问:
Should I log trivial fixes?
I'm in a code shop of two. And while I understand that a bug tracker is useful where the number of programmers is greater or equal to one, I'm not so convinced that logging bugs, changes, and fixes is worth the time when they're trivial. When I find a simple bug, I understand it, fix it, and run it through some testing. And THEN I realized I need to go log it.

I know in theory that bug logging should be done somewhere between finding the bug and fixing the bug, but if fixing it is faster than logging it, it seems like a drag. In larger code-shops, the boss pays attention to who is doing what and it's nice to know where others are mucking about.

I find myself describing things that I've already fixed and then instantly closing them. I have doubts that anyone will ever look at this closed bug again. Is it time to trim the process fat?

答:
You should log every change you make to your system. There's nothing wrong with logging it after the event - as long as you link the bug report to the change number.

Then if anything ever goes wrong you can track back to the bug and find out why you made the change you did.

In the vast majority of cases you are right and no one will look at these ever again, but in the 1 out of 100 when something does go wrong this information will be invaluable - especially if the problem only surfaces 6 months down the line.

UPDATE

Obviously if you are still developing a new feature and discover a bug in part of the feature you thought you'd finished it's not necessary to log it as a separate change. In these cases I'd log it against the item requesting the major feature.

Once the system with the feature has been passed to QA or the customer, then it's necessary to do what I outlined above.

Title: Should I log trivial fixes?


答:
Depends how trivial, I use this measure:

If it takes longer to log it than it took to fix it, it ain't worth logging it.

ContentLicense: CC BY-SA 3.0

Title: Should I log trivial fixes?

Body:
I'm in a code shop of two. And while I understand that a bug tracker is useful where the number of programmers is greater or equal to one, I'm not so convinced that logging bugs, changes, and fixes is worth the time when they're trivial. When I find a simple bug, I understand it, fix it, and run it through some testing. And THEN I realized I need to go log it.

I know in theory that bug logging should be done somewhere between finding the bug and fixing the bug, but if fixing it is faster than logging it, it seems like a drag. In larger code-shops, the boss pays attention to who is doing what and it's nice to know where others are mucking about.

I find myself describing things that I've already fixed and then instantly closing them. I have doubts that anyone will ever look at this closed bug again. Is it time to trim the process fat?


答:
If you use a source control tool, then you can describe the bug you fixed in the commit description and that is usually sufficient documentation for super-small, trivial bug fixes.

Furthermore, if you use a bug/feature tracker that is fully integrated with your source control and repositories, like FogBugz and Kiln, you'll be able to use the global search tool to find these bug fixes and see what code changes you made quite easily.

Plus, you can assign a code review to your programming partner so he can review the trivial fix you made, but I digress...

Title: Should I log trivial fixes?


答:
Tracking is important, but consider another scenario as well: when it comes time for your review. It will happen formally in person, or informally without you there via your boss pulling up reports from the bug tracker.

Consider them 'gimmes' that end up boosting your numbers. After all, they are bugs that you've fixed, and you should be recognized for fixing them, even if they are trivial fixes.

Log them.

Title: Should I log trivial fixes?


答:
From a metrics point of view, it may well still be useful.

This information could be used to show the boss a number of things:

we need more developers

something else in the process is broken (why so many bugs? does the other guy generate most of the bugs), maybe showing you have too many bugs. Maybe there is something causing this? are you releasing too early? is enough testing being done?

a good list of what you have been working on come bonus time.

That all being said, it depends how small a bug you are talking about. One liners you happen to spot while adding new code would probably be pointless to log for example.

Title: Should I log trivial fixes?


问:
How do you share your craft with non programmers?
Sometimes I feel like a musician who can't play live shows. Programming is a pretty cool skill, and a very broad world, but a lot of it happens "off camera"- in your head, in your office, away from spectators.

You can of course talk about programming with other programmers, and there is peer programming, and you do get to create something that you can show to people, but when it comes to explaining to non programmers what is it that you do, or how was your day at work, it's sort of tricky.

How do you get the non programmers in your life to understand what is it that you do?

NOTE: this is not a repeat of Getting non-programmers to understand the development process, because that question was about managing client expectations.

答: I try to explain it in terms of solving a problem.  I just choose to use a computer program to solve the problem.  That way you can discuss what you have done in terms of the problem you are trying to solve.  Once they understand that, the jump to solving it through programming is not very far and can usually be made by non techie types.</p>

ContentLicense: CC BY-SA 2.5


答: I try to log every change I make regardless of the size of it.  You never know when you, or someone else (future or present), will need to go back and see if that change is the possible cause of something else.  </p>

Title: Should I log trivial fixes?


问:
Why are statements in many programming languages terminated by semicolons?
Is there a reason that a semi-colon was chosen as a line terminator instead of a different symbol?

I want to know the history behind this decision, and hope the answers will lead to insights that may influence future decisions.

答:
Most languages took the semi-colon because it was already widely in use for that purpose and changing made no sense.

And considering the first languages to make that choice, you'll have to consider what are the alternatives.  When designing a language, you want the needed characters to be available, and character sets at this time were coded on 6 bits, often with some patterns reserved, often with some characters not firmly defined (for a later occurrence of this, think about the national variants of ISO-646 -- the US variant is well know under the name ASCII -- which reuse the codes for "common" characters such as [, # or $, and see the effect in a context where there is only half as many code positions available and letters and digits reserving more than half of those).

There was probably no other character which could be used as statement separator as intuitively (. is probably already the only serious contender for that criteria) and without introducing lexing or parsing difficulties at a time when the parsing and lexing theory was still in elaboration (. is now out of question due to its usage in real numbers).


问:
What's the role of a Project Manager in Scrum?
What's the role of a Project Manager in Scrum?

I have heard that it is not advisable for the PM to be a SCRUM Master which I can see as making sense as the PM oversees the project whereas the SCRUM Master is more concerned with managing the work packages.

To my mind it would seem that having a PM as SCRUM Master goes against managin by exception, one of the principles of PRINCE2.

The PM should be more concerned with:

establishing the scope of the project, ensuring the business case for
the project remains valid

planning the number of iterations

maintaining the overall project plan including software release dates

acquiring external resources needed by the Scrum team e.g. users for
User Acceptance Testing

managing risks and issues which are escalated by the Scrum team

communicating with the executive including reporting progress

Could any PM's (or SCRUM Masters) experienced in managing agile projects using SCRUM give their experience/opinion on whether the two roles could/should be combined?

答:
In Scrum, the traditional role of the PM is really divided into the roles of the Product Owner and the Scrum Master, with some responsibility also falling to everyone on the Scrum team.

The Product Owner is responsible for defining the project scope, prioritizing work by maintaining the product backlog, deciding if the effort should continue into future iterations, and being involved in risk management and mitigation strategies as a representative of the user and customer. In other words, the Product Owner deals with things that happen outside the team, with regards to the user and customer, and provides a single focal point for this information.

The Scrum Master is more process and team oriented. This person manages the resources, often takes point on risk management and mitigation strategies, and deals with the process and ensuring that the people who need information but aren't on the Scrum team have access to it and visibility on the work being done and any successes and failures of the team.

Some work is delegated to the team as a whole. For example, there is no single individual providing organization and instructions - the team as a whole works with the product backlog and previous data to determine how much work to take on in a sprint. Also, risk management is another activity that falls to the whole team, with the Scrum Master facilitating the process.

Finally, some concepts don't map well to Scrum at all.

There isn't an up-front idea of the total number of iterations needed. The idea is to set a timebox on iterations (often 2-4 weeks) and have a potentially shippable deliverable that adds value. The project ends when the backlog is empty or the needs of the customer change such that funding another iteration would cost more than the value added by the work that can be done. Of course, it's not a blind idea - you know by watching the backlog and working with the Product Owner when the project is approaching a termination state.

In addition, potentially releasable software is produces no less frequently than at the completion of every sprint. The idea is that there is a value-adding product at the end of every iteration. This product has been designed, implemented, tested internally, and undergone acceptance testing. All documentation and guides associated with the product are also up-to-date. In other words, if the customer wants it, they can get it. However, they might not want to go through the effort of deploying a product at the end of every sprint, but it's an option. Because you are responsive to change, you should be able to denote an actually-shipped product in your sprint planning meeting.

It's not advisable to combine the role of Product Owner and Scrum Master because they are concerned with different things. The Product Owner is working from the perspective of the end user and the customer - deliver the most value in the least amount of time possible and demand a high quality product. The Scrum Master is team centric and provides a counter balance to ensure that the team isn't overworked, has the resources they need to do the best job, and that they are generally happy and productive people. I, personally, think that someone who is skilled enough can probably play both roles. However, it does take a skilled manager and leader to do so. There's a great deal of information about this in a Project Management Stack Exchange question about combining the roles of Scrum Master and Product Owner.


问:
What can I do to make sure my code gets maintained in a developer light environment?
I am a contract data analyst, so I bounce between jobs every 3-6 months, which I find to be a good fit for me, but it leads to some problems when it comes to coding. I mostly do statistics (I've asked a similar question on cross validated, but the answers there are not relevant here), but I have also found out that the business world loves excel and loves copying and pasting the same thing over and over again even more. This led me to learn how to write VBA scripts and then VB.NET programs to automate as many of these reports as I can.

I am certain my programs are not the most elegant, but I put a good bit of effort into making sure they work under as many cases as I can test, I add in exceptions and try to code so the program can handle changes in the files that it processes, but there is a limit, if you remove a huge portion of the data, there is a good chance my program is going to trip up, which I accept will inevitably happen. Usually a pretty minor change in the code fixes the problem and I do try and comment my code and make it readable under the assumption that some other person will have to read it some day.

My problem is that I generally get put on teams of folks with essentially no experience with programming (like VBA would be a huge stretch for anyone I work directly with). I am wondering what I should be doing as the person that wrote the code to do my best to keep it maintained. I have two approaches in mind (outlined next), but would be very happy to get any advice.

Solution 1: Find the more tech savvy coworkers and run them through the programs and what basic changes can be made. Honestly automating excel is about as easy as it can get when it comes to programming, so I feel like I could teach someone the basics of maintaining it pretty quick.

Solution 2: Get in touch with the IT department and show them what is going on and maybe they will be able to help. The problem here is that the IT department is constantly swamped (as I'm sure many of you know) and I feel like kind of a jerk for dumping more things on them.

I do leave my personal email address with places and am willing to answer quick questions via email, but I view the need for more exhaustive maintenance as something of an inevitability and would like to make sure I do my due diligence to make sure it gets done. I imagine some combination of the two approaches outlined there, but is there any kind of heads up I should give IT? I feel like I would be annoyed if I started getting requests to fix a program that I had never seen from some random guy that is no longer there.

答:
I like your first solution: find some tech-savvy employees there and teach them the basics

I usually find there are always a few tech-smart users at most companies. These people always seem to be quite happy to learn something new and interesting, and usually enjoy the break it gives them from whatever their regular job is. Just be sure they have your email and know to contact you with questions.


答:
What you really want is to be IN the IT dev team first and foremost.

Then it would be much easier for your work to become their responsibility once you leave, after you've done a proper handover.

They may well be swamped, but I'm sure they'd rather have hands on any systems now while you around.

I've seen a number of places work in that way with hacked together excel spreadsheets with thousands of lines of VBA written by some non techy becoming mission critical. Then when it falls over IT get blamed when they haven't ever seen the system.

Title: What can I do to make sure my code gets maintained in a developer light environment?

Body:
I am a contract data analyst, so I bounce between jobs every 3-6 months, which I find to be a good fit for me, but it leads to some problems when it comes to coding. I mostly do statistics (I've asked a similar question on cross validated, but the answers there are not relevant here), but I have also found out that the business world loves excel and loves copying and pasting the same thing over and over again even more. This led me to learn how to write VBA scripts and then VB.NET programs to automate as many of these reports as I can.

I am certain my programs are not the most elegant, but I put a good bit of effort into making sure they work under as many cases as I can test, I add in exceptions and try to code so the program can handle changes in the files that it processes, but there is a limit, if you remove a huge portion of the data, there is a good chance my program is going to trip up, which I accept will inevitably happen. Usually a pretty minor change in the code fixes the problem and I do try and comment my code and make it readable under the assumption that some other person will have to read it some day.

My problem is that I generally get put on teams of folks with essentially no experience with programming (like VBA would be a huge stretch for anyone I work directly with). I am wondering what I should be doing as the person that wrote the code to do my best to keep it maintained. I have two approaches in mind (outlined next), but would be very happy to get any advice.

Solution 1: Find the more tech savvy coworkers and run them through the programs and what basic changes can be made. Honestly automating excel is about as easy as it can get when it comes to programming, so I feel like I could teach someone the basics of maintaining it pretty quick.

Solution 2: Get in touch with the IT department and show them what is going on and maybe they will be able to help. The problem here is that the IT department is constantly swamped (as I'm sure many of you know) and I feel like kind of a jerk for dumping more things on them.

I do leave my personal email address with places and am willing to answer quick questions via email, but I view the need for more exhaustive maintenance as something of an inevitability and would like to make sure I do my due diligence to make sure it gets done. I imagine some combination of the two approaches outlined there, but is there any kind of heads up I should give IT? I feel like I would be annoyed if I started getting requests to fix a program that I had never seen from some random guy that is no longer there.


问:
How do you manage feature requests and software changes?
I am a Software Engineer and over the past few years I have become the de-facto software project manager simply because there isn't one. So to keep our sanity in the R&D/Engineering department, customers have become accustomed to coming to me with their requests. I have no experience in this realm so it is my first time acting as a project manager for software projects. I have managed other things but not software.

So, how do you manage software projects and mark priorities? Requests come in at infrequent intervals so we very well could be working on something for someone else and then another person comes in with a "rush" job that needs working on. Is it easier to just say First Come, First Serve or is it the person with the most money?

答:
The answers I see thus far are good.  One thing that I will specifically spell out is that you are going to have to be good at saying "No" to some requests.

If you allow the customer to set the urgency, it will almost always be "High" (or greater).

You (either you yourself, or a team, depending on your setup) will need to evaluate these requests, and prioritize them based on your own criteria.


问:
How do you accurately create estimates for programming projects given to you?
I am looking for some insight from you smart people on SO.  I'm a relatively new developer (3+ years of experience) primarily on the .NET framework, and I'm absolutely terrible at knowing how to properly estimate even the smallest of projects.  I know that it's going to be a pretty big hindrance to my upward mobility as well as my joy of programming if I don't figure out good tools, methodologies, approaches, etc.  Therefore, I am seeking your knowledge and wisdom on this subject.

I have heard of SWAG and have most of the time employed that to give my estimates in the past, but I don't feel comfortable just "feeling it out."  Certainly, from my experience of doing similar projects I can recall how long it took me and give a relatively accurate estimate, but even that isn't always very accurate.  Plus, it seems that inherent in every project are gotchas and unforeseeables to make estimating even more difficult.  Thoughts?

答:
We use the technique of componential estimate. It's how we call the type of estimation which is the most risk free for both – suppliers and clients

One can make use of componential type estimate for the whole development process. No need to re-estimate from scratch when you want to add, remove or replace features, services etc. You can easily remove a feature without affecting the accuracy - as you can see, this type is very flexible. It’s as closest as one might get to the precise price estimate. With a clear componential estimate, a prospect will have full understanding of what they pay for.

But to make such an estimate you should have clear requirements, understand all features of the project and what services your client needs. Usually you don't, but you should try. As a result you'll get a successful project and a happy client.

Hope this information will help you! For our team it's the best technique to make an accurate estimate.


问:
In hindsight, is basing XAML on XML a mistake or a good approach?
XAML is essentially a subset of XML. One of the main benefits of basing XAML on XML is said to be that it can be parsed with existing tools. And it can, to a large degree, although the (syntactically non-trivial) attribute values will stay in text form and require further parsing.

There are two major alternatives to describing a GUI in an XML-derived language. One is to do what WinForms did, and describe it in real code. There are numerous problems with this, though it’s not completely advantage-free (a question to compare XAML to this approach). The other major alternative is to design a completely new syntax specifically tailored for the task at hand. This is generally known as a domain-specific language.

So, in hindsight, and as a lesson for the future generations, was it a good idea to base XAML on XML, or would it have been better as a custom-designed domain-specific language? If we were designing an even better UI framework, should we pick XML or a custom DSL?

Since it’s much easier to think positively about the status quo, especially one that is quite liked by the community, I’ll give some example reasons for why building on top of XML might be considered a mistake.

Basing a language off XML has one thing going for it: it’s much easier to parse (the core parser is already available), requires much, much less design work, and alternative parsers are also much easier to write for 3rd party developers.

But the resulting language can be unsatisfying in various ways. It is rather verbose. If you change the type of something, you need to change it in the closing tag. It has very poor support for comments; it’s impossible to comment out an attribute. There are limitations placed on the content of attributes by XML. The markup extensions have to be built "on top" of the XML syntax, not integrated deeply and nicely into it. And, my personal favourite, if you set something via an attribute, you use completely different syntax than if you set the exact same thing as a content property.

It’s also said that since everyone knows XML, XAML requires less learning. Strictly speaking this is true, but learning the syntax is a tiny fraction of the time spent learning a new UI framework; it’s the framework’s concepts that make the curve steep. Besides, the idiosyncracies of an XML-based language might actually add to the "needs learning" basket.

Are these disadvantages outweighted by the ease of parsing? Should the next cool framework continue the tradition, or invest the time to design an awesome DSL that can’t be parsed by existing tools and whose syntax needs to be learned by everyone?

P.S. Not everyone confuses XAML and WPF, but some do. XAML is the XML-like thing. WPF is the framework with support for bindings, theming, hardware acceleration and a whole lot of other cool stuff.

答:
The only compelling reason to use XML is to establish an open data standard.  XAML is the same display language used in both Silverlight and WPF; any vendor can use the same markup standard to create a display definition for their own platform, and it can be reused in Silverlight or WPF.

In the aerospace industry, we have control rooms that, thanks to the advances of computer technology, are now reasonably flexible.  In the past, all the hardware was custom, unique, and very expensive; today it is all run with inexpensive, commonly-available, off-the-shelf PC's.  This greatly reduces vendor lock in.  However, display widgets are still written using ActiveX, because that's how it's always been done.

ActiveX requires access to Microsoft tools that are, well, obsolete.  So the Air Force and the Inter-Range Instrumentation Group is coming up with a Data Display Markup Language, which is XML based.  This will allow practitioners to design displays using XML markup, in the editor of their choice.  Sound familiar?

Nobody argues that XML is not without its faults.  But it's the best thing available for what it was designed to do, until something better comes along.

See Also

Why XML Doesn't Suck


问:
The reason to make some code open source
I have a library that makes architecture to load data from server and display all controls in table layout. It works great but it have a lot of TODOs there.
Also, this library in 99% created by me. I starts developing it in when I working in one company, continue developing in in other company - I just move code prototype to new working place.
Library contain large amount of iPhone features/hacks/fixes that write again make no sense.
All created iOS business applications by me, based on this library.

When library become needed in few projects simultaneously, I wanted to make library open source on GitHub but my Team Lead ask to create private repository for it.
Library contains and uses 12 open source libraries.

So:

Is it a good idea to make such library open source? It contains all my iOS development experience.

How to argue my wish to make library open source for Team Lead?

If I can't make this library open source - can I use it in other company? In contract, thats I work with, said that I assign all copyrights to employer.

答:
First, you need to make sure you can legally do this.  If any of it qualifies as a work for hire, you need to get permission from any company that owns some of the copyright.  This applies not just to the current company but to any past ones.

To answer your specific questions:

Probably, particularly if you can generalize it to be useful for other people.

Tell him you can get outside contributions.  If it's really good, tell him the company can sell support.

You at least need a license from any company that owns part of the copyright to those using the library (e.g. your next company).  It doesn't necessarily have to be an open source license.

OwnerDisplayName: Yanny

OwnerDisplayName: Matthew Flaschen


问:
Subscript binding and array categories
I am learning "Programming languages principles" and there is a lot of information about stuff which make up a programming language . Unfortunately every material I came across until now has a lot of technical jargon involved and is very difficult to understand (Atleast for a beginner sincerely trying to understand the topic on his own by reading the material) .

Can anyone explain me the "Subscript binding and array categories" in general .. The classification says there are five kinds of arrays -

1.Static array

2.Fixed stack-dynamic array

3.Stack dynamic array

4.Fixed heap dynamic array

5.Heap dynamic array

This is what I could understand from the definitions (almost on every article on this topic I came across) .

Static array - subscript ranges are statically bound and storage allocation is static.

I understood that the space for the array is allocated in memory at compile time (before run time) .

Fixed stack-dynamic array  - subscript ranges are statically bound, but the allocation is done at elaboration time during execution.

Now I didn't understand anything . What is meaning of the italicized phrases

Stack-dynamic array  - the subscript ranges are dynamically bound, and the storage allocation is dynamic “during execution.”  Once bound they remain fixed during the lifetime of the variable.

I dont understand what is meant by being 'bound' ?

I should be able to understand the remaining two definitions if I understand these three .

I know I am asking a lot .

Thanks :)

Here's a link I recently came across which I find useful for this topic . Anyone interested in this topic , check it out . :)

答:
To elaborate DeadMG's answer, it sounds like they mean:

Static array: an array whose size is known, and whose storage is allocated, at compile time. In C, you might write at global (file) scope:

```<code>int static_array[7];
</code>```

Fixed stack-dynamic array: you know the size of your array at compile time, but allow it to be allocated automatically on the stack (the size is fixed at compile time but the storage is allocated when you enter its scope, and released when you leave it)

```<code>void foo()
{
  int fixed_stack_dynamic_array[7];
  /* ... */
}
</code>```

Stack dynamic array: you don't know the size until runtime, eg. C99 allows this:

```<code>void foo(int n)
{
  int stack_dynamic_array[n];
  /* ... */
}
</code>```

Fixed heap dynamic array: same as the 2 except using explicit heap allocation

```<code>int * fixed_heap_dynamic_array = malloc(7 * sizeof(int));
</code>```

Heap dynamic array: you can probably guess this:

```<code>void foo(int n)
{
  int * heap_dynamic_array = malloc(n * sizeof(int));
}
</code>```

Is this the same book as Concepts of Programming Languages?  Because again, these aren't a useful classification of types, they only address the allocation mechanism. Once you pass any of these "different" things into a function, their classification under this scheme is irrelevant.

Title: Subscript binding and array categories

Body:
To elaborate DeadMG's answer, it sounds like they mean:

Static array: an array whose size is known, and whose storage is allocated, at compile time. In C, you might write at global (file) scope:

int static_array[7];

Fixed stack-dynamic array: you know the size of your array at compile time, but allow it to be allocated automatically on the stack (the size is fixed at compile time but the storage is allocated when you enter its scope, and released when you leave it)

void foo()
{
  int fixed_stack_dynamic_array[7];
  /* ... */
}

Stack dynamic array: you don't know the size until runtime, eg. C99 allows this:

void foo(int n)
{
  int stack_dynamic_array[n];
  /* ... */
}

Fixed heap dynamic array: same as the 2 except using explicit heap allocation

int * fixed_heap_dynamic_array = malloc(7 * sizeof(int));

Heap dynamic array: you can probably guess this:

void foo(int n)
{
  int * heap_dynamic_array = malloc(n * sizeof(int));
}

Is this the same book as Concepts of Programming Languages?  Because again, these aren't a useful classification of types, they only address the allocation mechanism. Once you pass any of these "different" things into a function, their classification under this scheme is irrelevant.


答:
Preamble

Even if that code is the result of all your knowledge about iOS please do not forget that you're paid for knowledge in your head not for the size of a .zip file in your usb drive.

Answer

I think you should check this with a lawyer (or some specialized forums) but at first sight:

To make or not a library Open Source can be a good idea (I think whenever possible it's always a good idea, I guess that's the reason we're all here on this site: to share knowledge) but it's your choice. Start reading something about Free Software Movement if you have any doubt. I don't want to start a debate here about this topic (even in the Open Source world there are a lot of different points of view).

Even if you write it by yourself probably you can't make it free: your employer paid you for that work, you used his structures and moreover your contract explicitly assert that he is the copyright owner. Imagine if people that wrote, for example, Microsoft Windows kernel release the source code in the Open Source community; do you think it's possible? Legally a company has the tools to protect from that. To do that you should provide the evidence that you did not write that software at work, that it's part of another personal/private project and you have been paid to integrate that library in the company product.

Even if everything above is satisfied you have to consider what you didn't write of that library. No matters if 99% or 50%, you can't steal someone else efforts. This is very important because it implies respect for their work (it doesn't matter how small compared to the total). Think that Open Source doesn't mean free of any rule; Open Source licenses grant rights to owners (and they decide what you can do with that software).

Ok, I'm not an expert about this and I'm not a lawyer so these are only few considerations about this topic but I hope they helped a little bit to understand what you can do.

Title: The reason to make some code open source

Body:
I have a library that makes architecture to load data from server and display all controls in table layout. It works great but it have a lot of TODOs there.
Also, this library in 99% created by me. I starts developing it in when I working in one company, continue developing in in other company - I just move code prototype to new working place.
Library contain large amount of iPhone features/hacks/fixes that write again make no sense.
All created iOS business applications by me, based on this library.

When library become needed in few projects simultaneously, I wanted to make library open source on GitHub but my Team Lead ask to create private repository for it.
Library contains and uses 12 open source libraries.

So:

Is it a good idea to make such library open source? It contains all my iOS development experience.

How to argue my wish to make library open source for Team Lead?

If I can't make this library open source - can I use it in other company? In contract, thats I work with, said that I assign all copyrights to employer.


问:
Are operators clearer to read than keywords or functions?
It's a bit subjective, but I'm hoping to get a clearer understanding of what factors make an operator clear to use vs obtuse and difficult.  I've been considering language designs recently, and one issue that I always circle back around on is when to make some key operation in the language an operator, and when to use a keyword or function.

Haskell is somewhat notorious for this, as custom operators are easy to create and often a new data type will come packaged with several operators for use on it.  The Parsec library, for example, comes with a ton of operators for combining parsers together, with gems like >. and .>  I can't even recall what they mean right now, but I do remember them being very easy to work with once I had memorized what they actually mean.  Would a function call such as leftCompose(parser1, parser2) have been better?  Certainly more verbose, but clearer in some ways.

Operator overloads in C-like languages are a similar issue, but conflated by the additional problem of overloading the meaning of familiar operators like + with unusual new meanings.

In any new language, this would seem like a pretty tough issue.  In F#, for example, casting uses a mathematically derived type-casting operator, instead of the C# style cast syntax or the verbose VB style.  C#: (int32) x VB: CType(x, int32) F#: x :> int32

In theory a new language could have operators for most built-in functionality.  Instead of def or dec or var for variable declaration, why not ! name or @ name or something similar.  It certainly shortens up declaration followed by binding: @x := 5 instead of declare x = 5 or let x = 5  Most code is going to require a lot of variable definitions, so why not?

When is an operator clear and useful, and when is it obscuring?

答:
To me, an operator stops being useful when you can no longer read the line of code out loud or in your head, and have it make sense.

For example, declare x = 5 reads as "declare x equals 5" or let x = 5 can be read as "let x equal 5", which is very understandable when read out loud, however reading @x := 5 is read as "at x colon equals 5" (or "at x is defined to be 5" if you're a mathematician), which doesn't make sense at all.

So in my opinion, use an operator if the code can be read out loud and understood by a reasonably intelligent person not familiar with the language, but use function names if not.


答:
IANAL

If you generated the first part of the code in the first company on their time they can probably already have you prosecuted for theft of the prototype.  Making it open source may lay you open to charges of theft from both employers.


答:
from a general language design point of view there need not be any difference between functions and operators. One could describe functions as prefix operations with any (or even variable) arity. And keywords can be seen as just functions or operators with reserved names (which is useful in designing a grammar).

All of these decision eventually come down to how do you want the notation to read and that as you say is subjective, though one can make some obvious rationalisations e.g. use the usual infix operators for maths as everyone knows them

Lastly Dijkstra wrote an interesting justification of the mathematical notations he used, which includes a good discussion of the trade-offs of infix vs prefix notations

Title: Are operators clearer to read than keywords or functions?

Body:
It's a bit subjective, but I'm hoping to get a clearer understanding of what factors make an operator clear to use vs obtuse and difficult.  I've been considering language designs recently, and one issue that I always circle back around on is when to make some key operation in the language an operator, and when to use a keyword or function.

Haskell is somewhat notorious for this, as custom operators are easy to create and often a new data type will come packaged with several operators for use on it.  The Parsec library, for example, comes with a ton of operators for combining parsers together, with gems like >. and .>  I can't even recall what they mean right now, but I do remember them being very easy to work with once I had memorized what they actually mean.  Would a function call such as leftCompose(parser1, parser2) have been better?  Certainly more verbose, but clearer in some ways.

Operator overloads in C-like languages are a similar issue, but conflated by the additional problem of overloading the meaning of familiar operators like + with unusual new meanings.

In any new language, this would seem like a pretty tough issue.  In F#, for example, casting uses a mathematically derived type-casting operator, instead of the C# style cast syntax or the verbose VB style.  C#: (int32) x VB: CType(x, int32) F#: x :> int32

In theory a new language could have operators for most built-in functionality.  Instead of def or dec or var for variable declaration, why not ! name or @ name or something similar.  It certainly shortens up declaration followed by binding: @x := 5 instead of declare x = 5 or let x = 5  Most code is going to require a lot of variable definitions, so why not?

When is an operator clear and useful, and when is it obscuring?


答:
An operator is clear and useful when it is familiar. And that probably means that overloading operators should be done only when the chosen operator is near enough (as in form, precedence and associativity) as an already established practice.

But digging a little further, there are two aspects.

The syntax (infix for operator as opposed to prefix for function call syntax) and the naming.

For the syntax, there is another case where infix are enough clearer than prefix that it may warrant the effort becoming familiar: when calls are chained and nested.

Compare a * b + c * d + e * f with +(+(*(a, b), *(c, d)), *(e, f)) or + + * a b * c d * e f (both are parsable in the same condition as the infix version). The fact that the + separate the terms instead of preceding one of them by a long way make it more readable in my eyes (but you have to remember precedence rules which aren't needed for prefix syntax). If you need to compound things in this way, the long term benefit way be worth the learning cost. And you keep this advantage even if you name your operators with letters instead of using symbols.

Concerning the naming of operators, I see few advantages in using something else than established symbols or clear name.  Yes they may be shorter, but they are really cryptic and will be quickly forgotten if you don't have a good reason to already know them.

A third aspect if you take a language design POV, is if the set of operators should be open or closed -- can you add operator or not --, and if the priority and associativity should be user specifiable or not.  My first take would be to be careful and not provide user specifiable priority and associativity, while I'd be more open on having an open set (it would increase the push to use operator overloading, but would decrease the one to use a bad one just to benefit from the infix syntax where it is useful).


问:
Tooling and support for message format specifications
How do most companies define and manage message format specifications? Is it common for companies to create custom tools for creating and working with these documents?

At work we have a lot of systems that communicate via UDP messages. Each system has its own Interface Control Document (in Word or in HTML) which describes its message scheme. The documents have descriptions of each message along with its fields, and usage notes.

We're looking to standardize the format of these ICDs and write some tools that help create them. I was thinking we should create an ICD schema, and define the ICDs in some data-interchange format (XML, JSON, protobuf). Then we could create parsers that generate human-readable documentation (HTML, PDF), or even message parsing code (where useful and appropriate).

I don't want to reinvent the wheel, and I don't want to get too carried away. Does the above proposal sound reasonable?

答:
Sounds reasonable - I've seen a few message formats specified in XML, although that spec doesn't generally have the detailed comments necessary for good documentation. It's fairly straightforward to generate code from it too.

I haven't seen anything more general or standardized (and naturally no two of these specs use the same schema), so I don't think you're reinventing the wheel.


答:
In management speak:

If it's not core to your activity outsource it.

Opensourcing a library is equivalent to outsourcing it for free.


问:
Are Domain Objects in Domain Driven Design only supposed to be write-only?
I've been reading about Domain Driven Design for almost two years and have been cautiously been introducing some concepts in to my daily work or at least making plans for how things I do regularly could be done within a Domain Driven Design.

One conclusion that I've beginning to come to especially in response to reading more about Event Sourcing and Command Query Responsibility Segregation (CQRS) that perhaps domain objects are intended to be used only for write purposes. To be more clear, it seems that what people are subtly suggesting in much of the documentation I've read that the domain objects are responsible for doing domain centric operations/calculations, validation, and then are there mainly to provide a road to persistence through the infrastructure provided within a Repository implementation. Although I do like the fact that this may simplifies the domain model greatly as it cuts out the responsibility of exposing state.

If it is indeed correct that domain objects are mainly to be used as write-only objects then that raises some questions for me that I'm hoping somebody could answer.

How does one perform unit tests on an object that has setters, or methods that modify the state of an object but that provide no outwardly public interface to read the state from such as property getters in C#? Is it okay to expose state solely for the purpose of making that object testable?

How does one show to a user the results of calculations or operations done in the domain without having to persist them and then pull the results from persist store outside of the context of the domain? Is it okay to expose state solely for the purpose of showing results.

Is the rule of thumb that the only property getters (get accessors) should be ones that are also writable in the domain? Or said differently should readonly properties be the only thing to avoid since they are only there for read purposes and thus do not play a a necessary role in the actual domain model?

Related material:

TDD, DDD and Encapsulation

答:
Not sure that there is a 'one true way' answer for a design approach that, to be fair, is still evolving. First, DDD and CQRS are not the same thing although the CQRS folks seem to have derived from a DDD-influenced starting point.

There's a lot going on in the DDD mindset and much of it has to do with properly defined boundaries of problems, communication among stakeholders, and interaction between systems, not necessarily a specific implementation in code, so I don't think being too hard-core is a virtue.

You are maybe seeing some of the debate around whether and how domain objects should be changeable, and what function a domain object serves in a system as a whole.  CQRS splits a system into read and write pathways, so it's sensible to conclude that you don't actually need read access when you're on the write pathway. Reading then becomes something you do against the events raised by some domain objects and consumed (handled) by others. If you go back a bit in the CQRS history, you'll find arguments that domain objects shouldn't have setters, only getters and a single 'handler' method.  The logic here is that only consuming events should result in state change, and that change is entirely handled internally by the domain object.

You show the results of change by treating them as separate artifacts of change, putting them into a separate, flat persistent structure (e.g., a table) and reading it as if you were just reading a report on the current and historical state of the system. For example, you could consume an event by extracting the data you need to read and saving it to a database table that maps closely to a single view (e.g. a screen) of your system.

If you do experiment with this style, be cognizant that other programmers are likely not going to be familiar with this approach, and that there are relatively few (but interesting) scenarios where it's justifiable as a design approach.

For unit testing, there are a couple of approaches that may work for you.  The first, and most natural, is to verify the events you expect to see raised by your domain objects are correct.  A domain object might raise a generic changed event holding information about the change.  You could verify that.  You could verify the fact that the event was raised at all, and that other events weren't raised.

Another approach is to use Test Spies that expose readable attributes on your domain object so you can verify state changes. For instance, you can inherit from your domain object, add some accessors to read what would otherwise be encapsulated state and verify that it's correct.

Again, you're confused because these approaches are confusing. If you're looking to adopt some good ideas into your programming, take the juicy bits first.  DDD boundaries and making roles explicit are changes to your way of thinking about communicating with your code.  CQRS at a minimum suggests that reading data and writing data are segregable operations.  That insight leads you to think very clearly about what the role of the data you do need to present is, how much you really need, who's consuming it, how fresh does it need to be, etc...  You don't need a full blown Event Sourcing implementation to adopt better encapsulation in your coding. You can start by just focusing on atomic operations within your object, "Tell, Don't Ask" approaches to object interface design, and Inversion of Control through events/handlers rather than strict control within procedural services.


问:
SOLID vs. static methods
Here's a problem I frequently run into: Let there be a web shop project that has a Product class. I want to add a feature which allows users to post reviews to a product. So I have a Review class which references a product. Now I need a method that lists all reviews to a product. There's two possibilities:

(A)

```<code>public class Product {
  ...
  public Collection<Review> getReviews() {...}
}
</code>```

(B)

```<code>public class Review {
  ...
  static public Collection<Review> forProduct( Product product ) {...}
}
</code>```

From looking at the code, I'd choose (A): It's not static and it doesn't need a parameter. However, I sense that (A) violates the Single Responsibility Principle (SRP) and the Open-Closed Principle (OCP) whereas (B) doesn't:

(SRP) When I want to change the way reviews are collected for a product, I have to change the Product class. But there should be only one reason why to change the Product class. And that's certainly not the reviews. If I pack every feature that has something to do with products in Product, it'll soon be clattered.

(OCP) I have to change the Product class to extend it with this feature. I think this violates the 'Closed for change' part of the principle. Before I got the customer's request for implementing the reviews, I considered Product as finished, and "closed" it.

What is more important: following the SOLID principles, or having a simpler interface?

Or am I doing something wrong here altogether?

Result

Wow, thanks for all of your great answers! It's hard to pick one as official answer.

Let me summarize the main arguments from the answers:

pro (A): OCP is not a law and readability of the code matters as well.

pro (A): the entity relationship should be navigable. Both classes may know about this relationship.

pro (A)+(B): do both and delegate in (A) to (B) so Product is less likely to be changed again.

pro (C): put finder methods into third class (service) where it's not static.

contra (B): impedes mocking in tests.

A few additional things my colleges at work contributed:

pro (B): our ORM framework can automatically generate the code for (B).

pro (A): for technical reasons of our ORM framework, it will be necessary to change the "closed" entity in some cases, independently from where the finder goes to. So I won't always be able to stick to SOLID, anyway.

contra (C): to much fuss ;-)

Conclusion

I'm using both (A)+(B) with delegation for my current project. In a service-oriented environment, however, I'll go with (C).

答:
Patterns and principles are guidelines, not rules written in the stone. In my opinion the question is not if it's better to follow SOLID principles or to keep a simpler interface. What you should ask yourself is what is more readable and comprehensible to most of people. Often this means that it must be as near as possible to the domain.

In this case I would prefer the solution (B) because for me  the starting point is the Product, not the Review but imagine you're writing a software to manage reviews. In that case the center is the Review so solution (A) may be preferable.

When I have a lot of methods like this ("connections" between classes) I strip them all outside and I create one (or more) new static class to organize them. Usually you can see them as queries or kind of repository.

Title: SOLID vs. static methods


答:
I think operators are much more readable when their function closely mirrors their familiar, mathematical purpose.  For example, standard operators such as +, -, etc. are more readable than Add or Subtract when performing addition and subtraction. The operator's behavior must be clearly defined.  I can tolerate an overload of the meaning of + for list concatenation, for example.  Ideally the operation would not have side effects, returning a value instead of mutating.

I've struggled with shortcut operators for functions like fold, though.  Obviously more experience with them would ease this, but I find foldRight more readable than /: .


问:
Make a big deal out of == true?
There is a colleague of mine who constantly writes:

```<code>if (someBool == true)
</code>```

It drives me up the wall!  Should I make a big deal of it or just drop it?

答: Remember you are working as part of a team, so you need to work these things out together.  "Plays nice with others" is still an important personality trait even after elementary school :)</p>

Title: Make a big deal out of == true?


答:
Your Product can just delegate to your static Review method, in which case you are providing a convenient interface in a natural location (Product.getReviews) but your implementation details are in Review.getForProduct.

SOLID are guidelines and should result in a simple, sensible interface. Alternatively, you could derive SOLID from simple, sensible interfaces.  It's all about dependency management within code.  The goal is to minimize the dependencies that create friction and create barriers to inevitable change.

Title: SOLID vs. static methods

Body:
Here's a problem I frequently run into: Let there be a web shop project that has a Product class. I want to add a feature which allows users to post reviews to a product. So I have a Review class which references a product. Now I need a method that lists all reviews to a product. There's two possibilities:

(A)

```<code>public class Product {
  ...
  public Collection<Review> getReviews() {...}
}
</code>```

(B)

```<code>public class Review {
  ...
  static public Collection<Review> forProduct( Product product ) {...}
}
</code>```

From looking at the code, I'd choose (A): It's not static and it doesn't need a parameter. However, I sense that (A) violates the Single Responsibility Principle (SRP) and the Open-Closed Principle (OCP) whereas (B) doesn't:

(SRP) When I want to change the way reviews are collected for a product, I have to change the Product class. But there should be only one reason why to change the Product class. And that's certainly not the reviews. If I pack every feature that has something to do with products in Product, it'll soon be clattered.

(OCP) I have to change the Product class to extend it with this feature. I think this violates the 'Closed for change' part of the principle. Before I got the customer's request for implementing the reviews, I considered Product as finished, and "closed" it.

What is more important: following the SOLID principles, or having a simpler interface?

Or am I doing something wrong here altogether?

Result

Wow, thanks for all of your great answers! It's hard to pick one as official answer.

Let me summarize the main arguments from the answers:

pro (A): OCP is not a law and readability of the code matters as well.

pro (A): the entity relationship should be navigable. Both classes may know about this relationship.

pro (A)+(B): do both and delegate in (A) to (B) so Product is less likely to be changed again.

pro (C): put finder methods into third class (service) where it's not static.

contra (B): impedes mocking in tests.

A few additional things my colleges at work contributed:

pro (B): our ORM framework can automatically generate the code for (B).

pro (A): for technical reasons of our ORM framework, it will be necessary to change the "closed" entity in some cases, independently from where the finder goes to. So I won't always be able to stick to SOLID, anyway.

contra (C): to much fuss ;-)

Conclusion

I'm using both (A)+(B) with delegation for my current project. In a service-oriented environment, however, I'll go with (C).


答:
Operators-as-symbols are useful when they intuitively make sense.  + and - are obviously addition and subtraction, for example, which is why pretty much every language ever uses them as their operators.  Same with comparison (< and > are taught in grade school, and <= and >= are intuitive extensions of the basic comparisons when you understand that there's no underlined-comparison keys on the standard keyboard.)

* and / are less immediately obvious, but they're used universally and their position on the numeric keypad right next to the + and - keys helps provide context.  C's << and >> are in the same category: when you understand what a left-shift and a right-shift are, it's not too difficult to understand the mnemonics behind the arrows.

Then you come to some of the truly strange ones, stuff that can turn C code into unreadable operator soup.  (Picking on C here because it's a very operator-heavy example whose syntax pretty much everyone is familiar with, through either working with C or with descendant languages.)  For example, then % operator.  Everyone knows what that is: it's a percent sign... right?  Except in C, it has nothing to do with division by 100; it's the modulus operator.  That makes zero sense mnemonically, but there it is!

Even worse are the boolean operators.  & as an and makes sense, except that there are two different & operators which do two different things, and both are syntactically valid in any case where one of them is valid, even though only one of them ever actually makes sense in any given case.  That's just a recipe for confusion!  The or, xor and not operators are even worse, since they don't use mnemonically useful symbols, and aren't consistent either.  (No double-xor operator, and the logical and bitwise not use two different symbols instead of one symbol and a doubled-up version.)

And just to make it worse, the & and * operators get reused for completely different things, which makes the language harder for both people and compilers to parse.  (What does A * B mean?  It depends entirely on the context: is A a type or a variable?)

Admittedly, I never spoke with Dennis Ritchie and asked him about the design decisions he made in the language, but so much of it feels like the philosophy behind operators was "symbols for the sake of symbols."

Contrast this with Pascal, which has the same operators as C, but a different philosophy in representing them: operators should be intuitive and easy to read.  The arithmetic operators are the same.  The modulus operator is the word mod, because there's no symbol on the keyboard that obviously means "modulus".  The logical operators are and, or, xor and not, and there's only one of each; the compiler knows whether you need the boolean or bitwise version based on whether you're operating on booleans or numbers, eliminating a whole class of errors.  This makes Pascal code far easier to understand than C code, especially in a modern editor with syntax highlighting so the operators and keywords are visually distinct from identifiers.


答:
If you think that the Product is the right place to find the product's Reviews, you can always give the Product a helping class to do the job for it. (You can tell because your business will never talk about a review except in terms of a product).

For instance, I would be tempted to inject something that played the role of a review retriever. I would probably give it the interface IRetrieveReviews. You can put this in the constructor of the product (Dependency Injection). If you want to change how the reviews are retrieved you can do it easily by injecting a different collaborator - a TwitterReviewRetriever or an AmazonReviewRetriever or MultipleSourceReviewRetriever or whatever else you need.

Both now have a single responsibility (being the go-to for all things product-related, and retrieving reviews, respectively), and in the future the product's behavior with respect to reviews can be modified without actually changing the product (you could extend it as a ProductWithReviews if you really wanted to be pedantic about your SOLID principles, but this would be good enough for me).

Title: SOLID vs. static methods


答:
I would have a ProductsReview class. You say Review is new anyway. That doesn't mean it can just be anything. It still must have only one reason to change. If you change how you get the reviews for whatever reason you would have to change the Review class.

That isn't correct.

You are putting the static method in Review class because... why?  Isn't that what you are struggling with? Isn't that the whole problem?

Then don't. Make a class that sole responsibility is getting the products reviews. You can then subclass it to ProductReviewsByStartRating whatever. Or subclass it to get reviews for a class of products.

Title: SOLID vs. static methods


问:
Derived Classes and namespaces
I am deriving a class, for use in my application, from a class provided by another group.  Should the derived class be in the namespace for my application or the namespace of the parent class?

While I am extending the class to add features I need, the added features are not specific to my application. The project that contains the parent class is also rarely updated so there is a chance my additions would never be picked up... Maybe none of this matters.

答:
It should be in the namespace of your application

Since you are extending the class to add features for your application, the class should be part of your application's namespace, not a different one.

Now if other applications would also be using this derived class in addition to your 1st one, then I would make a separate library file (and namespace) which contains any customized components from the first namespace, and import this library into any application that needs to use the derived class.

Title: Derived Classes and namespaces


答:
You are sub classing an object from the library (your parent class namespace) to make the library evolved rather than to create hybrid between the application space and the library. Hence, ideally such derivation should/could be helpful to other applications as well. If the derived class is in same namespace as parent class, this would be relatively straight forwards; where as if it is in your app's namespace, would introduce an unnecessary dependency for the App2 on your app. Hence, the derived class should be in libraries namespace. </p>

<p>Further you may want to read this: Why is subclassing too much bad (and hence why should we use prototypes to do away with it)? </p>

Title: Derived Classes and namespaces

Body:
I am deriving a class, for use in my application, from a class provided by another group.  Should the derived class be in the namespace for my application or the namespace of the parent class?

While I am extending the class to add features I need, the added features are not specific to my application. The project that contains the parent class is also rarely updated so there is a chance my additions would never be picked up... Maybe none of this matters.

Body:
You are sub classing an object from the library (your parent class namespace) to make the library evolved rather than to create hybrid between the application space and the library. Hence, ideally such derivation should/could be helpful to other applications as well. If the derived class is in same namespace as parent class, this would be relatively straight forwards; where as if it is in your app's namespace, would introduce an unnecessary dependency for the App2 on your app. Hence, the derived class should be in libraries namespace.

Further you may want to read this: Why is subclassing too much bad (and hence why should we use prototypes to do away with it)?


问:
is it programmer's duty to disable directory listing?
Recently I have project in which a directory listing is enabled, due to which some scripts can be seen by outside world. I asked website administrator and he said it's not his responsibility, its the programmer's job. I also asked programmer about this and he said that the script is actually a cron job, and according to him, he has to test the script on webserver as there is a difference between development and production environment, so he placed there to test that. According to him, there was no direct link as he assumed directory listing is disabled and taken care by administrator.

Who is the right person to do this?

答: Both. It is a problem that has to be solved. If the programmer can do it, why not do it? If the admin can do it, why not do it? If the programmer cannot, it's obviously the responsibility of the admin, but the requirement should (probably) have been documented in the release docs.</p>


答:
SOLID are guidelines, so influence decision making rather than dictate it.

One thing to be aware of when using static methods is their impact on testability.

Testing forProduct(Product product) won't a problem.

Testing something that depends on it will be.

You won't have a seam for isolating the dependant Code-Under-Test (CUT) to use a mock, since when the application is running, the static methods necessarily exist.

Let's have a method called CUT() that calls forProduct()

If forProduct() is static you can't test CUT() as an atomic unit and all of your tests become integration tests that test unit logic.

A failure in a test for CUT, could be caused by a problem in CUT() or in forProduct() (or any of its dependent code) which removes the diagnosis benefits of unit tests.

See this excellent blog post for more detailed information: http://googletesting.blogspot.com/2008/12/static-methods-are-death-to-testability.html

This can lead to frustration with failing tests and abandonment of good practices and benefits that surround them.

Title: SOLID vs. static methods


问:
How do you handle changes in client focus?
We are working on a large ongoing project that has continual feature changes. These features could take as long as 3 - 4 weeks to complete.

This would of course be fine, except the client is always changing its priorities/focus based on pushes from THEIR clients who may want certain features implemented before others.

So, we often have to shift gears in the middle of a major feature build and start a new feature that all of a sudden has a greater priority. We then of course have the time cost of merging everything together at some point, and also the cost of that lost momentum on the original feature.

Our estimates are out the window at that point.

Is there any good way to handle this?

Some options I've thought of:

assume this is the way things will be, and apply a 'distracted client' factor of up to 100% on all estimates (this is dangerous in the case where we can actually complete a feature without interruption)

educate the client on the costs of shifting gears, and perhaps apply a change premium to previous estimates if they want us to change to working on a different feature

refuse to work on more than one feature/release at a time (aside from bug fixes). This is probably not realistic.

I'm looking forward to hearing about how others have tackled this. It can't be uncommon.

答:
I agree most closely with #2.  However, you better make sure that you are careful with the wording in your contract.

Obviously, you are going to have to have some flexibility (on both sides) to allow some further feature definition on existing features, and allow for some additional (small) features to be added to fill in any missing functionality that is thought of later.

However, if there are big changes, then you need to make the client feel the cost.  Explaining the cost to them is one thing, but unless you actually pass it on to them in a  way, they are unlikely to change.  It may even pay to draw up a second contract for that new work, if it is truly new work.

Make the cost realistic.  You don't want to gouge your client, but you also don't want to have constant context switching - in the long run, that could lead to bad software.  If you come up with a cost that actually makes the context switching worthwhile, and they agree to it, then everybody wins.


问:
Should I log trivial fixes?
I'm in a code shop of two. And while I understand that a bug tracker is useful where the number of programmers is greater or equal to one, I'm not so convinced that logging bugs, changes, and fixes is worth the time when they're trivial. When I find a simple bug, I understand it, fix it, and run it through some testing. And THEN I realized I need to go log it.

I know in theory that bug logging should be done somewhere between finding the bug and fixing the bug, but if fixing it is faster than logging it, it seems like a drag. In larger code-shops, the boss pays attention to who is doing what and it's nice to know where others are mucking about.

I find myself describing things that I've already fixed and then instantly closing them. I have doubts that anyone will ever look at this closed bug again. Is it time to trim the process fat?

答:
To answer this really depends on where you are in the process.

These can apply to a new project or a new feature set being designed.

Initial Design
If you find bugs on code that we created during initial design then creating a bug track for it would not be necessary. I would suggest a separate commit for the change so you can easily unwind it if you find a problem later.

Testing

Code is usualy still conidered imature during unit testing so unless it is done by a different group I would say no.  If unit testing is done by a different group than a bug tracker is a good way to formalize the testing procedure.

CSCI testing depends. Is it done by another group? If so then yes (see above).  Is this the last step of testing before release? Then yes, because at this point your software should be considered mature.  If you are interested in metrics then it would also be good to start tracking bugs at this point.

For any higher level of testing then you should use bug tracking.  At these points your software should be considered mature and tracking bugs is important.

Release

You should always track bugs on released code. This is important for accountability.

Streamlining a process to fit your needs is also important. Do you really need a huge bug tracking system?  Are all the fields really that important for a team of 2 people?

Title: Should I log trivial fixes?


答:
Is it possible that someone else could encounter the bug, perhaps in an older version of the software that's been released to the outside world?  If so, then logging both the bug and the fix can be useful.

Others have suggested that if it takes longer to log the bug than to fix it, then it's not worth logging.  I suggest that the relevant time span is not between finding the bug and fixing it, it's between the time the bug was introduced and the time the fix is released.

If the change and release history indicate that the bug has never seen the light of the day, then logging the fix when you check it into source control should be sufficient.

This is pretty close to this question, but I'm not sure it's a duplicate, since this one focuses on trivial fixes.

Title: Should I log trivial fixes?


问:
JSF for an internet facing, high traffic web application
I, perhaps, made a wrong choice of going with a Component-based Framework like JSF for an internet facing, high traffic web application.
Development with JSF has although been easier but what I fear now is whether JSF would allow me that scalability & performance with all it fundamental problems & issues. State saving in a high traffic web app, does that make sense at all!?

How do I tune up my JSF app now to make it perform better under heavy load? I am already trying to reduce the state / component tree by reducing the no of components on page. What are other things I can tune up to make JSF app perform better ?

答:
What performance characteristics are you trying to achieve?

You should start with the threshold that is acceptable. For example, you don't want users to wait for more than 3 seconds for the login page to load.

Then you need to create a time budget.  For example, set timing points at the boundaries of your application (browser, application, DB etc) so you know exactly where the time is being spent.

Only then should you look to tune the individual components within your application architecture.  JSF might not even be a problem :-)


答:
It would be a good idea to see what session scoped beans are necessary for the session and which can just be request scoped.  Further, try to see where you can realistically clean up session scoped beans when you have finished with them as this will reduce session size.

If it is server memory that is out of control you can configure it to store session state on the client side, however this will increase the size of requests and responses through your servers so bandwidth may take a hit.

Likewise if bandwidth is the bottleneck then try storing session state on the server to reduce the request and response sizes.

Martijn is correct however, you should take the time to properly evaluate your performance bottlenecks with a proper profiling tool before pointing your finger at JSF.  This very well may also be a database issue as well.

Body:
I, perhaps, made a wrong choice of going with a Component-based Framework like JSF for an internet facing, high traffic web application.
Development with JSF has although been easier but what I fear now is whether JSF would allow me that scalability & performance with all it fundamental problems & issues. State saving in a high traffic web app, does that make sense at all!?

How do I tune up my JSF app now to make it perform better under heavy load? I am already trying to reduce the state / component tree by reducing the no of components on page. What are other things I can tune up to make JSF app perform better ?


答:
Funny because I always replace code like:

```<code>if(foo) {
</code>```

With:

```<code>if(true == foo) {
if(false == foo) {
</code>```

But I got this habit because most of the time the code I worked with didn't have clear variable names.

Title: Make a big deal out of == true?

Body:
There is a colleague of mine who constantly writes:

```<code>if (someBool == true)
</code>```

It drives me up the wall!  Should I make a big deal of it or just drop it?

Body:
Funny because I always replace code like:

if(foo) {

With:

if(true == foo) {
if(false == foo) {

But I got this habit because most of the time the code I worked with didn't have clear variable names.


问:
Why is Twitto not secure?
I've come across Twitto, which basically is a web framework that fits in a tweet. It is so short that I can post the code here :

```<code>require __DIR__.'/c.php';
if (!is_callable($c = @$_GET['c'] ?: function() { echo 'Woah!'; }))
  throw new Exception('Error');
$c();
</code>```

It basically searches for a file named c.php and calls whatever function in that files that is the same name as $_GET['c'].

On the project's website, there is a big red banner at the bottom of the page that reads :

» TWITTO IS NOT SECURE, DON'T USE IT FOR YOUR NEXT WEBSITE «

I am no PHP guru, but to me it looks like if you take all the precautions you normally take with a standard PHP site (sanitizing user input, etc), it should be secure enough ?

What is wrong with this tiny framework ?

EDIT : I understand why this framework is not secure AS-IS, but with the proper bootstrapping and validation checks and everything inside the function you call, it should be just as secure as any other framework ?

答:
I'ts because of this:

The "Hello World!" controller is now accessible at
  /twitto.php?c=hello_world.

Anybody can execute your PHP SERVER SIDE code from any browser! (With a simple HTTP GET)!

EDIT I'm pretty sure this call any standard PHP function, Not just the ones in the C.php file, how can you secure that?

Title: Why is Twitto not secure?


答:
This is not secure, since it allows to run any function available on your system.

It's difficult to find a good example of a function which will cause too much harm, since, for example, PHP doesn't have a magic "format my server" parameterless function. Still:

twitto.php?c=phpinfo

for example will display everything about your system to a hacker. Pretty nice, isn't it?

In the same way, you may add some parameterless functions to your app, without expecting them to be called by the end users. For example:

DisplayUsersInfo() flushes the information about the users, including the sensitive data,

ShowAdminTab(TAB_USERS) shows the users tab in the administration panel by calling DisplayUsersInfo.

The ShowAdminTab($tab) is called only after authentication and other means which protect the administration panel from unauthorized access. Fine. Then somebody calls twitto.php?c=DisplayUsersInfo. No authentication required.

Title: Why is Twitto not secure?

Body:
I've come across Twitto, which basically is a web framework that fits in a tweet. It is so short that I can post the code here :

```<code>require __DIR__.'/c.php';
if (!is_callable($c = @$_GET['c'] ?: function() { echo 'Woah!'; }))
  throw new Exception('Error');
$c();
</code>```

It basically searches for a file named c.php and calls whatever function in that files that is the same name as $_GET['c'].

On the project's website, there is a big red banner at the bottom of the page that reads :

» TWITTO IS NOT SECURE, DON'T USE IT FOR YOUR NEXT WEBSITE «

I am no PHP guru, but to me it looks like if you take all the precautions you normally take with a standard PHP site (sanitizing user input, etc), it should be secure enough ?

What is wrong with this tiny framework ?

EDIT : I understand why this framework is not secure AS-IS, but with the proper bootstrapping and validation checks and everything inside the function you call, it should be just as secure as any other framework ?


答:
Have a read of Software Estimation: Demystifying the Black Art by Steve McConnell - there are many different techniques described.

My advice is to give a 3 point estimate as it helps to communicate the risk of the work being undertaken and forces you to think about what could possibly go wrong.

Also run your estimates past someone else first before you commit to them.  And if there are multiple people working on the task I found Planning Poker a great technique.

Title: How do you accurately create estimates for programming projects given to you?

Body:
I am looking for some insight from you smart people on SO.  I'm a relatively new developer (3+ years of experience) primarily on the .NET framework, and I'm absolutely terrible at knowing how to properly estimate even the smallest of projects.  I know that it's going to be a pretty big hindrance to my upward mobility as well as my joy of programming if I don't figure out good tools, methodologies, approaches, etc.  Therefore, I am seeking your knowledge and wisdom on this subject.

I have heard of SWAG and have most of the time employed that to give my estimates in the past, but I don't feel comfortable just "feeling it out."  Certainly, from my experience of doing similar projects I can recall how long it took me and give a relatively accurate estimate, but even that isn't always very accurate.  Plus, it seems that inherent in every project are gotchas and unforeseeables to make estimating even more difficult.  Thoughts?


答:
What is more important: following the SOLID principles, or having a simpler interface?

Interface vis-a-vis SOLID

These are not mutually exclusive. The interface should express the nature of your business model ideally in business model terms. The SOLID principles is a Koan for maximizing Object Oriented code maintainability (and I mean "maintainability" in the broadest sense). The former supports the use and manipulation of your business model and the latter optimizes code maintenance.

Open/Closed Principle

"don't touch that!" is too simplistic an interpretation. And assuming we mean "the class" is arbitrary, and not necessarily right. Rather, OCP means that you have designed your code such that modifying it's behavior does not (should not) require you to directly modify existing, working code. Further, not touching the code in the first place is the ideal way to preserve the integrity of existing interfaces; this is a significant corollary of OCP in my view.

Finally I see OCP as an indicator of existing design quality. If I find myself cracking open classes (or methods) too often, and/or without really solid (ha, ha) reasons for doing so then this may be telling me I've got some bad design (and/or I don't know how to code OO).

Give it your best shot, we have a team of doctors standing by

If your requirements analysis tells you that you need to express the Product-Review relationship from both perspectives, then do so.

Therefore, Wolfgang, you may have a good reason for modifying those existing classes. Given the new requirements, if a Review is now a fundamental part of a Product, if every extension of Product needs Review, if doing so makes client code appropriately expressive, then integrate it into the Product.

Title: SOLID vs. static methods


问:
Efficient methods for storing tens of millions of objects for querying, with a high number of inserts per second?
This is basically a logging/counting application that is counting the number of packets and counting the type of packet, etc. on a p2p chat network. This equates to about 4-6 million packets in a 5 minute period. And because I only take a "snapshot" of this information, I am only removing packets older than 5 minutes every five minutes. So the maximum about of items that will be in this collection is 10 to 12 million.

Because I need to make 300 connections to different superpeers, it is a possibility that each packet is trying to be inserted at least 300 times (which is probably why holding this data in memory is the only reasonable option).

Currently, I have been using a Dictionary for storing this information. But because of the large amount of items I'm trying to store, I run into issues with the large object heap and the amount of memory usage continuously grows over time.

```<code>Dictionary<ulong, Packet>

public class Packet
{
    public ushort RequesterPort;
    public bool IsSearch;
    public string SearchText;
    public bool Flagged;
    public byte PacketType;
    public DateTime TimeStamp;
}
</code>```

I have tried using mysql, but it was not able to keep up with the amount of data that I need to insert (while checking to make sure it was not a duplicate), and that was while using transactions.

I tried mongodb, but the cpu usage for that was insane and did not keep either.

My main issue arises every 5 minutes, because I remove all packets that are older than 5 minutes, and take a "snapshot" of this data. As i'm using LINQ queries to count the number of packets containing a certain packet type. I also am calling a distinct() query on the data, where I strip 4 bytes (ip address) out of the keyvaluepair's key, and combine it with the requestingport value in the Value of the keyvalupair and use that to get a distinct number of peers from all the packets.

The application currently hovers around 1.1GB of memory usage, and when a snapshot is called it can go so far as to double the usage.

Now this wouldn't be an issue if I have an insane amount of ram, but the vm I have this running on is limited to 2GB of ram at the moment.

Is there any easy solution?

答:
Instead of having one dictionary and searching that dictionary for entries that are too old; have 10 dictionaries. Every 30 seconds or so create a new "current" dictionary and discard the oldest dictionary with no searching at all.

Next, when you're discarding the oldest dictionary, put all the old objects onto a FILO queue for later, and instead of using "new" to create new objects pull an old object off the FILO queue and use a method to reconstruct the old object (unless the queue of old objects is empty). This can avoid a lot of allocations and a lot of garbage collection overhead.

OwnerDisplayName: Josh


问:
How to write functionally in a web framework
I love Rich Hickey, Clojure and Haskell and I get it when he talks about functions and the unreliability of side-effecting code.

However I work in an environment where nearly all the functions I write have to read from the database, write to the database, make HTTP requests, decrement a user's balance, modify a frontend HTML component based on a click action, return different results based on the URI or the POST body. We also use PHP for the frontend, which is littered with functions like parse_str(), which modifies an object in place. All of these are side-effecting to one degree or another.

Given these constraints and the side-effecting nature of the logic I'm coding, what can I do to make my code more reliable and function-able?

答:
I would not agree with Rich Hickey or anybody else that claims that "side effects" (meaning state changes?) are inherently unreliable.  There are several factors at play which possibly give rise to such an impression, and I will mention them as far as I understand.

Programmers doing imperative programming think of it essentially as an intuitive activity, and disregard/ignore the mathematical basis of imperative programming.  Programmers doing functional programming, on the other hand, keep mathematical functions firmly in mind.  So, I presume that they treat it as a more mathematical activity.  But, with training and practice, people can develop the same degree of mathematical rigour with imperative programming too.  I know of plenty of examples of good practice in imperative programming where people use formal methods on a daily basis and build very high-quality systems.

Imperative programming is harder because the problems we tackle with it are harder.  Functional programming usually shuns such problems.  Hence, it is easier.  If functional programmers tackle the same kind of problems that we do with imperative programming (build the same kind of data structures that achieve high performance, handle state updates necessary for the real world etc.), I believe they will face the same kind of complexities that imperative programmers do.  It is easy to say that functional programming is easy as long as you keep doing the easy stuff!

There is at least one sense in which imperative programming is less reliable than functional programming, viz., we don't know yet how to get mileage out of type systems in imperative progrmming.  You can't compose two functions unless their types match.  In contrast, you can compose two commands no matter what they do.  We don't have type systems that say this command achieves this, and that command requires that, and you can compose them only these specs match.  We are making some progress on that front now.  Microsoft has released a verification tool called Code contracts which does something akin to typechecking in the imperative programming world.  It seems very successful and is becoming something of a rage in fact.

Imperative programming languages are also crummy, designed by practitioners who don't know much about language design.  Functional programming languages, on the other hand, are designed by programming language researchers and, so, are well-designed and well-tailored.  So, we are not comparing the like with the like here.  Imperative programming languages designed by researchers don't get used.  They get swamped by the practitioners' languages.  So, imperative programming is a victim of its own success in a sense.

The programming languages I use are what get called "functional" languages, like Lisp, Scheme and ML.  You can do both functional programming and imperative programming in them, and I have done both.  The problems you can tackle with functional programming are clean and easy.  They are equally clean and easy even if you code them imperatively.  It doesn't make much difference which style you use.  On the other hand, the problems I tackle with imperative programming, functional programming cannot even begin to tackle.  So, I would ignore the false prophets that sing the virtues of functional programming before they even begin to tackle the hard problems of programming.

In terms of advice, I would say, please do learn functional programming.  It can clarify your thinking and make you a better imperative programmer.  (In an interesting blogpost, Bob Harper, who teaches functional programming at Carnegie-Mellon recounted the feedback they got from their Facebook alumni. "They overwhelmingly said that one of the three most important courses for them was my course on functional programming.  The reason? Because they learned there how to think abstractly, and learned what the code “should be”".)

Keep the specifications of the functions/procedures topmost in your mind and make sure that they match whenever you compose calls.  If you can get a tool like "Code contracts" to work in your environment, do use it.  In the absence of any such tools, what I do is to trace through the code line by line, with the aid of a debugging tool if I have one, and make sure that every line is doing what it is supposed to do.

When you deal with complicated data structures with lots of cached information etc, write down the invariants that govern the data structure.  And, then make sure that every method re-establishes the invariant, even in the presence of exceptions.  Programming data structures is the hardest part of imperative programming.

And, if you find that you are making too many mistakes and the code is turning out to be buggy, do slow down and think more carefully.  If you can't get it right the first time, the problem is probably hard, and there is no use pretending that it is easy.


答:
The problem with operators is that there's only a small number of them compared to the number of sensical (!) method names that could be used instead. A side effect is that user-definable operators tend to introduce a lot of overloading.

Certainly, the line C = A * x + b * c is easier to write and read than C = A.multiplyVector(x).addVector(b.multiplyScalar(c)).

Or, well, it's certainly easier to write, if you've got all overloaded versions of all those operators in your head. And you can read it afterwards, while fixing the second-to-last bug.

Now, for most code that's going to be running out there, that's fine. "The project passes all tests, and it runs" - for many a piece of software that's all we could ever want.

But things work out differently when you're doing software that goes into critical areas. Safety critical stuff. Security. Software that keeps planes in the air, or that keeps nuclear facilities running. Or software that encrypts your highly confidential emails.

For security experts that specialize in auditing code, this can be a nightmare. The mix of an abundance of user-defined operators and operator overloading can leave them in the unpleasant situation that they have a hard time figuring out what code is going to run eventually.

So, as stated in the original question, this is a highly subjective subject.  And while many a suggestion about how operators should be used might sound perfectly sensical, the combination of only a few of them might create a lot of trouble in the long run.


问:
How do people manage to write and maintain extremely complex and hard to read code?
Reading SQLite source code is IMO mission impossible. Yet it is a usable piece of quite complex software (it's a full-blown embedded database after all) that can be downloaded, compiled and used from others code and it is constantly updated.

How do people manage to write and maintain such extremely complex and hard to read code?

答:
The algorithm being implemented sets a lower limit on how simple the code for an implementation can be.  If an abstract description of the algorithm to be implemented is extremely complicated and requires tons of different pieces of data to be coupled to each other, then the code implementing said algorithm can't be simple no matter who's writing it.

In other words, one reason why I sometimes write inscrutable code is because, given the algorithm I want to implement, I have no choice.


答:
Simple approach: try memcached.

It is optimized to run tasks like this.

It can reuse spare memory on less busy boxes, not only on your dedicated box.

It has built-in cache expiration mechanism, which is lazy so no hiccups.

The downside is that it's memory-based and does not have any persistence. If an instance is down, data is gone. If you need persistence, serialize the data yourself.

More complex approach: try Redis.

It is optimized to run tasks like this.

It has built-in cache expiration mechanism.

It scales / shards easily.

It has persistence.

The downside is that it's slightly more complex.

Title: Efficient methods for storing tens of millions of objects for querying, with a high number of inserts per second?

Body:
This is basically a logging/counting application that is counting the number of packets and counting the type of packet, etc. on a p2p chat network. This equates to about 4-6 million packets in a 5 minute period. And because I only take a "snapshot" of this information, I am only removing packets older than 5 minutes every five minutes. So the maximum about of items that will be in this collection is 10 to 12 million.

Because I need to make 300 connections to different superpeers, it is a possibility that each packet is trying to be inserted at least 300 times (which is probably why holding this data in memory is the only reasonable option).

Currently, I have been using a Dictionary for storing this information. But because of the large amount of items I'm trying to store, I run into issues with the large object heap and the amount of memory usage continuously grows over time.

```<code>Dictionary<ulong, Packet>

public class Packet
{
    public ushort RequesterPort;
    public bool IsSearch;
    public string SearchText;
    public bool Flagged;
    public byte PacketType;
    public DateTime TimeStamp;
}
</code>```

I have tried using mysql, but it was not able to keep up with the amount of data that I need to insert (while checking to make sure it was not a duplicate), and that was while using transactions.

I tried mongodb, but the cpu usage for that was insane and did not keep either.

My main issue arises every 5 minutes, because I remove all packets that are older than 5 minutes, and take a "snapshot" of this data. As i'm using LINQ queries to count the number of packets containing a certain packet type. I also am calling a distinct() query on the data, where I strip 4 bytes (ip address) out of the keyvaluepair's key, and combine it with the requestingport value in the Value of the keyvalupair and use that to get a distinct number of peers from all the packets.

The application currently hovers around 1.1GB of memory usage, and when a snapshot is called it can go so far as to double the usage.

Now this wouldn't be an issue if I have an insane amount of ram, but the vm I have this running on is limited to 2GB of ram at the moment.

Is there any easy solution?


问:
How is software installed from an image?
I read an article a while back (forgot from where) that essentially stated that someone wrote a virus and inserted it into an image. The end result allowed the cracker to have his way with the system.

How is this possible?

答:
It's possible to hide information (text, data, anything) in a image using steganography technique.

If an executable is hidden in a image, it still needs to be executed to infest your system. In practice, it depends on how you open the image, depending on the software/OS you use to open it.


答: Simple. He also smuggled in a (most likely) vbs script, that did the actual job of extracting the virus code from the picture and executing it. Not very different from just double clicking the BeautifulGirls.exe attachment that was arriving in your inbox 5-6 years ago.</p>

Title: How is software installed from an image?

Body:
I read an article a while back (forgot from where) that essentially stated that someone wrote a virus and inserted it into an image. The end result allowed the cracker to have his way with the system.

How is this possible?


答:
Using this would generally depend on a fairly simple fact: most images are compressed. Along with this, the code to de-compress an image is often written assuming that the data in the image was compressed according to a fairly specific set of rules.

At times, however, people have found various vulnerabilities, chiefly that old standby, the buffer overrun, in image decompression code. By writing a file that does not follow the rules expected by the decompressor, they can figure out a way to overrun a stack-allocated buffer, and write data outside the allocated space on the stack.

From there, it's a fairly typical buffer-overflow attack, which are widely enough documented that there's no real point in my trying to go into it here.


答: Suppose there is a buffer overflow bug in an image loading/processing module. It could be possible to create an image that triggers the bug and injects malicious code this way.</p>