SVG Polyline drawing of limits

Question: Hey guys im trying to use a ie feature or bug, but it works fine for my solution.
In IE if i have a smaller svg with a larger polyline, the polyline shows through the svg edges.
The same code not work on other browsers and i need to understand why works only on IE.
Has any css or js that i can change to set all browsers to make results equal ie ?
Here is the code, run on IE and run on other browsers, you only view the line in ie and is what i need.

svg
{
    border: solid 1px red;  margin: 40px 40px 20px 20px;
}
<!DOCTYPE html>    <svg height="20" width="50"> <polyline points="20,20 40,25 60,40 80,120 120,140 200,180 200,-10" style="fill:none;stroke:black;stroke-width:3" /> </svg>

See that only IE draws the line over the edges.
Comment: See the code:
Answer: Setting a style overflow: visible; for the svg element should help.
For details on the rules, see the SVG overflow spec. A overflow: hidden; is set by a conforming browser stylesheet if a <svg> element is not the root of a stand-alone document.
Note that you will still have to deal with the overflow rules of all parent elements.

SVG Polyline drawing of limits


Solve $y^{(x)}(x)=ax+b$ using fractional calculus

Question: Based on the fun of:

Conjectured simple ODE solution: $$y^{(y(x))}(x)=f(x)\mathop \implies\limits^?(y(x))!+c_0Γ(y(x))=\int\limits_{c_1}^xf(t)(x-t)^{y(x)-1} dt $$

Imagine we had a function of which its nth derivative at $x=n$ was some function:
$$\frac{d^{x}y(x)}{dx^x}=y^{(x)}(x)=ax+b\implies y(0)=b\implies y'(1)=a+b,\int y(x)dx\bigg|_{x=-1}=a-b$$
Now let's use the fractional integral as the inverse of the xth derivative as $x$ is any constant. Therefore we can use Cauchy's Repeated Integral formula:
$$y^{(x)}(x)=ax+b\implies y(x)+c_1=\text I^{x}_x (ax+b)$$
We can also generalize the lower integration bound as there may be no analog for the indefinite integral:
$$\,_a\text I^n_x g(x)\mathop=^\text{def}\frac 1{Γ(n)}\int_a^xg(t)(x-t)^{n-1}dt \implies y(x)+c_1=\,_{c_0}\text I^x_x (ax+b)= \frac 1{Γ(x)}\int_{c_0}^x(at+b)(x-t)^{x-1}dt \mathop=^{x\ne 0,-1}\\\implies y(x)=^?\frac{(x-c_0)^x(ac_0x+ax+bx+b)}{(x+1)!}+c_1$$
Here is an interactive graph of the conjectured answer.

The problem is that this formula only works for the trivial $a=b=0$ case.

Here is my graphical attempt for $y^{(x)}(x)=1$:
$$y(0)=1,y'(1)=1,y''(1)=1$$
maybe we can assume a function looking like the following with all constants of integration being $0$ for simplicity. Here is the graph with these properties:

Notice how this function matches up with our conjectured result:
$$y^{(x)}(x)=1\implies y(x)=\frac{x^x}{x!}$$
Actually we can generalize this process by doing:
$$y^{f(x)}(x)=g(x)\implies y(x)=\text I_x^n g(x),n=f(x)$$
given that $f\ne y$ so that we can solve the equation.
Then just use a definition of the $n$th integral or derivative and to finish.
I have also found this solution $n\in\Bbb N$ derivatives for $ax+b=1$ with many initial conditions:
$$y'''(x)=1,y(0)=y'(1)=y''(2)=y'''(3)=1\implies y^{(n)}(x)=1,y^{(n)}(n)=y^{(n-1)}(n-1)=1=…=y''(2)=1,y'(1)=1,y(0)=1:$$
which would give the following polynomial for $n=6$:
$$y(x)= \frac1{720} (720 - 4866 x + 4560 x^2 - 1500 x^3 + 270 x^4 - 24 x^5 + x^6), y^{(6)}(6)= y^{(5)}(5)= y^{(4)}(4)= y^{(3)}(3)= y^{(2)}(2) = y'(1)=y(0)=1 $$
Therefore our conjectured solution for $n\in\Bbb N$ is:
$$y=\frac1{n!}\sum_{k=0}^n c_k(-1)^k x^k,$$
where $c_k$ are the coefficients of our solution polynomial which may relate to these Polynomial function.
A self answer found the general solution assuming natural number order derivatives.
Therefore, how can $y^{(x)}(x)=ax+b$ be  solved for $y(x)$ using fractional derivatives? Please correct me and give me feedback!
Comment: It seems to me that $y(x) = x^x/x!$ does not satisfy $y'(1)=1$ nor $y''(2)=1$ nor $y'''(3) = 1$.
Comment: @GEdgar Note how the question said " The problem is that this formula only works for the trivial $a=b=0$ case. " Do you know how we can solve $$y^{(x)}(x)=ax+b$$? Thanks.
Comment: I tried to find some claim in that lengthy post to test.  So, you do not claim that $$y^{(x)}(x)=1\implies y(x)=\frac{x^x}{x!}$$  Is there something that you do claim?
Answer: Help is needed for solving the differential equation for fractional derivatives.
Maybe if $x\in\Bbb N$, then the following is a finite difference equation. However, the following is a particular solution to $y^{([x])}(x)=ax+b$ with the round $[x]$ or $y^{(x)}(x)=ax+b$ with $n$, $n\in\Bbb N$. Find a pattern for $y^{(x-k)},k\in\Bbb N$
$$y^{(x)}(x)=ax+b,y^{(x-1)}(x)=\frac{ax^2}{1\cdot2}+bx+c_0,y^{(x-2)}(x)=\frac{ax^3}{1\cdot2\cdot3}+\frac{bx^2}{1\cdot2}+c_1x+c_0,\implies y^{(x-k)}=\frac{ax^{k+1}}{(k+1)!}+\frac{bx^k}{k!}+\sum_{n=0}^{k-2}c_nx^n$$
Set $k=[x]$ and rename series coefficients:
$$\boxed{y(x)=a\frac{x^{[x]+1}}{([x]+1)!}+b\frac{x^{[x]}}{[x]!}+\sum_{n=0}^{x-2}c_nx^n}$$
Shown here
Comment: Maybe generalize with $y^{(f(x))}=g(x)$?


How to get an array inside a JSON response in .NET Core?

Question: I working with a JSON that has this form:
{
   "success": true,
   "message": "OK!",
   "result": [
      {
         "Id": 1,
         "description": "Creacion",
         "name": "name1"
       },
       {
         "Id": 1,
         "description": "Creacion",
         "name": "name2"
       }
   ]
}

I want to get the result array data. I've trying with this:
List<object> list = new List<object>();

public async Task<bool> GetList()
{
     JObject json = new JObject();
     HttpClient http = new HttpClient();
     string urlComplete = "https://..."; // url where the data is obtained
     var response = await http.GetAsync(urlComplete);
     var result = response.Content.ReadAsStringAsync().Result;
     json = JObject.Parse(result);

     ContractStateList  = JsonConvert.DeserializeObject<List<object>>(json.ToString());

     return true;
}

But it throws an error that says Cannot deserialize the current JSON object...
Any help is appreciated.
Comment: I recommend using [this answer](https://stackoverflow.com/a/46825163/3181933) to generate classes to deserialize your JSON to. Also, fix your JSON before you paste it in.
Comment: "Id: 1,  seems invalid.
Comment: I have so many questions about this code. 1) Why are you using `.Result` in an `async` method? Why didn't you use `var result = await response.Content.ReadAsStringAsync();`? 2) Why are you parsing the JSON to a JObject, then serializing that back to a JSON string, before then deserializing that to a `List`? What do you feel that this extra step is doing for you? 3) Why do you expect to be able to just deserialize the inner "result" list directly from the containing object's JSON?
Answer: you have to add to headers  a content type that shoult be returned. Try this code
public async Task<List<Result>> GetList()
{

    using (var client = new HttpClient())
    {
    var urlAddress = "http://...";

    var contentType = new MediaTypeWithQualityHeaderValue("application/json");
    client.DefaultRequestHeaders.Accept.Add(contentType);
    var response = await client.GetAsync(urlAddress);

    if (response.IsSuccessStatusCode)
    {
        var json = await response.Content.ReadAsStringAsync();
        var jsonParsed=JObject.Parse(json);
        var jsonResult=jsonParsed["result"];
        if (jsonResult!=null)
        {
        List<Result> result = jsonResult.ToObject<List<Result>>();
        return result;
        }
    }
  }
return null;
}

and create class
public partial class Result
{
    [JsonProperty("Id")]
    public long Id { get; set; }

    [JsonProperty("description")]
    public string Description { get; set; }

    [JsonProperty("name")]
    public string Name { get; set; }
}


DNS redirection from root domain to www for a heroku app

Question: I can't configure my DNS in order to redirect my root domain to www.domain for a Heroku app.
I'm using Vultr's DNS. The problem is Heroku does not provide IP address so I can't add an A record, nor a CNAM record to redirect root to www (source):

DNS A-records require that an IP address be hard-coded into your
  application's DNS configuration. This prevents your infrastructure
  provider from assigning your app a new IP address on your behalf when
  adverse conditions arise and can have a serious impact to your app's
  uptime.
A CNAME record does not require hard-coded IP addresses and allows
  Heroku to manage the set of IPs associated with your domain. However,
  CNAME records are not available at the zone apex and can't be used to
  configure root domains.

Here is my DNS configuration:

Thus, the SSL certificate fails in Heroku:

My question is: how can I easily redirect the root domain of my Heroku app to www.domain.com?
Thanks.
Comment: You should then probably ask them, but don't get your hopes up.
Comment: Providers which support CNAME-like functionality are listed in the [Custom Domains article](https://devcenter.heroku.com/articles/custom-domains#add-a-custom-root-domain).
Comment: Can't I do it with Vultr? I'm managing all my domains with their DNS, I would prefer to keep everything at the same place.
Answer: ping with the DNS target you have got from Heroku. you will get the IP for that. Use that as Dns targe in vultr. worked for me.
example:
<code>➜  ~ ping botletter.com.herokudns.com
PING botletter.com.herokudns.com (184.108.40.206): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
</code>
Here use 22.214.171.124 IP in vultr DNS target
Comment: Heroku's IPs, by default are dynamic. So no, this will fail as soon as the IP changes.
You can use add-ons such as Fixie to get a list of static IP addresses.
https://devcenter.heroku.com/articles/fixie


Using parameters within a shell command in Jenkinsfile for Jenkins pipeline

Question: I want to use defined parameters in Jenkinsfile in several shell commands, but I get an exception. In my example I want to execute a simple docker command. The parameter defines the path to docker executable.
This is my very short Jenkinsfile:
pipeline {
  agent any

  parameters {
    string(defaultValue: '/Applications/Docker.app/Contents/Resources/bin/docker', description: '', name: 'docker')
  }

  stages {
    stage('Test') {
      steps {
        sh 'sudo ${params.docker} ps -a'
      }
    }
  }
}

And I get the following exception:
[e2e-web-tests_master-U4G4QJHPUACAEACYSISPVBCMQBR2LS5EZRVEKG47I2XHRI54NCCQ] Running shell script
/Users/Shared/Jenkins/Home/workspace/e2e-web-tests_master-U4G4QJHPUACAEACYSISPVBCMQBR2LS5EZRVEKG47I2XHRI54NCCQ@tmp/durable-e394f175/script.sh: line 2: ${params.docker}: bad substitution

When I change the Jenkinsfile without using the paramter inside the shell command it passes successfully:
pipeline {
  agent any

  parameters {
    string(defaultValue: '/Applications/Docker.app/Contents/Resources/bin/docker', description: '', name: 'docker')
  }

  stages {
    stage('Test') {
      steps {
        sh 'sudo /Applications/Docker.app/Contents/Resources/bin/docker ps -a'
      }
    }
  }
}

So, how can I use parameters inside a shell command in Jenkinsfile? I tried string and text as parameter types.
Answer: The issue you have is that single quotes are a standard java String.
Double quotes are a templatable String, which will either return a GString if it is templated, or else a standard Java String.
So it you use double quotes:
  stages {
    stage('Test') {
      steps {
        sh "sudo ${params.docker} ps -a"
      }
    }
  }

then params.docker will replace the ${params.docker} inside the 'sh' script in the pipeline.
If you want to put " inside the "sudo ${params.docker} ps -a" it doesn't work like bash (which is confusing) you use java style escaping, so "sudo \"${params.docker}\" ps -a"


WebResource.axd and ScriptResource.axd + 404 not found…

Question: I got my asp.net web application to run on a shared hosting.... When i inspected through firebug i found WebResource.axd and ScriptResource.axd returned 404 not found....
WebResource.axd?d=rpqvYNSuvgzlFHiQAGNqVg2&t=633861392532362500 - 404 not found
ScriptResource.axd?d=QH2WS5PI-hjjDYgFwsGU2R-Ze_5jnx-rARAoYxg3JBJyMBl78kd2glg_Q2erkzpacmOcEqLLKqaqHoUVJifLezkXnAGUAWVurxXH feAY8yI1&t=ffffffff873865f3 - 404 not found
Then i searched in stackoverflow and found this link,
ASP.NET web application - WebResource.axd and ScriptResource.axd files - Loading time issue
It didnt help me... I am on shared hosting... I use asp.net 3.5 sp1 and sqlserver2005..
I dont use any ajax libraries...
Answer: Maybe the HTTP handler was deactived globally. You could try to add this to the httpHandler section of your web.config and see what happens:
<add path="WebResource.axd" verb="GET" type="System.Web.Handlers.AssemblyResourceLoader" validate="true"/>

Comment: @splattne ok i ll try it...
Answer: Plesk Admins,
Please disable the Web Application Firewall to solve this issue.
Tools & Settings > Web Application Firewall > Turn Off
Cheers!


What path should I give so that contextual filter works

Question: I am creating on view page for which works like archive and I am doing it for the terms that are used in Blog(I am using blog module).
I have followed this tutorial.
But problem is when I give CONTEXTUAL FILTERS to year+month, and after that If I open my URL example.com/blog/201502 it is showing me 404 page.
Where am I lacking ?
NOTE: It is working fine in preview which are under view.
Some snap shot regarding this:

If I put path something like blog/% then It is showing me all the blog post and I want to have Terms.

If I click on January 2015 then It should give me following result :

Please help me.I have tried a lot.Let me know if more information is required.
Comment: How is the contextual filter processing the argument?  How does it know that 201501 is January 2015?  Is it a custom field on the blog?
Comment: I am sorry but I did not get you.There is only one field that I have added and it is term name.You can see it in first pic of my question.
Comment: @Darvanen Why is it give me all the blog entry if I add `%` in the path(example.com/%) ? I have managed the path.But page is showing all the blog entry but in the preview, It is showing me **January 2015**.Do you know the reason behind it ?
Answer: Instead of creating a node view create a taxonomy view
In that provide two relationships
Taxonomy term: Content with term
Taxonomy term: Content using {Name of the taxonomy field in the content type}*
Add a contextual filter of the type Content : Title Use the first relationship for the contextual filter, Make necessary changes in the more option such as change to lover case turn space to dashes etc
Add the required fields from the content with the relationship set to 2)

You are good to go.
EDIT : As per the discussion There was another need to also show the nodes under a term and its sub terms.
Create a view of the type content.

Add the required fields

Add a contextual filter of the type Content: Has taxonomy term ID (with depth) and select the depth a value as deep as the hierarchy you have in the taxonomy.

Now when you pass the term id as the input it would show all the nodes under that taxonomy term including the child nodes
If you wish to change the url to have the term name instead of the term ID Do the following.
In view give the path as taxonomy/term/% this will override the default taxonomy path.

Install Pathauto Module this depends on Tokens module so have to install that as well.

In Configuration -> URL aliases you have a tab called Patters

Set the pattern of the "TAXONOMY TERM PATHS" to what you would like it to be. Make sure that the last value is [term:name] so if you want the path to be category/carrot you should give it as category/[term:name]

If you have already added the taxonomy terms then you would need to do the "BULK UPDATE" which is again a tab on the URL Alias page.

Now when you visit the page category/termname you will see all the nodes under the term including the child terms


How to play in time, for songwriters

Question: How do songwriters make recordings that are in time?
Here's what I've tried:
1) Recording with a metronome.
OK, now my songs are in time, but are different (e.g. quantized/snapped to the beat inappropriately) in places.  I believe these issues, at least in part, stem from the fact that I've never transcribed the song I'm playing -- I usually don't know where exactly the beats fit into the rhythm or amongst the words.
2) Transcribing/Carefully counting out each phrase, then recording with a metronome
OK, well I guess this is probably the fool proof way, but, as an amateur it can take me days.  In fact, while I've tried this many times, I don't know if I've ever gotten past the first few bars.
3) Making a drum track:
Well, I've tried this with a bunch of songs, while I've had more success with this than option (2), I've never been happy with the results.  My thought is always to cut up a recording into (relatively in-time) pieces, record again where necessary, make a drum track, redo the guitar over the drum track (or the cut-up guitar), redo the vocals once the better guitar is down.  Somehow this never works out like I planned.
4) Make a drum track using the groove track feature of GarageBand, then re-record using the drum track
I was inspired to make this post after spending several hours failing at writing midi drum phrases that would tell GarageBand how to warp this song correctly into time (in hopes it would give me a recording that I could use make a better drum track to help me play the song in time).
So anyways, I feel like I'm going about this all wrong, or maybe it's just hard.  There are so many things to try doing or studying or practicing.  I'm feeling overwhelmed and hoping for some advice that will give me direction and motivation.  Any idea what I need to study or practice in order to overcome this hurdle?
Comment: You do this the same way that every human performer learns to play or sing in time. Learn to count a rhythm, and then practise, practise, practise! If you don't already play an instrument, start learning one (it doesn't matter much *what* instrument). You won't succeed in getting something in time  "mechanically" until you can *hear in your mind* what you want to accomplish - if you can't actually identify what is wrong, you can only fix the problems by getting lucky.
Answer: I think you're slowing down a bit over the course of that Soundcloud track (solid songwriting effort btw), but other than that it's the same feel and tempo and meter all the way through, no half bars or dropped beats or funny business.  I think you just need practice playing along with an external time source, and getting used to the idea that the downbeats are there whether you're emphasizing them on the guitar or not. GarageBand's groove track feature is great, but it'll take some fiddling to get it to fit the feel you have there, and I wonder if that might not be what's tripping you up.
The simplest thing would be just a kick on the downbeats (one thump underneath each of these words: "this", "never", "any", "better"). Do you tap your foot in time while playing? If that doesn't come naturally, that's the first thing to learn.
To start with, slow it down, way down. After decades as a self-taught guitarist, I've been taking piano lessons, and my teacher keeps telling me to slow down when I screw up. Finally I started listening, and it's almost unbelievable how much that helps. It's like a superpower.
I may be totally off base on this, but I get the impression you do everything by instinct and feel, without thinking about it. You just charge at it, and it just happens. You're very musical that way, but now you've run into something where you charge at it and it doesn't happen. So you need to learn to put things on a more conscious basis.
UPDATE
The chorus hook is stuck in my head. Bravo!
Answer: It's going to depend a lot on what you do with it next. Listening to the song, the guitar is fine on timing - the vocals wander a bit, but that's probably the way you want them to. I usually put a drum track down first, as a reference for all other tracks. Try to find the beat that's most appropriate, but that's not all that easy. Tempo-wise, experiment to find the optimum - often, I've recorded a whole track, only to feel that it's not quite the right speed or feel. I still find it's better than a click track, or metronome, as it feels like I'm playing with 'proper' drums. And it's easier to re-record a small section. Whether this track stays at the end is a decision made later. But, it's far more tricky matching a perfect drum track to what's already been done, as you found out!
With that simple but regular drum track it's relatively easy to put fills in later, when you've got the rest of the tracks down, and you can hear where there's space for them.
If you want to put other instruments - played by others - onto the recording, they will likely need a solid rhythm to follow, it's much easier. They won't necessarily even need to hear the vox track.
If that's all you want - vox and guitar - then does it need to be any closer in solid tempo than it already is?
Answer: There are four classes at Berklee Online that address this. Songwriting is a craft, so it takes experience, but there are some rules. Lookup the books that are used for the classes on Berklee Online songwriting courses. Read those, and study those by actually doing the exercises. They are good books.
The course names are:

Lyric Writing: Tools and Strategies
Lyric Writing: Writing Lyrics to Music
Songwriting: Harmony
Songwriting: Melody

The first one just takes you through the types of rhymes, strong syllable identification, song structure, and developing rhythms from written songs. The second in the list, takes you through writing an effective song to a given rhythm set - which is often the approach that songwriters have to take.
The third class speaks for itself, but it takes you through exploring different harmonies in a workshop format. Same for the fourth one. I am in the last classes at Berklee, but can safely say that if you go through the books in a disciplined manner, that you will become an effective songwriter and understand just about every approach to support your creativity.
Answer: My method when recording:

Play the song using your recording sofware(DAW) in a simple 4/4 measure straight through. When you feel the tempo is not right adjust it until it feels right. It's ok if it's all sounding sloppy at this point as long as your changes are where they need to be.
Adjust your metronome tempo at the parts you have changes if needed. In my DAW I can setup the metronome to adjust automatically after building the tempo track. I'm sure this a normal feature in most DAWs
Finally Play your song according to the metronome tempo you set for the track until you have it spot on.

That'll hone you in. If your absolutely not sure on the tempo just play it all out in a 4/4 measure. Metronome is a must for me if I don't have a drummer.
As far as the words go you'll have to first get the song solid while playing so the singing will flow in it's own manner. But if your playing the song in time your words should fall into time even if it feels as if it's on the off-beat. The idea is your playing should always keep you strapped in time so you can somewhat dance around with your singing without worrying about getting off tempo.
I would first practice with simple measures and singing on the beat if your not used to it.

How to play in time, for songwriters


O que é atomic web design?

Question: Superficialmente achei muito interessante essa abordagem, mas antes de se aprofundar gostaria de saber do que se trata exatamente, também, se é possível usá-lo em projetos de curta escala, ou até mesmo em uma empresa que não dispõe de uma equipe dedicada?
Comment: Este é um artigo muito bem elaborado sobre o assunto, em inglês no entanto. http://atomicdesign.bradfrost.com/chapter-2/
Comment: @hugocsl entendo o que está dizendo, eu por muito tempo pensei a mesma coisa do DDD que na minha cabeça é algo que eu sempre fiz, a diferença é que está organizado de uma forma sólida e didática.
Comment: kk Interessante, eu entendi mais como uma especificação de identidade do projeto, ou seja, para que vários componentes espalhados, se podemos pré-definir tudo em partes principais, depois só espalhar, levando em conta a identidade e também as fases do "átomo", mas concordo que está bem hipster embora os artigos sejam de 2013
Comment: Eu acredito que esse conceito é possível sim de ser usado em projetos pequenos, já que tem mais a ver com um modelo mental de como trabalhar do que outra coisa. No fim tudo que você estará fazendo é um design com melhor qualidade pensando em usar os componentes mais corretos para cada fim.
Comment: @ÐvÐ ele usa a química para tentar explicar :-)
Answer: Como recentemente o Brad Frost, o pai do Atomic Design, fez uma "revisão" do conceito depois de 6 anos, resolvi deixar uma resposta com uns pontos. Resumidamente foram incluídos os Design Tokens (tipografia, cores, espaçamentos e até tom de voz).

Para quem não está familiarizado com o Atomic Design aqui vão umas ilustrações para ajudar a entender de forma prática. Repare que nessa imagem abaixo os Design Tokens ainda não tinha sido contemplados, não existem detalhes da biblioteca de ícones, paleta de cores ou escolhas tipográficas.

Agora a resposta
Agora mais focado na pergunta. Primeiro, o Atomic Design (AD), não é uma regra rígida, um conceito imutável e engessado. Ele não precisa seguir passos tão rígido, e assim como o Scrum ou o Design Sprint ele pode ser adaptado a realidade da sua empresa e do seu time.
Aqui vc pode ver como a CanadaPost tem sua maneira particular de usar o AC que diverge um pouco do conceito original... Esse é só um exemplo, na sua empresa vcs deve encontrar o que melhor se adapta a cultura de desenvolvimento do projeto.
 https://www.canadapost.ca/cpc/en/designsystem/mercury/principles/atomic-design.page

Considere que, quase todo Design System como Bootstrap, Materialize, Bluma, Tailwind, Faundation, etc, praticamente todos, de uma certa forma estão dentro do conceito Atomic, pois eles têm, tipografia definida, paleta de cores, ícones, grid, botões, dropdowns, navbar, templates. etc.
Como sou designer, vou abordar um pro e um contra de não ter uma pessoa dedicada. Não vou entrar no mérito do UX nessa resposta para não ficar muito longo, presume-se que o usuário já foi pesquisado etc. ok.
E qual é a principal vantagem de se usar esses Design System? Sim economia de tempo, e facilidade para quem não domina o design e CSS. O problema mesmo acontece quando vc precisa quebrar as regras do sistema! Ai um profissional mais especialista vai fazer falta. Como vc pode ver abaixo.
Pro: Basicamente o pro é custo, pois vc não vai ter que gastar com um profissional dedicado e que em alguns casos pode ficar um pouco ocioso dentro do time.
O resto é tudo contra rss...
Contra:

Inconsistência no design, podendo haver variações de cores, tipografia, etc.
Ninguém para fazer ajustes de design para adaptar componentes a novas realidades.
Ninguém para criar um componente novo que não existia antes no Design System.
Ausência de pessoa responsável pela manutenção da biblioteca e documentação.

Esses são só uns pontos que fazem toda a diferença. Um Design System vai ajudar muito para um squad reduzido, mas a longo prazo um profissional vai te fazer falta quando as coisas começarem a escalar de mais, é fácil perder o controle de um sistema de design, principalmente quando a equipe e grande e todo mundo faz um style ali ou aqui.
Resumindo: O Atomic Design é um conceito que vai te ajudar a construir um Design System, que vai ajudar a sua equipe a desenvolver um projeto mais consistente e de maneira mais rápida e organizada. Lembrando que um designer vai facilitar muito a vida do time, principalmente se ele for multi-disciplinar com conhecimentos de UX > UI > Front-end
Veja, é mais fácil e rápido montar algo complexo seguindo um manual que é igual para todos e que todos podem consultar de forma fácil, ou cada um vai montando do jeito que quer conforme acha melhor. Qual das duas maneiras tem mais chance de fracassar? Independente do tamanho do time, quem tem mais chance de fracassar, quem tem um "manual" ou quem não tem um "manual"??
Comment: @FelipeDuarte é uma iniciativa bem legal, até respondi a pesquisa lá rss. No início realmente é custoso desenvolver o design e estabelecer o design system, mas no futuro se ganha em dobro. []´s
Comment: Praticamente uma resposta quântica...
Comment: @AndersonCarlosWoss http://prntscr.com/oq1lh7
Comment: Ótima resposta! essa pergunta em 2017 me deixou realmente com a pulga atrás da orelha, pois é realmente muito difícil mudar a cabeça de uma equipe para implementar um design system, e creio que o grande vilão é o tempo, então estou criando um ferramenta que está em 'ultra beta' kk, para resolver esse problema caso queiram dar uma olhada em https://swizer.io basicamente o propósito é criar, gerenciar e exportar componentes.

O que é atomic web design?


Given $\frac{dx}{dt} = f(x)$, find $x(t)$

Question: I have a phase plot of velocity vs position in 1D. I don't, however, have an equation for it--as this one can change for different applications. I want to find the corresponding function x(t).
For my particular application, what I have is a table of discrete values for x and $\frac{dx}{dt} $, so if you can think of a way to approximate x(t) discretely (instead of analytically), it would solve my problem too.
Comment: Is here $$f(x)=f(x(t))$$?
Comment: Taking the integral of both sides gives you $$x(t)=\int f(x) dt$$.
Comment: We don't know x(t) yet, so we can't have the derivative as a function of time at the moment.
Comment: Yes Peter, but I cannot integrate the right half cause I don't have a function f in terms of t
Comment: Do you mean that the values of $t$ are unknown ?
Comment: Yes, the values of t are unknown at each point
Answer: This kind of ordinary differential equation ($x' = f(x)$) is called homogeneous.  It is a special case of separable equations ($x'(t)= f(x)g(t)$).
When $f(x)$ is known for all $x$, the standard trick for integrating an equation like this is called separation of variables.  It looks kind of like hocus-pocus, but bear with me for a minute.
If $\frac{dx}{dt} = f(x)$, write it as:
$$
    \frac{dx}{f(x)} = dt
$$
Both sides of the above are differentials (you might call it a "differential equation" or something).  Slap on an integral sign and you have
$$
    \int\frac{dx}{f(x)} = \int dt
$$
The left-hand side is a function of $x$, and the right-hand side is a function of $t$.  Yes, there's a constant of integration which must be included.  But after that is done, we can (hopefully) solve for $x$ in terms of $t$.
As an example, suppose $f(x) = 2x$.  The equation $x' = 2x$ models a constant relative growth rate, such as those found in bacteria cultures, bank accounts, etc.  The separation of variables technique gives
$$
    \frac{dx}{2x} = dt \implies \frac{dx}{x} = 2\,dt \implies \ln|x| = 2t + C
$$
Now we can solve for $x$ in terms of $t$:
$$
    x = e^{2t+C} = e^C e^{2t} = Ae^{2t}
$$
where $C$ is an arbitrary constant.  $A$ is also a constant that has to be determined by initial conditions.
There are some important theoretical points about when and why this technique works.  After all, we are taught to never treat the $dx$ and $dt$ in a derivative as separate quantities, and think of $\frac{dx}{dt}$ as a monolithic symbol.  But it does work.
After I wrote this answer I saw that you added that $f(x)$ is only known for certain discrete values of $x$.  In that case, a different method needs to be applied.
Comment: Oh.. I can't believe I didn't think of separation of variables. Thank you so much for your thorough answer!
Comment: It helps to remember that $1$ is a function!  So $x' = f(x) g(t)$, where $g(t) =1$.
Comment: Quick question: how can I deal with the problem if f(x)=0 at some point?
Comment: I can't understand how this answers the question when the function is only known at discrete points ?!
Comment: I guess you're right.. It doesn't... But it helped! Here's how I'm currently doing it:
I take the reciprocal of my f(x) values and integrate those by using summation ∑1/f(x) and multiplying by Δx. The result will be a close estimate of the corresponding t for each x--mapping x to t.
In the case where f(x)=0, I take interpolate with nearby value of f(x) that are not 0--there might be a better way to do it.. But that is enough for my application.
Comment: @YvesDaoust: I gave my answer before that part of the question appeared.  If I had seen that earlier, I would have recommended a numerical approximation.  I've edited the answer to reflect that anachronism.


Como simular onclick checkbox

Question: Bom dia Pessoal, eu possuo um formulario que é uma datatable, e tenho um botão que marca ou desmarca, todas as checkboxs dessa datatable, por padrão esses checkbox vem marcado, eu preciso que ao ler a página ou ao clicar no botão marcar todas o checkbox altere sua propriedade simulando um click em cada checkbox. segue abaixo meu botão. Tem como?
function marcardesmarcar() {
$('.marcar').each(function () {
    if (this.checked)
       $(this).attr("checked", false);
    else
       $(this).prop("checked", true);
});

}
Answer:     $(document).ready(function() {
      toggleCheckBoxs(); // inicia alternando os checks boxs
    });

    function toggleCheckBoxs(){
      var checks = $('input');
      // checks.map((i,x) => x.checked = !x.checked );
      checks.map((i,x) => $(x).click() ); // aqui dispara o evento de click
    }

Verifica aqui: teste
Comment: essa funçao que uso ja faz da mesma forma que a sua, minha duvida é se a sua resposta vai simular o evento click, nos checksboxs
Comment: hum, entendi, atualizei a resposta.
Answer: Você pode usar desta forma, automaticamente ao marcar o seu CheckBox, ele busca todos os outros e marca o mesmo valor do seu checkbox clicado:

$("#marcar").click(function(){
    $('input:checkbox').not(this).prop('checked', this.checked);
});
Comment: não da assim, porque eu preciso percorrer o datatable, $('.marcar').each(function (), .marcar eu uso a classe
Comment: E por que você usa `.prop()` em um if e no else você usa o  `.attr()`?
Comment: desculpa estava testando e esqueci de inverter,
Answer: Posso te ajudar mostrando como você pode fazer isso com JS Vanilla:
// Pega todos os elementos com a class .marcar
const marcar = document.querySelectorAll('.marcar')

//Transforma a HTMLCollection em array e intera cada item
Array.from(marcar).forEach(el => {
  // Checa o valor de cada elemento
  let isChecked = el.checked
  return el.checked = !isChecked // Seta o atributo inverso do que está atual
})

Comment: vou dar uma pesquisada em JS Vanilla...
Comment: Mas isso resolve seu problema?
Answer: Bom pessoal depois de muito estudar, consegui resolver utilizando a função abaixo.
function marcardesmarcar() {
$('.marcar').on('click', function () {
    if (this.checked)
       $(this).attr("checked", false);
    else
       $(this).prop("checked", true);
});
// Chama a função de clique através do trigger
$('.marcar').trigger('click');

}

Como simular onclick checkbox


Adding more variables to menu for use in menu.html.twig

Question: I'm attempting to give menus more variables to work with besides the default menu_name,items, and attributes. This is because making a variable in the preprocess menu hook does not allow it to be accessible in the menu.html.twig template.
My ultimate goal is to be able to add menu items that contain the user id in the path.
I believe I need to add the var to menu by using hook_theme_registry_alter and follow the format of https://api.drupal.org/api/drupal/core%21includes%21theme.inc/function/drupal_common_theme/8.2.x
So I attempted to add a variable to menu in my .theme file like so
function mytheme_theme_registry_alter(&$theme_registry){
    $theme_registry['menu']['variables']['test_var'] = 'testing theme registry alter';
}

But when I do so nothing appears when I alter menu.html.twig like so

    {{ menus.menu_links(items, attributes, 0) }}
{#     {% macro menu_links(items, attributes, menu_level) %} #}
    {% macro menu_links(items, attributes, menu_level) %}
    {% import _self as menus %}
    {% if items %}
    {% if menu_level == 0 %}

        {% else %}

            {% endif %}
            {% for item in items %}
                {% if item.below %}

                {% else %}

                {% endif %}
                {{ link(item.title, item.url) }}
                {% if item.below %}
                    {{ menus.menu_links(item.below, attributes, menu_level + 1) }}
                {% endif %}

            {% endfor %}

{{ test_var }}

        {% endif %}
        {% endmacro %}

How would I add more menu variables for use in menu.html.twig ?
UPDATE: I also tried {{menus.test_var}} but that just broke the page
UPDATE 2: Using {{ kint() }} the test_var did not appear anywhere
Comment: Did you clear the cache?
Comment: Yes the cache has been cleared
Comment: I think it expects an array, not a string: https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Render%21theme.api.php/function/hook_theme_registry_alter/8.3.x
Comment: But I'm adding a custom var. Why would it matter what variable type it is? In the theme registry not all variables are arrays     'menu' => array(
      'variables' => array('menu_name' => NULL, 'items' => array(), 'attributes' => array()), The menu name is just a string
    ),
Comment: You did not pass a variable _in_ an array, you only passed a string.
Comment: Are you saying to do  $theme_registry['menu']['variables'] += ['test_var' => 'testing theme registry alter']; instead? I'm not sure how that would be different
Answer: Here is an example from a real project I had done:
mytheme.theme:
/**
 * Implements hook_theme_registry_alter().
 * @param $theme_registry
 */
function mytheme_theme_registry_alter(&$theme_registry) {
  $theme_registry['menu']['variables']['top_parent'] = [];
}

/**
 * Implements hook_preprocess_block__menu_block().
 * @param $variables
 */
function mytheme_preprocess_block__menu_block(&$variables) {
  // set the top parent on the left nav
  if ($variables['elements']['#id'] == 'left_navigation' && !empty($variables['elements']['content']['#items'])) {
    // code removed

    $variables['content']['#top_parent'] = [
      'title' => $menu_content->getTitle(),
      'url' => $menu_content->getUrlObject(),
      'is_current' => ($current_path == $item_path)
    ];
  }

  // code removed
  }
}

In Twig:
  {% if menu_level == 0 %}

      {{ link(top_parent.title, top_parent.url) }}

  {% endif %}

You are likely missing the part where you add test_var key to the content array:
$variables['content']['#test_var'] = "whatever";
With exception to flagging is-current, it looks like you're trying to do the same thing I did. You should strive to use the link function in Twig instead of a hard coded anchor unless there is no way around it.
Comment: Still doesn't work for me. Also I'm not using a block. I'm programmatically rendering the menu by rendering it in preprocess_page and storing it in a twig variable. And I'm assigning these variables inside preprocess_menu not preprocess_menu_block I've tried different versions like $vars['content']['#test_var'] $vars['test_var'] and $vars['#test_var'] all with no luck
Answer: be careful to the name of your menu for example if you want to assign a new variables to main menu
you must do something like this
function mytheme_theme_registry_alter(&$theme_registry) {
  $theme_registry['menu__main']['variables']['top_parent'] = [];
}

Answer: Sometimes theme hooks are specific so you might have
node
and
node__mytype
Therefore, the theme registry array key to change is $theme_registry['node__mytype'] in addition to the normal one.
Here is a function to effect all variations.
/**
 * Implements hook_theme_registry_alter().
 */
function mythemename_theme_registry_alter(&$theme_registry) {
  $target_theme_hook = 'node';
  $target_theme_hooks = [];
  foreach (array_keys($theme_registry) as $theme_hook) {
    // Is target theme hook.
    if ($target_theme_hook === $theme_hook) {
      $target_theme_hooks[] = $theme_hook;
      continue;
    }
    // Is more specific version of the target theme hook.
    if (strpos($theme_hook, "{$target_theme_hook}__") === 0) {
      $target_theme_hooks[] = $theme_hook;
      continue;
    }
  }
  // Add $new_var as a variable to the 'node' theme hook(s) we
  // collected eailer. Set its default value to be an
  // empty string.
  foreach ($target_theme_hooks as $target_theme_hook) {
    $theme_registry[$target_theme_hook]['variables']['new_var'] = '';
  }
}


Why is form submit handler not called when calling form_set_error?

Question: I want to know where in Drupal documentation it is listed that submit handlers are not called when form_set_error has been called.
I don't see it in form_ser_error api, nor in FAPI Quickstart guide and FAPI reference.
Looks like I'm missing some simple thing.
Answer: submit handlers are only invoked if there are no validation errors. Calling form_set_error() results in a validation error.
From the quickstart guide that you linked:

1. A submit function is called only if a submit button was present and exists in the $_POST, and validation did not fail.


Why should I firewall servers?

Question: PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into their firewalling solutions, and also because they've been indoctrinated to believe in their necessity.
However, I'm looking for answers from people who are experts in security. I believe that this is an important question, and the answer will benefit more than just myself and the company I work for. I've been running our server network for several years without a compromise, without any firewalling at all. None of the security compromises that we have had could have been prevented with a firewall.
I guess I've been working here too long, because when I say "servers", I always mean "services offered to the public", not "secret internal billing databases". As such, any rules we would have in any firewalls would have to allow access to the whole Internet. Also, our public-access servers are all in a dedicated datacenter separate from our office.
Someone else asked a similar question, and my answer was voted into negative numbers. This leads me to believe that either the people voting it down didn't really understand my answer, or I don't understand security enough to be doing what I'm currently doing.
This is my approach to server security:

Follow my operating system's security guidelines before connecting my server to the Internet.
Use TCP wrappers to restrict access to SSH (and other management services) to a small number of IP addresses.
Monitor the state of this server with Munin. And fix the egregious security problems inherent to Munin-node in its default configuration.
Nmap my new server (also before connecting my server to the Internet). If I were to firewall this server, this should be the exact set of ports incoming connections should be restricted to.
Install the server in the server room and give it a public IP address.
Keep the system secure by using my operating system's security updates feature.

My philosophy (and the basis of the question) is that strong host-based security removes the necessity of a firewall. The overall security philosophy says that strong host-based security is still required even if you have a firewall (see security guidelines). The reason for this is that a firewall that forwards public services to a server enables an attacker just as much as no firewall at all. It is the service itself that is vulnerable, and since offering that service to the entire Internet is a requirement of its operation, restricting access to it is not the point.
If there are ports available on the server that do not need to be accessed by the whole Internet, then that software needed to be shut down in step 1, and was verified by step 4. Should an attacker successfully break into the server through vulnerable software and open a port themselves, the attacker can (and do) just as easily defeat any firewall by making an outbound connection on a random port instead. The point of security isn't to defend yourself after a successful attack - that's already proven to be impossible - it's to keep the attackers out in the first place.
It's been suggested that there are other security considerations besides open ports - but to me that just sounds like defending one's faith. Any operating system/TCP stack vulnerabilities should be equally vulnerable whether or not a firewall exists - based on the fact that ports are being forwarded directly to that operating system/TCP stack. Likewise, running your firewall on the server itself as opposed to having it on the router (or worse, in both places) seems to be adding unnecessary layers of complexity. I understand the philosophy "security comes in layers", but there comes a point where it's like building a roof by stacking X number of layers of plywood on top of each other and then drilling a hole through all of them. Another layer of plywood isn't going to stop the leaks through that hole you're making on purpose.
To be honest, the only way I see a firewall being any use for servers is if it has dynamic rules preventing all connections to all servers from known attackers - like the RBLs for spam (which coincidentally, is pretty much what our mail server does). Unfortunately, I can't find any firewalls that do that. The next best thing is an IDS server, but that assumes that the attacker doesn't attack your real servers first, and that attackers bother to probe your entire network before attacking. Besides, these have been known to produce large numbers of false positives.
Comment: This question would have been well suited for http://security.stackexchange.com
Comment: Love it. Local firewall rules are almost always voodoo-only.
Comment: And so ALL of the traffic that passes between your servers is encrypted?
Comment: Do you have desktops/employees in your network as well? What do you do with them?
Comment: @routeNpingme: It looks like I didn't include that tidbit in my original post. All of our servers need to be open to the public, and live in a dedicated datacenter. If your office is your datacenter, I suppose it would be necessary to have a firewall between your server network and your office network. In which case, I'm talking about the server network - why firewall something that has complete public access?
Comment: Possible duplicate of [Why would I need a firewall if my server is well configured?](https://serverfault.com/questions/232642/why-would-i-need-a-firewall-if-my-server-is-well-configured)
Comment: Except I asked it first. https://serverfault.com/questions/232642/why-would-i-need-a-firewall-if-my-server-is-well-configured is a duplicate of my question.
Comment: See also https://serverfault.com/questions/232642/why-would-i-need-a-firewall-if-my-server-is-well-configured
Answer: Advantages of firewall:

You can filter outbound traffic.
Layer 7 firewalls (IPS) can protect against known application vulnerabilities.
You can block a certain IP address range and/or port centrally rather than trying to ensure that there is no service listening on that port on each individual machine or denying access using TCP Wrappers.
Firewalls can help if you have to deal with less security aware users/administrators as they would provide second line of defence. Without them one has to be absolutely sure that hosts are secure, which requires good security understanding from all administrators.
Firewall logs would provide central logs and help in detecting vertical scans. Firewall logs can help in determining whether some user/client is trying to connect to same port of all your servers periodically. To do this without a firewall one would have to combine logs from various servers/hosts to get a centralized view.
Firewalls also come with anti-spam / anti-virus modules which also add to protection.
OS independent security. Based on host OS, different techniques / methods are required to make the host secure. For example, TCP Wrappers may not be available on Windows machines.

Above all this if you do not have firewall and system is compromised then how would you detect it? Trying to run some command 'ps', 'netstat', etc. on local system can't be trusted as those binaries can be replaced. 'nmap' from a remote system is not guaranteed protection as an attacker can ensure that root-kit accepts connections only from selected source IP address(es) at selected times.
Hardware firewalls help in such scenarios as it is extremely difficult to change firewall OS/files as compared to host OS/files.
Disadvantages of firewall:

People feel that firewall will take care of security and do not update systems regularly and stop unwanted services.
They cost. Sometimes yearly license fee needs to be paid. Especially if the firewall has anti-virus and anti-spam modules.
Additional single point of failure. If all traffic passes through a firewall and the firewall fails then network would stop. We can have redundant firewalls, but then previous point on cost gets further amplified.
Stateful tracking provides no value on public-facing systems that accept all incoming connections.
Stateful firewalls are a massive bottleneck during a DDoS attack and are often the first thing to fail, because they attempt to hold state and inspect all incoming connections.
Firewalls cannot see inside encrypted traffic. Since all traffic should be encrypted end-to-end, most firewalls add little value in front of public servers. Some next-generation firewalls can be given private keys to terminate TLS and see inside the traffic, however this increases the firewall's susceptibility to DDoS even more, and breaks the  end-to-end security model of TLS.
Operating systems and applications are patched against vulnerabilities much more quickly than firewalls. Firewall vendors often sit on known issues for years without patching, and patching a firewall cluster typically requires downtime for many services and outbound connections.
Firewalls are far from perfect, and many are notoriously buggy. Firewalls are just software running on some form of operating system, perhaps with an extra ASIC or FPGA in addition to a (usually slow) CPU. Firewalls have bugs, but they seem to provide few tools to address them. Therefore firewalls add complexity and an additional source of hard-to-diagnose errors to an application stack.
Comment: `Above all this if you do not have firewall and system is compromised then how would you detect it?` Intrusion detection is not the job of the firewall. That job is more properly handled by the HIDS (host-based intrusion detection system), which is independent of the firewall.
Comment: Syslog servers eliminate the need for item 5. If anything, it's best to send your firewall logs to a syslog server, in case an attacker manages to compromise the firewall and delete its logs. Then the attacker has to compromise two systems just to delete the logs, and they might not be prepared for that (especially with automated attacks). Likewise, if all your systems have centralized logging, you get better detail about the attack than firewall logs can provide.
Comment: This answer was accepted over the more popular one because it provides better and a more comprehensive set of reasons for using a firewall. And not, for that matter.
Comment: My point was since HIDS resides on host we cant trust its output. For example even if we use cryptographically secure 'tripwire' as host based IDS, the attacker can always replace all tripwire binaries (twadmin, tripwire, twprint, etc.) with compromised versions which will never report intrusion. Even if we try to copy libraries/binaries from other system, there can be a process running which monitors these compromised binaries and again replaces them with corrupted version in case they are replaced or updated. Firewall being independent from host, can be trusted in such scenarios.
Comment: Stateful packet inspection firewalls do NOT belong in front of servers. They are a huge liability in DDoS attacks, and are typically the first thing to fail under attack.
Comment: It is also important to make distinction between full fledged firewall and what can be categorized as simple (thus performing well) packer filter. Src/dst based filtering followed by manipulating routing is most optimal solution for the first line of defense. It can be followed with more protection if needed. This gives a lot of flexibility.
Answer: TCP Wrappers could be arguably called a host-based firewall implementation; you're filtering network traffic.
For the point on an attacker making outbound connections on an arbitrary port, a firewall would provide a means of controlling outgoing traffic as well; a properly configured firewall manages ingress and egress in a way which is appropriate to the risk related to the system.
On the point about how any TCP vulnerability isn't mitigated by a firewall, you're nt familiar with how firewalls work.  Cisco has a whole bunch of rules available for download which identify packets constructed in a way that would cause particular operating systems problems.  If you grab Snort and start running it with the right rule set, you will also get alerted on this kind of thing.  And of course, Linux iptables can filter out malicious packets.
Basically, a firewall is proactive protection.  The farther you get away from being proactive, the most likely that you'll find yourself in a situation where you're reacting to a problem rather than preventing the problem.  Concentrating your protection at the border, as with a dedicated firewall, makes things easier to manage because you have a central choke point rather than duplicating rules everywhere.
But no single thing is necessarily a final solution.  A good security solution generally is multi-layer, where you have a firewall at the border, TCP wrappers at the device, and probably some rules on internal routers as well.  You should usually protect the network from the Internet, and protect the nodes from each other.  This multi-layer approach isn't like drilling a hole through multiple sheets of plywood, it's more like putting up a pair of doors so an intruder has two locks to break instead of just one; this is called a man trap in physical security, and most every building has one for a reason. :)
Comment: Also if they sneak inside the building and open the inner door for their friend outside, they then have to also unlock and open the outer door. (i.e. without an external firewall, someone who gets into your server can open it right up, whereas an external firewall would still block the open ports from the outside)
Comment: @Ernie - no, it only needs to exist to be automatically probed for free space for Warez, customer databases, financial info, passwords, and being added to a botnet - but even that can be bad enough - some admins will happily blackhole your IP if it looks like you host zombies.
Comment: @Ricket: Perhaps they could, but modern attackers don't bother with things like this. Your site would have to be of particular interest for an attacker to do anything more than add your server to a zombie farm.
Comment: `TCP Wrappers could be arguably called a host-based firewall implementation` +1 for a great answer.
Answer: (You may want to read "Life without Firewalls")
Now: What about having a legacy system for which no patches get published anymore?  What about not being able to apply the patches to N-machines at the time you need to do so, while at the same time you can apply them in fewer nodes in the network (firewalls)?
There's no point in debating the firewall's existence or need. What really matters is that you have to implement a security policy. To do so you will use whatever tools will implement it and help you manage, expand and evolve it. If firewalls are needed to do so, that's fine. If they are not needed that's fine too. What really matters is having a working and verifiable implementation of your security policy.
Comment: @Ernie - I guess you could just have got lucky. How do you know you haven't been compromised? The results of forensic investigations on many of my clients have discovered compromise, sometimes dating back months, while the attackers found personal and financial information, client details, intellectual property, business plans etc. As Sean said - get a proper security audit done.
Comment: Actually, aside from the fact that our server network is physically separate from our office network (and thus, no truly sensitive data can be gleaned from it, even with root access on every server), I have been able to discover every single compromise we've ever had since I started here. I could go on about the horror show that existed when I started, but I don't have enough space. :) Suffice to say that most attacks are not subtle, and the subtle ones are discoverable too. Oh yes, and user privilege separation is your friend.
Comment: Heh. I've been running our server network for the past 8 years without a firewall. I could have *written* "Life without firewalls", but he did a way better job and runs a way larger network than I, anyway.
Comment: "life without firewalls" is snake-oil since he uses host based stateless firewalling, too: "Most services (including RPC) protected by TCP Wrappers. Some services which should only be used within our networks are limited to just those networks. TCP Wrappers also provides consistent logging of accepted and refused connections for services, even those accessible from anywhere."
Answer: Most of your explanations seem to refute a need for a firewall, but I don't see a con to having one, other than the small amount of time to set one up.
Few things are a "necessity" in a strict meaning of the word. Security is more about setting up all the blockades you can. The more work needed to break into your server means less chance of successful attack. You want to make it more work to break into your machines than somewhere else. Adding a firewall makes more work.
I think a key use is redundancy in security. Another plus of firewalls is you can simply drop attempts to connect to any port rather than responding to rejected requests - this will make nmapping a little more inconvenient for an attacker.
Most important to me on the practical note of your question is you can lock SSH, ICMP, and other internal services down to local subnets as well as rate limit incoming connections to help alleviate DOS attacks.
"The point of security isn't to defend yourself after a successful attack - that's already proven to be impossible - it's to keep the attackers out in the first place."
I disagree. Limiting damages can be just as important. (under this ideal why hash passwords? or stick your database software on a different server than your web applications?) I think the old saying "Don't stick all of your eggs in one basket" is applicable here.
Comment: Well, you're right, I didn't put any cons in there. Cons: increased network complexity, single point of failure, single network interface through which bandwidth is bottlenecked. Likewise, administrative mistakes made on one firewall can kill your entire network. And gods forbid that you lock yourself out of it in the meantime when it's a 20 minute trip to the server room.
Comment: This may be purely rhetorical, but when you say "Security is more about setting up all the blockades you can", I would prefer to hear "Security is more about blocking everything by default, and carefully opening the strict minimum to operate".
Comment: +1 A comprehensive security plan covers prevention, detection and response.
Answer: Should I firewall my server? Good question. It would seem that there is little point to slapping a firewall on top of a network stack that already rejects connection attempts to all but the handful of ports that are legitimately open. If there is a vulnerability in the OS that allows maliciously crafted packets to disrupt/exploit a host, would a firewall running on that same host prevent the exploit? Well, maybe ...
And that is probably the strongest reason to run a firewall on every host: A firewall might prevent a network stack vulnerability from being exploited. Is that a strong enough reason? I don't know, but I suppose one could say, "No one ever got fired for installing a firewall."
Another reason to run a firewall on a server is to decouple these two otherwise strongly correlated concerns:

From where, and to what ports, do I accept connections on?
Which services are running and listening for connections?

Without a firewall, the set of services running (along with the configurations for tcpwrappers and such) completely determines the set of ports the server will have open, and from whom connections will be accepted. A host-based firewall gives the admin additional flexibility to install and test new services in a controlled way before making them more widely available. If such flexibility is not required, then there is less reason to install a firewall on a server.
On a final note, there is one item not mentioned in your security checklist that I always add, and that is a host-based intrusion detection system (HIDS), such as AIDE or samhain. A good HIDS makes it extremely difficult for an intruder to make unwanted changes to the system and remain undetected. I believe all servers should be running some kind of HIDS.
Comment: HIDS are great - If you intend to set it and forget it. And never add or delete accounts. Otherwise the vast majority of HIDS logs are going to be long lists of what you did today, and will quickly end up being ignored all the time.
Comment: +1 for mention of HIDS systems.
Comment: No pain, no gain, as they say. On servers with a lot of changes, it is possible to filter out expected noise, leaving you to concentrate on the unexpected.
Answer: A firewall is a tool. It doesn't make things secure in and of itself, but it can make a contribution as a layer in a secure network. That doesn't mean you need one, and I certainly worry about people who blindly say "I've got to get a firewall" without understanding why they think that way and who don't understand the strengths and weaknesses of firewalls.
There are a lot of tools we can say we don't need... Is it possible to run a Windows computer without Antivirus? Yes it is... but it's a nice layer of insurance to have one.
I'd say the same about firewalls - whatever else you can say about them, they are a nice level of insurance. They are not a substitute for patching, for locking machines down, for disabling services you don't use, for logging, etc... but they can be a useful supplement.
I'd also suggest that the equation changes somewhat depending on whether or not you're talking about placing a firewall in front of a group of carefully tended servers, as you seem to be, or a typical LAN with a mix of workstations and servers, some of which might be running some pretty hairy stuff despite the best efforts and wishes of the IT team.
One more thing to consider is the the benefit of creating an obviously hardened target. Visible security, whether it's bright lights, heavy locks and an obvious alarm box on a building; or an obvious firewall on a business' range of IP addresses can deter the casual intruder - they'll go looking for easier prey. This won't deter the determined intruder who knows you have information they want and is determined to get it, but deterring the casual intruders is still worthwhile - especially if you know that any intruder whose probes persists past the deterrent needs to be taken especially seriously.
Comment: Thus the reason I said "servers" instead of "office network"? :) In our case especially, the datacenter and office are two physically separate entities.
Comment: I understand that Ernie, but it's a point that's worth underlining... so I did.
Answer: All great questions. BUT - I'm very surprised PERFORMANCE is not been brought to the table.
For highly (CPU-wise) used Web front ends, local firewall really degrades performance, period. Try a load test and see. I saw this tons of times. Turning off firewall increased performance (request per-sec) by 70% or more.
This trade-off must be considered.
Comment: It depends very much on the firewall rules in place.  Firewall rules are sequentially run on every packet, so you don't want to have hundreds of rules that have to be looked at.  Last winter when we managed a site that had an advertisement on the superbowl, the firewall rules were not a problem, for example.  But I do agree that you need to understand the performance impact of firewall rules.
Answer: A firewall is additional protection. Three particular scenarios it protects against are network stack attacks (i.e. your server OS has a vulnerability to on specially crafted packets that never reach the level of ports), a successful intrusion making a connection to "phone home" (or send spam, or whatever), or a successful intrusion opening a server port or, less detectable, watch for a port knocking sequence before opening a port. Granted, the last two have to do with mitigating the damage of an intrusion rather than preventing it, but that doesn't mean it's useless. Remember that security is not an all-or-nothing proposition; one takes a layered approach, belt and suspenders, to achieve a level of security that is sufficient for your needs.
Comment: I fail to see how I can have any expectation of blocking outbound traffic to any effect, especially when our customers expect many of our servers to send mail to random hosts on the internet (as is the case with spam). "Phoning home" is just a matter of connecting to some other random host on the net - and I doubt that blocking all outbound connections save for a few will help anything at all - that is, if you want to do *anything* on the internet. And blocking just a few ports is kind of like setting up a toll booth in the middle of the desert.
Comment: +1 Absolutely, defence in depth is key.
Answer: I'm no security expert by any means, but it sounds as though you are firewall'ed. It seems as though you've taken some of the core functionality of a firewall and made it part of your policies and procedures. No, you don't need a firewall if you are going to do the same job as a firewall yourself. As for myself, I'd rather do the best I can in keeping up security, but have a firewall looking over my shoulder, but at some point when you can do everything the firewall is doing, it starts to become irrelevant.
Answer: A firewall is certainly not needed for smaller setups. If you have one or two servers, software firewalls are maintainable. With that said, we don't run without dedicated firewalls, and there are a few reasons why I maintain this philosophy:
Separation of Roles
Servers are for applications. Firewalls are for packet inspection, filtering, and policies. A web server should worry about serving web pages, and that's it. Putting both roles in one device is like asking your accountant to also be your security guard.
Software is a moving target
The software on the host is always changing. Applications can create their own firewall exceptions. The OS is updated and patched. Servers are a high-traffic "admin" area, and your firewall policies/security policies are often way more important to security than your application configurations. In a Windows environment, suppose somebody makes a mistake at some Group Policy level and turns Windows Firewall off on the desktops PCs, and doesn't realize that it's going to get applied to the servers. You're wide open in a matter of clicks.
Just speaking to updates, firewall firmware updates generally come out once or twice a year, while OS and service updates are a constant stream.
Reusable services/policies/rules, manageability
If I set up a service/policy called "Web Server" once (say TCP 80 and TCP 443), and apply it to the "web servers group" at the firewall level, that is much more efficient (a couple of configuration changes) and exponentially less prone to human error than setting up firewall services on 10 boxes, and opening up 2 ports x 10 times. When that policy needs to change, it's 1 change vs. 10.
I can still manage a firewall during an attack, or after a compromise
Say my host-based firewall + application server is getting attacked and CPU is off the chart. To even start to figure out what's happening, I am at the mercy of my load being less than the attacker's to even get in and look at it.
An actual experience - I once messed up a firewall rule (left ports to ANY instead of a specific one, and server had a vulnerable service), and the attacker actually had a live Remote Desktop session to the box. Every time I'd start to get a session, the attacker would kill off/disconnect my session. If it wasn't for being able to shut down that attack from an independent firewall device, that could have been a lot worse.
Independent Monitoring
The logging in dedicated firewall units is usually far superior to host-based software firewalls. Some are good enough that you don't even need external SNMP / NetFlow monitoring software to get an accurate picture.
IPv4 Conservation
There is no reason to have two IP addresses if one is for web and one is for mail. Keep the services on separate boxes, and route the ports appropriately via the device designed to do that.
Answer:
Blockquote
  Well, you're right, I didn't put any cons in there. Cons: increased network complexity, single point of failure, single network interface through which bandwidth is bottlenecked. Likewise, administrative mistakes made on one firewall can kill your entire network. And gods forbid that you lock yourself out of it in the meantime when it's a 20 minute trip to the server room.

First, adding at most one additional routed hop through your network is not complex. Second, no firewall solution implemented with any single point of failure is completely useless. Just like you cluster your important server or services and use bonded NICs, you implement highly available firewalls. Not doing so, or not recognizing and knowing that you'd do so is very short sighted. Simply stating that there is a single interface does not automatically make something a bottleneck. That assertion shows that you have no idea how to properly plan and deploy a firewall sized to handle the traffic that would flow through your network. You are correct in saying that a mistake in policy can cause harm to your entire network, but I'd argue that maintaining individual policies on all your servers is far more error prone that a single place.
As for the argument that you keep up with security patching and follow security guides; that's a shaky argument at best. Typically security patches aren't available until after a vulnerability is discovered. That means that the entire time you're running publicly addressable servers they are vulnerable until they are patched. As others have pointed out, IPS systems can help prevent compromises from such vulnerabilities.
If you think your systems are as safe as they can be, that's a good confidence to have. However, I'd recommend you have a professional security audit performed on your network. It may just open your eyes.
Comment: `It may just open your eyes.` +1 as it will be the last nail in the coffin.
Answer: In general, security is an onion thing, as already mentioned. There are reasons firewalls exist, and it's not just all the other lemmings being stupid morons.
This answer comes, as searching for 'fail2ban' on this page did not give me any results. So if I double other content, bear with me. And excuse me, if I rant a little, I provide plain experience as this might come in handy for others. :)
Networking considerations, local vs. external
This is rather Linux specific and concentrates on host based firewalling, which is usually the use case. External firewalling goes hand in hand with a proper network structure and other security considerations usually go into that. Either you know what is implied here, then you will likely not need this posting. Or you don't, then just read on.
Running firewalls externally and locally may seem counter-intuitive and double work. But this also gives the possibility turn of the rules on the external one, without compromising security on all other hosts being behind it. The need could arise from either debugging reasons or because somebody has just fucked up. Another use case will come down there in the 'adaptive global firewalling' section, for which you will also need both global and local firewalls.
Cost and availability and the same story all the time:
Firewalling is just one aspect of a proper secured system. Not installing a firewall as it 'costs' money, introduces a SPOF or whatever is just bullshit, pardon my French here. Just setup a cluster. Oh, but what if the fire cell has an outage? Then setup your cluster on spanning two or more fire compartments.
But what if the whole datacenter is unreachable, as both of the external carriers are out of business (excavator killed your fiber)? Just make your cluster spanning several datacenters, then.
That's expensive? Clusters are too complex? Well, paranoia has to be paid for.
Just whining about SPOFs, but not wanting to pay more money or creating little more complex setups is a clear case of double standards or just a small wallet on company or customer side.
This pattern applies to ALL these discussions, no matter which service is the current matter of the day. No matter if it's a VPN gateway, a Cisco ASA used just for firewalling, a MySQL or PostgreSQL database, a virtual system or server hardware, a storage backend, switches/routers, ...
By now you should get the idea.
Why bother with firewalling?
In theory your reasoning is sound. (Only running services can be exploited.)
But this is only half the truth. Firewalling, especially stateful firewalling can do much more for you. Stateless firewalls are only important if you experience performance issues like others already mentioned.
Easy, central, discrete access control
You mentioned TCP wrappers - these implement basically the same functionality for securing your environment. Because ACLs, by the way, are also just feature-incomplete host-based stateless firewalls.
For the sake of the argument, let's assume someone doesn't know of tcpd and likes using a mouse? fwbuilder might come into mind.
Having full access from your management network is something you should have enabled, which is something of the first use cases of your host based firewall.
How about a multi-server setup, where the database runs somewhere else and you cannot put both/all the machines within a shared (private) subnet for whatever reason? Use the firewall to allow MySQL access on port 3306 only for the single given IP address of the other server, done, simple.
And that also works flawlessly for UDP. Or whatever protocol. Firewalls can be so damn flexible. ;)
Portscan mitigation
Further, with firewalling, general portscans can be detected and mitigated as the amount of connections per timespan can be monitored via the kernel and its networking stack, and the firewall can act upon that.
Also invalid or obscure packets can be handled prior to them ever reaching your application.
Outbound traffic limiting
Filtering outbound traffic is usually a pain in the ass. But it can be a must, depending on contract.
Statistics
Another thing that a firewall can give you, is statistics. (Think watch -n1 -d iptables -vnxL INPUT with having added some rules for special IP addresses right at the top to see if packets are coming through.)
You can see in plain daylight if things work or they do not. Which is VERY useful when troubleshooting connections and being able to tell the other person on the telephone you do not get packets, without having to resort to chatty tcpdump's. Networking is fun, most people just do now know what they are doing, and all to often it's just simple routing errors. Hell, even I don't always know what I am doing. Although I have worked with literally dozens of complex systems and appliances, often with tunneling, too, by now.
IDS/IPS
Layer7 firewalling is usually snake-oil (IPS/IDS), if not attended properly and updated regularly. Plus the licenses are damn expensive, so I'd spare getting one if you have no real need for getting everything money can buy you.
Masqerading
Easy, just try this with your wrappers. :D
Local port forwarding
See masquerading.
Securing password access channels with dynamic IP addresses
What about if customers have dynamic IP addresses and there is not a VPN setup deployed? Or other dynamic approaches to firewalling? This is already hinted at in the question, and here will come a use case for the Unfortunately, I can't find any firewalls that do that. part.
Having disabled the root account access via a password is a must. Even if access is limited to certain IP addresses.
Also, still having another blanko account ready with a password login if ssh keys get lost or deployment fails is very handy if something goes really wrong (a user has administrative access to the machine and 'things happened'?). It is the same idea for network access as it is having single-user mode on Linux or using init=/bin/bash via grub for local access really really bad and cannot use a live disk for whatever reason. Don't laugh, there are virtualization products prohibiting that. Even if the functionality exists, what if an outdated software version is run lacking the functionality?
Anyway, even if you run your ssh daemon on some esoteric port and not on 22, if not having implemented things like port knocking (to open even another port and thus mitigating portscans, slowly bordering on being too impractical), port scans will detect your service eventually.
Usually you also set up all servers with the same configuration, with the same ports and services for efficiency reasons. You cannot set up ssh to a different port on every machine. Also you cannot change it on all machines every time you consider it being 'public' information, because it already is after a scan. The question of nmap being legal or not is not an issue when having a hacked Wi-Fi connection at your disposal.
If this account is not named 'root', people may not be able to guess the user account name of your 'backdoor'. But they will know, if they get another server from your company, or just buy some webspace, and have an unchrooted/unjailed/uncontainered look at /etc/passwd.
For purely theoretical illustration now, they could use a hackable website there to gain access to your server and look up how things are usually run at your place. Your hack search tools might not run 24/7 (usually they do at night for disk performance reasons for the filesystem scans?) and your virus scanners are not updated the second a new zero-day sees the light of the day, so it will not detect these happenings at once, and without other protection measures you may never even know what happened. To get back to reality, if someone has access to zero-day exploits, it's very likely he will not target your servers anyway as these are just expensive. This is just for illustrating that there is always a way into a system if the 'need' arises.
But on the topic again, just don't use an extra passworded account, and don't bother? Please read on.
Even if attackers to get the name and port of this extra account, a fail2ban + iptables combination will stop them short, even if you used only an eight-letter password. Plus fail2ban can be implemented for other services, too, widening the monitoring horizon!
For your own services, if the need ever arose: Basically every service logging failures to a file can get fail2ban support via providing a file, what regex to match and how many failures are allowed, and the firewall will just happily ban every IP address it is told to.
I am not telling to use 8-digit passwords! But if they get banned for 24 hours for five wrong password tries, you can guess how long they will have to try if they do not have a botnet at their disposal even with such lousy security. And you'd be astonished what passwords customers tend to use, not just for ssh. Having a look at peoples' mail passwords via Plesk tells you everything you'd rather not want to know, if you'd ever do, but what I am not trying to imply here of course. :)
Adaptive global firewalling
fail2ban is just one application which uses something along the lines of iptables -I <chain_name> 1 -s <IP> -j DROP, but you can easily build such stuff yourself with some Bash magic quite fast.
To further expand something like this, aggregate all fail2ban IP addresses from servers within your network on an extra server, that curates all the lists and passes it in turn to your core firewalls blocking all the traffic already on the edge of your network.
Such functionality cannot be sold (of course it can, but it will just be a brittle system and suck), but has to be interweaved into your infrastructure.
While at it, you can also use blacklist IP addresses or lists from other sources, be it aggregated by yourself or external ones.
Answer: First of all, by your talk about port forwarding, I think you're conflating firewalling with NATing. While these days NATs very often function as de facto firewalls, that it is not the purpose for which they were designed. NAT is a routing tool. Firewalls are for regulating access.  It's important for clarity of thought to keep these concepts distinct.
It is of course true that putting a server behind a NAT box and then configuring the NAT to forward anything to that server, is no more secure than putting the server directly on the Internet. I don't think anyone would argue with this.
Similarly, a firewall configured to allow all traffic is no firewall at all.
But, is "allow all traffic" really the policy you want? Does anyone ever have a need to ssh to any of yours servers from a Russian IP address?  While you're tinkering with the configuration of some new experimental network daemon, does the whole world really need access to it?
The power of a firewall is that it lets you keep open only those services that you know need to be open and maintain a single point of control for implementing this policy.
Comment: All of your points have been addressed in my question. Yes, "allow all traffic" is really the policy we want for non-management services like SSH or some server's management port. Otherwise people wouldn't be able to see our web pages and send us mail!
Comment: As for only keeping open those services that need to be, that's what steps 1 and 4 are for.
Answer: In the physical world, people secure valuables by putting them in safes.  But there is no safe that cannot be broken into.  Safes, or security containers, are rated in terms of how long it takes to force entry.  The purpose of the safe is to delay the attacker long enough that they are detected and active measures then stop the attack.
Similarly, the proper security assumption is that your exposed machines will, eventually, be compromised.  Firewalls and bastion hosts are not set up to prevent your server (with your valuable data) from compromise, but to force an attacker to compromise them first and allow you to detect (and deter) the attack before the valuables are lost.
Note that neither firewalls nor bank vaults protect against insider threats.  That's one reason for bank accountants to take two weeks leave consecutively, and for servers to have full internal security precautions even though protected by bastion hosts.
You seem to imply in the original post that you are forwarding "outside world" packets through your firewall directly to your server.  In that case, yes, your firewall isn't doing very much.  A better perimeter defense is done with two firewalls and a bastion host, where there is no direct logical connection from outside to inside -- every connection terminates in the DMZ bastion host; every packet is examined appropriately (and possibly parsed out) before forwarding.
Comment: @Per Wiklander - GAAP include regular check audits.  An embezzling accountant may be able to cook the numbers and prevent discovery during those check audits when present, but if required to be away from the job for two consecutive weeks someone else will be reporting and their malfeasance can be discovered.  It's a form of two-person control.
Comment: "That's one reason for bank accountants to take two weeks leave consecutively" can you clarify on that one? Might not be important here, but I got interested.
Comment: -1 because I already covered the fact that you don't have to break into a firewall before you break into a server - The firewall *must* allow the public to have access to a service that you are *offering* to the public, therefore the server itself is open to attack from the public. There are no services on any of our servers that we do not already *want* the public to have access to.
Comment: @Ernie - You miss the point.  A bastion host design DMZ isolates a host by firewalls on both sides.  That host *is* exposed to attack, and will eventually be subverted.  But that host is *not* your server and properly will have minimal amounts of your critical information on it.  The DMZ (host+firewalls) slows down an attack on your server long enough that you can respond and prevent its success.
Comment: How does the bastion host protect anything on the servers? An example: Port 80, 25, and 110 are the only open ports on a server. The firewall allows traffic to these ports from the entire internet. Therefore, the firewall protects nothing. If your servers are in a separate location from your office, then you need no further protection except for a firewall at your office.
Answer: Vulnerabilities are hard to predict. It is practically impossible to predict which way your infrastructure is going to get exploited. Having a firewall "raises the bar" for an attacker wanting to exploit a vulnerability, and this is the important part, BEFORE you know what that vulnerability is. Additionally, the ramifications of  the firewall can be easily understood in advance, so you are unlikely to CAUSE problems with a firewall which are more severe than the problems you are likely to avoid.
This is why "nobody ever got fired for installing a firewall". Their implementation is very low risk, and has a HIGH likelihood of either preventing or mitigating an exploit. Also, most really nasty vulnerabilities end up being exploited by automation, so anything "unusual" will end up breaking a  bot, or at least get it to skip you in favor of an easier target.
Side note; firewalls are not for the internet only. Your accounting dept. doesn't need ssh/whatever to your ldap server, so don't give it to them. Compartmentalizing internal services can make a big difference to the cleanup job in the event that something DOES breach the castle walls.
Comment: True, but that same server probably has port 3306 (mysql) and a variety of other protocols which would potentially benefit from a firewall.

That is not to say that you should have no other protection; just that the firewall isn't going to hurt. Also, I think you missed my point that all traffic doesn't need to be open for all users. Port 22 may need to be open, but not on ALL your hosts, and certainly not to the entire internet (or accounting and HR either). Closing 25 for accounting if they are supposed to operate over 465 may mitigate some spam malware for example.
Comment: Having a firewall doesn't raise the bar when you need to have firewall rules opening ports 80, 53, 25, 110, 143, 443, 993, 995 and more to the entire internet. Those servers are just as vulnerable with a firewall as without, if you need to have rules like that.
Answer: Have to say Ernie that whilst you seem do a lot to harden your servers and mitigate against attacks and vulnerabilities, I don't agree with your stance on firewalls.
I treat security a bit like an onion in that ideally you have layers that you have to get through before you get to the core, and personally I think it's grossly misguided not to have some form of hardware firewall at your network perimeter.
I'll admit I'm coming at this from the "what I'm used to" angle, but I know that every single month I get a nice little list of that months patches from Microsoft, many of them being exploited in the wild.  I'd imagine the same happens for pretty much any OS and set of applications you care to think of.
Now I'm not suggesting firewalls do away with this, nor are firewalls immune to having bugs/vulnerabilities, obviously a "hardware" firewall is just software running on a hardware stack.
That said, I sleep a lot safer knowing that if I have a server that needs only port 443 to be accessible from the web, my perimeter Juniper ensures that only port 443 is accessible from the web.  Not only that but my Palo Alto ensures that the traffic coming in is decrypted, and inspected, and logged, and scanned for IPS/IDS - not that it does away with the need to keep the server(s) secure and up to date, but why would you NOT find that a benefit given that it can mitigate for zero-day exploits and good old human error?
Answer: Stateful packet inspection firewalls do NOT belong in front of public servers. You're accepting all connections, so the state tracking is pretty useless. Traditional firewalls are a huge liability in DDoS attacks and are typically the first thing to fail under DDoS attack, even before link bandwidth or server resources are totally consumed.
Stateless packet filters on routers do make sense in front of public servers, but only if they can handle line rate of all the ingress and egress traffic (such as a hardware ACL in a router).
Google, Facebook, and even Microsoft do not put traditional "firewalls" in front of public servers. Anyone who has run public web services at "more than one server" scale should know this.
Other functions found in traditional firewalls such as Cisco ASAs or whatever are best implemented on the hosts themselves, where they can be scaled out effectively. Logging, IDS, etc. are all software features in firewalls anyway, so they just become a huge bottleneck and DDoS target if put in front of publicly accessible servers.
Comment: I think context matters. The OP likely wasn't speaking about web-scale systems, where load balancing and firewalling would be implemented much differently than the back-office technology stack of an SMB.
Comment: Even in front of a single server, a stateful firewall doesn't do much of anything to help you if you're accepting connections from everywhere. You need to be using TLS or other encryption for everything anyway, so all a firewall can do is say "hey, there goes some more data past me on port 443". Firewalls are pretty much dead: http://etherealmind.com/why-firewalls-wont-matter-in-a-few-years/
Answer: Why do all of your servers need a public address?

Install the server in the server room
  and give it a public IP address.

Out of 14 or so servers that I run on a regular basis, only 2 have publicly accessible interfaces.
Edited to add:  In other networks that I've had a hand in managing, we've had the ability to turn off/on services at will, whereas we didn't have access to manage the firewall.  I cannot even begin to tell you how many times, inadvertently of course, an unneeded service (SMTP) got turned on and left on and the only thing saving us from becoming a spam dump and getting blacklisted in the process, was a firewall.
Also, is all of the traffic that passes between servers, fully encrypted?
You can certainly drive a car 100 mph with no seatbelts, no airbags and bald tires, but why would you??
Comment: I didn't say, EVER, that firewalls were the be-all or end-all of security.  I won't repeat what's already been said here.  They are but one LAYER in many LAYERS of security.  I've asked you twice now and you haven't answered.  Servers on a LAN are chatty things.  Do all of your servers only talk over encrypted channels to each other?
Comment: Because they may all have services that need to be accessed "from the Internet"
Comment: Um, no. More like driving a car at 70 mph with seatbelts and airbags while paying attention to what you're doing. But without locking your doors. There's a security policy in place, and the servers are kept secure, but there's no firewall. Firewalls are not the be-all and end-all of security, you know.
Answer: Firewalls can prevent system users from opening up network-accessible services that the administrators aren't aware of, or doing port forwarding to other machines.  By making use of the hashlimit module, firewalls can also rate-limit abusers based on the remote IP.
A firewall is another safety net that ensures your policies are adhered to.  Sure, don't run services you don't expect to.
I definitely recommend that software updates are applied in a timely manner, for example, but I also recommend firewalls on all machines.  It's like when I drive: Sure I try to avoid obstacles and other cars, but I also wear a seatbelt and have airbags just in case the unexpected happens.
Answer: You may not be realizing how much you are benefiting from firewalls simply because everybody else is using them. In a day when literally everyone, down to home DSL users have firewalls in place port sniffing has been all but given up as a feasible attack vector. A decent hacker isn't going to waste their time checking for such things.

Why should I firewall servers?