问:
Finding next free IP in a network
I have an IP network and want to automatically find a free IP address to provision a new server. Due to frequent server additions/removals the used IPs might be quite fragmented over the whole address space. To effectively check if an IP is free I have to ping and ask the DNS system, which is considered expensive. So I want to minimise these lookups and store some information about used/free addresses in a relational database. This should give me good candidates and I only have to do a few such lookups.

The question is how to do so in a most simple and efficient way that SQL can handle?

One first idea was to generate all possible addresses and store them in the database. Used ones just get the use column set to true. Then just make a SQL query that returns like the first 10 addresses where the use value is false. Looks fairly simple to get a new address. But this approach could become a problem for big networks. Also I have to generate and remove unused addresses for every network change.

If I only store the used addresses I don't see how to make a query that returns me free addresses. I have to retrieve the whole list and implement the logic on the client. But I was hoping I could off-load that to the database server.

Are there any better alternatives? Scan for free addresses regularly and only store a few ones? Sort the list of used addresses, maybe in a tree like structure where the non-leafs hold some information about free addresses in their child segment? These solutions seem rather complicated to me. I would prefer a simple algorithm without any extra running scanners/generators, and then in the worst case I have to fall back to some other method.

Is there anything SQL can provide me with? Like give me the smallest free element in a sorted list of integers?

Cheers.

答:
An effective and efficient solution to this problem will most likely require both a business process and a technical component. The activity has two tasks: a) getting an IP and b) returning an IP.

In order for the solution to provide an IP it has to know which IP addresses are being managed and, of these, which are taken/available. When a previously received IP is no longer used by the user, it must be returned to the set of managed IPs.

You'll probably have a few challenges:

which networks (subnets, IP ranges) are being managed?

how do you create a baseline of which IPs are being used?

how do you enforce check-out and check-in of addresses?

how are IPs assigned on the network (static, dynamic)?

Let's make it a bit more concrete with an example:

Assume we have a subnet, say, 192.168.1.0/24. You might want to reserve the IP 192.168.1.1 for the gateway. The rest could be part of the pool. (Don't forget to exclude the broadcast address 192.168.1.255 as well.)

Up until now people have just grabbed random addresses and tried it. If it worked they kept it, if not they tried another one. So as of today we have no idea which ones are being used and which ones are free. In order to get our baseline we could do any number of the things you mentioned: pings, DNS lookups, etc. Some systems might not respond to pings (e.g. because of packet filters, Windows firewall, etc), the DNS server might not be current for whatever reason ("it was supposed to be just a quick test, I didn't need a DNS entry"), and so on. Probably the most reliable way to check if an IP is in use is to do a ping and/or a port scan. A ping is quick, but a port scan is quite slow, but doing both will give you some confidence about the state of the world. You could run this discovery phase for a week or two to account for hosts that are temporarily offline -- assuming they'll pop up in that timeframe. If they don't, you run the risk of getting a duplicate on the network. If possible, find the old host that's offline and pull the network connection -- leave a note explaining why.

Prior to this scan, let all the IP requestors know what's going on. Ask them to volunteer which IPs they're using and start recording stuff. Furthermore, tell them to record any new IPs they check out from that day. Use something like a Google Docs spreadsheet or whatever -- it supports simultaneous users so it'd be good for this.

All right, eventually the baseline finishes and now you'll also have a peer-sourced spreadsheet with some data. Consolidate the two and that'll be your truth copy. Now your business process kicks in. Any IP that is checked out must be checked in after use. Record whatever information is necessary to effectively manage the check-out and check-in tasks.

One way to phase out the old "junk in the trunk" (i.e. IPs acquired prior to this new process) could be to create static entries in your DHCP server for these. This set would shrink over time as they come off the lease. The rest of the addresses, the free ones, would be in the DHCP pool and could be checked out and checked in as per standard DHCP. If somebody can't use DHCP for whatever reason, you'd simply create a static entry as with the old addresses. DHCP can also be automatically integrated with DNS so that they're automatically registered and users would use names and not IPs to reference them. (pfSense does this with the stock DHCP server and DNS server/Unbound DNS.)

You can use any data store (including SQL) to manage the check-out and check-in, but there's a tradeoff between how much meta-data you need (and the work required)  versus how much you get for free from the DHCP/DNS server. But you can certainly write some script/program to automate this, especially on Unix since you'll likely be modifying text files and calling scripts to reload the changes.

Title: Finding next free IP in a network


问:
Are there programming languages that allow you to do set arithmetic on types?
Out of curiosity, are there languages that allow you to do set arithmetic on types to create new types? Something like:

```<code>interface A {
  void a();
  void b();
}

interface B {
  void b();
  void c();
}

interface C = A & B; // has b()
interface D = A | B; // has a(), b() and c()
interface E = (A & B) ^ B; // has c()
</code>```

I know that in some languages these ideas can be expressed (i.e., Java has List<Comparable & Serializable> for the union of the interfaces) but I've never heard of a language that supports type arithmetic. Thanks!

答:
Yes, Ceylon is a language with ad hoc union and intersection types, as described in this chapter from the Ceylon tour:

```<code>http://ceylon-lang.org/documentation/1.0/tour/types/
</code>```

It's amazing the number of cool idioms you get out of this. Here's one interesting example I blogged recently. And here's a short presentation where I quickly gloss over several simple idioms.

Even better, union/intersection types are the "missing link" that makes generic type argument inference really work right in Ceylon as opposed to other languages which combine subtype and parametric polymorphism.

Note that there are limitations to this sort of "type arithmetic", as you've described it. For example, you can't have a set complement operator at the type level, at least not without introducing undecidability.

HTH

ContentLicense: CC BY-SA 3.0

Body:
Yes, Ceylon is a language with ad hoc union and intersection types, as described in this chapter from the Ceylon tour:

http://ceylon-lang.org/documentation/1.0/tour/types/

It's amazing the number of cool idioms you get out of this. Here's one interesting example I blogged recently. And here's a short presentation where I quickly gloss over several simple idioms.

Even better, union/intersection types are the "missing link" that makes generic type argument inference really work right in Ceylon as opposed to other languages which combine subtype and parametric polymorphism.

Note that there are limitations to this sort of "type arithmetic", as you've described it. For example, you can't have a set complement operator at the type level, at least not without introducing undecidability.

HTH


问:
Does a team of developers need a manager?
Background:

I'm currently part of a team of four: 1 manager, 1 senior developer and 2 developers. We do a range of bespoke in-house systems / projects (e.g. 6-8 weeks) for an organisation of around 3500 staff, as well as all the maintenance and support required from the systems that have been created before. There is not enough of us to do all the work that is potentially coming our way - we're understaffed. Management acknowledge this, but budget restraints limit our ability to recruit additional members to the team (even if we make the salary back in savings).

The Change

This leaves us where we are now. Our manager is due to leave his role for pastures new, leaving a vacancy in the team. Management are using this opportunity to restructure our team which would see the team manager role replaced by another developer and another senior developer. Their logic being that we need more developers, so here's a way of funding it (one of the roles is partially funded from another vacant post).

The team would have no direct line manager and the roles and responsibilities would be divided up between the seniors and the (relatively new to post) service manager (a non-technical role with little-to-no development knowledge/experience whose focus is shared amongst a number of other teams and individuals) - who would be our next actual manager up the food chain.

I guess the final question is:

Is it possible to run a development team without an manager? Have you had experience of this? And what things could go wrong / could be of benefit to us?

I'd ideally like to "see the light" and the benefits of doing things this way, or come up with some points for argument against it.

答:
The benefits of having a manager depends on the role they are playing for your team. So, it really comes down to the role needed for the team:

Do you need someone who has the authority to resolve disputes between team members and keep the team focused on delivering good quality work on time?

Or do you need someone to provide air cover as mentioned in a top answer? Manage schedules, decide priorities, intervene between upper management and the team, etc.

So, do you need that? Can the people in the positions you noted do this for you? If so, then you're fine. If not, you're probably headed towards disaster.

Source: personal experience with group projects and managed and unmanaged teams.


问:
How do you format arrays within parameters?
I'm talking about something like this:

```<code>echo $form->input('general_addresss', array(
            'label' => 'Where will you go today?'
            'format' => array('before', 'input', 'after', 'label', 'after', 'error')
            ));
</code>```

Do you start with one array parameter, then break a line? If it can't fit on a line, do you immediately break a line?

After of which, do you do a set number of tabs over? What happens if an array within an array has lots of properties?

Is there any particular guide you follow?

答:
I would generally do something like this:

```<code>array('before',
      'input',
      'after',
      'label',
      'after',
      'error')
</code>```

Although I don't know of any particular standard that spells out what "should" be done.

ContentLicense: CC BY-SA 2.5

Body:
I would generally do something like this:

array('before',
      'input',
      'after',
      'label',
      'after',
      'error')

Although I don't know of any particular standard that spells out what "should" be done.


问:
What is the norm for introducing new hires to a code base?
After college I worked at one company for 6 months, and I've just now joined another one, bringing the grand total in my career so far to two.

So the first company had a few hundred thousand lines of code, maybe, across a couple hundred files. There was absolutely no introduction to where to start learning the organization of the code base...just, "Here, go find the source of this bug."

It was horrifically intimidating. I did slowly start to find my way around the front end, but 6 months in I was only just starting to be introduced to the server-side code. I was really happy to leave the company...I was relatively terrified of trying to find my way around the back end, which was by far the larger part of the code.

(I'm a front end developer whose work occasionally requires me to make minor modifications to the back end.)

But this new company...it's a big one, focused around a website...think Amazon. 2000 employees. I would estimate millions of lines of code but there's no way for me to know for sure. One of my coworkers showed me a 3-dimensional graph of the file dependencies...I almost fainted. It looked like this:

The coworker was chuckling fondly as he rotated it and zoomed around.

Yet again, there is no guide, no introduction, just....here you go, get coding.

I am horrified and very stressed. The job seems great in every way besides this, and I am quickly starting to worry that I am not competent as I seem to be the only person who finds this intimidating.

What are other people's experience with this scenario? Is it just me? What have you done in the past? How long does it take you to get a firm grasp on things? I have asked my coworkers this question and they said "a couple weeks." A couple weeks to learn a thousand plus files, hundreds or thousands of lines long each? Am I incompetent? Just say it.

答:
Encapsulation is a wonderful thing.

It means that you're not going to be looking at that entire object graph when you make a change.  You're only going to be looking at a handful of classes, and those classes will be wrapped in unit tests with a very high level of code coverage, so that refactoring a class won't break its basic functionality.  You've got clear, testable requirements, right?

Now, excuse me while I go home to my rolling fields, free-flowing chocolate, and dancing unicorns.


答:
It is not uncommon. At my current job, I was asked to look at the current codebase (~200 dlls, ~500 kloc) and at the end of week 3, present to the boss, architects and team leads the top 10 things wrong with it.

The key thing to remember is that you're new. New people have questions. Ask questions. that will help you get your bearings about where (generally) things live. Once you know generally where things live, and (generally) how things work, then you can dig in to learn enough to do what you need. That investigation is the key skill which will determine your competency.

Few people can learn large codebases in depth, but you should learn the big parts and who to ask when you inevitably run into roadblocks. And with experience, you'll ask less and less because the new code will look eerily like codebases you have worked with in the past.

Title: What is the norm for introducing new hires to a code base?

Body:
After college I worked at one company for 6 months, and I've just now joined another one, bringing the grand total in my career so far to two.

So the first company had a few hundred thousand lines of code, maybe, across a couple hundred files. There was absolutely no introduction to where to start learning the organization of the code base...just, "Here, go find the source of this bug."

It was horrifically intimidating. I did slowly start to find my way around the front end, but 6 months in I was only just starting to be introduced to the server-side code. I was really happy to leave the company...I was relatively terrified of trying to find my way around the back end, which was by far the larger part of the code.

(I'm a front end developer whose work occasionally requires me to make minor modifications to the back end.)

But this new company...it's a big one, focused around a website...think Amazon. 2000 employees. I would estimate millions of lines of code but there's no way for me to know for sure. One of my coworkers showed me a 3-dimensional graph of the file dependencies...I almost fainted. It looked like this:

The coworker was chuckling fondly as he rotated it and zoomed around.

Yet again, there is no guide, no introduction, just....here you go, get coding.

I am horrified and very stressed. The job seems great in every way besides this, and I am quickly starting to worry that I am not competent as I seem to be the only person who finds this intimidating.

What are other people's experience with this scenario? Is it just me? What have you done in the past? How long does it take you to get a firm grasp on things? I have asked my coworkers this question and they said "a couple weeks." A couple weeks to learn a thousand plus files, hundreds or thousands of lines long each? Am I incompetent? Just say it.


答:
For the most part, your experience is what I know as "the norm".

Very often one of your first tasks will be "Go find and fix this bug" and you'll struggle finding your way throughout the source tree (ideally starting at the source code search tool) to search the codebase for the particular error text or something related.

If you have a kind or competent lead then you'll get another bug, or feature, or some work item somewhat related to the last one. The next will also be somewhat related to the other two, and so on as time passes by. One day, someone will reveal to you that they don't have the foggiest idea what the area of code you've been working in does and you'll realize that you are the expert for the particular feature sets that you've been bug fixing for the past n months.

Eventually, you'll get assigned something completely different, and it starts all over again.

The codebase for the product I work on is in the realm of millions of lines of code... I don't know what most of it does - but I generally don't have to.


答:
The best way to tackle this codebase is to not tackle it. That is, forget about understanding it whole. Instead, pick a well-defined goal that is small in scope and implement it.

It could be a small new feature, a bug fix, or increasing test coverage of a class or component  that already has some tests but could use  some more coverage.

Basically, you need to just jump in and do something well-defined and useful.


答:
Other folks have already written some good answers, so I'll just mention them in summary:

DON'T PANIC! This happens to everyone. :)

Ask questions! You aren't expected to understand the entire codebase. It generally isn't humanly possible anyway.

I'll add to those that reading code is a critical skill that you're developing right now. It's rarely approached in a significant way in a classroom environment for practical reasons, so we've all gone through what you are. It's frustrating at the front end, as learning usually is, but you'll get the hang of it through practice and experience.

Good luck, and don't forget to have fun!  :)


答:
"I have asked my coworkers this question and they said "a couple weeks." A COUPLE WEEKS TO LEARN A THOUSAND PLUS FILES, HUNDREDS OR THOUSANDS OF LINES LONG EACH???"

You are panicking and your panic is making you irrational. Slow down, and take a few deep breaths.

Nobody "learns" a large code base in a matter of weeks. In a very large project nobody ever "learns" the whole code base. You learn parts, you specialize, you forget, and you relearn. You use documentation, specs, comments, and software tools to find your way around.  Know your tools: IDE, editor, debugger, build system, VCS, and command line tools like grep.

Being given a bug to fix is a typical learning exercise for a new hire. If they have any sense it will not be a complex bug that touches a lot of code.  Treat everything not directly related to that bug as a black box until you are absolutely forced to delve more deeply into it. Learn just enough to fix that problem, and then go get another problem. Do this a few hundred times and you'll begin to understand how the project is organized.


问:
Is there such a thing as e-commerce without a shopping cart?
Imagine you want to set up a minimalist e-commerce website for a "lemonade stall". You only have two products - a large glass of lemonade OR a small glass of lemonade (always either/or; never both). You want people to select, to pay, to enjoy - that fast, that simple, and with no other distracting features/options offered. Because you're a child who can't add, and in any case you make the rules, everyone has to pay for their one glass of lemonade separately. A shopping cart makes no sense, and in fact detracts from the value of the product you are offering. On the other hand, you do want to encourage repeat customers, so a customer database of some kind might be useful (or might not). And somewhere in the future you can imagine introducing a medium glass of lemonade as a third product. But that is as complex as it can possibly get.

If that is your brief, what are the options one should consider? Writing the functionality from the ground up? Taking an off-the-shelf package and configuring/stripping it back? Using a shopping cart behind the scenes, but hiding it? I'm interested in knowing what approaches are viable, and which is likely to take the least work to get an acceptable result. Answers that lean towards implementation in PHP/MySQL, or e-commerce frameworks written in them, are preferred.

答:
Yes there is. One such system is 1-click, which is patented by Amazon.
From 1-click,

... allows an online shopper using an internet marketplace to purchase an item without having to use shopping cart software.

The fact that it's already exists and, as in your comment, you read the patent, I believe you need to either a) license it or b) make sure you use something that's not claimed by the patent (I'm not affiliated with them, btw.).


问:
Why doesn't Haskell have a 'format' function for string interpolation?
I'm trying to use Shake and I stumbled upon the following problem: there's no easy and convenient way to interpolate a string. I know about Text.Printf — it's not what I'm looking for. The interpolation syntax I'm talking about is like this:

(Make)

```<code>HEADERS_DIR := /some/path/to/dir

CFLAGS := "-g -I$(HEADERS_DIR) -O2"
</code>```

(Python)

```<code>headers_dir = "/some/path/to/dir"

cflags = "-g -I{headers_dir} -O2".format(**locals())
</code>```

And now compare this to possible Haskell's solution. Firstly:

```<code>$ cabal install interpolatedstring-perl6
$ ghci -XExtendedDefaultRules -XQuasiQuotes
</code>```

And then:

```<code>> import Text.InterpolatedString.Perl6 (qq)
> let headers_dir = "/path/to/some/dir"
> [qq| -g -I$headers_dir -O2 |] :: String
</code>```

While I think Make goes maybe a step too far in its eagerness to interpolate even when not asked, I wonder why Haskell doesn't have a format function like Python does. It could parse the supplied string and pull the value with same name as referenced in pattern:

```<code>let headers_dir = "/path/to/some/dir"
format "-g -I$headers_dir -O2"
</code>```

Is there a specific reason why it's not implemented, or everyone is just happy with Text.Printf's verbosity and/or lengthy setup of interpolation libraries?

Update: A lot of people misinterpret the question as asking about general string formatting, with possibility of precision specification in case of integers, etc. The examples provided demonstrate one specific case of interpolation, which is just "substitute the result of show a at the place of name". It does allow for simpler syntax, and it does not use a variadic function per se.

答:
What's wrong with quasiquoting? Check out Shakespeare (as mentioned in comments):</p>

```<code>{-# LANGUAGE QuasiQuotes #-}
import Text.Shakespeare.Text
import Data.Text

runtimeInterpolatedString :: (ToText a, ToText b, ToText c) => a -> b -> c -> Text
runtimeInterpolatedString a b c = [lt|There once was #{a} that #{b} when #{c}.|]
</code>```

Body:
What's wrong with quasiquoting? Check out Shakespeare (as mentioned in comments):

{-# LANGUAGE QuasiQuotes #-}
import Text.Shakespeare.Text
import Data.Text

runtimeInterpolatedString :: (ToText a, ToText b, ToText c) => a -> b -> c -> Text
runtimeInterpolatedString a b c = [lt|There once was #{a} that #{b} when #{c}.|]

ContentLicense: CC BY-SA 4.0


问:
APIs, Versioning and Models
I have my (JSON) API structured like this (which I'm pretty happy with):

API Project

```<code>/_V1
    /Controllers
        V1EntityController.cs        // Applies to version 1 only
/_V2
    /Controllers
        V2OtherEntityController.cs   // Applies to versions 2 and below
/Controllers/
    EntityController.cs              // Applies to versions 2 and above
    OtherEntityController.cs         // Applies to versions 3 and above
</code>```

Core Project

```<code>/Data/Entity.cs
/Data/OtherEntity.cs
</code>```

But as the project has progressed both the Entity and OtherEntity classes has become full of legacy properties and a bunch of ShouldSerializexxx methods. They also then also contain properties and sub-classes which are only for serialization.

Would a better solution for this be to create "Models" in the API project like so:

API Project

```<code>/_V1
    /Controllers
        V1EntityController.cs
    /Models
        V1EntityModel.cs
/_V2
    /Controllers
        V2OtherEntityController.cs
    /Models
        V2OtherEntityModel.cs
/Controllers
    EntityController.cs
    OtherEntityController.cs
/Models
    EntityModel.cs
    OtherEntityModel.cs
</code>```

Then convert to and from the classes in the core project? What's the industry recognised practice for handling this scenario?

答:
I've tried a couple different approaches: version the entire project into it's own namespace (e.g. v1-controllers, models, etc) or just version what you need (e.g. v3 controller uses v2 operation which uses v1 repositories, etc). Depending on the complexity of the software, each has it's own pros and cons. We had gotten to a point where only versioning what you need to version will eventually get unmanageable. For instance, if you use generic interfaces, you will inevitably encounter the situation where versioning something that implements that interface will force you to version everything else down the chain which is no bueno. If you did a good job separating client contracts from domain objects and database entities, then you should be a bit better off because you're really just mapping your client contracts back to your domain object, and since the domain object shouldn't really need to be versioned all that often (almost never, really), you should be pretty safe. There are other several patterns that can help you sort of "shuttle" out the correct versions as the path is executing.

The short solution might be to version the whole chain, depending on how often you release. Your project can get pretty large if you release a lot, and fixing a bug in one version wont fix it in the others, so there will be a lot of extra work. But, in the end, it's easier to manage as a whole since it becomes a [safe] free-for-all when the entire chain is versioned. And since being forced to support many versions is lame anyway, having multiple copies doesn't seem quite AS lame.

OwnerDisplayName: Jamie

Title: APIs, Versioning and Models


问:
Deploying Database Schema changes in a patching process
I am facing a conceptual development methodology problem that I was hoping you could help me with. Firstly, a little bit of background.

Background

The project I am developing is a niche application that contains a database of information, and the target audience for my application are private individuals on the lower-end of the technical proficiency scale. In fact, that is the primary reason for my project: many similar options in this field exist but the vast majority are fragile and complicated applications that require a high degree of both programming, database and sysadmin experience just to keep running. Worse yet, years or even decades of poor maintenance and "improvement" by amateur programmers who only barely understood what they were doing means many of these applications are simply beyond that ability of a non-professional to maintain.

The reason that I began this project was to give them a low barrier of entry alternative that they could reasonably extend and customise via configuration rather than programming, to centralise and minimise the maintenance. I myself have been programming for nearly 20 years but not until very recently in a professional capacity: I am actually a Civil Engineer, but my main professional experience is in being a client/technical representative for large enterprise engineering and asset management systems. So please excuse me if I am not 100% up to date with all of the professional or academic lingo.

Problem

My big conceptual problem is how to safely and invisibly to the end user merge database changes as part of an upgrade process. Basically, as I release major versions, sometimes extensions to tables or new tables might be made to the database model, which will need to be rolled out as part of the patching process. In the past, I have only ever done this on my own development servers and my approach was fairly haphazard and manual.

How should I go about quantifying, preparing and deploying the required database changes as part of my application? For reference, my program is written in C# and I use SQL Server (deployed to the user bundled with the application as SQL Server Compact Edition). I have not yet selected a patching platform to use, as possible compatability with whatever methodology I come up with here may influence my choice. My thoughts are that when I decide to do a release, there are probably some tools I must use to prepare a database difference between the last release and the current release, and prepare a SQL script to execute. Then at some point in the installation process, it must run the SQL script and bring the database up to date.

It seems simple, but I am really not sure whether it is possible. Most of the tools I can find for databases out there seem aimed at Enterprise-level applications and Database Administrators, and I am hard-pressed to figure out if they can actually do the simple task I need it to do.

Am I on the right track for doing this or is there a better approach?

答:
Write SQL scripts with a huge amount of error handling in them (look for a column to not exist before adding it to a table, look for the table to not exist when creating it, etc.). You can run the scripts as a part of your installation package (results may vary as different installers can make that easier or much harder than necessary), or you can run the scripts when your application starts. If you do the latter, I would recommend moving the SQL scripts to another location so that you don't attempt to run them more than once.

You can look at all of the available installers out there. I have used InnoSetup with good success running all sorts of executables after placing my files in the appropriate places. I have heard it is possible to do the same with an MSI, but I never got it working. If you decide to use WiX, its Burn tool can create an executable install that gives you both an executable installer and an MSI installer in the same package.


答:
One relatively simple approach that I have used for a similar SQL CE app is to distribute with the update a list of SQL statements that contain the cumulative updates to the schema since the first version of the schema that was initially distributed. The final SQL statement in the list will update a row in a lookup table so that the version number of the schema will be the same as the release. The SQL statements can be distributed either as a file or as a resource in the application.

```<code>UPDATE lookupTable
SET value = 'alarm.wav'
WHERE lookupType = 'sounds' AND lookupId = 'soundFile' AND value = 'test.wav';

ALTER TABLE Users DROP CONSTRAINT UQ__userEmail__00000000000000E0;

UPDATE lookupTable
SET value = '2.8.0.6'
WHERE lookupType = 'version' AND lookupId = 'DataModelVersion';
</code>```

Then each time the program runs it can check the value of the version number of the program versus that of the current schema and if the schema is not the same then it will run the latest schema file to do the schema changes and then update the schema version, e.g.

```<code>if (!Application.ProductVersion.Equals(schemaVersion)) {
    Schema.UpgradeDatabase(Schema.GetDbConnectionString(), upgradeFile);
</code>```

The UpgradeDatabase method must be able to handle the fact that since the list of SQL statements are cumulative then earlier insert or alter statements may encounter constraint errors when they are run again on a subsequent upgrade.  That can be worked around by throwing only exceptions that aren't expected, e.g.

```<code>//SQL Lines are split on ';' and put in a commands array
foreach (string command in commands) {
    cmd.CommandText = command;
    try {
        cmd.ExecuteNonQuery();
    } catch (Exception exc) {
        // Only throw if it's not an expected error due to rerun of the cumulative statements.
        if (!exc.Message.ToUpper().Contains("VIOLATION OF PRIMARY KEY CONSTRAINT")
          && !exc.Message.ToUpper().Contains("A DUPLICATE VALUE CANNOT BE INSERTED INTO A UNIQUE INDEX")
          && !exc.Message.ToUpper().Contains("THE FOREIGN KEY CONSTRAINT DOES NOT EXIST"))
            throw;
    }
}
</code>```

Of course testing must be done on each patch release to make sure the SQL upgrades the DB properly and that expected errors are ignored. The fact that the SQL statements are cumulative eases the burden of handling cases where a user might have skipped several minor releases before installing a release and keeps it pretty simple.

The method is relatively simple and has reliably worked for upgrading client apps that are remotely distributed. The only downside is that it doesn't handle going back to an earlier version, but if a patch needs to be issued to go back to some schema then that can be done by adding more lines to alter it back to the previous schema.

Title: Deploying Database Schema changes in a patching process

Body:
I am facing a conceptual development methodology problem that I was hoping you could help me with. Firstly, a little bit of background.

Background

The project I am developing is a niche application that contains a database of information, and the target audience for my application are private individuals on the lower-end of the technical proficiency scale. In fact, that is the primary reason for my project: many similar options in this field exist but the vast majority are fragile and complicated applications that require a high degree of both programming, database and sysadmin experience just to keep running. Worse yet, years or even decades of poor maintenance and "improvement" by amateur programmers who only barely understood what they were doing means many of these applications are simply beyond that ability of a non-professional to maintain.

The reason that I began this project was to give them a low barrier of entry alternative that they could reasonably extend and customise via configuration rather than programming, to centralise and minimise the maintenance. I myself have been programming for nearly 20 years but not until very recently in a professional capacity: I am actually a Civil Engineer, but my main professional experience is in being a client/technical representative for large enterprise engineering and asset management systems. So please excuse me if I am not 100% up to date with all of the professional or academic lingo.

Problem

My big conceptual problem is how to safely and invisibly to the end user merge database changes as part of an upgrade process. Basically, as I release major versions, sometimes extensions to tables or new tables might be made to the database model, which will need to be rolled out as part of the patching process. In the past, I have only ever done this on my own development servers and my approach was fairly haphazard and manual.

How should I go about quantifying, preparing and deploying the required database changes as part of my application? For reference, my program is written in C# and I use SQL Server (deployed to the user bundled with the application as SQL Server Compact Edition). I have not yet selected a patching platform to use, as possible compatability with whatever methodology I come up with here may influence my choice. My thoughts are that when I decide to do a release, there are probably some tools I must use to prepare a database difference between the last release and the current release, and prepare a SQL script to execute. Then at some point in the installation process, it must run the SQL script and bring the database up to date.

It seems simple, but I am really not sure whether it is possible. Most of the tools I can find for databases out there seem aimed at Enterprise-level applications and Database Administrators, and I am hard-pressed to figure out if they can actually do the simple task I need it to do.

Am I on the right track for doing this or is there a better approach?

Body:
One relatively simple approach that I have used for a similar SQL CE app is to distribute with the update a list of SQL statements that contain the cumulative updates to the schema since the first version of the schema that was initially distributed. The final SQL statement in the list will update a row in a lookup table so that the version number of the schema will be the same as the release. The SQL statements can be distributed either as a file or as a resource in the application.

UPDATE lookupTable
SET value = 'alarm.wav'
WHERE lookupType = 'sounds' AND lookupId = 'soundFile' AND value = 'test.wav';

ALTER TABLE Users DROP CONSTRAINT UQ__userEmail__00000000000000E0;

UPDATE lookupTable
SET value = '2.8.0.6'
WHERE lookupType = 'version' AND lookupId = 'DataModelVersion';

Then each time the program runs it can check the value of the version number of the program versus that of the current schema and if the schema is not the same then it will run the latest schema file to do the schema changes and then update the schema version, e.g.

if (!Application.ProductVersion.Equals(schemaVersion)) {
    Schema.UpgradeDatabase(Schema.GetDbConnectionString(), upgradeFile);

The UpgradeDatabase method must be able to handle the fact that since the list of SQL statements are cumulative then earlier insert or alter statements may encounter constraint errors when they are run again on a subsequent upgrade.  That can be worked around by throwing only exceptions that aren't expected, e.g.

//SQL Lines are split on ';' and put in a commands array
foreach (string command in commands) {
    cmd.CommandText = command;
    try {
        cmd.ExecuteNonQuery();
    } catch (Exception exc) {
        // Only throw if it's not an expected error due to rerun of the cumulative statements.
        if (!exc.Message.ToUpper().Contains("VIOLATION OF PRIMARY KEY CONSTRAINT")
          && !exc.Message.ToUpper().Contains("A DUPLICATE VALUE CANNOT BE INSERTED INTO A UNIQUE INDEX")
          && !exc.Message.ToUpper().Contains("THE FOREIGN KEY CONSTRAINT DOES NOT EXIST"))
            throw;
    }
}

Of course testing must be done on each patch release to make sure the SQL upgrades the DB properly and that expected errors are ignored. The fact that the SQL statements are cumulative eases the burden of handling cases where a user might have skipped several minor releases before installing a release and keeps it pretty simple.

The method is relatively simple and has reliably worked for upgrading client apps that are remotely distributed. The only downside is that it doesn't handle going back to an earlier version, but if a patch needs to be issued to go back to some schema then that can be done by adding more lines to alter it back to the previous schema.


答:
Beside something along the lines of Jason's answer, I would create the array before the function call if it is complicated.  Where complicated refers either to the array itself or the function call using that array.  So, if the function call starts to look like crap, as in your example, just create a variable for the array and use that in the call.

Don't optimize prematurely.  It's one variable.  Error on the side of legibility and optimize to unmaintainable mess only if necessary.

Title: How do you format arrays within parameters?

Body:
I'm talking about something like this:

```<code>echo $form->input('general_addresss', array(
            'label' => 'Where will you go today?'
            'format' => array('before', 'input', 'after', 'label', 'after', 'error')
            ));
</code>```

Do you start with one array parameter, then break a line? If it can't fit on a line, do you immediately break a line?

After of which, do you do a set number of tabs over? What happens if an array within an array has lots of properties?

Is there any particular guide you follow?


答: If you don't need a shopping cart, put the item selection on the same page that you collect the payment information.  Then submit it all in one post to your server for processing.  You wouldn't need an off-the-shelf component for that, unless you weren't able to integrate the payment API on the server side.</p>

Title: Is there such a thing as e-commerce without a shopping cart?

Body:
Imagine you want to set up a minimalist e-commerce website for a "lemonade stall". You only have two products - a large glass of lemonade OR a small glass of lemonade (always either/or; never both). You want people to select, to pay, to enjoy - that fast, that simple, and with no other distracting features/options offered. Because you're a child who can't add, and in any case you make the rules, everyone has to pay for their one glass of lemonade separately. A shopping cart makes no sense, and in fact detracts from the value of the product you are offering. On the other hand, you do want to encourage repeat customers, so a customer database of some kind might be useful (or might not). And somewhere in the future you can imagine introducing a medium glass of lemonade as a third product. But that is as complex as it can possibly get.

If that is your brief, what are the options one should consider? Writing the functionality from the ground up? Taking an off-the-shelf package and configuring/stripping it back? Using a shopping cart behind the scenes, but hiding it? I'm interested in knowing what approaches are viable, and which is likely to take the least work to get an acceptable result. Answers that lean towards implementation in PHP/MySQL, or e-commerce frameworks written in them, are preferred.


问:
"Open Source" licenses that do not allow source redistribution
I am starting to work on a new commercial software project that may use elements of "open source" code.

I have been instructed to ensure that I only use code which is licensed for commercial use and although we may decide to make it open source in the future it should be required to be open source.

So this clearly prohibits the use of any true copyleft licensed code.

But this got me wondering; are there any standard "open source" software licenses that allow commercial use, but do not allow redistribution of source?

I have intensionally used quotes around open source as I am aware that any licenses that fit this criteria cannot be compatible with the accepted OSI definition of open source.

答:
No, not that I ever heard of.

Your firm is looking for "dual license" code, code that is available EITHER under an open source license OR under a commercial license.  When such code is acquired under a commercial license, the licensee generally is not obligated to release the source of his modifications to anyone.

With such code, your firm COULD elect in the future to release it as open source, provided of course that the various chunks you mix and match are all under compatible open source licenses, so that the final product can be licensed as a whole.

The odds are that your firm is going to find itself paying a LOT of money for those commercial licenses.


问:
Building a web app with encrypted MySQL database entries?
I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be stored in the database. All of which I'm hosting myself.

I want to set up a system where a user can access his own entries and see the plain text results, but even if he was able to access someone else's they would be encrypted, unintelligible strings.

I have an idea of how to accomplish this, but perhaps it's not optimal or there exist tools to do this already in a more efficient way.

Store username as plain text, and password encrypted with sha1(). Or both encrypted with sha1().

Take the user's password (not the encrypted one, but the one he typed in and use it do define a key specific to that username and password, which will then be stored as a session variable.

Encrypt, or decrypt all of that users data with that key.

In my opinion even if someone gained access to the database and saw a list of plain text usernames and encrypted passwords they couldn't figure out the specific key since it's not stored anywhere. Therefore even if access was gained, they couldn't decipher the content of the sensitive database fields. Of course I'm building in ways to stop them accessing the database anyway, but as a catch-all effort this seems like a good set of steps.

Could the experts please comment on this, and offer some advice? Thanks a lot.

答:
To encrypt & decrypt mysql data we will use AES_ENCRYPT() and AES_DECRYPT() functions. These functions used the official AES (Advanced Encryption Standard) algorithm & encode data with a 128-bit key length. 128 bits is much faster and secure enough for most purposes.

Because AES_ENCRYPT() encrypts a string and returns a binary string. AES_DECRYPT() decrypts the encrypted string and returns the original string.

AES is a block-level algorithm. So when data encrypted it is padded. So you can calculate the length of the result string using this formula:

1.) 16 × (trunc(string_length / 16) + 1)

So if your address field structure is = VARCHAR(100) ; //100 length of varchar
Then before your encryption it should be converted

```<code>= 16 * (trunc(100/ 16) + 1)
= 16 * (6.25 + 1)
= 16 * 7.25
= 116
</code>```

So VARCHAR(100) should be converted to VARBINARY(116) minimum. I suggest use little more like VARBINARY(150) in this case.

Because if AES_DECRYPT() detects invalid data or incorrect padding, it will return NULL. But it is also possible for AES_DECRYPT() to return a non-NULL value (possibly garbage) if the input data or the key is invalid.

Syntax:

1.) AES_ENCRYPT(str, key_str);

2.) AES_DECRYPT(crypt_str,key_str);

Please remember, the encryption and decryption will occur based on a key. So you’ve to keep that key in a secret place and using variable you could pass the key to mysql to encrypt and decrypt data.

AES_ENCRYPT() and AES_DECRYPT() can be considered the most cryptographically secure encryption functions currently available in MySQL.

Inserting data as follows:

```<code>INSERT into user (first_name, address) VALUES (AES_ENCRYPT('Obama', 'usa2010'),AES_ENCRYPT('Obama', 'usa2010'));
</code>```

Retrieving data as follows:

```<code>SELECT AES_DECRYPT(first_name, 'usa2010'), AES_DECRYPT(address, 'usa2010') from user;
</code>```

additional notations:

You'll need to apply a salt to the data that you encrypt. This is a
special code that the encryption algorithm uses which works a bit like
a key.

You'll need to provide the exact same key back to decrypt the data,
and if an attacker should gain access to your database, they won't be
able to decipher it without knowing the salt.

If you define your salt in PHP like this, you'll be able to pull the
constant into your SQL statements more easily.

Body:
To encrypt & decrypt mysql data we will use AES_ENCRYPT() and AES_DECRYPT() functions. These functions used the official AES (Advanced Encryption Standard) algorithm & encode data with a 128-bit key length. 128 bits is much faster and secure enough for most purposes.

Because AES_ENCRYPT() encrypts a string and returns a binary string. AES_DECRYPT() decrypts the encrypted string and returns the original string.

AES is a block-level algorithm. So when data encrypted it is padded. So you can calculate the length of the result string using this formula:

1.) 16 × (trunc(string_length / 16) + 1)

So if your address field structure is = VARCHAR(100) ; //100 length of varchar
Then before your encryption it should be converted

= 16 * (trunc(100/ 16) + 1)
= 16 * (6.25 + 1)
= 16 * 7.25
= 116

So VARCHAR(100) should be converted to VARBINARY(116) minimum. I suggest use little more like VARBINARY(150) in this case.

Because if AES_DECRYPT() detects invalid data or incorrect padding, it will return NULL. But it is also possible for AES_DECRYPT() to return a non-NULL value (possibly garbage) if the input data or the key is invalid.

Syntax:

1.) AES_ENCRYPT(str, key_str);

2.) AES_DECRYPT(crypt_str,key_str);

Please remember, the encryption and decryption will occur based on a key. So you’ve to keep that key in a secret place and using variable you could pass the key to mysql to encrypt and decrypt data.

AES_ENCRYPT() and AES_DECRYPT() can be considered the most cryptographically secure encryption functions currently available in MySQL.

Inserting data as follows:

INSERT into user (first_name, address) VALUES (AES_ENCRYPT('Obama', 'usa2010'),AES_ENCRYPT('Obama', 'usa2010'));

Retrieving data as follows:

SELECT AES_DECRYPT(first_name, 'usa2010'), AES_DECRYPT(address, 'usa2010') from user;

additional notations:

You'll need to apply a salt to the data that you encrypt. This is a
special code that the encryption algorithm uses which works a bit like
a key.

You'll need to provide the exact same key back to decrypt the data,
and if an attacker should gain access to your database, they won't be
able to decipher it without knowing the salt.

If you define your salt in PHP like this, you'll be able to pull the
constant into your SQL statements more easily.


问:
I am a beginner. Can I directly start learning C++11? or I have to learn old C++?
I'm a beginner and have only little knowledge in programming.

Would it be good if I directly learn C++ from books which cover new C++11 or should I study through the old best C++ books?

Should I have little knowledge about C++ before learning C++11? or I can start directly from there?

Would it cause problem if I directly start from C++11? If no, then suggest some books on C++11.

答:
When my time, C was considered a prerequisite of C++, especially for those beginners of programming. Because you have to figure out what does a language do and why it has been designed like that. C got loads of great and sufficient ideas of programming language, which will never be out of date. Thus, I believe this is the best start.

And after having some basic point of view regarding the programming stuffs, you may have to choose what to be done as the next move, which means, choose a language to learn as deeply as you could. No matter how deep you get, it can generally decide how deep you can get for any other languages, which means, no matter how many languages you have learned, the deepest one will always be the first one that you have dug up. For me, I have performed research on Java and made some models of Java on my own to better understand its kernel functionality.

After that, you might be able to learn whatever you want, because you have totally understanding on the technology of the programming language. I have started learning C#, Go, Python even Scala and have done many projects for fun/work. The personal record is 3 months from starting learning a language to becoming 1.0 head of a developing project.

In my case, it has been over 15 years since my first program and I cant even remember what it is. I believe if you work hard enough, you will definitely get better and faster than me.


答:
There are no open-source licenses that do not allow the redistribution of source; that's a contradiction in terms.  What there are, though, are non-viral open-source licenses that do not require the redistribution of source.

It sounds like what you're looking for is code with a license less "strong" than the GPL family.  Have a look at the MPL (Mozilla Public License), which requires you to publish any changes you make to the MPL code itself but doesn't care about the rest of the project you use it in, even if it's a commercial project.  Also, there are a number of extremely permissive open-source licenses such a the MIT license, the BSD license and the Zlib license that have minimal restrictions on what you can and can't do with the code in question.

Title: "Open Source" licenses that do not allow source redistribution

Body:
I am starting to work on a new commercial software project that may use elements of "open source" code.

I have been instructed to ensure that I only use code which is licensed for commercial use and although we may decide to make it open source in the future it should be required to be open source.

So this clearly prohibits the use of any true copyleft licensed code.

But this got me wondering; are there any standard "open source" software licenses that allow commercial use, but do not allow redistribution of source?

I have intensionally used quotes around open source as I am aware that any licenses that fit this criteria cannot be compatible with the accepted OSI definition of open source.


问:
Typical agreements for freelance development?
I am just starting out my programming career and I have a chance to bid on a freelance job. I have looked over the specifications for the app and believe I am capable of meeting the requirements satisfactorily. I have worked on a team developing 2 different apps for the same platform , as well as one app I wrote for a friends business (for pay but it was informal) and all of the stuff I have done for personal use/school so I believe I can estimate fairly accurately how long it will take me.

However I have no clue about how these things work in the real world. I have only been finished school for less then a year and I have only had 2 short-term developer contracts. Specifically:

Payment: what is usual? Payment on delivery? Payment upfront? Percentage upfront?

Sourcecode: I understand that I would need to give them the source code but what about previous librarys which I have made. If I use those in the project would they then belong to the client as well?

How detailed should the initial contract be? What if the client changes their mind about details part way through.

I'm not really certain how to set a price (I would appreciate suggestions formulas).

I assume that there must be some sort of industry standards for this sort of thing I'm just not sure what they are/ where to find them? I would really appreciate any advice on the subject, even if it is just links to other resources. If it matters both myself and the potential client are located in Canada.

答:
Here are my tips and comments based on my freelance experience:

1) It depends on the client. You can start with a 25% upfront as a default, another 25% midway through the project and the rest upon completion. Carefully detail the milestones and payment options in your proposal. You can also offer a discount for paying upfront. Some clients might not be able to adhere to your payment requirements due to bureaucracy reasons, like NGOs or Government; they usually have their own set of rules you have to follow in order to work with them; don't fight it.

2) The app or whatever you coded is for them to keep and the libraries you use are probably under an opensource license. Libraries you make for the project is work you've done for the client, so it would be difficult to argue the code is completely yours. Usually you give full rights over the final product, as a whole, but you can incorporate a copyright clause in your contract to cover different cases. For example (change the word "Designer" to whatever fits best):

Copyright Terms

a) Until payment is made in full, Designer holds full rights to each
and every original design created for Client under this Contract.

b) Client understands and agrees that Designer owns all of the
concepts/preliminary designs created before the final design(s)

c) Client agrees that Designer will retain the right to use the final
design(s) and all preliminary designs in design competitions,
publications on design, educational purposes, and in marketing
Designer’s business.

d) Any materials given to the Designer by the
Client (text, photographs, videos, etc.) must not violate patent,
copyright, trade secret or other property rights of any person, firm
or entity.

3) The contract should be as detailed as you need to cover yourself. Include everything you can think of that is important to have in written agreement. Here's a list of things that you should probably include:

Project Description: scope of work, delivery options, materials required...

Date of Completion: project start and end date

Acceptable Delays: unforeseen events, family...

Estimated Cost: per hour, per package, per feature...

Milestones: detailed breakdown of project phases, production steps...

Payment Terms: payment options, cancellation penalties...

Then I'd make sure to cover these cases to avoid changes that are are out the scope of the project or that may require a separate contract:

a) Minor changes and additions such as correcting text or changing colors can be requested within X days upon completion of the Project. All changes must be made within the Scope of the original Project Description. Designer reserves the prerogative
to determine what consist of a minor change.

b) Any other changes or work not covered by this Contract will invoke Designer’s hourly rate of X per hour. This payment will be in addition to all other amounts owed under this Contract. Depending on the work requested, it may be necessary to amend this Contract or create a new Contract.

Also, remember that you're not the client's employee; I think it's important clarify this so I usually add a clause at the end of the contract, something like:

Client understands and agrees that Designer is an independent
  contractor and not the Client’s employee. Although Client will provide
  direction to the Designer, the Designer will determine the manner and
  ways in which design(s) are created for the Client. The work created
  for the Client under this Contract will not be deemed a
  “work-for-hire” [...]

4) Unfortunately cost depends on many factors, primarily location, and cost of living. There's no secret formula. I find it easier to always estimate in hours of work, even if you bill per project, or per feature. All you need is an accurate rate in your area. In the US it varies from $50/h up to $200/h depending on expertise, size and complexity of the project, outsourcing, and many other factors.

For small projects I find that packages work best. You start with a base package, and provide different add-ons previously estimated in hours, for example a web project might look like:

```<code>// Package 1
Basic: $1500 static site up to 5 pages + $100 per page
Responsive add-on: $1000

// Package 2
WordPress: $2500 up to 5 content-types + $250 per content type
Social media add-on: $500
User login add-on: $1000
</code>```

I think it's important to give the clients choice, but also direction. I'm no law expert so most of the stuff I've put together is from the internet, after reading hundreds of different resources on freelancing.

Body:
Here are my tips and comments based on my freelance experience:

1) It depends on the client. You can start with a 25% upfront as a default, another 25% midway through the project and the rest upon completion. Carefully detail the milestones and payment options in your proposal. You can also offer a discount for paying upfront. Some clients might not be able to adhere to your payment requirements due to bureaucracy reasons, like NGOs or Government; they usually have their own set of rules you have to follow in order to work with them; don't fight it.

2) The app or whatever you coded is for them to keep and the libraries you use are probably under an opensource license. Libraries you make for the project is work you've done for the client, so it would be difficult to argue the code is completely yours. Usually you give full rights over the final product, as a whole, but you can incorporate a copyright clause in your contract to cover different cases. For example (change the word "Designer" to whatever fits best):

Copyright Terms

a) Until payment is made in full, Designer holds full rights to each
and every original design created for Client under this Contract.

b) Client understands and agrees that Designer owns all of the
concepts/preliminary designs created before the final design(s)

c) Client agrees that Designer will retain the right to use the final
design(s) and all preliminary designs in design competitions,
publications on design, educational purposes, and in marketing
Designer’s business.

d) Any materials given to the Designer by the
Client (text, photographs, videos, etc.) must not violate patent,
copyright, trade secret or other property rights of any person, firm
or entity.

3) The contract should be as detailed as you need to cover yourself. Include everything you can think of that is important to have in written agreement. Here's a list of things that you should probably include:

Project Description: scope of work, delivery options, materials required...

Date of Completion: project start and end date

Acceptable Delays: unforeseen events, family...

Estimated Cost: per hour, per package, per feature...

Milestones: detailed breakdown of project phases, production steps...

Payment Terms: payment options, cancellation penalties...

Then I'd make sure to cover these cases to avoid changes that are are out the scope of the project or that may require a separate contract:

a) Minor changes and additions such as correcting text or changing colors can be requested within X days upon completion of the Project. All changes must be made within the Scope of the original Project Description. Designer reserves the prerogative
to determine what consist of a minor change.

b) Any other changes or work not covered by this Contract will invoke Designer’s hourly rate of X per hour. This payment will be in addition to all other amounts owed under this Contract. Depending on the work requested, it may be necessary to amend this Contract or create a new Contract.

Also, remember that you're not the client's employee; I think it's important clarify this so I usually add a clause at the end of the contract, something like:

Client understands and agrees that Designer is an independent
  contractor and not the Client’s employee. Although Client will provide
  direction to the Designer, the Designer will determine the manner and
  ways in which design(s) are created for the Client. The work created
  for the Client under this Contract will not be deemed a
  “work-for-hire” [...]

4) Unfortunately cost depends on many factors, primarily location, and cost of living. There's no secret formula. I find it easier to always estimate in hours of work, even if you bill per project, or per feature. All you need is an accurate rate in your area. In the US it varies from $50/h up to $200/h depending on expertise, size and complexity of the project, outsourcing, and many other factors.

For small projects I find that packages work best. You start with a base package, and provide different add-ons previously estimated in hours, for example a web project might look like:

// Package 1
Basic: $1500 static site up to 5 pages + $100 per page
Responsive add-on: $1000

// Package 2
WordPress: $2500 up to 5 content-types + $250 per content type
Social media add-on: $500
User login add-on: $1000

I think it's important to give the clients choice, but also direction. I'm no law expert so most of the stuff I've put together is from the internet, after reading hundreds of different resources on freelancing.


答:
I would have done it like this:

```<code>echo $form->input(
    'general_addresss', array(
       'label' => 'Where will you go today?',
       'format' => array(
           'before',
           'input',
           'after',
           'label',
           'after',
           'error'
       )
    )
);
</code>```

Syntax highlighting can be a very easy thing to confuse :) However, in your case, the example you gave is also perfectly fine. It would depend on how many nested arrays (with xx number of members) I was dealing with.

Whatever makes it easy to read and modify. I personally find one member per line much easier to enumerate (mentally) while looking to make a change, while clearly separating each member.

Of course, follow what exists, when applicable.

Body:
I would have done it like this:

echo $form->input(
    'general_addresss', array(
       'label' => 'Where will you go today?',
       'format' => array(
           'before',
           'input',
           'after',
           'label',
           'after',
           'error'
       )
    )
);

Syntax highlighting can be a very easy thing to confuse :) However, in your case, the example you gave is also perfectly fine. It would depend on how many nested arrays (with xx number of members) I was dealing with.

Whatever makes it easy to read and modify. I personally find one member per line much easier to enumerate (mentally) while looking to make a change, while clearly separating each member.

Of course, follow what exists, when applicable.


问:
Is it possible to keep only one Database for both web and desktop applications?
I'm experiencing a trouble with my business model, let me explain better.

I'm developing a software for 1 year and few months, it's for the food industry, more exactly a software to: Delivery, Take Way, Table Reservation, POS, Accounts Payable and Receivable, Prints(receipt), Kitchen Monitors Orders, Customers Orders Control and Fiscal Area.

Well, I had separated the software mainly in two areas, one is web area and the other is desktop area (Used by Admins only) and local installed.

1 - Web Area (Basically do the follow:)

Show Catalog with the products

Customers Make Orders

Customers Pay for the Orders

etc ... as mentioned above

2 - Desktop Area

Manage Orders

Manage Customers

Manage Suppliers

Manage Accounts Payable and Receivable

etc ... as mentioned above

The web area is hosted in an online web server (scripts and database are online). The Desktop area is hosted locally in a Linux machine with a local database and local scripts files.

My question is:
Is it possible to keep only one Database for both applications? If YES, please what is the best approach?

Follow my technical specification environment

Database: Actually I have two databases working and I would love to keep only one.

Operating System: Linux (Kernel 2.6.X and above) or Windows (XP and above)

For the Web Area

Apache, PHP, Python, Java Script, Shell Script and MySQL.

For the Desktop Area:

PHP-GTK2, Apache, PHP, MySQL and Shell Script.

Addtional Information about the system [EDITED]

The main purposes to have a Desktop environment is:

I need to print and give out Tax Coupon on each new order.

I have the drawer.

I have a serial reader (Bar code).

I have a terminal to query for information.

and few other stuffs that is so hard if not impossible to do in the web environment.

Desktop relational schema: 104 tables.
Web relational schema: 42 tables.

Permissions is assigned based on: Deny all by default, and assigns as needed.

(Validation / Sanitization) has already been done in the web application.

Until now performance is not a problem, since every fiscal year part of my database will be archived.
(Also customer, suppliers and all related data about them will be archived after 3 years of inactivity).

My real problem is I have 2 environments today and I would love to have only 1.
Then "merge" the both worlds into one is an option, but not sure about.
I would love to read here a lot of ideas about this matter.

Observation about the process: Today it is in operation and it works fine, but I feel like waste time in some process.

Take a look in the scenario:

The order is made in the internet, then stored in my Web database.

The "order" is sent to the kitchen and prepared.

Print a receipt (Tax Coupon), put it with the order and delivery to the customer.

A Tax Coupon is generated by my Desktop Environment and it need a call to the orders table, but it is not the Web Order Table but a Desktop Order Table.

In few words I need to generate again the order to fill up the Tax Coupon. The same happen to Customer Register, Supplier Register and few other stuffs.

I hope this information turn my question more readable. Thanks Again!

答:
Yes it is possible. And may I also add that it should be for easier maintenance and modifications.

As I read you specs, it is very likely to develop using a single database, since you are using MySQL and light and easy to start. No you can not claim that MySQL is for only web application. Many applications are there of product and tool domain which are using it.

There are corresponding configurations that must be set for direct database connections. However, your Desktop application is connected to public host server with a static IP for you to do this and have your Desktop application establish connection.

I may also add that if you do not want to go through this tedious configurations, you can have a web service for your desktop to perform your desired database manipulations.

Add:
you web service may be using JSON or XML for better parsing.


答: As a beginner I think first you have to go through C++ concepts because C++11 and all is like a new version but C and C++ are the basic for any type of development. Once you learned C++ most of the concepts will get automatically cleared.</p>

Title: I am a beginner. Can I directly start learning C++11? or I have to learn old C++?

Body:
I'm a beginner and have only little knowledge in programming.

Would it be good if I directly learn C++ from books which cover new C++11 or should I study through the old best C++ books?

Should I have little knowledge about C++ before learning C++11? or I can start directly from there?

Would it cause problem if I directly start from C++11? If no, then suggest some books on C++11.


问:
Which mathematical properties apply to XOR Swap algorithm (and similar bitwise operator algorithms)?
Assume you have two variables a and b, and you need to swap them, and for whatever reason, making a temporary variable for storage is not an option. This is the algorithm in pseudocode

```<code>a ← a XOR b
b ← a XOR b
a ← a XOR b
</code>```

Based on examples I can see that this does work.

But, why does it work?

More specifically, how was this derived? Was it a mere coincidence that XOR such and such values does this? This question applies to all bitwise operators.

I understand perfectly what they do, and how they work, and various algorithms that take advantage of them. But, are there mathematical properties of these bitwise operators that these algorithms are derived from? What are those mathematical properties? And which of them apply to the specific example of an XOR swap?

答:
"Why does the algorithm work?" is a subjective concept and primarily opinion-based, so don't feel bad if this question is put on hold. But the closely related "How does it work?" can be answered, so I'll have a go.

First of all, XOR is special in that it preserves all information that you put into it: it maps 1 to 0 and 0 to 1 (when applied to 1) and 0 to 0 and 1 to 1 (when applied to 0). This is important, because without that property the trick couldn't work. For instance, logical AND is not information-preserving: if you AND 0 to a value, you'll always get 0 no matter what the left hand side was, so you cannot reconstruct the input from the output.

Also, it's cyclical: if you XOR the same value to one number twice, you get the original number back. This isn't hard to see, because every 0 in the number turns into a 1 and then back again to 0, and vice versa. This is also critical for the trick to work.

After the first step, a has been overwritten with a different value, but the information about that value is still present. The original value is the one that you would get if you applied XOR b to it again, and that's what happens in the second step. The third step repeats this trick for b, but because b has already been changed in the second step, the final a = a XOR b effectively executes two XOR operations, ending up with exactly the original value of b.

That is as close as I can come to explaining why I think the method works, but note that to acquire an intuitive understanding of such tricks, nothing beats actually performing the computation yourself. Pick a couple of two-digit binary numbers, get a piece of paper, and get busy assigning. Better yet, get all 16 combinations of two-digit binary numbers and compute all those 48 steps on paper. It's almost impossible not to understand the XOR information flow after that.


答:
This can be done with any invertable binary operation like XOR or addition.  So you could just as well write:

```<code> a ← a + b
 b ← a - b
 a ← a - b
</code>```

Or more generally, suppose that for some binary (associative, commutative) operator # there is an identity i such that

```<code>x # i = i # x = x
</code>```

and that for every value x there is a value x' such that

```<code>x # x' = i
</code>```

Then you can swap two values using that operator:

```<code>a ← a # b
b ← a # b'
a ← a # b'
</code>```

For addition, x' = -x, but for XOR we have x XOR x = 0 so that x' = x, so that:

```<code>a ← a XOR b
b ← a XOR b'
a ← a XOR b'
</code>```

reduces to

```<code>a ← a XOR b
b ← a XOR b
a ← a XOR b
</code>```

Title: Which mathematical properties apply to XOR Swap algorithm (and similar bitwise operator algorithms)?

Body:
Assume you have two variables a and b, and you need to swap them, and for whatever reason, making a temporary variable for storage is not an option. This is the algorithm in pseudocode

```<code>a ← a XOR b
b ← a XOR b
a ← a XOR b
</code>```

Based on examples I can see that this does work.

But, why does it work?

More specifically, how was this derived? Was it a mere coincidence that XOR such and such values does this? This question applies to all bitwise operators.

I understand perfectly what they do, and how they work, and various algorithms that take advantage of them. But, are there mathematical properties of these bitwise operators that these algorithms are derived from? What are those mathematical properties? And which of them apply to the specific example of an XOR swap?

Body:
This can be done with any invertable binary operation like XOR or addition.  So you could just as well write:

 a ← a + b
 b ← a - b
 a ← a - b

Or more generally, suppose that for some binary (associative, commutative) operator # there is an identity i such that

x # i = i # x = x

and that for every value x there is a value x' such that

x # x' = i

Then you can swap two values using that operator:

a ← a # b
b ← a # b'
a ← a # b'

For addition, x' = -x, but for XOR we have x XOR x = 0 so that x' = x, so that:

a ← a XOR b
b ← a XOR b'
a ← a XOR b'

reduces to

a ← a XOR b
b ← a XOR b
a ← a XOR b


问:
Are classes with only a single (public) method a problem?
I am currently working on a software project that performs compression and indexing on video surveillance footage. The compression works by splitting background and foreground objects, then saving the background as a static image, and the foreground as a sprite.

Recently, I have embarked on reviewing some of the classes that I have designed for the project.

I noticed that there are many classes that only have a single public method. Some of these classes are:

VideoCompressor (with a compress method that takes in an input video of type RawVideo and returns an output video of type CompressedVideo).

VideoSplitter (with a split method that takes in an input video of type RawVideo and returns a vector of 2 output videos, each of type RawVideo).

VideoIndexer (with an index method that takes in an input video of type RawVideo and returns a video index of type VideoIndex).

I find myself instantiating each class just to make calls like VideoCompressor.compress(...), VideoSplitter.split(...), VideoIndexer.index(...).

On the surface, I do think the class names are sufficiently descriptive of their intended function, and they are actually nouns. Correspondingly, their methods are also verbs.

Is this actually a problem?

答: No, this is not a problem, quite the opposite. It is a sign of modularity and clear responsibility of the class. The lean interface is easy to grasp from the viewpoint of a user of that class, and it will encourage loose coupling. This has many advantages but almost no drawbacks. I wish more components would be designed that way!</p>


答:
There may be reasons to extract a given method into a dedicated class. One of those reasons is to allow Dependency Injection.

Imagine you have a class called VideoExporter which, eventually, should be able to compress a video. A clean way would be to have an interface:

interface IVideoCompressor
{
    Stream compress(Video video);
}
```

<p>which would be implemented like this:</p>

<pre class="lang-java prettyprint-override"><code>class MpegVideoCompressor : IVideoCompressor
{
    // ...
}

class FlashVideoCompressor : IVideoCompressor
{
    // ...
}
</code>```

and used like this:

class VideoExporter
{
    // ...
    void export(Destination destination, IVideoCompressor compressor)
    {
        // ...
        destination = compressor(this.source);
        // ...
    }
    // ...
}
```

A bad alternative would be to have a VideoExporter which has plenty of public methods and does all the job, including the compressing. It would quickly become a maintenance nightmare, making it hard to add support for other video formats.

Title: Are classes with only a single (public) method a problem?

Body:
I am currently working on a software project that performs compression and indexing on video surveillance footage. The compression works by splitting background and foreground objects, then saving the background as a static image, and the foreground as a sprite.

Recently, I have embarked on reviewing some of the classes that I have designed for the project.

I noticed that there are many classes that only have a single public method. Some of these classes are:

VideoCompressor (with a compress method that takes in an input video of type RawVideo and returns an output video of type CompressedVideo).

VideoSplitter (with a split method that takes in an input video of type RawVideo and returns a vector of 2 output videos, each of type RawVideo).

VideoIndexer (with an index method that takes in an input video of type RawVideo and returns a video index of type VideoIndex).

I find myself instantiating each class just to make calls like VideoCompressor.compress(...), VideoSplitter.split(...), VideoIndexer.index(...).

On the surface, I do think the class names are sufficiently descriptive of their intended function, and they are actually nouns. Correspondingly, their methods are also verbs.

Is this actually a problem?

Body:
There may be reasons to extract a given method into a dedicated class. One of those reasons is to allow Dependency Injection.

Imagine you have a class called VideoExporter which, eventually, should be able to compress a video. A clean way would be to have an interface:

interface IVideoCompressor
{
    Stream compress(Video video);
}

which would be implemented like this:

class MpegVideoCompressor : IVideoCompressor
{
    // ...
}

class FlashVideoCompressor : IVideoCompressor
{
    // ...
}

and used like this:

class VideoExporter
{
    // ...
    void export(Destination destination, IVideoCompressor compressor)
    {
        // ...
        destination = compressor(this.source);
        // ...
    }
    // ...
}

A bad alternative would be to have a VideoExporter which has plenty of public methods and does all the job, including the compressing. It would quickly become a maintenance nightmare, making it hard to add support for other video formats.


答:
More specifically, how was this derived? Was it a mere coincidence
  that XOR such and such values does this? This question applies to
  all bitwise operators.

These bitwise operations correspond to well-known elementary
operations from higher-algebra that I will briefly describe.

Modular arithmetic

The first important item is modular
arithmetic—which is a
special kind of computations a quotient
ring.  Even if you do not
suspect it you are already familiar with special cases of modular
arithmetic.

If we choose a positive integer N that we call the modulo we can
compute on residues modulo N which is just like computing with
normal numbers and pretending than N = 0.  All the usual computation
rules on integers still hold, with two provisions:

For residues a = b modulo N means that the integers a and b differ by a multiple of N.

For residues modulo N the relation m × a = m × b does not imply
that a = b even if m is non-zero modulo N. [RSA]

But the remaining usual relations still hold. Let us review a few examples.

If January the 2nd is a Thursday, then February the 2nd is a Sunday
because we identify days with residues modulo 7 and, January having
31 days, we write

2 + 31 = 2 + 4 × 7 + 3 = 2 + 3 = 5

so that February the 2nd is the same day of the week as January the 5th, a Sunday.

At school we learn to sum up the digits of numbers to check if we
performed well a multiplication.  We are actually computing on
residues modulo 9, so that 10 = 1, and verify that our
multiplication is correct modulo 9. (Of course, this is not
foolproof, e.g. we would not see if we were off by 9.)

When computing on bits, we compute on residues modulo 2 and the
addition is XOR, the multiplication is AND. So

a XOR b = a + b

a AND b = a × b

NOT a = 1 XOR a = 1 + a = 1 - a (which is the “good”definition of NOT)

a OR B = a + b + a × b

As an exercise, you can check that a OR b is NOT(NOT a AND NOT b) by
expanding the corresponding algebraic expression. It is also
interesting to note that “the easy operation” is XOR and not OR.

[RSA]: As a side note, the RSA system is based on the nultiplicative theory of residues modulo N where N is the product of two prime numbers.

Linear algebra

Linear algebra
systematises computations on coordinates.  At an elementary level, it
is taught with coordinates in the ring R of real numbers and
applied to geometry and mechanics. Ring is the mathematical term for a
set of coefficients, on which we can compute just like on integers. So,
yes, sets of residues modulo a given N are also rings, and can also
be as coefficients to do linear algebra.

Now let B be the ring of residues modulo 2, that is 0, 1 endowed with
addition and multiplication as above.  A machine register, say in a 8
bits machine, but 8 could be any other number, can be seen as a
8-dimensional vector with entries in B, so that a XOR b = a + b,
where the addition considered is the addition of vectors with entries
in B. (If you consider a and b as 2-complement's representation of
some integers, a XOR bhas nothing to do with the sum of these
integers.)

XOR-Swap

Now let's take an overpedantic look at the XOR-Swap algorithm.  We
start with a and b and I write a[k] and b[k] the values of a and b at
the various steps of the algorithms.

```<code>a[1] ← a[0] + b[0]

b[1] ← a[1] + b[0]

a[2] ← b[1] + a[1]
</code>```

Note that for these vectors with entries in B we have,

```<code>b[1] = a[0] + 2× b[0] = a[0]

a[2] = b[1] + a[1] = 2 × a[0] + b[0] = b[0]
</code>```

So, by the end of our computation, b holds the initial value of a and
a holds the initial value of b.

Body:
More specifically, how was this derived? Was it a mere coincidence
  that XOR such and such values does this? This question applies to
  all bitwise operators.

These bitwise operations correspond to well-known elementary
operations from higher-algebra that I will briefly describe.

Modular arithmetic

The first important item is modular
arithmetic—which is a
special kind of computations a quotient
ring.  Even if you do not
suspect it you are already familiar with special cases of modular
arithmetic.

If we choose a positive integer N that we call the modulo we can
compute on residues modulo N which is just like computing with
normal numbers and pretending than N = 0.  All the usual computation
rules on integers still hold, with two provisions:

For residues a = b modulo N means that the integers a and b differ by a multiple of N.

For residues modulo N the relation m × a = m × b does not imply
that a = b even if m is non-zero modulo N. [RSA]

But the remaining usual relations still hold. Let us review a few examples.

If January the 2nd is a Thursday, then February the 2nd is a Sunday
because we identify days with residues modulo 7 and, January having
31 days, we write

2 + 31 = 2 + 4 × 7 + 3 = 2 + 3 = 5

so that February the 2nd is the same day of the week as January the 5th, a Sunday.

At school we learn to sum up the digits of numbers to check if we
performed well a multiplication.  We are actually computing on
residues modulo 9, so that 10 = 1, and verify that our
multiplication is correct modulo 9. (Of course, this is not
foolproof, e.g. we would not see if we were off by 9.)

When computing on bits, we compute on residues modulo 2 and the
addition is XOR, the multiplication is AND. So

a XOR b = a + b

a AND b = a × b

NOT a = 1 XOR a = 1 + a = 1 - a (which is the “good”definition of NOT)

a OR B = a + b + a × b

As an exercise, you can check that a OR b is NOT(NOT a AND NOT b) by
expanding the corresponding algebraic expression. It is also
interesting to note that “the easy operation” is XOR and not OR.

[RSA]: As a side note, the RSA system is based on the nultiplicative theory of residues modulo N where N is the product of two prime numbers.

Linear algebra

Linear algebra
systematises computations on coordinates.  At an elementary level, it
is taught with coordinates in the ring R of real numbers and
applied to geometry and mechanics. Ring is the mathematical term for a
set of coefficients, on which we can compute just like on integers. So,
yes, sets of residues modulo a given N are also rings, and can also
be as coefficients to do linear algebra.

Now let B be the ring of residues modulo 2, that is 0, 1 endowed with
addition and multiplication as above.  A machine register, say in a 8
bits machine, but 8 could be any other number, can be seen as a
8-dimensional vector with entries in B, so that a XOR b = a + b,
where the addition considered is the addition of vectors with entries
in B. (If you consider a and b as 2-complement's representation of
some integers, a XOR bhas nothing to do with the sum of these
integers.)

XOR-Swap

Now let's take an overpedantic look at the XOR-Swap algorithm.  We
start with a and b and I write a[k] and b[k] the values of a and b at
the various steps of the algorithms.

a[1] ← a[0] + b[0]

b[1] ← a[1] + b[0]

a[2] ← b[1] + a[1]

Note that for these vectors with entries in B we have,

b[1] = a[0] + 2× b[0] = a[0]

a[2] = b[1] + a[1] = 2 × a[0] + b[0] = b[0]

So, by the end of our computation, b holds the initial value of a and
a holds the initial value of b.


问:
What's the best way to explain branching (of source code) to a client?
The situation is that a client requested a number of changes about 9 months ago which they then put on hold with them half done.  They've now requested more changes without having made up their mind to proceed with the first set of changes.  The two sets of changes will require alterations to the same code modules.

I've been tasked with explaining why them not making a decision about the first set of changes (either finish them or bin them) may incur additional costs (essentially because the changes would need to be made to a branch then if they proceed with the first set of changes we'd have to merge them to the trunk - which will be messy - and retest them).

The question I have is this:

How best to explain branching of code to a non-technical client?

答:
It probably not that important to explain branching. What is important is that you explain the impact of their non-decision.

In this case the impact is if they decide they want the first set of changes down the road it will increase the cost then if you implement the change now. One nice way they will get the message is if you do an estimate for both.

If they don't understand why the estimates are different you can explain as you already have. Testing will have to be done twice and incompatibilities will need to be resolved, etc.

You can also use a building metaphors. Personally I don't like them but it wouldn't be that hard to do. One example that springs to mind replacing a bathtub and the plumbing together is cheaper than replacing the bathtub and plumbing separately, since you only have to rip out the tub once and re-caulk once and so on.


问:
Is it correct/useful to define Computational Complexity in this way?
I analyzed my algorithm and I deduced that in the best case it requires n^3 iterations while in the worst case it requires n^4 iterations. Then I asserted that my algorithm is in \Omega(n^3) and in \BigO(n^4). Is this assertion correct and useful?

(sorry for the format but I'm not able to add LaTeX text, so if you can please tell me how to format this I will edit soon, thanks)

答:
If you are sure that n^4/n^3 is the best/worst case complexity of your algorithm, it is certainly correct to state that the algorithm is in O(n^4) and Omega(n^3).

Weather it makes sense to add this to the algorithms description, depends on your target audience:

To present a generic algorithm to scientists, it is valuable, since it allows to compare the algorithm to others in terms of computational complexity. (Remember to clarify what n is)

To present an algorithm tailored to a specific problem to practitioners, computational complexity might not be of interest. For example, your algorithm might still be worse than another, on average, if the n is usually small and never really big in the use case scenario.

Computational complexity provides a very abstract view on the algorithm. For theoretical considerations that is just what you want. In practice there may be many other properties that are much more important, because you can consider the problem specific factors.


答:
why bitwise algorithms work? because someone found it and proved they worked for all values.

if you remember that a^b = b^a and a^a=0 and a^0=a then you can expand the algorithm as:

```<code>a'=a^b;
b'=a'^b;
a''=a'^b';
</code>```

or

```<code>b'=(a^b)^b=a^(b^b)=a;
a''=((a^b)^b)^(a^b)=a^b^b^a^b=a^a^b=b;
</code>```

that said I believe that this is useless in modern languages because the optimizer will recognize the "temp var swap" (tmp=a;a=b;b=tmp;) and optimize as needed.

Plus on RISC architectures you need to load the variables into a register before you can xor them and if you have them both in registers you can just write them out in opposite places. This means that is is only useful if there is a direct xor on the locations and there isn't an extra location to store the temporary.

Body:
why bitwise algorithms work? because someone found it and proved they worked for all values.

if you remember that a^b = b^a and a^a=0 and a^0=a then you can expand the algorithm as:

a'=a^b;
b'=a'^b;
a''=a'^b';

or

b'=(a^b)^b=a^(b^b)=a;
a''=((a^b)^b)^(a^b)=a^b^b^a^b=a^a^b=b;

that said I believe that this is useless in modern languages because the optimizer will recognize the "temp var swap" (tmp=a;a=b;b=tmp;) and optimize as needed.

Plus on RISC architectures you need to load the variables into a register before you can xor them and if you have them both in registers you can just write them out in opposite places. This means that is is only useful if there is a direct xor on the locations and there isn't an extra location to store the temporary.


问:
Working with shader code
I am starting my first project in OpenGL/GLSL and I was wondering, how do you work with code of shaders?

Because it needs to be const char and syntax higlighting shows everything in the same color (as string) and so its difficult to navigate in code.

```<code>const char *shader = ..."void main()\n"...;
</code>```

Do you edit the code and then add quotation marks or do you just write it with quotation marks from the start? Thanks

edit: using VS2012

答:
some use separate files and include them as resources, some use macros, some use external files and read them in at runtime.

both of the external file options will allow syntax highlighting

and technically you don't need const char*, just a char* will do (it is implicitly convertible)

Title: Working with shader code


问:
When should a database table use timestamps?
First a note, I thought maybe this question belonged in the database exchange, but I think it is more broadly related to a programming solution as a whole than to databases. Will move to database exchange if people think thats the best one.

I was wondering when a database table should have a created and updated timestamp added?

The first obvious answer is that if any business logic needs to know when something was updated (like a transaction completion date etc) then it must go in.

But what about non business logic cases? For example I can think of scenarios where it would be really useful to know the date time that rows changed to help with fault finding e.g. some business logic is failing and looking at the related database rows its possible to identify that one row is being update before another row which is causing the error.

With this use case, it would make sense to give every table an update and create timestamp (except for maybe the most trivial enum tables that wouldn't be updated by any part of the application).

Giving every table a timestamp is surely a great way to quickly bog down a database (although could be wrong).

So when should a database table use create and update timestamps?

答:
For a better and more comprehensive database management and most wise practice is to do so.

First, it is more likely as a developer, you would wanted to have track on the database transactions and/or activities for development and ease on tracing bugs and errors on your code whenever it involves your database.

Also, whenever you need to track on the activities made on you database for statistic purposes.

Another, is it often happens that maybe for the time being you don't need to keep track of your database activities, but it is more likely you would in the future. It will be needing your time today, but buys you more in the future.


答:
In one project, we use digital certificates to do the encryption.

The encryption/decryption are done on the client side and require the use of an activex component or a java applet.

Of course, this may be overkill for your purpose.

Title: Building a web app with encrypted MySQL database entries?

Body:
I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be stored in the database. All of which I'm hosting myself.

I want to set up a system where a user can access his own entries and see the plain text results, but even if he was able to access someone else's they would be encrypted, unintelligible strings.

I have an idea of how to accomplish this, but perhaps it's not optimal or there exist tools to do this already in a more efficient way.

Store username as plain text, and password encrypted with sha1(). Or both encrypted with sha1().

Take the user's password (not the encrypted one, but the one he typed in and use it do define a key specific to that username and password, which will then be stored as a session variable.

Encrypt, or decrypt all of that users data with that key.

In my opinion even if someone gained access to the database and saw a list of plain text usernames and encrypted passwords they couldn't figure out the specific key since it's not stored anywhere. Therefore even if access was gained, they couldn't decipher the content of the sensitive database fields. Of course I'm building in ways to stop them accessing the database anyway, but as a catch-all effort this seems like a good set of steps.

Could the experts please comment on this, and offer some advice? Thanks a lot.


答:
As someone who has been both poacher (developer) and gamekeeper (DBA), I'm surprised many still don't see the value in this and consider it bloat.

Simply put:

For any table where records are added (but never updated) e.g. logins
  etc I'd consider adding a DATE_CREATED column.

For any table where records are added and updated, I'd consider adding
  a DATE_CREATED and a DATE_UPDATED column.

I've worked at many places where DATE_CREATED and DATE_UPDATED are included in every table by default as part of the design.

For larger databases with millions/billions of rows where the database update ran over the course of a few days, we also added a SOURCE column for some tables which tracked which data pot caused the update e.g. 3rd party feed, user update, DBA modification, data cleanse etc.

Title: When should a database table use timestamps?

Body:
First a note, I thought maybe this question belonged in the database exchange, but I think it is more broadly related to a programming solution as a whole than to databases. Will move to database exchange if people think thats the best one.

I was wondering when a database table should have a created and updated timestamp added?

The first obvious answer is that if any business logic needs to know when something was updated (like a transaction completion date etc) then it must go in.

But what about non business logic cases? For example I can think of scenarios where it would be really useful to know the date time that rows changed to help with fault finding e.g. some business logic is failing and looking at the related database rows its possible to identify that one row is being update before another row which is causing the error.

With this use case, it would make sense to give every table an update and create timestamp (except for maybe the most trivial enum tables that wouldn't be updated by any part of the application).

Giving every table a timestamp is surely a great way to quickly bog down a database (although could be wrong).

So when should a database table use create and update timestamps?