Search Results

Search found 13692 results on 548 pages for 'bad practices'.

Page 138/548 | < Previous Page | 134 135 136 137 138 139 140 141 142 143 144 145  | Next Page >

• How should I ethically approach user password storage for later plaintext retrieval?

  - by Shane

  As I continue to build more and more websites and web applications I am often asked to store user's passwords in a way that they can be retrieved if/when the user has an issue (either to email a forgotten password link, walk them through over the phone, etc.) When I can I fight bitterly against this practice and I do a lot of ‘extra’ programming to make password resets and administrative assistance possible without storing their actual password. When I can’t fight it (or can’t win) then I always encode the password in some way so that it at least isn’t stored as plaintext in the database—though I am aware that if my DB gets hacked that it won’t take much for the culprit to crack the passwords as well—so that makes me uncomfortable. In a perfect world folks would update passwords frequently and not duplicate them across many different sites—unfortunately I know MANY people that have the same work/home/email/bank password, and have even freely given it to me when they need assistance. I don’t want to be the one responsible for their financial demise if my DB security procedures fail for some reason. Morally and ethically I feel responsible for protecting what can be, for some users, their livelihood even if they are treating it with much less respect. I am certain that there are many avenues to approach and arguments to be made for salting hashes and different encoding options, but is there a single ‘best practice’ when you have to store them? In almost all cases I am using PHP and MySQL if that makes any difference in the way I should handle the specifics. Additional Information for Bounty I want to clarify that I know this is not something you want to have to do and that in most cases refusal to do so is best. I am, however, not looking for a lecture on the merits of taking this approach I am looking for the best steps to take if you do take this approach. In a note below I made the point that websites geared largely toward the elderly, mentally challenged, or very young can become confusing for people when they are asked to perform a secure password recovery routine. Though we may find it simple and mundane in those cases some users need the extra assistance of either having a service tech help them into the system or having it emailed/displayed directly to them. In such systems the attrition rate from these demographics could hobble the application if users were not given this level of access assistance, so please answer with such a setup in mind. Thanks to Everyone This has been a fun questions with lots of debate and I have enjoyed it. In the end I selected an answer that both retains password security (I will not have to keep plain text or recoverable passwords), but also makes it possible for the user base I specified to log into a system without the major drawbacks I have found from normal password recovery. As always there were about 5 answers that I would like to have marked correct for different reasons, but I had to choose the best one--all the rest got a +1. Thanks everyone!

  Read the article

• Should I use block identifiers ("end;") in my code?

  - by JosephStyons

  Code Complete says it is good practice to always use block identifiers, both for clarity and as a defensive measure. Since reading that book, I've been doing that religiously. Sometimes it seems excessive though, as in the case below. Is Steve McConnell right to insist on always using block identifiers? Which of these would you use? //naughty and brief with myGrid do for currRow := FixedRows to RowCount - 1 do if RowChanged(currRow) then if not(RecordExists(currRow)) then InsertNewRecord(currRow) else UpdateExistingRecord(currRow); //well behaved and verbose with myGrid do begin for currRow := FixedRows to RowCount - 1 do begin if RowChanged(currRow) then begin if not(RecordExists(currRow)) then begin InsertNewRecord(currRow); end //if it didn't exist, so insert it else begin UpdateExistingRecord(currRow); end; //else it existed, so update it end; //if any change end; //for each row in the grid end; //with myGrid

  Read the article

• One class per file rule in .NET?

  - by Joan Venge

  I follow this rule but some of my colleagues disagree with it and argue that if a class is smaller it can be left in the same file with other class(es). Another argument I hear all the time is "Even Microsoft don't do this, so why should we?" What's the general consensus on this? Are there cases where this should be avoided?

  Read the article

• Where to put a piece of code in Ruby on Rails?

  - by yuval

  I have a post controller that has many comments. The post model has a field called has_comments which is a boolean (so I can quickly select from the database only posts that have comments). To create a new comment for a post, I use the create action of my comments controller. After I create the comment I need to update my post's has_comments field and set it to true. I can update this field from the create action of my comments controller, but that doesn't seem right - I feel that I should really be using the post's update action, but I'm not sure if it's right to call it (via send?) from the create action of the comments controller. Where should the code for updating the post be? Thank you!

  Read the article

• Finding relative libraries when using symlinks to ruby executables

  - by dgtized

  Imagine you have an executable foo.rb, with libraries bar.rb layed out in the following manner: <root>/bin/foo.rb <root>/lib/bar.rb In the header of foo.rb you place the following require to bring in functionality in bar.rb: require File.dirname(__FILE__)+"../lib/bar.rb" This works fine so long as all calls to foo.rb are direct. If you put as say $HOME/project, and symlink foo.rb into $HOME/usr/bin, then __FILE__ resolves to $HOME/usr/bin/foo.rb, and is thus unable to locate bar.rb in relation to the dirname for foo.rb. I realize that packaging systems such as rubygems fix this by creating a namespace to search for the library, and that it is also possible to adjust the load_path using $: to include $HOME/project/lib, but it seems as if a more simple solution should exist. Has anyone had experience with this problem and found a useful solution or recipe?

  Read the article

• Why cast null before checking if object is equal to null?

  - by jacerhea

  I was looking through the "Domain Oriented N-Layered .NET 4.0 Sample App" project and ran across some code that I do not understand. In this project they often use syntax like the following to check arguments for null: public GenericRepository(IQueryableContext context,ITraceManager traceManager) { if (context == (IQueryableContext)null) throw new ArgumentNullException("context", Resources.Messages.exception_ContainerCannotBeNull); Why would you cast null to the type of the object you are checking for null?

  Read the article

• Best practice for near reuse of model components?

  - by Chris Knight

  I have a requirement to use a Fund model in my code. It will contain a fund name and fund code. In the interest of reuse I've poked around the package containing the other models used and found an existing Fund model. However the issue here is that, in addition to fund name and code, it also contains an amount. Amount isn't directly relevant in my context. So, do I: 1) Use the existing Fund model as is, ignoring the setters/getters for fund amount. 2) Put a FundDescription interface onto the existing Fund model for accessing only the information I'm interested in. 3) Make a FundDescription base class from which the existing Fund model could now extend 4) Create a whole new seperate model since the two are slightly contextually different

  Read the article

• How to avoid nested functions when using AJAX?

  - by Fletcher Moore

  Sequential Asynchronous calls are gross. Is there a more readable solution? The problem is this is hard to follow: ajaxOne(function() { // do something ajaxTwo(function() { // do something ajaxThree() }); }); where the anonymous functions are callbacks that are called on server response. I'm using a third party API to make the AJAX calls, so I need a generic solution.

  Read the article

• Hibernate many-to-one - bad usage?

  - by DaveA

  Just trying out Hibernate (with Annotations) and I'm having problems with my mappings. I have two entity classes, AudioCD and Artist. @Entity public class AudioCD implements CatalogItem { @Id @GeneratedValue(strategy = GenerationType.AUTO) private int id; private String title; @ManyToOne(cascade = { CascadeType.ALL }, optional = false) private Artist artist; .... } @Entity @Table(uniqueConstraints = { @UniqueConstraint(columnNames = { "name" }) }) public class Artist { @Id @GeneratedValue(strategy = GenerationType.AUTO) private int id; @Column(nullable = false) private String name; ..... } I get AudioCD objects from an external source. When I try to persist the AudioCD the Artist gets persisted as well, just like I want to happen. If I try persisting another different CD, but Artist already exists I get errors due to constraint violations. I want Hibernate to recognise that the Artist already exists and shouldn't be inserted again. Can this be done via annotations? Or do I have to manage the persistence of the AudioCD and Artist seperately?

  Read the article

• It is good programming practice to always check for null pointers before using an object in C++?

  - by jm1234567890

  This seems like a lot of work; to check for null each time an object is used. I have been advised that it is a good idea to check for null pointers so you don't have to spend time looking for where segmentation faults occur. Just wondering what the community here thinks?

  Read the article

• Null and blank values

  - by Jonathan D

  What's the best way of writing robust code so that a variable can be checked for null and blank. e.g. string a; if((a != null) && (a.Length() > 0)) { //do some thing with a }

  Read the article

• 'EXC_BAD_ACCESS' When trying to access a variable?

  - by Nick Brooks

  I get an 'EXC_BAD_ACCESS' error when trying to access variable in a function other than the one it was set in: NSLog(@"Commening search (%@)",sessionID); // This causes it The variable is set in the 'awakeFromNib' function: //Retrieve Session-ID sessionID = [self getSessionID]; The variable itself is defined in the header: NSString *sessionID;

  Read the article

• Asynchronous SQL Operations

  - by Paul Hatcherian

  I've got a problem I'm not sure how best to solve. I have an application which updates a database in response to ad hoc requests. One request in particular is quite common. The request is an update that by itself is quite simple, but has some complex preconditions. For this request the business layer first requests a set of data from the data layer. The business logic layer evaluated the data from the database and parameters from the request, from this the action to be performed is determined, and the request's response message(s) are created. The business layer now executes the actual update command that is the purpose of the request. This last step is the problem, this command is dependent on the state of the database, which might have changed since the business logic ran. Locking down the data read in this operation across several round-trips to the database doesn't seem like a good idea either. Is there a 'best-practice' way to accomplish something like this? Thanks!

  Read the article

• Building a life-critical System using Agile

  - by Ben Breen

  Looking at the general trend of comments in my question about Building an Aircraft using Agile, the biggest problem other than cost appears to be safety. Do people feel that it is not possible to build a safe system (or prove it is safe) using agile? Doesn’t all the iterative testing mitigate this? Is it likely that a piece of software developed using agile will never be as reliable as counterparts such as waterfall?

  Read the article

• Could this be considered a well-written PHP5 class?

  - by Ben Dauphinee

  I have been learning OOP principals on my own for a while, and taken a few cracks at writing classes. What I really need to know now is if I am actually using what I have learned correctly, or if I could improve as far as OOP is concerned. I have chopped a massive portion of code out of a class that I have been working on for a while now, and pasted it here. To all you skilled and knowledgeable programmers here I ask: Am I doing it wrong? class acl extends genericAPI{ // -- Copied from genericAPI class protected final function sanityCheck($what, $check, $vars){ switch($check){ case 'set': if(isset($vars[$what])){return(1);}else{return(0);} break; } } // --------------------------------- protected $db = null; protected $dataQuery = null; public function __construct(Zend_Db_Adapter_Abstract $db, $config = array()){ $this->db = $db; if(!empty($config)){$this->config = $config;} } protected function _buildQuery($selectType = null, $vars = array()){ // Removed switches for simplicity sake $this->dataQuery = $this->db->select( )->from( $this->config['table_users'], array('tf' => '(CASE WHEN count(*) > 0 THEN 1 ELSE 0 END)') )->where( $this->config['uidcol'] . ' = ?', $vars['uid'] ); } protected function _sanityRun_acl($sanitycheck, &$vars){ switch($sanitycheck){ case 'uid_set': if(!$this->sanityCheck('uid', 'set', $vars)){ throw new Exception(ERR_ACL_NOUID); } $vars['uid'] = settype($vars['uid'], 'integer'); break; } } private function user($action = null, $vars = array()){ switch($action){ case 'exists': $this->_sanityRun_acl('uid_set', $vars); $this->_buildQuery('user_exists_idcheck', $vars); return($this->db->fetchOne($this->dataQuery->__toString())); break; } } public function user_exists($uid){ return($this->user('exists', array('uid' => $uid))); } } $return = $acl_test->user_exists(1);

  Read the article

• Reference table values in a war against magic numbers

  - by Alex N.

  This question bugged me for years now and can't seem to find good solution still. I working in PHP and Java but it sounds like this maybe language-agnostic :) Say we have a standard status reference table that holds status ids for some kind of entity. Further let's assume the table will have just 5 values, and will remain like this for a long time, maybe edited occasionally with addition of a new status. When you fetch a row and need to see what status it is you have 2 options(as I see it at least) - put it straight ID values(magic numbers that is) or use a named constant. Latter seem much cleaner, the question though is where those named constants should leave? In a model class? In a class that uses this particular constant? Somewhere else?

  Read the article

• Is it a good idea to define a variable in a local block for a case of a switch statement?

  - by Paperflyer

  I have a rather long switch-case statement. Some of the cases are really short and trivial. A few are longer and need some variables that are never used anywhere else, like this: switch (action) { case kSimpleAction: // Do something simple break; case kComplexAction: { int specialVariable = 5; // Do something complex with specialVariable } break; } The alternative would be to declare that variable before going into the switch like this: int specialVariable = 5; switch (action) { case kSimpleAction: // Do something simple break; case kComplexAction: // Do something complex with specialVariable break; } This can get rather confusing since it is not clear to which case the variable belongs and it uses some unnecessary memory. However, I have never seen this usage anywhere else. Do you think it is a good idea to declare variables locally in a block for a single case?

  Read the article

• Which user account to assign as owner when attaching an SQL Server database?

  - by FreshCode

  This is a simple database security & performance question, but I've always used either a special user (eg. mydbuser), or Windows' built-in NETWORK SECURITY account as the owner when attaching databases to my SQL Server instances. When deploying my database to a production server, is there a specific user I should stick to or avoid? I would think that using an account with a set password could open the database up to a potential security issue.

  Read the article

• Python-based password tracker (or dictionary)

  - by Arrieta

  Hello: Where we work we need to remember about 10 long passwords which need to change every so often. I would like to create a utility which can potentially save these passwords in an encrypted file so that we can keep track of them. I can think of some sort of dictionary passwd = {'host1':'pass1', 'host2':'pass2'}, etc, but I don't know what to do about encryption (absolutely zero experience in the topic). So, my question is really two questions: Is there a Linux-based utility which lets you do that? If you were to program it in Python, how would you go about it? A perk of approach two, would be for the software to update the ssh public keys after the password has been changed (you know the pain of updating ~15 tokens once you change your password). As it can be expected, I have zero control over the actual network configuration and the management of scp keys. I can only hope to provide a simple utility to me an my very few coworkers so that, if we need to, we can retrieve a password on demand. Cheers.

  Read the article

• Is it good practice to initialize array in C/C++?

  - by sand

  I recently encountered a case where I need to compare two files (golden and expected) for verification of test results and even though the data written to both the files were same, the files does not match. On further investigation, I found that there is a structure which contains some integers and a char array of 64 bytes, and not all the bytes of char array were getting used in most of the cases and unused fields from the array contain random data and that was causing the mismatch. This brought me ask the question whether it is good practice to initialize the array in C/C++ as well, as it is done in Java?

  Read the article

• Where do I put the Current user query so as to not repeat per controller?

  - by Kevin

  I have a standard query that gets the current user object: @user = User.find_by_email(session[:email]) but I'm putting it as the first line in every single controller action which is obviously not the best way to do this. What is the best way to refactor this? Do I put this as a method in the Application controller (and if so, can you just show me a quick example)? Do I put the entire @user object into the session (has about 50 columns and some sensitive ones like is_admin)? Or is there another way to remove this kind of redundancy?

  Read the article

• boost.asio's socket's recieve/send functions are bad?

  - by the_drow

  Data may be read from or written to a connected TCP socket using the receive(), async_receive(), send() or async_send() member functions. However, as these could result in short writes or reads, an application will typically use the following operations instead: read(), async_read(), write() and async_write(). I don't really understand that remark as read(), async_read(), write() and async_write() can also end up in short writes or reads, right? Why are those functions not the same? Should I use them at all? Can someone clarify that remark for me?

  Read the article

• Why doesn't String's hashCode() cache 0?

  - by polygenelubricants

  I noticed in the Java 6 source code for String that hashCode only caches values other than 0. The difference in performance is exhibited by the following snippet: public class Main{ static void test(String s) { long start = System.currentTimeMillis(); for (int i = 0; i < 10000000; i++) { s.hashCode(); } System.out.format("Took %d ms.%n", System.currentTimeMillis() - start); } public static void main(String[] args) { String z = "Allocator redistricts; strict allocator redistricts strictly."; test(z); test(z.toUpperCase()); } } Running this in ideone.com gives the following output: Took 1470 ms. Took 58 ms. So my questions are: Why doesn't String's hashCode() cache 0? What is the probability that a Java string hashes to 0? What's the best way to avoid the performance penalty of recomputing the hash value every time for strings that hash to 0? Is this the best-practice way of caching values? (i.e. cache all except one?) For your amusement, each line here is a string that hash to 0: pollinating sandboxes amusement & hemophilias schoolworks = perversive electrolysissweeteners.net constitutionalunstableness.net grinnerslaphappier.org BLEACHINGFEMININELY.NET WWW.BUMRACEGOERS.ORG WWW.RACCOONPRUDENTIALS.NET Microcomputers: the unredeemed lollipop... Incentively, my dear, I don't tessellate a derangement. A person who never yodelled an apology, never preened vocalizing transsexuals.

  Read the article

• Comparing objects and inheritance

  - by ereOn

  Hi, In my program I have the following class hierarchy: class Base // Base is an abstract class { }; class A : public Base { }; class B : public Base { }; I would like to do the following: foo(const Base& one, const Base& two) { if (one == two) { // Do something } else { // Do something else } } I have issues regarding the operator==() here. Of course comparing an instance A and an instance of B makes no sense but comparing two instances of Base should be possible. (You can't compare a Dog and a Cat however you can compare two Animals) I would like the following results: A == B = false A == A = true or false, depending on the effective value of the two instances B == B = true or false, depending on the effective value of the two instances My question is: is this a good design/idea ? Is this even possible ? What functions should I write/overload ? My apologies if the question is obviously stupid or easy, I have some serious fever right now and my thinking abilities are somewhat limited :/ Thank you.

  Read the article

• Are upper bounds of indexed ranges always assumed to be exclusive?

  - by polygenelubricants

  So in Java, whenever an indexed range is given, the upper bound is almost always exclusive. From java.lang.String: substring(int beginIndex, int endIndex) Returns a new string that is a substring of this string. The substring begins at the specified beginIndex and extends to the character at index endIndex - 1 From java.util.Arrays: copyOfRange(T[] original, int from, int to) from - the initial index of the range to be copied, inclusive to - the final index of the range to be copied, exclusive. From java.util.BitSet: set(int fromIndex, int toIndex) fromIndex - index of the first bit to be set. toIndex - index after the last bit to be set. As you can see, it does look like Java tries to make it a consistent convention that upper bounds are exclusive. My questions are: Is this the official authoritative recommendation? Are there notable violations that we should be wary of? Is there a name for this system? (ala "0-based" vs "1-based")

  Read the article

< Previous Page | 134 135 136 137 138 139 140 141 142 143 144 145  | Next Page >