2,701 reputation
2819
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 4 years, 4 months
seen yesterday

May
16
comment Coding: conciseness/efficiency vs readability
I hope the SecondToken function is a joke.
May
14
comment c# naming - What are common conventions for a suffix to distinguish between read-only and writable interfaces
@KChaloux The latter is a wrapper and can still change its contents through the underlying collection. So it's only readonly, not immutable.
May
14
revised c# naming - What are common conventions for a suffix to distinguish between read-only and writable interfaces
added 15 characters in body
May
14
answered c# naming - What are common conventions for a suffix to distinguish between read-only and writable interfaces
May
14
comment c# naming - What are common conventions for a suffix to distinguish between read-only and writable interfaces
The O in ReadOnly should be uppercase to fit with the existing readonly collections in .NET.
May
11
comment Standard ways of revoking user access to a site
The cookie should consist of a random 128 bit value stored in its own table. That way you can revoke it by deleting it, and a user can have multiple sessions at the same time. Alternatively you can look at whatever session support is built into ASP.NET.
May
10
comment Standard ways of revoking user access to a site
Clearing the cookie isn't even necessary as long as you check in the db if the cookie is valid.
May
8
comment How to “neutralize” those who write bad code on the team?
Guns. Lots of them.
May
8
comment How to extend Constructor Injection?
Adding a required dependency is a breaking change, no matter how you inject that dependency.
May
7
comment How to show to management that unit testing is cheaper in the long run than manual testing?
I think unit testing argument validation just so you get to 100% coverage is very little value for the effort. Doing so may be worthwhile when building a high quality library (like the BCL), but I wouldn't do so in an application.
May
7
comment What has research shown about the effectiveness of comments?
Why have an example code as comment instead of as actual executable code?
May
2
revised If null is bad, why do modern languages implement it?
added 419 characters in body
May
2
answered If null is bad, why do modern languages implement it?
Apr
20
comment Browser security and payments
Even with TLS you need to trust the server which delivers the javascript. This problem can only be solved by improving browsers and even then only in part. For example if a shop website embeds javascript from an ad server it trusts, but the ad server is actually malicious (perhaps it was hacked) that server can send a copy of the CC data to the hacker.
Apr
20
comment Browser security and payments
First one is about code style, second is just as bad for native code. Only the lack of secure erase is a real issue, and one with little relevance to credit cards since it this only matters when the client gets compromised later on. The biggest issue IMO is how common it is to embed external javascript instead of serving it from your own. SSL is good enough for low value targets like CC numbers, but might not be good enough for liberationtech.
Apr
20
comment Browser security and payments
The point of these posts is that javascript cryto doesn't add any security over https -- not that https is insecure. In particular javascript crypto without https is not secure, and javascript crypto over https doesn't protect you from a malicious server. There are people who claim they don't need https or that they're safe from malicious server, which is not true.
Apr
17
comment How to design an IDisposable that unconditionally needs to be disposed?
"Eventually" is "once the app domain is shut down" in this case. So it's a memory leak if you don't dispose it manually.
Apr
16
comment How would another popular language avoid having to use the factory pattern while managing similar complexity as in Java/Java EE?
The problem isn't the use of factories -- it's a perfectly fine pattern. It's the overuse of factories which is especially prevalent in the enterprisey java world.
Apr
7
comment Real time unit testing - or “how to mock now”
In many cases it's simpler to pass a value DateTime now to the code instead of a clock.
Apr
2
comment how are virtual methods slower in C#
Since the CPU doesn't execute IL, it doesn't matter what the IL uses, it matters what machine code the JIT produces. For virtual methods that's an indirect call, for non virtual methods it's a direct call or the callee even gets inlined into the caller.