts...) with several levels of nesting while the calling code should typically have to deal with only one level. Looks a bit like a violation of the Law of Demeter only with nested method calls instead of a chain of sub-sub-properties. This muddles the intention behind the line of code somewhat.

There's a weird singleton usage - AssemblySource.Instance.Select() implies that Instance is an IEnumerable, which is a bit awkward.

The x variable in the lambda expression is ugly. Generally you try to give your lambda variables intention revealing names - helps the reader identify what kind of data the function is about, even if he's not familiar with lambdas.

It's not clear why you should filter with OfType<T>() a collection of objects you've just newed up...

However, all these flaws relate to the way the original developer wrote the code and how expressive he designed it to be. This is not something specific to the latest versions of C# and the appearance of lambda expressions.

More generally, it helps if the reader of your code knows how lambdas work, but with clear enough naming you almost always manage to make your code readable even to someone with a pre-.NET 3.5 background.

Title: Is C# becoming harder to read?


答:
In short: Writing software that extends or enhances the functioning of an OS, like drivers, system utilities updates to OS'es or even brand new OS'es.

It mostly involves the Memory Management; I/O operations in the broadest sense of the word like networking, file access and device management; process management (multi tasking, process administration, etc.); user<->system interaction methods (both in and out) and user administration.
Basically everything that is part of the OS that isn't an application is systems programming.

Title: what exactly is system programming?

Body:
I have never understood what system programming meant. The usual definition given is "...doing something close to the Os or extending Os features...".

Does using Windows API directly rather than some libraries to say do file i/o make it system programming? Was writing Android OS system programming? If I write something that would expose linux kernel through a console like app on Android am I doing system programming? If I am writing software to control a washing machine am I writing system programming?

I am a beginner in programming and this is confusing me to no end. Please explain contrasting it with "application programming".


问:
Is BDD actually writable by non-programmers?
Behavior-Driven Development with its emblematic “Given-When-Then” scenarios syntax has lately been quite hyped for its possible uses as a boundary object for software functionality assessment.

I definitely agree that Gherkin, or whichever feature definition script you prefer, is a business-readable DSL, and already provides value as such.

However, I disagree that it is writable by non-programmers (as does Martin Fowler).

Does anyone have accounts of scenarios being written by non-programmers, then instrumented by developers?

If there is indeed a consensus on the lack of writability, then would you see a problem with a tool that, instead of starting with the scenarios and instrumenting them, would generate business-readable scenarios from the actual tests?

Update: regarding the “scenario-generator” tool, it would of course not guess business language magically  ;)  But, just like we currently use regexp matchers to create tests in a top-down approach (on the abstraction dimension), we could use string builders to create scenarios in a bottom-up approach.

A “to give an idea only” example:

```<code>Given I am on page ${test.currentPage.name}
And I click on element ${test.currentAction.element}
…
</code>```

答:
I have seen it. Didn't end up well.

I think that cucumber is cumbersome (<--lol :D) abstraction for this exact reason. Too hard for non-technical people to write by themselves; too verbose for technical people.

Non technical people just haven't learned to think like programmers. It is our privilege to understand abstract knowledge, break it down, build up anew and still be able to run away from ambiguousness successfully. That's what we are paid for.

If there is indeed a consensus on the lack of writability, then would you see a problem with a tool that, instead of starting with the scenarios and instrumenting them, would generate business-readable scenarios from the actual tests?

Tool itself won't be able to generate them. Computer knows nothing about business domain. In the end - programmer would be responsible for drawing what needs to be generated anyway and even then - likely those scenarios would be too verbose/cryptic for their end-users.


问:
Is Entity Framework ready for production?
I'm looking into Entity Framework for a new project that I'm going to be taking on and as part of my research into it I'm asking some industry professionals if it's stable and ready for 'real world' implementation.

In the running is:

EF

NHibernate

DevExpress XPO

I already have a great deal of experience with XPO, but I'm not particularly happy with it.

答: I haven't actually used the full stack, but we use it piecemeal in our product and it seems quite mature, though we had to adapt some pieces for our needs.</p>

ContentLicense: CC BY-SA 2.5


答:
Part of the difficulty in terms of the customer writing a specifications document is that the customer often doesn't know how to translate the things the customer wants into a language which actually describes what the customer needs. While the customer may say that they want a certain behaviour to exist in a system, they are generally not so concerned with the minutiae until they have seen and used and experienced the software working in a manner which the customer feels doesn't quite match their needs.

When customers describe a business process, they often leave a lot of relevant information out. Often this information relates to things about a process that are commonly understood within the customer's particular domain and which is therefore taken for granted and often not relayed to the programmer. At other times, the customer doesn't actually know how to deal with all of the boundary conditions within a system, and is looking to the programmer for guidance.  Sometimes it's all a simple case of usability, with the customer thinking they want something to work in one way, but later changing mind when it becomes clearer that things should work differently.

Ok, so enough of "customer-relations 101 for programmers". The question is whether there is still value in having the customer use a business readable DSL to define how to define a specification. I believe that with guidance, the answer is a tentative 'yes', and I say tentative because the next question that comes to mind is, why would you have a customer  craft a DSL when you can have a programmer more easily define one that will provide a customer with a simple yet rich language to define how a system needs to work?

When you have provided a customer with a language for describing how they would like a system to work, you are going to end up with statements that say something along the lines of:

"for a given 'subsystem', as a 'business entity' I want 'some feature' so that I might achieve 'some result'".

This type of statement ends up describing a requirement in a very clear way, providing the the overall shape that the customer basically wishes the system to assume, or another way of looking at it is that the customer is describing what the system is.  If you wish to have your customer think about things a little further, you can then ask them to describe the rules which the feature must obey using a number of statement similar perhaps to:

"Given 'some system state', When 'some action occurs', Then expect 'some result'

Again very clear descriptions, this time about how the system should behave.  The thing is, this will not replace the need for a software developer to fill in all of the blanks, and to tease out further details that the customer may be only peripherally aware of. While the customer may be able to be 'trained' by the programmer to describe features and behaviours in a nice programmer-friendly format, the customer won't really have the skills or the knowledge to generate meaningful test cases, nor to provide the implementation code. This was I think the point of the Martin Fowler article the OP has referred to. So yes, the software itself isn't writable by the customer, but the description of the software most certainly can - and IMHO should - be written by the customer. For what it's worth, I didn't read Fowler's article as saying that the customer shouldn't or can't write the DSL, but rather that the cost in creating a tool that would ensure the customer can understand how to successfully implement a DSL is effectively prohibitive, which is why I feel it's easier and perhaps more cost effective to show the customer a DSL, and help the customer tune it if needed in order to provide a common language which both business people and programmers can use to collectively stay on the same page.

I feel that we programmers can sometimes forget that our customers are generally very smart in terms of their understanding of their businesses and business processes, certainly much better than we do.  When they don't have a programmer to tell them how to build a software system, the customers generally resort to other - perhaps less efficient - means to solve their particular business management problems. By this I mean simple databases (think Access) or spreadsheets, or even in hand written ledgers, and with well defined rules and procedures to manage those processes. What many customers lack isn't a means to determine how a system needs to work, but rather how it should be built, and more importantly how efficiently describe the behavioural rules of a system to the people who do have the skills to actually build the system.

If there is indeed a consensus on the lack of writability, then would you see a problem with a tool that, instead of starting with the scenarios and instrumenting them, would generate business-readable scenarios from the actual tests?

I think that this is looking at the the issue the wrong way around. I would see a large problem with a tool that generates documentation from tests if that documentation was intended to represent a specification in any way.  In order to test a scenario, you need to understand it, therefore the scenario needs to already exist for you to both define a test for it. If you describe the scenario in a BDD-syntax, then you have already specified it, and thus you can only instrument the scenarios after the fact. If on the other hand you had a tool that would allow the customer to describe a system in a nice programming-friendly DSL, and if that tool could be used to generate the code templates that would be used as a test suite, then I'd say there would be great value in such a tool.  It would not see the customer taking programmers out of the equation, and it would help reduce the effort required to take the customer's wishes and generate test-encoded requirements in a BDD fashion, and would perhaps make the customer's wishes more easily understood.  It would not however be a substitute for having an experienced software developer on hand to help the customer to separate the customer's needs from the customer's wants.

Title: Is BDD actually writable by non-programmers?

Body:
Behavior-Driven Development with its emblematic “Given-When-Then” scenarios syntax has lately been quite hyped for its possible uses as a boundary object for software functionality assessment.

I definitely agree that Gherkin, or whichever feature definition script you prefer, is a business-readable DSL, and already provides value as such.

However, I disagree that it is writable by non-programmers (as does Martin Fowler).

Does anyone have accounts of scenarios being written by non-programmers, then instrumented by developers?

If there is indeed a consensus on the lack of writability, then would you see a problem with a tool that, instead of starting with the scenarios and instrumenting them, would generate business-readable scenarios from the actual tests?

Update: regarding the “scenario-generator” tool, it would of course not guess business language magically  ;)  But, just like we currently use regexp matchers to create tests in a top-down approach (on the abstraction dimension), we could use string builders to create scenarios in a bottom-up approach.

A “to give an idea only” example:

```<code>Given I am on page ${test.currentPage.name}
And I click on element ${test.currentAction.element}
…
</code>```


问:
Is a project without license public domain?
If a project has no a license or has unknown authors, is it public domain?</p>

答:
I am not a lawyer, but my understanding is that no, it would not be in the public domain. See the first paragraph on this wikipedia page about the Berne Convention. Basically you have  to explicitly give up the rights, otherwise you have them, so unless you can find where it is put into the public domain it is not there. I am sure it is far more complicated than that, but I think I would start with that.

Here is a stackoverflow post with some more perspective.


答:
Anytime a new version of popular language gains new constructs, similar debates arise.

I also had these doubts years ago (http://gsscoder.blogspot.it/2009/08/use-csharps-features-wisely.html).

In my opinion C# is evolving in an elegant and consistent way.

Code in your sample is not complex, maybe you're not used with lamda expressions.

The problem is that C# is not only an object oriented language, it now supports also functional constructs (http://archive.msdn.microsoft.com/FunctionalCSharp/).

Title: Is C# becoming harder to read?

Body:
As C# has progressed, many language features have been added. It has come to the point where it's becoming unreadable for me.

As an example, consider the following code snip from Caliburn.Micro code here:

```<code>            container = CompositionHost.Initialize(
                   new AggregateCatalog(
                      AssemblySource.Instance.
                             Select(x => new AssemblyCatalog(x))
                               .OfType<ComposablePartCatalog>()
                )
            );
</code>```

Now, this is just a small example.

I have a number of questions:

Is this a common or known problem?

Is the C# community finding the same?

Is this an issue with the language, or is it the style used by the developer?

Are there any simple solutions to better understand others code and avoid writing code in this way?


问:
About Intellectual-Property agreement with employer
In IP agreement IP is define as below

Intellectual Property (whether or not patentable and whether or not made during working
  hours) is defined as but not limited to: all product specifications, developments, inventions, works of authorship, derivative works, technologies, programs, systems, software, mobile applications and other mobile programming interfaces, designs, methodologies, encryptions, ideas, techniques, patents, formulas, processes, concepts, know-how and date made or conceived or reduced to practice or developed during employment period ,remain the property of XXXXXXX[COMPANY_NAME]XXXX or its affiliates.

This is the first time I have seen any IP agreement. Isn't it too stringent? or its standard practice across industry?

答:
Such a clause would be unenforceable where I live (Minnesota), but I've seen businesses write unenforceable provisions into agreements, and I don't know where you live.  (Small businesses may not have the best legal advice, large ones are likely to be multi-state, and even unenforceable provisions might discourage behavior the employer doesn't want.)

What you can do, anywhere, is negotiate agreements.  Don't assume that what is put in front of you is necessarily unalterable, on a take-it-or-leave-it basis.  If you have concerns about provisions like this, talk to whoever you're negotiating with at the company.  Your best leverage will come between the time when you're offered a job and the time you accept.


问:
How to unit test a jsp file?
I'm developing a Java 6 EE application and I'm testing my jsp code with another one with a testing version of the function calls and code used in the original one but it seems loose and impractical. Is there a good way to accomplish this kind of testing?</p>

答:
You can also consider using a HTTP unit test framework like HTTPUnit | http://httpunit.sourceforge.net/.

Another important point is to well separate concerns of your application.

E.g. using techniques like TDD (http://en.wikipedia.org/wiki/Test-driven_development), you'll design types for testability.

Types consumed within JSP will be tested in specific unit tests. If this is not possible, you should simulate user -> browser interaction (again, HTTPUnit o similar tool).

Title: How to unit test a jsp file?


问:
Do you ever read language specs?
While trying to answer questions on SO site (particularly C++ questions) I find that most of the times one person or the other includes a quote from the standard. I myself have hardly read the language spec. Even when I try to read it, I can't get my head around the language used in the specs. So, my question to become a good developer in a particular language is it essential to read its spec and know all its dusty corners which invoke undefined/implementation defined behavior? </p>

答: The Common Lisp Hyperspec is a really useful bit of documentation. I refer to it a lot.

Title: Do you ever read language specs?


问:
Is unit testing development or testing?
I had a discussion with a testing manager about the role of unit and integration testing. She requested that developers report what they have unit and integration tested and how. My perspective is that unit and integration testing are part of the development process, not the testing process. Beyond semantics what I mean is that unit and integration tests should not be included in the testing reports and systems testers should not be concerned about them. My reasoning is based on two things.

Unit and integration tests are planned and performed against an interface and a contract, always. Regardless of whether you use formalized contracts you still test what e.g. a method is supposed to do, i.e. a contract.

In integration testing you test the interface between two distinct modules. The interface and the contract determine when the test passes. But you always test a limited part of the whole system. Systems testing on the other hand is planned and performed against the system specifications. The spec determines when the test passes.

I don't see any value in communicating the breadth and depth of unit and integration tests to the (systems) tester. Suppose I write a report that lists what kind of unit tests are performed on a particular business layer class. What is he/she supposed to take away from that?

Judging what should and shouldn't be tested from that is a false conclusion because the system may still not function the way the specs require even though all unit and integration tests pass.

This might seem like useless academic discussion but if you work in a strictly formal environment as I do, it's actually important in determining how we do things. Anyway, am I totally wrong?

答:
She insisted that devs report what they have unit and integration tested and how.

Is she really trying to argue about whether this kind of testing is actually in the realm of "development", or is she just trying to figure out how well your code is covered by unit testing? Just by looking at the information you've given, it seems like she just wants to know which parts of the code are covered and where she should focus her team's effort.

I worked on a testing team right out of school before I moved into a development role, and I can see how this might be valuable to her and her team.

Title: Is unit testing development or testing?


答:
I don't see that it matters too much.

If you don't provide them to QA/Testing, and they don't do proper tests, and it fails in production, it's their fault for letting it through QA into production without verifying it works as specified.

If you do provide them to QA/Testing, and they don't do proper tests...same outcome as if you had not provided them.

However, if you provide them, they could compare them against the spec as well, and/or suggest which tests might be flawed, or need changing because they did find a bug.

Really, I don't see much downside in providing them.  It's still on QA/testing to validate against the spec.  If they take the lazy way and just rely that your testing is good enough because they all passed, it's them that failed at their job.  As long as they still have the spec as well, the results of the unit/integration tests are just fluff, and shouldn't be able to hurt you one way or the other. This is the reason we have dev and QA.  Multiple checks that the app performs as specified.

Devs make mistakes, QA makes mistakes, ideally they don't both make a mistake on the same item...and if they do...it's potentially a analyst who dropped the ball writing an unclear spec.

Title: Is unit testing development or testing?

Body:
I had a discussion with a testing manager about the role of unit and integration testing. She requested that developers report what they have unit and integration tested and how. My perspective is that unit and integration testing are part of the development process, not the testing process. Beyond semantics what I mean is that unit and integration tests should not be included in the testing reports and systems testers should not be concerned about them. My reasoning is based on two things.

Unit and integration tests are planned and performed against an interface and a contract, always. Regardless of whether you use formalized contracts you still test what e.g. a method is supposed to do, i.e. a contract.

In integration testing you test the interface between two distinct modules. The interface and the contract determine when the test passes. But you always test a limited part of the whole system. Systems testing on the other hand is planned and performed against the system specifications. The spec determines when the test passes.

I don't see any value in communicating the breadth and depth of unit and integration tests to the (systems) tester. Suppose I write a report that lists what kind of unit tests are performed on a particular business layer class. What is he/she supposed to take away from that?

Judging what should and shouldn't be tested from that is a false conclusion because the system may still not function the way the specs require even though all unit and integration tests pass.

This might seem like useless academic discussion but if you work in a strictly formal environment as I do, it's actually important in determining how we do things. Anyway, am I totally wrong?


答:
Unit testing is the responsibility of developers that the tests can be useful to understand how the pieces of code work on their own.  Some may see this as a form of documentation and thus has some value although there may be overhead if the unit tests are changed regularly.

The other value in passing the tests over is that this can avoid doubling up on tests that may be redundant in terms of ensuring basic functionality.

There is also user acceptance testing that is separate from all of this as the end user may have their own understanding of how a system is to function.

Title: Is unit testing development or testing?


答:
If your company has a defined methodology to ensure the quality of its products (if they are SOX compliant, or are trying to improve their CMMI level, they probably do), then products must be able to stand up to audit to show that the process was followed.

Often, the defined process includes unit testing (which is a good thing).  Unfortunately, this also means you have to document your unit tests and prove that they were run in order to stand up to audit.  So that means you need a way to report on your unit tests.

Look at a tool like Sonar to help you out--it will report the level of code coverage and the results of your unit test runs.

Title: Is unit testing development or testing?


答:
As others have pointed out, for legal advice, you really want to consult a lawyer.  What provisions are actually enforcable will depend on the country and state in which you live among other issues that prevent a site like this from giving a canonical answer.  A lawyer that is familiar with the laws where you live can give you a much better reply.

You can certainly see if the employer would be willing to amend the agreement.  If you do that, though, understand that employers are unlikely to be willing to give up rights to any IP you create that is vaguely associated with the work you do for them.  From the company's standpoint, the problem is that if you happen to figure out how to solve some problem related to the business the company is in on Saturday in your shower while not using any of their equipment, the company needs to have rights to that.  Otherwise, employees could end up holding the company hostage claiming that all sorts of ideas that came to them while they slept or while they were driving in to work needed to be licensed.  Of course, that just defers the problem because someone has to figure out after the idea is created whether it is related to the business the company is in and that can be very nebulous-- if you work for Google, for example, what software isn't related to something that Google does?

Practically, one question to ask is how likely the company is to enforce an overbroad IP agreement and how likely you are to actually go to court to defend any exceptions you carve out.  If, for example, you get permission to build an open source chess application and your company decides later that some part of the chess application uses something that you developed in the course of your work for the company, are you really willing to go to court to defend those rights?  That could be a very expensive (and mentally exhausting) process even if you are clearly in the right.  On the other hand, if you think that you might like to start a company based around some open source app that you develop, you might well be willing to go to the courts to enforce the agreement.

If the company you're working for doesn't have a habit of suing employees to get rights to software that is unrelated to what the company does (and almost all companies fall into this category) and you just want to work on projects outside work as a hobby, perhaps an informal handshake agreement with your boss is sufficient.  That won't stand up in court, but if you already know that you'd fold before it got before a judge, maybe that doesn't matter too much.  If you want a bit more protection, perhaps you can negotiate some exclusions for particular projects or types of projects (i.e. linux, Apache, etc. depending on your skills and interests) or to negotiate that you'll inform the company about any open source projects you contribute to and they have N days to indicate that they want to object/ claim ownership.


答: No it not essential to be a good developer in a particular language. However it helps a ton when answering a question in a definitive way. So StackOverFlow users use it a lot. </p>

Title: Do you ever read language specs?

Body: While trying to answer questions on SO site (particularly C++ questions) I find that most of the times one person or the other includes a quote from the standard. I myself have hardly read the language spec. Even when I try to read it, I can't get my head around the language used in the specs. So, my question to become a good developer in a particular language is it essential to read its spec and know all its dusty corners which invoke undefined/implementation defined behavior? </p>


答:
I think the most important for you would be to clarify why she needs that report.

There can be different explanations (as suggested by several answers), which require very different strategies.

if she is a reasonable person, simply wanting to get information to help the work of her testing team, it makes sense to get to a common understanding, and work out some solution which would be suitable to both of you. You can discuss with her the nature of unit tests and the fundamental difference between unit vs functional / system / acceptance tests. Hopefully you can get her understand that these work on very different levels and neither can replace the other.

if she is a control freak or bureaucrat, demanding a report just for the sake of it, you can generate something to satisfy her whims with the least amount of effort (e.g. what @Doc suggested :-).

if she is into some power game, you may question whether she has the right to demand reports from developers. In my experience, developers usually aren't supposed to report to the QA department.

Title: Is unit testing development or testing?


问:
Is it advisable to ask employees to create 'work' GitHub accounts?
I've moved all our company Git repositories to GitHub and now I want to add employees to the projects. Since most employees already have personal GitHub accounts, I'm wondering whether I should ask them to create a work GitHub account. The reason that I'm thinking of doing this is to decrease the chances of unauthorized access to our code base since their personal accounts may be well publicized through their personal activity on the site, increasing chances of targeted attacks. Furthermore, if their personal account is ever compromised it won't mean the whole company code is accessible to the hijacker. Since this will bring the burden of maintaining two accounts for the employees I'm wondering whether it is the correct approach and whether it even makes sense. I would love to hear your opinions on this.

Update
Thanks for all the useful insights. I won't set an answer as accepted because of the subjective nature of the question/answers and since I took the best points from several different answers.

I have decided to go forward this way: I will remind employees that work-related GitHub e-mail notifications will have to be sent to their work e-mail accounts for practical reasons. Therefore it would make more sense to create work GitHub accounts. If they are willing to use their personal GitHub accounts and connect it to their work e-mail accounts then that's fine. In any case, employees will have to agree in written form to a number  of conditions tied to using GitHub. These are related to account security: choosing a secure password using a secure random password generator that is not used with any other account, not accessing GitHub through computers not owned or administered by them, etc. At the end of the day employees will have to decide themselves whether a work account makes more sense for them or not.

答:
Since everyone seems to agree on the lack of employer’s need to separate both, here is my short experience having tried using my personal account on professional projects and open-source contributions made in the context of work.

Just to make the context complete: I was not asked anything regarding accounts, actually GitHub is unknown to most people at my workplace. I simply was able to get green lights to open-source the project I will be working on, and went with the least amount of work, i.e. using my personal account.

From an employee’s point of view, one thing I really hate: getting notifications on my personal email for work stuff.

From that observation, I went to realize it’s a blatant breaking of the professional / personal barrier: if I want to contribute to a project during my off time, I still get all updates from my work projects… And it can bring confusion for external contributors, who might contact you without knowing you’re off that project.

Then of course, there’s a balance to find with the fact that your personal reputation can gain from your work contributions. But then again, it might the opposite if your name gets associated with a poor project…

In the end, as the question is asked from the employer’s point of view, and considering all other answers: I would say there’s probably not much point in enforcing using work-dedicated accounts. But you shouldn't forbid it, so that employees who prefer to raise the personal barrier may do so, and perhaps hint about those risks…?

As a side note, regarding security, since there seems to be some easy dismissal in other answers:

Of course, a “work” account would not be any more or less secure than a “personal” account regarding passwords. But when you're using GitHub, you're allowed to push with an SSH key. And that key usually lies in one’s session… So, the personal account can compromise all work repositories with a simple personal computer steal (without password knowledge), whereas a dedicated work account would probably have its key lie only on the work machine, making it more physically secure (hopefully).


答:
I would think that it would be beneficial to provide this type of thing. Unit test coverage should be something that is known by development and testing so that they can account for that.

Obviously, you have to test the business critical stuff no matter what. You have to test the commonly used functionality hard regardless of whether it has great unit test coverage. It couldn't hurt to let them know what other places are covered by unit tests. Does the code already check for edge cases in this one little control? This kind of stuff is helpful to know on all sides of the business.

Title: Is unit testing development or testing?


问:
Why are there so many string classes in the face of std::string?
It seems to me that many bigger C++ libraries end up creating their own string type. In the client code you either have to use the one from the library (QString, CString, fbstring etc., I'm sure anyone can name a few) or keep converting between the standard type and the one the library uses (which most of the time involves at least one copy).

So, is there a particular misfeature or something wrong about std::string (just like auto_ptr semantics were bad)? Has it changed in C++11?

答: It's because every programmer has something to prove and feels the need to create their own awesome, faster string class for their one, awesome function. It's usually a little superfluous and leads to all kinds of extra string conversions in my experience.</p>

OwnerDisplayName: fish


答:
It's mostly about Unicode. The Standard support for Unicode is abysmal at best, and everyone has their own Unicode needs. For example, ICU supports every Unicode functionality you could ever want, behind the most disgusting automatically-generated-from-Java interface you could possibly imagine, and if you're on Unix being stuck with UTF-16 may well not be your idea of a good time.

In addition, many people need differing levels of Unicode support- not everyone needs the complex text layout APIs and such things. So it's easy to see why numerous string classes exist- the Standard one is pretty suck and everybody has different needs from the new ones, with nobody managing to create a single class that can perform lots of Unicode support cross-platform with a pleasant interface.

In my opinion, this is mostly the fault of the C++ Committee for not correctly providing support for Unicode- in 1998 or 2003, maybe it was understandable, but not in C++11. Hopefully in C++17 they will do better.

Title: Why are there so many string classes in the face of std::string?

Body:
It seems to me that many bigger C++ libraries end up creating their own string type. In the client code you either have to use the one from the library (QString, CString, fbstring etc., I'm sure anyone can name a few) or keep converting between the standard type and the one the library uses (which most of the time involves at least one copy).

So, is there a particular misfeature or something wrong about std::string (just like auto_ptr semantics were bad)? Has it changed in C++11?


答:
String is C++'s big embarrassment.

For the first 15years you don't provide a string class at all - forcing every compiler on every platform and every user to create their own.

Then you make something that's confused about whether it's supposed to be a full string  manipulation API or just an STL char container, with some algorithms that duplicate the ones on a std::Vector or are different.

Where an obvious string operation like replace() or mid() involves such a mess of iterators that you need to introduce a new 'auto' keyword to keep the statement fitting on a single page and leads most people to give up on the whole language.

And then you have  unicode 'support' and std::wstring that is just arghh.....

< rant off > thank you - I'm feeling much better now.


问:
HTTP PHP Authentication and Android
I am working on a website for which I hope to have an application for as well. Because of this, I am creating PHP API's which will go into my Database and serve specific data based on the method/function called.

I want to protect these API's from misuse however, and I plan on implementing Authentication Digest to do so. However one of the OS's I want to support is Android. And I know that a malicious user would be able to reverse engineer the Android app and figure out my authentication scheme.

I am left wondering:

Is there a better way to protect these API's from misuse?

Is there a way to prevent a malicious user from reverse engineering the app and potentially seeing the source code for it, enabling them to see my authentication scheme?

If none of these are preventable, then is my only option to have a Username/Password cred specifically for the Android app, and when eventually hacked, change the creds and issue an update for the app?

答:
In my opinion, talking about authentication, you could give a look to OAuth | http://oauth.net/.

I've recently implemented a RESTful service (using other techs, .NET/NancyFX). In my case the mobile app needs access to public available content (the same published in companion website).
In a case like mine the real concern wasn't security but some sort of misuse.

I've protected my service using an API Key: http://yourhost.com/api/{api-key}/xyz. Valid keys are stored in a persistent repository (in my case a mysql instance) and checked on every request. This worked great for me.

You may also find this useful too | https://stackoverflow.com/questions/6004068/restful-api-keys-suggestions.

Title: HTTP PHP Authentication and Android


问:
Pros and cons for open or close sourcing niche type products
One of the products I developed, is really a niche type application (2 or 3 other competitors in the market). Although for the most part, I'm the lone user of these applications, I'm thinking of selling the app right now.

My question is:

Because of the small market share and that it's a niche project would you advise I open or close my application?

答:
As has been mentioned, a niche application may have trouble finding contributors and an open source project without contributors is bad.

You can always easily go from closed source to oepn source, but once opened the source cannot be closed.  At least, not the version that was opened.  You should keep that in mind as you move forward.  Also, should you decide to go open source, carefully read understand and evaluate the various open source licenses and carefully chose the one that is right for your project and you.


答:
I think the role of QA and Development, and the interplay, can vary a lot between organizations. But in general, on my team, I tell joining members to basically pretend like there isn't a QA team, in the sense that they are responsible for the changes they are pushing into production. In turn, our QA team doesn't assume much about developer testing, and does a fair amount of testing the system as a functional whole.

For this reason, our QA team doesn't care all that much about what is and isn't unit tested before they begin testing.

I do think it's helpful for the QA team to understand what the unit tests do and do not cover, at a high level, so that we can collectively work to identify gaps, and areas that might need more rigor. So, maybe your colleague is after a high level summary, as opposed to the gory details.

Title: Is unit testing development or testing?


问:
Is it bad practice to use <?= tag in PHP?
I've come across this PHP tag <?=  ?> recently and I am reluctant to use it, but it itches so hard that I wanted to have your take on it. I know it is bad practice to use short tags <?  ?> and that we should use full tags <?php  ?> instead, but what about this one : <?=  ?>?

It would save some typing and it would be better for code readability, IMO. So instead of this:

```<code><input name="someVar" value="<?php echo $someVar; ?>">
</code>```

I could write it like this, which is cleaner :

```<code><input name="someVar" value="<?= $someVar ?>">
</code>```

Is using this operator frowned upon?

答:
You should definitely try to avoid short form tags, whether it's <? or <?=.

The main technical reason is portability, you can never be sure that the short form tags will work for every given setup, as they can be turned off, lookup the short_open_tag directive. But you can always be absolutely certain that the long form will work everywhere.

It would save some typing and it would be better for code readability, IMO.

That's also a bad habit. I can't really tell you what you find more readable, but I'm feverishly against using code readability as an excuse to save yourself a couple of keystrokes. If you are concerned about readability, you should go for a template engine, this:

```<code><input name="someVar" value="{someVar}">
</code>```

is far more readable from both your examples.

Lastly, it's worth noting that short form tags are explicitly discouraged by major PHP projects, for example PEAR and Zend Framework.

ContentLicense: CC BY-SA 4.0

Body:
You should definitely try to avoid short form tags, whether it's <? or <?=.

The main technical reason is portability, you can never be sure that the short form tags will work for every given setup, as they can be turned off, lookup the short_open_tag directive. But you can always be absolutely certain that the long form will work everywhere.

It would save some typing and it would be better for code readability, IMO.

That's also a bad habit. I can't really tell you what you find more readable, but I'm feverishly against using code readability as an excuse to save yourself a couple of keystrokes. If you are concerned about readability, you should go for a template engine, this:

<input name="someVar" value="{someVar}">

is far more readable from both your examples.

Lastly, it's worth noting that short form tags are explicitly discouraged by major PHP projects, for example PEAR and Zend Framework.


答:
Dusting off my PHP hat

I'd definitely favor the use of <?= $someVar ?> over the more verbose echo (simply personal preference). The only downside AFAIK is for users who are running pre-5.4.0, in which case short_open_tag must be enabled in php.ini.

Now having said that, if your project isn't OS, then it's a moot point. If it is, I'd either document the fact that short_open_tags must be enabled, or use the more portable of the two solutions.

Title: Is it bad practice to use <?= tag in PHP?

Body:
I've come across this PHP tag <?=  ?> recently and I am reluctant to use it, but it itches so hard that I wanted to have your take on it. I know it is bad practice to use short tags <?  ?> and that we should use full tags <?php  ?> instead, but what about this one : <?=  ?>?

It would save some typing and it would be better for code readability, IMO. So instead of this:

```<code><input name="someVar" value="<?php echo $someVar; ?>">
</code>```

I could write it like this, which is cleaner :

```<code><input name="someVar" value="<?= $someVar ?>">
</code>```

Is using this operator frowned upon?


答:
I think that the <?= version is a good/acceptable practice, provided that you only use it for final output of variables and avoid any function-calls or ternary-logic that aren't directly related to the presentation of the data.

It's certainly much better than <? echo($x); ?> everywhere.

Long-term, you may want to look into templating engines such as Smarty.


答: I would say that should be a choice left up to the employee.  One thing I would say is do not force them to use their personal github account if they don't want to.  I was at a company that used GitHub and while it was not a requirement, I personally wanted to create a separate account.  The main reason was to protect my person projects.  I didn't want the company to try to say one of my personal projects was their's because it was under the same github account used for their comapny projects (not sure if that would ever hold up in court however I don't have much faith in the legal system when it comes to things like this).  I think having that clean separate can be a good thing.</p>

Title: Is it advisable to ask employees to create 'work' GitHub accounts?

Body:
I've moved all our company Git repositories to GitHub and now I want to add employees to the projects. Since most employees already have personal GitHub accounts, I'm wondering whether I should ask them to create a work GitHub account. The reason that I'm thinking of doing this is to decrease the chances of unauthorized access to our code base since their personal accounts may be well publicized through their personal activity on the site, increasing chances of targeted attacks. Furthermore, if their personal account is ever compromised it won't mean the whole company code is accessible to the hijacker. Since this will bring the burden of maintaining two accounts for the employees I'm wondering whether it is the correct approach and whether it even makes sense. I would love to hear your opinions on this.

Update
Thanks for all the useful insights. I won't set an answer as accepted because of the subjective nature of the question/answers and since I took the best points from several different answers.

I have decided to go forward this way: I will remind employees that work-related GitHub e-mail notifications will have to be sent to their work e-mail accounts for practical reasons. Therefore it would make more sense to create work GitHub accounts. If they are willing to use their personal GitHub accounts and connect it to their work e-mail accounts then that's fine. In any case, employees will have to agree in written form to a number  of conditions tied to using GitHub. These are related to account security: choosing a secure password using a secure random password generator that is not used with any other account, not accessing GitHub through computers not owned or administered by them, etc. At the end of the day employees will have to decide themselves whether a work account makes more sense for them or not.


答:
Reasons for using short tags:

They are shorter.

Reasons for not using short tags:

They introduce one more configuration gotcha - while you do control the server most of the time in a professional context, if you plan to release your code to the general public, short tags may break unrepairably for people who use it on, say, shared hosting.

They make it way too easy to casually drop un-sanitized strings into your output. This is scary because it may introduce XSS vulnerabilities. While long tags do nothing directly to prevent this, they do signal to the programmer that maybe what they are doing isn't the right thing, and they should start using a template system that automatically handles HTML-encoding for them right now. Outputting dynamic strings with long tags is painful, which is a good (educative) thing.


答:
Writing automated tests is a developer's job; the tests are part of the codebase and should be treated as such - they should be subject to the same code reviews, coding standards, source control discipline, etc., as the rest of the project.

Running said tests is done for two reasons: First, as a tool in guiding the developers. You run tests to verify that the code you have just written does what it is supposed to, you use them as additional documentation, and to verify that changes do not break any existing functionality. If you do real TDD, the tests are also authoritative source of technical specifications. The second reason to use the tests is during QA and deployment. Running all automated tests should be one of the first steps in every round of testing; running automated tests is cheap (virtually no manpower required at all), and it doesn't make much sense to go into manual testing if the automated ones fail.

This means that the responsibilities should be like this:

Developers write automated tests

Developers run individual automated tests as needed, as part of their development workflow

QA runs all automated tests as one of the first stages of testing

If you have a build server, then QA's task (regarding automated tests) boils down to "open the build server's report and verify that everything is green".

Title: Is unit testing development or testing?


答:
To be honest, I think that echoing a result whichever the method is (old or new fashion) is something pretty obsolete while MVC celebrates 33 years already.

I would say that yes, this is a good practice to encapsulate the incoming server (php) data within an XML document and process it in your applicative/client layer, thus, saving you even the idea of using such a tag.


答:
As usual, IANAL, consult a lawyer for legal advice. That said:

No. The default is "all rights reserved". You are not allowed to copy someone else's work without the author's explicit permission, even if the author is unknown.

Works are free for you to use under the following circumstances:

You have written it yourself, and haven't transferred your rights to anyone else (note that in some jurisdictions, all your intellectual property is automatically transferred to your employer, even if the contract doesn't state this explicitly).

The author has explicitly released the work into the public domain. Note that some jurisdictions in the world do not acknowledge this; in those countries, you may still be violating the law (although it is unlikely that the author is going to sue).

The copyright holder is a government institution or similar legal person whose works are in the public domain by law.

The author has given you explicit permission.

The author has released the work under a permissive license (e.g. MIT, Apache, or BSD licenses). You are still bound by that license though.

All the authors have been dead for long enough (where "long enough" means 70 years in many countries, but the figure may differ either way). I doubt you'll see this in the software realm anytime soon, but it's very relevant in arts and music.

Title: Is a project without license public domain?

Body: If a project has no a license or has unknown authors, is it public domain?</p>


问:
.NET Dependency Management Systems
I have some .NET projects that are starting to get large enough to merit looking into Dependency Management solutions, so we don't have to copy binaries from one project to another. Here's what I've found so far:

NPanday is based on a port of Maven. I can't tell how recently it was worked on, but the last release was in May 2011.

NuGet seems to be under active development, and it appears to have support directly from Microsoft. Some people complained that it "only addresses dependency resolution," but I don't know what else it should address, or whether it has added more features since that point. It does appear to have recently added the ability to import binaries as part of the build process so we don't have to commit them to our repositories.

Refix appears to still be in Beta, after having received no attention since Sept 2011.

Would somebody with recent experience using any of these dependency management tools (or any others that work well) share your experience? Is NuGet mature enough to use it for dependency management? If not, what does it lack?

答:
NuGet would likely be my answer. After working the precursor (Nu) which was just sitting on top of RubyGems, I can say that having resources towards something helps. Now once job I ended up with a patched version of the executable because we had a local  repository besides remote ones. I'm not sure if they fixed that problem yet or not, but since they are accepting patches, it should be easy to correct. On all the open source projects in the .NET arena I work on we now do all of through NuGet. It's much easier, though publishing up the chain does take a little while longer.

OpenWrap is an option, but everything needs built. Which is kinda a pain in the butt. If you can't get the project building right it takes a while to deal with. Openwrap has been trying to solve this for a long time and it's still really awkward. Binary only distribution is a lot easier (sometimes)...

The other two I'm not familiar with. So I can't comment on them a ton.

Title: .NET Dependency Management Systems


答: As mentioned consult with a lawyer but in the US and most western countries no. Copyright exists on something regardless of if you explicitly claim it with a (@C) symbol. Generally if you are paid to create the code your employer owns it unless you specified otherwise in your employment contract. If it is made by yourself you are the copyright holder.</p>


问:
What are the key points to evaluate to select a good SMS gateway?
We are planning to add a "SMS verification account" option for our customers. (So we will only send SMS. We do not need a short code.)

We have found several companies who offer SMS gateways through REST APIs (we use PHP).

As we are totally new to the SMS world, we are wondering:

What are the key points to pay attention to/evaluate to select a good SMS gateway?

答:
By no means an exhaustive list, but they key points I learned when I went through the same process:

Price per SMS (obvious). However, some gateways give better bulk discounts. If you expect to send a lot of SMSs, this could become important.

Carrier coverage Not all gateways support all carriers. Make sure they cover the ones you care about.

International coverage Many gateways are region-specific. Make sure they cover all the geographies you care about.

Integration work Older gateways have a contracts process, followed by an integration call, followed by a setup process. This can all take weeks. Newer ones like Twilio can have you up and running in a few minutes without ever needing to talk to a human.

Support When something isn't working, what's the procedure for getting help? Is there someone you can call, or at least email?

Performance / Uptime Honestly, they're probably all solid in this respect. But check references. A good gateway will give you a list of customers you can call to see how their experiences were.

MMS (multi media message) support If you ever want to send multi media messages. At the time, the only company I found who could do this on all carriers was OpenMarket. May not matter to your, but if it does it greatly restricts your choices.

Ultimately, we went with Twilio and couldn't be happier. Their carrier coverage in the US is great, and the amount of effort to get up and running was trivial.

Not sure what the status of their international SMSs - if that's important to you, do some research on that in particular. They also didn't support MMS last I checked, but it sounds like that doesn't matter for your application.


答: I don't think not reading language specs themselves keeps anyone from being a good programmer, but reading them certainly wouldn't hurt. Reading specs straight through is boring as heck, and I don't blame anyone for not doing so, but reading specs in pieces when working on related items isn't so bad and I find I retain more over time doing it that way anyway.</p>

Title: Do you ever read language specs?


问:
How can I convince a project manager that there is no way to solve all the compatibility issues?
I have been working on this project for more than a year now, and we are close to release, the project manager wants the product to be perfect and working in every single aspect.

I like that and I love working under the perfection idea, but it seems he is delaying the launch too much because of compatibility issues, he wants the product to work in every single installation, every single configuration possible, and in most cases, the product just works without issues when it's on the hands of the client.

UPDATE :
yes the product doesn't work properly when there are conflicts, for example, other products that don't use guidelines nor standards to load libraries (causes double library load which leads to failure), cache is another example and so on.....
but we warn the clients about the conflict before purchasing and help them fixing it after purchasing

I've tried to explain it by giving some examples on major products, he understands the situation, but can not believe that it is near impossible (if it is not impossible) to do what he wants.

Hope it is clarified enough for the community to answer.

答:
ask him/her to make a list of all possible compatibility issues and situations; note that a complete list cannot be created, and suggest that the number of possible compatibility issues is infinite and not all possible incompatibilities are worth delaying launch for; concentrate on the ones most likely to occur for your largest market segment, and pick up the rest as they happen.

a company that releases a reasonable quality product and then responds quickly to problems is far more likely to succeed than one that never releases a product at all!


答:
Like Steven says, have them list all the possible compatibility scenarios, identify what works and what doesn't.  Then identify your exact constraints for the failing scenarios, estimate the cost to overcome those constraints for each scenario (not just in development cost, but in maintenance & support costs as well), then push it back as a business decision as to what they are willing to pay for.

Edit: As far as your compatibility issues go; Try to add code to validate, then warn the user if it is not compatible with your supported environment.  But make sure everything works with your supported environment.

Title: How can I convince a project manager that there is no way to solve all the compatibility issues?

Body:
I have been working on this project for more than a year now, and we are close to release, the project manager wants the product to be perfect and working in every single aspect.

I like that and I love working under the perfection idea, but it seems he is delaying the launch too much because of compatibility issues, he wants the product to work in every single installation, every single configuration possible, and in most cases, the product just works without issues when it's on the hands of the client.

UPDATE :
yes the product doesn't work properly when there are conflicts, for example, other products that don't use guidelines nor standards to load libraries (causes double library load which leads to failure), cache is another example and so on.....
but we warn the clients about the conflict before purchasing and help them fixing it after purchasing

I've tried to explain it by giving some examples on major products, he understands the situation, but can not believe that it is near impossible (if it is not impossible) to do what he wants.

Hope it is clarified enough for the community to answer.


答: Introduce your PM to the vaporware concept. Though, if you are still finding cases where your product is not working as intended that are easy to find/reasonably expect-able then you don't have a quality shippable product. There is becoming more and more of a mindset in the industry to ship it now, and fix it later, and pushing back against that isn't necessarily a bad thing. A reputation for releasing quality software the first time is a lot better than a reputation of quickly spewing out crap and patching it up later.</p>


答:
Another way is to find a middle ground that's acceptable to both of you as a solution.  What happens when an incompatibility is encountered?  If your software crashes, then that's likely unacceptable regardless if you document it or not.  If your software graciously terminates or prevents the incompatibility (for example, displaying an error message that the software is incompatible and suggesting possible alternatives), then that may be a "solution" that's amenable to the project manager.

In other words, there may be more than one solution to the problem.  You may need to negotiate with your project manager to figure out the proper action that'll get the product launched.


答:
It's hard to beat Twilio. As Rob suggests, it's very easy to get up and running with Twilio. Their cost per text are just 1 cent. You can also get dedicated numbers for just 1USD per month.

Twilio can receive inbound texts from your customer too, which you will need. That could rule out some providers.

It's worth mentioning that you could also hook up a mobile phone to a pc and use some software to send and receive sms and mms. This could be cost effective if you have a sim card that has a number of free texts per month with your provider. Inbound texts are free this way too.

Title: What are the key points to evaluate to select a good SMS gateway?

Body:
We are planning to add a "SMS verification account" option for our customers. (So we will only send SMS. We do not need a short code.)

We have found several companies who offer SMS gateways through REST APIs (we use PHP).

As we are totally new to the SMS world, we are wondering:

What are the key points to pay attention to/evaluate to select a good SMS gateway?


答: I learned C# from the language spec, which I believe was floated at least a couple of years before Visual Studio.NET was released. But that was more of a matter of just taking note of what was different from Java - I don't know if it would be such a good way to learn a language that was a lot different from what I already knew.</p>

Title: Do you ever read language specs?


答:
My experience is that it is best left to the BA (Business Analyst) to write the GWT(Given-When-Then)s(experience using SpecFlow).  The BA can translate the Customer requirements  into the GWT and the business can read it.  Customers understand the systems but they do not have the tech think to write the requirements in a way that we can use.

Ideally the BA would write some GWT, I would make some revisions, the BA would review/revise repeat until the BA and business was confident in the coverage.  Practically the BA would give me a rough draft that I would clean up and make work.  The Business shrugs it off saying sure then wonders why it didn't cover some areas no one thought of.


答: Such decisions should be made from a business point of view. Estimate how much would it cost to implement some compatibility feature, and what would the benefits be. Then just decide, if you really need it.</p>


问:
When do I need to use a framework?
I am new to web programming and at this time I am learning about PHP. I would like to know when do I need to use a PHP framework such as CakePHP? What are things that this and other similar PHP frameworks offer for me?  And is it really important to use a framework to be a professional?

And can I create my own framework to provide the features I like into it?

答: When you find yourself doing the same thing over and over again, look around and see if there is a framework that does the same redundant stuff you would have ended up doing on your own. Don't just use a framework because of the hype. I personally like CodeIgniter and Rasmus Lerdorf's "no-framework PHP MVC framework" http://toys.lerdorf.com/archives/38-The-no-framework-PHP-MVC-framework.html</p>

Title: When do I need to use a framework?


答:
History

Before the misinformation train goes too far out of the station, there are a bunch of things you need to understand about PHP short tags.

The primary issue with PHP's short tags is that XML managed to choose a tag (<?) that was already used by PHP.

With the option enabled, you weren't able to raw output the xml declaration without getting syntax errors:

```<code><?xml version="1.0" encoding="UTF-8" ?>
</code>```

This is a big issue when you consider how common XML parsing and management is.

What about <?=?

Although <? causes conflicts with xml, <?= does not. Unfortunately, the options to toggle it on and off were tied to short_open_tag, which meant that to get the benefit of the short echo tag (<?=), you had to deal with the issues of the short open tag (<?). The issues associated with the short open tag were much greater than the benefits from the short echo tag, so you'll find a million and a half recommendations to turn short_open_tag off, which you should.

With PHP 5.4, however the short echo tag has been re-enabled separate from the short_open_tag option. I see this as a direct endorsement of the convenience of <?=, as there's nothing fundamentally wrong with it in and of itself.

The problem is that you can't guarantee that you'll have <?= if you're trying to write code that could work in a wider range of PHP versions.

ok, so now that that's all out of the way

Should you use <?=?

Body:
History

Before the misinformation train goes too far out of the station, there are a bunch of things you need to understand about PHP short tags.

The primary issue with PHP's short tags is that XML managed to choose a tag (<?) that was already used by PHP.

With the option enabled, you weren't able to raw output the xml declaration without getting syntax errors:

<?xml version="1.0" encoding="UTF-8" ?>

This is a big issue when you consider how common XML parsing and management is.

What about <?=?

Although <? causes conflicts with xml, <?= does not. Unfortunately, the options to toggle it on and off were tied to short_open_tag, which meant that to get the benefit of the short echo tag (<?=), you had to deal with the issues of the short open tag (<?). The issues associated with the short open tag were much greater than the benefits from the short echo tag, so you'll find a million and a half recommendations to turn short_open_tag off, which you should.

With PHP 5.4, however the short echo tag has been re-enabled separate from the short_open_tag option. I see this as a direct endorsement of the convenience of <?=, as there's nothing fundamentally wrong with it in and of itself.

The problem is that you can't guarantee that you'll have <?= if you're trying to write code that could work in a wider range of PHP versions.

ok, so now that that's all out of the way

Should you use <?=?


问:
How do you keep code with continuations/callbacks readable?
Summary: Are there some well-established best-practice patterns that I can follow to keep my code readable in spite of using asynchronous code and callbacks?

I'm using a JavaScript library that does a lot of stuff asynchronously and heavily relies on callbacks. It seems that writing a simple "load A, load B, ..." method becomes quite complicated and hard to follow using this pattern.

Let me give a (contrived) example. Let's say I want to load a bunch of images (asynchronously) from a remote web server. In C#/async, I'd write something like this:

```<code>disableStartButton();

foreach (myData in myRepository) {
    var result = await LoadImageAsync("http://my/server/GetImage?" + myData.Id);
    if (result.Success) {
        myData.Image = result.Data;
    } else {
        write("error loading Image " + myData.Id);
        return;
    }
}

write("success");
enableStartButton();
</code>```

The code layout follows the "flow of events": First, the start button is disabled, then the images are loaded (await ensures that the UI stays responsive) and then the start button is enabled again.

In JavaScript, using callbacks, I came up with this:

```<code>disableStartButton();

var count = myRepository.length;

function loadImage(i) {
    if (i >= count) {
        write("success");
        enableStartButton();
        return;
    }

    myData = myRepository[i];
    LoadImageAsync("http://my/server/GetImage?" + myData.Id,
        function(success, data) {
            if (success) {
                myData.Image = data;
            } else {
                write("error loading image " + myData.Id);
                return;
            }
            loadImage(i+1);
        }
    );
}

loadImage(0);
</code>```

I think the drawbacks are obvious: I had to rework the loop into a recursive call, the code that's supposed to be executed in the end is somewhere in the middle of the function, the code starting the download (loadImage(0)) is at the very bottom, and it's generally much harder to read and follow. It's ugly and I don't like it.

I'm sure that I'm not the first one to encounter this problem, so my question is: Are there some well-established best-practice patterns that I can follow to keep my code readable in spite of using asynchronous code and callbacks?

答:
Took me a bit to decode why you're doing it this way, but I think this might be close to what you want?

```<code>function loadImages() {
   var countRemainingToLoad = 0;
   var failures = 0;

   myRepository.each(function (myData) {
      countRemainingToLoad++;

      LoadImageAsync("http://my/server/GetImage?" + myData.Id,
        function(success, data) {
            if (success) {
                myData.Image = data;
            } else {
                write("error loading image " + myData.Id);
                failures++;
            }
            countRemainingToLoad--;
            if (countRemainingToLoad == 0 && failures == 0) {
                enableStartButton();
            }
        }
    );
}

disableStartButton();
loadImages();
</code>```

It first off as many AJAX requests as it can do simultaneously, and it waits until all of them are completed before enabling the Start button.  This will be faster than a sequential wait, and, I think, is much easier to follow.

EDIT:  Note that this assumes you have .each() available, and that myRepository is an array.  Be careful what loop iteration you use here in place of that, if it isn't available - this one takes advantage of closure properties for the callback.  I'm not sure what you have available, though, since LoadImageAsync seems to be part of a specialized library - I see no results in Google.

Body:
Took me a bit to decode why you're doing it this way, but I think this might be close to what you want?

function loadImages() {
   var countRemainingToLoad = 0;
   var failures = 0;

   myRepository.each(function (myData) {
      countRemainingToLoad++;

      LoadImageAsync("http://my/server/GetImage?" + myData.Id,
        function(success, data) {
            if (success) {
                myData.Image = data;
            } else {
                write("error loading image " + myData.Id);
                failures++;
            }
            countRemainingToLoad--;
            if (countRemainingToLoad == 0 && failures == 0) {
                enableStartButton();
            }
        }
    );
}

disableStartButton();
loadImages();

It first off as many AJAX requests as it can do simultaneously, and it waits until all of them are completed before enabling the Start button.  This will be faster than a sequential wait, and, I think, is much easier to follow.

EDIT:  Note that this assumes you have .each() available, and that myRepository is an array.  Be careful what loop iteration you use here in place of that, if it isn't available - this one takes advantage of closure properties for the callback.  I'm not sure what you have available, though, since LoadImageAsync seems to be part of a specialized library - I see no results in Google.


问:
Given the presentation model pattern, is the view, presentation model, or model responsible for adding child views to an existing view at runtime?
I am building a Flex 4 based application using the presentation model design pattern. This application will have several different components to it as shown in the image below.

The MainView and DashboardView will always be visible and they each have corresponding presentation models and models as necessary. These views are easily created by declaring their MXML in the application root.

```<code><s:HGroup width="100%" height="100%">
    <MainView width="75% height="100%"/>
    <DashboardView width="25%" height="100%"/>
</s:HGroup>
</code>```

There will also be many WidgetViewN views that can be added to the DashboardView by the user at runtime through a simple drop down list. This will need to be accomplished via ActionScript.

The drop down list should always show what WidgetViewN has already been added to the DashboardView. Therefore some state about which WidgetViewN's have been created needs to be stored. Since the list of available WidgetViewN and which ones are added to the DashboardView also need to be accessible from other components in the system I think this needs to be stored in a Model object.

My understanding of the presentation model design pattern is that the view is very lean. It contains as close to zero logic as is practical. The view communicates/binds to the presentation model which contains all the necessary view logic. The presentation model is effectively an abstract representation of the view which supports low coupling and eases testability. The presentation model may have one or more models injected in in order to display the necessary information. The models themselves contain no view logic whatsoever.

So I have a several questions around this design.

Who should be responsible for creating the WidgetViewN components and adding these to the DashboardView? Is this the responsibility of the DashboardView, DashboardPresentationModel, DashboardModel or something else entirely? It seems like the DashboardPresentationModel would be responsible for creating/adding/removing any child views from it's display but how do you do this without passing in the DashboardView to the DashboardPresentationModel?

The list of available and visible WidgetViewN components needs to be accessible to a few other components as well. Is it okay for a reference to a WidgetViewN to be stored/referenced in a model?

Are there any good examples of the presentation model pattern online in Flex that also include creating child views at runtime?

答:
Per Martin Fowler's explanation of the Presentation Model ( http://martinfowler.com/eaaDev/PresentationModel.html ), I believe the answers are as follows:

FWIW, I'm not an expert in the Presentation Model pattern.

1) Would be in your DashboardPresentationModel since that holds the presentation logic for your program.  That logic would then determine whether the widget is allowed or not, as well as making the subsequent instantiation.

2) If I understand your layout correctly, then I believe the answer is no.  The PresentationModel should contain that information and, if necessary, provide methods for accessing that information.

3) Sorry, don't know.


问:
Where can I safely learn about computer security?
I find it really hard to find resources about computer security. I asked questions on message boards about key loggers and viruses and I got negative assumption from people assuming the the worse. Also, I don't think that I can trust random message boards.

I know that it is a broad topic, but are there any good websites that I can follow and learn from that are targeted to beginner with some samples?

I am a developer (or at least want to be one) and I have a CS degree if that helps.

答:
Honestly, 90% of the "hacking" books and resources out there are junk. While they may give you insight into how script kiddies work, most don't go much further than that.

The only true way to understand computer security is to understand systems (software and/or hardware in some cases) very thoroughly. In wholly understanding a given system, you will also be able to identify its weak points and vulnerabilities.

Seeing as how you have a CS degree, you're (hopefully) not afraid to dig into code. Take a look at some OS software and look for potential vulnerabilities (SQL injection attacks, buffer overflows or any other category as listed in the OWASP vulnerability category list).

Other good resources are:

National Vulnerability Database

Security Focus

The Open Source Vulnerability Database

OWASP

Of course, to keep abreast of the most recent developments, you'll want to get yourself onto the Bugtraq mailing list.

Having said all that, it's been quite some time since I invested any time into security-related matters, so there may be other resources that I'm not aware of.


问:
Can I say that ASP.NET is compiled?
You know that C# is a compiled language. But when we develop web applications we use ASP.NET + C#, in this case can we say that ASP.NET is compiled? </p>

<p>If ASP.NET is not compiled does it affect the performance of C# when ASP.NET and C# works beside each other to develop web applications? </p>

答:
I assume that you are referring to the contents of the actual .aspx page containing the markup?

The .aspx page is not directly compiled. Instead, at runtime the ASP.NET engine generates C# code based on this file, places it in a folder called, "Temporary ASP.NET Files", and then compiles that C# code. So yes, it is compiled.

There is a bit about it in this post: https://stackoverflow.com/q/2374086/158483

You can also enable precompilation to make this compilation already at compile time. But it is still being compiled if you don't enable precompilation. It is just being compiled much later.

Title: Can I say that ASP.NET is compiled?


问:
How should I start refactoring my mostly-procedural C++ application?
We have a program written in C++ that is mostly procedural, but we do use some C++ containers from the standard library (vector, map, list, etc).   We are constantly making changes to this code, so I wouldn't call it a stagnant piece of legacy code that we can just wrap up.

There are a lot of issues with this code making it harder and harder for us to make changes, but I see the three biggest issues being:

Many of the functions do more (way more) than one thing

We violate the DRY principle left and right

We have global variables and global state up the wazoo.

I was thinking we should attack areas 1 and 2 first.  Along the way, we can "de-globalize" our smaller functions from the bottom up by passing in information that is currently global as parameters to the lower level functions from the higher level functions and then concentrate on figuring out how to removing the need for global variables as much as possible.

I just finished reading Code Complete 2 and The Pragmatic Programmer, and I learned a lot, but I am feeling overwhelmed.  I would like to implement unit testing, change from a procedural to OO approach, automate testing, use a better logging system, fully validate all input, implement better error handling and many other things, but I know if we start all this at once, we would screw ourselves.  I am thinking the three I listed are the most important to start with.

Any suggestions are welcome.

We are a team of two programmers mostly with experience with in-house scripting.  It is going to be hard to justify taking the time to refactor, especially if we can't bill the time to a client.  Believe it or not, this project has been successful enough to keep us busy full time and also keep several consultants busy using it for client work.

答:
First, try to get rid of all warnings in the compilation of your program. Make sure you compile with something like the -Wall flag. Getting rid of warnings is a commonly overlooked problem that needs attention.

Next, try to get your hands on a C++ static analyzer. Running the static analyzer on your code will produce a list of problems with your code, and a lot of the time the problems will be ordered by severity. Try to solve the most serious violations first, and use the static analyzer to guide your refactoring.


答:
There are many answers to the question but here are some:

Legacy.  Many string libraries and classes were written PRIOR to the existence of std::string.

For compatibility with code in C.  The library std::string is C++ where as there are other string libraries which work with C and C++.

To avoid dynamic allocations.  The library std::string uses dynamic allocation and may not be suitable for embedded systems, interrupt or real-time related code, or for low-level functionality.

Templates. The library std::string is based on templates.  Until fairly recently a number of C++ compilers had poorly performing or even buggy template support.  Unfortunately, I work in an industry that uses a lot of custom tools and one of our toolchains from a major player in the industry doesn't "officially" 100% support C++ (with buggy stuff being templates et al).

There are probably many more valid reasons as well.


答:
I'd start with problem #3 first. It's great to refactor your functions to avoid DRY and SRP, but when you have to refactor them again to deal with getting rid of the globals, it's not much point. If you simply pass an int to every function in your program, it's really no different to real global state. You need to create solid interfaces and encapsulation. In addition, it's pretty hard to refactor any function that has a global dependency.

The trick here is going to be, isolate a group of related functions, and refactor them until they're high quality, and then go again on another group. The key here is to break their interfaces up so that you can, in future, refactor them individually if you need to.

As for better error handling, correct use of classes and exceptions will bring that automatically, as it were.

In addition, I would create a new design for the program from scratch, and refactor towards it, so that the end result is not a mess of modules that are all individually coded well but make no sense as a group.

Refactoring can be best expressed as paying off technical debt which was accrued when the program was first created- in other words, in the future, you are going to have to do this work anyway to implement some feature or fix some bug. In the long run, you are saving time and money.

Title: How should I start refactoring my mostly-procedural C++ application?

Body:
We have a program written in C++ that is mostly procedural, but we do use some C++ containers from the standard library (vector, map, list, etc).   We are constantly making changes to this code, so I wouldn't call it a stagnant piece of legacy code that we can just wrap up.

There are a lot of issues with this code making it harder and harder for us to make changes, but I see the three biggest issues being:

Many of the functions do more (way more) than one thing

We violate the DRY principle left and right

We have global variables and global state up the wazoo.

I was thinking we should attack areas 1 and 2 first.  Along the way, we can "de-globalize" our smaller functions from the bottom up by passing in information that is currently global as parameters to the lower level functions from the higher level functions and then concentrate on figuring out how to removing the need for global variables as much as possible.

I just finished reading Code Complete 2 and The Pragmatic Programmer, and I learned a lot, but I am feeling overwhelmed.  I would like to implement unit testing, change from a procedural to OO approach, automate testing, use a better logging system, fully validate all input, implement better error handling and many other things, but I know if we start all this at once, we would screw ourselves.  I am thinking the three I listed are the most important to start with.

Any suggestions are welcome.

We are a team of two programmers mostly with experience with in-house scripting.  It is going to be hard to justify taking the time to refactor, especially if we can't bill the time to a client.  Believe it or not, this project has been successful enough to keep us busy full time and also keep several consultants busy using it for client work.


答:
My advice would be to be very very careful not to break something that works!

Look on this as a long term incremental project, improve code in the area that is relevant to a current change request and as far as possible leave the rest alone.

Don't get rid of global's just because they are global. Some data is naturally global -- time of day, run number, business date, connection status, shutdown requested etc.

The DRY principal applies mostly to development, once the code has been repeated it makes very little difference until you need to make a major change to the repeated code. So leave this stuff alone until it requires a major change.

Many functions that do more than one thing. -- welcome to the real world. Business requirments are never as simple as the ones you see in the text books, and, are often an amalgam of complex interdependent functionality. If you see a case where a function can be split cleanly into two separate simpler functions then jump on it, but, don't expect to find too many.


问:
How to unit test a jsp file?
I'm developing a Java 6 EE application and I'm testing my jsp code with another one with a testing version of the function calls and code used in the original one but it seems loose and impractical. Is there a good way to accomplish this kind of testing?</p>

答:
If you haven't read about MVC (model view controller), do so.  You shouldn't have code in a JSP, just display.  Putting code in JSP is very 1900's.

Seriously though, if there is no code in the JSP, you aren't testing the JSP.  You are testing the action/flow.  Then you could use HttpUnit or Selenium.  The big difference is that Selenium tests from a real browser.

Title: How to unit test a jsp file?


答:
try to externalize the functional code of the servlet to test it outside of a servlet context with real unit tests

test the servlet endpoints with tools like:

HTTPUnit

HtmlUnit

Selenium

Cactus

JspTest

...

Title: How to unit test a jsp file?

Body: I'm developing a Java 6 EE application and I'm testing my jsp code with another one with a testing version of the function calls and code used in the original one but it seems loose and impractical. Is there a good way to accomplish this kind of testing?</p>


问:
Is programming or computer science in general, all about algorithms?
As a grad student, I find it more and more common for prestigious companies (like Google, Facebook, Microsoft,...) to put algorithm questions in their test and interviews. A few startups I applied to also asked about algorithms. I wonder if algorithms fluency is the most important thing for software developer in those companies?

If the answer being yes, what are the best method or resources for one to learn & practice about algorithms effectively? I can't seem to get interested in solving seemingly too complicated problems found in most textbook or websites. Though easily understand basic algorithms (like quicksort, bubblesort,...), I find it immensely difficult to remember and reuse them later.

Thanks.

P/S: If you ask me what I like, it's building good softwares to solve users' problems innovatively. I suppose that does not necessarily mean the software has to be very complicated.

答:
Yes.

Computer Science is mostly algorithms (by percentage).

No.

But that is the "Science" of computers. The most common application of Computer Science is Software Engineering. Software Engineering is not mainly algorithms. It's mainly about the art of creating, the pursuit of perfection, and is centered around positively affecting the lives of real people who exist today. While Computer Science may share some of the same motivation, it is a far cry from Software Engineering.

Ask a tenured professor at a major Computer Science University what the most critical thing to understand about programming is, and they will likely tell you "algorithms and data structures"

Ask a senior developer at a major software company what the most critical thing to understand about programming is, and they will likely tell you, "learning to delight customers" (implied in that is understanding agile, thinking like a customer, shipping on time and continuously, making things that work, etc)

Might seem like semantics, but from my understanding the two are remarkably different both in practice and theory.


问:
Do reactive extensions and ETL go together?
I don't fully understand reactive extensions, but my inital reading caused me think about the ETL code I have.

Right now its basically a workflow to to perform various operations in a certain sequence based on conditions it find as it progresses.

I can also imagine an event driven way such that only a small amount of imperative logic causes a chain reaction to occur.

Of course I don't need a new type of programming model to make an event driven collaboration like that.

Just the same I am wondering if ETL is a good fit for potentially exploring Rx further.

Is my connection in a valid direction even? If not, could you briefly correct the error in my logic?

答: My first instinct is to say no: Rx is about observable collections and asynchronous programming, whereas ETL is about dynamic data mapping and extraction.  I don't see how they are related at all.</p>