News for hackers. Stuff that matters.
Re:The Best Code Documentation ‘Tool’ Ever Made by thegreenroom on Tuesday July 01, 2014 @02:01AM (#7969319)
so your using function names instead of comments?
Re:The Best Code Documentation ‘Tool’ Ever Made by martinnormark on Tuesday July 01, 2014 @03:22AM (#7969502)
You could say that. What I'm saying is that splitting up a function into smaller functions with good names, is way better documentation than comments.
Re:The Best Code Documentation ‘Tool’ Ever Made by Hermel on Tuesday July 01, 2014 @03:51AM (#7969586)
I can confirm this. Function names tend to be much more reliable than comments. Here's an example from Java that can lead to security problems. Consider setSeed from java.security.SecureRandom:

  /**
   * Reseeds this random object. The given seed supplements,rather than
   * replaces, the existing seed. Thus, repeated calls are guaranteed
   * never to reduce randomness.
   */
  synchronized public void setSeed(byte[] seed) {
    secureRandomSpi.engineSetSeed(seed);
  }
Note that the name of the method conveys something different than the comment says. From the method name, I would expect setSeed to set the seed, and not to add to the seed. A better name would have been "addSeed".

Unsurprisingly, some implementations of java.security.SecureRandom follow the comment, others follow the method name - causing a potential security issue. To complicate things further, note that the comment in the equivalent Android class java.security.SecureRandom requires setSeed to set the seed, see: http://developer.android.com/reference/java/security/SecureR...

Thus, security libraries implementating of java.security.SecureRandom cannot implement both, the Oracle and the Google version, at the same time in accordance with the specifications. This could have been avoided if the time spent on commenting setSeed would have been spent on finding a better method name.

Re:The Best Code Documentation ‘Tool’ Ever Made by pan69 on Tuesday July 01, 2014 @06:37AM (#7969944)
How do you write unit tests for classes like this? A lot of reflection I assume?
Re:The Best Code Documentation ‘Tool’ Ever Made by martinnormark on Tuesday July 01, 2014 @07:59AM (#7970157)
I only test against the final result, that I expect any public method to produce. The unit test should pay no consideration to the implementation details such as private methods.

If you want to test the fragments in isolation, split it out into a separate class that you use as a dependency. Your desire to do so is often a good indication that you should split up the responsibility.

Re:The Best Code Documentation ‘Tool’ Ever Made by joshka on Tuesday July 01, 2014 @09:47AM (#7970569)