Search Results

Search found 8692 results on 348 pages for 'patterns and practices'.

Page 171/348 | < Previous Page | 167 168 169 170 171 172 173 174 175 176 177 178  | Next Page >

• How should I ethically approach user password storage for later plaintext retrieval?

  - by Shane

  As I continue to build more and more websites and web applications I am often asked to store user's passwords in a way that they can be retrieved if/when the user has an issue (either to email a forgotten password link, walk them through over the phone, etc.) When I can I fight bitterly against this practice and I do a lot of ‘extra’ programming to make password resets and administrative assistance possible without storing their actual password. When I can’t fight it (or can’t win) then I always encode the password in some way so that it at least isn’t stored as plaintext in the database—though I am aware that if my DB gets hacked that it won’t take much for the culprit to crack the passwords as well—so that makes me uncomfortable. In a perfect world folks would update passwords frequently and not duplicate them across many different sites—unfortunately I know MANY people that have the same work/home/email/bank password, and have even freely given it to me when they need assistance. I don’t want to be the one responsible for their financial demise if my DB security procedures fail for some reason. Morally and ethically I feel responsible for protecting what can be, for some users, their livelihood even if they are treating it with much less respect. I am certain that there are many avenues to approach and arguments to be made for salting hashes and different encoding options, but is there a single ‘best practice’ when you have to store them? In almost all cases I am using PHP and MySQL if that makes any difference in the way I should handle the specifics. Additional Information for Bounty I want to clarify that I know this is not something you want to have to do and that in most cases refusal to do so is best. I am, however, not looking for a lecture on the merits of taking this approach I am looking for the best steps to take if you do take this approach. In a note below I made the point that websites geared largely toward the elderly, mentally challenged, or very young can become confusing for people when they are asked to perform a secure password recovery routine. Though we may find it simple and mundane in those cases some users need the extra assistance of either having a service tech help them into the system or having it emailed/displayed directly to them. In such systems the attrition rate from these demographics could hobble the application if users were not given this level of access assistance, so please answer with such a setup in mind. Thanks to Everyone This has been a fun questions with lots of debate and I have enjoyed it. In the end I selected an answer that both retains password security (I will not have to keep plain text or recoverable passwords), but also makes it possible for the user base I specified to log into a system without the major drawbacks I have found from normal password recovery. As always there were about 5 answers that I would like to have marked correct for different reasons, but I had to choose the best one--all the rest got a +1. Thanks everyone!

  Read the article

• Where to put a piece of code in Ruby on Rails?

  - by yuval

  I have a post controller that has many comments. The post model has a field called has_comments which is a boolean (so I can quickly select from the database only posts that have comments). To create a new comment for a post, I use the create action of my comments controller. After I create the comment I need to update my post's has_comments field and set it to true. I can update this field from the create action of my comments controller, but that doesn't seem right - I feel that I should really be using the post's update action, but I'm not sure if it's right to call it (via send?) from the create action of the comments controller. Where should the code for updating the post be? Thank you!

  Read the article

• Best practice for near reuse of model components?

  - by Chris Knight

  I have a requirement to use a Fund model in my code. It will contain a fund name and fund code. In the interest of reuse I've poked around the package containing the other models used and found an existing Fund model. However the issue here is that, in addition to fund name and code, it also contains an amount. Amount isn't directly relevant in my context. So, do I: 1) Use the existing Fund model as is, ignoring the setters/getters for fund amount. 2) Put a FundDescription interface onto the existing Fund model for accessing only the information I'm interested in. 3) Make a FundDescription base class from which the existing Fund model could now extend 4) Create a whole new seperate model since the two are slightly contextually different

  Read the article

• Request/Response pattern in SOA implementation

  - by UserControl

  In some enterprise-like project (.NET, WCF) i saw that all service contracts accept a single Request parameter and always return Response: [DataContract] public class CustomerRequest : RequestBase { [DataMember] public long Id { get; set; } } [DataContract] public class CustomerResponse : ResponseBase { [DataMember] public CustomerInfo Customer { get; set; } } where RequestBase/ResponseBase contain common stuff like ErrorCode, Context, etc. Bodies of both service methods and proxies are wrapped in try/catch, so the only way to check for errors is looking at ResponseBase.ErrorCode (which is enumeration). I want to know how this technique is called and why it's better compared to passing what's needed as method parameters and using standard WCF context passing/faults mechanisms?

  Read the article

• Is this a problem typically solved with IOC?

  - by Dirk

  My current application allows users to define custom web forms through a set of admin screens. it's essentially an EAV type application. As such, I can't hard code HTML or ASP.NET markup to render a given page. Instead, the UI requests an instance of a Form object from the service layer, which in turn constructs one using a several RDMBS tables. Form contains the kind of classes you would expect to see in such a context: Form= IEnumerable<FormSections>=IEnumerable<FormFields> Here's what the service layer looks like: public class MyFormService: IFormService{ public Form OpenForm(int formId){ //construct and return a concrete implementation of Form } } Everything works splendidly (for a while). The UI is none the wiser about what sections/fields exist in a given form: It happily renders the Form object it receives into a functional ASP.NET page. A few weeks later, I get a new requirement from the business: When viewing a non-editable (i.e. read-only) versions of a form, certain field values should be merged together and other contrived/calculated fields should are added. No problem I say. Simply amend my service class so that its methods are more explicit: public class MyFormService: IFormService{ public Form OpenFormForEditing(int formId){ //construct and return a concrete implementation of Form } public Form OpenFormForViewing(int formId){ //construct and a concrete implementation of Form //apply additional transformations to the form } } Again everything works great and balance has been restored to the force. The UI continues to be agnostic as to what is in the Form, and our separation of concerns is achieved. Only a few short weeks later, however, the business puts out a new requirement: in certain scenarios, we should apply only some of the form transformations I referenced above. At this point, it feels like the "explicit method" approach has reached a dead end, unless I want to end up with an explosion of methods (OpenFormViewingScenario1, OpenFormViewingScenario2, etc). Instead, I introduce another level of indirection: public interface IFormViewCreator{ void CreateView(Form form); } public class MyFormService: IFormService{ public Form OpenFormForEditing(int formId){ //construct and return a concrete implementation of Form } public Form OpenFormForViewing(int formId, IFormViewCreator formViewCreator){ //construct a concrete implementation of Form //apply transformations to the dynamic field list return formViewCreator.CreateView(form); } } On the surface, this seems like acceptable approach and yet there is a certain smell. Namely, the UI, which had been living in ignorant bliss about the implementation details of OpenFormForViewing, must possess knowledge of and create an instance of IFormViewCreator. My questions are twofold: Is there a better way to achieve the composability I'm after? (perhaps by using an IoC container or a home rolled factory to create the concrete IFormViewCreator)? Did I fundamentally screw up the abstraction here?

  Read the article

• Null and blank values

  - by Jonathan D

  What's the best way of writing robust code so that a variable can be checked for null and blank. e.g. string a; if((a != null) && (a.Length() > 0)) { //do some thing with a }

  Read the article

• Is it ok to throw NotImplemented exception in virtual methods?

  - by Axarydax

  I have a base class for some plugin-style stuff, and there are some methods that are absolutely required to be implemented. I currently declare those in the base class as virtual, for example public virtual void Save { throw new NotImplementedException(); } and in the descendand I have a public override void Save() { //do stuff } Is it a good practice to throw a NotImplementedException there? The descendand classes could for example be the modules for handling different file formats. Thanks

  Read the article

• How to reference a class that implements certain interface?

  - by vikp

  Hi, I have an interface for logging the exceptions, i.e. IExceptionLogger. This interface has 3 implementations: DBExceptionLogger, XMLExceptionLogger, CSVExceptionLogger. I have an application that will make a use of DBExceptionLogger. The application references only IExceptionLogger. How do I create an instance of DBExceptionLogger within the application. I can't reference the DBExceptionLogger directly since it will break the purpose of having IExceptionLogger interface. Thanks

  Read the article

• how to make objects globally accessible?

  - by fayer

  i have this code: class IC_Core { /** * Database * @var IC_Database */ public static $db = NULL; /** * Core * @var IC_Core */ protected static $_instance = NULL; private function __construct() { } public static function getInstance() { if ( ! is_object(self::$_instance)) { self::$_instance = new self(); self::initialize(self::$_instance); } return self::$_instance; } private static function initialize(IC_Core $IC_Core) { self::$db = new IC_Database($IC_Core); } } but when i wanna access IC_Database with: $IC = IC_Core::getInstance(); $IC->db->add() // it says that its not an object. i think the problem lies in self::$db = new IC_Database($IC_Core); but i dont know how to make it work. could someone give me a hand=) thanks!

  Read the article

• Which pattern to use for logging? Dependency Injection or Service Locator?

  - by andlju

  Consider this scenario. I have some business logic that now and then will be required to write to a log. interface ILogger { void Log(string stuff); } interface IDependency { string GetInfo(); } class MyBusinessObject { private IDependency _dependency; public MyBusinessObject(IDependency dependency) { _dependency = dependency; } public string DoSomething(string input) { // Process input var info = _dependency.GetInfo(); var intermediateResult = PerformInterestingStuff(input, info); if (intermediateResult== "SomethingWeNeedToLog") { // How do I get to the ILogger-interface? } var result = PerformSomethingElse(intermediateResult); return result; } } How would you get the ILogger interface? I see two main possibilities; Pass it using Dependency Injection on the constructor. Get it via a singleton Service Locator. Which method would you prefer, and why? Or is there an even better pattern? Update: Note that I don't need to log ALL method calls. I only want to log a few (rare) events that may or may not occur within my method.

  Read the article

• Does database affect classes?

  - by satyanarayana

  I had created one class User and UserDAOImpl class for querying DB using class User. As there is one table to be queried, these two classes are sufficient for me. What if there is a case where new fields are to be added to that one table is to be divided into 3 tables( user_info, user_profile and user_address) to store user? As new fields are added, I need to change classes User and UserDAOImpl, it seems these two are not sufficient. It seems database changes affect my classes. In this case, do I need to divide class User into 3 classes as tables are changes? Can any one suggest me how can I solve this without making too many changes?

  Read the article

• #Define Compiler Directive in C#

  - by pm_2

  In C, I could declare a compiler directive as follows: #define MY_NUMBER 10 However, in C#, I only appear to be able to do this: #define MY_NUMBER Which is obviously useless in this case. Is this correct, or am I doing something wrong? If not, can anyone suggest a way of doing this, either at namespace or solution level? I thought of maybe creating a static class, but that seems to be overkill for one value.

  Read the article

• Lock thread using somthing other than a object

  - by Scott Chamberlain

  when using a lock does the thing you are locking on have to be a object. For example is this legal static DateTime NextCleanup = DateTime.Now; const TimeSpan CleanupInterval = new TimeSpan(1, 0, 0); private static void DoCleanup() { lock ((object)NextCleanup) { if (NextCleanup < DateTime.Now) { NextCleanup = DateTime.Now.Add(CleanupInterval); System.Threading.ThreadPool.QueueUserWorkItem(new System.Threading.WaitCallback(cleanupThread)); } } return; } EDIT-- From reading SLaks' responce I know the above code would be not valid but would this be? static MyClass myClass = new MyClass(); private static void DoCleanup() { lock (myClass) { // } return; }

  Read the article

• C# Design Reduce a Long List of Methods

  - by guazz

  I have a simple application that loads data from an XML file to a database. public class EmployeeLoader() { public void LoadEmpoyees() {...} public void LoadSalaries() {...} public void LoadRegistrationData() {...} public void LoadTaxData() {...} } Is it a good idea to have multiple "Load" methods as this looks like a code smell as I have about tweney Load methods? If so, how do I make my code more readable? Each Load method loads data to the corresponding table in the database via a repository?

  Read the article

• Should every class have its own namespace?

  - by thehouse

  Something that has been troubling me for a while: The current wisdom is that types should be kept in a namespace that only contains functions which are part of the type's non-member interface (see C++ Coding Standards Sutter and Alexandrescu or here) to prevent ADL pulling in unrelated definitions. Does this imply that all classes must have a namespace of their own? If we assume that a class may be augmented in the future by the addition of non-member functions, then it can never be safe to put two types in the same namespace as either one of them may introduce non-member functions that could interfere with the other. The reason I ask is that namespaces are becoming cumbersome for me. I'm writing a header-only library and I find myself using classes names such as project::component::class_name::class_name. Their implementations call helper functions but as these can't be in the same namespace they also have to be fully qualified!

  Read the article

• In Java how instance of and type cast(i.e (ClassName)) works on proxy object ?

  - by learner

  Java generates a proxy class for a given interface and provides the instance of the proxy class. But when we type cast the proxy object to our specific Object, how java handles this internally? Is this treated as special scenario? For example I have class 'OriginalClass' and it implements 'OriginalInterface', when I create proxy object by passing 'OriginalInterface' interface java created proxy class 'ProxyClass' using methods in the provided interface and provides object of this class(i.e ProxyClass). If my understanding is correct then can you please answer following queries 1) When I type cast object of ProxyClass to my class OriginalClass this works, but how java is allowing this? Same in case of instace of? 2) As my knowledge java creates a proxy class only with the methods, but what happen when I try to access attributes on this object? 3) Only interface methods are getting implemented in Proxy, but what happens when I try to access a method which not in interface and only mentioned in the class? Thanks, Student

  Read the article

• It is good programming practice to always check for null pointers before using an object in C++?

  - by jm1234567890

  This seems like a lot of work; to check for null each time an object is used. I have been advised that it is a good idea to check for null pointers so you don't have to spend time looking for where segmentation faults occur. Just wondering what the community here thinks?

  Read the article

• What pattern to use in this scenario?

  - by jess

  Hi, We have got many forms(windows app C#) in our application.We have similar steps in most of them - user adds a new object(in a grid),fills values and save.On,save,we validate,and save if everything ok,else show message.Now,adding of object usually means we add a new row with some default values.

  Read the article

• Finding relative libraries when using symlinks to ruby executables

  - by dgtized

  Imagine you have an executable foo.rb, with libraries bar.rb layed out in the following manner: <root>/bin/foo.rb <root>/lib/bar.rb In the header of foo.rb you place the following require to bring in functionality in bar.rb: require File.dirname(__FILE__)+"../lib/bar.rb" This works fine so long as all calls to foo.rb are direct. If you put as say $HOME/project, and symlink foo.rb into $HOME/usr/bin, then __FILE__ resolves to $HOME/usr/bin/foo.rb, and is thus unable to locate bar.rb in relation to the dirname for foo.rb. I realize that packaging systems such as rubygems fix this by creating a namespace to search for the library, and that it is also possible to adjust the load_path using $: to include $HOME/project/lib, but it seems as if a more simple solution should exist. Has anyone had experience with this problem and found a useful solution or recipe?

  Read the article

• What is the role of the Router Object in MVC based frameworks

  - by Saif Bechan

  In most MVC based framework I see a router object. If I look at it splits up the uri and decides what controller should be used, and which action should be fired. Even though this makes a lot of sense, I can not give this a place in the MVC patern. Is splitting up the uri not the job of the controller. And then the controller should just decide which class and function to run.

  Read the article

• How are partial methods used in C# 3.0?

  - by Eric Z Beard

  I have read about partial methods in the latest C# language specification, so I understand the principles, but I'm wondering how people are actually using them. Is there a particular design pattern that benefits from partial methods?

  Read the article

• Are upper bounds of indexed ranges always assumed to be exclusive?

  - by polygenelubricants

  So in Java, whenever an indexed range is given, the upper bound is almost always exclusive. From java.lang.String: substring(int beginIndex, int endIndex) Returns a new string that is a substring of this string. The substring begins at the specified beginIndex and extends to the character at index endIndex - 1 From java.util.Arrays: copyOfRange(T[] original, int from, int to) from - the initial index of the range to be copied, inclusive to - the final index of the range to be copied, exclusive. From java.util.BitSet: set(int fromIndex, int toIndex) fromIndex - index of the first bit to be set. toIndex - index after the last bit to be set. As you can see, it does look like Java tries to make it a consistent convention that upper bounds are exclusive. My questions are: Is this the official authoritative recommendation? Are there notable violations that we should be wary of? Is there a name for this system? (ala "0-based" vs "1-based")

  Read the article

• Number of characters recommended for a statement

  - by liaK

  Hi, I have been using Qt 4.5 and so do C++. I have been told that it's a standard practice to maintain the length of each statement in the application to 80 characters. Even in Qt creator we can make a right border visible so that we can know whether we are crossing the 80 characters limit. But my question is, Is it really a standard being followed? Because in my application, I use indenting and all, so it's quite common that I cross the boundary. Other cases include, there might be a error statement which will be a bit explanatory one and which is in an inner block of code, so it too will cross the boundary. Usually my variable names look bit lengthier so as to make the names meaningful. When I call the functions of the variable names, again I will cross. Function names will not be in fewer characters either. I agree a horizontal scroll bar shows up and it's quite annoying to move back and forth. So, for function calls including multiple arguments, when the boundary is reached I will make the forth coming arguments in the new line. But besides that, for a single statement (for e.g a very long error message which is in double quotes " " or like longfun1()->longfun2()->...) if I use an \ and split into multiple lines, the readability becomes very poor. So is it a good practice to have those statement length restrictions? If this restriction in statement has to be followed? I don't think it depends on a specific language anyway. I added C++ and Qt tags since if it might. Any pointers regarding this are welcome.

  Read the article

• best practice when referring to a program's name in C

  - by guest

  what is considered best practice when referring to a program's name? i've seen #define PROGRAM_NAME "myprog" printf("this is %s\n", PROGRAM_NAME); as well as printf("this is %s\n", argv[0]); i know, that the second approach will give me ./myprog rather than myprog when the program is not called from $PATH and that the first approach will guarantee consistence regarding the program's name. but is there anything else, that makes one approach superior to the other?

  Read the article

• Should I use block identifiers ("end;") in my code?

  - by JosephStyons

  Code Complete says it is good practice to always use block identifiers, both for clarity and as a defensive measure. Since reading that book, I've been doing that religiously. Sometimes it seems excessive though, as in the case below. Is Steve McConnell right to insist on always using block identifiers? Which of these would you use? //naughty and brief with myGrid do for currRow := FixedRows to RowCount - 1 do if RowChanged(currRow) then if not(RecordExists(currRow)) then InsertNewRecord(currRow) else UpdateExistingRecord(currRow); //well behaved and verbose with myGrid do begin for currRow := FixedRows to RowCount - 1 do begin if RowChanged(currRow) then begin if not(RecordExists(currRow)) then begin InsertNewRecord(currRow); end //if it didn't exist, so insert it else begin UpdateExistingRecord(currRow); end; //else it existed, so update it end; //if any change end; //for each row in the grid end; //with myGrid

  Read the article

< Previous Page | 167 168 169 170 171 172 173 174 175 176 177 178  | Next Page >