问:
Scheduling/suspending embedded interpreters
Let's say that I want to embed a scripting engine inside some other program, to allow users to create custom behaviours for objects.

For example, when a particular event happens, the server would launch an embedded scripting engine and run a user-supplied response-to-event script supplied by each actor. Conceptually you can imagine it like a movie script. A new character enters the scene. Each of the actors in the scene must now respond to the new arrival, and that behaviour is governed by their user-supplied scripts.

Now I can launch an embedded interpreter which will run the user-supplied scripts, but I need somehow for the main application to "timeslice" or schedule those sub-processes.

For example there might be a rule that says each actor can perform one action per second. So after an actor performs the one action, I would like suspend their interpreter until their next chance to act.

Another way I thought of implementing it was for the actors to voluntarily release control. e.g. their script might go "say hello; sleep 1000 millis; wave arms; sleep 1000 mills;" If I was going to do that I might as well give them a "crash me" button to push as well.

If I had to destroy or re-enter the interpreters, I would also need some way of storing the state/program counter so it could resume.

I'm also considering running them as separate threads or processes, but I'm not sure how exactly how much control I will have over them, to be able to suspend and resume a thread or subprocess in this manner. Edit: I would also be dependant on the clients behaviour to synchronise everything, just as if I was depending on them to sleep.

I am told this is a common game design pattern, but I can't really find any useful information on how to implement it. I've looked at embedded interpreters, for example Nashorn JS in Java or Lua in C++ and they don't appear to support suspending the interpreter, which would be "easy way" to do this.

Can anyone give guidelines here? At the moment I think thread or process control might be the best solution?

Edit: I don't really to want to have write my own interpreter ... although if I did, I could obviously suspend it at will. It would be a lot of work even for a basic stack machine.

Edit: I'm beginning to think that I need to have a custom interpreter that I tell to "run 100 opcodes (etc), then sleep".

答:
An interpreter must be defined specifically for this problem. Specifically, many interpreters use the native system call stack to store contexts (i.e. they call themselves recursively, for example to interpret function calls). Such an interpreter cannot readily be suspended. Instead, the interpreter will need to store continuations of function calls directly.

Stackless Python is an implementation of this technique that is popular in the game development industry.


问:
Does exist a reflexive compiled language?
I just wonder if exists a compiled language that can modify it's own machine code.

I know that in most common operative systems the executable code is protected during execution time, but maybe if you're using some specific a permissive operative system, you can use a language that allow you use reflexive features over it's own code.

I found that some assembly programmers used reflexivity so maybe someone invented some high level language that allows you to compile reflexive machine code.

UPDATE
The real case
We are building a high performance scientific program. We are using in C as a portable assembly. We usually check the generated assembly code to improve our code making it faster. Looking inside we figured that a good way to improve the code is that C have some facilities of machine code reflexivity.

Example:
Imagine this code:

```<code>void func (int b) {
int i;
for ( i = 0 ; i < 10 ; i ++) {
  if ( i + b == 2 ) do_some();
  do_other();
}
</code>```

Would be more performant if you could make a reflexive approach

```<code>void util(int i, int b) {
  if ( i + b == 2 ) {
    do_some();
    delete_util(); //this will delete the util function and just continue where is called.
  }
}

void func(int b) {
int i;
for ( i = 0 ; i < 10 ; i ++) {
  util(i, b);
  do_other();
}
</code>```

I know there are a lot of reflexive languages that are interpreted or compiles to VMs, but because of that are less performant, then not what I need.

答:
First, the very definition of compiled languages is suspicious (actually, it is language implementations that are mostly compiled - and some of them compile to bytecode, but even in most C implementatons the printf format string can be viewed as interpreted by the C standard library; so there is a continuous spectrum between interpreters and compilers).

(In the rest of my answer, I am implicitly focusing on Linux systems, commonly used for HPC)

Then look for homoiconic languages, notably Common Lisp and Io. Notice that the SBCL implementation of Common Lisp is compiling to machine code at every REPL interaction. Also, SBCL can be configured to generate code as efficient as optimized C.

BTW, usually code is not self-modifying (because on current tablet/laptop/desktop/server processors it makes the CPU caches very unhappy, and because reasoning about self modification is tricky), but several applications (and language implementations) are generating fresh machine code at runtime, then running it -in the same process. You can use JIT compiling techniques (libjit or GCCJIT etc...), or simply generate C (or even C++) code at runtime, compile it into some shared object, and dynamically load that fresh code e.g. with POSIX dlopen (on current systems, compilers are quick enough to make that compatible with human interaction; see my GCC MELT as an example.).

Notice that cleverly emitting some C code at runtime (you'll better at least represent the full AST of the emitted code in memory before writing it to some generated /tmp/emittedcode.c file), then compiling it with gcc -O3 -Wall -fPIC -shared /tmp/emittedcode.c -o /tmp/emittedcode.so, then dlopen-ing the freshly produced /tmp/emittedcode.so plugin, can give you very efficient runtime generated code, as efficient as your original program, if you emit the C code with care. There is no need to delete code, just use function pointers obtained by dlsym-ing your generated plugin (you could indirectly have closures, or C++11 std::functions, or callbacks above dlsym-ed function pointers). In practice (see my manydl.c example) you can afford many hundreds of thousands of dlopen-ed plugins without doing any dlclose (because you'll mostly "leak" code memory, which does not grow that fast).

So with most metaprogramming techniques, a small piece of code is rarely (or never) self-modified, but the entire software system is modifying itself (often growing itself) by generating and using new code (hence, self-modification happens at the program level, not inside a small function); even when you program in assembler (which you should not do much today, because compilers are generating better code than human programmers realistically can) you rarely use self-overwriting code (in particular, because it is not efficient today).

Notice that GCCJIT being GCC-based, and LLVM too being part of a compiler suite, can both be configured and used to emit at runtime very efficient machine code. Of course the JIT-compilation, that is machine code emission, time will need to be bigger (to run the same optimizations as your favorite compiler), but you probably don't care. On the other extreme  GNU lightning and tinycc are generating very quickly slow machine code.

Read also about multi-stage programming & dynamic software updating. Look into J.Pitrat's blog (he passed away in October 2019 and was the first French AI researcher) & read his books. See also the self-generated C code of his CAIA system, and look into the ongoing RefPerSys free software project.

If you are not familiar with compiler technology (and emitting C code is a form of compilation), you should take time to study it. Assuming you know some dialect of Lisp I recommend the Lisp In Small Pieces book by Queinnec (because most of compilation is not parsing, see this & that).

(If you care about performance, you really should benchmark. What is mattering is cache misses and pipeline stalling. Arithmetic and predictable jumps are nearly free, but an L3 cache miss (to your RAM modules) takes more than 100 nanoseconds, i.e. more time than several hundreds machine instructions; see this page and its answers section...; current processors are spending half of their time waiting for memory (L2 or L3 cache, RAM modules))

ContentLicense: CC BY-SA 3.0

ContentLicense: CC BY-SA 4.0


问:
How to define fixed priced software projects and how to argue what is inside scope and what is outside scope?
So here is what happened

The customer gave me a list of things he wanted to have. It is a funding website. So to start a funding project he wanted to have certain fields in the "create/edit funding project" part. He gave me a document on what should get implemented.
I estimated around 25 hours for it and made a price tag for that milestone, but am now at 66 hours, and according to him, it is not done yet.

An example:
We changed an existing wordpress theme. He wanted a funding project initiator name for each project. So i estimated 0.5 hours for adding a field 'project initiator name'. For me, that was adding the field and adding it to the "create/edit funding project page" there was not mentioned to add it somewhere else in the document.

Now he added a "bug" that this new field does not change in the "My account" the display of the "my profile". He added other things that were not in the feature list as well.

How do you create contracts for milestones that don't give the customer a bad understanding of what is inside and me no need to explain what is not inside?

答:
If I have learnt anything from freelance projects and especially with Agile development it is: for goodness sake - set done criteria. These are clear milestones that can be ticked off once something has been done. Naturally, these need to be crystal clear and set with your customer from the outset.

Now they may just want "a website", but even then it is worth taking the time to itemise everything so if either party are no longer happy with the association, then the work completed can be billed.

Something that can help (which freelancing sites use quite a lot) is escrow. It isn't a silver bullet but it at least helps to know that the development budget has been put aside and you're not over a barrel developing forevermore without seeing a dime.

Not everything should be billed. It greases the wheels if you can do the odd (quick) bit for free whilst you're in a certain section of the code doing something else. Make sure your client is aware of this goodwill development and it will help your position for any contentious features/bugs.


问:
static method, helper function or in the controller, where does this go?
I'm working on a piece of functionality that simply allows a guest user to perform an action a certain number of times before requiring them to login\create account. In this instance, they can vote on photos in a gallery 5 times before the app asks them to create an account.

My solution is roughly as follows.

On initial load, set cookie with vote_count=1;

retrieve and increment vote_count each time a user votes;

When vote_count=5, redirect user to page asking them to login or sign up. (of course the user can delete their cookies or use another browser etc, but I'm not concerned with that right now).

My problem is where to implement this code.

Even though I will only call this feature on one route, I feel the controller is the wrong place because it adds quite a bit of code, and if I change the number of times a user can vote, I'm changing code in the controller (maybe that's not a bad thing?)

I don't believe this should live in a helpers.php file because it's not needed anywhere else in the app.

I guess I could create it's own class and it could live as a static method, but I feel static methods are best left for functionality in which they will always return the same value and have the same result regardless of where they are called.

To put this into a good question. What is a good OOP way of implementing this that fits in line with Laravel?

答:
Although I don't have experience with Laravel, but I do have solid Symfony2 background and I don't know how much the framework matters in this question I would say that the proper OOP solution is to create a class that implements the logic needed.

Putting this code in controller seems to you as a bad idea, because the controller is an integration layer so no business logic should be placed in it. Of course you can always compromise depending in situation.

And bout should it be static method or not - check this answer: https://stackoverflow.com/a/2671636/1904606


问:
Unit Testing: Assembler code and different architectures
I am currently unit testing some C code and I am faced with a problem:

Within the code there are called functions that contain inline assembler code for the SPARC 8 architecture.

Since I am doing the unit tests on a x86 architecture, it obviously can't be compiled. Unfortunately, testing it on the target plattform is not possible for me.

What do you think would be a proper approach for this problem? Should I modify the original code by enveloping the inline assembler code with #ifdef UNIT_TEST #endif, or is there an alternative solution?

答:
No one said unit tests have to be run all on the same platform - but no one said you could reach 100% test coverage either.

As a first step, #ifdef out the code, preferably factoring it into a platform-specific function. Write a suitable implementation of this function for x86. However, I don't think it is appropriate to select the code to be compiled based on "unit testing" or "not unit testing". Rather, simply use the architecture: x86 or SPARC.

Now continue working on your tests and on your program. Simply document the "hole" in testing you have created: the function, while unit-tested on x86 is not unit tested on SPARC. Just don't stop your progress because you have not figured out yet how to test this particular piece of code.

Assuming you had written this piece of assembler for a good reason (such as e.g. a very frequently used routine called in tight loops) you should now feel uncomfortable. The good news is that unless you ship yesterday, you have some time to patch the hole. Here are some ideas:

1) You are probably doing integration testing (or field tests, or anything higher-level than unit tests). If the observed behavior is as per spec, then your assembler code is probably fine. At the end of the day, it's all about the testing conditions: if your integration testing includes most of the operational conditions, then you are OK. Granted, you won't get the same feedback than with unit tests (the loop will be longer; the failure will not be as precise as "expected this, got that" and harder to investigate) but still: your code is tested.

2) You might have some colleagues around, who will be happy to do a code review on this specific part.

3) You could try to use an emulator (QEmu seems to support SPARC archs). I have no idea if this could pay back, but why not give it a shot?

4) Are you 100% sure you can't have your hands on the target machine? How much is going to cost a defect in this code? If it's more than a few days of work, then you can probably convince your manager to buy an old Sun station to run tests on. Testing always look too expensive at first sight, but it's like an insurance, or an investment. Really, hardware is cheap compared to man-hours, lost company benefits (or, even worse, court trials).

To sum up: either you feel you must unit test your code (and in this case, make it happen by ruling out the "impossible for me" part), or rely on other forms of testing.


问:
Filtering request and responses in RESTful MEAN stack
I have a very basic RESTful service written using the MEAN stack (MongoDb, Express.js, Angular.js, Node.js) and utilizing the Mongoose ODM.

Product schema

```<code>var productSchema = new mongoose.Schema({
  name: {type: String, required: true, maxlength: 250},
  _prices: [{
    amount: {type: Number,required: true,min: 0.0},
    date: {type: Date, required: true, default: Date.now}
  }]
});

productSchema
.virtual('price')
.get(function () {
  var price = this._prices[this._prices.length - 1];
  return price !== undefined ? price.amount : undefined;
});

productSchema.methods.setPrice = function (amount) {
  this._prices.push({amount: amount});
};
</code>```

The purpose of the _prices array and the price virtual property is that I want to save an audit trail of the price history.

I have a RESTful interface for /products supporting the usual GET, POST, PUT and DELETE.

In my system, administrators are allowed to POST, PUT, and DELETE, which is obvious, however the issue arises for anonymous access.  Anonymous users are allowed to GET only, but the GET response should not include the _prices field, as only administrators can see the history.

As anonymous

```<code>{
  name: "Widget",
  price: "5.99"
}
</code>```

As administrator

```<code>{
  name: "Widget",
  price: "5.99",
  _prices: [
    {price: "7.25", date: "2015-02-28"},
    {price: "5.99", date: "2016-01-09"}
  ]
}
</code>```

The majority of tutorials I read regarding the MEAN stack always show returning the mongoose model directly.

```<code>exports.getAll = function(request, response) {
  Product.find({}, '-_prices', function (err, products) {
    res.json(200, products);
  });
};
</code>```

This is very simple to get around from the products controller, however, I find this to be very misplaced as this filtering logic is in the controller, and brittle in that if I add new fields to my schema, I must go back to the controller to ensure I am not exposing fields in the future.

I also have questions about going the other way, doing request validation.  It seems most tutorials have you accept user input as-is and let the mongoose validation fail.

```<code>exports.post = function(request, response) {
  var product = new Product(request.body)

  product.save(function(error, product) {
    if (error) {
      return response.json(422, error);
    }

    response.send(201);
  });
};
</code>```

Having been used to ASP.NET WebApi, my views on this are slightly skewed.  I would have probably created separate view models for the request, and different view models for the response (depending on whether I'm authenticated or not), do the input validation on the request view model, and have only invariant validation within my entity.  However, I want to ensure I am doing thing the MEAN stack way.

My questions are as follows:

Should I rely solely on mongoose's validation for input validation, or should I write my own before it even gets to mongoose?

For output filtering, should I create a security / filtering  module which accepts a Product and returns a view-model depending on the user's context, dependent on whether they're an administrator or not?

Should I override the toJSON behavior (which is extensible in mongoose, by the way) to do the filtering?

Should I create a layer of abstraction between my controllers and mongoose?

My initial thought is that mongoose itself has too much responsibility, but I don't want to avoid using it if it's the best approach.

答:
Should I rely solely on mongoose's validation for input validation, or should I write my own before it even gets to mongoose?

I think that kind of checks should be done by your service, between DB and HTTP modules, not inside DB.

For output filtering, should I create a security / filtering module which accepts a Product and returns a view-model depending on the user's context, dependent on whether they're an administrator or not?

I dislike the way something is returned from model to HTTP interface directly, but you can just use simplest method here: check the rights in request handlers and tweak the object by removing extra fields, if needed. This will take less lines.

Should I override the toJSON behavior (which is extensible in mongoose, by the way) to do the filtering?

No.

Should I create a layer of abstraction between my controllers and mongoose?

Do you mean data model layer? No. Let your controllers "control" this.


问:
How does breaking up a big method into smaller methods improve unit testability when the methods are all private?
I'm presently reading Building Maintainable Software by Joost Visser and some of the maintenance guidelines they recommend include: A) each unit/method should be short (less than 15 lines per method) and B) methods should have a low cyclomatic complexity. It suggests that both these guideline helps with testing.

The example below is from the book explaining how they would refactor a complex method to reduce the per method cyclomatic complexity.

Before:

```<code>public static int calculateDepth(BinaryTreeNode<Integer> t, int n) {
    int depth = 0;
    if (t.getValue() == n) {
        return depth;
    } else {
        if (n < t.getValue()) {
            BinaryTreeNode<Integer> left = t.getLeft();
            if (left == null) {
                throw new TreeException("Value not found in tree!");
            } else {
                return 1 + calculateDepth(left, n);
            }
        } else {
             BinaryTreeNode<Integer> right = t.getRight();
             if (right == null) {
                throw new TreeException("Value not found in tree!");
             } else {
                return 1 + calculateDepth(right, n);
             }
        }
    }
}
</code>```

After:

```<code>public static int calculateDepth(BinaryTreeNode<Integer> t, int n) {
     int depth = 0;
     if (t.getValue() == n)
        return depth;
     else
        return traverseByValue(t, n);
}
private static int traverseByValue(BinaryTreeNode<Integer> t, int n) {
     BinaryTreeNode<Integer> childNode = getChildNode(t, n);
     if (childNode == null) {
        throw new TreeException("Value not found in tree!");
     } else {
        return 1 + calculateDepth(childNode, n);
     }
}
private static BinaryTreeNode<Integer> getChildNode(
     BinaryTreeNode<Integer> t, int n) {
     if (n < t.getValue()) {
        return t.getLeft();
     } else {
        return t.getRight();
     }
}
</code>```

In their justification they state (emphasis mine):

Argument:

“Replacing one method with McCabe 15 by three methods with McCabe 5
  each means that overall McCabe is still 15 (and therefore, there are
  15 control ow branches overall). So nothing is gained.”

Counter Argument:

Of course, you will not decrease the overall McCabe complexity of a system by
  refactoring a method into several new methods. But from a
  maintainability perspective, there is an advantage to doing so: it
  will become easier to test and understand the code that was written.
  So, as we already mentioned, newly written unit tests allow you to
  more easily identify the root cause of your failing tests.

Question: How does it become easier to test?

According to the answers to this question, this question, this question, this question and this blog we should not be testing private methods directly. Which means we need to test them via the public methods that use them. So going back to the example in the book, if we are testing the private methods via the public method, then how does the unit tests functionality improve, or change at all for that matter?

答:
I can see 2 possibilities :

The author is referring to private method names being included in the stack trace when a unit test fails unexpectedly.

Hence

as we already mentioned, newly written unit tests allow you to more easily identify the
  root cause of your failing tests.

What still puzzles me is newly written unit tests. What does he mean, and what is it that he already mentioned ?

The author got carried away by how marvelous refactoring to private methods is and forgot that they're extremely difficult to test in isolation.

I suspect the latter. The other benefit he mentions (better understandability) remains valid though.


问:
Looking for an example of using code with Apache License Version 2.0
I know there are a lot of Q/As in legalese or plain English. I am wondering if anyone could provide a real life example of the text that needs to be included with the distribution of software using code with Apache License Version 2.0.

For example, if an app uses Apache Commons Math, a Java library with Apache License Version 2.0, what is the text regarding this license needed to be included in its distribution?

答:
The boilerplate notice for the Apache License is:

Copyright [yyyy] [name of copyright owner]

Licensed under the Apache License, Version 2.0 (the "License"); you
  may not use this file except in compliance with the License. You may
  obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
  implied. See the License for the specific language governing
  permissions and limitations under the License.

There is also the complete Apache License v2 available in HTML and TXT formats.

If you are distributing a source code for a project, you should place the complete license in a text file called LICENSE at the root of the project. If you need a NOTICE file (projects run by the Apache Software Foundation require one), it goes at the same level.

If you are distributing a binary for a project and are providing a JAR or a tarball, then the LICENSE (and NOTICE) files must be at the top level. That is, when you uncompress the file, you should see a LICENSE (and NOTICE) file in the target.

If you are distribute a single file (such as a Gist on GitHub), then you are probably OK with putting the boilerplate notice at the top of the file.

If you are using Apache License v2 licensed software in your project, you need to include the LICENSE and NOTICE files for that library. The way I usually do this is that I have a lib directory in the root of my project. I would extract the library distribution into a subdirectory of the lib directory. Assuming that the author packaged their application properly, it will contain the appropriate license files.


问:
API design dilemma: to REST or not to REST
I'd like to design a REST API supporting:

Login

Temporary token generation

The reason being there are a number of client-side REST libraries that would speed up development if used, as they take care of serialization, connection, etc. If not used, we would have to code these parts separately. I don't need REST for performance, there will be no load balancing or caching involved in the server side.

Login and token generation are quite common. And yet I'm having a hard time trying to figure how to do them in REST. For instance:

Login

I've read a lot about login in REST, and apparently there's no right answer here. In the end many people end up using OAuth just because it is mainstream. Actually I just need to check if the user exists and the password is correct. Any other operation in the API will be passed the user name and password for authorization purposes, so for now we are still in the stateless side.

The problem here is that I've envisioned login as a query against the users collection:

```<code>GET https://api.example.com/users?usr=username&psw=1234
</code>```

The server will respond with a filtered list of a single user.

But I don't like passing the password in the query string. It does not look OK to me. The connection will be made using HTTPS, but there's an additional step of having to URL-encode all odd characters, and decode them in the server, which we wont have in a POST. And also URLs are more frequently logged than payloads.

I could also get the password in the server response:

```<code>GET https://api.example.com/users?usr=username
</code>```

The returned JSON object would contain all the fields for the user (id, password, etc), so I could check the password in the client.

Which one is better? Any alternative?

Token generation

A registered user is able to generate temporary tokens. I'm struggling trying to force tokens into being a resource. They are generated on the fly, and the operation is not idempotent, as each subsequent token request will return a different token. To make things worse, this operation is stateful: there will be a temporary table in the backend where tokens will be stored for a period of time. So what would be the REST version? It could be a PUT if the client were the one generating it, but it is the server.

TL;DR
This is so difficult. If I succeed in creating a REST version of this API, the client code will be shorter and clearer, as we will be using well-known libraries that have been extensively tested. But honestly it looks almost impossible to force the stateful into stateless. Maybe I should just give up and provide a straightforward stateful API? How could I explain the extra time it would take to management? They will probably argue that nowadays everything is REST.

答:
For passwords, sending a hash copy of the password would seem to be your best alternative.  Notice that this avoids two of the problems you are considering: the hash of the password disguises the "secret" that you are transmitting, and the result of the hash can be expressed in a reasonable character set so that you don't have to worry about encode/decode.  (Note: we haven't actually added any security by doing this).

I'm suspicious about using the url to communicate the credentials -- why not use the Authorization header?  You wrote:

Any other operation in the API will be passed the user name and password for authorization purposes

Were you expecting to embed the credentials in every api call?

the operation is not idempotent

Then the operation is a POST.  The most common answer that I've seen is to expose a "token collection" resource, and add a new token by posting the request to that resource.  Principle of least surprise should maybe lean you this direction.

But you might re-examine your assumption that the operation isn't idempotent.  Clearly, you don't want to have multiple tokens in your table -- but if the database rejects the command to inject a duplicate token, you've got the idempotent behavior that you need.  You'll want to be consistent with HTTP put semantics, which means that you'll want the resource you are PUTting to be unique to the token.

Note that the token resource and the token entity are two different things.  You can "create" the resource first, and then (if the client application follows that link) create the token.  REST doesn't care - as long as the client is following links provided in the hypermedia, everything is good.

I'm struggling trying to force tokens into being a resource.

It shouldn't be too difficult, resources are cheap.

For instance, if your token is an analog of an HTTP cookie (one of the parts of the web that Fielding calls out as not being restful), then a flow of requests from the client might look like

```<code>POST /A
-- the server does its magic here, generating and storing a new token, which
-- it wants the client to reference in its subsequent requests
redirect: /B?token=54321

GET /B?token=54321
-- Now the server knows that this is a request for resource /B within the
-- context of the specific token.  The representation of this resource
-- includes links to things that are also in the context of the token
returns: [representation including link /C?token=54321]

GET /C?token=54321
-- Subsequent calls stay in token=54321 space, until the server expires the
-- token and redirects the caller to some other representation of state.
</code>```

Another alternative would be to separate out the reservation of the token identifier from the creation of the token

```<code>GET /A
-- here, the server generates a unique identifier for the token, without
-- doing any of the persistence work.
redirect: /B?token=54321

POST /B?token=54321
-- The client passes back to the server the id of the token, and the server
-- can choose to go create it and store it.
-- Notice: we aren't posting to the token resource, we are posting to
-- the resource identified by /B?token=12345; you get to decide what
-- that resource is.  If the representations are suitable, and you can make
-- the operation idempotent now that the token identifier is fixed, you
-- might be able to use PUT rather than POST
returns: [representation including link /C?token=54321]

GET /C?token=54321
-- Subsequent calls stay in token=54321 space, until the server expires the
-- token and redirects the caller to some other representation of state.
</code>```

If you wanted to be extra careful, you might implement resources that distinguish a reserved token from a persisted token.

```<code>GET /A
-- here, the server generates a unique identifier for the token, without
-- doing any of the persistence work.  We're not making any changes to
-- the server state right now, so this is a reserved token.
redirect: /A?reservedToken=54321

GET /A?reservedToken=54321
-- this resource knows the token identifier, so it can now produce the
-- hypermedia control(s) that constrain the client to the reservedToken=54321 space.
-- We still haven't changed anything; this GET request is safe.
-- It's also potentially cacheable.
returns: [representation including link /B?reservedToken=54321]

POST /B?reservedToken=54321
-- The client passes back to the server the id of the token, and the server
-- can choose to go create it and store it.
-- Notice: we aren't posting to the token resource, we are posting to
-- the resource identified by /B?reservedToken=12345; you get to decide what
-- that resource is.  If the representations are suitable, and you can make
-- the operation idempotent now that the token identifier is fixed, you
-- might be able to use PUT rather than POST.
redirect: /B?persistedToken=54321

GET /B?persistedToken=54321
-- Now this resource knows that the token has already been reserved, and
-- can generate additional hypermedia controls that constrain the
-- client to the persistedToken=54321 space.  Once again, this GET
-- request is safe and cacheable.
returns: [representation including link /C?persistedToken=54321]

GET /C?persistedToken=54321
-- Subsequent calls stay in persistedToken=54321 space, until the server expires the
-- token and redirects the caller to some other representation of state.
</code>```

The client is just choosing from the hypermedia controls provided by the server.  So while this history would look like

```<code>GET /A
GET /A?reservedToken=54321
POST /B?reservedToken=54321
GET /B?persistedToken=54321
GET /C?persistedToken=54321
</code>```

You can later decide that if these resource identifiers don't comply with your coding standards, or that they are to difficult to follow, or simply that you are bored with them, then you can change them all

```<code>GET /A
GET /W?reservedToken=54321
POST /X?reservedToken=54321
GET /Y?persistedToken=54321
GET /Z?persistedToken=54321
</code>```

Body:
For passwords, sending a hash copy of the password would seem to be your best alternative.  Notice that this avoids two of the problems you are considering: the hash of the password disguises the "secret" that you are transmitting, and the result of the hash can be expressed in a reasonable character set so that you don't have to worry about encode/decode.  (Note: we haven't actually added any security by doing this).

I'm suspicious about using the url to communicate the credentials -- why not use the Authorization header?  You wrote:

Any other operation in the API will be passed the user name and password for authorization purposes

Were you expecting to embed the credentials in every api call?

the operation is not idempotent

Then the operation is a POST.  The most common answer that I've seen is to expose a "token collection" resource, and add a new token by posting the request to that resource.  Principle of least surprise should maybe lean you this direction.

But you might re-examine your assumption that the operation isn't idempotent.  Clearly, you don't want to have multiple tokens in your table -- but if the database rejects the command to inject a duplicate token, you've got the idempotent behavior that you need.  You'll want to be consistent with HTTP put semantics, which means that you'll want the resource you are PUTting to be unique to the token.

Note that the token resource and the token entity are two different things.  You can "create" the resource first, and then (if the client application follows that link) create the token.  REST doesn't care - as long as the client is following links provided in the hypermedia, everything is good.

I'm struggling trying to force tokens into being a resource.

It shouldn't be too difficult, resources are cheap.

For instance, if your token is an analog of an HTTP cookie (one of the parts of the web that Fielding calls out as not being restful), then a flow of requests from the client might look like

POST /A
-- the server does its magic here, generating and storing a new token, which
-- it wants the client to reference in its subsequent requests
redirect: /B?token=54321

GET /B?token=54321
-- Now the server knows that this is a request for resource /B within the
-- context of the specific token.  The representation of this resource
-- includes links to things that are also in the context of the token
returns: [representation including link /C?token=54321]

GET /C?token=54321
-- Subsequent calls stay in token=54321 space, until the server expires the
-- token and redirects the caller to some other representation of state.

Another alternative would be to separate out the reservation of the token identifier from the creation of the token

GET /A
-- here, the server generates a unique identifier for the token, without
-- doing any of the persistence work.
redirect: /B?token=54321

POST /B?token=54321
-- The client passes back to the server the id of the token, and the server
-- can choose to go create it and store it.
-- Notice: we aren't posting to the token resource, we are posting to
-- the resource identified by /B?token=12345; you get to decide what
-- that resource is.  If the representations are suitable, and you can make
-- the operation idempotent now that the token identifier is fixed, you
-- might be able to use PUT rather than POST
returns: [representation including link /C?token=54321]

GET /C?token=54321
-- Subsequent calls stay in token=54321 space, until the server expires the
-- token and redirects the caller to some other representation of state.

If you wanted to be extra careful, you might implement resources that distinguish a reserved token from a persisted token.

GET /A
-- here, the server generates a unique identifier for the token, without
-- doing any of the persistence work.  We're not making any changes to
-- the server state right now, so this is a reserved token.
redirect: /A?reservedToken=54321

GET /A?reservedToken=54321
-- this resource knows the token identifier, so it can now produce the
-- hypermedia control(s) that constrain the client to the reservedToken=54321 space.
-- We still haven't changed anything; this GET request is safe.
-- It's also potentially cacheable.
returns: [representation including link /B?reservedToken=54321]

POST /B?reservedToken=54321
-- The client passes back to the server the id of the token, and the server
-- can choose to go create it and store it.
-- Notice: we aren't posting to the token resource, we are posting to
-- the resource identified by /B?reservedToken=12345; you get to decide what
-- that resource is.  If the representations are suitable, and you can make
-- the operation idempotent now that the token identifier is fixed, you
-- might be able to use PUT rather than POST.
redirect: /B?persistedToken=54321

GET /B?persistedToken=54321
-- Now this resource knows that the token has already been reserved, and
-- can generate additional hypermedia controls that constrain the
-- client to the persistedToken=54321 space.  Once again, this GET
-- request is safe and cacheable.
returns: [representation including link /C?persistedToken=54321]

GET /C?persistedToken=54321
-- Subsequent calls stay in persistedToken=54321 space, until the server expires the
-- token and redirects the caller to some other representation of state.

The client is just choosing from the hypermedia controls provided by the server.  So while this history would look like

GET /A
GET /A?reservedToken=54321
POST /B?reservedToken=54321
GET /B?persistedToken=54321
GET /C?persistedToken=54321

You can later decide that if these resource identifiers don't comply with your coding standards, or that they are to difficult to follow, or simply that you are bored with them, then you can change them all

GET /A
GET /W?reservedToken=54321
POST /X?reservedToken=54321
GET /Y?persistedToken=54321
GET /Z?persistedToken=54321


问:
How should I handle a HTTP response whose body takes time to generate, and whose headers cannot be determined until generation is complete?

Background

My web application lives on a centralised server in the product's "network", and provides the means to manage/configure various distributed devices. The server also logs various statistics that arrive from each device, storing them on disk in /var/log/. The web GUI allows users to download those logs.

It also has a facility to download them in various different formats, which requires an on-the-fly translation/conversion. This conversion takes some time (say on the order of thirty seconds) and results in files of size in the 300MB region.

All of this is fine and a user can accept that downloading such a converted file is going to take some time. But I've architected myself into a bit of a corner in terms of how effectively I can actually deliver these files.

For the purposes of this question, I shall not be exploring AJAX/JavaScript/Java/Flash/multi-step/multi-page solutions. Assume that, from the user agent's perspective, the download shall be a straightforward HTTP GET request to a CGI script from clicking on an  element, and nothing more.

Problem

My web application is loosely MVC-architected in such a way that the controller chosen to satisfy the requested action (say, in this case: controller "devices" action "getConvertedLog") performs its business logic and sets various flags that describe how the HTTP response should be composed. Only after the controller has finished its work will the HTTP response be composed, with response headers generated and the body streamed from, in this case, a temporary file on disk.

The first problem with this is that the controller itself performs (or, at least, invokes) the file conversion, takes some time to perform. The HTTP headers are consequently not generated (let alone transferred) for thirty seconds or so. Not only does this result in thirty seconds of literally nothing happening in the browser (at least from my experience in Chrome) but it also puts the entire request at high risk of a HTTP 504 Gateway Timeout error from intervening routers.

I could shuffle my code around a little so that some HTTP response headers can be transferred to the browser before the conversion begins, to at least give an indication that something is happening (and, hopefully, stave off the Gateway Timeout). But before the conversion completes I have no way of knowing how many bytes will comprise the result. Therefore, I cannot send a meaningful Content-Length header, so the user-agent cannot display progress to the user. And for a 300MB file I do not consider this to be acceptable.

The second problem with this is that, if there is an error during conversion, the HTTP response code should be meaningful. So I cannot have sent a Status in these hypothetical pre-conversion headers.

Question

What would you do here? What's the least I need to do indicate to user-agents and proxies that the request has been accepted and a response is coming (albeit slowly), before the success or failure and size of the response has been determined?

I guess it would be ideal if it were legal and functional to send a very small set of headers, say:

```<code> Status: 200 OK
 Content-Type: application/zip
 Content-Disposition: attachment; filename="thefile.zip"
</code>```

… then follow it up with the remaining headers (Set-Cookie, Cache-Control, Content-Length and so forth), some potentially replacing earlier ones (like a change in Status) and, finally, the response body.

I'm hoping the fact that Apache's CGI module translates and re-orders some headers (e.g. Status: 200 ends up in the first line of the response as HTTP/1.1 200 OK) can help here. How might HTTP 102 Processing help here?

(Update: "At least one CGI-Header must be supplied, but no CGI header can be repeated with the same field-name." [CGI 1.1, §9.2]. Rats.)

答:
This is a common problem.  The first example that springs to mind is in credit card authentication.

As has been mentioned, you need to conceptually fork the process, so that one thing responds to the client and another does the actual work.

This is actually quite straight forward, because HTTP is a state free protocol, you can have a page render, and complete the client transaction, whilst actually carrying on functioning on the server (as long as the service on the server allows you too, PHP will normally time you out if you take too long).

So here's a plan.  When you get your request, create your temporary file, with a name like /tmp/.part and redirect the client to a different page, which I'll come to shortly.  Either send the  as a parameter within the redirect link, or as a cookie.  Then conclude your connection with the client and process the file, storing data in /tmp/.part as you go.  Once you're done, rename /tmp/.part to /tmp/

On the different page, given  parameter (either from cookie or parameter), and check for the existence of /tmp/ or /tmp/.part  If the .part file exists, it's still processing, either generate a html file with a meta tag telling the user to reload in a few seconds, or sleep for a few seconds and give the client a redirect with the same form as the original caller.

If /tmp/ exists, you're done.  Present the user with the file for download.

You might also want to add some garbage collections somewhere to check if there are .part files that haven't changed for >1 hour, or actual files that are more than 2 or 3 hours old, and delete them.

If you have a server that is timing you out, then you have 2 options, via restart during refresh, or via cron.

If you opt for restart, code the .part file with enough information to pick up the process mid way through and have the refresh stage check for a running process and if it doesn't find one, restart the process
If you opt to go through cron, you're ultimately changing the above to a job management system, where instead of the cgi-bin initiating the work, you have it create the request, and have cron periodically checking for requests (the existence of a .part file) and where it finds one, it executes it.

Regarding error handling, this could feed into your ability to restart a process.  If the .part contains some status indicator, to tell the reload screen where it's at, you could pass error conditions back to the user.  If the executing script encounters a problem, it updates .part.  When the client next reloads the page with  as it's context, it looks at the .part file and returns back the status.

It's worth bearing in mind, you have to balance the complication of putting into .part more than simply the incomplete version of what will be  vs creating a 3rd file such as .status which the reload script might use.

OwnerDisplayName: Lightness Races in Orbit


问:
More than one deployable git branch
My dilemma is about the GIT flow.

Let's assume that I have an application that can be deployed differently (staging release, QA release, production release).

Since the application has profiles to be executed as staging version or as production version (it doesn't depend on which branch the executable is) with the same binary, I think it's really useless to create three different deployable branches, but some colleagues think that it is correct because we need to clarify the binary purpose.

What for me is wrong is that once you checked out the staging branch, you have to force the deploy as staging (it is still possible to select the production version). This problem isn't possible to avoid, so I think that the three deployable branches aren't useful

This is the state they are thinking about:

branch master : binary + all profiles

branch staging : same master sources

branch qa : same master sources

They just want to keep the ideas ordered (I don't think so)

Are both right?

答:
You deploy the branch you need to where you need to.

Now, obviously you aren't going to deploy a feature branch to production. But deploying the latest build from Master to development shouldn't be a problem.

The development branch in git-flow is about being the mainline - that from which the normal process has you branching off of and merging too. The only exception to this process is that of the hotfix branch where you need to grab the current from production.

Lets look at that hotfix a bit more and consider what the deployment process would be when you have three locations.  You probably would deploy the fresh hot fix to dev, make some commits on that branch, and then deploy that to QA and then to prod.

For a normal release process with git-flow you are likely to be having builds off of the development server on development branch.  Once you branch for release, you will likely have the head of the branch be going to the development server (so the devs working on the release effort can see what the current state is), and specific tagged branches going to QA.  Once QA oks one of the tagged builds, the release branch at that tag gets merged into master and then master is tagged and deployed to production.

You will probably want to have multiple environments for dev.  The head of release is one deployment environment, head of development is another deployment environment, and maybe even a head of feature being another one or five.

You should be able to build any branch for any deployment environment profile. Deploying the current production to the dev server should be doable.

Git-flow itself is orthogonal to where you deploy things. It is about making sure that the different branches have a limited and defined set of roles that they take. By limiting the roles it makes it easier to reason about what each branch is doing and what its state is at any given time.

The only thing that git-flow tries to say about where specific things are deployed is that the head of master is production.  Anything else about what you deploy where in your environment is a site specific issue.  Git-flow works just as well with only one production and devs doing all other deployments to their local servers as it does for having production, staging, qa, dev, and dozens of feature servers.

The steps for doing a deployment to any specific server are completely up to the local workflow for that server.

Title: More than one deployable git branch


问:
What does 'upper bound' mean in context of BigO?
My computer science teacher says Big O has an upper bound but no lower bound. When I look at a graph of an algorithm mapped out using BigO though, there isn't an upper bound at all. The upper limit goes on forever. So what do it mean to say there is an upper bound in the context of BigO?</p>

答:
The worst case gives us an upper bound on performance. Analyzing an algorithm’s worst case guarantees that it will never perform worse than what we
determine.</p>


问:
Where is the class itself stored at runtime to be used as a reference
In C# or Java we find that the objects are stored on heap and their reference vars are stored on stack. But at run time where is the class definition stored to be used as a template for creating objects?</p>

答: Class definitions are stored in a separate area (neither stack nor heap) called the method area. In .net the corresponding area is called the Loader Heap. Data in the method area is written by the class loader, and it is never garbage collected and cannot be deleted.


问:
I released my project under GPL. Can I still use it in my commercial app?
So I have this super sweet library I'm working on. Let's say I release it into the wild under GPL. In tandem I'm working on a commercial piece of software, and I'd like to use this library in it.

Since I made the library in the first place (even though I made it GPL), is it safe to assume I can use it in the commerical app?

Now that it's released as GPL, lets say some people make some awesome updates to it. Their work is also under GPL. Therefore I cannot include their changes in my commercial app, unless I wanted to make my commerical app GPL as well (which I don't). In that scenario, the safest thing to do would be to use my library as it was originally released when it was 100% my own code.

Is the above correct? If so, would releasing my library under LGPL be a better idea so I can re-incorporate changes to it into my commercial app since I'll just be linking to the DLL?

Edit after Thomas' answer:

To add a bit about the dual licensing option, it does open up the world of being able to commercially sell my library. On the other hand, I really want to bring in other developers to improve it (if they want), which kind mucks up the commercial licensing aspect. What is more important? For me, I'd rather have a better library than make a couple bucks off of it (it's not THAT impressive), so Thomas' point about going with LGPL is perfect. That allows me to both solicit assistance, and to take advantage of other contributors I can simply link to the DLL inside of having the original code baked into my solution file. The important bit is that I can use this improved code in my main commercial app and I won't worry about commercializing a subset of it (this library).

答:
Yes, you can release the portions that you own (in this case, the library before modifications were made by other contributors) under one or more other licenses. Those other licenses could be anything that you want, from other open source licenses to specific licenses to other people or organizations.

If you are producing a library that is meant to be linked to, then releasing it under the LGPL would probably be better. It would ensure that modifications to your library remain open and free, while letting people link to the library in closed-source applications.

It's easiest to make licensing decisions before you release the software to the public, and definitely before other people have contributed. Once other people contribute, you can't simply change the license on someone else's work.


答:
A class is not a monolithic template. It is an abstract concept.  It has methods, which are executable code. That code will be in the "code segment". The template you refer to would be a structure that contains initial values for data members and possibly a virtual method table. Those would be in the "data segment". That is, once everything is native code loaded into memory, ready to be executed. Before that (while it is IL or Java byte code), it is all data loaded into allocated memory. So that would be on the heap.

"Method area" as mentioned in a different answer is a Common Language Infrastructure level answer. That is software. Heap and stack are CPU level concepts, as are code segment and data segment.

Title: Where is the class itself stored at runtime to be used as a reference

Body: In C# or Java we find that the objects are stored on heap and their reference vars are stored on stack. But at run time where is the class definition stored to be used as a template for creating objects?</p>


问:
Software design: recommend approach to avoid slicing/type erasure here
Here is a concrete minimal example to formulate my question :

In small ball game, you have a physics engine that moves the objects regularly:

```<code>void move(set< PhysicalObject* > objets, Duration t)
</code>```

And that engine can use user defined behaviour when a collision happens (using a strategy class). For instance, default strategy is to update objects directions, but you can provide it with a custom strategy class that kills objects according to some specific rules.

```<code>void update_after_collision(DerivedObject* a, DerivedObject* b)
</code>```

In order to implement new behaviour during a collision, I have some specific derived classes (they have additional attributes/methods corresponding to their lifetime, etc.)

The problem is: the engine calls the update_after_collision strategy, hence I can't use my derived class is this strategy without using a visitor pattern or a type cast. Note that the engine only knows about the base class, not the derived ones.

Is there a way to avoid it? What is the standard approach to look at?

Is another programming paradigm better for this particular case?

EDIT : Code is written in C++

答:
What you have here is a typical use-case of runtime multiple-dispatch, and depending on the actual object-oriented language you intend to use, this is either built-in or requires some work.
I am sorry this answer cannot be more precise, but this depends largely on the actual programming language.

Assuming a Java-esque language, you could quickly devise a custom dispatch method: a simple organisation of "classes" in an enumerated type can be enough at first and quite easy to modify. Each object holds a type tag indicating which types it belongs to.

Your collision method can hold a square matrix of specialized callbacks for each combination of types. In pseudo-code:

```<code>collisions[from.tag][to.tag]
</code>```

... refers to the method you need to call with the given from and to objects.
You can extend your set of tags, but this requires a recompilation phase. But binding tags to effective methods can be done at runtime while debugging, if you want.

If you want to introduce inheritance, this becomes a little more involved: imagine there is no specific method for a tag T (an empty cell in the collisions matrix), you should fall back to its parent type P(T) (assuming single-inheritance). For that you could have a parent member inside each of your enum value.

For C++, have a look at Open Multi-Methods for C++ from Stroustrup et al.

Body:
What you have here is a typical use-case of runtime multiple-dispatch, and depending on the actual object-oriented language you intend to use, this is either built-in or requires some work.
I am sorry this answer cannot be more precise, but this depends largely on the actual programming language.

Assuming a Java-esque language, you could quickly devise a custom dispatch method: a simple organisation of "classes" in an enumerated type can be enough at first and quite easy to modify. Each object holds a type tag indicating which types it belongs to.

Your collision method can hold a square matrix of specialized callbacks for each combination of types. In pseudo-code:

collisions[from.tag][to.tag]

... refers to the method you need to call with the given from and to objects.
You can extend your set of tags, but this requires a recompilation phase. But binding tags to effective methods can be done at runtime while debugging, if you want.

If you want to introduce inheritance, this becomes a little more involved: imagine there is no specific method for a tag T (an empty cell in the collisions matrix), you should fall back to its parent type P(T) (assuming single-inheritance). For that you could have a parent member inside each of your enum value.

For C++, have a look at Open Multi-Methods for C++ from Stroustrup et al.


问:
Draw a Call Graph
I'm maintaining an old code base written in python. In particular there is a complex piece of code that from a module calls other functions from other modules that call other functions and so on. It is not OOP, just functions and modules.

I've tried to keep track where the flow begins and ends anytime I call the main function but I feel I need to draw this because I'm getting lost in the sub-calls.

What concerns me is that each function calls multiple external functions within their body to complete their task and return the value to the caller.

How can I draw this? Meaning what kind of chart/graphic would be appropriate to document this kind of behavior/code?

So, I don't think would be useful to draw an UML diagram, neither a flowchart.
A call graph, maybe?

答:
I think what you're looking for here is a Sequence Diagram. These allow you to visualize the order in which various modules call eachother via the use of arrows.

Constructing one is simple:

Draw your starting class with a dotted line below it.

Draw the next class/method in the call trace with a dotted line below that

Connect the lines with an arrow, vertically positioned below the last arrow you drew

Repeat steps 2-3 for all calls in your trace

Example

Let's assume we have the following code we want to create a sequence diagram for:

```<code>def long_division(quotient, divisor):
    solution = ""
    remainder = quotient
    working = ""
    while len(remainder) > 0:
        working += remainder[0]
        remainder = remainder[1:]
        multiplier = find_largest_fit(working, divisor)
        solution += multiplier
        working = calculate_remainder(working, multiplier, divisor)
    print solution

def calculate_remainder(working, multiplier, divisor):
    cur_len = len(working)
    int_rem = int(working) - (int(multiplier) * int (divisor))
    return "%*d" % (cur_len, int_rem)

def find_largest_fit(quotient, divisor):
    if int(divisor) == 0:
        return "0"
    i = 0
    while i <= 10:
        if (int(divisor) * i) > int(quotient):
            return str(i - 1)
        else:
            i += 1

if __name__ == "__main__":
    long_division("645", "5")
</code>```

The first thing we'll draw is the entry point (main) connecting to the method long_division. Note that this creates a box in long_division, signifying the scope of the method call. For this simple example, the box will be the entire height of our sequence diagram due to the fact that this is the only thing run.

Now we call find_largest_fit to find the largest multiple that fits within our working number, and returns it to us. We draw a line from long_division to find_largest_fit with another box to signify scope for the function call. Note how the box ends when the multiplier is returned; this is the end of that functions scope!

Repeat a few times for a larger number and your chart should look something like this:

Notes

You can choose whether you want to label the calls with the variable names passed, or their values if you only want to document one specific case. You can also show recursion with a function calling itself.

Additionally, you can show users in here and prompt them and show their input into the system easily enough. It's a fairly flexible system that I think you'll find rather useful!

Title: Draw a Call Graph

Body:
I think what you're looking for here is a Sequence Diagram. These allow you to visualize the order in which various modules call eachother via the use of arrows.

Constructing one is simple:

Draw your starting class with a dotted line below it.

Draw the next class/method in the call trace with a dotted line below that

Connect the lines with an arrow, vertically positioned below the last arrow you drew

Repeat steps 2-3 for all calls in your trace

Example

Let's assume we have the following code we want to create a sequence diagram for:

def long_division(quotient, divisor):
    solution = ""
    remainder = quotient
    working = ""
    while len(remainder) > 0:
        working += remainder[0]
        remainder = remainder[1:]
        multiplier = find_largest_fit(working, divisor)
        solution += multiplier
        working = calculate_remainder(working, multiplier, divisor)
    print solution

def calculate_remainder(working, multiplier, divisor):
    cur_len = len(working)
    int_rem = int(working) - (int(multiplier) * int (divisor))
    return "%*d" % (cur_len, int_rem)

def find_largest_fit(quotient, divisor):
    if int(divisor) == 0:
        return "0"
    i = 0
    while i <= 10:
        if (int(divisor) * i) > int(quotient):
            return str(i - 1)
        else:
            i += 1

if __name__ == "__main__":
    long_division("645", "5")

The first thing we'll draw is the entry point (main) connecting to the method long_division. Note that this creates a box in long_division, signifying the scope of the method call. For this simple example, the box will be the entire height of our sequence diagram due to the fact that this is the only thing run.

Now we call find_largest_fit to find the largest multiple that fits within our working number, and returns it to us. We draw a line from long_division to find_largest_fit with another box to signify scope for the function call. Note how the box ends when the multiplier is returned; this is the end of that functions scope!

Repeat a few times for a larger number and your chart should look something like this:

Notes

You can choose whether you want to label the calls with the variable names passed, or their values if you only want to document one specific case. You can also show recursion with a function calling itself.

Additionally, you can show users in here and prompt them and show their input into the system easily enough. It's a fairly flexible system that I think you'll find rather useful!


问:
A JavaScript IIFE prevents leaks to the global space as a closure? Is that the correct concept?
I see in the code or sometimes people talk about it, for some JavaScript code:

```<code>(function() {
    var something;

    function someFunction() {
        // some code here
    }

    // do something

}());
</code>```

That's an "Immediately Invoked Function Expression", or IIFE.  I often hear people say, "yeah, do it in a closure", or "do this in a closure" in the code comment -- as if a closure is "protecting the leak to the global space."

But is that the correct concept?  I think it is a local scope, or an anonymous local scope, that is shield any local variables from leaking to the global scope.  It really has nothing to do with a closure, which is a function with a scope chain.  Sure, the anonymous function used for the IIFE is a closure, but it is not relevant here.  If you say you want a closure, it is because you want the access to the current scope (and all scopes in scope chain).  To say, shielding local variable to the global scope "by using a closure", is not a correct concept, is it?

Update: In any language that doesn't have closure, such as C, you can still do the exact same thing of shielding any local variables to leak into the global space.  So it is not "closure" that is doing the job.

答:
I think it is a local scope, or an anonymous local scope, that is shield any local variables from leaking to the global scope.

Yes, that's precisely what it is. And because JavaScript doesn't actually have block scopes, the only way you can implement it is with functions. Hence, IIFEs.

To say that you are using a closure here is true, because the function expression creates a closure. Without that, your "local scope" would have no access to any other variables in the scope in which it is found. However, this is again something of an implementation detail — it's not core to the problem at the design level.


问:
Is increasing codebase size and complexity worth it to make fully configurable?
I'm re-creating a web app (Google Apps Script) that i made a couple months ago, and decided that I wanted to make it fully configurable this time around. So that I don't have to go in any change any code or settings to adapt to new changes in the data it manipulates, queries, and displays. I've also worked to make some optimizations that have increased the responsiveness of the app by nearly an order of magnitude (From 2-10 seconds down to 1 second or less) through caching.

I'm almost complete, and after taking a step back I've noticed my codebase is nearly 3x the size and feels much more complex than it did earlier. I no longer hard code any values or settings, I can swap, add, or remove columns from spreadsheets or databases without breaking the programs behavior.

However, I am not sure if it's "worth" it. I may not have to go in and make changes to avoid breakage, but if I need to jump in a few months from now I doubt I'll understand how my code works right off the bat.

答:
It sounds like you're weighing the cost of code that's a little more difficult to understand than the original code against the benefit of being able to "swap, add, or remove columns from spreadsheets or databases without breaking the programs behavior", as well as optimizations that speed things up by (up to) a factor of 10 (and maybe more?). Only you can truly answer if it was worth it, but if the improved performance and functionality is something you enjoy more than easy-to-read code (but time consuming to maintain), then it was worth it.

And if you're worried that your fancier code base is harder to understand, then you really want to start documenting it NOW, before you forget how it works.


答:
There is no hard-and-fast rule. But this question should always be considered carefully when thinking of redesigning a system.

In general, it is very bad practice to hard-code any settings into your program. Configuration settings and large external values should always come from files. This separation of data and code (or logic) should, for any reasonably sized application, make your code more readable and manageable.

Generally, this should be a goal from the start. If you find yourself, as in this case, with a messy code-base with hard-coded values strewn around, then you need to carefully consider if refactoring it the "correct" way is worth the cost. Refactoring an existing application is both time-consuming and provides no immediate benefit to end-users (or your employer).

While it may feel bad to have ugly code like this around, in a real-life situation, you often do not have the luxury to polish code to the degree you'd personally be comfortable with. Only once the maintainability of the code becomes a hindrance to further development efforts is a refactor often worth it.

In this case, it is your app, so you are in complete control. Besides, you have already put in the work for the rewrite, so congratulations! However, your code should not be more complex than it was before:

I've noticed my codebase is nearly 3x the size and feels much more complex than it did earlier.

The size increase is expected, but what you mean by "complex" is important there. Do you find the code harder to reason about and navigate? If so, this is a big red-flag, as you wrote all of the code yourself! Imagine if you came in as a new developer to a company and were expected to start working on this codebase. Do you think you'd find it easy or difficult?

On the other hand, if by "complex" you just mean that there's more logic going on, but you still understand it well, then that's less of a worry. If you add more functionality to an application, there's going to be more moving parts. But the overall quality of code throughout the application should remain roughly the same.

Title: Is increasing codebase size and complexity worth it to make fully configurable?

Body:
I'm re-creating a web app (Google Apps Script) that i made a couple months ago, and decided that I wanted to make it fully configurable this time around. So that I don't have to go in any change any code or settings to adapt to new changes in the data it manipulates, queries, and displays. I've also worked to make some optimizations that have increased the responsiveness of the app by nearly an order of magnitude (From 2-10 seconds down to 1 second or less) through caching.

I'm almost complete, and after taking a step back I've noticed my codebase is nearly 3x the size and feels much more complex than it did earlier. I no longer hard code any values or settings, I can swap, add, or remove columns from spreadsheets or databases without breaking the programs behavior.

However, I am not sure if it's "worth" it. I may not have to go in and make changes to avoid breakage, but if I need to jump in a few months from now I doubt I'll understand how my code works right off the bat.


答:
Did you make the changes based on any specific end user requirements?

If yes, it is worthy to users to have that change.

If no, did you consider "fully configurable behavior" is really desirable for any foreseeable future requirements that you will definitely implement?

If yes, it "maybe" worthy for future changes. I said "maybe" because    you can only say whether it is worthy by then, considering the added    complexity.

If no, did you enjoy or learn something new while implementing the changes?

If yes, only you can tell if it is worthy or not.

If no, it may worth some reputation points on stackexchange :)


问:
Recommend an approach to decouple Product and Access code constructs, in order to simplify Product testing
I have some code that tightly couples Product specific code and Product-Access code.  I am not sure how to untangle it.  So for example, for testing Product, I have to mock up Access objects.  And maybe there is no way around it, but maybe there is.  I have code that goes something like this:

```<code>class Product
{
    function __construct() {
        global $user;   //current logged in user object
        $id = $user->getId(); //used to make calls to DB
        $this->access = $db->query("SELECT access ... where id=$id");
        //DB returns "product access" information which is used to allow/reject access
        //code of product is tightly coupled with code for authorization
    }
}

class ProductA extends Product
{
    function __construct() {
        parent::__construct();
        if ($this->access != "all_access") doPartialAccess();
        else doFullAccess();
    }
}
//...
class ProductX extends Product
{
    function __construct() {
        parent::__construct();
        if ($this->access != "all_access") doPartialAccess();
        else doFullAccess();
    }
}
</code>```

Approach 1

My first thought is to use dependency injection, to inject $user (or $access object directly) into constructor of Product.  but wait ... I will have to do this with every Product* extending Product.  Even if I do this, it will be effectively just moving the instantiation of $user elsewhere in the code (outside of Product* classes).  As such, I am not sure it will be the best solution necessarily, because I think it will convolute the codebase with introducing what I think are unnecessary parameters into constructors, instead of making the codebase more maintainable.

Approach 2

Another thought is to have some kind of a "registry" for access object, where I can put objects in it and extract objects out of it.  But wait, Registry pattern is deemed an anti-pattern.  And I am already using it -- see the global $user!?  Not an object oriented way to do this, mind you, but registry concept nevertheless.

Question

My long term goal is to decouple product code (various computations, assembling a product model string, etc.) from user permissions code controlling access to the class.  Product access constructs are actually used to build some SQL queries, so code of Product and Access are pretty much entangled right now.  Product needs Access and I am not sure if I can de-tangle them.  I think I can't walk around the fact that Product does need Access.  Perhaps I just need to pull out the currently-sparsely placed code lines that do control access, and put them into their own Access class and call that class ProductAccess, or the like.  There may be no way around it, but I am not entirely sure how to do this correctly.  DI seems to be inappropriate(?)

My short-term goal is that want to be able to test code for ProductA, without mocking up Access class.  But then this could be a wrong goal to have.  Maybe I need to mock up Access, since How will I test Product without knowing what level of access it needs...

My overall goal is to find a way to decouple classes as much as I can, while keeping existing functionality and getting rid of the registry pattern I have there now.  Is there a way to do this, or is my goal flawed?

答:
I think the problem is that your class design is a tad confused, so your question does not have a straightforward answer..

A product should not have any knowledge of users or access permissions. For instance, an inventory report needs access to all products, independent of which users have access rights.

You probably should be looking at some form of controller/manager class that does worry about who has access rights to products (perhaps named something like  ProductAccessManager). It may ask the product class what user roles are allowed to have access, then check that the requestor is in one of those roles and grant or deny access as appropriate. This separates the access logic from the product itself.

A clean class design avoids the kind of questions you are asking, and generally simplifies testing. I think that some further thought into your class design will pay big dividends in the future.


问:
Support for non-english characters?
Is support for non-english characters common in programming languages? I mean, technically, I would think it is feasable, but I don't have any experience in anything other than english, so I don't know how common it is.

I know that there are non-english based programming languages, but can something like C#, C++, C, Java, or Python support non-english classes/methods/variables?

Example in go (url, http://play.golang.org/p/wRYCNVdbjC)

```<code>package main

import "fmt"

type 世界 struct {
    世界 string
}

func main() {
    fmt.Println("Hello, 世界")
    世界 := new(世界)
    世界.世界 = "hello world"
    fmt.Println(世界.世界)
}
</code>```

答:
I think that this question is somewhat wider than "can I write Kanji in my favorite programming language".

For Java (and probably most other languages) Unicode is supported, and strings should be externalized to property files or similar. This lets you handle some common internationalization issues:

The messages are required in multiple languages (well that is what internationalization is about)

The position of parameters may vary between languages. For instance "The beautiful woman" in English may morph into the equivalent of "The woman beautiful" in other languages.

If your application supports multiple languages, then most developers will not be fluent in all the deployed languages. Again it is best if you support a single developnment language, and employ foreign language nationals to translate into other languages.

Title: Support for non-english characters?


答:
Although non-ASCII identifiers are supported in a large number of programming languages as 9000 and AhJian have said, it would be bad practice to use such and there are several reasons to do that.

The first one is that in some moment in feature a foreign coworkers that don't understand the language can join the the team, or the code may need to be reviewed by foreign experts or consultants. For them will be very hard to understand the code.

The second one, related to the first, is that you may not get help or review in StackExchange network if you don't replace the identifiers with english ones.

The third reason is that many of the programming terms are not translated in the particular language.

Title: Support for non-english characters?

Body:
Is support for non-english characters common in programming languages? I mean, technically, I would think it is feasable, but I don't have any experience in anything other than english, so I don't know how common it is.

I know that there are non-english based programming languages, but can something like C#, C++, C, Java, or Python support non-english classes/methods/variables?

Example in go (url, http://play.golang.org/p/wRYCNVdbjC)

```<code>package main

import "fmt"

type 世界 struct {
    世界 string
}

func main() {
    fmt.Println("Hello, 世界")
    世界 := new(世界)
    世界.世界 = "hello world"
    fmt.Println(世界.世界)
}
</code>```


问:
"Too object-oriented"
I come from a strong OO background, and I have recently started working in an organization which, although the code is written in Java, has a lot less emphasis on good OO design than what I am used to. I have been told that I introduce "too much abstraction", and that I should instead code the way it has always been done, which is a procedural style in Java.

TDD is also not very much practiced here, but I want to have testable code.  Burying business logic in static private methods in large "God-classes" (which seems to be the norm for this team) is not very testable.

I struggle in clearly communicating my motivation to my co-workers.  Does anyone have some advice on how I can convince my coworkers that using OO and TDD leads to more easily maintained code?

This question about technical debt is related to my question.  However, I am trying to avoid incurring the debt in the first place, as opposed to paying it down after the fact which is what the other question covers.

答:
To sell new ways to work, you need to show obvious benefits. Writing more layers of abstraction, without a clear benefit but a vague: "it can be beneficial for the future" won't work.

Make factories where the factories make more then one type of object.
Use dependency injection, where it immediately shows benefits.
Make interfaces that are actually going to be implemented by more then one class.

What I see too often in "true OO" is that advanced techniques are used to solve really simple problems in an overly complex way.

How can you show the benefit of a factory if it is only ever going to make the same object? Find a problem in your code that benefits from advanced techniques and shows your point and work from there.

Wars are won one battle at a time.

Title: "Too object-oriented"


问:
What is the equivalent of The Little Lisper project in Haskell?
In the book The Little Lisper, you implement a minimal Scheme in 10 Chapters that is capable of interpreting any chapter in the book.

To me it seems you could do the same for a 'minimal subset of a typed language' to be self-bootstrapping. I'm trying to work out what is feasible.

To me the options are:

Simply Typed Lambda Calculus

System F

Miranda

Haskell subset

Assumptions:

Note that I'm ignoring the GHC runtime elements like spineless tagless graph-interpreter

My question is: What is the equivalent of the Little Lisper project in Haskell?

答: There's a quite useful tutorial by Oleg Kiselyov and Chung-chieh Shan, in which they build a very simple implementation of the simply-typed lambda calculus with Hindley-Milner type inference. IIRC they don't write a parser for their language (you write parse trees in Haskell to use it), but this would clearly be a very simple addition that could be based on a typical parsec tutorial.</p>


问:
Can I use corporate-licensed tool at home/for personal projects?
Normally, the company where a programmer works has corporate licensed tools which are useful for programmer (ex: proprietary IDEs, reflectors, diagramming tools, office tools and PDF makers, etc.)

Can I :

Install it at home and use it for company projects?

Install it at home and use it for personal projects (possibly commercial)?

Use it at office for personal project (e.g. after office hours)?

I am not strictly asking for legal advise here (though some legal point of view would be nice, too). But is it a right thing to do in general?

答:
First, you need the permission of the employer.

Second, you and your employer need to check the license of the software in question. As an example, if you buy software from the App Store, the license allows you to use it in different ways; if you use it commercially then you may install it on any number of computers in the company that are exclusively used by the same person, or on one computer in the company that is used by any number of people, but not on any computers outside the company. So what you want to do would be illegal.

There are companies giving you cheap home user licenses, for example at some point I paid £14 for Microsoft Office with a license that required me to delete the software when I left the company I worked for.


问:
Why use XML in Android?
From what I understand, isn't XML used for layouts and to setup how an activity looks?

My book says that XML files are converted into Java code but then, why not just write everything in Java?

答:
Its because its simpler - tools can be written to manipulate a XML document far easier than understand java code, so the layout can be created and modified by a simple tool that does not need to also be a java parser.

Its also easier for people to describe a layout in XML than in java directly.

This technique is used by a lot of things, eg WSDL that describes a web service interface and is converted to (quite complex) code by a specialist tool. It helps the developer focus on one aspect without worrying about the implementation and allows tools to be written to generate different types of code (eg the wsdl can be turned into a server stub, and also a client API)

Title: Why use XML in Android?


答:
Yes, as @ThomasOwens said, you can use the portions that you own (that you wrote) in a closed-source, non-gpl app.

I think what clarifies this, but hasn't been mentioned, is the distinction between license and copyright. You, the author of the code, own its copyright despite licensing the code under gpl. In fact, you should immediately, if not sooner, go to http://www.copyright.gov and set up an account. Then register your copyright (Form TX) online. This is especially important when you intend to use that code commercially. If copyright matters ever come under dispute, courts look very favorably on you if you've registered the copyright before infringement occurs.

As for gpl, that's just a license issued by the copyright holder. And the gpl specifically prohibits using licensed code in closed-source projects. But you're not a licensee. You're the copyright owner. So you can do what you want. But, exactly like you said, you won't own the copyright to contributions to your codebase from other programmers. You'll be a licensee to their copyrighted code, and they'll be a licensee to your copyrighted code.

Again, go to http://www.copyright.gov and register the copyright to your code. Even if you don't intend to use it commercially, it just costs a few bucks, and it concretely establishes you as the copyright holder. In principle, you own the copyright to anything you write the moment it's on paper. But, like I said, in practice, if the matter comes under dispute, courts look very favorably on you if you've registered the copyright before infringement occurs. P.S. I'm not a lawyer (and I don't play one on tv:)

Title: I released my project under GPL. Can I still use it in my commercial app?

Body:
So I have this super sweet library I'm working on. Let's say I release it into the wild under GPL. In tandem I'm working on a commercial piece of software, and I'd like to use this library in it.

Since I made the library in the first place (even though I made it GPL), is it safe to assume I can use it in the commerical app?

Now that it's released as GPL, lets say some people make some awesome updates to it. Their work is also under GPL. Therefore I cannot include their changes in my commercial app, unless I wanted to make my commerical app GPL as well (which I don't). In that scenario, the safest thing to do would be to use my library as it was originally released when it was 100% my own code.

Is the above correct? If so, would releasing my library under LGPL be a better idea so I can re-incorporate changes to it into my commercial app since I'll just be linking to the DLL?

Edit after Thomas' answer:

To add a bit about the dual licensing option, it does open up the world of being able to commercially sell my library. On the other hand, I really want to bring in other developers to improve it (if they want), which kind mucks up the commercial licensing aspect. What is more important? For me, I'd rather have a better library than make a couple bucks off of it (it's not THAT impressive), so Thomas' point about going with LGPL is perfect. That allows me to both solicit assistance, and to take advantage of other contributors I can simply link to the DLL inside of having the original code baked into my solution file. The important bit is that I can use this improved code in my main commercial app and I won't worry about commercializing a subset of it (this library).


问:
Specify optional parameter names even though not required?
Consider the following method:

```<code>public List<Guid> ReturnEmployeeIds(bool includeManagement = false)
{

}
</code>```

And the following call:

```<code>var ids = ReturnEmployeeIds(true);
</code>```

For a developer new to the system, it'd be pretty difficult guessing what true did. First thing you'd do is hover over the method name or go to the definition (neither of which are big tasks in the slightest). But, for readability sake, does it make sense to write:

```<code>var ids = ReturnEmployeeIds(includeManagement: true);
</code>```

Is there anywhere that, formally, discusses whether or not to explicitly specify optional parameters when the compiler doesn't need you to?

The following article discusses certain coding conventions: https://msdn.microsoft.com/en-gb/library/ff926074.aspx

Something similar to the article above would be great.

答:
If you encounter code like:

```<code>public List<Guid> ReturnEmployeeIds(bool includeManagement = false)
{

}
</code>```

you can pretty much guarantee what's inside the {} will be something like:

```<code>public List<Guid> ReturnEmployeeIds(bool includeManagement = false)
{
    if (includeManagement)
        return something
    else
        return something else
}
</code>```

In other words, the boolean is used to choose between two courses of action: the method has two responsibilities. This is pretty much guaranteed a code smell. We should always strive to ensure that methods only do one thing; they only have one responsibility. Therefore, I'd argue both of your solutions are the wrong approach. Using optional parameters is a sign that the method is doing more that one thing. Boolean parameters are also a sign of this. Having both should definitely set alarm bells ringing. What you should do therefore, is refactor the two different sets of functionality out into two separate methods. Give the methods names that make clear what they do, eg:

```<code>public List<Guid> GetNonManagementEmployeeIds()
{

}

public List<Guid> GetAllEmployeeIds()
{

}
</code>```

This both improves the readability of the code and ensures you are better following SOLID principles.

EDIT
As has been pointed out in the comments, the case here that these two methods will likely have shared functionality, and that shared functionality will likely best be wrapped in a private function that will need a boolean parameter to control some aspect of what it does.

In this case, should the parameter name be supplied, even though the compiler doesn't need it? I'd suggest there's no simple answer to that and that judgement is needed on a case by case basis:

The argument for specifying the name, is that other developers (including yourself in six months time) should be the primary audience of your code. The compiler is definitely a secondary audience. So always write code to make it easier for other people to read; rather than just supplying what the compiler needs. An example of how we use this rule every day, is that we do not fill our code with variables _1, _2 etc, we use meaningful names (which mean nothing to the compiler).

The counter argument is that private methods are implementation details. One could reasonably expect anyone looking at a method such as below, would trace through the code to understand the purpose of the boolean parameter as they are inside the internals of the code:

```<code>public List<Guid> GetNonManagementEmployeeIds()
{
    return ReturnEmployeeIds(true);
}
</code>```

Is the source file, and the methods, small and easily understood? If yes, then the named parameter probably amounts to noise. If no, it may well be very helpful. So apply the rule according to circumstances.

Body:
If you encounter code like:

public List<Guid> ReturnEmployeeIds(bool includeManagement = false)
{

}

you can pretty much guarantee what's inside the {} will be something like:

public List<Guid> ReturnEmployeeIds(bool includeManagement = false)
{
    if (includeManagement)
        return something
    else
        return something else
}

In other words, the boolean is used to choose between two courses of action: the method has two responsibilities. This is pretty much guaranteed a code smell. We should always strive to ensure that methods only do one thing; they only have one responsibility. Therefore, I'd argue both of your solutions are the wrong approach. Using optional parameters is a sign that the method is doing more that one thing. Boolean parameters are also a sign of this. Having both should definitely set alarm bells ringing. What you should do therefore, is refactor the two different sets of functionality out into two separate methods. Give the methods names that make clear what they do, eg:

public List<Guid> GetNonManagementEmployeeIds()
{

}

public List<Guid> GetAllEmployeeIds()
{

}

This both improves the readability of the code and ensures you are better following SOLID principles.

EDIT
As has been pointed out in the comments, the case here that these two methods will likely have shared functionality, and that shared functionality will likely best be wrapped in a private function that will need a boolean parameter to control some aspect of what it does.

In this case, should the parameter name be supplied, even though the compiler doesn't need it? I'd suggest there's no simple answer to that and that judgement is needed on a case by case basis:

The argument for specifying the name, is that other developers (including yourself in six months time) should be the primary audience of your code. The compiler is definitely a secondary audience. So always write code to make it easier for other people to read; rather than just supplying what the compiler needs. An example of how we use this rule every day, is that we do not fill our code with variables _1, _2 etc, we use meaningful names (which mean nothing to the compiler).

The counter argument is that private methods are implementation details. One could reasonably expect anyone looking at a method such as below, would trace through the code to understand the purpose of the boolean parameter as they are inside the internals of the code:

public List<Guid> GetNonManagementEmployeeIds()
{
    return ReturnEmployeeIds(true);
}

Is the source file, and the methods, small and easily understood? If yes, then the named parameter probably amounts to noise. If no, it may well be very helpful. So apply the rule according to circumstances.


问:
Programming by dictation?
ie. you speak out the code, and someone else across the room types it in

Anyone tried this?

Obviously the person taking the dictation would need to be a coder too, so you didn't have to explain everything and go into tedious detail (not 'open bracket, new line...' but more like 'create a new class called myParser that takes three arguments, first one is...').

I thought of it because sometimes I'm too easily distracted at my computer. Surrounded by buttons, instant gratification a click away, the world at my fingertips. To get stuff done, I want to get away, write my code on paper. But that would mean losing access to necessary resources, and necessitate tedious typing-up later on.  The solution? Dictate.

Pros:

no chance to check reddit, stackexchange, gmail, etc.

code while you pace the room, lie down, play billiards, whatever

train your brain to think more abstractedly (have to visualize things if you can't just see the screen)

skip the tedious details (closing brackets etc.)

the typist gets to shadow a more experienced programmer and learn how they work

the typist can provide assistance/suggestions

external pressure of typist expecting instructions, urging you to stay focussed

Cons

might be too hard

might not work any better

rather inefficient use of assisting programmer

need to find/pay someone to do this

答:
"and not go into tedious detail" sounds like a peasant worker doing all the hard work while the boss stands back and directs.

If tedious detail is getting in the way of coding, you need to stop coding and start designing first. This is how we used to do it - sit down and think about what you want to do before you start doing it. Use paper, storyboards, various UML diagrams (if you like, I find them tedious in themselves!) and anything else that gets the concepts, transitions, state and overall system architecture in place. Then you can code to this design and find it a lot easier.

ContentLicense: CC BY-SA 2.5

Title: Programming by dictation?