Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
203 votes

Fear of web-app not being "future-proof"

Perfect is the enemy of good. Or put another way, don't worry about it today. If your app does what it needs to do, then it's fine. It's not a bad thing to rewrite parts of software further down the ...
Philip Kendall's user avatar
182 votes

Developing web applications for long lifespan (20+ years)

What is even more important than your code surviving for 20 years is that your data survives for 20 years. Chances are, that's the thing worth preserving. If your data is easy to work with, building ...
Avner Shahar-Kashtan's user avatar
137 votes
Accepted

Developing web applications for long lifespan (20+ years)

Planning software for such a lifespan is difficult, because we don't know what the future holds. A bit of context: Java was published 1995, 21 years ago. XmlHttpRequest first became available as a ...
amon's user avatar
  • 134k
118 votes

Why is 2FA usually done after the correct password has been provided?

I think you're misinterpreting what actually happens. It's not doing the second factor (SMS code, authenticator app) after login is successful, but simply after one factor (password) has been verified....
Avner Shahar-Kashtan's user avatar
112 votes

Fear of web-app not being "future-proof"

Any thoughts on how I can overcome this mental block, and to ensure my app will be scalable? The crux of the issue isn't scalability. The crux of the issue is thinking that you will get it right the ...
Flater's user avatar
  • 51.7k
68 votes
Accepted

Is it common practice to validate responses from 3rd party APIs?

Absolutely. For starters, you never know that somebody hasn't hacked into your connection and the reply you receive doesn't come from the API at all. And some time in the last two weeks I think ...
gnasher729's user avatar
  • 45.7k
63 votes

What is a good approach to handling exceptions?

This code: try: do_something() except Exception: log_error() is dangerous. Not because you caught a generic Exception but because you suppressed the exception without doing any recovery or ...
candied_orange's user avatar
54 votes

Why is XSLT so rarely used on the web?

XSLT does not really have a useful role in the modern interactive web. The purpose of XSLT is to transform from one XML language into another - but you actually never need to do that in the first ...
JacquesB's user avatar
  • 59.7k
53 votes

When is it better to optimize a software for better performance, at the beginning or at the end of the development?

The number one thing should always and forever be readability. If it's slow but readable, I can fix it. If it's broken but readable, I can fix it. If it's unreadable, I have to ask someone else what ...
candied_orange's user avatar
52 votes

What is a good approach to handling exceptions?

we did not know what to anticipate, while the behavior would be the same for all, e.g. log and continue with execution. To me, this is your major problem. If an exception occurs and you don't know ...
Philip Kendall's user avatar
44 votes

Why not use SQL instead of GraphQL?

Basically, abstraction. SQL requires your clients to know your exact database structure, which is not good. On top of that, analysing the SQL in order to perform special operations based on the value ...
Andy's user avatar
  • 10.3k
43 votes

Is it common practice to validate responses from 3rd party APIs?

Somebody else's API is your external interface. You shouldn't blindly trust anything that crosses that boundary. Your future debuggers will thank you for not propagating the other system's errors ...
Ross Patterson's user avatar
38 votes

Developing web applications for long lifespan (20+ years)

The previous answer by amon is great, but there are two additional points which weren't mentioned: It's not just about browsers; devices matter too. amon mentions the fact that a “web site that ...
Arseni Mourzenko's user avatar
38 votes

Why is 2FA usually done after the correct password has been provided?

In most websites, 2FA are optional. The site can only know whether the user needs 2FA after the user enters their username. Additionally, most sites requires successfully authenticating the password ...
Lie Ryan's user avatar
  • 12.4k
37 votes
Accepted

Service layer returns DTO to controller but need it to return model for other services

A really simple rule of thumb is that you should only use a DTO when you need to ... transfer data. That means use a DTO at the boundaries of your web API, or when you are sending the object on a ...
Berin Loritsch's user avatar
33 votes
Accepted

What is the benefit of having "no runtime errors", like Elm claims?

Exceptions have extremely limiting semantics. They must be handled exactly where they are thrown, or in the direct call stack upwards, and there is no indication to the programmer at compile time if ...
Karl Bielefeldt's user avatar
32 votes

Developing web applications for long lifespan (20+ years)

You do not plan to last 20 years. Plain and simple. Instead you shift your goals to compartmentalization. Is your app database agnostic? If you had to switch data-bases right now, could you. Is ...
coteyr's user avatar
  • 2,533
32 votes

Why not use SQL instead of GraphQL?

In theory there is no reason you can't expose an SQL interface like this. In practice SQL is far too powerful to be effectively limited to the security scope you want to expose. Even if you allow ...
Ewan's user avatar
  • 76.3k
26 votes

When is it better to optimize a software for better performance, at the beginning or at the end of the development?

If a certain level of performance is necessary (a non-functional requirement), then that should be a design goal from the start. E.g. this can influence which technologies might be appropriate, or how ...
amon's user avatar
  • 134k
26 votes
Accepted

Password reset email that is not considered spam

There is no magic bullet here. What's surprising to me is it's not the big orgs that are intercepting your email. I've found Google very prone to intercepting these kinds of emails. A few things to ...
GrandmasterB's user avatar
  • 39.2k
24 votes
Accepted

Splitting a big project to create a multi-module Maven project

Is it possible? Yes certainly. I have, in the past, structured a few projects like this. Here are some bits I hope will get you started. There are two main features of Maven you will use to weave ...
Newtopian's user avatar
  • 7,201
23 votes

Why does "front-end" only pertain to web development?

The premise of your question is wrong. When you say that you "discovered that WPF is not considered 'Front End' development", what you really meant is that you discovered that large swaths of the ...
kmote's user avatar
  • 3,322
22 votes
Accepted

Do I store blog posts in a database? And how do I continue to make posts?

You seem to be creating a Content Management System (CMS). Many such systems already exist, and the majority stores the content within a database. The fact that the content may be rather large is not ...
amon's user avatar
  • 134k
20 votes

Why is XSLT so rarely used on the web?

Depends what you mean by "in Web". XSLT is very widely used. As far as we can judge from metrics like the number of StackOverflow questions, it is in the top 30 programming languages, which probably ...
Michael Kay's user avatar
  • 3,529
18 votes
Accepted

Who designs databases in web development?

Your question is not only pertinent to webapps, but to all kinds of apps that use a database backend. In my experience The design of the database is the combined work of developers and DBAs. ...
Tulains Córdova's user avatar
18 votes

Fear of web-app not being "future-proof"

Despite the enormous amount of money Facebook and Google have poured into marketing to convince you otherwise, front end frameworks exist for two primary reasons: First, offloading hardware/network ...
Iron Gremlin's user avatar
  • 1,115
17 votes

Is it common practice to validate responses from 3rd party APIs?

Is your API-boundary also a trust-boundary? As you are communicating with a remote system, that's nearly a certainty. Even if the remote system itself might be trusted, the medium might not be. ...
Deduplicator's user avatar
  • 9,041
17 votes

Does OOP overemphasize the importance of noun and thus put action/verb in the less importance position ?

One of the problems with OOP is not what OOP is, but how it is taught. Alan Kay, who coined the term "Object-Oriented Programming" has made it very clear on multiple occasions that Messaging ...
Jörg W Mittag's user avatar
16 votes

When is it better to optimize a software for better performance, at the beginning or at the end of the development?

when would be the best time to optimize a software for better performance(speed). Begin by removing from your mind the concept that performance is the same thing as speed. Performance is what the ...
Eric Lippert's user avatar
  • 46.2k
15 votes

Should I check for software on a users machine via a web browser?

You cannot check through a browser if the user have other software like Word installed. If that was possible it would be a huge security hole.
JacquesB's user avatar
  • 59.7k

Only top scored, non community-wiki answers of a minimum length are eligible