Tag Info

Hot answers tagged

69

You can't, and the more people understand this, and the deeper they understand, the better for the world. Code that runs on a device under the user's control cannot be controlled. Smart phones can be jailbroken. Set-top boxes can be cracked. Ordinary browsers don't even attempt to prevent access to javascript code. It you have something worth stealing or ...


18

The rule here is: Do everything client-side that doesn't affect anyone else if the user tampers with it. In particular, that means graphical effects. Do everything server-side that needs to be secure, and just send UI events from the client (eg. then client just says "the user tapped the Buy button" while the server actually carries out the transaction). ...


13

This is exactly the case where making it a completely client-side application is not appropriate. You can make the logic and basic validation of forms client-side (you still have to revalidate on server, because someone may try to fake the request) to improve responsiveness, you can do HTTP requests from JavaScript passing data there and back in JSON to ...


6

Your primary difficulties I feel are that you have a mismatch between a very linear and custom workflow in an older application that do not coincide with the user interaction workflows that are common on the web. Web applications that interact with a server application that contain the business logic communicate in a Request/Response messaging style. The ...


5

It is difficult to imagine a situation in which being scalable is not important enough to take into consideration when building a web application, however, I imagine it could happen. If you are making a web application in order to try out new technologies, it does not need to be "production ready." Likewise if you know that this is going to be a web ...


4

The description on the Suhosin website is pretty clear, emphasis mine: If you are using PHP only for your own server and only for your own scripts and applications, then you can judge for yourself, if you trust your code enough. In that case you most probably don’t need the Suhosin extension. [...] Even PHP core programmers are writing insecure code from ...


4

In most REST APIs, the type of object is not embedded in the payload. That is the job of the resource resolver. Your "master registrar" is equivalent to the typical path resolver found in web servers, except for using embedded types instead of paths. So instead of your format: POST / { topic: { property1: "value1", property2: ...


3

I'd argue that you really can't. If you're willing to send the data to the client, you must expect that it will be abused - however possible. Your example regarding the API key is illustrative of the point, and I would not include that in your client side JS - it will be stolen and abused. You definitely will still need some amount of server code to keep ...


3

Feedback is crucial to maintaining this relationship I'd advocate for a more collaborative approach to help you work better together with these vendors. If you value the closeness of this relationship, and want to keep it, open lines of communication that help them serve you better are best. Consider the fact that almost nothing works perfectly once it is ...


3

As always in such cases YAGNI (You Ain't Gonna Need It) and KISS (Keep It Simple Stupid) applies. In other words, keep your application as simple as possible, and only add features which are currently needed (don't add features which may be needed in the future). Simple systems are easier to develop, easier to maintain and are often easy to scale.


2

Combine the two ID's together, as in ID="WidgetID_RelativeID" This will guarantee uniqueness.


2

Some client side filtering issues: Cache invalidation. Server side filtering will always operate on up-to-date data, while client caches will have to be updated when data changes. This may be very complex depending on which correctness guarantees you want to have. The future developer will curse this solution. If it doesn't work properly the customers will ...


2

You are right that Class attributes [were originally] meant for CSS, but that doesn't necessarily mean that you cannot also use them as JavaScript hooks. (But some care is required.) According to the HTML4 spec, The class attribute has several roles in HTML: * As a style sheet selector (when an author wishes to assign style information to a set of ...


2

The HTTP spec's definition of POST is very broad. There are two clauses that make it good to treat as the "create" verb. It is the method for "append" to a database It is the method for general "data processing" So for REST, the sense of POST is that it's for appending to a collection of resources. In your example, POST to "/topics" is perfectly valid ...


2

Your middle paragraph is the heart of the problem: Running a client side app means this now needs to happen on a users browser. The third party API provides the necessary js files to achieve this. Why does a client side app mean you cannot have server-side work? The push towards client-side programming isn't about eliminating servers, but ...


2

I recently discovered Intercom, which uses local storage to implement broadcast messaging between windows. Local storage fires an event (onstorage) when data changes, so no polling is necessary. Intercom allows all pages on a domain to communicate, regardless of how they were opened.


1

Let's step back from this and take a higher level look.. shall we.. Did Eudora or outlook (a client side app, not even needing a browser) ever cause a financial loss for any company? No. Anyone could write to the POP/SMTP API's and be the client. But no loss to the server. The server didn't limit client actions, computations, storage, temperature, disk size, ...


1

Software distribution happens when you make a copy of software and give that copy to someone else for their use. If the software remains under your ownership and control and you give it to someone acting as your agent to carry out your instructions that is not distribution. You don't have to list everything and you never could. Just acknowledge a few of the ...


1

You first and third assumptions are solid. You middle assumption "class attributes are meant for CSS and should not be used in JS selectors" is completely, utterly wrong. Granted, there's some structural / separation-of-concerns purity about it. But it rejects the reality and common practice of almost all dynamic JavaScript modification of HTML documents. ...


1

This http://www.unigui.com/ seems relevant. This seems also close https://forums.embarcadero.com/thread.jspa?messageID=510208&tstart=0. I guess your old "business layer" code is written with Borland tools, either C++ or Delphi? Some decade ago I was porting lots of legacy code from 16bit DOS (Turbo Pascal) to 16bit DPMI (Borland Pascal) and to 32bit ...


1

Read up on asynchronous programming It sounds like your original desktop app was tightly coupled with the GUI with functions not continuing until user chooses decisions from popups. The web, and many GUI frameworks, just don't work like this - all operations that may require user input have to provide a delegate/callback so that processing can continue. ...


1

You can't.... easily. Think about this from the user's point of view - why should their query be terminated because someone else is making another request? Fix your query to run faster so the system doesn't grind to a halt when somebody does something unexpected.


1

I believe you are trying to recreate the concept of a database management system the hard way. File I/O combined with parsing and re-parsing your data is what kills your performance. Option 1: Handle the merging yourself a) Put your master "array" into a database as a set of rows in (one or more) table(s). b) Read in your files, and merge the results in ...


1

I thought I'd make a quick comment on your first question: 1) How do you come up with what entities are needed? The first thing I do for a new project is, either on a white board or big blank piece of paper, write down all the physical and conceptual things about that particular project that I and my team can think of. It's a brainstorm session. ...



Only top voted, non community-wiki answers of a minimum length are eligible