问:
How can I keep browser URL secret when editing data?
Suppose,
There is a user list.

```<code>Edit
Edit
</code>```

When a system user clicked to edit a user info. Then it goes to url to browser like as

http://abc.com/user/5

He can manually replace 5 to 155 and edit(update) the user info. It is a problem to me. How can I remove this problem?

I have an idea: Calling the edit page by ajax. So that the number will be hidden. Is there any good idea?

答:
I have encountered this issue several times and have found what I think is the simplest solution. Since your user can edit (personal/account?) information, I assume you have some kind of authentication system up and running. If you use sessions to keep track of recognized clients you can store the user's ID inside it. Then you can fetch the ID from the session when the appropriate page is requested. You would have to change your URL structure to users/edit (or something similar) so that is does NOT have any sensitive information.

Now you have hidden the sensitive data from the URL. This also comes with a bonus. Imagine a user linking his current URL (your old structure with the ID) in an email and the recipient clicks it. Your validated user have now unwillingly given away his/hers ID.

Sum up

Remove the user ID from the URL structure

Store the user ID inside a session

Change the URL structure to NOT include any sensitive information

Fetch the ID from the session when the appropriate page is requested

Continue business as usual

Alternative

If the ID inside the URL is a requirement you can "borrow" some of the concept from the above. If you store the user ID inside the session (or your used temporary storage of recognized users), you can compare the ID from the URL against it. If it matches we are good to go, otherwise we can show and error, logout the user and so on.

Hope this can help you, happy coding!

Body:
Suppose,
There is a user list.

```<code><a href="user/5">Edit</a>
<a href="user/6">Edit</a>
</code>```

When a system user clicked to edit a user info. Then it goes to url to browser like as

http://abc.com/user/5

He can manually replace 5 to 155 and edit(update) the user info. It is a problem to me. How can I remove this problem?

I have an idea: Calling the edit page by ajax. So that the number will be hidden. Is there any good idea?


答:
Just use an URL with some query parameters, like

```<code><a href="user/5?checksum=12345">Edit</a>
</code>```

Of course the checksum is computed, perhaps using some session cookie, and your server code has something to validate it. So if your user is abusing the system by editing the URL (e.g. replacing user/5 by user/567) the checksum should no more be valid.

Be kind with your users. Don't have an absurdly long checksum (like linkedin does). Make it of reasonable length (e.g. 48 chars is more than enough).

Expect advanced users to eventually (and legitimately) bookmark such an URL so ensure it is working when some user uses it next month or next year.

ContentLicense: CC BY-SA 3.0

Title: How can I keep browser URL secret when editing data?

Body:
Just use an URL with some query parameters, like

<a href="user/5?checksum=12345">Edit</a>

Of course the checksum is computed, perhaps using some session cookie, and your server code has something to validate it. So if your user is abusing the system by editing the URL (e.g. replacing user/5 by user/567) the checksum should no more be valid.

Be kind with your users. Don't have an absurdly long checksum (like linkedin does). Make it of reasonable length (e.g. 48 chars is more than enough).

Expect advanced users to eventually (and legitimately) bookmark such an URL so ensure it is working when some user uses it next month or next year.


问:
How would somebody uphold a license on "illegal" code?
First off, I want to say that this is purely hypothetical; it's just a scenario that came to mind. I am not looking for personal legal advice, but rather, I'm trying to gain a better understanding of software licensing in general.

Suppose somebody open-sources code relating to a botnet (either the code to infect a zombie, control the zombies, or both) under some license, let's say GPL.

A few questions.

First off, are botnets illegal? I don't know if it differs from country to country. I ask because if it isn't, then my question would make no sense whatsoever.

Can a software license be applied to "illegal" software?

If a person decides to take that code and violates the license terms, could the original creator take action against said person?

Even if they could, should they? What happens if somebody openly admits they are the creator of code that does illegal things?

答:
First, I'm not a lawyer.  If you want reliable legal advice, find one.

Establishing and using a botnet probably means committing felonies in most First World countries, which tend to have laws against unauthorized use of somebody else's computer.

However, software that can be used illegally, or even software designed to do illegal things, is generally not itself illegal.  (There are exceptions; in the US, for example, software to remove certain protections may be illegal under the DMCA.)  So, let's assume we're in the US discussing software that is in violation of the DMCA.

There is no reason why there shouldn't be a software license on such software, partly because it won't be illegal everywhere.  The copyright holder could indeed take legal action against people violating the license, although that may not go very far.

Whether this is wise is another matter.  Writing code that does illegal things is not itself illegal, but possession of certain software might be.  I'd rather not confess to a crime in a court document.

ContentLicense: CC BY-SA 2.5


问:
Type system for performance
Do (static) type systems exist which attempt to formalize the performance characteristics of programs? I cannot find seem to find such attempts.

Since type systems are (one of) the most powerful tools in the programmer's arsenal to make statements about programs, and since there are many instances in which performance is critical, it would not seem to be far-fetched to imagine attempts had been undertaken to create a type system which attempts to make at least some statements about the storage and runtime characteristics of programs.

答:
You could imagine a type system sophisticated enough to be related to WCET or complexity of the program. Then, the issue is to make a sound type analyzer (or checker) - i.e. typing rules - to make that possible, and implement it efficiently enough to make that reasonably useful.

Most of the type systems are simple enough to be quick to compute in practice (at least for the reasonable set of programs a human developer could manually write).

Some academic programming languages (e.g. AGDA) have very sophisticated type systems which are Turing-complete, so their compiler may take a large (perhaps infinite) amount of time.

(If I understand well, Jérémie Salvucci's PhD work in progress at LIP6 in Paris is quite related to your question; I have sent him an email about it; you might look for regions and types...).

Be however aware of Rice's theorem & the Halting problem. Type systems might not always be the silver bullet you might want them to be (see the old no silver bullet book).

Title: Type system for performance


问:
What should the files and folder (Core, Assets, Common, Models, Resources, Views) in my project represent?
I am a novice programmer who has inherited a software project that contains the following files and folders. The project is using C# and WPF. What should I expect to find and continue putting inside of the following folders and files:

```<code>Core
    Assets
    Common
    Models
    Resources
    API.cs
Views
</code>```

I am hoping that this structure builds on some kind of easy to understand theory.

My most confusing points are that:

The API.cs file has a lot of functions that I think are part of some of the models. Also, the functions in this application are not used by any other application, so why is there even need for an API?

I don't quite understand what the difference is between Common and Models.

If you can shed some light on why this kind of structure is used and what should go where, then that would be of great help to me.

答: All those folders are simply means to keep track of your project resources. If you wanted to put a model into common or a shared resource into model (generally I would put common resources into the common directory) you could. They really have little to do with the app itself. As for methods which do not seem to be used, you say it is an inherited project? It is not unusual to find redundant code in inherited projects so maybe they aren't. </p>


答:
Your application probably have different actions with different access levels, for example an admin will probably be allowed more things than a simple user.

So you better build some data-matrix summarizing user(-roles) access-rights and check brefore treating any request if the current logged-in user (or even unlogged Guest if you happen to have such a role) has the right or not to perform this action. Of course this might look overkill, but if you mind about security you definitely need it. You can NEVER trust the user, you always have to validate server-side.


答:
It seems eminently possible to create a type system which categorises the performance characteristic of types (e.g. "fast/slow for serial access, "fast/slow for random access", "memory efficient/inefficient").  Those traits could be abstract types placed into the hierarchy in such a way that the more concrete types inherited from them.  However, the performance of any program using those types would depend upon the way they are actually used/accessed.  For the type system to make statements about the program itself, usage of (access to) those types would have itself to be represented as types.  This would mean forgoing the use of built-in control structures (e.g. for/while loops) and instead using types which implement them.  Hence the hierarchy could have an abstract serial-access type and descendant list-serial-access, tree-serial-access types and so on.  Efficiency of usage might then be at least partly expressed by the combination and application of these types to each other.

In a functional language like Haskell - which has almost no control structures anyway - this looks to me fairly practical and enforceable.  In Java, however, such a system seems much less achievable (not so much from the implementation as from the enforceability/trustworthiness of the result).

Haskell already allows us to state definitively how much of a program is pure and provides ways of confining particular activities within sealed boxes. Since parallelism/concurrency in Haskell is implemented through the type system, it could be argued that it is already part of the way there (to what you want). In contrast, imperative languages (even statically typed ones like Java) offer the coder many, many ways to subvert any attempt at this.

Title: Type system for performance

Body:
Do (static) type systems exist which attempt to formalize the performance characteristics of programs? I cannot find seem to find such attempts.

Since type systems are (one of) the most powerful tools in the programmer's arsenal to make statements about programs, and since there are many instances in which performance is critical, it would not seem to be far-fetched to imagine attempts had been undertaken to create a type system which attempts to make at least some statements about the storage and runtime characteristics of programs.


问:
When to Assign the Scrum Tasks
Our Scrum Scenario:

We have two Sprint Planning Meetings (Part 1 and Part 2).

Part 1: What should be done during the Sprint?

Part 2: How should these things be done?

I guess there are some differences in how this is handled. This is according to Boris Gloger's German book. In practice these things can be done on the same day or even during the same meeting.

Team Size:

Developer: 3

All of them have their strengths either in Backend or Frontend development

We would like to get all familiar with all the technologies used in the project. We do not like to have private kingdoms but have a constant discussion about how things can be done.

At which point in time should Tasks be assigned? Within the Scrum Process: Sprint Planning 1, 2, [...] Review Meeting, Retrospective Meeting, etc.?

Who is responsible for the assigning tasks? The Product Owner, the Scrum Master, the developers?

答:
At the beginning of your sprint you should have a sprint planning meeting.  This is where your team decides which user stories to deliver that sprint.  At the end of the meeting you should have a reasonable and prioritized sprint backlog.

Your developers should then pick tasks from the top of the backlog.  When they finish their current task they return to the backlog and pick then next available task.  Again from the top.

Nobody needs to be assigned anything.

Title: When to Assign the Scrum Tasks


问:
Why List<E> interface is additionally introduced in collection hierarchy?
Below is the diagram, where, if we just consider the implementations of List,

AbstractList maintains the core behavior of list. To introduce the new implementation class MyList(say) one can inherit AbstractList and override(if necessary) required methods. By extending AbstractList. Additionally, class MyList is obeying the contract to behave like a list.

```<code>class MyList extends AbstractList{..}
</code>```

Users can use collection hierarchy, as,

```<code>AbstractList l = new ArrayList<String>();
l.add("one"); //execute ArrayList's add method
</code>```

A class can also maintain composition relation with any list implementation(at runtime), by having

```<code>AbstractList l;
</code>```

as member, that gets populated at runtime, with any list implementation.

So,

I would like to understand the clear reason, Why additionally interface List<E> is introduced?

note1: Intention is to understand, how to use interface. This not a duplicate question, because both abstract class and interface are used.I did not use the word 'instead of' or 'rather'

note2: Let us not get into java-8 default methods, as above collection hierarchy was designed with whatever was provided till java-7

答:
Your question seems to stem from the wrong assumption that every List is also a subclass of AbstractList. While AbstractList offers versatile base implementations for a lot of methods, there might be reasons not to use this option.

It’s hard to find an example when looking to the public API only, but there is one: CopyOnWriteArrayList.

You will find much more once you understand that not every implementation is public, e.g. by looking at Collections.unmodifiableList and
Collections.synchronizedList, both returning implementations not inheriting from AbstractList for a good reason. They have base classes which are more suitable to their task, UnmodifiableList extends UnmodifiableCollection and SynchronizedList extends SynchronizedCollection.

There can be other, application-specific reasons not to subclass AbstractList, in the end, the decision to make the entire Collection-API interface-based is fundamental and there is no reason to make an exception for List. It’s not different to why you should use the Collection interface instead of AbstractCollection or the Set interface instead of AbstractSet…

Regarding how to use it… If it is about parameters or heap variables which ought to offer the maximum flexibility, of course, you should always use the least specific type that is required for the operation, e.g. the List interface, if it is required that the provided Collection has List semantic. As said, there are List types which do not extend AbstractList.

If it is about local variables within an implementation code, you might declare a variable to match the type of the actual implementation, e.g. ArrayList<X> l=new ArrayList<>(); to reduce the number of different types which occur in this code. But that still implies that there is no reason to refer to AbstractList. The only place where a reference is to AbstractList is feasible is in the extends AbstractList clause…


问:
Does code format affect performance?
I think I have came across a few times when I reformat some segment of code, it performed the way I wanted it to other than the other poorly formatted segment of code? Does code format affect performance? Or is that a myth?</p>

答:
The only time I think format matters is with dynamically downloaded code - ie things like javascript where huge blocks of comments and/or very long variable names will slow down the download, but even then this does not affect the compile time. (and the download time can be fixed by minimising the javascript file).

For compiled files, the source is just a collection of symbols separated by whitespace. The compile doesn't care how these are formatted, a single long line would be just as good as a nicely formatted source file, as far as the compiler is concerned (admittedly some languages would care, eg Python that relies on formatting, particularly new line indentation, but even that doesn't affect the speed of compilation).

Formatting is for people, not for computers. Its important for that reason.

Title: Does code format affect performance?


问:
Bad practice - switch case to set environment
In the last three years that I have worked as developer, I have seen a lot of examples where people use a switch statement to set the path (both in back-end and front-end) for a URL. Below is an example of this:

Back-end example (C#):

public static string getHost(EnvironmentEnum environment){
    var path = String.Empty;
    switch (environment)
    {
        case EnvironmentEnum.dev:
            path = "http://localhost:55793/";
            break;
        case EnvironmentEnum.uat:
            path = "http://dev.yourpath.com/";
            break;
        case EnvironmentEnum.production:
            path = "http://yourpath.com/";
            break;
    }
    return path;
}
```

<p>Front-end example (JavaScript):</p>

<pre class="lang-js prettyprint-override"><code>(function () {
    if (window.location.host.indexOf("localhost") !== -1) {
        window.serviceUrl = "http://localhost:57939/";
    }
    else if (window.location.host.indexOf("qa") !== -1) {
        window.serviceUrl = "http://dev.yourpath.com/";
    }
    else {
        window.serviceUrl = "http://yourpath.com/";
    }
})();
</code>```

It has been discussed whether it is a good or bad practice, and I think it is a bad practice, because we must avoid this kind of code and set a proper configuration. But to be honest I really don't know the proper answer and why is it not recommended and what is the correct way to implement this.

can someone explain it the pros and cons of the above practice?

答:
Code that works for you and is easy to maintain is by definition "good". You should never change things just for the sake of obeying someone's idea of "good practice" if that person cannot point out what the problem with your code is.

In this case, the most obvious problem is that resources are hard-coded into your application - even if they're selected dynamically, they're still hard-coded. This means that you cannot change these resources without recompiling/redeploying your application. With an external configuration file, you'd only have to change that file and restart/reload your application.

Whether or not that is a problem depends on what you do with it. In a Javascript framework that is automatically redistributed with every request anyway, it is no problem at all - the changed value will propagate to every user the next time they use the application. With an on-premises deployment in a compiled language in an inaccessible location it is a very big problem indeed. Reinstalling the application might take a long time, cost a lot of money or have to be done at night to preserve availability.

Whether or not hard-coded values are a problem depends on whether  your situation is more like the first example or more like the second example.


答:
You are absolutely right in thinking this is a bad practice. I've seen this in production code, and it always comes back to bite you.

What happens when you want to add another environment? Or change your development server? Or you need to fail over to a different location? You can't because your configuration is directly tied to code.

Configuration should be forced out of code and into the environment itself. It's a principle of a Twelve-Factor App (http://12factor.net/config), but it's a good practice for any application. You may find that environment variables aren't appropriate for your situation, in which case I'd suggest looking at storing that configuration in a database of configuration file alongside (but not checked in with) code.

Title: Bad practice - switch case to set environment

Body:
In the last three years that I have worked as developer, I have seen a lot of examples where people use a switch statement to set the path (both in back-end and front-end) for a URL. Below is an example of this:

Back-end example (C#):

public static string getHost(EnvironmentEnum environment){
    var path = String.Empty;
    switch (environment)
    {
        case EnvironmentEnum.dev:
            path = "http://localhost:55793/";
            break;
        case EnvironmentEnum.uat:
            path = "http://dev.yourpath.com/";
            break;
        case EnvironmentEnum.production:
            path = "http://yourpath.com/";
            break;
    }
    return path;
}
```

<p>Front-end example (JavaScript):</p>

<pre class="lang-js prettyprint-override"><code>(function () {
    if (window.location.host.indexOf("localhost") !== -1) {
        window.serviceUrl = "http://localhost:57939/";
    }
    else if (window.location.host.indexOf("qa") !== -1) {
        window.serviceUrl = "http://dev.yourpath.com/";
    }
    else {
        window.serviceUrl = "http://yourpath.com/";
    }
})();
</code>```

It has been discussed whether it is a good or bad practice, and I think it is a bad practice, because we must avoid this kind of code and set a proper configuration. But to be honest I really don't know the proper answer and why is it not recommended and what is the correct way to implement this.

can someone explain it the pros and cons of the above practice?


问:
Is overriding Object.finalize() really bad?
The main two arguments against overriding Object.finalize() is that:

You don't get to decide when it's called.

It may not get called at all.

If I understand this correctly, I don't think those are good enough reasons to hate Object.finalize() so much.

It is up to the VM implementation and the GC to determine when the right time to deallocate an object is, not the developer. Why is it important to decide when Object.finalize() gets called?

Normally, and correct me if I'm wrong, the only time Object.finalize() wouldn't get called is when the application got terminated before the GC got a chance to run. However, the object got deallocated anyway when the application's process got terminated with it. So Object.finalize() didn't get called because it was not needed to be called. Why would the developer care?

Every time I'm using objects that I have to manually close (like file handles and connections), I get very frustrated. I have to be constantly checking if an object has an implementation of close(), and I'm sure I have missed a few calls to it at some points in the past. Why isn't it just simpler and safer to just leave it to the VM and GC to dispose of these objects by putting the close() implementation in Object.finalize()?

答:
To your first question:

It is up to the VM implementation and the GC to determine when the right time to deallocate an object is, not the developer. Why is it important to decide when Object.finalize() gets called?

Well, the JVM will determine, when it is a good point to reclaim the storage that has been allocated for an object. This is not necessarily the time when the resource clean up, you want to perform in finalize(), should happen. This is illustrated in the “finalize() called on strongly reachable object in Java 8” question on SO. There, a close() method has been called by a finalize() method, while an attempt to read from the stream by the same object is still pending. So besides the well-known possibility that finalize() gets called way to late there is the possibility that it gets called too early.

The premise of your second question:

Normally, and correct me if I'm wrong, the only time Object.finalize() wouldn't get called is when the application got terminated before the GC got a chance to run.

is simply wrong. There is no requirement for a JVM to support finalization at all. Well, it’s not completely wrong as you could still interpret it as “the application got terminated before finalization took place”, assuming that your application will ever terminate.

But note the small difference between “GC” of your original statement and the term “finalization”. Garbage collection is distinct to finalization. Once the memory management detects that an object is unreachable, it may simply reclaim its space, if either, it doesn’t have a special finalize() method or finalization is simply unsupported, or it may enqueue the object for finalization. Thus, the completion of a garbage collection cycle does not imply that finalizers are executed. That may happen at a later time, when the queue is processed, or never at all.

This point is also the reason why even on JVMs with finalization support, relying on it for resource cleanup is dangerous. Garbage collection is part of the memory management and hence triggered by memory needs. It’s possible that garbage collection never runs because there is enough memory during the whole runtime (well, that still fits into the “the application got terminated before the GC got a chance to run” description, somehow). It’s also possible that the GC does run but afterwards, there is enough memory reclaimed, so the finalizer queue is not processed.

In other words, native resources managed this way are still an alien to the memory management. While it is guaranteed that an OutOfMemoryError is only thrown after sufficient attempts to free memory, that does not apply to native resources and finalization. It is possible that opening a file fails due to insufficient resources while the finalization queue is full of objects which could free these resources, if the finalizer ever ran…


问:
Win loss code that does not make 1-0 record better than someone like 20-3
ok, am just looking for a win loss code example. This can be for any language, just wanting the outline. Fairly new to programming, so dummy it up for me :)

I can do (win-loss/total of win loss). Guessing that is a good standard win loss ratio, but I don't want a new person that has 1-0 to be ranked higher than someone that has 20-3.

Any help is appreciated and thank you.

EDIT:

The chess styles are a little more than needed. Just want a ranking system with win/loss. so lest say 20-3 is top in league right now. he is, say 23 weeks in so far. if one guy comes in and wins first match against anyone, I don't want him to take #1 spot over people thats been there longer and have a great winning record. To respond to ampt... maybe he will be best in league, but I don't want him instantly there cause he had one good match. Not sure if that clarify any more. Didn't really follow Doc all the way. Looks as if he is hindered in list up to his 11th game. Not sure if thats what you ment there. Thanks again for all reasponses.

答:
Since you've dismissed the tried and tested option of an ELO style ranking system then you have to re-examine your needs.

[if a player] wins first match against anyone, I don't want him to take #1 spot

... seems to sum things up best.  It suggests that a crude win/loss ratio seems to be adequate and that the only requirement is to stop new players from appearing on the leaderboard.

To do that really you just need a minimum game count.

Something like:-

```<code>winRatio = win / math.max(win + loss, minMatches)
</code>```

...would mean that someone would have to win minMatches in order to get that 100% win rate and after that many games they should be starting to find their level anyway.

Ultimately the fairest system for unmatched competitors is more along the ELO lines and you'll find you will want that in the end unless all your players are very evenly matched - I would suggest you code for it now, start using it in the backend and then when they complain that the scoring system is still unfair you can look responsive to user demands when in fact you knew it was coming all along...  sometimes our game is all about perception.

Body:
Since you've dismissed the tried and tested option of an ELO style ranking system then you have to re-examine your needs.

[if a player] wins first match against anyone, I don't want him to take #1 spot

... seems to sum things up best.  It suggests that a crude win/loss ratio seems to be adequate and that the only requirement is to stop new players from appearing on the leaderboard.

To do that really you just need a minimum game count.

Something like:-

winRatio = win / math.max(win + loss, minMatches)

...would mean that someone would have to win minMatches in order to get that 100% win rate and after that many games they should be starting to find their level anyway.

Ultimately the fairest system for unmatched competitors is more along the ELO lines and you'll find you will want that in the end unless all your players are very evenly matched - I would suggest you code for it now, start using it in the backend and then when they complain that the scoring system is still unfair you can look responsive to user demands when in fact you knew it was coming all along...  sometimes our game is all about perception.


问:
Is it good practice to put database connections into a class library?
I am using entity framework and I created multiple libs. XYZ is main lib which handles majority of operations. And for integration purpose I have created different libs which are comparatively smaller.

I want them to have database connection of external account table which handles authentication and token management. In XYZ I have crated entity class for database access, but I don't want to reference XYZ into smaller lib because I just want to use one class and that will create unnecessary burden.

What is a recommended way to provide database connection for single table?

Should I create same entity class in every lib or create new lib to access database?

答:
Seems like your login class belongs into a third library that would be referenced by both: the main XYZ and your other smaller libraries.

Libraries are like bricks that contain common functionalities. If you feel like you are referencing a library for just one little bit of it, move the bit out, it's obviously common between other libraries as well. Then reference it from all the libraries that require it.

Current:

```<code>Library A -> Library XYZ(Which contains login stuff)
</code>```

New Solution:

```<code>Library A -> Login Library
Library XYZ -> Login Library
</code>```

Body:
Seems like your login class belongs into a third library that would be referenced by both: the main XYZ and your other smaller libraries.

Libraries are like bricks that contain common functionalities. If you feel like you are referencing a library for just one little bit of it, move the bit out, it's obviously common between other libraries as well. Then reference it from all the libraries that require it.

Current:

Library A -> Library XYZ(Which contains login stuff)

New Solution:

Library A -> Login Library
Library XYZ -> Login Library


答:
For one, (as others have mentioned) this is a bad idea because you're tying implementation details into your code. This makes it difficult to change things.

As mentioned in this answer, if you want to add a new environment now you have to update your code everywhere, instead of just adding your program to a new environment.

There is another serious flaw with doing this in your Javascript code: You're exposing the internals of your company to potential attackers. Sure, you may be behind a firewall, but you still may have a disgruntled employee or someone who lets a virus in.

Bad news bears.

The best thing to do is to set your configuration from the environment (as in the previously linked answer, Twelve-Factor App has great advice on the topic). There are several ways to do this depending on your language. One of the easiest (usually) is to just set environment variables. Then you just change the variables depending on where you're running - whether that's a local dev box, qa, or production. Another option is storing the values in a .ini file or JSON. Yet another alternative would be storing your config values as actual code. Depending on what language or environment you're using this may or may not be a good idea.

But the ultimate goal is to let you take one code base, drop it on any machine that has the supported architecture/connectivity, and be able to run it without modifying the code in any way.


问:
Continuous Batch Processing in Java
My team has written an application which we've decided needs to run a process, we'll say about once a day, as long as the application is being used. I've never done anything like this in Java before so am hoping to get a better idea of how I'd design a solution.

Initially, I've been going through the Oracle 'Overview of Batch Processing' tutorial and trying to create a working example of a batch process. However, I got far enough along in the tutorial and read this line:

Starting a Batch Job from a Servlet -
  Note that the mere presence of a job XML file or other batch artifacts (such as ItemReader) doesn't mean that a batch job is automatically started when the application is deployed. A batch job must be initiated explicitly, say, from a servlet or from an Enterprise JavaBeans (EJB) timer or an EJB business method.

So it would appear that the functionality that I'm looking at does not necessarily entail a continuous process and has to be initiated manually.

Our initial thoughts on what we wanted to accomplish was to have a 'batch job' initiate a service which contained our business logic at least once a day. So I wonder:

Is continuous processing something I should be able to accomplish with the batch processing api I'm looking at?

If so, how does this commonly work?

If not, how do Java developers typically handle this type of problem from a high level?

答:
What you are looking to create already exists: look around for Java cron libraries. You can set up a crontab similar to the Unix daemon which invokes Java classes at the intervals you choose as long as your program is running.

Rather than focusing on the batch aspect of the task, focus on the timing aspect. Processing a batch of records is conceptually easier than ensuring your program runs at specific times, and thankfully that part is already done by someone else.

Title: Continuous Batch Processing in Java


问:
What false ideas are there that puts people off using threads?
Implementing threading in a program is hard, yes, however why is it that some people will not implement them even when there is an obvious need for it.

An example: Program has to load a dataset from a database, the thing to do would be to make the connection and get the data from the database in a worker thread and then load it into the GUI, leaving the GUI thread responsive for the user.

But no, I've talked to people whom seem to think that threads are evil and bad and whatnot and one should avoid them at all costs.  I've even heard that some class instructor advised against to use of threads and therefore did not want cover their use. WHAT???

With the hardware going into multi-core, I think that we need to understand threads better and not be afraid to use them. I find it a fascinating subject personally.

So what are things you've heard about threading that are false?

答:
Threading solves all your problems

If you're having performance issues you should not jump right to threading.

Threads are lightweight

Threads are lightweight in tens and twenties. Spawning thousands of threads is not.

Threading is easy [Java]

It's easy to create threads, that doesn't mean you will benefit from it.


答:
What if I want to run the backend on my own machine but not on port 55793, for example if I were running multiple versions at the same time to compare them? What if I want to run the application backend on one machine, but access it from another? What if I want to add a fourth environment? As others have pointed out, you have to recompile just to change the basic configuration.

The approach you have described might have worked in practice for your team so far, but it's pointlessly restrictive. A configuration system that allows parameters like this path to be set arbitrarily in a central configuration file is far more flexible than one that only provides fixed options, and what advantage do you gain with the switch statement approach? None!


问:
Why prefer sizeof(element) over sizeof(TYPE) for calculating the number of elements in an array?
I'm reading "King K.N's C programming" and found the following statement:

We discussed using the expression sizeof(a)/sizeof(a[0]) to calculate the number of elements in an array. The expression sizeof(a)/sizeof(t), where t is the type of a's elements, would also work, but it is considered an inferior technique.

Why is it considered an inferior technique?

答:
sizeof(a)/sizeof(t) explicitly codes the type into the expression. You now have the type specified in multiple locations, with no compiler support for ensuring that you're using the same type. So, if you change the base type of the array, but not in the (completely separate) count expression, bingo: your code will compile just fine, but your element count will be wrong. If you're lucky your program will crash, but if not it will function almost completely correctly, but every once in a while will behave totally bizarrely.

sizeof(a)/sizeof(a[0]) is guaranteed to be correct, only requiring the name of the array. Change the type and you're fine; change the array name and the compiler will complain. No thinking required: we like that kind of programming.

ContentLicense: CC BY-SA 4.0


问:
Should you create a github repo/project for things as small as a useful function
Is it appropriate to make a fully blown github project/repo for something that you believe would be useful to others, but is as small as a single function?</p>

答: No, something as small as a single function probably doesn't need to be made as a full repository. Instead, you could make it a Gist, which is GitHub's way of sharing small snippets of code in a source controlled way that's similar to a repository.</p>


答:
GitHub says that "Gist is a simple way to share snippets and pastes with others." On the surface, that might suggest that Gist is a better alternative to a project, for a "small useful" function.

A fuller answer probably involves answering "how useful is useful", as you described it? Furthermore, how much work does the function do? If you would be happy to describe the function as a "snippet" or a "paste", then by all means, use a Gist. If, on the other hand, you expect the function might be re-used by hundreds or thousands of others, and cut computational intensity in half, for example, then perhaps it deserves a project.

Title: Should you create a github repo/project for things as small as a useful function

Body: Is it appropriate to make a fully blown github project/repo for something that you believe would be useful to others, but is as small as a single function?</p>


问:
GNU GPL when applied to Data
I would like to export the contents of the GCIDE dictionary data from xml format to sql format for sqlite; however, I am concerned how the GNU GPL License impacts my use of the data. To be clear I want the data and not the xml tags inserted into my database. I then plan to create a small app that will make use of that data in sql lite. Does this mean my sqlite database needs to be provided free and open source? Does this mean any apps I create that connect to the database need to be free and open source?

FYI: I plan on making a public facing web application that uses gcide dictionary data.I am not sure if this counts as distribution of the software or not.

答:
IANAL.

I think it depends on whether your app is a 'derived work' of the GCIDE database.  If your app is a general dictionary-interacting app that works with any dictionary you import into it, that's one thing.  But it sounds like your app is fundamentally dependent on the GPL GCIDE database, so the case for it being a derived work is strong.  Derived works of GPL works can be redistributed only if they are distributed in compliance with the GPL.

Title: GNU GPL when applied to Data


问:
Changing requirements mid-sprint
I am in the middle of an agile sprint. Midway we realize that the requirement that we were working upon, could have been done in an easier fashion in a totally different way. The development work done on the current requirement wont be needed at all or needs to be changed totally. How is this handled in Agile? Even if we do communicate timeline and impact changes what is the formal method of handling this.</p>

答:
If you are faced with the work needing to be re-done, you re-do it.

Re-doing the implementation of a product backlog item does not necessarily require any user story to be re-written. The motivation to re-do the implementation may not have had anything to do with a change in the user story.

Re-doing some implementation also does not necessarily require a sprint to be cancelled. Sprint-cancellation should be rare. Scrum teams do not always accomplish everything that they set out to accomplish in a sprint.

Scrum does not aim to minimise effort. Scrum aims to produce high quality increments of a deliverable solution. If you use Scrum, you accept that sometimes "re-work" will be necessary. If you want to aim for minimised effort and re-work, you might adopt a different method.

Title: Changing requirements mid-sprint


问:
When should you avoid iterative and incremental development?
I'm currently reading some literature about software development process models. Everywhere I look, I only read the problems with the Waterfall model and how the iterative and incremental development approach solves these problems. But, I cannot find any information about when you should avoid this approach.

So, for what kind of projects should you better avoid iterative and incremental development?

答:
In some projects, you have to follow a strict development process, which may not be iterative. An example for these is in the aerospace sector when you have to deliver software by DO-178B/C standards and the like.

For one, you do not even have a choice in those cases. You couldn't develop iteratively even if you wanted to. But more importantly, these projects do not lend themselves to iterative development very well either.

Think of writing control software that gets shot into space (literally!). There is no more room for improvement once it's on flight (it's already different if your thing would start to operate on the moon or the ISS, because software patches become possible). Additionally, the hardware being controlled is typically very mature and requirements have been well analyzed and are very seldom subjected to changes.

Similar cases happen in software that needs to be certified. While you can develop those iteratively, there is a certain point at which you have to declare the whole thing complete in order to get the certification. After that, you must not touch the software again, or your certification is void. Again, a scenario that doesn't exactly favor iterative development.

That being said however, I notice more and more software projects in these sectors going for incremental developments (within the unchangeable frame of the required specification standards). Also, great care is taken to reduce the amount of software that cannot be developed iteratively (or just needs certification) and clearly separate it from the remaining software. The monetary advantages of this move are obvious (at least to anyone who has ever seen the cost of software that controls a plane), but it's also the typical text-book advantages of incremental development that the product developers are interested in.


问:
Approaches for storing and analysing large amounts of time-based data
I've been asked to develop a "telemetry" application that records data generated by a hardware device, which I read every 100ms.

There are approx 250 data points (32-bit values), but only a subset of these (say 30-50) will be returned by each 100ms read, so it will take several reads before I've got all 250 data points. Out of the data point values read, only a small number are likely to have changed since those same data points were last read - some change every 100ms, others perhaps every few seconds, while others very infrequently (or even never).

The main requirements for the system are:-

The ability to plot one or more data points over time, at 100ms resolution

The ability to view the values of all 250 data points at a particular point in time

The application needs to store the last 60 hours worth of data

I'm looking for some thoughts on how best to tackle this, particularly how to store the data in a way that supports the required reporting. So far I'm veering towards this idea:-

I maintain a "dictionary" of all 250 data points, updating the values after each read. Every 100ms I would write all 250 values to my data store. It's easy to implement and easy to query the data to satisfy the requirements. The downside is that it's not a particularly efficient use of storage (but hey - disk space is cheap nowadays).

Alternatively, ever 100ms, I could store only values that have changed since they were last read, however this becomes more difficult to implement, especially when it comes to querying. E.g. for requirement #2, I would have to construct a "snapshot" by traversing back through the data from the required point in time, looking for each data point's last stored value.

Now I've written all this out I think I've answered my own question. The "write everything" approach seems to be a no-brainer. However I've had no experience of this kind of mass data storage and analysis so I would be interested to hear what others think.

答:
Depending on the frequency with which queries may be made against the data, I would suggest: Storing the data in a compressed format; and decompressing the data prior to querying.

Alternatively, if queries are too frequent for the above: store the data in uncompressed format; and compress data older than 60 hours at a frequency of your choosing.


问:
Where is the closure argument initialized?
In this Wikipedia article about Closures

```<code>   function startAt(x)
       function incrementBy(y)
           return x + y
       return incrementBy

    variable closure1 = startAt(1)
    variable closure2 = startAt(5)
</code>```

It says that "Note that, as startAt returns a function, the variables closure1 and closure2 are of function type. Invoking closure1(3) will return 4, while invoking closure2(3) will return 8."

Why invoking closure1(3) will return 4, and invoking closure2(3) will return 8? I cannot see where is y initialized.

答:
Your y variable is a formal argument of the returned  incrementBy function (actually a dynamically created closure), so it is getting its value when that function (the just built closure) is applied.

Your x variable (inside incrementBy) is a closed variable. It has to be inside the closure made inside startAt. That fresh closure is dynamically created at runtime, when you are calling startAt.

So a closure is mixing data (the values -or perhaps the references- of the closed variables) and code (much like objects do, there is a deep similarity between closures and objects) and it is generally built at runtime.

Read also about anonymous functions since they are building closures at runtime. Read also the λ-calculus & currying wikipage... With anonymous functions introduced by the fun keyword (like in Ocaml) the example can be rewritten:

```<code>let startAt x =
   let incrementBy y = x + y in
   incrementBy
</code>```

which is the same as

```<code>let startAt x =
   fun y -> x + y
</code>```

In Scheme (or Lisp) you'll use the lambda keyword to make anonymous function:

```<code>(define (startAt x) (lambda (y) (+ x y)))
</code>```

If you are familiar or curious about Lisp, read Queinnec's Lisp In Small Pieces book, which explains all that in great details, with implementation technicalities.

BTW, read SICP. It is explaining the purpose of functional values (hence what closures are) quite well.

A related (and also difficult) notion is continuation.

If you are mostly a web programmer, try HOP or Opa (or perhaps ocsigen). They all use nicely closures and continuations (thru CPS), notably to easily mix browser side and server side computations.

Body:
Your y variable is a formal argument of the returned  incrementBy function (actually a dynamically created closure), so it is getting its value when that function (the just built closure) is applied.

Your x variable (inside incrementBy) is a closed variable. It has to be inside the closure made inside startAt. That fresh closure is dynamically created at runtime, when you are calling startAt.

So a closure is mixing data (the values -or perhaps the references- of the closed variables) and code (much like objects do, there is a deep similarity between closures and objects) and it is generally built at runtime.

Read also about anonymous functions since they are building closures at runtime. Read also the λ-calculus & currying wikipage... With anonymous functions introduced by the fun keyword (like in Ocaml) the example can be rewritten:

let startAt x =
   let incrementBy y = x + y in
   incrementBy

which is the same as

let startAt x =
   fun y -> x + y

In Scheme (or Lisp) you'll use the lambda keyword to make anonymous function:

(define (startAt x) (lambda (y) (+ x y)))

If you are familiar or curious about Lisp, read Queinnec's Lisp In Small Pieces book, which explains all that in great details, with implementation technicalities.

BTW, read SICP. It is explaining the purpose of functional values (hence what closures are) quite well.

A related (and also difficult) notion is continuation.

If you are mostly a web programmer, try HOP or Opa (or perhaps ocsigen). They all use nicely closures and continuations (thru CPS), notably to easily mix browser side and server side computations.


问:
Security and sanitizing user-input with limited control over 'output' targets
I have recently joined a team working on an application with an integrated chat system. It is a standard chat system that allows clients to communicate, with messages routed through a central server.

Usually when dealing with user-input text, it is recommended to 'escape-on-output' instead of 'escape-on-input'. There are numerous examples (1, 2, 3) as to why this is better, but it basically boils down to: you need to sanitize the text depending on the context in which it is used. If inserting a user chat message into a database, you should escape for SQL and use prepared statements. If display the chat message to a web browser, you should escape for HTML. Etc.

Unfortunately, none of the above security concerns were recognized until recently. (Yes, really).

The quick 'hack' solution was to filter user chat messages when received by the server, and strip out any possibly nefarious-looking character (<,>,",',{,},\, etc). This led to a lot of user complaints, since their punctuation would now magically disappear when displaying in the chat channel.

I want to believe that we can do better than this current 'hack', and allow users to type any text they want in a secure environment.

The problem is that I am working with seemingly impossible constraints. We have numerous versions of the client, spread over many devices, thousands of users, and slow adoption rate of new versions. There's lots of fragmentation, and we can't force clients to update.

Management doesn't care too much about user experience, and has basically told me:

Implement a solution to protect against every possible type of
  malicious user-input without having to touch the clients. Oh, and also
  protect against any future 'careless' developer who doesn't know what
  they are doing and might accidentally try to eval() the user chat
  message.

(Yes, I was actually told that last part).

Is there any better solution to this problem that would provide a slightly better user experience?

Thanks for reading.

答:
yes, your manager is right - security flaws don't make themselves, they were all produced by a developer who didn't consider every case. Because software can be complicated, we can all be guilty of this. So you design a system defensively to help prevent us from screwing up. One day some requirement will come in that requires eval, and then..

So, you can strop stripping out any character, and instead just make the input safe for insertion into the DB. This should be simple and easy to verify.

Then you need to change the routines that pull the data out of the DB and sanitise that for the client. If you cannot detect the client application (eg thick client or web) then you'll have to apply a lowest-common denominator to all output, escaping all possibilities.

The important part here is verifying the data, stripping out any character is, as you've found, unhelpful. So determine what the requirements are for making the data safe rather than implementing an overly broad modification. That should be sellable to your boss - you can't tell if its done right if you don't know what right is.


答:
Threading is hard

Sure. It can be. However, people get this idea in their head that it's so hard, such that they don't bother trying to figure it out.

It's not like it's impossible.

Title: What false ideas are there that puts people off using threads?

Body:
Implementing threading in a program is hard, yes, however why is it that some people will not implement them even when there is an obvious need for it.

An example: Program has to load a dataset from a database, the thing to do would be to make the connection and get the data from the database in a worker thread and then load it into the GUI, leaving the GUI thread responsive for the user.

But no, I've talked to people whom seem to think that threads are evil and bad and whatnot and one should avoid them at all costs.  I've even heard that some class instructor advised against to use of threads and therefore did not want cover their use. WHAT???

With the hardware going into multi-core, I think that we need to understand threads better and not be afraid to use them. I find it a fascinating subject personally.

So what are things you've heard about threading that are false?


问:
Post-mortem of a project
Scenario: I've been working for half a year on a small project with a team of two people. They are working in a foreign country, so most of the time we worked via video conference tool.

While those tools work well for providing information, feedback and giving directions, I don't think these are great tools for activities which require more bi-directional and/or longer interaction, whether it is a brainstorming activity or in this case, a project postmortem.

Problem: The project will ends in a few days, and we will not have any face-to-face meeting for another two months. I think that a postmortem should be done quickly after the end of the project, while the project is still present in the team's mind.

Question: What is most important for conducting the postmortem of a project, use a conferencing solutions to perform the postmortem remotely or wait for two months until the team can meet in person?  Secondly, since I have to choose between these two options, how can I mitigate the negative effects of doing it late or doing it through a communication tool?

答:
what is the most important for conducting the postmortem of my project, meeting "physically" or not doing it two months after?

Since you are doing everything over video link (I assume using skype or similar), then you should be quite comfortable doing it that way. The physical presence is not really necessary.

But it is important to conduct it as soon as possible, while you all know what problems in the process you faced, and what needs to be changed.

how can I mitigate the negative effects of doing it late or doing it through a communication tool?

Writing down list of problems, as a reminder, would be a way, if you decide to wait for so long. Or adding // TODO comments in the code, if there wasn't enough time to do refactoring.

I am not aware of negative effects of holding a meeting using a communication tool. I do it weekly using lync, and (except for occasionally bad connection), it works fine. You can share desktop if you need to show something, and you see people.

It may require a bit of additional preparation, like creating additional diagrams, but basically it works as you are in one big room.

Title: Post-mortem of a project


问:
How to debug a program after it appears to fix itself
While chasing a segfault around a complicated and grouchy c++ program I added several //comments and cout statements, but no 'actual' code. Then, suddenly, for no apparent reason the segfault vanishes.

I'm happy, but still a little worried, because I don't think I fixed anything and there was clearly something wrong.

How can I debug a problem that has disappeared? (sadly I don't have a version that's still giving a segfault, any older versions have other problems)

As an aside, do you think I am mistaken in thinking that I have only added //comments and cout statements? Is it more likely that I accidentally altered something else?

答:
Getting a segmentation fault only happens when you have invoked undefined behaviour. And undefined behaviour means that the normal rules of a programming language don't apply: whatever the run-time system does is by definition OK, and you don't get to complain about it. It might even do the expected thing, just to confuse you.

In particular, adding debug statements can change a program so that it raises exceptions where it didn't before, or vice versa. Indeed, this is expected, because detecting memory access violations depends on how precisely things are laid out in memory, and any code you add changes these details.

Therefore, your program was definitely wrong before, and if you don't get exceptions now, it is almost certainly still wrong, only less obviously wrong. It is much more likely that introducing debug messages changed the variety of undefined behaviour you get than that you fixed your logic and didn't notice.


问:
Should updating to a newer library be done incrementally or in one big leap?
The project that I am currently working on is using a library (well, sort of a library, it self-describes as a toolkit, Geant4), that is several versions out of date.

As there are bugs in it, that have been fixed in newer versions, its likely that it will be updated. I may not be asked to do it, but if I am, what's the best strategy, should an update be done all in one leap, or is it better to move forward one version at a time?

A single leap might go quicker, but then again the patch notes only document a step at a time. Is one less likely to get into trouble with incremental updates?

(if you feel that 'library' is the wrong term, feel free to edit)

答:
Small steps are usually useless in this kind of situation. More often than not, the real trouble (if there is any) stems from one particular change that causes you a lot of trouble, not from the accumulation of insignificant changes.

Therefore, doing things step by step will just take you longer to get to the critical point, and leave you less time to deal with it. A middling-large version step at infrequent intervals is usually faster than either tracking everything, or waiting until you no longe runderstand the API.


问:
User and role modeling
I'm working with a system in ASP.NET MVC, with Entity Framework for ORM. The application has a requirements to allow users to have different types of roles, and authorization rules will be different for each role (.e.g. user with role A will be able to see some pages, role B will see some different pages)

In most of the systems that I work with before, this user and role relation will be modeled as:

```<code>public class User
{
    //Omitted properties
    public List<Role> Roles { get; set; }
}

public class Role
{
    //Omitted properties
}
</code>```

However in this system, there are some other requirements that require user to have different properties based on different roles, .e.g. role A user will have property A + B, role B user will have property C + D. Each user, regardless of which role it has, is still be identified by a common id (Active Directory user id). And there might be a situation where an user has more than one role

I'm wondering what's the best way to model this relation. I think of some ways but haven't found one that is good enough:

Approach 1: Each user has a profile that contains properties that are different from role to role:

```<code>public class User
{
    //Omitted properties
    public List<Role> Roles { get; set; }
    public List<UserProfile> Profile { get; set; }
}

public abstract class UserProfile
{
    //Common properties
}

public class RoleAUserProfile : UserProfile
{
    //Omitted properties
}

public class RoleBUserProfile : UserProfile
{
    //Omitted properties
}

public class Role
{
    //Omitted properties
}
</code>```

Problems: difficult to model with EF code first fluent api. I setup with table splitting approach but always have problem with abstract UserProfile and key. Also list of user profiles in User is not clear. When I want to get data for a specific role, need to loop through the list, check one by one

Approach 2: Different user class for different type of role:

```<code>public class User
{
    //Omitted properties
    public List<Role> Roles { get; set; }
}

public class RoleAUser : User
{
    //Omitted properties
}

public class RoleBUser : User
{
    //Omitted properties
}

public class Role
{
    //Omitted properties
}
</code>```

Problems: cannot handle case one user multiple roles. Also the inheritance relationship seems awkward to me

Approach 3: Put everything in one User class:

```<code>public class User
{
    //Omitted properties

    //Role A properties

    //Role B properties

    public List<Role> Roles { get; set; }
}

public class Role
{
    //Omitted properties
}
</code>```

Problems: difficult to maintain when number of properties for each role is large, difficult to use (need to know what properties belong to which roles to use correctly)

Approach 4: Similar to approach 1 but instead of creating new UserProfile, put data directly into different role class itself. Seem awkward to me

Any suggestion to how to model this situation? Maybe I over-complicate things but I haven't found any satisfying solution yet.

答: If a property is dependent only on the User, then it belongs on User; if it depends only on a Role, it belongs on Role. Clearly, if it depends on both User and Role, it belongs on a class that models the intersection of User and Role, i.e. something like Profile. A user can have many profiles; many profiles can refer to the same role, so it's just a normal many-to-many intersection entity.</p>

Title: User and role modeling


问:
OO Design Question - Library/Objects for API which includes id references
Public api:

```<code>getClients / getClientById - returns a json object like:

    { clientid: 1, name: "Client1" }

getProjects / getProjectById - returns a json object like
    { projectid: 5, name: "MyProject", clientid: 1}
</code>```

Question: How do you design a library and set of objects to interact with this API specifically with the problem of how project contains the clientId. What I keep clashing against is that the project object contains a clientid so do I build my project object with just an ID or also a client object i.e

```<code>class Project
{
    int projectId ...
    string name ....

    int clientId....
    Client client // Not sure about this pattern as it wont always be initialized?
}
</code>```

As a couple of solutions/ideas you could:

Force Project to take a Client object in the constructor but now you force a hit to the API before creating a project.

Not have the Client member in Project but now to use the library but does this make the object system harder to use?

Have the project object go grab the client from the API as needed

Concerns

Every time you are in a project object having to do a trip to the public API to get the client name.

When you are in a project object the client reference could be null (if you include it).

If the project knows how to get a client via the API the object now our code is becoming a jumbled mess.

How I handle this up to now

Keep the client and project objects as close to the API definitions as possible and in my API wrapper class build in some caching so I am not as bothered about calling it to get the client everytime I need it. Code is still not great though because it ends up looking like:

```<code>var project = apiWrapper.getProject(5)
out("This project belongs to client " + apiWrapper.getClient(project.clientId)
// note this call to getClient has cahcing in my implemtation
</code>```

答:
Forget about the API to start with. Model your business domain, which means a Project has a Client: not a clientId, a Client.

Then, in the API, translate to and from the model and the external (JSON) view. That's one of the standard responsibilities of the API ("controller") layer. Of course, this approach only really makes sense if you're using an ORM (e.g. Hibernate) that will automate the synchronization and persistence of the model for you.

For create/update use cases, the API layer, or Data Access layer, should translate from IDs to actual objects, e.g. if the JSON Project has a clientId, lookup the Client with that ID and set it on the Project. The ORM itself is unlikely to do this for you: its job is to convert between tables/rows and your object model, not between JSON and your object model. Some app frameworks (e.g. Spring in the Java world) do things like this: parsing JSON and constructing your object model, using a suitable JSON parser. Usually, your JSON library would allow you to markup your code with annotations to specify how to map to/from JSON.

For the query use cases (e.g. getProject) the default JSON serialization should be to include referenced objects, e.g. a Project contains a 'client' property that is a sub-object in JSON format. However, there are 2 reasons to deviate from this and include only the sub-object's ID, not the whole object itself:

Efficiency: if your request rates are very high and/or the sub-object is very large, and the typical client will not always use the sub-object detail

Cycles: in the case where Project refers to Client, but Client also refers back to a list of Projects, you have a cycle. Typically, you can "break" these cycles using your JSON annotations (if any), or exposing only one side of the relationship in your model.


答:
What is most important for conducting the postmortem of a project, use
  a conferencing solutions to perform the postmortem remotely or wait
  for two months until the team can meet in person?

Personally, I think meeting people in person breaks down a lot of barriers and empowers each person to contribute to the discussion. In my own experience, I've seen people in video conferencing get distracted or nod off (no joke) during a conference. I'm sure there are plenty of examples out there where this has worked well, I just haven't encountered any.

While the above is more of a critique on remote conferencing vs face-to-face meetings, I feel you could make use of both for your particular problem with the addition of a few other communication mediums that you haven't mentioned.

First, you could have a conference to highlight the key areas you want to address in the post-mortem to keep the team's attention focused. Secondly, you could employ a wiki for each member to contribute thoughts, ideas, or whatever you want them to put forward. When the time comes to have a meeting in person, you can review the content posted on the wiki. It is important that all team members contribute to this as anyone not doing so is liable to forget or take a while to come back up to speed (depending on the size of the problem and their level of involvement).

The second part of your question on how to mitigate these problems can be addressed in a variety of ways. In your example, I've gone under the assumption the project has followed a waterfall development approach and you are now wanting to review the project. If you follow an agile approach, you can have project retrospectives at the end of each sprint to discuss where the project is heading and things you want to improve.  I've found retrospectives to be extremely important, but most companies I have worked for don't seem to take them very seriously and communication breaks down bringing my team into a situation not too dissimilar from your own.

A supplementary strategy you could employ is to make use of a wiki. Create a post-mortem section for the project and ensure all team members contribute to it and review it.

Remote teamwork is all too common and it's very easy for people to forget there are other people in the same team, working remotely, which is why face-to-face meetings are important to put faces to names and break down barriers. What I believe you want to do is encourage communication within a team by give them as many communication mediums as possible.

Title: Post-mortem of a project

Body:
Scenario: I've been working for half a year on a small project with a team of two people. They are working in a foreign country, so most of the time we worked via video conference tool.

While those tools work well for providing information, feedback and giving directions, I don't think these are great tools for activities which require more bi-directional and/or longer interaction, whether it is a brainstorming activity or in this case, a project postmortem.

Problem: The project will ends in a few days, and we will not have any face-to-face meeting for another two months. I think that a postmortem should be done quickly after the end of the project, while the project is still present in the team's mind.

Question: What is most important for conducting the postmortem of a project, use a conferencing solutions to perform the postmortem remotely or wait for two months until the team can meet in person?  Secondly, since I have to choose between these two options, how can I mitigate the negative effects of doing it late or doing it through a communication tool?


问:
Difference between hotfix and bugfix?
I know this is a very basic question but I cant seem to find the answer with Google. What is the difference between a hotfix and a bugfix? </p>

答:
The term hotfix is generally used when client has found an issue within the current release of the product and can not wait to be fixed until the next big release. Hence a hotfix issue is created to fix it and is released as a part of update to the current release usually called Cumulative Update(CU). CUs are nothing but a bunch of hotfixes together.

Bugfix - We usually use this when an issue is found during the development and testing phase internally.

Title: Difference between hotfix and bugfix?


答:
Small steps will probably cost you more than one large jump. </p>

<p>Remember that for each upgrade of the library, you must perform regression testing (which is never cheap) in addition to relearning the API, and hunting down and fixing all the bugs that may pop up. Contrast this with doing one big jump. Regression testing, API familiarity and bug fixing are still there for the big jump but you do it once instead of twice or more. </p>

Title: Should updating to a newer library be done incrementally or in one big leap?

Body:
The project that I am currently working on is using a library (well, sort of a library, it self-describes as a toolkit, Geant4), that is several versions out of date.

As there are bugs in it, that have been fixed in newer versions, its likely that it will be updated. I may not be asked to do it, but if I am, what's the best strategy, should an update be done all in one leap, or is it better to move forward one version at a time?

A single leap might go quicker, but then again the patch notes only document a step at a time. Is one less likely to get into trouble with incremental updates?

(if you feel that 'library' is the wrong term, feel free to edit)

Body:
Small steps will probably cost you more than one large jump.

Remember that for each upgrade of the library, you must perform regression testing (which is never cheap) in addition to relearning the API, and hunting down and fixing all the bugs that may pop up. Contrast this with doing one big jump. Regression testing, API familiarity and bug fixing are still there for the big jump but you do it once instead of twice or more.


答:
It depends if you have persistent state like a database or runtime configuration, and if you care about retaining that state.  If you do, it's best to do the upgrade in steps, because this is how the developers test and support upgrades.  Occasionally, developers will also support larger upgrades.  Ubuntu's LTS versions are a good example.

If you don't have any state you care to retain, and you're already several versions behind, a "big leap" upgrade is usually cleanest, because the library developers have fixed bugs they introduced and improved interfaces they created in minor versions, but keep in mind that the longer you put it off, the more incompatibilities there will be in your client code.  If you make the big upgrade and all of a sudden have a ton of bugs, you may want to back it out and do it incrementally.


答:
A bugfix is just that: a fix for a bug. This could happen at almost any time in a product's lifetime: during development, during testing, or after release.

A hotfix can be one or more bugfixes. The important part is the hot, which refers to when it is applied. Originally, it referred to patching an actively running system (aka, 'hot'). It's grown to more generally refer to bugfixes provided after the product is released to the public (this could be during public beta testing, too), but outside of the regular update schedule.

Title: Difference between hotfix and bugfix?

Body: I know this is a very basic question but I cant seem to find the answer with Google. What is the difference between a hotfix and a bugfix? </p>


问:
BDD, Cucumber best practices
I'm trying to understand some best practices when it comes to BDD and Cucumber. I've only recently started to use it,
and the first feature I have written a test for is testing a search feature, more specifically how a Repository layer
integrates with a JPA EntityManager that has been injected using the @PersistenceContext annotation. It does this by
creating an EJBContainer using the GlassFish embedded maven dependency and initialising the persistence layer this way.
It works so I'm fairly happy with that.

Now I'm at the stage where I want to start using Selenium with Cucumber to test the search feature of the JSF page. Which
I'm assuming I'll be able to check the contents of a HTML table after the search has been submitted.

Is it possible to use the same feature file with a different steps class that does Selenium testing? Is this a good practice?
At the moment none of this Cucumber stuff feels like unit testing, it all feels like Integration testing!

What I have in mind is something like the following organisation

```<code>test
    |
    java
    |   |
    |   feature
    |       |
    |       web
    |       |  |
    |       |  user
    |       |      UserSearchWebSteps
    |       |      UserAddWebSteps
    |       |      UserDeleteWebSteps
    |       |      UserWebTest
    |       db
    |          |
    |          user
    |              UserSearchDBSteps
    |              UserAddDBSteps
    |              UserDeleteDBSteps
    |              UserDBTest
    resources
        |
        feature
            |
            user
                search_users.feature
                add_user.feature
                delete_user.feature
</code>```

So the steps would be organised at the level of web or db, and then in this example each user step is under that. With
a corresponding runner test class that runs all those steps

And as both the web and db levels expect the same results I'd have shared feature files.

The UserXXXTest would then specify in it's cucumber options where to find the feature file, and because the steps for web
and db are separated at the pacakge level having a step method with the same regexp shouldn't be an issue.

```<code>@RunWith(Cucumber.class)
@CucumberOptions(features =
{
    "src/test/resources/feature/user"
})
public class UserDBTest
{

}
</code>```

答: I believe you've misunderstood a fundamental concept. Behavior Driven Development is not unit testing.  If you're waiting until after you've written your code before you create your feature file, you're doing it wrong. The benefit BDD provides is that you get your business partner to tell you how they will evaluate whether or not the code meets their requirements before you start coding.  And this is expressed as the scenarios in the feature file. Your non-technical business partner should be able to read the scenarios and understand exactly what is being tested. (In fact, if you're really doing it right, the business are writing the feature files as a result of the three amigos meeting.) You should still be unit testing as you code. BDD = does the application perform the way the business expects it to. Unit Testing = does the code perform the way the developer expects it to. There is a subtle but incredibly important difference between those two.

Title: BDD, Cucumber best practices


答:
Segfaults often are affected by whatever garbage happened to be in the memory you're erroneously trying to access.  Adding a cout near the bug can change that.  I've also had bugs that are dependent on what memory location a pointer happened to be assigned to.  Move the pointer by adding "irrelevant" code, and it changes the behavior.

That's why the safest way to debug such problems is using a debugger, because it doesn't change the conditions.  It also happens to be the fastest way, usually instantly giving you the exact line the bug occurs and the exact state of the variables at that point, although the root cause is often an assignment that occurred previously.  And you don't have the overhead of waiting for compiles.  There's really no excuse not to learn how to use a debugger.

Title: How to debug a program after it appears to fix itself

Body:
While chasing a segfault around a complicated and grouchy c++ program I added several //comments and cout statements, but no 'actual' code. Then, suddenly, for no apparent reason the segfault vanishes.

I'm happy, but still a little worried, because I don't think I fixed anything and there was clearly something wrong.

How can I debug a problem that has disappeared? (sadly I don't have a version that's still giving a segfault, any older versions have other problems)

As an aside, do you think I am mistaken in thinking that I have only added //comments and cout statements? Is it more likely that I accidentally altered something else?


答:
It is quite easy to get frustrated with management in these situations but keep in mind that your company only exists to make money. Having a super useful and secure application is not necessarily a worthwhile goal from a manager's point of view.

You have not mentioned in what format the data is pushed to clients but if it is in HTML form then have you considered replacing certain characters with their HTML entity form? Instead of removing them all together. I.e. > becomes > etc. From the client's perspective they will still be able to send and receive non-word characters but without the risk of XSS. This would be my recommendation.

Unfortunately I believe it may be necessary to filter both incoming and outgoing data due to issues such as second order SQL injection whereby data that is not immediately malicious becomes so when it is later retrieved and used in a different context.

It sounds like you may also benefit from educating your manager a little. There is no such thing as 100% secure. A popular approach to thinking about security which I like is that security is not about making your self invulnerable it's about raising the bar to a level where it is no longer worth it for someone to attack you.

Again, it comes back to money. If you can talk to your manager on his level, about how much engineering effort and time (therefore money) it will take to achieve what he is asking then he might cut you some slack. Get him to start thinking about "secure enough" not just "secure".

Title: Security and sanitizing user-input with limited control over 'output' targets

Body:
I have recently joined a team working on an application with an integrated chat system. It is a standard chat system that allows clients to communicate, with messages routed through a central server.

Usually when dealing with user-input text, it is recommended to 'escape-on-output' instead of 'escape-on-input'. There are numerous examples (1, 2, 3) as to why this is better, but it basically boils down to: you need to sanitize the text depending on the context in which it is used. If inserting a user chat message into a database, you should escape for SQL and use prepared statements. If display the chat message to a web browser, you should escape for HTML. Etc.

Unfortunately, none of the above security concerns were recognized until recently. (Yes, really).

The quick 'hack' solution was to filter user chat messages when received by the server, and strip out any possibly nefarious-looking character (<,>,",',{,},\, etc). This led to a lot of user complaints, since their punctuation would now magically disappear when displaying in the chat channel.

I want to believe that we can do better than this current 'hack', and allow users to type any text they want in a secure environment.

The problem is that I am working with seemingly impossible constraints. We have numerous versions of the client, spread over many devices, thousands of users, and slow adoption rate of new versions. There's lots of fragmentation, and we can't force clients to update.

Management doesn't care too much about user experience, and has basically told me:

Implement a solution to protect against every possible type of
  malicious user-input without having to touch the clients. Oh, and also
  protect against any future 'careless' developer who doesn't know what
  they are doing and might accidentally try to eval() the user chat
  message.

(Yes, I was actually told that last part).

Is there any better solution to this problem that would provide a slightly better user experience?

Thanks for reading.

Body:
It is quite easy to get frustrated with management in these situations but keep in mind that your company only exists to make money. Having a super useful and secure application is not necessarily a worthwhile goal from a manager's point of view.

You have not mentioned in what format the data is pushed to clients but if it is in HTML form then have you considered replacing certain characters with their HTML entity form? Instead of removing them all together. I.e. > becomes &gt; etc. From the client's perspective they will still be able to send and receive non-word characters but without the risk of XSS. This would be my recommendation.

Unfortunately I believe it may be necessary to filter both incoming and outgoing data due to issues such as second order SQL injection whereby data that is not immediately malicious becomes so when it is later retrieved and used in a different context.

It sounds like you may also benefit from educating your manager a little. There is no such thing as 100% secure. A popular approach to thinking about security which I like is that security is not about making your self invulnerable it's about raising the bar to a level where it is no longer worth it for someone to attack you.

Again, it comes back to money. If you can talk to your manager on his level, about how much engineering effort and time (therefore money) it will take to achieve what he is asking then he might cut you some slack. Get him to start thinking about "secure enough" not just "secure".


答: Why can't Client also contain its own id value? Then you will always use the Client object (it is, after all, the data you need) whilst still maintaining the id reference to use to uniquely identify that particular client.</p>

Title: OO Design Question - Library/Objects for API which includes id references

Body:
Public api:

```<code>getClients / getClientById - returns a json object like:

    { clientid: 1, name: "Client1" }

getProjects / getProjectById - returns a json object like
    { projectid: 5, name: "MyProject", clientid: 1}
</code>```

Question: How do you design a library and set of objects to interact with this API specifically with the problem of how project contains the clientId. What I keep clashing against is that the project object contains a clientid so do I build my project object with just an ID or also a client object i.e

```<code>class Project
{
    int projectId ...
    string name ....

    int clientId....
    Client client // Not sure about this pattern as it wont always be initialized?
}
</code>```

As a couple of solutions/ideas you could:

Force Project to take a Client object in the constructor but now you force a hit to the API before creating a project.

Not have the Client member in Project but now to use the library but does this make the object system harder to use?

Have the project object go grab the client from the API as needed

Concerns

Every time you are in a project object having to do a trip to the public API to get the client name.

When you are in a project object the client reference could be null (if you include it).

If the project knows how to get a client via the API the object now our code is becoming a jumbled mess.

How I handle this up to now

Keep the client and project objects as close to the API definitions as possible and in my API wrapper class build in some caching so I am not as bothered about calling it to get the client everytime I need it. Code is still not great though because it ends up looking like:

```<code>var project = apiWrapper.getProject(5)
out("This project belongs to client " + apiWrapper.getClient(project.clientId)
// note this call to getClient has cahcing in my implemtation
</code>```


问:
Designing a list class with filtering and sorting
The app I'm developing needs to display lists of items. Simple enough, but there are a number of things which can change based on user input:

Items can be added to/removed from the list.

The items in the list can be updated. Multiple items can be updated simultaneously!

The filters can be updated. Multiple filters can be updated simultaneously!

The sort order of the items can change.

Possibly relevant info:

It's a multiplatform Java app.

One of the platforms we distribute on is MIDP, so that limits which language features/libraries/etc we can use.

The implementation is currently split into a model class (in the common code) and device-specific view/controller classes.

I've tried a couple of approaches to designing a suitable list implementation, but both have drawbacks:

Approach 1:

The platform-specific controller implementations are responsible for calling a refresh() method whenever anything happens which could change the list.

This approach keeps the list class (model) implementation fairly straightforward, but leaves much of the responsibility up to the platform-specific controller implementations. The more logic there is in these classes, the greater the chance of bugs creeping in. It also encourages the controllers to directly notifying the view of updates, which feels like poor design.

Approach 2:

The model is entirely responsible for raising events to notify the platform-specific views of changes. The list items, filter, and sorters notify the model when they change, which then notifies the views of changes.

This keeps the platform-specific classes much simpler, and feels like a stronger design (less coupling between the classes, etc). However, the list class implementation becomes much more complicated.

My main problem with this approach is dealing with a proliferation of events when multiple items/filters are updated in a single operation.

My questions:

Is there other approaches I could/should be trying?

Is there a recognised way to manage/avoid the explosion of events in approach #2?

答:
As you will be continually adding and removing items from the list I'd suggest you use a LinkedList as this provides more efficiency by simply removing reference from the removed item to the next available in the list  - thus preventing the need to move all elements forward. In the case of filtering you could implement the Criteria Design Pattern. First we declare an Interface with a single abstract method:

```<code>public interface Criteria {
   /**
    * abstract method applyFilter
    * @param object to check for
    * @param users
    * @return filtered list
    */
    List<User>applyFilter(Object object, List<User>users);
}
</code>```

Next we create a concrete filter class which implements this interface. For instance we want to filter out all users who are under 25 years of age.

```<code>public class CriteriaAge implements Criteria {

    @Override
    public List<User> applyFilter(Object object, List<User> users) {
        Integer age = (Integer) object;
        List<User>filterList = new ArrayList<>();
        for(User u : users)
            if(u.getAge() < age)
                filterList.add(u);
        return filterList;
    }
}
</code>```

To apply this filter we can do:

// from the Controller (contains the complete list of users from DB)

```<code>Criteria ageCriteria = new CriteriaAge();
</code>```

// populate the View with presented data

```<code>System.out.println(ageCriteria.applyFilter(25));
</code>```

// returns a list of users under 25 and prints this out.

This example uses Model-View-Controller and Filter (Criteria) Design Patterns.

Body:
As you will be continually adding and removing items from the list I'd suggest you use a LinkedList as this provides more efficiency by simply removing reference from the removed item to the next available in the list  - thus preventing the need to move all elements forward. In the case of filtering you could implement the Criteria Design Pattern. First we declare an Interface with a single abstract method:

public interface Criteria {
   /**
    * abstract method applyFilter
    * @param object to check for
    * @param users
    * @return filtered list
    */
    List<User>applyFilter(Object object, List<User>users);
}

Next we create a concrete filter class which implements this interface. For instance we want to filter out all users who are under 25 years of age.

public class CriteriaAge implements Criteria {

    @Override
    public List<User> applyFilter(Object object, List<User> users) {
        Integer age = (Integer) object;
        List<User>filterList = new ArrayList<>();
        for(User u : users)
            if(u.getAge() < age)
                filterList.add(u);
        return filterList;
    }
}

To apply this filter we can do:

// from the Controller (contains the complete list of users from DB)

Criteria ageCriteria = new CriteriaAge();

// populate the View with presented data

System.out.println(ageCriteria.applyFilter(25));

// returns a list of users under 25 and prints this out.

This example uses Model-View-Controller and Filter (Criteria) Design Patterns.


问:
Is anything in programming truly evil?
So, there are a bunch of questions appearing asking is X evil, is Y evil.

My view is that there are no language constructs, algorithms or whatever which are evil, just ones which are badly used.  Hell, if you look hard enough there are even valid uses of goto.

So does absolute evil, that is something which is utterly incompatible with best practice in all instances, exist in programming?  And if so what is it?  Or is it just bad programmers not knowing when something is appropriate?

Edit: To be clear, I'm not talking about things programmers do (such as not checking return codes or not using version control - they're choices made by bad programmers), I mean tools, languages, statements, whatever which are just bad...

答: I'm surprised no one has floated Globals as a true evil.  No better way to be programming in an environment about which you have no idea of the parameters and virtually no control over what happens to them.  Chaos!  I have a strict ban on the use of global variables in all of my coding.</p>

Title: Is anything in programming truly evil?


答:
From my experience in support at a large software company the two terms are unrelated.

Bug fix is an action on the source code, it is a code change or set of changes to address a reported code defect (a bug.)

A hotfix is generally a patch or update for clients / deployed systems but more specifically they are patches which are:-

not released to a schedule.

intended to address either 'niche' situations or 'emergency' responses.

only relevant to the specific issue documented in the release notes.

poorly tested.  If at all.

a potential source for the (re)introduction of bugs.

intended for small audiences.

likely to affect automated patching systems and require additional monitoring.  Hotfixes may deploy a file/library with unusually high version number to prevent the hotfix from being patched over.

supplied by the software maker directly to named contacts, not publically available.  Customers are often expected to contact technical support to request hotfixes for example.

frequently branched from the 'last known good' source tree.  As a 'quick fix' the code used in the hotfix may never make it back into the main build (it may be that as a temporary fix a better solution requires more time/resources.)

Title: Difference between hotfix and bugfix?


答:
I suggest you record the data point values as they come and timestamp them.

```<code>timestamp  point  value
1436285231 A      0
1436285231 B      2
1436285232 A      2
...        ...     ...
</code>```

You will be accumulating 270 Megabytes per 60 hours of data.
If I got my estimates correct :)

((((250*32bits)*100ms)*36000ms)*60hrs) (not including timestamp and any other data you need to store)

To speed up your UI, Average the data per minimum interval that you will allow in your plots, and cache the result.

Title: Approaches for storing and analysing large amounts of time-based data

Body:
I've been asked to develop a "telemetry" application that records data generated by a hardware device, which I read every 100ms.

There are approx 250 data points (32-bit values), but only a subset of these (say 30-50) will be returned by each 100ms read, so it will take several reads before I've got all 250 data points. Out of the data point values read, only a small number are likely to have changed since those same data points were last read - some change every 100ms, others perhaps every few seconds, while others very infrequently (or even never).

The main requirements for the system are:-

The ability to plot one or more data points over time, at 100ms resolution

The ability to view the values of all 250 data points at a particular point in time

The application needs to store the last 60 hours worth of data

I'm looking for some thoughts on how best to tackle this, particularly how to store the data in a way that supports the required reporting. So far I'm veering towards this idea:-

I maintain a "dictionary" of all 250 data points, updating the values after each read. Every 100ms I would write all 250 values to my data store. It's easy to implement and easy to query the data to satisfy the requirements. The downside is that it's not a particularly efficient use of storage (but hey - disk space is cheap nowadays).

Alternatively, ever 100ms, I could store only values that have changed since they were last read, however this becomes more difficult to implement, especially when it comes to querying. E.g. for requirement #2, I would have to construct a "snapshot" by traversing back through the data from the required point in time, looking for each data point's last stored value.

Now I've written all this out I think I've answered my own question. The "write everything" approach seems to be a no-brainer. However I've had no experience of this kind of mass data storage and analysis so I would be interested to hear what others think.

Body:
I suggest you record the data point values as they come and timestamp them.

timestamp  point  value
1436285231 A      0
1436285231 B      2
1436285232 A      2
...        ...     ...

You will be accumulating 270 Megabytes per 60 hours of data.
If I got my estimates correct :)

((((250*32bits)*100ms)*36000ms)*60hrs) (not including timestamp and any other data you need to store)

To speed up your UI, Average the data per minimum interval that you will allow in your plots, and cache the result.