2,701 reputation
2819
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 4 years, 4 months
seen 13 hours ago

Nov
25
comment Alternative to Singleton when D.I. is not an option
@Snagulus Since the singleton accesses external mutable state (a database), a classical singleton is a bad solution. Still it might be the best available solution in this context. Sometimes one has to choose the smallest evil, which might be a singleton here.
Nov
24
comment Are frameworks used for “big” websites?
There are two kinds of "big". Having many features and having many users. For sites with many users, performance often trumps development effort.
Nov
24
comment C++ for C# Developers
@DPD But C# and Java lack the cool parts of C++. For example proper value-type support + RAII and C++ templates are far more powerful than .net generics
Nov
24
comment C++ for C# Developers
C# Delegates and c function pointers are quite different. A delegate is closer to a functor in C++ than to a function pointer.
Nov
24
comment C++ for C# Developers
Just read Stroustrup: The C++ Programming Language and a couple of FAQs(+FQA)
Nov
22
comment How deterministic are SessionIDs from SHA'd GUIDs?
Just use a proper secure PRNG and generate 16 bytes. Based on /dev/urandom on linux and CryptGenRandom on windows. Most languages offer an easy to use wrapper on top of them. For example in C# you'd use RNGCryptoServiceProvider.
Nov
22
comment How deterministic are SessionIDs from SHA'd GUIDs?
As a non-secure PRNG this is fine. Hashing unique values produces random looking values. But it's not a secure PRNG, since GUIDs can be predictable. If your session IDs are secret tokens used to authenticate the client, this is not acceptable.
Nov
21
comment Initializing a variable as undefined
In javascript there is a difference between a missing property and a property that exists, but has the value undefined.
Nov
19
comment Why do so many websites prefer “git rebase” over “git merge”?
This is especially important in larger open source projects, where many people will read the logs and perhaps review the changes. Nobody wants to see a contributor's dozens of merges and incomplete intermediate version that combine into on logically consistent change.
Nov
16
comment Shuffling algorithm with no “self-mapping”?
@RobertHarvey In this context "unbiased" means that all allowed configurations are equally likely. Generating a random permutation and rejecting forbidden values produces such an unbiased configuration. For many problems this approach is prohibitively expensive, but in this case it is pretty fast.
Nov
16
comment Shuffling algorithm with no “self-mapping”?
@OregonTrail As Derek said, on average it's only 2.7 times as expensive as Fisher-Yates, even without early-out. With early out, the overhead (approximately) halves, so it's only ~1.8 times as expensive. That's pretty efficient IMO.
Nov
15
comment When You Have Both Options, When Functional and When OOP?
I prefer simple immutable types (a more functional style) for simple data and complex algorithms, whereas for complex data with may connections I prefer OOP. But since the opposite of function is imperative, not OOP it's often possible to have mostly functional algorithms operate on complex mutable objects.
Nov
15
comment Why does the modifier access for the properties need to be public with Unity?
@Telastyn 1) Manual DI should be possible as well. An IoC container is just a convenience. Preferably the your class doesn't even know there is such thing as IoC containers or even worse which one you're using. 2) The IoC container is external to the object, so it should go through the public API. Either calling a public constructor, or setting a public property.
Nov
14
comment Generating a Nakagami Random Variable
In the worst case one can always use an approximation of the inverse CDF combining it with a rejection function to arrive at the precise distribution.
Nov
13
comment Signing redistributed files
Depends on the license of the library you're using.
Nov
13
comment How to model an address type in DDD?
Certainly seems like the cleanest solution, but since addresses are typically used only once, denormalizing them into the user-address connection is probably the most practical approach in many situations.
Nov
13
comment So Singletons are bad, then what?
There is one more condition to be the bad singleton pattern: Mutability or access to external mutable state. For example making something like AsciiEncoding a singleton with a static accessor would be fine since any possible instance of it would be equivalent.
Nov
13
comment Updating password hashing without forcing a new password for existing users
if H1 is really terrible this won't be secure. Being terrible in this context is mostly about losing a lot of entropy from the input. Even MD4 and MD5 are nearly perfect in this regard, so this approach is only insecure for some homebrew hashes or hashes with really short output (below 80 bits).
Nov
13
comment Why not expose a primary key
hm? Obviously it requires SSL, but that's the case no matter how you authenticate and authorize. Over SSL an attacker can't learn the token (just like they can't learn cookies) and it also prevents replay attacks. The main downside of this approach is that you can't revoke access for individual users, so I prefer using it only for immutable resources. Revoking access to immutable resources is meaningless since an attacker could simply store a local copy.
Nov
13
comment Why not expose a primary key
Unguessable urls (e.g. containing a cryptographically random 128 bit token) are one form of proper authorization.