答:
Do i:

fix the code and get blamed for breaking it? or

leave the bug, and get blamed when the customer finds it?

You fix the bug, start the unit tests, and when they succeed, you check in your fix.

(Or, if your unit tests take a really long time, you check in your fix first, and then wait whether your CI tool sends you a mail because your commit broke something.)


问:
Should I demand unit-testing from programmers?
I work at a place where we buy a lot of IT projects. We are currently producing a standard for systems-requirements for the requisition of future projects. In that process, we are discussing whether or not we can demand automated unit testing from our suppliers.

I firmly believe that proper automated unit-testing is the only way to document the quality and stability of the code. Everyone else seems to think that unit-testing is an optional method that concerns the supplier alone. Thus, we will make no demands of automated unit-testing, continous testing, coverage-reports, inspections of unit-tests or any of the kind. I find this policy extremely frustrating.

Am I totally out of line here?

Please provide me with arguments for any of the opinions.

答: There are lots of projects that are very successful despite the fact that they don't use unit tests. Just look at the linux kernel, its a gigantic project with a complexity well beyond what you would find in any normal project, and it still works. So if the result is good software, you shouldn't care how they achieved it.</p>

ContentLicense: CC BY-SA 3.0


答:
It seems to me that including this requirement would have little practical benefit, since it would be impossible to enforce.

You could demand the code for the actual tests, or a report of what actual tests were run and passed.  If it is a proprietary project, the vendor would probably not want to supply that, since it would likely be highly suggestive of the details of the code, and may bristle at being made to provide low-level implementation details and told how to do their jobs.  At some point, there has to be some trust.

If you don't, they could blow you off either but just checking the box next to "runs a suite of unit tests" for fulfill the requirement by writing a single test that passes if their utility compiles and runs or a similar half-assed effort.

So while automated unit tests is a commendable practice, I don't think it's practical to insist on it from outside vendors.

Title: Should I demand unit-testing from programmers?

Body:
I work at a place where we buy a lot of IT projects. We are currently producing a standard for systems-requirements for the requisition of future projects. In that process, we are discussing whether or not we can demand automated unit testing from our suppliers.

I firmly believe that proper automated unit-testing is the only way to document the quality and stability of the code. Everyone else seems to think that unit-testing is an optional method that concerns the supplier alone. Thus, we will make no demands of automated unit-testing, continous testing, coverage-reports, inspections of unit-tests or any of the kind. I find this policy extremely frustrating.

Am I totally out of line here?

Please provide me with arguments for any of the opinions.


答:
Unit testing is an indication of how that supplier handles risks during the development cycle. Those who use unit tests value reducing risk and the quality of those tests is an indication on how much risk has been managed.

With that said, unit tests do not define what level of risk that project is attempting to tackle. It also doesn't play any role in the reduction of risk introduced by bad programming practices.

Therefore, you could have one supplier who has solid testing practices in place but continues to write highly risky code while another supplier who does zero testing but writes low risk code. If the two suppliers offer the same product, then it's best to go with the low risk supplier.

This can only be gauged by interviewing, mentoring and learning about the personalities and skills of the people involved with that supplier.


问:
Standards & compliances for secure web application development?
I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way and i have mine.

I am not talking about the formatting of code, but rather of way site is organized in classes and the way the utilize them. and the way they create functions and process forms etc.

Their coding does not match my standards, but again they argue that its matter of preference and as long as goal achieved the can be different way's to do it. I agree but their way is proven to have bugs and we spend a lot of time going back and forth with them to fix all problems security or functionality, yet they still write same code no matter how many times i asked them to stop doing certain things.

Now i am ready to dismiss them but friend of mine told me that he has same exact problem with freelance developers he work with. So i don't want to trade one bad apple for another.

Question is is there some world wide (or at least europe and usa) accepted standard or compliance on how write secure web based applications. What application architecture should be for maintainable application.

Is there are some general standard that can be used for any language ruby php or java govern security and functionality and quality of code? Or at least for PHP and MySQL i use for my website. So i can make them follow this strict standard and stop making excuses.

答:
The first thing I thought of was the nightmares I endured during a Sarbanes-Oxley audit. Now while you may not have to comply with SOX (you're not a publicly traded company for example) the companies you do business with might.

To that end, and while I am no expert, a good place to start is making sure all personal customer information in your possession is encrypted.

In fact you can begin with thinking about the problem by assuming that at some point your whole database will be stolen and what ramifications would there be if that were to happen. In short, encrypt personal information robustly with the appropriate libraries (do not simply hash) and do not store the key in the same database.

http://www.jasonkolb.com/weblog/2006/04/web_20_security_1.html

http://www.opensecuritylab.org/storing-passwords-securely-using-salt-in-php

http://us2.php.net/manual/en/ref.mcrypt.php


问:
What could be the best way to generalize data from Facebook and Twitter?
I am not sure if this is the best subsite to ask this question, but I'm pretty sure it doesn't fit on the normal or facebook SO page...

I've been asked to make a general API for connecting to several Social Media platforms (at the moment Facebook and Twitter).

I have already realised both of them seperately. Meaning I retrieve the data I need from both Facebook and Twitter and hold the data in it's own dataclass. In my case a list of FacebookTimelineItems and a list of TwitterTimelineItems.

now the hard part is taking the parts that are used in both (username, id, message and such) and make 1 general class that is eventually passed on to who/whatever sent the call to my API.

these are two pics of the data classes I have:

http://imageshack.us/photo/my-images/703/facebookdata.png/

http://imageshack.us/photo/my-images/204/twitterdata.png/

probably not 100% correct but it gives an idea what it looks like.

Now I've been having several idea about how to go about and generalize the two, which is harder then I thought at first.

Create an interface (TimelineItem) and let the other classes extend that one.
this way I'll always be sure I have a class that contains at least the basic info I need.
downside is that deserializing the JSON seems to be a nightmare.

Use the two dataclasses I have and combine them into a new class afterwards, then pass that one back to whoever requested it.
This would probably work but I get the idea it's not the best way to tackle this problem, and is pretty dodgy IF I get it working.

Or, in case of the other two being nearly impossible. Keep the two seperated in the front end, and go sit in the corner crying because I've just figured out you can't lump together facebook and twitter...

Note: I don't have to make the front end part (view), I just make sure the Model is nicely filled with data :)

I hope I placed this in the right section, if I didn't I apologise and would like to know where I should go with my question.

Thanks in advance for any replied/ideas/opinions on this.

答:
Your first approach is likely the correct approach.

Instead of fleshing out why, let me ask you some questions that will lead you to the correct answer.

How would you handle integrating another social media site, such Google+, or whatever?

Is this code working at the correct layer of abstraction, yet?  Offhand, it sounds like implementation details for a particular data feed are biasing your general solution.

How would you structure things to simplify writing your front end?  Should your front end even care where the data feeds are coming from, so long as it has at least one feed to display?


答:
Or at least for PHP and MySQL i use for my website

I would first enforce using PHP Data Objects (PDO) extension for all database communication. Especially by using PDO's prepared statements. See http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/

Secondly, I would look at using a library or framework for working with forms. You can use Zend Framework as a library and ZF has libraries for working with forms. Since Zend is "The PHP Company" it may be considered "official" I suppose. EDIT: and/or review this link What technical details should a programmer of a web application consider before making the site public?

Thirdly, you should probably read Essential PHP Security by Chris Shiflett. It goes over basic security practices and can enlighten you to potential security holes that may not be as obvious to you. Then you can reference this book as another "standard".

Title: Standards & compliances for secure web application development?

Body:
I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way and i have mine.

I am not talking about the formatting of code, but rather of way site is organized in classes and the way the utilize them. and the way they create functions and process forms etc.

Their coding does not match my standards, but again they argue that its matter of preference and as long as goal achieved the can be different way's to do it. I agree but their way is proven to have bugs and we spend a lot of time going back and forth with them to fix all problems security or functionality, yet they still write same code no matter how many times i asked them to stop doing certain things.

Now i am ready to dismiss them but friend of mine told me that he has same exact problem with freelance developers he work with. So i don't want to trade one bad apple for another.

Question is is there some world wide (or at least europe and usa) accepted standard or compliance on how write secure web based applications. What application architecture should be for maintainable application.

Is there are some general standard that can be used for any language ruby php or java govern security and functionality and quality of code? Or at least for PHP and MySQL i use for my website. So i can make them follow this strict standard and stop making excuses.


问:
How do you balance the speed of Sprints with the customer's conservative adoption schedule?
I'd prefer to have sprints that last 3-4 weeks, but customers don't want to adopt new feature/function every 3-4 weeks. Existing customers  are conservative and, once we meet their minimum bar for features and capabilities, they like to remain on a
stable release for much longer than 4 weeks.  Even a 3-month cycle would be pushing it for them.

On the other hand, newer customers tend to have more feature requests, and are willing to follow sprints. But this willingness dissipates after we've met their bar.

How do you balance the need for rapid sprints with the customer's conservative view of application change?

I'm particularly interested in SaaS scenarios.

答:
Keep your short releases in-house, until the customer is ready. Then, release to the customer on one of your four-week cycles.

If possible, have the customer participate in software reviews between their release dates, so that you can keep your sprints on track.


问:
Real world T4 usage
How many of you have ever used (or even know of)  the Visual Studio Text Templating Engine?

I mean, T4 templates have been around for quite some years now. The where initially included in Visual Studio 2005 SDK, and they where moved to Visual Studio 2008 core just before releasing it.

What I want to know is if this is really used out there. I mean, why doesn't the VS team invested in a descent minimal editor for the templates? It doesn't even have syntax couloring!
I know there are a couple of good T4 editors out there, but as they don't come built in, I tend to think that this is an unknown feature for most developers.

Have you ever used T4 templates in any of your projects? I'm really interested in answers that explain how they created their own T4 to accelerate, automate, or generate artifacts for your project.

答:
I just started to use them recently with Entity Framework in order to generate the SQL scripts and/or POCO classes.

Before that, I'd used String Template for quick code generation. Deklarit's dkts were also a great solution, plus, it had a nice template editor right on Visual Studio (those were the days) :)

ContentLicense: CC BY-SA 2.5

Title: Real world T4 usage


答:
Sprints aren't about deployment

Sprints are for the developers, they are about commitments to deliverables, not about deployments by customers.

The goal of a Sprint is to have a Deliverable. There is no requirement to actually deliver it much less deploy it.

Every team I have been on produces many more deliverable builds than the operations team could possibly deploy and promote to production.

Software as a Service

SaaS is a specific circumstance, you deliver what you want when you want to, but don't break backwards compatibility without a lot of notice, if ever. Nothing stops you from deploying new API features alongside old ones, and marking the old ones deprecated.

Have a very public end of life/support policy so everyone knows what to expect and when to expect support to end.

Title: How do you balance the speed of Sprints with the customer's conservative adoption schedule?

Body:
I'd prefer to have sprints that last 3-4 weeks, but customers don't want to adopt new feature/function every 3-4 weeks. Existing customers  are conservative and, once we meet their minimum bar for features and capabilities, they like to remain on a
stable release for much longer than 4 weeks.  Even a 3-month cycle would be pushing it for them.

On the other hand, newer customers tend to have more feature requests, and are willing to follow sprints. But this willingness dissipates after we've met their bar.

How do you balance the need for rapid sprints with the customer's conservative view of application change?

I'm particularly interested in SaaS scenarios.


答:
How do you balance the need for rapid sprints with the customer's conservative view of application change?

The way I see it, if the customer doesn't need/want another delivery in 3-4 weeks, there is no need for a rapid sprint.

The balance here would be to change your development cycle to match their expectations.


答:
If all you are saying is that they do not want to deploy live frequently then set them up a public facing demo server and do your end of sprint deploy/review there.

If you are saying they really just do not want to spend that much time dealing with the product anymore then you either lighten the workload or continue with the rework risk.

Many times in the latter situations the PM or the sales person ends up filling the role of the customer anyway, regardless if sprint duration because the customer is just not interested in participating.  It is unfortunate, and leads to larger rework but it is true.


答:
As many people have pointed out, forcing venders to write unit tests (or better, a combination of automated unit and integration tests) to fulfill a contract will probably not yield high quality results.  On the other hand, I do agree that automated testing is by far the best method currently in use to ensure the quality of code.

I think code written with unit tests is much easier to maintain than code that was written first and had unit tests added later.  It forces modularity and minimal dependencies.  Integration tests are also necessary for verifying the correctness of the code, but they don't have the same impact on the quality of the code as it is written.  In essence, automated integration tests could be added after the fact, but unit tests have the most impact when written with the original code.

My advice for your situation is look for venders who prefer to write code with unit tests, and choose them over venders who tend not to write code with unite tests.  If management will pay for it, put automated tests in the contract but ONLY IF THE VENDER IS USED TO WRITING CODE WITH UNIT TESTS.


问:
Should you keep a copy of all the code you write?
I know the company you work for owns the code and obviously you will get arrested if you try to sell it. But is it uncommon for developers to keep a personal copy of the code they wrote (for future reference)?

Apparently this guy was sent to prison for copying source code.

答:
With your employer's permission publish the neat re-usable code as open source projects for other people to use. Then your employer can also benefit from contributions by other people to this code.

This way you can keep the code legally, build a public portfolio of code you've written and the code can benefit other people.


问:
Switching from abstract class to interface
I have an abstract class which has all abstract methods except one which constructs objects of the subclasses. Now my mentor asked me to move this abstract class to an interface.

Having an interface is no problem except with the method used to construct subclass objects. Where should this method go now?

Also, I read somewhere that interfaces are more efficient than abstract classes.  Is this true?

Here's an example of my classes

```<code>abstract class Animal {
    //many abstract methods
    getAnimalobject(some parameter) {
        return //appropriate subclass
    }
}

class Dog extends Animal {}
class Elephant extends Animal {}
</code>```

答:
Also, I read somewhere that interfaces are more efficient than abstract classes. Is this true?

No, neither are more efficient then the other.

Abstraction gives you better inherited behavior changes of class, since you only have to make changes in one place. Where as, interfaces allow you to separate the behavior of a class into multiple descriptions.

This is because a class can only extend one abstract class. So all of the behavior of the abstract class is inherited, where as a class can implement multiple interfaces which allows that class to represent multiple behaviors.

Having an interface is no problem except with the method used to construct subclass objects. Where should this method go now?

Maybe something like this.

```<code>interface Animal {
  getAnimalobject(parameter);
}

class Dog implements Animal {
   function getAnimalobject(parameter) { return .... }
}

class Elephant implements Animal {
   function getAnimalobject(parameter) { return .... }
}
</code>```

Lots of reasons why this is better then abstraction, but I don't want to really write them all down. Here are my top reasons for interfaces over abstraction.

Top Reasons To Use Interface

Abstracted classes can create object and memory management problems. For example; if you create an abstract class called "List" and it had an abstract method called "Remove". When you implement your own "Remove" method, should you delete memory or keep it? You simply don't know what the base class is doing, or what it will do in the future. If someone modifies the base class to handle the list differently, then you could likely break things in your class.

Interfaces are easy to use in testing. Creating mock objects of an interface is far easier then creating a mock object of abstract classes.

Objects can implement multiple interfaces but only one abstract class.

Changes to an abstract class can cause a cascade of failures across multiple classes, or worse just one small hidden failure in a rarely used class.

Body:
Also, I read somewhere that interfaces are more efficient than abstract classes. Is this true?

No, neither are more efficient then the other.

Abstraction gives you better inherited behavior changes of class, since you only have to make changes in one place. Where as, interfaces allow you to separate the behavior of a class into multiple descriptions.

This is because a class can only extend one abstract class. So all of the behavior of the abstract class is inherited, where as a class can implement multiple interfaces which allows that class to represent multiple behaviors.

Having an interface is no problem except with the method used to construct subclass objects. Where should this method go now?

Maybe something like this.

interface Animal {
  getAnimalobject(parameter);
}

class Dog implements Animal {
   function getAnimalobject(parameter) { return .... }
}

class Elephant implements Animal {
   function getAnimalobject(parameter) { return .... }
}

Lots of reasons why this is better then abstraction, but I don't want to really write them all down. Here are my top reasons for interfaces over abstraction.

Top Reasons To Use Interface

Abstracted classes can create object and memory management problems. For example; if you create an abstract class called "List" and it had an abstract method called "Remove". When you implement your own "Remove" method, should you delete memory or keep it? You simply don't know what the base class is doing, or what it will do in the future. If someone modifies the base class to handle the list differently, then you could likely break things in your class.

Interfaces are easy to use in testing. Creating mock objects of an interface is far easier then creating a mock object of abstract classes.

Objects can implement multiple interfaces but only one abstract class.

Changes to an abstract class can cause a cascade of failures across multiple classes, or worse just one small hidden failure in a rarely used class.


问:
Should a software developer get a yearly equipment budget?
I am looking at a new position with a new company.  I have talked to some people in the past (in general, not at this company) that they had been given a yearly budget to buy new computer stuff to keep up to date.

Now why I feel this question is worth asking here is that Joel comes right out and says an employer should pay for the best equipment money can buy... within reason of course.

From The Joel Test: 12 Steps to Better Code

9. Do you use the best tools money can buy?

Writing code in a compiled language is one of the last things that still can't be done instantly on a garden variety home computer...

Top notch development teams don't torture their programmers. Even minor frustrations caused by using underpowered tools add up, making programmers grumpy and unhappy. And a grumpy programmer is an unproductive programmer...

Does anyone know if the industry has such a standard to offer an allowance or budget?

I have never worked for a company like this, but I am thinking I should toss this in the ring for negotiations.  Seems reasonable.  How do bigger companies like MS, Google, and Apple handle this?  If you say yes, give a range... I have been told numbers from $5k to $10k.  Seems high to me, but hey I would gladly take it.

答:
Developers should get a yearly training + equipment budget, but when things go really well, extra classes/conferences/training/equipment/books/tshirts/meals should be made available.

It's usually worth more to a developer's than cash.


问:
Python and only Python for almost any programming tasks!
Am I wrong if I think that Python is all I need to master, in order to solve most of the common programming tasks?

EDIT
I'm not OK with learning new programming languages if they don't teach me new concepts of programming and problem solving; hence the idea behind mastering a modern, fast evolving, with a rich set of class libraries, widely used and documented, and of course has a "friendly" learning curve programming language.

I think that in the fast evolving tech industry, specialization is key to success.

答:
While you are right that you should master at least one language, learning another language is rarely if ever a waste of time. Even the most horrible programming language (I won't tell the name because this could end up in a bloody religious war :-)) has some features who made me think:"Hey, why can't Java/C/ do this?".

Besides, there isn't THE perfect language as of today. Though Python comes pretty close to it ^^.


答: No, you don't need necessarily to demand complete and automated test units. Its more important that they supply you with proper testing strategy documents. We're doing  well this way.</p>


问:
Do you obfuscate your email address in open-source code to prevent spamming?
I've been thinking of releasing a few projects, and most authors in the community leave their email address right in the code, often as is or using commonly used schemes like "meATNOSPAMgmail.com", which sort of gets my paranoia flag up...

When releasing source code publicly, does it often lead to your email address being parsed by spam bots, and if so how do you obfuscate it ?

答:
Whenever possible, I avoid publishing my email address.

I use three strategies:

As a previous answer stated, I give a web site.

I use an image of my email address.

I have my own domain so I can use lots and lots of email addresses. For each site foo.com, I use the email address foo.com@example.com.

All three of these strategies can be seen at the top of my resume.

A domain only costs about $8/year from GoDaddy.com. I then use Google Apps, free version (http://google.com/a), to forward email from all of the different email addresses to me (there is a setting to do this). If I have an address "go bad", that is, it starts to get lots of spam, I just write a filter for that address that throws out everything sent to it.


问:
Business Analyst role in development process
I work as a business analyst and I currently oversee much of the development efforts of an internal project.  I'm responsible for the requirements, specs, and overall testing.  I work closely with the developers (onshore and offshore).

The offshore team produces all of the reports.  Version 1.0 had a 9 month development cycle and I had about 4-5 months to test all the reports.  There was the usual back and forth to get the implementation right.

Version 2.0 had a much shorter development cycle (3 months).  I received the first version of the reports about 3 weeks ago and noticed a lot of things wrong with it.  Many of the requirements were wrong and the performance of the queries was horrendous at 5x - 6x longer than it should have been.

The onshore lead developer was out and did not supervise the offshore development team in generating the reports.

Management knew about the performance issues and I also told them I was trying to find a way to improve performance; they did not explicitly approve of sending test queries, but they were also not concerned with the fact I was doing that.  I took a look at the SQL in the reports and was able to improve performance greatly (by a factor of 6x) which is acceptable for this version.

I sent the updated queries as guidelines to the offshore team and told them they should look at doing X instead of Y to improve performance and also to fix some specific logic issues.

I then spoke to my managers about this because it doesn't feel right that I was developing SQL queries, but given our time crunch I saw no other way.  We were able to fix the issue quite fast which I'm happy with.

Current situation: the onshore managers aren't too pleased that the offshore team did not code for performance.  I know there are some things I could have done better throughout this process and I do not in any way consider myself a programmer.

My question is, if an offshore team that works apart from the onshore project resources fails to deliver an acceptable release, is it appropriate to clean up their work to meet a deadline?  What kind of problems could this create in the future?

Update: So far management is upset with the offshore team, but have not "reprimanded" me in any way, so I'm not sure in their eyes if what I did was wrong, but I think their main source of frustration was the offshore team was not able to come up with a solution and I was, especially since this sort of performance issue had come up in the past.  I am not defending my actions, but I want to give context so that the picture is a little clearer.  I accepted the answer that most criticizes my actions I agree it's not something that should be done by someone in my position.

答: The number one rule of software development is to make it work, everything else is secondary. If you are running up on a deadline and having problems they need to get fixed now. You will have plenty of time later to dissect the problem and figure out who failed to do what or what needs to be improved in the process for the future. If it becomes a common occurrence that you constantly have to fix problems you shouldn't have to, then that is a different issue and that shows a lack of management doing their job to identify and fix problems with the process.</p>


问:
My software is hosted on a "bad" website. Can I do anything about it?
Edit: Thanks for all of the answers, guys! I think I'm just going to include some kind of text on my webpage telling users to only download from the links provided. The thing is that there have been some legitimate and illegitimate websites that have picked up on my software, so it would be safer just to tell users to avoid any website that I don't link to.

Thanks a lot for all the help!

Original:

The software I've created is hosted on what you could call a "bad" website. It's hard to explain, so I'll just provide an example.

I've made a free password generator. This, along with most of my other FREE software, is available on this website.

This is their description of my software:

```<code>Platform: 7/7 x64/Windows 2K/XP/2003/Vista
Size: 61.6 Mb
License: Trial
File Type: .7z
Last Updated: June 4th, 2011, 15:38 UTC
Avarage Download Speed: 6226 Kb/s
Last Week Downloads: 476
Toatal Downloads: 24908
</code>```

Not only is the size completely skewed, it is not trial software, it's free software. The thing is that it's not the description I'm worried about--it's the download links.

The website is a scam website. They apparently link to "cracks" and "keygens", but not only is that in itself illegal, they actually link to fake download websites that give you viruses and charge your credit card.

Just to list things that are wrong with this website: they claim all software is paid software then offer downloads for keygens and cracks; they fake all details about the program and any program reviews and ratings; they and the downloads site they link to are probably run by the same person, so they make money off of these lies.

I'm only a teenager with no means to pursue legal action. This means that, unfortunately, I can't do anything that will actually get results. I'd like my software to only be downloaded off my personal website. I have links to four legitimate locations to download my software and that's it.

Essentially, is there anything I can do about this? As I said above, I can't pursue legal action, but is there some way I can discourage traffic to that website by blacklisting it or something? Can I make a claim on MY website to only download my software from the links I provide? Or should I just pay no mind? Because, honestly, it's a bit of a ways back in Google results.

答:
Report these sites as Phishing sites to, e.g., Google Report Phishing Page:

If you believe you've encountered a page designed to look like another page in an attempt to steal users' personal information, please complete the form below to report the page to the Google Safe Browsing team...


问:
Who is a CMS really for?
I have started lately discovering Content Management Systems, and I was wondering, who is really CMS for?

What I mean by that: is it only for companies, small businesses or individuals, that pays a contractor to make a website that it's users can just upload content through a easy interface.

Or is it used also by programmers, to build their own websites, projects? Would a Facebook, Twitter or StackExchange ever started by using a CMS, a very powerful one for example.

Would you as a programmer build your own "fancy" website on top of a CMS, for example like Typo3, or you would build it from scratch?

P.S
To be more clear is a summary:

What I mean to begin with is, would I as a developer choose a CMS to develop a website that can be scaled with a big base of users, be stuck if I choose to start with a CMS system. What if I build a website using CMS, and the website explodes in popularity, and then I wanted to add much more functionality that I have planed, is it possible that the CMS will limit the growth, because it might have not been build for that kind of scale?

答:
A CMS is useful for anyone who needs to create content and put it online. In some cases, this could probably be done by simple HTML pages (some people like to use a CMS because it's "enterprisey" even when they don't need it), but a CMS is can also be used for content that changes frequently and is touched by multiple users.

A CMS can have a system of who can edit which item of content, it can set up a content review workflow, it can dynamically reference the same content item in more than one place, it can be extended with plugins for custom functionality,... A good CMS is useful to anyone who needs this level of functionality, whether or not they are programmer.

Title: Who is a CMS really for?


答:
You may have reached the point in your life as a programmer, where you want to use a framework.  you write

I am not talking about the formatting of code, but rather of way site is organized in classes and the way the utilize them. and the way they create functions and process forms etc..

If you take any of the modern frameworks (Ruby on Rails, Python/Django, PHP/ZEND) they will give you exactly that:

they will tell you how to slice your app into models, views, controllers, where to put your code, what to call your classes, how to process forms, .... and they will also give you built in security features for handling raw html or escaped html, for preventing injection, xss, csrf, and so on.

My personal recommendation would be to leave php behind and move on to Rails - which I consider the most advanced of the frameworks. But YMMV.


问:
Structuring a rails application with static data
I'm working on a rails application, and so far I've focused on the api and the functionality. But now I'm more and more reaching a point where I will want to add static content, descriptions of the software and help information. Information that is generally in a CMS system.

How do I in the best way structure this so I can still work with the application. Yet maintaining the look and feel of the rails application?

Do write a CMS in my app? That seems a bit far fetched. Are there any Gems that do this?

What is the de facto standard for architecting this scenario?

答:
I concur with HungryCoder: for a few static pages a "pages" - controller is the simplest solution.

some point for switchning to a CMS style solution:

will your pages be translated into another languages?  when? by whom?

how often will the pages need to be changed (don't forget simple changes like telephone numbers)? by whom?

in a worst case scenario you could end up as the guy that word- and pdf-documents are sent to by impatient costumers every week, for conversion and inclusion in some "static" page ;-)


答:
As programmers, we are probably more aware of the security risks inherent in any complex web application. So there is a whole class of "static site generators" if you want to avoid these problems: you write some code on your development machine, compile it into html (with all the navigation, css and js being added automatically) and the simply upload the static stuff.

See https://github.com/mojombo/jekyll for an example.

Title: Who is a CMS really for?

Body:
I have started lately discovering Content Management Systems, and I was wondering, who is really CMS for?

What I mean by that: is it only for companies, small businesses or individuals, that pays a contractor to make a website that it's users can just upload content through a easy interface.

Or is it used also by programmers, to build their own websites, projects? Would a Facebook, Twitter or StackExchange ever started by using a CMS, a very powerful one for example.

Would you as a programmer build your own "fancy" website on top of a CMS, for example like Typo3, or you would build it from scratch?

P.S
To be more clear is a summary:

What I mean to begin with is, would I as a developer choose a CMS to develop a website that can be scaled with a big base of users, be stuck if I choose to start with a CMS system. What if I build a website using CMS, and the website explodes in popularity, and then I wanted to add much more functionality that I have planed, is it possible that the CMS will limit the growth, because it might have not been build for that kind of scale?


答:
Lets get the priorities straight first...

In your role as a customer your main concern is not unit-testing

If you are using suppliers who produce software for you then you really shouldn't be concerned if they are using one methodology or another. Your stakes is to acquire some kind of a solution that will help achieve your goals. The only thing you should care about is wether or not that solution is acceptable. That's why we have acceptance testing as it lies in your responsibility to make sure that you get what you want. It is at the crucial moment of customer acceptance that money will be transacted from your company's pockets into the supplier's pocket.

You could demand unit-tests as deliverable requirement but there are several inherit problems with them, the most severe is that there is no sure-fire way beforehand to determine the metrics:

What is the acceptable amount of unit tests?

Should there be 10 tests? How about 100 tests? How about 1000 tests? Actually, it is quite difficult to determine in the beginning how many tests you will need. The actual number is indeterminable really... like the halting problem... but we're not solving that problem.

You just want software that has unit-tests so you can continue development. Unit-tests don't tell what you've broken yet, but they're awesomely well suited to tell you when the code has a regression bug.

What is an acceptable level of code coverage?

"100%, of course!" you'd think. Unfortunately that metric is misleading; even if you had 100% code coverage, are you really sure things are working as expected? It is possible to have 100% coverage but not be done.

What you really need to be doing is exploratory testing, i.e. find someone who is really good at breaking stuff and let them do the testing. To find the bugs that no developer has even thought of.

Also 100% is sometimes unattainable with pure unit tests if you have some necessary performance hacks and use design patterns that are difficult to test (search "singleton" and "tdd" in your favorite search engine and you'll find some examples).

You want the delivered software to work and the specification document is your only warranty that it will.

You will need higher level of testing

Your specification document has to be verified somehow. Each point has to be gone through with your suppliers having clear goals and acceptance criteria. A well functioning QA organization (or an awesome tester if you're on a budget and on a limited scope) would provide the test cases to check these acceptance criteria. You also need someone to verify those acceptance criteria.

There are several ways to verify your goals, and if someone tells me that you can't set any sane quality, performance and efficiency goals I will hit them in the head with big and heavy books on exploratory, performance and usability testing respectively. It may be easy to overkill with the goals, but knowledge and communication will help you set realistic goals.

I'm not a lawyer but most project contracts (which is basically the mother of all specifications for the project) I've read usually have a defect ratio criteria that stipulates on how many bugs that are deemed acceptable. The bugs are usually determined through severity, show-stopping bugs that are found by QA have a low tolerance while minor blemishes have a high tolerance. In real projects it is difficult to demand that software has to have 0 defects. Deadlines usually put a stop to that practice. It is at these situations that you have to start bargaining the scope.

Most supplied software I've seen usually aren't delivered with unit tests. You could argue the suppliers should be professional enough to deliver this, however the chief reason you want unit tests delivered to you is to make sure that you don't get regression bugs and also enable refactoring. In real life with projects on tight deadlines both the supplier and customer will be lowering the scope and unit-tests would usually go out the window and be removed from the list of required deliverables.

It is a bit sad that high profile open source software come delivered with unit-tests but a professional software developer can't, right?

So when do I, as a customer, get to care about unit testing?

I would argue that the only time you would truly care about unit testing is if the deliverable software is a self-sufficient component that isn't executed as a stand-alone program, for which the coarsest testing you can to do is a unit test. Class libraries would be one kind of product that can be delivered together with unit-tests.


问:
What sort of Design Patterns do you use in Android Development?
I have been developing on Android for a couple months now, and building upon one in house program I found the scalability to be lacking. I have that gut feeling that if I applied some OO Design Patterns I would get an overall better program in speed, scalability, and readability.

Do any of you StackExchangers have ways you've applied a/many design pattern(s) that just seem to fit extremely well with the way Android works?

答:
Patterns aren't really platform-specific; they're about solving a particular issue.  So the patterns to apply vary on the type of application.  Platforms almost always have baked-in patterns that aren't explicitly mentioned.

You're likely using many patterns without being aware of them (observer, service layers, transaction scripts, active record, controller, factory, etc...).  So, perhaps another good question to ask is "What patterns should I understand to take advantage of the Android Platform?", or "What patterns aren't implemented in Android but make development easier?" (which is much more subjective, especially without a firm definition of what it is you're working on.

So perhaps the best answer for you isn't to ask for advice but to do some studying to see what you're using but not acknowledging.  Fowler's Patterns of Enterprise Application Architecture is a great read for this--and it's "Cheat Sheet" in the rear-cover is an awesome way to start reading the book.


问:
Development environment to manage multiple Oracle databases
I am in an enterprise environment where we have applications that need to run against multiple Oracle databases.  Developers may need to manage multiple vintages of these databases to support different test data or diagnose bugs against different versions of the code.

Right now, we have a limited set of test environments set up on "real" Oracle servers within the data center.  We juggle these among development and QA groups and there is a lot of conflicts and inefficiencies that arise because of it.

I am taking a look at Oracle Express Edition which would allow me to spin up a local Oracle database.  This is similar to the workflow I most often see with SQL Server.  Devs work on their location machine until they are ready to integration and then they push their DB changes to integration / QA environments.

However, from what I read it seems that Oracle XE only supports one database instance at a time.  So if I have an application that utilizes two different databases, I can't have both of them running on my local machine.  Is that correct?

Does Oracle Standard or Personal editions get around this limitation?  If I had one of those installed locally, how difficult would it be to get multiple databases working on the same development machine?  How do dev shops handle developing against Oracle where they need to be using several different Oracle instances for their applications?

答:
You are correct that XE is limited to one database per server.  Technically, you should be able to run multiple VMs on your development box with different XE databases installed on each one and connect to those databases from your application.  Of course, both databases would be limited by the other restrictions on XE (1 CPU core, 11 GB of data assuming we're talking about Oracle 11g XE, 1 GB of RAM).  I would have to spend some quality time looking through the license to determine whether this runs afoul of the licensing terms for XE-- on the other hand, it's probably not something Oracle is going to care about assuming that the rest of your licensing is kosher.

Both the standard and personal editions of Oracle will allow you to install multiple databases on a single machine.  The process isn't too difficult.  You'll need to determine whether you want the databases to be run from the same Oracle Home (in which case they'll share the same executables, they'll be patched together, etc.) or whether you want them to be installed in separate Oracle Homes (in which case they'll use different executables, they can be upgraded and patched independently, etc.).  Then it's just a matter of doing two installs if you want separate Oracle Homes or running the DBCA (Database Creation Assistant) twice if you want a single Oracle Home with multiple databases.

Since it sounds like you are coming from a SQL Server background, are you sure you are using the term "database" in the Oracle sense rather than in the SQL Server sense?  It's pretty rare in Oracle to be developing applications that access multiple different databases.  It is much more common to be developing applications that access multiple schemas in the same database.  An Oracle schema is roughly equivalent to a SQL Server database.  So it would be much more common in Oracle to simply have multiple schemas in a single Oracle database.


答:
It's essential that you get the customer to participate.  The entire point of iteration is to get customer feedback.  The feedback will allow you to adjust your course.

How do you balance the speed of Sprints with the customer's
  conservative adoption schedule?

SCRUM's benefit is not developing faster, it's about having better direction.  That means you'll get to your goal much quicker.  But you can't adjust your direction without customer feedback.

We've had success getting the customer to step in by adding a "beta" version.  It's basically a second production version.  It operations on the production database, but is updated every day from source control.  It's incredibly helpful to get feedback on items you worked on yesterday.  And the conservative people can stay on the regular production release.

Here's a good article on Boyd's Law of Iteration.  The quickly iterating fighter pilot wouldn't win without feedback.


答:
It is always appropriate to fix what is broken, and to get things to work as close to the spec as possible as close to the deadline as possible.

It is also appropriate for you to document all that you had to fix in order to make the stuff work.  It is important to know if your offshore resources are delivering acceptable code that fits your specification.  If they are not, it is appropriate to send them the documentation of the differences between your specifications (particularly re: performance) and to demonstrate that what they delivered was NOT what is in the spec.  This can be used by your managers to negotiate future work, or to limit what you pay for what you got.

Title: Business Analyst role in development process

Body:
I work as a business analyst and I currently oversee much of the development efforts of an internal project.  I'm responsible for the requirements, specs, and overall testing.  I work closely with the developers (onshore and offshore).

The offshore team produces all of the reports.  Version 1.0 had a 9 month development cycle and I had about 4-5 months to test all the reports.  There was the usual back and forth to get the implementation right.

Version 2.0 had a much shorter development cycle (3 months).  I received the first version of the reports about 3 weeks ago and noticed a lot of things wrong with it.  Many of the requirements were wrong and the performance of the queries was horrendous at 5x - 6x longer than it should have been.

The onshore lead developer was out and did not supervise the offshore development team in generating the reports.

Management knew about the performance issues and I also told them I was trying to find a way to improve performance; they did not explicitly approve of sending test queries, but they were also not concerned with the fact I was doing that.  I took a look at the SQL in the reports and was able to improve performance greatly (by a factor of 6x) which is acceptable for this version.

I sent the updated queries as guidelines to the offshore team and told them they should look at doing X instead of Y to improve performance and also to fix some specific logic issues.

I then spoke to my managers about this because it doesn't feel right that I was developing SQL queries, but given our time crunch I saw no other way.  We were able to fix the issue quite fast which I'm happy with.

Current situation: the onshore managers aren't too pleased that the offshore team did not code for performance.  I know there are some things I could have done better throughout this process and I do not in any way consider myself a programmer.

My question is, if an offshore team that works apart from the onshore project resources fails to deliver an acceptable release, is it appropriate to clean up their work to meet a deadline?  What kind of problems could this create in the future?

Update: So far management is upset with the offshore team, but have not "reprimanded" me in any way, so I'm not sure in their eyes if what I did was wrong, but I think their main source of frustration was the offshore team was not able to come up with a solution and I was, especially since this sort of performance issue had come up in the past.  I am not defending my actions, but I want to give context so that the picture is a little clearer.  I accepted the answer that most criticizes my actions I agree it's not something that should be done by someone in my position.


问:
Ways to break the "Syndrome of the perfect programmer"
I am probably not the only one that feel that way. But I have what I tend to call "The syndrome of the perfect programmer" which many might say is the same as being perfectionist but in this case it's in the domain of programming. However, the domain of programming is a bit problematic for such a syndrome.

Have you ever felt that when you are programming you're not confident or never confident enought that your code is clean and good code that follows most of the best practices ? There so many rules to follow that I feel like being overwhelmed somehow. Not that I don't like to follow the rules of course I am a programmer and I love programming, I see this as an art and I must follow the rules. But I love it too, I mean I want and I love to follow the rules in order to have a good feeling of what im doing is going the right way.. but I only wish I could have everything a bit more in "control" regarding best practices and good code.

Maybe it's a lack of organization? Maybe it's a lack of experience? Maybe a lack of practice? Maybe it's a lack of something else someone could point out? Is there any way to get rid of that syndrome somehow ?

答: As a programmer, your job is to produce code. The purpose of best practices is to increase your production rate by making things easier to understand/do/remember. If adhering to these practices is getting in the way of actually getting things done, you're doing something wrong. Simply try to produce code as fast as you can, and your practices should evolve to let you do just that.</p>


问:
Pronunciation in programming?
How do you correctly or erroneously pronounce programming terms?  Any that you find need strict correction or history into the early CS culture?

Programming

char = "tchar" not care?

! = bang not exclamation?

# = pound not hash? Exception #! = shebang

* = splat not star?

regex = "rej ex" not "regg ex"?

sql = "s q l" not "sequel" (already answered, just i.e.)

Unixen

| = pipe not vertical bar?

bin = bin as in pin , not as in binary?

lib = lib as in library , not as in liberate?

etc = "ett see" , not "e t c" (as in /etc and not "&c")

Annoyance

/ = slash not backslash

LaTeX = "laytek" not "lay teks"

答:
Obviously quite a few people haven't done their homework and read the comp.lang.c infrequently asked questions list. Otherwise, they'd know how to pronounce char:

19.26: How do you pronounce ``char''?

Like the first word of ``char *''. The accent is generally on the first syllable.

Some other pieces are funnier:

17.6: What's this ``white space'' I keep hearing about?

White space is a racist, segregational term. Implicitly, "dark" or "colored" space (i.e., the '_' character) is not good enough to separate tokens. More interestingly, the white space characters keep the other tokens apart. They say it's for parsing, but there's ample evidence the goal of white space is to keep the other characters from "taking over" the program. This is disguised by the description of C as "white space insensitive" - a simple ploy for sympathy.

Title: Pronunciation in programming?


答:
Make it work, make it clean, make it SOLID, make it performant.

The first three are an adage I espouse whenever anyone is wondering how to write SOLID code on a timeline. When you first write a line of code, it simply has to work, so do what you have to do and don't get fancy. The first time you revisit a line of code, it's no longer a one-off and you should clean up the code, making it readable and thus more maintainable. The third time your cursor goes in that line, it's probably kind of a big deal now, and you should refactor it to adhere to the SOLID methodology, abstracting dependencies, implementing patterns, and generally making the code easier to plug in or be plugged into for future enhancement.

Elegance in code is to be achieved where the programmer notices an opportunity, and is generally a function of simplifying, cleaning and generally improving the readability and maintainability of code while following the previous steps. It is not something to be maximized.

Performant code is almost always the least concern in memory-managed languages (Java, the .NET family, most functional languages, etc). In these environments, the goal is to write correct code ("correct" here defined as producing the expected result in all expected cases, and being understandable and well-structured, and thus maintainable), and performance is secondary (usually it will proceed to some degree from correct code). In all cases, an algorithm is performant when it's "good enough". Remember, "premature optimization is the root of all evil"; making optimizations that you don't know you will need does little more than waste time, obfuscate code, and generally prevent progress. It has to work first, then once it works, you run it and see how fast it runs. If it's not fast enough (as defined by some benchmark that is a published requirement), you improve it until it is, and then you stop.

Title: Ways to break the "Syndrome of the perfect programmer"

Body:
I am probably not the only one that feel that way. But I have what I tend to call "The syndrome of the perfect programmer" which many might say is the same as being perfectionist but in this case it's in the domain of programming. However, the domain of programming is a bit problematic for such a syndrome.

Have you ever felt that when you are programming you're not confident or never confident enought that your code is clean and good code that follows most of the best practices ? There so many rules to follow that I feel like being overwhelmed somehow. Not that I don't like to follow the rules of course I am a programmer and I love programming, I see this as an art and I must follow the rules. But I love it too, I mean I want and I love to follow the rules in order to have a good feeling of what im doing is going the right way.. but I only wish I could have everything a bit more in "control" regarding best practices and good code.

Maybe it's a lack of organization? Maybe it's a lack of experience? Maybe a lack of practice? Maybe it's a lack of something else someone could point out? Is there any way to get rid of that syndrome somehow ?


问:
iOS: Versioned static frameworks vs Git Submodules and included code
For the last couple of years I've been building static frameworks of common APIs for my iOS projects. I can build a universal binary containing all the architectures (i386, armv6, armv7) and wrap it up in a .framework directory structure. I then stored this in a directory based on the version of the framework. For example ..../myAPI/v0.1.0/myAPI.framework

Once I have this framework I can then easily add it to a project and if I want to advance the version, merely change the framework search paths to the later version.

This works, but the approach is very similar to what I would use in the Java world.

Recently I've been reading about using Git submodules and static framework sub projects in XCode 4.

Im wondering if my currently approach is something that I should consider retiring and what the pros/cons are of the new approach.

I'm weary of just including code because I've already had issues in a work project which had (effectively) multiple versions of a third party API.

Any opinions?

答:
It really depends. What is your main focus? Static and reliable versions, or staying in the edge?

This is, more or less, the same dilemma a common user would face when deciding if he wants to install an application from his package manager or directly from the developer's site (for example: Ogre3D's version is well ahead of the one that is on Ubuntu's repositories).

If you want to stay on the edge with your API's, go ahead and use git submodules. It will give you a lot of flexibility when you want to update your software.

If you want to stay with reliable versions, and don't want to change much what functions your code will call (since this is a thing that happens a lot when you update an API), then stay doing the same way you have been doing.


答:
When many people are involved in a task, roles must be clearly defined and measures must be set in place. If the code you get is bad, you tell them that it did not meet the expected performance standards set. If no performance standards set, then you could point out that it can be made better, but I don't think you should change it yourself.
Personally, I would not accept someone to change my code without discussing it with me first.

When different organizations are involved boundaries must not be crossed without careful considerations because people (and mostly managers) don't like this. After all this is what managers are for (or at least part of the reason).

This is not to say to let the opportunity of enhancement go away, instead make the management decide the approach if it is not already set.

It is very common to have offshore teams do strange things from what you consider acceptable because the nature of the contracts these companies sometimes take as well as many other reasons.


问:
How to create a Semantic Network like wordnet based on Wikipedia?
I am an undergraduate student and I have to create a Semantic Network based on Wikipedia. This Semantic Network would be similar to Wordnet(except for it is based on Wikipedia and is concerned with "streams of text/topics" rather than simple words etc.) and I am thinking of using the Wikipedia XML dumps for the purpose.

I guess I need to learn parsing an XML and "some other things" related to NLP and probably Machine Learning, but I am no way sure about anything involved herein after the XML parsing.

Is the starting step: XML dump parsing into text a good idea/step? Any alternatives?

What would be the steps involved after parsing XML into text to create a functional Semantic Network?

What are the things/concepts I should learn in order to do them?

I am not directly asking for book recommendations, but if you have read a book/article that teaches any thing related/helpful, please mention them. This may include a refernce to already existing implementations regarding the subject.

Please correct me if I was wrong somewhere. Thanks!

EDIT: The final product should be like a complete Semantic Network (like Conceptnet or Cyc etc.), So I can't use things like Semantic Mediawiki.

(On a second thought, it seems like I should have asked this question on linguistics and not here... )

答:
Wikipedia is great for human processing, not so much for machine processing.  Have a look at http://wiki.dbpedia.org to get the data extracted from Wikipedia in a machine processable format.  Their data set uses OWL as a knowledge representation to provide semantic context to the Wikipedia data set through RDF (XML based) metadata.

Once you have the data set, you will need to be able to run queries against your data.  SPARQL is particularly useful in querying data exposed in this format.  Consider how you define a stream of data, how you implement your data structures, and how you implement your algorithms that query your data to connect it all.

You can check dbpedia tagged questions for additional guidance.

http://answers.semanticweb.com/tags/dbpedia/?sort=newest

https://stackoverflow.com/questions/tagged/dbpedia


问:
Empirical Evidence of Popularity of Git and Mercurial
It's 2012! Mercurial and Git are both still strong.

I understand the trade-offs of both. I also understand everyone has some sort of preference for one or the other. That's fine.

I'm looking for some information on level of usage of both. For example, on stackoverflow.com, searching for Git gets you 12000 hits, Mercurial gets you 3000. Google Trends says it's 1.9:1.0 for Git.

What other empirical information is available to estimate the relative usage of both tools?

答:
Ohloh

In a similar style to my Git vs. SVN answer, Ohloh has been crawled (only) three times by the Internet Archive's Wayback Machine, but July 2011 is unreadable:

August 2010

Git: 26,485 repositories (11.3% of total)

Mercurial: 2,548 repositories (1.1% of total)

Ratio: 10.4:1.0

May 2011

Git: 116,224 repositories (35.3% of total)

Mercurial: 3,753 repositories (1.1% of total)

Ratio: 31.0:1.0

February 2012

Git: 124,000 repositories (26% of total)

Mercurial: ?

June 2012

Git: 134,459 repositories (27% of total)

Mercurial: 11,238 repositories (2% of total)

Ratio: 12.0:1.0

October 2013

Git: 238,648 repositories (38% of total)

Mercurial: 17,145 repositories (2% of total)

Ratio: 13.9:1.0

April 2014

Git: 238,648 repositories (38% of total)

Mercurial: 17,628 repositories (2% of total)

Ratio: 13.5:1.0

Eclipse Community Survey

Another source of data is the Eclipse Community Survey. Git values below are for Git/GitHub.

2009 (pdf)

Git: 2.4%

Mercurial: 1.1% (Note: Hg listed under "other" in 2009 report, but itemised in 2010 report)

Ratio: 2.2:1.0

2010 (pdf)

Git: 6.8%

Mercurial: 3%

Ratio: 2.3:1.0

2011 (pdf)

Git: 12.8%

Mercurial: 1.1%

Ratio: 11.6:1.0

2012

Git: 27.6%

Mercurial: 2.6%

Ratio: 10.6:1.0

2013

Git: 30.3%

Mercurial: 3.6%

Ratio: = 8.4:1.0

2014

Git: 33.3%

Mercurial: 2.1%

Ratio: = 15.9:1.0

Summary

These appear to show that, of the open source repositories registered on Ohloh, and of the developers using Eclipse, Git is a good order of magnitude more popular than Mercurial.


答:
I wouldn't say that a CMS is only useful for non-programmers.

Just the fact that I'm getting paid for writing code does not mean that I have to (or want to!) code every small website from scratch by myself.

If I just want the damn thing to work, without putting too much time and effort in other things than the actual content, then I use a CMS or a blog engine..

For example, I have a blog that is running on WordPress. If it ever gets as much traffic as Stack Exchange (which is VERY unlikely), then I'll probably have scalability problems and maybe I'll need to switch to something else.

But until then, it's just fine for my needs. I just log in, type some text, click "Publish" and I'm done

--> more time to slack off on Stack Exchange :-)

On the other hand...a CMS is basically a tool to build websites with content (or blogs, if you use a blog engine).

That's not what a site like Stack Exchange is. Stack Exchange is more of a web application...you can't easily do something like this with a CMS.

So if you want to create something like Stack Exchange, you have to do it from scratch because there is no ready-made platform that you can use.

Title: Who is a CMS really for?


答:
A Content Management System is going to help anyone, programmer or otherwise, manage the content of their website.  This can mean much more than HTML files--got images?  Easier to organize in a CMS. Got music files you want to stream? Easier to manage in a CMS.  Large files for downloads?  PDFs?  Reports?  The CMS gives you a framework for organizing and accessing all of these.

A CMS actually makes scaling easier.  Suppose you go old-school and store con your content on your server's file system.  What happens when you move to a cluster--which server is your content on?  Any decent CMS can be clustered and load balanced, making your life easier.

Title: Who is a CMS really for?


答: It really depends on the industry you plan to enter. I would say that far more jobs are available in Java or .Net than Python (not that there's anything wrong with Python). More people using these two application languages means they have, pretty much hands down (at the risk of offending someone), the widest knowledgebase and most expansive frameworks available. In the business app world, framework support is a huge part of remaining competitive.</p>

Title: Python and only Python for almost any programming tasks!

Body:
Am I wrong if I think that Python is all I need to master, in order to solve most of the common programming tasks?

EDIT
I'm not OK with learning new programming languages if they don't teach me new concepts of programming and problem solving; hence the idea behind mastering a modern, fast evolving, with a rich set of class libraries, widely used and documented, and of course has a "friendly" learning curve programming language.

I think that in the fast evolving tech industry, specialization is key to success.


答:
CMSes are used by the employees of the committent, who hardly ever get to say a word in the design process, sometimes are a step away from complete computer illiteracy, and almost never get proper training on how to use it.

Some programmers know this and jump trough hoops to make things work for everybody involved anyway, some don't know or don't care, and just drop in a canned solution, skin it up a little, and run away as fast as possible.

Title: Who is a CMS really for?


问:
Instantiate proper class based on some input
I'm attempting to understand how "switch as a code smell" applies when the proper code path is determined by some observable piece of data.

My Webapp object sets an internal "host" object based on the hostname of the current request. Each Host subclass corresponds to one possible hostname and application configuration: WwwHost, ApiHost, etc. What is an OOP way for a host subclass to accept responsibility for a specific hostname, and for Webapp to get an instance of the appropriate subclass?

Currently, the hostname check and Host instantiation exists within the Webapp object. I could move the test into a static method within the Host subclasses, but I would still need to explicitly list those subclasses in Webapp unless I restructure further. It seems like any solution will require new subclasses to be added to some centralized list.

答:
You should simply create instances of the desired subclass of Host:</p>

```<code>class Host
{
    private $name;
    private $type; //the name of the specific host type

    private function __construct($name, $type)
    {
        $this->name = $name;
        $this->type = $type;
    }

    public static function getInstance($name)
    {
        return new self($name, get_called_class());
    }
}

class wwwHost extends Host
{
    //code specific to the wwwHost class
}

class apiHost extends Host
{
    //code specific to the apiHost class
}

$myWwwHost = wwwHost::getInstance('aWwwHostName');
$myapiHost = apiHost::getInstance('anApiHostName');
</code>```

Body:
You should simply create instances of the desired subclass of Host:

class Host
{
    private $name;
    private $type; //the name of the specific host type

    private function __construct($name, $type)
    {
        $this->name = $name;
        $this->type = $type;
    }

    public static function getInstance($name)
    {
        return new self($name, get_called_class());
    }
}

class wwwHost extends Host
{
    //code specific to the wwwHost class
}

class apiHost extends Host
{
    //code specific to the apiHost class
}

$myWwwHost = wwwHost::getInstance('aWwwHostName');
$myapiHost = apiHost::getInstance('anApiHostName');


问:
Using submitted code in a commercial product
I have made a product which I have used the GPL licence, and am now getting pull requests from other authors.

The product also has a less restrictive commercial license available for purchase.

Can I include the submitted code with the commercial licensed product?

答: This is why many "serious" Open Source projects insist that contributors assign the copyright of their work to the project.  That means that the project itself owns all the code, and can do whatever it wants with it.  Some projects do this to ensure that they can sue people who violate the license (e.g., the FSF does this).  Others want to be able to reuse changes in non-OSS products (e.g., MySQL).


答:
We ran into a similar issue at my place of work.  We have the standard Development, QA, Production setup.  Every developer developed against the same database Dev, and for 80% of the time, all is well.  We really ran into problems when we wanted to add integration testing.  How could we be sure the data would be correct without wiping out entire tables?  The answer we settled on was using VMs as @Justin Cave suggests.

Every developer on my team is running on Windows 7 Pro, which means we all have XP mode, which deals with some pesky licensing that can come up with running VMs (unless you are running Linux).  Oracle Express 11G for Windows is still 32-bit, so setting it up in XP mode wasn't a big deal.  Here are a couple of lessons we learned to help you.

Setup a common .vhd file everyone can copy from a file server.  The .vhd file will contain the instance of Oracle and the base database structure and static data (countries, states, etc.)

Whenever a data structure change is made to an environment such as Dev you can use SQL Developer 3.1 (or higher) database diff tool to determine the differences in structure.  Update the .vhd locally and copy it out to the shared location.

Connecting to Oracle Express through a VM is not as straight-forward as one would think, at least with Virtual PC and XP mode.  You have to install Microsoft's Loopback adapter on the host and vm.  Once installed you can select the loopback adapter as the network connection for the VM.  You will need to setup the adapters on each machine.  For example the IP address on the host is 192.168.1.1 while the IP address on the VM is 192.168.1.2.  Instructions to install the Loopback adapter can be found here.

I haven't noticed a big difference between running natively vs on a VM.  The only thing is make sure you have set the memory for the VM to at least 1.5 GB prior to installing Oracle Express 11G.  Oracle's setup has a funny quirk where it will set Oracle's max memory limit to 100 MB instead of 1 GB, which caused a huge performance drop (queries that took a second suddenly took 10 seconds).  Changing it after install is a real pain.

Title: Development environment to manage multiple Oracle databases

Body:
I am in an enterprise environment where we have applications that need to run against multiple Oracle databases.  Developers may need to manage multiple vintages of these databases to support different test data or diagnose bugs against different versions of the code.

Right now, we have a limited set of test environments set up on "real" Oracle servers within the data center.  We juggle these among development and QA groups and there is a lot of conflicts and inefficiencies that arise because of it.

I am taking a look at Oracle Express Edition which would allow me to spin up a local Oracle database.  This is similar to the workflow I most often see with SQL Server.  Devs work on their location machine until they are ready to integration and then they push their DB changes to integration / QA environments.

However, from what I read it seems that Oracle XE only supports one database instance at a time.  So if I have an application that utilizes two different databases, I can't have both of them running on my local machine.  Is that correct?

Does Oracle Standard or Personal editions get around this limitation?  If I had one of those installed locally, how difficult would it be to get multiple databases working on the same development machine?  How do dev shops handle developing against Oracle where they need to be using several different Oracle instances for their applications?


问:
Testing To Prevent Cascading Bugs
Yesterday, Twitter was hit with a "Cascading Bug" as described in this blog post:

A “cascading bug” is a bug with an effect that isn’t confined to a particular software element, but rather its effect “cascades” into other elements as well.

I've seen this kind of bug, on a smaller scale of course, on some projects I've worked on. They can be difficult to identify in dev/test environments, even within a test driven development environment.

My questions are...

What are some strategies you use, beyond the basic TDD and standard regression testing, to identify and prevent the potential trouble points that might only occur in the production environment?

Does the presence of such problems indicate a breakdown in the software development process or simply a by-product of complex software systems?

答:
Dude, don't fear the [Chaos Monkey]!
-- Bill S. Preston, Esq.

Seriously, as Netflix, Amazon Web Services, Twitter, and others have found out, these problems arise spontaneously in complex systems.  There is some research to suggest that it is impossible to know for sure that such problems do not exist (i.e., that they are akin to Turing's Halting Problem).  The only "best practice" seems to be to randomly knock parts offline frequently, and make sure the system as a whole continues to function.  It's painful at first, and is best done on non-production systems until you've figured out how to handle many of the resulting failures, but it seems to work.  Netflix calls the tool that does this on their system "the Chaos Monkey" :-)

Title: Testing To Prevent Cascading Bugs


问:
Worst coding standard you've ever had to follow?
Have you ever had to work to coding standards that:

Greatly decreased your productivity?

Were originally included for good reasons but were kept long after the original concern became irrelevant?

Were in a list so long that it was impossible to remember them all?

Made you think the author was just trying to leave their mark rather than encouraging good coding practice?

You had no idea why they were included?

If so, what is your least favorite rule and why?

Some examples here

答:
I find many of the Mono coding guidelines to be pointless or counter-productive. For example:

80 column limit - considering we're all using widescreen monitors these days is just wasting the limited vertical space we don't have, and not making use of the horizontal space we do have.

Tabs for spaces - perfect way to make your code look like a mess when opened in different editors which have different tab sizes. (Also, eight space tabs is just wasting the very limited 80-columns you have to work with anyway).

Inconsistent brace positioning, for what reason? What's wrong with 1TBS?

There are a number of other guidelines there which are just "good practices", without reasoning.


问:
Best exception handling practices or recommendations?
I think the two main problems with my programs are my code structure/organization and my error handling. I'm reading Code Complete 2, but I need something to read for working with potential problems.

For example, on a website, if something can only happen if the user tampers with data via javascript, do you write for that? Also, when do you not catch errors? When you write a class that expects a string and an int as input, and they aren't a string and int, do you check for that, or do you let it bubble up to the calling method that passed incorrect parameters?

I know this is a broad topic that can't be answered in a single answer here, so what I'm looking for is a book or resource that's commonly accepted as teaching proper exception handling practice.

答:
One of the good things to remember is perform exception handling when there is a need.

For .NET development platform just follow the MSDN guidelines - Best Practices for Handling Exceptions, as well as check this nice code-project article - Exception Handling Best Practices in .NET

However, the following guidelines are mostly true for any development platform:

Don't manage business logic with exceptions. Use conditional statements instead. If a control can be done with if-else statement clearly, don't use exceptions because it reduces readability and performance  (e.g. null control, divide by zero control). .

Exception names must be clear and meaningful, stating the causes of exception.

Throw exceptions for error conditions while implementing a method. E.g. if you return -1, -2, -3 etc. values instead of FileNotFoundException, that method can not be understand.

Catch specific exceptions instead of the top Exception class. This will bring additional performance, readability and more specific exception handling.

Null control with conditionals is not an alternative to catching NullPointerException. If a method may return null, control it with if-else statement. If a return may throw NullPointerException, catch it.

Try not to re-throw the exception because of the price. Bu if re-throwing had been a must, re-throw the same exception instead of creating a new exception. This will bring additional performance. You may add additional info in each layer to that exception.

Define your own exception hierarchy by extending current Exception class (e.g. UserException, SystemException and their sub types) and use them. By doing this you can specialize your exceptions and define a reusable module/layer of exceptions. more to follow in this link


问:
Messaging technologies between applications ?
Recently, I had to create a program to send messages between two winforms executable. I used a tool with simple built-in functionalities to prevent having to figure out all the ins and outs of this vast quantity of protocols that exist.

But now, I'm ready to learn more about the internals difference between each of theses protocols. I googled a couple of them but it would be greatly appreciate to have a good reference book that gives me a clean idea of how each protocol works and what are the pros and cons in a couple of context.

Here is a list of nice protocols that I found:

Shared memory

TCP

List item

Named Pipe

File Mapping

Mailslots

MSMQ (Microsoft Queue Solution)

WCF

I know that all of these protocols are not specific to a language, it would be nice if example could be in .net.

Thank you very much.

答:
Most of the scenarios are supported through bindings in WCF.

For the official source you may look at WCF Feature Details, and good intro to Basic WCF Programming, and very detailed Introduction to Windows Communication Foundation is also availiable in MSDN.

Regarding books, the top rated book on this subject matter can be found here - Programming WCF Services


问:
Is it a security flaw to log the class and method name when an exception occurs?
I have the following :

```<code>public class doCheck(){

    public void performCheck(){
        try {
            perform all checks......
        }
        catch(Exception e){
            logger.error("Exception occured in class doCheck in method performCheck");
            thrown new MyNewException(e.getMessage());
        }
    }
}
</code>```

Is it safe to log the class and method name?

答:
That depends on whether your code base is hidden or not. If you ship the product to the client then he can inspect the Java byte code trivially anyway, so logging class names doesn’t reveal any information the user cannot get anyway.

For a server-side application, this is still true. However, it may be a security hole to display such logs to the client. That’s why most web application frameworks distinguish between a development and production configuration: during development, debug information is displayed to the user in the case of an error. In production, this information is logged on the server, but no longer displayed in the web browser / to the client.

OwnerDisplayName: Konrad Rudolph


答:
For MSMQ solution, take a look at NServiceBus. It is very easy to set up and play around with. They have plenty of examples that you can download and run.

We have used it in a number of applications and it works great so far.

There are also some similar alternatives, such as MassTransit.

Title: Messaging technologies between applications ?

Body:
Recently, I had to create a program to send messages between two winforms executable. I used a tool with simple built-in functionalities to prevent having to figure out all the ins and outs of this vast quantity of protocols that exist.

But now, I'm ready to learn more about the internals difference between each of theses protocols. I googled a couple of them but it would be greatly appreciate to have a good reference book that gives me a clean idea of how each protocol works and what are the pros and cons in a couple of context.

Here is a list of nice protocols that I found:

Shared memory

TCP

List item

Named Pipe

File Mapping

Mailslots

MSMQ (Microsoft Queue Solution)

WCF

I know that all of these protocols are not specific to a language, it would be nice if example could be in .net.

Thank you very much.


答:
I assume you are talking about CMS as combined with Web Content Management (WCM). The generic CMS can be all sorts of other things as well.

The important thing to realize is that there are (at least) two main types of CMS engines:

CMS as a framework in which you write components. This is mostly for creating websites and then programmers write individual display components, reporting elements, extension workflow steps, etc. But the content and the layout is the king.

CMS as a bolted-on engine to make storing and presenting textual content easy. This is a case when you have a custom application, but maybe you also have a built-in help system, which you don't want to reinvent from scratch. Or maybe some sort of forum component. This is much more about the programmer then and CMS functions are just a plugin.

There are systems for both of those approaches. You can often tell by reading the installation instructions. If the full system runs out of the box, that's usually a first type (user-oriented). If, instead, it talks about easy way to register which modules you want to show up and on what URLs, etc - it is a bolt-on programmer-oriented system.

My take on specific examples from C# world would be Kentico for the framework approach and Orchard for bolted-on approach.

Title: Who is a CMS really for?


问:
What are the differences between Castle Monorail 3 over ASP.Net MVC?
I have been using Castle Monorail for some years now with great success, although I haven't bothered to update the version I'm using (2 or 3 year old). Now I'm making a decision on go to ASP.Net MVC 3 or update to the latest Castle version.

I have been looking documentation on the newest version of Castle projects (specially Monorail), but there is really little or no info around (I may be wrong).

Does someone knows what are the differences between Castle Monorail version 3 over ASP.Net MVC3?

Thanks!

答:
Castle seems to be dead (latest blog post says "another one bites the dust....". MVC3 (4 is out soon) is very much alive and has strong team behind it. And, I believe, it has gone open-source recently.

I would switch to a project that actually has some community. Does not have to be ASP.Net MVC, but Castle does not seem to be it.

OwnerDisplayName: yorch


问:
What popular "best practices" are not always best, and why?
"Best practices" are everywhere in our industry.  A Google search on "coding best practices" turns up nearly 1.5 million results.  The idea seems to bring comfort to many; just follow the instructions, and everything will turn out fine.

When I read about a best practice - for example, I just read through several in Clean Code recently - I get nervous.  Does this mean that I should always use this practice?  Are there conditions attached?  Are there situations where it might not be a good practice?  How can I know for sure until I've learned more about the problem?

Several of the practices mentioned in Clean Code did not sit right with me, but I'm honestly not sure if that's because they're potentially bad, or if that's just my personal bias talking.  I do know that many prominent people in the tech industry seem to think that there are no best practices, so at least my nagging doubts place me in good company.

The number of best practices I've read about are simply too numerous to list here or ask individual questions about, so I would like to phrase this as a general question:

Which coding practices that are popularly labeled as "best practices" can be sub-optimal or even harmful under certain circumstances?  What are those circumstances and why do they make the practice a poor one?

I would prefer to hear about specific examples and experiences.

答:
Static typing of primitives

Having to specify a data type as one of a large number of types of number is premature optimization.  Just call it a number, keep track of its value, and assign a type later if it's useful for optimization.

User-defined types are useful.  Inherent types aren't.


问:
How do employers measure "strong or solid knowledge of programming language"?
Yesterday I had received a great job opportunity.

In requirements section I had seen the words:

solid knowledge of python;

solid knowledge of java;

good technical background;

Could you give me an answer, what does it mean?
How to test my current knowledge? What type of measure will be actually accepted by employer?

答:
If I were the employer I would talk to you on the phone about it to see if you had a clue. If you passed that test I would bring you in to the office. There we would talk in depth at a white board for a while and I would ask you to explain how to do several tasks.

Finally I would sit you down at a computer and ask you to write code.

In that process I don't expect someone to know every detail, but I would expect them to have a general clue


答:
If you have to ask ...

If you have to ask this, you probably don't qualify for any of those requirements.

Rephrase the Context

Replace solid knowledge of Java with solid knowledge of Jazz Guitar.

You would assume someone with solid knowledge of Jazz Guitar could perform any Jazz song that were asked to with confidence. They should also be able to demonstrate theoretical understanding of the foundations of Jazz by improvising on the spot. They should be able to hold their own with any other musician in a band with solid knowledge of Jazz Bass or Drums.

Apply this to a programming language such as Python, could you create a solution to any general problem in idiomatic Python? Could you demonstrate advanced understanding of the aspects of the language that are specific to Python? Can you hold your own in a team consisting of other solid knowledge of Python developers?

Subjective Standard

It becomes very clear that what is considered solid knowledge is subjective to the person asking.

That said, given those requirements you should be able to answer pretty much any general knowledge question about the things in question along with a good number of advanced knowledge questions that would come from extensive experience with the things listed.

Stackoverflow Reputation

I would say a 5 digit reputation, at mininum on stackoverflow.com in any specific language tag from answers and not questions would demonstrate solid knowledge of that topic.

Title: How do employers measure "strong or solid knowledge of programming language"?

Body:
Yesterday I had received a great job opportunity.

In requirements section I had seen the words:

solid knowledge of python;

solid knowledge of java;

good technical background;

Could you give me an answer, what does it mean?
How to test my current knowledge? What type of measure will be actually accepted by employer?


问:
initial Class design: access modifiers and no-arg constructors
Context:
Student working through Class design in personal/side project for Summer. I've never written anything implemented by others or had to maintain code. Trying to maximize encapsulation and imagining what would make code easy to maintain.

Concept:
Tight/Loose Class design where Tight and Loose refer to access modifiers and constructors.

Tight: initially, everything, including setters, is private and a no-arg constructor is not provided (only a full constructor).

Loose: not Tight

Exceptions: the obvious like toString

Reasoning:
If code, at the very beginning, is tight, then it should be guaranteed that changes, with respect to access/creation, should never damage existing implementations. The loosening of code happens incrementally and must be thought through, justified, and safe (validated).

Benefit:
Existing implementing code should not break if changes are made later.

Cost:
Takes more time to create.

Since this is my own thinking, I hope to get feedback as to whether I should push to work this way.  Good idea or bad idea?

答:
Tight coupling is when a group of classes are highly dependent on one another.

Let us see tight coupling between java objects first, take an example..

```<code>class Traveler
{
    Car c=new Car();
    void startJourney()
    {
       c.move();
    }
}
</code>```

and

```<code>class Car
{
  void move()
  {
     // logic...
  }
}
</code>```

In the above example, Traveler object is depends on car object.  So traveler class creating an object of Car class inside it

If the other class object is created in the dependent class, there exist tight coupling, I mean if method in car object is changed then we need to do the changes in the Traveler class too so its the tight coupling between Traveler and Car class objects.

Loose coupling is achieved by means of a design that promotes single-responsibility and separation of concerns.

A loosely-coupled class can be consumed and tested independently of other (concrete) classes.

Interfaces are a powerful tool to use for decoupling.

Let us see loose coupling between java objects, take an example..

In order to over come tight coupling between objects, spring framework uses dependency injection mechanism with the help of POJO/POJI model and through dependency injection its possible to achieve loose coupling

In the above example Traveler , Car are tightly coupled.  If we want to achieve loose coupling between the objects Traveler and Car, we need to re-write the application like….

```<code>class Traveler
{
    Vehicle v;
    public void setV(Vehicle v)
    {
      this.v = v;
    }

    void startJourney()
    {
       v.move();
    }
}
</code>```

Body:
Tight coupling is when a group of classes are highly dependent on one another.

Let us see tight coupling between java objects first, take an example..

class Traveler
{
    Car c=new Car();
    void startJourney()
    {
       c.move();
    }
}

and

class Car
{
  void move()
  {
     // logic...
  }
}

In the above example, Traveler object is depends on car object.  So traveler class creating an object of Car class inside it

If the other class object is created in the dependent class, there exist tight coupling, I mean if method in car object is changed then we need to do the changes in the Traveler class too so its the tight coupling between Traveler and Car class objects.

Loose coupling is achieved by means of a design that promotes single-responsibility and separation of concerns.

A loosely-coupled class can be consumed and tested independently of other (concrete) classes.

Interfaces are a powerful tool to use for decoupling.

Let us see loose coupling between java objects, take an example..

In order to over come tight coupling between objects, spring framework uses dependency injection mechanism with the help of POJO/POJI model and through dependency injection its possible to achieve loose coupling

In the above example Traveler , Car are tightly coupled.  If we want to achieve loose coupling between the objects Traveler and Car, we need to re-write the application like….

class Traveler
{
    Vehicle v;
    public void setV(Vehicle v)
    {
      this.v = v;
    }

    void startJourney()
    {
       v.move();
    }
}


答:
Your confusion is understandable. It can be hard to figure out what they mean if you're a fresh graduate who has been programming mainly on campus.

Life in the industry is a lot different because university professors usually program for research and proof-of-concept. They don't have to bother about things like continuous delivery, a solid build, unit testing, requirements, network infrastructure or the latest tools of the trade because either they're developing new tools or they're under way less constraints.

What the job requirements mean is that they're looking for someone who - at a minimum - doesn't have to ask about the syntax of his programming language of choice anymore, who knows how to look up documentation to fix problems on his own, who doesn't bother his seniors with small problems that could be solved by a Google search.


问:
Standards & compliances for secure web application development?
I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way and i have mine.

I am not talking about the formatting of code, but rather of way site is organized in classes and the way the utilize them. and the way they create functions and process forms etc.

Their coding does not match my standards, but again they argue that its matter of preference and as long as goal achieved the can be different way's to do it. I agree but their way is proven to have bugs and we spend a lot of time going back and forth with them to fix all problems security or functionality, yet they still write same code no matter how many times i asked them to stop doing certain things.

Now i am ready to dismiss them but friend of mine told me that he has same exact problem with freelance developers he work with. So i don't want to trade one bad apple for another.

Question is is there some world wide (or at least europe and usa) accepted standard or compliance on how write secure web based applications. What application architecture should be for maintainable application.

Is there are some general standard that can be used for any language ruby php or java govern security and functionality and quality of code? Or at least for PHP and MySQL i use for my website. So i can make them follow this strict standard and stop making excuses.

答:
There's the OWASP Application Security Verification Standard. It's an objective way of determining that best practices involved with security were followed by answering a checklist about the product. The checklist's requirements are independent from server-side technology.

http://code.google.com/p/owasp-asvs/wiki/ASVS

You may want to consider requiring at least level 1 compliance from your freelancers.

As a warning, the checklist contains items like "V5.2 - Verify that a positive validation pattern is defined and applied to all input." This means that unless a developer has actually carefully studied the requirements prior to implementation (or has already adopted a secure development methodology) they're unlikely to deliver an end result that doesn't need large rewrites to match the ASVS requirements.